@toa.io/extensions.exposition 1.0.0-alpha.282 → 1.0.0-alpha.283

package/transpiled/directives/auth/types.d.ts

@@ -1,5 +1,5 @@
 import { type Component } from '@toa.io/core';
-import { type Maybe } from '@toa.io/types';
+import { type Maybe } from '@toa.io/core';
 import { type Parameter } from '../../RTD/index.js';
 import type * as http from '../../HTTP/index.js';
 import type * as io from '../../io.js';
@@ -14,6 +14,8 @@ export interface Identity {
     roles?: string[];
     permissions?: Record<string, string[]>;
     scheme: string | null;
+    /** The component that verified the credentials; none for a transient identity. */
+    provider?: Remote;
     refresh: boolean;
 }
 export interface Extension {
@@ -32,5 +34,5 @@ export type AuthenticationResult = Maybe<{
 export type Scheme = 'basic' | 'token' | 'bearer' | 'code' | 'otp';
 export type Remote = 'basic' | 'federation' | 'tokens' | 'roles' | 'bans' | 'otp';
 export type Discovery = Record<Remote, Promise<Component>>;
-export type Schemes = Record<Scheme, Component>;
+export type Components = Partial<Record<Remote, Component>>;
 export type Create = (name: string, value: any, ...args: any[]) => Directive;

package/transpiled/directives/cache/Cache.js

@@ -13,11 +13,18 @@ export class Cache {
         return null;
     }
     async settle(directives, context, response) {
+        const directive = directives[0];
+        response.headers ??= new Headers();
+        // `cache:exact` sets what it is given, whatever the method: whether a reply may be
+        // stored at all is not a question about the method's cacheability, and a token
+        // endpoint answers a POST it must not have kept
+        if (directive instanceof Exact) {
+            directive.set(context, response.headers);
+            return;
+        }
         const method = context.request.method;
         if (method !== 'GET' && method !== 'HEAD')
             return;
-        const directive = directives[0];
-        response.headers ??= new Headers();
         if (directive === undefined) {
             if (context.identity !== null && !Control.disabled(response.headers)) {
                 response.headers.set('cache-control', 'private');

package/transpiled/directives/cache/Cache.js.map

@@ -1 +1 @@
-{"version":3,"file":"Cache.js","sourceRoot":"","sources":["../../../source/directives/cache/Cache.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AACtC,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAA;AAMlC,MAAM,OAAO,KAAK;IACA,IAAI,GAAW,OAAO,CAAA;IACtB,SAAS,GAAY,IAAI,CAAA;IAElC,MAAM,CAAE,IAAY,EAAE,KAAU;QACrC,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,CAAA;QAEhC,IAAI,KAAK,KAAK,SAAS;YACrB,MAAM,IAAI,KAAK,CAAC,oBAAoB,IAAI,sBAAsB,CAAC,CAAA;QAEjE,OAAO,IAAI,KAAK,CAAC,KAAK,CAAC,CAAA;IACzB,CAAC;IAEM,SAAS;QACd,OAAO,IAAI,CAAA;IACb,CAAC;IAEM,KAAK,CAAC,MAAM,CAAE,UAAuB,EAAE,OAA6B,EAAE,QAA8B;QACzG,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,CAAA;QAErC,IAAI,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,MAAM;YACvC,OAAM;QAER,MAAM,SAAS,GAAG,UAAU,CAAC,CAAC,CAAC,CAAA;QAE/B,QAAQ,CAAC,OAAO,KAAK,IAAI,OAAO,EAAE,CAAA;QAElC,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,IAAI,OAAO,CAAC,QAAQ,KAAK,IAAI,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;gBACrE,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,SAAS,CAAC,CAAA;gBAChD,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAA;YAClD,CAAC;QACH,CAAC;;YACC,SAAS,CAAC,GAAG,CAAC,OAAO,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAA;IAC5C,CAAC;CACF;AAED,MAAM,YAAY,GAAkD;IAClE,OAAO,EAAE,OAAO;IAChB,KAAK,EAAE,KAAK;CACb,CAAA"}
+{"version":3,"file":"Cache.js","sourceRoot":"","sources":["../../../source/directives/cache/Cache.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AACtC,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAA;AAMlC,MAAM,OAAO,KAAK;IACA,IAAI,GAAW,OAAO,CAAA;IACtB,SAAS,GAAY,IAAI,CAAA;IAElC,MAAM,CAAE,IAAY,EAAE,KAAU;QACrC,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,CAAA;QAEhC,IAAI,KAAK,KAAK,SAAS;YACrB,MAAM,IAAI,KAAK,CAAC,oBAAoB,IAAI,sBAAsB,CAAC,CAAA;QAEjE,OAAO,IAAI,KAAK,CAAC,KAAK,CAAC,CAAA;IACzB,CAAC;IAEM,SAAS;QACd,OAAO,IAAI,CAAA;IACb,CAAC;IAEM,KAAK,CAAC,MAAM,CAAE,UAAuB,EAAE,OAA6B,EAAE,QAA8B;QACzG,MAAM,SAAS,GAAG,UAAU,CAAC,CAAC,CAAC,CAAA;QAE/B,QAAQ,CAAC,OAAO,KAAK,IAAI,OAAO,EAAE,CAAA;QAElC,mFAAmF;QACnF,+EAA+E;QAC/E,gDAAgD;QAChD,IAAI,SAAS,YAAY,KAAK,EAAE,CAAC;YAC/B,SAAS,CAAC,GAAG,CAAC,OAAO,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAA;YAExC,OAAM;QACR,CAAC;QAED,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,CAAA;QAErC,IAAI,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,MAAM;YACvC,OAAM;QAER,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,IAAI,OAAO,CAAC,QAAQ,KAAK,IAAI,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;gBACrE,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,SAAS,CAAC,CAAA;gBAChD,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAA;YAClD,CAAC;QACH,CAAC;;YACC,SAAS,CAAC,GAAG,CAAC,OAAO,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAA;IAC5C,CAAC;CACF;AAED,MAAM,YAAY,GAAkD;IAClE,OAAO,EAAE,OAAO;IAChB,KAAK,EAAE,KAAK;CACb,CAAA"}

