@toa.io/extensions.exposition 1.0.0-alpha.28 → 1.0.0-alpha.283

package/transpiled/directives/auth/Incept.js

@@ -1,64 +1,80 @@
-"use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || function (mod) {
-    if (mod && mod.__esModule) return mod;
-    var result = {};
-    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
-    __setModuleDefault(result, mod);
-    return result;
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.Incept = void 0;
-const http = __importStar(require("../../HTTP"));
-const split_1 = require("./split");
-const schemes_1 = require("./schemes");
-class Incept {
+import assert from 'node:assert';
+import { console } from 'openspan';
+import * as http from '../../HTTP/index.js';
+import { split } from './split.js';
+import { create } from './create.js';
+import { INCEPTION, UNKNOWN, providers as providersOf } from './schemes.js';
+import { Role } from './Role.js';
+export class Incept {
+    static components = {};
+    static discovery;
+    static bans = null;
     property;
-    discovery;
-    schemes = {};
     constructor(property, discovery) {
+        assert.ok(property === null || typeof property === 'string', '`auth:incept` value must be a string or null');
         this.property = property;
-        this.discovery = discovery;
-    }
-    authorize(identity, input) {
-        return identity === null && 'authorization' in input.request.headers;
+        Incept.discovery ??= discovery;
     }
-    async settle(input, response) {
-        const id = response.body?.[this.property];
-        if (id === undefined)
-            throw new http.Conflict('Identity inception has failed as the response body ' +
-                ` does not contain the '${this.property}' property.`);
-        const [scheme, credentials] = (0, split_1.split)(input.request.headers.authorization);
-        const provider = schemes_1.PROVIDERS[scheme];
-        this.schemes[scheme] ??= await this.discovery[provider];
-        const identity = await this.schemes[scheme]
-            .invoke('incept', {
+    static async incept(context, id) {
+        const [scheme, credentials] = split(context.request.headers.authorization);
+        const candidates = providersOf(scheme);
+        if (candidates === undefined)
+            throw new http.BadRequest('Authentication scheme is not supported');
+        // a scheme several providers claim is incepted by the one that incepts; `Bearer`
+        // carries an access token this gateway issued, and an identity cannot be incepted
+        // from a credential it would itself have to exist to hold
+        const provider = candidates.find((candidate) => INCEPTION.includes(candidate));
+        if (provider === undefined)
+            throw new http.Unauthorized();
+        Incept.bans ??= await Incept.discovery.bans;
+        const ban = await Incept.bans.invoke('observe', { query: { id } });
+        if (ban.banned)
+            throw new http.Unauthorized();
+        Incept.components[provider] ??= await Incept.discovery[provider];
+        const identity = await Incept.components[provider].invoke('incept', {
             input: {
-                authority: input.authority,
+                scheme,
+                authority: context.authority,
                 id,
                 credentials
             }
         });
         if (identity instanceof Error)
             throw new http.UnprocessableEntity(identity);
-        input.identity = identity;
-        input.identity.scheme = scheme;
+        identity.scheme = scheme;
+        identity.roles = [];
+        return identity;
+    }
+    /** Credentials that were rejected for any reason but being unknown are not incepted. */
+    static acceptable(context) {
+        return context.request.headers.authorization === undefined || context.rejection === UNKNOWN;
+    }
+    authorize(identity, context) {
+        return identity === null && Incept.acceptable(context);
+    }
+    reply(context) {
+        if (this.property !== null)
+            return null;
+        const body = create(context.request.headers.authorization);
+        return { body };
+    }
+    async settle(context, response) {
+        const id = response.body?.[this.property ?? 'id'];
+        if (id === undefined) {
+            console.debug('Inception skipped: response does not contain expected property', {
+                property: this.property,
+                response
+            });
+            return;
+        }
+        assert(typeof id === 'string', `Response body property "${this.property}" expected to be a string`);
+        if (context.request.headers.authorization !== undefined)
+            context.identity = await Incept.incept(context, id);
+        else {
+            const identity = { id, scheme: null, refresh: true };
+            const roles = await Role.get(identity, Incept.discovery.roles);
+            context.identity = { ...identity, roles };
+        }
     }
 }
-exports.Incept = Incept;
 //# sourceMappingURL=Incept.js.map

