@toa.io/extensions.exposition 1.0.0-alpha.282 → 1.0.0-alpha.283

package/source/directives/auth/types.ts

@@ -1,5 +1,5 @@
 import { type Component } from '@toa.io/core'
-import { type Maybe } from '@toa.io/types'
+import { type Maybe } from '@toa.io/core'
 import { type Parameter } from '../../RTD/index.js'
 import type * as http from '../../HTTP/index.js'
 import type * as io from '../../io.js'
@@ -23,6 +23,9 @@ export interface Identity {
   roles?: string[]
   permissions?: Record<string, string[]>
   scheme: string | null // null for transient identities
+
+  /** The component that verified the credentials; none for a transient identity. */
+  provider?: Remote
   refresh: boolean
 }
 
@@ -43,6 +46,6 @@ export type AuthenticationResult = Maybe<{ identity: Identity, refresh: boolean
 export type Scheme = 'basic' | 'token' | 'bearer' | 'code' | 'otp'
 export type Remote = 'basic' | 'federation' | 'tokens' | 'roles' | 'bans' | 'otp'
 export type Discovery = Record<Remote, Promise<Component>>
-export type Schemes = Record<Scheme, Component>
+export type Components = Partial<Record<Remote, Component>>
 
 export type Create = (name: string, value: any, ...args: any[]) => Directive

package/source/directives/cache/Cache.ts

@@ -23,14 +23,23 @@ export class Cache implements DirectiveFamily<Directive> {
   }
 
   public async settle (directives: Directive[], context: AuthenticatedContext, response: http.OutgoingMessage): Promise<void> {
-    const method = context.request.method
+    const directive = directives[0]
+
+    response.headers ??= new Headers()
+
+    // `cache:exact` sets what it is given, whatever the method: whether a reply may be
+    // stored at all is not a question about the method's cacheability, and a token
+    // endpoint answers a POST it must not have kept
+    if (directive instanceof Exact) {
+      directive.set(context, response.headers)
 
-    if (method !== 'GET' && method !== 'HEAD')
       return
+    }
 
-    const directive = directives[0]
+    const method = context.request.method
 
-    response.headers ??= new Headers()
+    if (method !== 'GET' && method !== 'HEAD')
+      return
 
     if (directive === undefined) {
       if (context.identity !== null && !Control.disabled(response.headers)) {

package/source/directives/cache/Control.ts

@@ -22,9 +22,6 @@ export class Control implements Directive {
   }
 
   public set (context: AuthenticatedContext, headers: Headers): void {
-    if (!['GET', 'HEAD', 'OPTIONS'].includes(context.request.method))
-      return
-
     this.control ??= this.resolve(context)
 
     if (Control.disabled(headers))

package/source/directives/flow/Fetch.ts

@@ -5,7 +5,7 @@ import { NotFound } from '../../HTTP/index.js'
 import type { Directive } from './types.js'
 import type { ReadableStream } from 'node:stream/web'
 import type { Remotes } from '../../Remotes.js'
-import type { Maybe } from '@toa.io/types'
+import type { Maybe } from '@toa.io/core'
 import type { Component } from '@toa.io/core'
 import type { Output } from '../../io.js'
 import type { Input } from '../octets/types.js'

package/source/directives/index.ts

@@ -7,8 +7,9 @@ import { io } from './io/index.js'
 import { map } from './map/index.js'
 import { req } from './require/index.js'
 import { flow } from './flow/index.js'
+import { discovery } from './oauth/index.js'
 import type { DirectiveFamily } from '../RTD/index.js'
 import type { Interceptor } from '../Interception.js'
 
 export const families: DirectiveFamily[] = [authorization, io, cache, map, req, flow, octets, dev]
-export const interceptors: Interceptor[] = [cors]
+export const interceptors: Interceptor[] = [cors, discovery]

package/source/directives/io/IO.ts

@@ -1,6 +1,7 @@
 import { Output } from './Output.js'
 import { Input } from './Input.js'
 import { Throttle } from './Throttle.js'
+import { Status } from './Status.js'
 import { Sync } from './lib/throttle/index.js'
 import type * as http from '../../HTTP/index.js'
 import type { Parameter, DirectiveFamily } from '../../RTD/index.js'
@@ -72,6 +73,7 @@ export class IO implements DirectiveFamily<Directive> {
 const constructors: Record<string, Constructor> = {
   input: Input,
   output: Output,
+  status: Status,
   throttle: Throttle
 }
 