package/transpiled/directives/cache/Control.js

@@ -14,8 +14,6 @@ export class Control {
         return (directives & NO_STORE) === NO_STORE;
     }
     set(context, headers) {
-        if (!['GET', 'HEAD', 'OPTIONS'].includes(context.request.method))
-            return;
         this.control ??= this.resolve(context);
         if (Control.disabled(headers))
             return;

package/transpiled/directives/cache/Control.js.map

@@ -1 +1 @@
-{"version":3,"file":"Control.js","sourceRoot":"","sources":["../../../source/directives/cache/Control.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,WAAW,CAAA;AAGjC,MAAM,OAAO,OAAO;IACC,KAAK,CAAQ;IACxB,OAAO,GAAkB,IAAI,CAAA;IAC7B,IAAI,GAAY,KAAK,CAAA;IAE7B,YAAoB,KAAa;QAC/B,IAAI,CAAC,KAAK,GAAG,KAAK,CAAA;IACpB,CAAC;IAEM,MAAM,CAAC,QAAQ,CAAE,OAAgB;QACtC,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAA;QAE1C,IAAI,KAAK,KAAK,IAAI;YAChB,OAAO,KAAK,CAAA;QAEd,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,CAAA;QAE9B,OAAO,CAAC,UAAU,GAAG,QAAQ,CAAC,KAAK,QAAQ,CAAA;IAC7C,CAAC;IAEM,GAAG,CAAE,OAA6B,EAAE,OAAgB;QACzD,IAAI,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC;YAC9D,OAAM;QAER,IAAI,CAAC,OAAO,KAAK,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;QAEtC,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;YAC3B,OAAM;QAER,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,IAAI,CAAC,OAAO,CAAC,CAAA;QAE1C,IAAI,IAAI,CAAC,IAAI;YACX,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAA;IAC3C,CAAC;IAES,OAAO,CAAE,OAA6B;QAC9C,IAAI,OAAO,CAAC,QAAQ,KAAK,IAAI;YAC3B,OAAO,IAAI,CAAC,KAAK,CAAA;QAEnB,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAEnC,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,KAAK,OAAO;YACpC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAA;QAElB,IAAI,CAAC,UAAU,GAAG,CAAC,MAAM,GAAG,QAAQ,CAAC,CAAC,KAAK,MAAM;YAC/C,OAAO,YAAY,GAAG,IAAI,CAAC,KAAK,CAAA;QAElC,IAAI,CAAC,UAAU,GAAG,CAAC,MAAM,GAAG,OAAO,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;YAC5C,IAAI,CAAC,IAAI,GAAG,IAAI,CAAA;YAEhB,OAAO,WAAW,GAAG,IAAI,CAAC,KAAK,CAAA;QACjC,CAAC;QAED,OAAO,IAAI,CAAC,KAAK,CAAA;IACnB,CAAC;CACF;AAED,SAAS,IAAI,CAAE,KAAa;IAC1B,MAAM,UAAU,GAAG,KAAK,CAAC,KAAK,CAAC,aAAa,CAAC,CAAA;IAE7C,IAAI,UAAU,KAAK,IAAI;QACrB,OAAO,CAAC,CAAA;IAEV,IAAI,IAAI,GAAG,CAAC,CAAA;IAEZ,KAAK,MAAM,SAAS,IAAI,UAAU;QAChC,IAAI,IAAI,KAAK,CAAS,SAAS,EAC7B,SAAS,EAAE,OAAO,EAClB,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,QAAQ,EACpB,UAAU,EAAE,QAAQ,EACpB,CAAC,CAAC,CAAA;IAEN,OAAO,IAAI,CAAA;AACb,CAAC;AAED,MAAM,aAAa,GAAG,0CAA0C,CAAA;AAEhE,MAAM,MAAM,GAAG,CAAC,CAAA;AAChB,MAAM,OAAO,GAAG,CAAC,CAAA;AACjB,MAAM,QAAQ,GAAG,CAAC,CAAA;AAClB,MAAM,QAAQ,GAAG,CAAC,CAAA"}
