mcplane 0.4.1 → 0.5.1

package/dist/checks/chain.js

@@ -0,0 +1,171 @@
+import { metadata } from './oauth.js';
+const BROWSER_UA = 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0 Safari/537.36';
+/** Where ChatGPT sends the user back; an authorization server reporting an error redirects here, and we stop. */
+const REDIRECT_URI = 'https://chatgpt.com/connector_platform_oauth_redirect';
+/** RFC 7636's example S256 challenge: fixed, so the request is the same every run. */
+const CHALLENGE = 'E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM';
+const MAX_REDIRECTS = 5;
+const MAX_PAGES = 6;
+/** Every GET the chain makes, redirects included. */
+const MAX_REQUESTS = 16;
+/** Host or path words that mark a sign-in page or an identity provider. */
+const AUTHISH = /(^|[./-])(accounts?|auth|authorize|login|log-in|signin|sign-in|sso|oauth2?|identity|idp|clerk|auth0|okta|cognito|stytch|workos|kinde|descope|frontegg|microsoftonline|appleid)([./-]|$)/i;
+const ASSET = /\.(css|png|jpe?g|gif|svg|webp|ico|woff2?|ttf|map)(\?|$)/i;
+/** A bot challenge or a refusal, read from the response the way a browser would get it. */
+export function wallOf(status, headers) {
+    const cf = headers.get('cf-mitigated');
+    if (cf && /challenge/i.test(cf))
+        return 'Cloudflare challenge (cf-mitigated: challenge)';
+    const aws = headers.get('x-amzn-waf-action');
+    if (aws && /challenge|captcha/i.test(aws))
+        return `AWS WAF ${aws.toLowerCase()} (x-amzn-waf-action)`;
+    const vercel = headers.get('x-vercel-mitigated');
+    if (vercel && /challenge/i.test(vercel))
+        return 'Vercel challenge (x-vercel-mitigated: challenge)';
+    if (status === 403)
+        return 'HTTP 403';
+    return null;
+}
+/** Sign-in pages and identity-provider URLs a page links to or loads. */
+export function authLinks(html, base) {
+    const found = new Set();
+    const add = (raw) => {
+        try {
+            const u = new URL(raw.replace(/&/g, '&'), base);
+            if (u.protocol !== 'https:' && u.protocol !== 'http:')
+                return;
+            u.hash = '';
+            if (ASSET.test(u.pathname) || !AUTHISH.test(`${u.hostname}${u.pathname}`))
+                return;
+            found.add(u.toString());
+        }
+        catch { }
+    };
+    for (const m of html.matchAll(/\b(?:href|src|action)\s*=\s*["']([^"'<>\s]+)["']/gi))
+        add(m[1]);
+    for (const m of html.matchAll(/https:\/\/[a-z0-9.-]+\.[a-z]{2,}(?:\/[^\s"'<>`)\\]*)?/gi))
+        add(m[0]);
+    for (const m of html.matchAll(/<meta[^>]+http-equiv\s*=\s*["']refresh["'][^>]*content\s*=\s*["'][^"']*?\burl\s*=\s*([^"']+)["']/gi))
+        add(m[1].trim());
+    return [...found];
+}
+async function fetchHop(url) {
+    const res = await fetch(url, {
+        redirect: 'manual',
+        headers: { 'user-agent': BROWSER_UA, accept: 'text/html,application/xhtml+xml,*/*;q=0.8', 'accept-language': 'en' },
+        signal: AbortSignal.timeout(10_000),
+    }).catch((e) => e);
+    if (res instanceof Error)
+        return { hop: { url, status: 0, wall: null, error: res.name === 'TimeoutError' ? 'timed out' : res.message } };
+    const type = res.headers.get('content-type') ?? '';
+    const location = res.headers.get('location') ?? undefined;
+    const text = /html|json|text/.test(type) && !location ? await res.text().catch(() => '') : '';
+    let said;
+    if (res.status >= 400 && text) {
+        const json = /json/.test(type) ? (() => { try {
+            return JSON.parse(text);
+        }
+        catch {
+            return null;
+        } })() : null;
+        said = json?.error ? String(json.error) : /plain/.test(type) ? text.trim().slice(0, 60) : undefined;
+    }
+    const hop = { url, status: res.status, wall: wallOf(res.status, res.headers), location, contentType: type.split(';')[0] || undefined, said };
+    return { hop, html: /html/.test(type) ? text : undefined };
+}