package/source/directives/io/Output.ts

@@ -35,7 +35,10 @@ export class Output implements Directive {
 
   private restriction (context: Context) {
     return (message: OutgoingMessage): void => {
-      const error = message.status !== undefined && message.status >= 300
+      // what the gateway built is its own — a code and a message — and a restriction has
+      // nothing to say about it; everything else is a reply the operation returned, and is
+      // restricted whatever status it carries
+      const error = message.authentic === true
       const stream = message.body instanceof Stream
       const none = message.body === undefined || message.body === null
 

package/source/directives/io/Status.test.ts

@@ -0,0 +1,84 @@
+import { it } from 'node:test'
+import assert from 'node:assert/strict'
+
+import { Status } from './Status.js'
+import { Output } from './Output.js'
+import type { Input as Context } from '../../io.js'
+import type { OutgoingMessage } from '../../HTTP/index.js'
+
+const status = new Status('status')
+
+function context (): Context {
+  return { pipelines: { body: [], response: [] }, url: { pathname: '/' } } as unknown as Context
+}
+
+it('should take the status from the property and remove it', () => {
+  const response: OutgoingMessage = { body: { status: 400, error: 'invalid_request' } }
+
+  status.settle(context(), response)
+
+  assert.equal(response.status, 400)
+  assert.deepEqual(response.body, { error: 'invalid_request' })
+})
+
+it('should leave a reply that states no status alone', () => {
+  const response: OutgoingMessage = { body: { id: 'x' } }
+
+  status.settle(context(), response)
+
+  assert.equal(response.status, undefined)
+  assert.deepEqual(response.body, { id: 'x' })
+})
+
+it('should refuse a status that is not one', () => {
+  for (const value of ['400', null, {}, true])
+    assert.throws(() => {
+      status.settle(context(), { body: { status: value } } as OutgoingMessage)
+    }, /`io:status` expects 'status' to be a number/)
+})
+
+it('should refuse a declaration that is not a property name', () => {
+  for (const value of [1, null, {}, ['status']])
+    assert.throws(() => Status.validate(value), /`io:status` must be a string/)
+})
+
+it('should have a reply it named the status of restricted, whatever that status is', () => {
+  for (const stated of [200, 400]) {
+    const ctx = context()
+    const output = new Output(['code', 'error'])
+
+    output.preflight(ctx, [])
+
+    const response: OutgoingMessage = {
+      body: { status: stated, code: 'SplxlO', error: 'invalid_grant', secret: 'x' }
+    }
+
+    status.settle(ctx, response)
+
+    for (const transform of ctx.pipelines.response)
+      transform(response)
+
+    assert.equal(response.status, stated)
+    assert.deepEqual(response.body, { code: 'SplxlO', error: 'invalid_grant' })
+  }
+})
+
+it('should leave a failure the gateway built alone, on such a route too', () => {
+  const ctx = context()
+  const output = new Output(['code'])
+
+  output.preflight(ctx, [])
+
+  // what `Server.fail` builds out of an exception, on a route that also declares `io:status`
+  const response: OutgoingMessage = {
+    status: 422,
+    authentic: true,
+    body: { code: 'NOT_FOUND', message: 'nope' }
+  }
+
+  for (const transform of ctx.pipelines.response)
+    transform(response)
+
+  assert.deepEqual(response.body, { code: 'NOT_FOUND', message: 'nope' },
+    'a code and a message are not what a restriction has anything to say about')
+})

package/source/directives/io/Status.ts

@@ -0,0 +1,46 @@
+import assert from 'node:assert'
+import type { Directive } from './Directive.js'
+import type * as http from '../../HTTP/index.js'
+
+/**
+ * The status of the reply, taken from a property of what the operation returned and removed
+ * from it — an outcome the operation knows and the transport does not, like a protocol that
+ * states its error as a body rather than as a status of its own.
+ *
+ * Settled rather than transformed, so the status is set before anything reads it. A reply of
+ * 300 or above is left as the operation built it, which `io:output` does not restrict: a
+ * failure and a success are different shapes, and one list of permitted properties does not
+ * describe both.
+ */
+export class Status implements Directive {
+  private readonly property: string
+
+  public constructor (property: unknown) {
+    this.property = property as string
+  }
+
+  public static validate (value: unknown): asserts value is string {
+    assert.ok(typeof value === 'string', '`io:status` must be a string')
+  }
+
+  public preflight (): void {
+    // nothing to do until the operation has answered
+  }
+
+  public settle (_: unknown, response: http.OutgoingMessage): void {
+    const body: unknown = response.body
+
+    if (body === null || typeof body !== 'object' || !(this.property in body))
+      return
+
+    const value: unknown = (body as Record<string, unknown>)[this.property]
+
+    assert.ok(typeof value === 'number',
+      `\`io:status\` expects '${this.property}' to be a number`)
+
+    response.status = value
+
+    // eslint-disable-next-line @typescript-eslint/no-dynamic-delete
+    delete (body as Record<string, unknown>)[this.property]
+  }
+}