package/transpiled/directives/auth/Incept.js.map

@@ -1 +1 @@
-{"version":3,"file":"Incept.js","sourceRoot":"","sources":["../../../source/directives/auth/Incept.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AACA,iDAAkC;AAElC,mCAA+B;AAC/B,uCAAqC;AAErC,MAAa,MAAM;IACA,QAAQ,CAAQ;IAChB,SAAS,CAAW;IACpB,OAAO,GAAY,EAAwB,CAAA;IAE5D,YAAoB,QAAgB,EAAE,SAAoB;QACxD,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAA;QACxB,IAAI,CAAC,SAAS,GAAG,SAAS,CAAA;IAC5B,CAAC;IAEM,SAAS,CAAE,QAAyB,EAAE,KAAY;QACvD,OAAO,QAAQ,KAAK,IAAI,IAAI,eAAe,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAA;IACtE,CAAC;IAEM,KAAK,CAAC,MAAM,CAAE,KAAY,EAAE,QAA8B;QAC/D,MAAM,EAAE,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QAEzC,IAAI,EAAE,KAAK,SAAS;YAClB,MAAM,IAAI,IAAI,CAAC,QAAQ,CAAC,qDAAqD;gBAC3E,0BAA0B,IAAI,CAAC,QAAQ,aAAa,CAAC,CAAA;QAEzD,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,GAAG,IAAA,aAAK,EAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,aAAc,CAAC,CAAA;QACzE,MAAM,QAAQ,GAAG,mBAAS,CAAC,MAAM,CAAC,CAAA;QAElC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,MAAM,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAA;QAEvD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;aACxC,MAAM,CAAkB,QAAQ,EAAE;YACnC,KAAK,EAAE;gBACL,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,EAAE;gBACF,WAAW;aACZ;SACF,CAAC,CAAA;QAEF,IAAI,QAAQ,YAAY,KAAK;YAC3B,MAAM,IAAI,IAAI,CAAC,mBAAmB,CAAC,QAAQ,CAAC,CAAA;QAE9C,KAAK,CAAC,QAAQ,GAAG,QAAQ,CAAA;QACzB,KAAK,CAAC,QAAQ,CAAC,MAAM,GAAG,MAAM,CAAA;IAChC,CAAC;CACF;AAzCD,wBAyCC"}
+{"version":3,"file":"Incept.js","sourceRoot":"","sources":["../../../source/directives/auth/Incept.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAA;AAChC,OAAO,EAAE,OAAO,EAAE,MAAM,UAAU,CAAA;AAClC,OAAO,KAAK,IAAI,MAAM,qBAAqB,CAAA;AAC3C,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAA;AAClC,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACpC,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,IAAI,WAAW,EAAE,MAAM,cAAc,CAAA;AAC3E,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAKhC,MAAM,OAAO,MAAM;IACT,MAAM,CAAU,UAAU,GAAe,EAAE,CAAA;IAC3C,MAAM,CAAC,SAAS,CAAW;IAC3B,MAAM,CAAC,IAAI,GAAqB,IAAI,CAAA;IAE3B,QAAQ,CAAe;IAExC,YAAoB,QAAgB,EAAE,SAAoB;QACxD,MAAM,CAAC,EAAE,CAAC,QAAQ,KAAK,IAAI,IAAI,OAAO,QAAQ,KAAK,QAAQ,EACzD,8CAA8C,CAAC,CAAA;QAEjD,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAA;QACxB,MAAM,CAAC,SAAS,KAAK,SAAS,CAAA;IAChC,CAAC;IAEM,MAAM,CAAC,KAAK,CAAC,MAAM,CAAE,OAAgB,EAAE,EAAU;QACtD,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,aAAc,CAAC,CAAA;QAC3E,MAAM,UAAU,GAAG,WAAW,CAAC,MAAM,CAAC,CAAA;QAEtC,IAAI,UAAU,KAAK,SAAS;YAC1B,MAAM,IAAI,IAAI,CAAC,UAAU,CAAC,wCAAwC,CAAC,CAAA;QAErE,iFAAiF;QACjF,kFAAkF;QAClF,0DAA0D;QAC1D,MAAM,QAAQ,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAA;QAE9E,IAAI,QAAQ,KAAK,SAAS;YACxB,MAAM,IAAI,IAAI,CAAC,YAAY,EAAE,CAAA;QAE/B,MAAM,CAAC,IAAI,KAAK,MAAM,MAAM,CAAC,SAAS,CAAC,IAAI,CAAA;QAE3C,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,MAAM,CAAM,SAAS,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAA;QAEvE,IAAI,GAAG,CAAC,MAAM;YACZ,MAAM,IAAI,IAAI,CAAC,YAAY,EAAE,CAAA;QAE/B,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,KAAK,MAAM,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAA;QAEhE,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAE,CAAC,MAAM,CAAkB,QAAQ,EAAE;YACpF,KAAK,EAAE;gBACL,MAAM;gBACN,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,EAAE;gBACF,WAAW;aACZ;SACF,CAAC,CAAA;QAEF,IAAI,QAAQ,YAAY,KAAK;YAC3B,MAAM,IAAI,IAAI,CAAC,mBAAmB,CAAC,QAAQ,CAAC,CAAA;QAE9C,QAAQ,CAAC,MAAM,GAAG,MAAM,CAAA;QACxB,QAAQ,CAAC,KAAK,GAAG,EAAE,CAAA;QAEnB,OAAO,QAAQ,CAAA;IACjB,CAAC;IAED,wFAAwF;IACjF,MAAM,CAAC,UAAU,CAAE,OAAgB;QACxC,OAAO,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,aAAa,KAAK,SAAS,IAAI,OAAO,CAAC,SAAS,KAAK,OAAO,CAAA;IAC7F,CAAC;IAEM,SAAS,CAAE,QAAyB,EAAE,OAAgB;QAC3D,OAAO,QAAQ,KAAK,IAAI,IAAI,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,CAAA;IACxD,CAAC;IAEM,KAAK,CAAE,OAAgB;QAC5B,IAAI,IAAI,CAAC,QAAQ,KAAK,IAAI;YACxB,OAAO,IAAI,CAAA;QAEb,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,CAAA;QAE1D,OAAO,EAAE,IAAI,EAAE,CAAA;IACjB,CAAC;IAEM,KAAK,CAAC,MAAM,CAAE,OAAgB,EAAE,QAA8B;QACnE,MAAM,EAAE,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,CAAA;QAEjD,IAAI,EAAE,KAAK,SAAS,EAAE,CAAC;YACrB,OAAO,CAAC,KAAK,CAAC,gEAAgE,EAAE;gBAC9E,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,QAAQ;aACT,CAAC,CAAA;YAEF,OAAM;QACR,CAAC;QAED,MAAM,CAAC,OAAO,EAAE,KAAK,QAAQ,EAAE,2BAA2B,IAAI,CAAC,QAAQ,2BAA2B,CAAC,CAAA;QAEnG,IAAI,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,aAAa,KAAK,SAAS;YACrD,OAAO,CAAC,QAAQ,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC,CAAA;aAChD,CAAC;YACJ,MAAM,QAAQ,GAAG,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAA;YACpD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,CAAA;YAE9D,OAAO,CAAC,QAAQ,GAAG,EAAE,GAAG,QAAQ,EAAE,KAAK,EAAE,CAAA;QAC3C,CAAC;IACH,CAAC"}