+{"version":3,"file":"Control.js","sourceRoot":"","sources":["../../../source/directives/cache/Control.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,WAAW,CAAA;AAGjC,MAAM,OAAO,OAAO;IACC,KAAK,CAAQ;IACxB,OAAO,GAAkB,IAAI,CAAA;IAC7B,IAAI,GAAY,KAAK,CAAA;IAE7B,YAAoB,KAAa;QAC/B,IAAI,CAAC,KAAK,GAAG,KAAK,CAAA;IACpB,CAAC;IAEM,MAAM,CAAC,QAAQ,CAAE,OAAgB;QACtC,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAA;QAE1C,IAAI,KAAK,KAAK,IAAI;YAChB,OAAO,KAAK,CAAA;QAEd,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,CAAA;QAE9B,OAAO,CAAC,UAAU,GAAG,QAAQ,CAAC,KAAK,QAAQ,CAAA;IAC7C,CAAC;IAEM,GAAG,CAAE,OAA6B,EAAE,OAAgB;QACzD,IAAI,CAAC,OAAO,KAAK,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;QAEtC,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;YAC3B,OAAM;QAER,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,IAAI,CAAC,OAAO,CAAC,CAAA;QAE1C,IAAI,IAAI,CAAC,IAAI;YACX,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAA;IAC3C,CAAC;IAES,OAAO,CAAE,OAA6B;QAC9C,IAAI,OAAO,CAAC,QAAQ,KAAK,IAAI;YAC3B,OAAO,IAAI,CAAC,KAAK,CAAA;QAEnB,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAEnC,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,KAAK,OAAO;YACpC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAA;QAElB,IAAI,CAAC,UAAU,GAAG,CAAC,MAAM,GAAG,QAAQ,CAAC,CAAC,KAAK,MAAM;YAC/C,OAAO,YAAY,GAAG,IAAI,CAAC,KAAK,CAAA;QAElC,IAAI,CAAC,UAAU,GAAG,CAAC,MAAM,GAAG,OAAO,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;YAC5C,IAAI,CAAC,IAAI,GAAG,IAAI,CAAA;YAEhB,OAAO,WAAW,GAAG,IAAI,CAAC,KAAK,CAAA;QACjC,CAAC;QAED,OAAO,IAAI,CAAC,KAAK,CAAA;IACnB,CAAC;CACF;AAED,SAAS,IAAI,CAAE,KAAa;IAC1B,MAAM,UAAU,GAAG,KAAK,CAAC,KAAK,CAAC,aAAa,CAAC,CAAA;IAE7C,IAAI,UAAU,KAAK,IAAI;QACrB,OAAO,CAAC,CAAA;IAEV,IAAI,IAAI,GAAG,CAAC,CAAA;IAEZ,KAAK,MAAM,SAAS,IAAI,UAAU;QAChC,IAAI,IAAI,KAAK,CAAS,SAAS,EAC7B,SAAS,EAAE,OAAO,EAClB,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,QAAQ,EACpB,UAAU,EAAE,QAAQ,EACpB,CAAC,CAAC,CAAA;IAEN,OAAO,IAAI,CAAA;AACb,CAAC;AAED,MAAM,aAAa,GAAG,0CAA0C,CAAA;AAEhE,MAAM,MAAM,GAAG,CAAC,CAAA;AAChB,MAAM,OAAO,GAAG,CAAC,CAAA;AACjB,MAAM,QAAQ,GAAG,CAAC,CAAA;AAClB,MAAM,QAAQ,GAAG,CAAC,CAAA"}

package/transpiled/directives/index.js

@@ -7,6 +7,7 @@ import { io } from './io/index.js';
 import { map } from './map/index.js';
 import { req } from './require/index.js';
 import { flow } from './flow/index.js';
+import { discovery } from './oauth/index.js';
 export const families = [authorization, io, cache, map, req, flow, octets, dev];
-export const interceptors = [cors];
+export const interceptors = [cors, discovery];
 //# sourceMappingURL=index.js.map