package/source/directives/oauth/Discovery.ts

@@ -0,0 +1,76 @@
+import { documents, type Documents } from './documents.js'
+import type * as http from '../../HTTP/index.js'
+import type { Input, Output } from '../../io.js'
+import type { Interceptor } from '../../Interception.js'
+
+/**
+ * What a client reads before it can authenticate: where the authorization server is, and
+ * what this resource expects. Both are fixed paths a specification names, both must be
+ * answered to anyone, and both are a function of the annotation alone — nothing is read to
+ * build them, so they are built once per authority and served as they are.
+ *
+ * An interceptor rather than a route because `auth` runs before any directive: a client
+ * re-reading discovery while holding a stale token would have it verified, and then be
+ * refused a document that has to be public.
+ */
+export class Discovery implements Interceptor {
+  /**
+   * A map, because the key is the request's authority and an unconfigured host is passed
+   * through as itself: `Host: constructor` names something a plain object answers on its own.
+   */
+  private readonly authorities = new Map<string, Documents>()
+
+  public mount (options: http.Options): void {
+    this.authorities.clear()
+
+    if (options.oauth === undefined)
+      return
+
+    for (const [authority, host] of Object.entries(options.authorities))
+      this.authorities.set(authority, documents(origin(host), options.oauth))
+  }
+
+  public reset (): void {
+    this.authorities.clear()
+  }
+
+  public intercept (input: Input): Output {
+    const known = this.authorities.get(input.authority)
+
+    if (known === undefined)
+      return null
+
+    // every reply, not just a document's: the challenge is what points a client here
+    input.pipelines.response.push((response) => {
+      if (response.status !== UNAUTHORIZED)
+        return
+
+      response.headers ??= new Headers()
+      response.headers.set('www-authenticate', known.challenge(input.url.pathname))
+    })
+
+    const body = known.read(input.url.pathname)
+
+    if (body === undefined)
+      return null
+
+    return { body, headers: new Headers({ 'cache-control': 'public, max-age=3600' }) }
+  }
+}
+
+/**
+ * The absolute URL an authority is reached at. Loopback is served over http and everything
+ * else over https: the gateway may sit behind a terminating proxy, so the connection does
+ * not say which, and the configured host does. Taken from the configuration rather than
+ * from the request's `host`, which is the client's to write.
+ */
+function origin (host: string): string {
+  const name = host.split(':')[0]
+
+  const loopback = name === 'localhost' || name === '127.0.0.1' || name === '[::1]' ||
+    name.endsWith('.localhost')
+
+  return `${loopback ? 'http' : 'https'}://${host}`
+}
+
+const UNAUTHORIZED = 401