package/transpiled/directives/auth/Input.d.ts

@@ -0,0 +1,13 @@
+import type { Parameter } from '../../RTD/index.js';
+import type { Context, Directive, Identity, Create } from './types.js';
+export declare class Input implements Directive {
+    priority: number;
+    private readonly statements;
+    constructor(declarations: Declaration[], create: Create);
+    authorize(identity: Identity | null, context: Context, parameters: Parameter[]): Promise<boolean>;
+    private check;
+}
+export interface Declaration {
+    [key: Exclude<string, 'prop'>]: unknown;
+    prop: string | string[];
+}

package/transpiled/directives/auth/Input.js

@@ -0,0 +1,45 @@
+import { Forbidden } from '../../HTTP/index.js';
+export class Input {
+    priority = 0;
+    statements = [];
+    constructor(declarations, create) {
+        this.statements = declarations.map((declaration) => new Statement(declaration, create));
+    }
+    async authorize(identity, context, parameters) {
+        context.pipelines.body.push(async (body) => this.check(identity, context, parameters, body));
+        return false;
+    }
+    // eslint-disable-next-line max-params
+    async check(identity, context, parameters, body) {
+        if (body === undefined || body === null || body.constructor !== Object)
+            return body;
+        const settled = await Promise.allSettled(this.statements.map(async (statement) => statement.check(identity, context, parameters, body)));
+        for (const result of settled)
+            if (result.status === 'rejected')
+                throw result.reason;
+        return body;
+    }
+}
+class Statement {
+    properties;
+    directives = [];
+    constructor({ prop, ...directives }, create) {
+        this.properties = typeof prop === 'string' ? [prop] : prop;
+        for (const [name, value] of Object.entries(directives)) {
+            const directive = create(name, value);
+            this.directives.push(directive);
+        }
+    }
+    // eslint-disable-next-line max-params
+    async check(identity, context, parameters, body) {
+        const match = this.properties.some((property) => property in body);
+        if (!match)
+            return;
+        for (const directive of this.directives) {
+            const authorized = await directive.authorize(identity, context, parameters);
+            if (!authorized)
+                throw new Forbidden('Input property is not authorized');
+        }
+    }
+}
+//# sourceMappingURL=Input.js.map

package/transpiled/directives/auth/Input.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Input.js","sourceRoot":"","sources":["../../../source/directives/auth/Input.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAA;AAI/C,MAAM,OAAO,KAAK;IACT,QAAQ,GAAG,CAAC,CAAA;IACF,UAAU,GAAgB,EAAE,CAAA;IAE7C,YAAoB,YAA2B,EAAE,MAAc;QAC7D,IAAI,CAAC,UAAU,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,IAAI,SAAS,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,CAAA;IACzF,CAAC;IAEM,KAAK,CAAC,SAAS,CAAE,QAAyB,EAAE,OAAgB,EAAE,UAAuB;QAC1F,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,CAAC,CAAC,CAAA;QAE5F,OAAO,KAAK,CAAA;IACd,CAAC;IAED,sCAAsC;IAC9B,KAAK,CAAC,KAAK,CAAE,QAAyB,EAAE,OAAgB,EAAE,UAAuB,EAAE,IAAa;QACtG,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,WAAW,KAAK,MAAM;YACpE,OAAO,IAAI,CAAA;QAEb,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,EAAE,SAAS,EAAE,EAAE,CAC/E,SAAS,CAAC,KAAK,CAAC,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,IAAY,CAAC,CAAC,CAAC,CAAA;QAEhE,KAAK,MAAM,MAAM,IAAI,OAAO;YAC1B,IAAI,MAAM,CAAC,MAAM,KAAK,UAAU;gBAC9B,MAAM,MAAM,CAAC,MAAM,CAAA;QAEvB,OAAO,IAAI,CAAA;IACb,CAAC;CACF;AAED,MAAM,SAAS;IACI,UAAU,CAAU;IACpB,UAAU,GAAgB,EAAE,CAAA;IAE7C,YAAoB,EAAE,IAAI,EAAE,GAAG,UAAU,EAAe,EAAE,MAAc;QACtE,IAAI,CAAC,UAAU,GAAG,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;QAE1D,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;YACvD,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;YAErC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;QACjC,CAAC;IACH,CAAC;IAED,sCAAsC;IAC/B,KAAK,CAAC,KAAK,CAAE,QAAyB,EAAE,OAAgB,EAAE,UAAuB,EAAE,IAAU;QAClG,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,IAAI,IAAI,CAAC,CAAA;QAElE,IAAI,CAAC,KAAK;YACR,OAAM;QAER,KAAK,MAAM,SAAS,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACxC,MAAM,UAAU,GAAG,MAAM,SAAS,CAAC,SAAS,CAAC,QAAQ,EAAE,OAAO,EAAE,UAAU,CAAC,CAAA;YAE3E,IAAI,CAAC,UAAU;gBACb,MAAM,IAAI,SAAS,CAAC,kCAAkC,CAAC,CAAA;QAC3D,CAAC;IACH,CAAC;CACF"}