+/** GETs a URL and follows its redirects by hand, recording every hop. Never follows into the client's redirect URI. */
+export async function walk(start, budget = { left: MAX_REQUESTS }) {
+    const hops = [];
+    let url = start;
+    for (let i = 0; i <= MAX_REDIRECTS && budget.left > 0; i++) {
+        budget.left--;
+        const { hop, html } = await fetchHop(url);
+        hops.push(hop);
+        if (!hop.location || hop.status < 300 || hop.status >= 400)
+            return { hops, html, last: url };
+        const next = new URL(hop.location, url).toString();
+        if (next.startsWith(REDIRECT_URI) || !/^https?:/.test(next))
+            return { hops, last: url };
+        url = next;
+    }
+    return { hops, last: url };
+}
+/** The authorization request a client would open, for a client that isn't registered. */
+export function authorizeUrl(endpoint, md, resource) {
+    const u = new URL(endpoint);
+    const scopes = Array.isArray(md.scopes_supported) ? md.scopes_supported : [];
+    const q = {
+        response_type: 'code',
+        client_id: 'mcplane-preflight',
+        redirect_uri: REDIRECT_URI,
+        state: 'mcplane',
+        code_challenge: CHALLENGE,
+        code_challenge_method: 'S256',
+        resource,
+        ...(scopes.length ? { scope: scopes.join(' ') } : {}),
+    };
+    for (const [k, v] of Object.entries(q))
+        u.searchParams.set(k, v);
+    return u.toString();
+}
+const show = (h) => `${h.url.split('?')[0]}: ${h.wall ?? (h.error ? h.error : `HTTP ${h.status}${h.said ? ` (${h.said})` : ''}`)}`;
+/** The chain's hops as one check. Exported for tests. */
+export function chainCheck(start, pages, opts) {
+    const title = 'Reviewers can reach your sign-in page';
+    const all = [...start, ...pages.flat()];
+    const walls = all.filter((h) => h.wall);
+    if (walls.length) {
+        return {
+            id: 'auth.chain',
+            level: 'warn',
+            title,
+            detail: walls.map(show).join('; '),
+            fix: 'A bot challenge or a 403 on the sign-in chain leaves the OAuth window blank for reviewers, who sign in from data-centre networks, often through a TLS-inspecting proxy. ChatGPT reports it as "Sign-in could not load". Exempt the authorization endpoint, consent page and sign-in hosts from bot challenges (in Cloudflare, a WAF skip rule for Bot Fight Mode and managed challenges on those hosts and paths), or serve sign-in from a host without one. A pass from your own network proves less: run this again from a cloud VM or CI.',
+        };
+    }
+    const visited = [...new Set(all.filter((h) => !h.error).map((h) => new URL(h.url).host))];
+    const failed = all.filter((h) => h.error);
+    if (opts.stoppedEarly && !opts.seeded && !pages.length) {
+        return {
+            id: 'auth.chain',
+            level: 'info',
+            title,
+            detail: `stopped at the authorization endpoint: ${show(start[start.length - 1])}. Without a registered client it doesn't send anyone on to sign in`,
+            fix: 'List the sign-in page and identity-provider URLs your consent screen uses in server.signIn in mcplane.json (or pass --sign-in <url>), and preflight checks them for bot challenges and 403s too.',
+        };
+    }
+    return {
+        id: 'auth.chain',
+        level: 'pass',
+        title,
+        detail: `no bot challenge or 403 on ${visited.join(', ') || 'the chain'}${failed.length ? `; no answer from ${failed.map(show).join(', ')}` : ''}`,
+    };
+}
+export async function chainChecks(m, d) {
+    const md = metadata(d);
+    const endpoint = md?.authorization_endpoint;
+    if (typeof endpoint !== 'string' || !/^https?:\/\//.test(endpoint))
+        return [];
+    const budget = { left: MAX_REQUESTS };
+    const start = await walk(authorizeUrl(endpoint, md, m.server.url), budget);
+    const last = start.hops[start.hops.length - 1];
+    // A 4xx with no page to read means the server wants a registered client before it goes any further.