package/transpiled/directives/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../source/directives/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAA;AAC/C,OAAO,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAA;AACxC,OAAO,EAAE,IAAI,EAAE,MAAM,iBAAiB,CAAA;AACtC,OAAO,EAAE,GAAG,EAAE,MAAM,gBAAgB,CAAA;AACpC,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAA;AAC1C,OAAO,EAAE,EAAE,EAAE,MAAM,eAAe,CAAA;AAClC,OAAO,EAAE,GAAG,EAAE,MAAM,gBAAgB,CAAA;AACpC,OAAO,EAAE,GAAG,EAAE,MAAM,oBAAoB,CAAA;AACxC,OAAO,EAAE,IAAI,EAAE,MAAM,iBAAiB,CAAA;AAItC,MAAM,CAAC,MAAM,QAAQ,GAAsB,CAAC,aAAa,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,CAAA;AAClG,MAAM,CAAC,MAAM,YAAY,GAAkB,CAAC,IAAI,CAAC,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../source/directives/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAA;AAC/C,OAAO,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAA;AACxC,OAAO,EAAE,IAAI,EAAE,MAAM,iBAAiB,CAAA;AACtC,OAAO,EAAE,GAAG,EAAE,MAAM,gBAAgB,CAAA;AACpC,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAA;AAC1C,OAAO,EAAE,EAAE,EAAE,MAAM,eAAe,CAAA;AAClC,OAAO,EAAE,GAAG,EAAE,MAAM,gBAAgB,CAAA;AACpC,OAAO,EAAE,GAAG,EAAE,MAAM,oBAAoB,CAAA;AACxC,OAAO,EAAE,IAAI,EAAE,MAAM,iBAAiB,CAAA;AACtC,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AAI5C,MAAM,CAAC,MAAM,QAAQ,GAAsB,CAAC,aAAa,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,CAAA;AAClG,MAAM,CAAC,MAAM,YAAY,GAAkB,CAAC,IAAI,EAAE,SAAS,CAAC,CAAA"}

package/transpiled/directives/io/IO.js

@@ -1,6 +1,7 @@
 import { Output } from './Output.js';
 import { Input } from './Input.js';
 import { Throttle } from './Throttle.js';
+import { Status } from './Status.js';
 import { Sync } from './lib/throttle/index.js';
 import { ATOM_GROUP } from '../../const.js';
 export class IO {
@@ -48,6 +49,7 @@ export class IO {
 const constructors = {
     input: Input,
     output: Output,
+    status: Status,
     throttle: Throttle
 };
 const DENIAL = new Output([]);

package/transpiled/directives/io/IO.js.map

@@ -1 +1 @@
-{"version":3,"file":"IO.js","sourceRoot":"","sources":["../../../source/directives/io/IO.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACpC,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAA;AAClC,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AACxC,OAAO,EAAE,IAAI,EAAE,MAAM,yBAAyB,CAAA;AAK9C,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAG3C,MAAM,OAAO,EAAE;IACG,IAAI,GAAG,IAAI,CAAA;IACX,SAAS,GAAG,IAAI,CAAA;IAExB,IAAI,CAAkB;IAE9B,uFAAuF;IAC/E,IAAI,GAAgB,IAAI,CAAA;IAEzB,KAAK,CAAE,IAAqB;QACjC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAA;IAClB,CAAC;IAED,sCAAsC;IAC/B,MAAM,CAAE,IAAY,EAAE,KAAc,EAAE,OAAgB,EAAE,KAAa;QAC1E,IAAI,CAAC,CAAC,IAAI,IAAI,YAAY,CAAC;YACzB,MAAM,IAAI,KAAK,CAAC,iBAAiB,IAAI,sBAAsB,CAAC,CAAA;QAE9D,MAAM,SAAS,GAAG,YAAY,CAAC,IAAI,CAAC,CAAA;QAEpC,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