package/transpiled/directives/auth/Role.d.ts

@@ -1,13 +1,13 @@
 import { type Component } from '@toa.io/core';
-import { type Directive, type Identity } from './types';
-import type { Parameter } from '../../RTD';
+import { type Directive, type Identity } from './types.js';
+import type { Parameter } from '../../RTD/index.js';
 export declare class Role implements Directive {
     static remote: Component | null;
     private readonly roles;
     private readonly discovery;
     private readonly dynamic;
     constructor(roles: string | string[], discovery: Promise<Component>);
-    static set(identity: Identity, discovery: Promise<Component>): Promise<void>;
+    static get(identity: Identity, discovery: Promise<Component>): Promise<string[]>;
     authorize(identity: Identity | null, _: unknown, parameters: Parameter[]): Promise<boolean>;
     private match;
     private substitute;

package/transpiled/directives/auth/Role.js

@@ -1,11 +1,6 @@
-"use strict";
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.Role = void 0;
-const node_assert_1 = __importDefault(require("node:assert"));
-class Role {
+import assert from 'node:assert';
+import { quote } from '@toa.io/generic';
+export class Role {
     static remote = null;
     roles;
     discovery;
@@ -15,20 +10,18 @@ class Role {
         this.discovery = discovery;
         this.dynamic = this.roles.some((role) => role.includes('{'));
     }
-    static async set(identity, discovery) {
+    static async get(identity, discovery) {
         this.remote ??= await discovery;
         const query = {
-            criteria: `identity==${identity.id}`,
+            criteria: `identity==${quote(identity.id)}`,
             limit: 1024
         };
-        identity.roles = await this.remote.invoke('list', { query });
+        return await this.remote.invoke('list', { query });
     }
     async authorize(identity, _, parameters) {
         if (identity === null)
             return false;
-        await Role.set(identity, this.discovery);
-        if (identity.roles.length === 0) // Role.set()
-            return false;
+        identity.roles ??= await Role.get(identity, this.discovery);
         return this.match(identity.roles, parameters);
     }
     match(roles, parameters) {
@@ -43,10 +36,9 @@ class Role {
     substitute(parameters) {
         return this.roles.map((role) => role.replaceAll(/{(\w+)}/g, (_, key) => {
             const value = parameters.find((parameter) => parameter.name === key)?.value;
-            node_assert_1.default.ok(value !== undefined, `Role '${role}' requires '${key}' route parameter.`);
+            assert.ok(value !== undefined, `Role '${role}' requires '${key}' route parameter`);
             return value;
         }));
     }
 }
-exports.Role = Role;
 //# sourceMappingURL=Role.js.map