+    const stoppedEarly = !start.html && last.status >= 400;
+    const seeds = (Array.isArray(m.server.signIn) ? m.server.signIn : typeof m.server.signIn === 'string' ? [m.server.signIn] : []).filter((u) => /^https?:\/\//.test(u));
+    const seen = new Set([...start.hops.map((h) => h.url)]);
+    const queue = [...seeds, ...(start.html ? authLinks(start.html, start.last) : [])].filter((u) => !seen.has(u));
+    const pages = [];
+    // Two rounds: the pages the chain names, then the identity-provider hosts those pages load.
+    for (let round = 0; round < 2 && queue.length && pages.length < MAX_PAGES && budget.left > 0; round++) {
+        const batch = [...new Set(queue.splice(0))].filter((u) => !seen.has(u)).slice(0, Math.min(MAX_PAGES - pages.length, budget.left));
+        batch.forEach((u) => seen.add(u));
+        const results = await Promise.all(batch.map((u) => walk(u, budget)));
+        for (const r of results) {
+            pages.push(r.hops);
+            r.hops.forEach((h) => seen.add(h.url));
+            if (r.html)
+                queue.push(...authLinks(r.html, r.last));
+        }
+    }
+    return [chainCheck(start.hops, pages, { stoppedEarly, seeded: seeds.length > 0 })];
+}

package/dist/checks/listing.js

@@ -1,38 +1,43 @@
 import { forStore } from '../draft.js';
+import { imageInfo } from '../images.js';
 const get = (url) => fetch(url, { redirect: 'follow', signal: AbortSignal.timeout(12_000), headers: { 'user-agent': 'mcplane' } }).catch(() => null);
-/** Width and height from a PNG's IHDR chunk. */
-function pngSize(buf) {
-    if (buf.length < 24 || buf[0] !== 0x89 || buf[1] !== 0x50)
-        return null;
-    const v = new DataView(buf.buffer, buf.byteOffset);
-    return { w: v.getUint32(16), h: v.getUint32(20) };
-}
 const has = (stores, ...s) => s.some((x) => stores.includes(x));
+const MIB = 1024 * 1024;
+/** OpenAI's limit for plugin.json's root description, which the ChatGPT package fills from the one-liner. */
+const PLUGIN_DESCRIPTION_MAX = 1024;
 export async function listingChecks(m, tools, stores) {
     const checks = [];
     const origin = new URL(m.server.url).origin;
     // Icon
     if (!m.icon) {
-        checks.push({ id: 'listing.icon', level: 'warn', title: 'An icon URL is set', fix: 'Set "icon" to a direct PNG URL, at least 512×512. ChatGPT needs one uploaded; Claude asks for a direct .png/.svg URL when the favicon fails.' });
+        checks.push({ id: 'listing.icon', level: 'warn', title: 'An icon URL is set', fix: 'Set "icon" to a direct PNG URL, at least 512×512. ChatGPT needs one in its package; Claude asks for a direct .png/.svg URL when the favicon fails.' });
+    }
+    else if (!/^https?:\/\//i.test(m.icon)) {
+        // A local file works for the ChatGPT package, which bundles it; every other store needs a link.