;QAEzB,IAAI,IAAI,KAAK,UAAU;YACrB,IAAI,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAA;QAEpD,OAAO,IAAI,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,IAAK,EAAE,KAAK,CAAC,CAAA;IAChD,CAAC;IAEM,SAAS,CAAE,UAAuB,EAAE,OAAqB,EAC9D,UAAuB;QACvB,IAAI,UAAU,GAAG,KAAK,CAAA;QAEtB,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;YACnC,UAAU,KAAK,SAAS,YAAY,MAAM,CAAA;YAE1C,SAAS,CAAC,SAAS,CAAC,OAAO,EAAE,UAAU,CAAC,CAAA;QAC1C,CAAC;QAED,IAAI,CAAC,UAAU;YACb,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,UAAU,CAAC,CAAA;QAEvC,OAAO,IAAI,CAAA;IACb,CAAC;IAEM,MAAM,CAAE,UAAuB,EAAE,OAAqB,EAC3D,MAA4B;QAC5B,KAAK,MAAM,SAAS,IAAI,UAAU;YAChC,SAAS,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;IACvC,CAAC;IAED;;;;OAIG;IACI,OAAO;QACZ,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,CAAA;IACtB,CAAC;CACF;AAED,MAAM,YAAY,GAAgC;IAChD,KAAK,EAAE,KAAK;IACZ,MAAM,EAAE,MAAM;IACd,QAAQ,EAAE,QAAQ;CACnB,CAAA;AAED,MAAM,MAAM,GAAc,IAAI,MAAM,CAAC,EAAE,CAAC,CAAA"}
+{"version":3,"file":"IO.js","sourceRoot":"","sources":["../../../source/directives/io/IO.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACpC,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAA;AAClC,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AACxC,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACpC,OAAO,EAAE,IAAI,EAAE,MAAM,yBAAyB,CAAA;AAK9C,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAG3C,MAAM,OAAO,EAAE;IACG,IAAI,GAAG,IAAI,CAAA;IACX,SAAS,GAAG,IAAI,CAAA;IAExB,IAAI,CAAkB;IAE9B,uFAAuF;IAC/E,IAAI,GAAgB,IAAI,CAAA;IAEzB,KAAK,CAAE,IAAqB;QACjC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAA;IAClB,CAAC;IAED,sCAAsC;IAC/B,MAAM,CAAE,IAAY,EAAE,KAAc,EAAE,OAAgB,EAAE,KAAa;QAC1E,IAAI,CAAC,CAAC,IAAI,IAAI,YAAY,CAAC;YACzB,MAAM,IAAI,KAAK,CAAC,iBAAiB,IAAI,sBAAsB,CAAC,CAAA;QAE9D,MAAM,SAAS,GAAG,YAAY,CAAC,IAAI,CAAC,CAAA;QAEpC,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;QAEzB,IAAI,IAAI,KAAK,UAAU;YACrB,IAAI,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAA;QAEpD,OAAO,IAAI,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,IAAK,EAAE,KAAK,CAAC,CAAA;IAChD,CAAC;IAEM,SAAS,CAAE,UAAuB,EAAE,OAAqB,EAC9D,UAAuB;QACvB,IAAI,UAAU,GAAG,KAAK,CAAA;QAEtB,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;YACnC,UAAU,KAAK,SAAS,YAAY,MAAM,CAAA;YAE1C,SAAS,CAAC,SAAS,CAAC,OAAO,EAAE,UAAU,CAAC,CAAA;QAC1C,CAAC;QAED,IAAI,CAAC,UAAU;YACb,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,UAAU,CAAC,CAAA;QAEvC,OAAO,IAAI,CAAA;IACb,CAAC;IAEM,MAAM,CAAE,UAAuB,EAAE,OAAqB,EAC3D,MAA4B;QAC5B,KAAK,MAAM,SAAS,IAAI,UAAU;YAChC,SAAS,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;IACvC,CAAC;IAED;;;;OAIG;IACI,OAAO;QACZ,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,CAAA;IACtB,CAAC;CACF;AAED,MAAM,YAAY,GAAgC;IAChD,KAAK,EAAE,KAAK;IACZ,MAAM,EAAE,MAAM;IACd,MAAM,EAAE,MAAM;IACd,QAAQ,EAAE,QAAQ;CACnB,CAAA;AAED,MAAM,MAAM,GAAc,IAAI,MAAM,CAAC,EAAE,CAAC,CAAA"}