package/transpiled/directives/auth/Role.js.map

@@ -1 +1 @@
-{"version":3,"file":"Role.js","sourceRoot":"","sources":["../../../source/directives/auth/Role.ts"],"names":[],"mappings":";;;;;;AAAA,8DAAgC;AAKhC,MAAa,IAAI;IACR,MAAM,CAAC,MAAM,GAAqB,IAAI,CAAA;IAC5B,KAAK,CAAU;IACf,SAAS,CAAoB;IAC7B,OAAO,CAAS;IAEjC,YAAoB,KAAwB,EAAE,SAA6B;QACzE,IAAI,CAAC,KAAK,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAA;QACxD,IAAI,CAAC,SAAS,GAAG,SAAS,CAAA;QAC1B,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAA;IAC9D,CAAC;IAEM,MAAM,CAAC,KAAK,CAAC,GAAG,CAAE,QAAkB,EAAE,SAA6B;QACxE,IAAI,CAAC,MAAM,KAAK,MAAM,SAAS,CAAA;QAE/B,MAAM,KAAK,GAAU;YACnB,QAAQ,EAAE,aAAa,QAAQ,CAAC,EAAE,EAAE;YACpC,KAAK,EAAE,IAAI;SACZ,CAAA;QAED,QAAQ,CAAC,KAAK,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC,CAAA;IAC9D,CAAC;IAEM,KAAK,CAAC,SAAS,CACrB,QAAyB,EAAE,CAAU,EAAE,UAAuB;QAC7D,IAAI,QAAQ,KAAK,IAAI;YACnB,OAAO,KAAK,CAAA;QAEd,MAAM,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,CAAA;QAExC,IAAI,QAAQ,CAAC,KAAM,CAAC,MAAM,KAAK,CAAC,EAAE,aAAa;YAE7C,OAAO,KAAK,CAAA;QAEd,OAAO,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAM,EAAE,UAAU,CAAC,CAAA;IAChD,CAAC;IAEO,KAAK,CAAE,KAAe,EAAE,UAAuB;QACrD,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAA;QAExE,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,EAAE,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,KAAK,IAAI,IAAI,QAAQ,CAAC,UAAU,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC,CAAA;YAE5F,IAAI,EAAE;gBACJ,OAAO,IAAI,CAAA;QACf,CAAC;QAED,OAAO,KAAK,CAAA;IACd,CAAC;IAEO,UAAU,CAAE,UAAuB;QACzC,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE;YACrE,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,CAAA;YAE3E,qBAAM,CAAC,EAAE,CAAC,KAAK,KAAK,SAAS,EAC3B,SAAS,IAAI,eAAe,GAAG,oBAAoB,CAAC,CAAA;YAEtD,OAAO,KAAK,CAAA;QACd,CAAC,CAAC,CAAC,CAAA;IACL,CAAC;;AA3DH,oBA4DC"}
+{"version":3,"file":"Role.js","sourceRoot":"","sources":["../../../source/directives/auth/Role.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAA;AAChC,OAAO,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAA;AAKvC,MAAM,OAAO,IAAI;IACR,MAAM,CAAC,MAAM,GAAqB,IAAI,CAAA;IAC5B,KAAK,CAAU;IACf,SAAS,CAAoB;IAC7B,OAAO,CAAS;IAEjC,YAAoB,KAAwB,EAAE,SAA6B;QACzE,IAAI,CAAC,KAAK,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAA;QACxD,IAAI,CAAC,SAAS,GAAG,SAAS,CAAA;QAC1B,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAA;IAC9D,CAAC;IAEM,MAAM,CAAC,KAAK,CAAC,GAAG,CAAE,QAAkB,EAAE,SAA6B;QACxE,IAAI,CAAC,MAAM,KAAK,MAAM,SAAS,CAAA;QAE/B,MAAM,KAAK,GAAU;YACnB,QAAQ,EAAE,aAAa,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE;YAC3C,KAAK,EAAE,IAAI;SACZ,CAAA;QAED,OAAO,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC,CAAA;IACpD,CAAC;IAEM,KAAK,CAAC,SAAS,CAAE,QAAyB,EAAE,CAAU,EAAE,UAAuB;QACpF,IAAI,QAAQ,KAAK,IAAI;YACnB,OAAO,KAAK,CAAA;QAEd,QAAQ,CAAC,KAAK,KAAK,MAAM,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,CAAA;QAE3D,OAAO,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC,CAAA;IAC/C,CAAC;IAEO,KAAK,CAAE,KAAe,EAAE,UAAuB;QACrD,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAA;QAExE,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,EAAE,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,KAAK,IAAI,IAAI,QAAQ,CAAC,UAAU,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC,CAAA;YAE5F,IAAI,EAAE;gBACJ,OAAO,IAAI,CAAA;QACf,CAAC;QAED,OAAO,KAAK,CAAA;IACd,CAAC;IAEO,UAAU,CAAE,UAAuB;QACzC,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE;YACrE,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,CAAA;YAE3E,MAAM,CAAC,EAAE,CAAC,KAAK,KAAK,SAAS,EAC3B,SAAS,IAAI,eAAe,GAAG,mBAAmB,CAAC,CAAA;YAErD,OAAO,KAAK,CAAA;QACd,CAAC,CAAC,CAAC,CAAA;IACL,CAAC"}

package/transpiled/directives/auth/Rule.d.ts

@@ -1,9 +1,7 @@
-import { type Parameter } from '../../RTD';
-import type { Input, Directive, Identity } from './types';
+import { type Parameter } from '../../RTD/index.js';
+import type { Context, Directive, Identity, Create } from './types.js';
 export declare class Rule implements Directive {
     private readonly directives;
     constructor(directives: Record<string, any>, create: Create);
-    authorize(identity: Identity | null, input: Input, parameters: Parameter[]): Promise<boolean>;
+    authorize(identity: Identity | null, context: Context, parameters: Parameter[]): Promise<boolean>;
 }
-type Create = (name: string, value: any, ...args: any[]) => Directive;
-export {};

package/transpiled/directives/auth/Rule.js

@@ -1,7 +1,4 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.Rule = void 0;
-class Rule {
+export class Rule {
     directives = [];
     constructor(directives, create) {
         for (const [name, value] of Object.entries(directives)) {
@@ -9,14 +6,13 @@ class Rule {
             this.directives.push(directive);
         }
     }
-    async authorize(identity, input, parameters) {
+    async authorize(identity, context, parameters) {
         for (const directive of this.directives) {
-            const authorized = await directive.authorize(identity, input, parameters);
+            const authorized = await directive.authorize(identity, context, parameters);
             if (!authorized)
                 return false;
         }
         return true;
     }
 }
-exports.Rule = Rule;
 //# sourceMappingURL=Rule.js.map