+        const others = stores.filter((s) => s !== 'chatgpt');
+        checks.push(others.length
+            ? { id: 'listing.icon', level: 'warn', title: 'The icon is a URL', detail: `${m.icon} is a local file`, fix: '"mcplane pack chatgpt" bundles a local icon, but Claude and the other stores need a direct URL. Set "icon" to the URL and "chatgpt.logo" to the file.', stores: others }
+            : { id: 'listing.icon', level: 'info', title: 'The icon is a local file', detail: m.icon, fix: '"mcplane pack chatgpt" bundles it and checks its size.', stores: ['chatgpt'] });
     }
     else {
         const res = await get(m.icon);
         const type = res?.headers.get('content-type') ?? '';
         const buf = res?.ok ? new Uint8Array(await res.arrayBuffer()) : null;
-        const size = buf ? pngSize(buf) : null;
+        const img = buf ? imageInfo(buf) : null;
+        const size = img?.width !== undefined && img.height !== undefined ? `${img.width}×${img.height}` : '';
         if (!res?.ok) {
             checks.push({ id: 'listing.icon', level: 'fail', title: 'The icon URL loads', detail: `HTTP ${res?.status ?? 'error'}`, fix: 'Point "icon" at a URL that returns the image directly.' });
         }
         else if (!/\.(png|svg|jpe?g|gif|ico|webp)(\?|$)/i.test(m.icon)) {
             checks.push({ id: 'listing.icon', level: 'warn', title: 'The icon URL ends in an image extension', detail: m.icon, fix: 'Anthropic asks for an icon URL ending in .png, .svg, .jpg, .gif, .ico or .webp.', stores: ['claude-connectors'] });
         }
-        else if (type.includes('png') && size && (size.w < 512 || size.w !== size.h)) {
-            checks.push({ id: 'listing.icon', level: 'warn', title: 'The icon is square and at least 512 px', detail: `${size.w}×${size.h}`, fix: 'Use a square PNG of 512×512 or more; ChatGPT’s directory icon must be at least 256, and a 512 master covers every store.' });
+        else if (img?.format && size && (img.width !== img.height || (img.format !== 'svg' && img.width < 512))) {
+            checks.push({ id: 'listing.icon', level: 'warn', title: 'The icon is square and at least 512 px', detail: `${img.format.toUpperCase()}, ${size}`, fix: 'Use a square image of 512×512 or more, or a square SVG. ChatGPT’s package takes 48 to 4096 px, and a 512 master covers every store.' });
         }
         else {
-            checks.push({ id: 'listing.icon', level: 'pass', title: 'The icon loads', detail: `${type}${size ? `, ${size.w}×${size.h}` : ''}, ${buf ? Math.round(buf.length / 1024) : '?'} KB` });
-            if (buf && buf.length > 10 * 1024 && has(stores, 'chatgpt')) {
-                checks.push({ id: 'listing.icon-small', level: 'warn', title: 'A small icon is available for ChatGPT’s dialogs', detail: `${Math.round(buf.length / 1024)} KB`, fix: 'ChatGPT’s icon upload in developer mode caps at 10 KB. Export an 8-bit PNG (pngquant or `magick in.png PNG8:out.png`).', stores: ['chatgpt'] });
+            checks.push({ id: 'listing.icon', level: 'pass', title: 'The icon loads', detail: [img?.format?.toUpperCase() ?? type, size, buf && `${Math.round(buf.length / 1024)} KB`].filter(Boolean).join(', ') });
+            if (buf && buf.length > 5 * MIB && has(stores, 'chatgpt')) {
+                checks.push({ id: 'listing.icon-size', level: 'fail', title: 'The icon fits ChatGPT’s package (5 MiB)', detail: `${(buf.length / MIB).toFixed(1)} MiB`, fix: 'Images in the plugin ZIP are capped at 5 MiB. Export a smaller PNG.', stores: ['chatgpt'] });
             }
         }
     }
@@ -105,6 +110,10 @@ export async function listingChecks(m, tools, stores) {
             checks.push({ id: 'listing.prompts', level: 'pass', title: 'Starter prompts are short, unique and free of @mentions', stores: ['chatgpt'] });
         }
         len(g.description, 4000, 'listing.chatgpt-description', 'Long description for ChatGPT', ['chatgpt']);
+        // plugin.json's root description comes from the one-liner (or subtitle, or title).