package/transpiled/directives/io/Output.js

@@ -24,7 +24,10 @@ export class Output {
     }
     restriction(context) {
         return (message) => {
-            const error = message.status !== undefined && message.status >= 300;
+            // what the gateway built is its own — a code and a message — and a restriction has
+            // nothing to say about it; everything else is a reply the operation returned, and is
+            // restricted whatever status it carries
+            const error = message.authentic === true;
             const stream = message.body instanceof Stream;
             const none = message.body === undefined || message.body === null;
             if (this.disabled || error || stream || none)

package/transpiled/directives/io/Output.js.map

@@ -1 +1 @@
-{"version":3,"file":"Output.js","sourceRoot":"","sources":["../../../source/directives/io/Output.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACpC,OAAO,EAAE,OAAO,EAAE,MAAM,UAAU,CAAA;AAClC,OAAO,KAAK,OAAO,MAAM,cAAc,CAAA;AAMvC,MAAM,OAAO,MAAM;IACA,QAAQ,GAAY,KAAK,CAAA;IACzB,OAAO,GAAY,IAAI,CAAA;IACvB,WAAW,GAAa,EAAE,CAAA;IAC1B,OAAO,CAAa;IAErC,YAAoB,WAAwB;QAC1C,IAAI,OAAO,WAAW,KAAK,SAAS;YAClC,IAAI,WAAW;gBACb,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAA;;gBAEpB,IAAI,CAAC,OAAO,GAAG,KAAK,CAAA;;YAGtB,IAAI,CAAC,WAAW,GAAG,WAAW,CAAA;QAEhC,IAAI,CAAC,OAAO,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;IAC1C,CAAC;IAEM,MAAM,CAAC,QAAQ,CAAE,WAAoB;QAC1C,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,gCAAgC,CAAC,CAAA;IACxE,CAAC;IAEM,SAAS,CAAE,OAAgB;QAChC,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAA;IAC5D,CAAC;IAEO,WAAW,CAAE,OAAgB;QACnC,OAAO,CAAC,OAAwB,EAAQ,EAAE;YACxC,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,KAAK,SAAS,IAAI,OAAO,CAAC,MAAM,IAAI,GAAG,CAAA;YACnE,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,YAAY,MAAM,CAAA;YAC7C,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,KAAK,SAAS,IAAI,OAAO,CAAC,IAAI,KAAK,IAAI,CAAA;YAEhE,IAAI,IAAI,CAAC,QAAQ,IAAI,KAAK,IAAI,MAAM,IAAI,IAAI;gBAC1C,OAAM;YAER,IAAI,OAAO,OAAO,CAAC,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACtE,IAAI,IAAI,CAAC,OAAO;oBACd,OAAO,CAAC,IAAI,CAAC,4EAA4E,EACvF,EAAE,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAA;gBAEnC,OAAO,OAAO,CAAC,IAAI,CAAA;gBAEnB,OAAM;YACR,CAAC;YAED,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAU,OAAO,CAAC,IAAI,EAC5C,oEAAoE,CAAC,CAAA;YAEvE,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC;gBAC7B,OAAO,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,MAAiB,CAAC,CAAC,CAAA;;gBAExE,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;QACzC,CAAC,CAAA;IACH,CAAC;IAED,uFAAuF;IAC/E,GAAG,CAAE,OAAgB;QAC3B,MAAM,MAAM,GAAY,EAAE,CAAA;QAE1B,+EAA+E;QAC/E,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC;YACpC,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC;gBACvB,MAAM,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,CAAA;QAE9B,OAAO,MAAM,CAAA;IACf,CAAC;CACF"}
+{"version":3,"file":"Output.js","sourceRoot":"","sources":["../../../source/directives/io/Output.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACpC,OAAO,EAAE,OAAO,EAAE,MAAM,UAAU,CAAA;AAClC,OAAO,KAAK,OAAO,MAAM,cAAc,CAAA;AAMvC,MAAM,OAAO,MAAM;IACA,QAAQ,GAAY,KAAK,CAAA;IACzB,OAAO,GAAY,IAAI,CAAA;IACvB,WAAW,GAAa,EAAE,CAAA;IAC1B,OAAO,CAAa;IAErC,YAAoB,WAAwB;QAC1C,IAAI,OAAO,WAAW,KAAK,SAAS;YAClC,IAAI,WAAW;gBACb,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAA;;gBAEpB,IAAI,CAAC,OAAO,GAAG,KAAK,CAAA;;YAGtB,IAAI,CAAC,WAAW,GAAG,WAAW,CAAA;QAEhC,IAAI,CAAC,OAAO,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;IAC1C,CAAC;IAEM,MAAM,CAAC,QAAQ,CAAE,WAAoB;QAC1C,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,gCAAgC,CAAC,CAAA;IACxE,CAAC;IAEM,SAAS,CAAE,OAAgB;QAChC,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAA;IAC5D,CAAC;IAEO,WAAW,CAAE,OAAgB;QACnC,OAAO,CAAC,OAAwB,EAAQ,EAAE;YACxC,mFAAmF;YACnF,qFAAqF;YACrF,wCAAwC;YACxC,MAAM,KAAK,GAAG,OAAO,CAAC,SAAS,KAAK,IAAI,CAAA;YACxC,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,YAAY,MAAM,CAAA;YAC7C,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,KAAK,SAAS,IAAI,OAAO,CAAC,IAAI,KAAK,IAAI,CAAA;YAEhE,IAAI,IAAI,CAAC,QAAQ,IAAI,KAAK,IAAI,MAAM,IAAI,IAAI;gBAC1C,OAAM;YAER,IAAI,OAAO,OAAO,CAAC,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACtE,IAAI,IAAI,CAAC,OAAO;oBACd,OAAO,CAAC,IAAI,CAAC,4EAA4E,EACvF,EAAE,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAA;gBAEnC,OAAO,OAAO,CAAC,IAAI,CAAA;gBAEnB,OAAM;YACR,CAAC;YAED,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAU,OAAO,CAAC,IAAI,EAC5C,oEAAoE,CAAC,CAAA;YAEvE,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC;gBAC7B,OAAO,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,MAAiB,CAAC,CAAC,CAAA;;gBAExE,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;QACzC,CAAC,CAAA;IACH,CAAC;IAED,uFAAuF;IAC/E,GAAG,CAAE,OAAgB;QAC3B,MAAM,MAAM,GAAY,EAAE,CAAA;QAE1B,+EAA+E;QAC/E,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC;YACpC,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC;gBACvB,MAAM,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,CAAA;QAE9B,OAAO,MAAM,CAAA;IACf,CAAC;CACF"}

package/transpiled/directives/io/Status.d.ts

@@ -0,0 +1,19 @@
+import type { Directive } from './Directive.js';
+import type * as http from '../../HTTP/index.js';
+/**
+ * The status of the reply, taken from a property of what the operation returned and removed
+ * from it — an outcome the operation knows and the transport does not, like a protocol that
+ * states its error as a body rather than as a status of its own.
+ *
+ * Settled rather than transformed, so the status is set before anything reads it. A reply of
+ * 300 or above is left as the operation built it, which `io:output` does not restrict: a
+ * failure and a success are different shapes, and one list of permitted properties does not
+ * describe both.
+ */
+export declare class Status implements Directive {
+    private readonly property;
+    constructor(property: unknown);
+    static validate(value: unknown): asserts value is string;
+    preflight(): void;
+    settle(_: unknown, response: http.OutgoingMessage): void;
+}