package/transpiled/directives/auth/Rule.js.map

@@ -1 +1 @@
-{"version":3,"file":"Rule.js","sourceRoot":"","sources":["../../../source/directives/auth/Rule.ts"],"names":[],"mappings":";;;AAGA,MAAa,IAAI;IACE,UAAU,GAAgB,EAAE,CAAA;IAE7C,YAAoB,UAA+B,EAAE,MAAc;QACjE,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;YACvD,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;YAErC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;QACjC,CAAC;IACH,CAAC;IAEM,KAAK,CAAC,SAAS,CACrB,QAAyB,EAAE,KAAY,EAAE,UAAuB;QAC/D,KAAK,MAAM,SAAS,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACxC,MAAM,UAAU,GAAG,MAAM,SAAS,CAAC,SAAS,CAAC,QAAQ,EAAE,KAAK,EAAE,UAAU,CAAC,CAAA;YAEzE,IAAI,CAAC,UAAU;gBACb,OAAO,KAAK,CAAA;QAChB,CAAC;QAED,OAAO,IAAI,CAAA;IACb,CAAC;CACF;AAtBD,oBAsBC"}
+{"version":3,"file":"Rule.js","sourceRoot":"","sources":["../../../source/directives/auth/Rule.ts"],"names":[],"mappings":"AAGA,MAAM,OAAO,IAAI;IACE,UAAU,GAAgB,EAAE,CAAA;IAE7C,YAAoB,UAA+B,EAAE,MAAc;QACjE,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;YACvD,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;YAErC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;QACjC,CAAC;IACH,CAAC;IAEM,KAAK,CAAC,SAAS,CAAE,QAAyB,EAAE,OAAgB,EAAE,UAAuB;QAC1F,KAAK,MAAM,SAAS,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACxC,MAAM,UAAU,GAAG,MAAM,SAAS,CAAC,SAAS,CAAC,QAAQ,EAAE,OAAO,EAAE,UAAU,CAAC,CAAA;YAE3E,IAAI,CAAC,UAAU;gBACb,OAAO,KAAK,CAAA;QAChB,CAAC;QAED,OAAO,IAAI,CAAA;IACb,CAAC;CACF"}

package/transpiled/directives/auth/Scheme.d.ts

@@ -1,7 +1,7 @@
-import { type Directive, type Identity, type Input } from './types';
+import { type Directive, type Identity, type Context } from './types.js';
 export declare class Scheme implements Directive {
     private readonly scheme;
     private readonly Scheme;
     constructor(scheme: string);
-    authorize(_: Identity | null, input: Input): boolean;
+    authorize(_: Identity | null, context: Context): boolean;
 }

package/transpiled/directives/auth/Scheme.js

@@ -1,47 +1,20 @@
-"use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || function (mod) {
-    if (mod && mod.__esModule) return mod;
-    var result = {};
-    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
-    __setModuleDefault(result, mod);
-    return result;
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.Scheme = void 0;
-const http = __importStar(require("../../HTTP"));
-const split_1 = require("./split");
-class Scheme {
+import * as http from '../../HTTP/index.js';
+import { split } from './split.js';
+export class Scheme {
     scheme;
     Scheme;
     constructor(scheme) {
         this.scheme = scheme.toLowerCase();
         this.Scheme = scheme[0].toUpperCase() + scheme.substring(1);
     }
-    authorize(_, input) {
-        if (input.request.headers.authorization === undefined)
+    authorize(_, context) {
+        if (context.request.headers.authorization === undefined)
             return false;
-        const [scheme] = (0, split_1.split)(input.request.headers.authorization);
+        const [scheme] = split(context.request.headers.authorization);
         if (scheme !== this.scheme)
             throw new http.Forbidden(this.Scheme +
-                ' authentication scheme is required to access this resource.');
+                ' authentication scheme is required to access this resource');
         return false;
     }
 }
-exports.Scheme = Scheme;
 //# sourceMappingURL=Scheme.js.map

package/transpiled/directives/auth/Scheme.js.map

@@ -1 +1 @@
-{"version":3,"file":"Scheme.js","sourceRoot":"","sources":["../../../source/directives/auth/Scheme.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,iDAAkC;AAElC,mCAA+B;AAE/B,MAAa,MAAM;IACA,MAAM,CAAQ;IACd,MAAM,CAAQ;IAE/B,YAAoB,MAAc;QAChC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,WAAW,EAAE,CAAA;QAClC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAA;IAC7D,CAAC;IAEM,SAAS,CAAE,CAAkB,EAAE,KAAY;QAChD,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,aAAa,KAAK,SAAS;YACnD,OAAO,KAAK,CAAA;QAEd,MAAM,CAAC,MAAM,CAAC,GAAG,IAAA,aAAK,EAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,CAAA;QAE3D,IAAI,MAAM,KAAK,IAAI,CAAC,MAAM;YACxB,MAAM,IAAI,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM;gBAClC,6DAA6D,CAAC,CAAA;QAElE,OAAO,KAAK,CAAA;IACd,CAAC;CACF;AArBD,wBAqBC"}
+{"version":3,"file":"Scheme.js","sourceRoot":"","sources":["../../../source/directives/auth/Scheme.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,IAAI,MAAM,qBAAqB,CAAA;AAE3C,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAA;AAElC,MAAM,OAAO,MAAM;IACA,MAAM,CAAQ;IACd,MAAM,CAAQ;IAE/B,YAAoB,MAAc;QAChC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,WAAW,EAAE,CAAA;QAClC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAA;IAC7D,CAAC;IAEM,SAAS,CAAE,CAAkB,EAAE,OAAgB;QACpD,IAAI,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,aAAa,KAAK,SAAS;YACrD,OAAO,KAAK,CAAA;QAEd,MAAM,CAAC,MAAM,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,CAAA;QAE7D,IAAI,MAAM,KAAK,IAAI,CAAC,MAAM;YACxB,MAAM,IAAI,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM;gBAClC,4DAA4D,CAAC,CAAA;QAEjE,OAAO,KAAK,CAAA;IACd,CAAC;CACF"}