+        const root = g.oneLiner ?? g.subtitle ?? g.title;
+        if (root && root.length > PLUGIN_DESCRIPTION_MAX)
+            checks.push({ id: 'listing.plugin-description', level: 'fail', title: `Plugin description fits (${PLUGIN_DESCRIPTION_MAX} characters)`, detail: `${root.length} characters (plugin_description_too_long)`, fix: 'The ChatGPT package uses your one-liner as plugin.json’s description. Shorten it, or give ChatGPT its own in listing.chatgpt.oneLiner.', stores: ['chatgpt'] });
         // The plugin package requires all four listing URLs for MCP review.
         const missing = ['website', 'support', 'privacy', 'terms'].filter((k) => !g.links?.[k]?.startsWith('https://'));
         checks.push(missing.length

package/dist/checks/oauth.d.ts

@@ -0,0 +1,45 @@
+/**
+ * OAuth discovery the way Vercel Connect and MCP clients run it, from the documents alone:
+ * protected-resource metadata (RFC 9728) on the MCP host, then the authorization server's
+ * RFC 8414 metadata and OpenID Connect discovery, path-suffixed forms included. Read-only:
+ * nothing is registered.
+ *
+ * https://vercel.com/docs/connect/providers
+ * https://modelcontextprotocol.io/specification/2026-07-28/basic/authorization/authorization-server-discovery
+ */
+export interface Doc {
+    url: string;
+    /** 0 when nothing answered. */
+    status: number;
+    contentType: string;
+    /** The body, when it parsed as a JSON object. */
+    json: Record<string, any> | null;
+    /** The issuer identifier this URL was built from (RFC 8414 §3.3: the document's issuer must equal it). */
+    forIssuer?: string;
+}
+export interface Discovery {
+    /** The MCP server URL discovery started from. */
+    resource: string;
+    /** Protected-resource metadata, when a well-known URL answered with it. */
+    prm: Doc | null;
+    /** The first authorization server named in the PRM, else the MCP URL itself (what Vercel Connect is given). */
+    issuer: string;
+    /** Every RFC 8414 URL tried, in order, and the one that answered with JSON. */
+    oauthTried: Doc[];
+    oauth: Doc | null;
+    /** Every OpenID Connect URL tried, in order, and the one that answered with JSON. */
+    oidcTried: Doc[];
+    oidc: Doc | null;
+}
+/** Well-known URLs for an issuer or resource. RFC 8414 §3.1 inserts the suffix between host and path; OIDC also appends it. */
+export declare function wellKnown(base: string, suffix: string): {
+    inserted: string | null;
+    origin: string;
+    appended: string | null;
+};
+export declare const isJsonType: (t: string) => boolean;
+/** A document a client would use: 200, served as JSON, a JSON object. */
+export declare const usable: (d: Doc | null | undefined) => d is Doc;
+export declare function discover(resource: string): Promise<Discovery>;
+/** What a client reads: the OAuth document, with gaps filled from OpenID Connect discovery (Vercel Connect does this). */
+export declare const metadata: (d: Discovery | null | undefined) => Record<string, any> | null;

package/dist/checks/oauth.js

@@ -0,0 +1,64 @@
+/**
+ * OAuth discovery the way Vercel Connect and MCP clients run it, from the documents alone:
+ * protected-resource metadata (RFC 9728) on the MCP host, then the authorization server's
+ * RFC 8414 metadata and OpenID Connect discovery, path-suffixed forms included. Read-only:
+ * nothing is registered.