package/source/directives/oauth/documents.ts

@@ -0,0 +1,113 @@
+import type { OAuth } from '../../Annotation.js'
+
+/** The discovery documents of one authority, and the challenge that points at them. */
+export interface Documents {
+  /** The document a path names, or nothing when it names none. */
+  read: (pathname: string) => object | undefined
+
+  /** `WWW-Authenticate` for a request to this path, which names the resource it failed at. */
+  challenge: (pathname: string) => string
+}
+
+export function documents (issuer: string, oauth: OAuth): Documents {
+  const server = authorizationServer(issuer, oauth)
+  const resources = protectedResources(issuer, oauth)
+  const scope = oauth.scopes === undefined ? '' : `, scope="${oauth.scopes.join(' ')}"`
+
+  function read (pathname: string): object | undefined {
+    if (pathname === AUTHORIZATION_SERVER || pathname === OPENID_CONFIGURATION)
+      return server
+
+    if (pathname.startsWith(PROTECTED_RESOURCE))
+      return resources.get(pathname.slice(PROTECTED_RESOURCE.length))
+
+    return undefined
+  }
+
+  function challenge (pathname: string): string {
+    return `Bearer resource_metadata="${issuer}${PROTECTED_RESOURCE}${suffix(oauth, pathname)}"${scope}`
+  }
+
+  return { read, challenge }
+}
+
+/**
+ * RFC 8414. `authorization_endpoint` is the application's own page and may be anywhere;
+ * everything else this extension serves. Both flags are load-bearing for a client that
+ * prefers Client ID Metadata Documents: without either it falls back to registration.
+ */
+function authorizationServer (issuer: string, oauth: OAuth): object {
+  const metadata: Record<string, unknown> = {
+    issuer,
+    authorization_endpoint: oauth.authorize,
+    token_endpoint: `${issuer}${TOKEN}`,
+    response_types_supported: ['code'],
+    grant_types_supported: ['authorization_code'],
+    code_challenge_methods_supported: ['S256'],
+    token_endpoint_auth_methods_supported: ['none'],
+    client_id_metadata_document_supported: true,
+    authorization_response_iss_parameter_supported: true
+  }
+
+  if (oauth.registration === 'open')
+    metadata.registration_endpoint = `${issuer}${REGISTRATION}`
+
+  if (oauth.scopes !== undefined)
+    metadata.scopes_supported = oauth.scopes
+
+  return metadata
+}
+
+/**
+ * RFC 9728, keyed by the path the well-known segment is followed by: a client resolving
+ * `https://host/mcp` reads `/.well-known/oauth-protected-resource/mcp`, and one that names
+ * no path reads the document at the origin.
+ */
+function protectedResources (issuer: string, oauth: OAuth): Map<string, object> {
+  const map = new Map<string, object>()
+
+  for (const path of oauth.resources ?? [])
+    map.set(canonical(path), resource(issuer, canonical(path), oauth))
+
+  map.set('', resource(issuer, '', oauth))
+
+  return map
+}
+
+function resource (issuer: string, path: string, oauth: OAuth): object {
+  const metadata: Record<string, unknown> = {
+    resource: issuer + path,
+    authorization_servers: [issuer],
+    bearer_methods_supported: ['header']
+  }
+
+  if (oauth.scopes !== undefined)
+    metadata.scopes_supported = oauth.scopes
+
+  return metadata
+}
+
+/** The document a request to this path was refused against: the longest resource holding it. */
+function suffix (oauth: OAuth, pathname: string): string {
+  let longest = ''
+
+  for (const path of oauth.resources ?? [])
+    if (pathname.startsWith(path) && path.length > longest.length)
+      longest = path
+
+  return canonical(longest)
+}
+
+/**
+ * A resource is identified without its trailing slash — the form MCP asks for — while a
+ * route is declared with one, so `/mcp/` identifies `…/mcp`.
+ */
+function canonical (path: string): string {
+  return path.endsWith('/') ? path.slice(0, -1) : path
+}
+
+const AUTHORIZATION_SERVER = '/.well-known/oauth-authorization-server'
+const PROTECTED_RESOURCE = '/.well-known/oauth-protected-resource'
+const OPENID_CONFIGURATION = '/.well-known/openid-configuration'
+const TOKEN = '/identity/grants/'
+const REGISTRATION = '/identity/clients/'

package/source/directives/oauth/index.ts

@@ -0,0 +1,3 @@
+import { Discovery } from './Discovery.js'
+
+export const discovery = new Discovery()

package/source/directives/octets/Delete.ts

@@ -5,7 +5,7 @@ import { Workflow } from './workflows/index.js'
 import { Directive } from './Directive.js'
 import type { Parameter } from '../../RTD/index.js'
 import type { Unit, Location } from './workflows/index.js'
-import type { Maybe } from '@toa.io/types'
+import type { Maybe } from '@toa.io/core'
 import type { Component } from '@toa.io/core'
 import type { Output } from '../../io.js'
 import type { Input } from './types.js'

package/source/directives/octets/Get.ts

@@ -1,7 +1,7 @@
 import { Forbidden, NotFound } from '../../HTTP/index.js'
 import * as schemas from './schemas.js'
 import { Directive } from './Directive.js'
-import type { Maybe } from '@toa.io/types'
+import type { Maybe } from '@toa.io/core'
 import type { Entry, Stream } from '@toa.io/extensions.storages'
 import type { Component } from '@toa.io/core'
 import type { Output } from '../../io.js'