package/transpiled/directives/io/Status.js

@@ -0,0 +1,34 @@
+import assert from 'node:assert';
+/**
+ * The status of the reply, taken from a property of what the operation returned and removed
+ * from it — an outcome the operation knows and the transport does not, like a protocol that
+ * states its error as a body rather than as a status of its own.
+ *
+ * Settled rather than transformed, so the status is set before anything reads it. A reply of
+ * 300 or above is left as the operation built it, which `io:output` does not restrict: a
+ * failure and a success are different shapes, and one list of permitted properties does not
+ * describe both.
+ */
+export class Status {
+    property;
+    constructor(property) {
+        this.property = property;
+    }
+    static validate(value) {
+        assert.ok(typeof value === 'string', '`io:status` must be a string');
+    }
+    preflight() {
+        // nothing to do until the operation has answered
+    }
+    settle(_, response) {
+        const body = response.body;
+        if (body === null || typeof body !== 'object' || !(this.property in body))
+            return;
+        const value = body[this.property];
+        assert.ok(typeof value === 'number', `\`io:status\` expects '${this.property}' to be a number`);
+        response.status = value;
+        // eslint-disable-next-line @typescript-eslint/no-dynamic-delete
+        delete body[this.property];
+    }
+}
+//# sourceMappingURL=Status.js.map

package/transpiled/directives/io/Status.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Status.js","sourceRoot":"","sources":["../../../source/directives/io/Status.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAA;AAIhC;;;;;;;;;GASG;AACH,MAAM,OAAO,MAAM;IACA,QAAQ,CAAQ;IAEjC,YAAoB,QAAiB;QACnC,IAAI,CAAC,QAAQ,GAAG,QAAkB,CAAA;IACpC,CAAC;IAEM,MAAM,CAAC,QAAQ,CAAE,KAAc;QACpC,MAAM,CAAC,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,EAAE,8BAA8B,CAAC,CAAA;IACtE,CAAC;IAEM,SAAS;QACd,iDAAiD;IACnD,CAAC;IAEM,MAAM,CAAE,CAAU,EAAE,QAA8B;QACvD,MAAM,IAAI,GAAY,QAAQ,CAAC,IAAI,CAAA;QAEnC,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC;YACvE,OAAM;QAER,MAAM,KAAK,GAAa,IAAgC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QAEvE,MAAM,CAAC,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,EACjC,0BAA0B,IAAI,CAAC,QAAQ,kBAAkB,CAAC,CAAA;QAE5D,QAAQ,CAAC,MAAM,GAAG,KAAK,CAAA;QAEvB,gEAAgE;QAChE,OAAQ,IAAgC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;IACzD,CAAC;CACF"}

package/transpiled/directives/oauth/Discovery.d.ts

@@ -0,0 +1,23 @@
+import type * as http from '../../HTTP/index.js';
+import type { Input, Output } from '../../io.js';
+import type { Interceptor } from '../../Interception.js';
+/**
+ * What a client reads before it can authenticate: where the authorization server is, and
+ * what this resource expects. Both are fixed paths a specification names, both must be
+ * answered to anyone, and both are a function of the annotation alone — nothing is read to
+ * build them, so they are built once per authority and served as they are.
+ *
+ * An interceptor rather than a route because `auth` runs before any directive: a client
+ * re-reading discovery while holding a stale token would have it verified, and then be
+ * refused a document that has to be public.
+ */
+export declare class Discovery implements Interceptor {
+    /**
+     * A map, because the key is the request's authority and an unconfigured host is passed
+     * through as itself: `Host: constructor` names something a plain object answers on its own.
+     */
+    private readonly authorities;
+    mount(options: http.Options): void;
+    reset(): void;
+    intercept(input: Input): Output;
+}