+ *
+ * https://vercel.com/docs/connect/providers
+ * https://modelcontextprotocol.io/specification/2026-07-28/basic/authorization/authorization-server-discovery
+ */
+/** Well-known URLs for an issuer or resource. RFC 8414 §3.1 inserts the suffix between host and path; OIDC also appends it. */
+export function wellKnown(base, suffix) {
+    const u = new URL(base);
+    const path = u.pathname.replace(/\/+$/, '');
+    return {
+        inserted: path ? `${u.origin}/.well-known/${suffix}${path}` : null,
+        origin: `${u.origin}/.well-known/${suffix}`,
+        appended: path ? `${u.origin}${path}/.well-known/${suffix}` : null,
+    };
+}
+export const isJsonType = (t) => /\bjson\b/i.test(t);
+async function getDoc(url, forIssuer) {
+    const res = await fetch(url, { headers: { accept: 'application/json', 'user-agent': 'mcplane' }, redirect: 'follow', signal: AbortSignal.timeout(10_000) }).catch(() => null);
+    const contentType = res?.headers.get('content-type') ?? '';
+    const text = res ? await res.text().catch(() => '') : '';
+    let json = null;
+    try {
+        const v = JSON.parse(text);
+        if (v && typeof v === 'object' && !Array.isArray(v))
+            json = v;
+    }
+    catch { }
+    return { url, status: res?.status ?? 0, contentType, json, forIssuer };
+}
+/** A document a client would use: 200, served as JSON, a JSON object. */
+export const usable = (d) => !!d && d.status === 200 && !!d.json && isJsonType(d.contentType);
+/** Tries each [url, issuer it was built from] in order, skipping forms that don't apply, and stops at the first usable document. */
+async function firstOf(...urls) {
+    const tried = [];
+    for (const [url, issuer] of urls) {
+        if (!url)
+            continue;
+        const d = await getDoc(url, issuer);
+        tried.push(d);
+        if (usable(d))
+            return { tried, hit: d };
+    }
+    return { tried, hit: null };
+}
+export async function discover(resource) {
+    const pr = wellKnown(resource, 'oauth-protected-resource');
+    const prm = await firstOf([pr.inserted, ''], [pr.origin, '']);
+    const named = prm.hit?.json?.authorization_servers;
+    const issuer = Array.isArray(named) && typeof named[0] === 'string' ? named[0] : resource;
+    const as = wellKnown(issuer, 'oauth-authorization-server');
+    const oi = wellKnown(issuer, 'openid-configuration');
+    // The issuer a document must declare is the identifier its URL was built from, exactly. For a path
+    // issuer, the origin form (which Vercel Connect also reads) was built from the origin.
+    const atOrigin = as.inserted ? new URL(issuer).origin : issuer;
+    // MCP clients try the path-suffixed forms first.
+    const [oauth, oidc] = await Promise.all([firstOf([as.inserted, issuer], [as.origin, atOrigin]), firstOf([oi.inserted, issuer], [oi.appended, issuer], [oi.origin, atOrigin])]);
+    return { resource, prm: prm.hit, issuer, oauthTried: oauth.tried, oauth: oauth.hit, oidcTried: oidc.tried, oidc: oidc.hit };
+}
+/** What a client reads: the OAuth document, with gaps filled from OpenID Connect discovery (Vercel Connect does this). */
+export const metadata = (d) => d && (d.oauth || d.oidc) ? { ...(d.oidc?.json ?? {}), ...(d.oauth?.json ?? {}) } : null;

package/dist/checks/readiness.d.ts

@@ -0,0 +1,58 @@
+/**
+ * Readiness for MCP 2026-07-28: warnings and notes, never blockers. The revision drops the
+ * initialize handshake for per-request _meta and server/discover, requires Mcp-Method and Mcp-Name
+ * headers on Streamable HTTP, deprecates Dynamic Client Registration for Client ID Metadata
+ * Documents, and has clients validate the issuer (RFC 8414 §3.3, RFC 9207). A warning means a
+ * 2026-07-28 client would fail today; a note means something deprecated or optional.