package/source/directives/octets/Workflow.ts

@@ -7,7 +7,7 @@ import type { Input } from './types.js'
 import type { Component } from '@toa.io/core'
 import type { Output } from '../../io.js'
 import type { Remotes } from '../../Remotes.js'
-import type { Maybe } from '@toa.io/types'
+import type { Maybe } from '@toa.io/core'
 import type { Entry } from '@toa.io/extensions.storages'
 import type { Parameter } from '../../RTD/index.js'
 

package/source/directives/octets/workflows/Execution.ts

@@ -3,7 +3,7 @@ import { console } from 'openspan'
 import type { Unit } from './Workflow.js'
 import type { Remotes } from '../../../Remotes.js'
 import type { Component } from '@toa.io/core'
-import type { Maybe } from '@toa.io/types'
+import type { Maybe } from '@toa.io/core'
 import type { Entry } from '@toa.io/extensions.storages'
 
 export class Execution extends Readable {

package/source/index.ts

@@ -4,3 +4,9 @@ export { components } from './Composition.js'
 export { Factory } from './Factory.js'
 
 export type { Remotes } from './Remotes.js'
+
+// what an operation is written against, rather than the gateway's own
+export type { Claims, Identity } from './userland.js'
+
+// what an octets workflow is given
+export type * as octets from './octets.js'

package/source/octets.d.ts

@@ -0,0 +1,17 @@
+export interface WorkflowInput<
+  TParameters extends Record<string, string> = Record<string, string>,
+  TSteps extends Record<string, unknown> = Record<string, unknown>,
+> {
+  authority: string
+  identity?: string
+  storage: string
+  path: string
+  entry: {
+    id: string
+    type: string
+    size: number
+    meta: Record<string, unknown>
+  }
+  parameters: TParameters
+  steps: TSteps
+}

package/source/userland.ts

@@ -0,0 +1,47 @@
+/**
+ * What Exposition puts into an operation's input, for the operation to be written against.
+ *
+ * The gateway's own types are its business; these are the application's.
+ */
+
+/**
+ * The identity behind the call, as `auth:delegate` embeds it:
+ *
+ * ```yaml
+ * /echo:
+ *   GET:
+ *     auth:assert: true
+ *     auth:delegate: identity
+ *     endpoint: echo
+ * ```
+ *
+ * ```javascript
+ * export async function computation ({ identity }, context) { }
+ * ```
+ */
+export interface Identity {
+  readonly id: string
+
+  /** What the identity holds. Delegation resolves them, so they are always here. */
+  roles: string[]
+
+  permissions?: Record<string, string[]>
+
+  /** How the identity was authenticated; `null` for a transient one. */
+  scheme: string | null
+
+  /** Whether the credentials presented are due to be exchanged. */
+  refresh: boolean
+
+  /** The token's claims, where the identity was federated. */
+  claims?: Claims
+}
+
+/** A federated token's payload: what it must carry, and whatever else the issuer put there. */
+export interface Claims {
+  iss: string
+  sub: string
+  aud?: string | string[]
+
+  [claim: string]: unknown
+}

package/transpiled/Annotation.d.ts

@@ -19,8 +19,25 @@ export interface Annotation {
     ip?: string;
     /** Failed authentications an address may make; none are metered unless set. See `identity.md`. */
     bouncer?: Bouncer;
+    /** The authorization server this context exposes; none is exposed without it. */
+    oauth?: OAuth;
     '/'?: object;
 }
+export interface OAuth {
+    /**
+     * Where a client sends the user to consent. The one endpoint of the flow that needs a
+     * person, and so the one this extension does not serve: an application builds it.
+     */
+    authorize: string;
+    /** Paths a token may be restricted to, each advertised as a protected resource. */
+    resources?: string[];
+    /** What a client may ask for. Each is a role, or a scope within one. */
+    scopes?: string[];
+    /** Origins whose Client ID Metadata Documents may be read. None are without it. */
+    trust?: string[];
+    /** Dynamic Client Registration, off unless opened. */
+    registration?: 'open' | 'closed';
+}
 export interface Bouncer {
     /** what an address may fail at once, 20 by default */
     attempts?: number;