package/transpiled/directives/auth/create.d.ts

@@ -0,0 +1,2 @@
+import type { Identity } from './types.js';
+export declare function create(credentials?: string): Identity;

package/transpiled/directives/auth/create.js

@@ -0,0 +1,10 @@
+import { newid } from '@toa.io/generic';
+export function create(credentials) {
+    return {
+        id: newid(),
+        scheme: credentials?.split(' ')[0] ?? null,
+        refresh: false,
+        roles: []
+    };
+}
+//# sourceMappingURL=create.js.map

package/transpiled/directives/auth/create.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"create.js","sourceRoot":"","sources":["../../../source/directives/auth/create.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAA;AAGvC,MAAM,UAAU,MAAM,CAAE,WAAoB;IAC1C,OAAO;QACL,EAAE,EAAE,KAAK,EAAE;QACX,MAAM,EAAE,WAAW,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI;QAC1C,OAAO,EAAE,KAAK;QACd,KAAK,EAAE,EAAE;KACV,CAAA;AACH,CAAC"}

package/transpiled/directives/auth/index.d.ts

@@ -1,2 +1,2 @@
-import { Authorization } from './Authorization';
+import { Authorization } from './Authorization.js';
 export declare const authorization: Authorization;

package/transpiled/directives/auth/index.js

@@ -1,6 +1,3 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.authorization = void 0;
-const Authorization_1 = require("./Authorization");
-exports.authorization = new Authorization_1.Authorization();
+import { Authorization } from './Authorization.js';
+export const authorization = new Authorization();
 //# sourceMappingURL=index.js.map

package/transpiled/directives/auth/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../source/directives/auth/index.ts"],"names":[],"mappings":";;;AAAA,mDAA+C;AAElC,QAAA,aAAa,GAAG,IAAI,6BAAa,EAAE,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../source/directives/auth/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA;AAElD,MAAM,CAAC,MAAM,aAAa,GAAG,IAAI,aAAa,EAAE,CAAA"}

package/transpiled/directives/auth/schemes.d.ts

@@ -1,3 +1,26 @@
-import { type Remote, type Scheme } from './types';
-export declare const PROVIDERS: Record<Scheme, Remote>;
-export declare const PRIMARY: Scheme;
+import type { Remote, Scheme } from './types.js';
+/**
+ * The providers of a scheme, in the order they are asked. More than one claims `Bearer`:
+ * an OpenID `id_token` is federated, and a token this gateway issued is presented that way
+ * by an OAuth client. Which of them a credential belongs to is each provider's own to say,
+ * so the order here is only which is asked first.
+ */
+export declare const PROVIDERS: Record<Scheme, Remote[]>;
+export declare const INCEPTION: Remote[];
+export declare const PRIMARY: Remote;
+/**
+ * The providers of a scheme, or nothing for a scheme that is not one — including a name a
+ * plain object answers on its own, like `constructor`.
+ */
+export declare function providers(scheme: string): Remote[] | undefined;
+/**
+ * What a provider answers when the credentials are not of its kind. The next provider of
+ * the scheme is asked; a provider that declines has done nothing, so asking is free of
+ * effect — which asking one that rejects would not be.
+ */
+export declare const UNRECOGNIZED = "UNRECOGNIZED";
+/**
+ * The rejection of credentials that are verifiable and owned by no identity: the one
+ * inception goes ahead with.
+ */
+export declare const UNKNOWN = "NOT_FOUND";

package/transpiled/directives/auth/schemes.js

@@ -1,10 +1,34 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.PRIMARY = exports.PROVIDERS = void 0;
-exports.PROVIDERS = {
-    basic: 'basic',
-    token: 'tokens',
-    bearer: 'federation'
+/**
+ * The providers of a scheme, in the order they are asked. More than one claims `Bearer`:
+ * an OpenID `id_token` is federated, and a token this gateway issued is presented that way
+ * by an OAuth client. Which of them a credential belongs to is each provider's own to say,
+ * so the order here is only which is asked first.
+ */
+export const PROVIDERS = {
+    basic: ['basic'],
+    token: ['tokens'],
+    bearer: ['tokens', 'federation'],
+    code: ['federation'],
+    otp: ['otp']
 };
-exports.PRIMARY = 'token';
+export const INCEPTION = ['basic', 'federation'];
+export const PRIMARY = 'tokens';
+/**
+ * The providers of a scheme, or nothing for a scheme that is not one — including a name a
+ * plain object answers on its own, like `constructor`.
+ */
+export function providers(scheme) {
+    return Object.hasOwn(PROVIDERS, scheme) ? PROVIDERS[scheme] : undefined;
+}
+/**
+ * What a provider answers when the credentials are not of its kind. The next provider of
+ * the scheme is asked; a provider that declines has done nothing, so asking is free of
+ * effect — which asking one that rejects would not be.
+ */
+export const UNRECOGNIZED = 'UNRECOGNIZED';
+/**
+ * The rejection of credentials that are verifiable and owned by no identity: the one
+ * inception goes ahead with.
+ */
+export const UNKNOWN = 'NOT_FOUND';
 //# sourceMappingURL=schemes.js.map