+ *
+ * Spec:         https://modelcontextprotocol.io/specification/2026-07-28
+ * Key changes:  https://modelcontextprotocol.io/specification/2026-07-28/changelog
+ * Release post: https://blog.modelcontextprotocol.io/posts/2026-07-28/
+ */
+import { type RpcReply } from '../mcp-client.js';
+import type { Check } from '../types.js';
+import { type Discovery } from './oauth.js';
+export declare const MODERN = "2026-07-28";
+export type Era = 'modern' | 'legacy' | 'auth' | 'broken';
+/**
+ * Reads the answer to a modern server/discover request the way a dual-era client does
+ * (basic/versioning#backward-compatibility): a DiscoverResult or a modern error means a modern
+ * server; a 4xx or a JSON-RPC error that isn't modern means a legacy one, and the client falls
+ * back to initialize. A 5xx, or no JSON-RPC answer at all, gives it nothing to go on.
+ */
+export declare function eraOf(r: RpcReply | null): {
+    era: Era;
+    versions: string[];
+    detail: string;
+};
+export declare function eraCheck(e: ReturnType<typeof eraOf>): Check;
+/**
+ * An initialize that offers 2026-07-28. Under the 2025-11-25 lifecycle a server answers with the
+ * requested version only if it supports it, otherwise with one it does; 2026-07-28 has no initialize
+ * at all, so the right answer is a handshake-era version. A modern-only server rejects initialize
+ * and SHOULD name its versions in the error (basic/versioning).
+ * https://modelcontextprotocol.io/specification/2025-11-25/basic/lifecycle#version-negotiation
+ */
+export declare function initializeCheck(r: RpcReply | null, era: Era): Check;
+/** Modern servers: a tools/list carrying Mcp-Method is the ordinary case. A strict server rejects one without it (-32020). */
+export declare function modernHeaderCheck(r: RpcReply | null): Check;
+/** Legacy servers: the same tools/list with and without the new headers should get the same answer. */
+export declare function legacyHeaderCheck(plain: RpcReply | null, tagged: RpcReply | null): Check;
+/** Browser clients send both headers on every POST, so the CORS preflight must allow them. Null when the server doesn't answer CORS at all (server.cors covers that). */
+export declare function corsCheck(allowOrigin: string | null, allowHeaders: string | null): Check | null;
+/**
+ * MCP Events is a draft, not part of 2026-07-28: events/list, events/poll, events/stream and
+ * events/subscribe, from the Triggers and Events Working Group. Reported, never a warning.
+ * https://github.com/modelcontextprotocol/experimental-ext-triggers-events/blob/main/docs/design-sketch-proposal.md
+ */
+export declare function eventsCheck(r: RpcReply | null): Check;
+/** 2026-07-28 clients MUST check the metadata's issuer against the issuer they built the URL from, and MUST NOT use it otherwise (authorization-server-discovery). */
+export declare function issuerCheck(d: Discovery): Check | null;
+/** client_id_metadata_document_supported: DCR is deprecated in 2026-07-28 for CIMD, removable from the first revision on or after 2027-07-28. */
+export declare function cimdCheck(md: Record<string, any>): Check;
+/** authorization_response_iss_parameter_supported (RFC 9207): a SHOULD in 2026-07-28, expected to become a MUST. */
+export declare function issCheck(md: Record<string, any>): Check;
+export declare function readinessChecks(url: string, auth: 'none' | 'oauth', opts?: {
+    token?: string;
+    oauth?: Discovery | null;
+}): Promise<Check[]>;