package/transpiled/Factory.js

@@ -41,7 +41,7 @@ export class Factory {
         const node = root.resolve();
         const methods = new EndpointsFactory(remotes);
         const directives = new DirectivesFactory(families, remotes, this.host, options);
-        const interception = new Interception(interceptors);
+        const interception = new Interception(interceptors, options);
         const tree = new Tree(node, methods, directives);
         const composition = new Composition(this.host);
         const gateway = new Gateway(broadcast, tree, interception);

package/transpiled/Factory.js.map

@@ -1 +1 @@
-{"version":3,"file":"Factory.js","sourceRoot":"","sources":["../source/Factory.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAA;AAChC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAsC,MAAM,UAAU,CAAA;AAC9E,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACpC,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AACtC,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AACtC,OAAO,EAAE,IAAI,EAAE,MAAM,gBAAgB,CAAA;AACrC,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAA;AAChD,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAA;AAC9D,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAA;AAClD,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAA;AAC9C,OAAO,KAAK,IAAI,MAAM,WAAW,CAAA;AACjC,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAA;AACvC,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAChD,OAAO,KAAK,IAAI,MAAM,iBAAiB,CAAA;AAMvC,MAAM,OAAO,OAAO;IACD,IAAI,CAAM;IAE3B,YAAoB,IAAU;QAC5B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAA;IAClB,CAAC;IAEM,KAAK,CAAC,MAAM,CAAE,OAAgB,EAAE,IAAiB;QACtD,MAAM,SAAS,GAAc,MAAM,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,CAAC,CAAA;QAC3E,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;QAE5E,4EAA4E;QAC5E,MAAM,MAAM,GAA8B;YACxC,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,SAAS,EAAE,OAAO,CAAC,IAAI;YACvB,QAAQ,EAAE,OAAO,CAAC,SAAS,KAAK,UAAU;YAC1C,IAAI;YACJ,OAAO,EAAE,IAAI;SACd,CAAA;QAED,OAAO,IAAI,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,CAAA;IACtC,CAAC;IAEM,KAAK,CAAC,OAAO;QAClB,MAAM,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,yBAAyB,EAC7C,wCAAwC,CAAC,CAAA;QAE3C,aAAa,EAAE,CAAA;QAEf,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAiB,CAAA;QACjF,MAAM,SAAS,GAAc,MAAM,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAA;QAC/D,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,OAAO,EAAE,CAAC,CAAA;QACjD,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACtC,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,EAAE,CAAA;QAC3B,MAAM,OAAO,GAAG,IAAI,gBAAgB,CAAC,OAAO,CAAC,CAAA;QAC7C,MAAM,UAAU,GAAG,IAAI,iBAAiB,CAAC,QAAQ,EAAE,OAAO,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;QAC/E,MAAM,YAAY,GAAG,IAAI,YAAY,CAAC,YAAY,CAAC,CAAA;QACnD,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,UAAU,CAAC,CAAA;QAEhD,MAAM,WAAW,GAAG,IAAI,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAC9C,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,SAAS,EAAE,IAAI,EAAE,YAAY,CAAC,CAAA;QAE1D,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;QACxB,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,CAAA;QAC5B,0EAA0E;QAC1E,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAA;QAE3C,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAA;QAC5C,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;QAEvB,OAAO,MAAM,CAAA;IACf,CAAC;CACF;AAED,MAAM,OAAO,GAAG,YAAY,CAAA;AAC5B,MAAM,WAAW,GAAG,oBAAoB,CAAA;AACxC,MAAM,UAAU,GAAG,sBAAsB,CAAA;AAEzC,SAAS,aAAa;IACpB,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;IACxC,MAAM,KAAK,GAAc,OAAO,CAAC,GAAG,CAAC,OAAO,KAAK,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAA;IACvE,MAAM,OAAO,GAAG,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAA0B,CAAA;IAEhG,OAAO,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,KAAK,EAAE,CAAC,CAAA;IAEpD,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAA;IAEzC,MAAM,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAkB,CAAC,CAAA;AAC1F,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,WAAW;IAClB,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,KAAK,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,cAAc,KAAK,GAAG,CAAA;IAE/E,OAAO,KAAK,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;AACpD,CAAC"}