package/transpiled/directives/auth/schemes.js.map

@@ -1 +1 @@
-{"version":3,"file":"schemes.js","sourceRoot":"","sources":["../../../source/directives/auth/schemes.ts"],"names":[],"mappings":";;;AAEa,QAAA,SAAS,GAA2B;IAC/C,KAAK,EAAE,OAAO;IACd,KAAK,EAAE,QAAQ;IACf,MAAM,EAAE,YAAY;CACrB,CAAA;AAEY,QAAA,OAAO,GAAW,OAAO,CAAA"}
+{"version":3,"file":"schemes.js","sourceRoot":"","sources":["../../../source/directives/auth/schemes.ts"],"names":[],"mappings":"AAEA;;;;;GAKG;AACH,MAAM,CAAC,MAAM,SAAS,GAA6B;IACjD,KAAK,EAAE,CAAC,OAAO,CAAC;IAChB,KAAK,EAAE,CAAC,QAAQ,CAAC;IACjB,MAAM,EAAE,CAAC,QAAQ,EAAE,YAAY,CAAC;IAChC,IAAI,EAAE,CAAC,YAAY,CAAC;IACpB,GAAG,EAAE,CAAC,KAAK,CAAC;CACb,CAAA;AAED,MAAM,CAAC,MAAM,SAAS,GAAa,CAAC,OAAO,EAAE,YAAY,CAAC,CAAA;AAC1D,MAAM,CAAC,MAAM,OAAO,GAAW,QAAQ,CAAA;AAEvC;;;GAGG;AACH,MAAM,UAAU,SAAS,CAAE,MAAc;IACvC,OAAO,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,MAAgB,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;AACnF,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,cAAc,CAAA;AAE1C;;;GAGG;AACH,MAAM,CAAC,MAAM,OAAO,GAAG,WAAW,CAAA"}

package/transpiled/directives/auth/split.d.ts

@@ -1,2 +1,2 @@
-import { type Scheme } from './types';
+import { type Scheme } from './types.js';
 export declare function split(authorization: string): [Scheme, string];

package/transpiled/directives/auth/split.js

@@ -1,38 +1,11 @@
-"use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || function (mod) {
-    if (mod && mod.__esModule) return mod;
-    var result = {};
-    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
-    __setModuleDefault(result, mod);
-    return result;
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.split = void 0;
-const http = __importStar(require("../../HTTP"));
-function split(authorization) {
+import * as http from '../../HTTP/index.js';
+export function split(authorization) {
     const space = authorization.indexOf(' ');
     if (space === -1)
-        throw new http.Unauthorized('Malformed authorization header.');
+        throw new http.Unauthorized('Malformed authorization header');
     const Scheme = authorization.slice(0, space);
     const scheme = Scheme.toLowerCase();
     const value = authorization.slice(space + 1);
     return [scheme, value];
 }
-exports.split = split;
 //# sourceMappingURL=split.js.map

package/transpiled/directives/auth/split.js.map

@@ -1 +1 @@
-{"version":3,"file":"split.js","sourceRoot":"","sources":["../../../source/directives/auth/split.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,iDAAkC;AAGlC,SAAgB,KAAK,CAAE,aAAqB;IAC1C,MAAM,KAAK,GAAG,aAAa,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IAExC,IAAI,KAAK,KAAK,CAAC,CAAC;QACd,MAAM,IAAI,IAAI,CAAC,YAAY,CAAC,iCAAiC,CAAC,CAAA;IAEhE,MAAM,MAAM,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAA;IAC5C,MAAM,MAAM,GAAG,MAAM,CAAC,WAAW,EAAY,CAAA;IAC7C,MAAM,KAAK,GAAG,aAAa,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAA;IAE5C,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC,CAAA;AACxB,CAAC;AAXD,sBAWC"}
+{"version":3,"file":"split.js","sourceRoot":"","sources":["../../../source/directives/auth/split.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,IAAI,MAAM,qBAAqB,CAAA;AAG3C,MAAM,UAAU,KAAK,CAAE,aAAqB;IAC1C,MAAM,KAAK,GAAG,aAAa,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IAExC,IAAI,KAAK,KAAK,CAAC,CAAC;QACd,MAAM,IAAI,IAAI,CAAC,YAAY,CAAC,gCAAgC,CAAC,CAAA;IAE/D,MAAM,MAAM,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAA;IAC5C,MAAM,MAAM,GAAG,MAAM,CAAC,WAAW,EAAY,CAAA;IAC7C,MAAM,KAAK,GAAG,aAAa,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAA;IAE5C,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC,CAAA;AACxB,CAAC"}