+{"version":3,"file":"Factory.js","sourceRoot":"","sources":["../source/Factory.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAA;AAChC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAsC,MAAM,UAAU,CAAA;AAC9E,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACpC,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AACtC,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AACtC,OAAO,EAAE,IAAI,EAAE,MAAM,gBAAgB,CAAA;AACrC,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAA;AAChD,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAA;AAC9D,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAA;AAClD,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAA;AAC9C,OAAO,KAAK,IAAI,MAAM,WAAW,CAAA;AACjC,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAA;AACvC,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAChD,OAAO,KAAK,IAAI,MAAM,iBAAiB,CAAA;AAMvC,MAAM,OAAO,OAAO;IACD,IAAI,CAAM;IAE3B,YAAoB,IAAU;QAC5B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAA;IAClB,CAAC;IAEM,KAAK,CAAC,MAAM,CAAE,OAAgB,EAAE,IAAiB;QACtD,MAAM,SAAS,GAAc,MAAM,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,CAAC,CAAA;QAC3E,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;QAE5E,4EAA4E;QAC5E,MAAM,MAAM,GAA8B;YACxC,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,SAAS,EAAE,OAAO,CAAC,IAAI;YACvB,QAAQ,EAAE,OAAO,CAAC,SAAS,KAAK,UAAU;YAC1C,IAAI;YACJ,OAAO,EAAE,IAAI;SACd,CAAA;QAED,OAAO,IAAI,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,CAAA;IACtC,CAAC;IAEM,KAAK,CAAC,OAAO;QAClB,MAAM,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,yBAAyB,EAC7C,wCAAwC,CAAC,CAAA;QAE3C,aAAa,EAAE,CAAA;QAEf,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAiB,CAAA;QACjF,MAAM,SAAS,GAAc,MAAM,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAA;QAC/D,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,OAAO,EAAE,CAAC,CAAA;QACjD,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACtC,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,EAAE,CAAA;QAC3B,MAAM,OAAO,GAAG,IAAI,gBAAgB,CAAC,OAAO,CAAC,CAAA;QAC7C,MAAM,UAAU,GAAG,IAAI,iBAAiB,CAAC,QAAQ,EAAE,OAAO,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;QAC/E,MAAM,YAAY,GAAG,IAAI,YAAY,CAAC,YAAY,EAAE,OAAO,CAAC,CAAA;QAC5D,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,UAAU,CAAC,CAAA;QAEhD,MAAM,WAAW,GAAG,IAAI,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAC9C,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,SAAS,EAAE,IAAI,EAAE,YAAY,CAAC,CAAA;QAE1D,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;QACxB,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,CAAA;QAC5B,0EAA0E;QAC1E,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAA;QAE3C,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAA;QAC5C,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;QAEvB,OAAO,MAAM,CAAA;IACf,CAAC;CACF;AAED,MAAM,OAAO,GAAG,YAAY,CAAA;AAC5B,MAAM,WAAW,GAAG,oBAAoB,CAAA;AACxC,MAAM,UAAU,GAAG,sBAAsB,CAAA;AAEzC,SAAS,aAAa;IACpB,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;IACxC,MAAM,KAAK,GAAc,OAAO,CAAC,GAAG,CAAC,OAAO,KAAK,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAA;IACvE,MAAM,OAAO,GAAG,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAA0B,CAAA;IAEhG,OAAO,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,KAAK,EAAE,CAAC,CAAA;IAEpD,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAA;IAEzC,MAAM,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAkB,CAAC,CAAA;AAC1F,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,WAAW;IAClB,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,KAAK,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,cAAc,KAAK,GAAG,CAAA;IAE/E,OAAO,KAAK,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;AACpD,CAAC"}

package/transpiled/HTTP/Server.d.ts

@@ -2,10 +2,11 @@ import { Connector } from '@toa.io/core';
 import { type OutgoingMessage } from './messages.js';
 import { Context } from './Context.js';
 import type { Protocol } from './types.js';
-import type { Bouncer } from '../Annotation.js';
+import type { Bouncer, OAuth } from '../Annotation.js';
 export declare class Server extends Connector {
     private readonly server;
     private readonly properties;
+    /** Host to authority. A map: a `Host` of `constructor` names what a plain object answers. */
     private readonly authorities;
     /** Tracked for the drain: `Http2Server` has no `closeIdleConnections`. */
     private readonly sessions;
@@ -40,6 +41,8 @@ interface Properties {
     ip?: string;
     /** Failed authentications an address may make; none are metered unless set. */
     bouncer?: Bouncer;
+    /** The authorization server this context exposes; none is exposed without it. */
+    oauth?: OAuth;
 }
 export type Options = {
     authorities: Properties['authorities'];