package/transpiled/directives/oauth/Discovery.js

@@ -0,0 +1,58 @@
+import { documents } from './documents.js';
+/**
+ * What a client reads before it can authenticate: where the authorization server is, and
+ * what this resource expects. Both are fixed paths a specification names, both must be
+ * answered to anyone, and both are a function of the annotation alone — nothing is read to
+ * build them, so they are built once per authority and served as they are.
+ *
+ * An interceptor rather than a route because `auth` runs before any directive: a client
+ * re-reading discovery while holding a stale token would have it verified, and then be
+ * refused a document that has to be public.
+ */
+export class Discovery {
+    /**
+     * A map, because the key is the request's authority and an unconfigured host is passed
+     * through as itself: `Host: constructor` names something a plain object answers on its own.
+     */
+    authorities = new Map();
+    mount(options) {
+        this.authorities.clear();
+        if (options.oauth === undefined)
+            return;
+        for (const [authority, host] of Object.entries(options.authorities))
+            this.authorities.set(authority, documents(origin(host), options.oauth));
+    }
+    reset() {
+        this.authorities.clear();
+    }
+    intercept(input) {
+        const known = this.authorities.get(input.authority);
+        if (known === undefined)
+            return null;
+        // every reply, not just a document's: the challenge is what points a client here
+        input.pipelines.response.push((response) => {
+            if (response.status !== UNAUTHORIZED)
+                return;
+            response.headers ??= new Headers();
+            response.headers.set('www-authenticate', known.challenge(input.url.pathname));
+        });
+        const body = known.read(input.url.pathname);
+        if (body === undefined)
+            return null;
+        return { body, headers: new Headers({ 'cache-control': 'public, max-age=3600' }) };
+    }
+}
+/**
+ * The absolute URL an authority is reached at. Loopback is served over http and everything
+ * else over https: the gateway may sit behind a terminating proxy, so the connection does
+ * not say which, and the configured host does. Taken from the configuration rather than
+ * from the request's `host`, which is the client's to write.
+ */
+function origin(host) {
+    const name = host.split(':')[0];
+    const loopback = name === 'localhost' || name === '127.0.0.1' || name === '[::1]' ||
+        name.endsWith('.localhost');
+    return `${loopback ? 'http' : 'https'}://${host}`;
+}
+const UNAUTHORIZED = 401;
+//# sourceMappingURL=Discovery.js.map

package/transpiled/directives/oauth/Discovery.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Discovery.js","sourceRoot":"","sources":["../../../source/directives/oauth/Discovery.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAkB,MAAM,gBAAgB,CAAA;AAK1D;;;;;;;;;GASG;AACH,MAAM,OAAO,SAAS;IACpB;;;OAGG;IACc,WAAW,GAAG,IAAI,GAAG,EAAqB,CAAA;IAEpD,KAAK,CAAE,OAAqB;QACjC,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,CAAA;QAExB,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS;YAC7B,OAAM;QAER,KAAK,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC;YACjE,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,SAAS,EAAE,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,CAAA;IAC3E,CAAC;IAEM,KAAK;QACV,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,CAAA;IAC1B,CAAC;IAEM,SAAS,CAAE,KAAY;QAC5B,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAA;QAEnD,IAAI,KAAK,KAAK,SAAS;YACrB,OAAO,IAAI,CAAA;QAEb,iFAAiF;QACjF,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE;YACzC,IAAI,QAAQ,CAAC,MAAM,KAAK,YAAY;gBAClC,OAAM;YAER,QAAQ,CAAC,OAAO,KAAK,IAAI,OAAO,EAAE,CAAA;YAClC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,EAAE,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAA;QAC/E,CAAC,CAAC,CAAA;QAEF,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;QAE3C,IAAI,IAAI,KAAK,SAAS;YACpB,OAAO,IAAI,CAAA;QAEb,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,OAAO,CAAC,EAAE,eAAe,EAAE,sBAAsB,EAAE,CAAC,EAAE,CAAA;IACpF,CAAC;CACF;AAED;;;;;GAKG;AACH,SAAS,MAAM,CAAE,IAAY;IAC3B,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAA;IAE/B,MAAM,QAAQ,GAAG,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,OAAO;QAC/E,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAA;IAE7B,OAAO,GAAG,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,MAAM,IAAI,EAAE,CAAA;AACnD,CAAC;AAED,MAAM,YAAY,GAAG,GAAG,CAAA"}

package/transpiled/directives/oauth/documents.d.ts

@@ -0,0 +1,9 @@
+import type { OAuth } from '../../Annotation.js';
+/** The discovery documents of one authority, and the challenge that points at them. */
+export interface Documents {
+    /** The document a path names, or nothing when it names none. */
+    read: (pathname: string) => object | undefined;
+    /** `WWW-Authenticate` for a request to this path, which names the resource it failed at. */
+    challenge: (pathname: string) => string;
+}
+export declare function documents(issuer: string, oauth: OAuth): Documents;

package/transpiled/directives/oauth/documents.js

@@ -0,0 +1,82 @@
+export function documents(issuer, oauth) {
+    const server = authorizationServer(issuer, oauth);
+    const resources = protectedResources(issuer, oauth);
+    const scope = oauth.scopes === undefined ? '' : `, scope="${oauth.scopes.join(' ')}"`;
+    function read(pathname) {
+        if (pathname === AUTHORIZATION_SERVER || pathname === OPENID_CONFIGURATION)
+            return server;
+        if (pathname.startsWith(PROTECTED_RESOURCE))
+            return resources.get(pathname.slice(PROTECTED_RESOURCE.length));
+        return undefined;
+    }
+    function challenge(pathname) {
+        return `Bearer resource_metadata="${issuer}${PROTECTED_RESOURCE}${suffix(oauth, pathname)}"${scope}`;
+    }
+    return { read, challenge };
+}
+/**
+ * RFC 8414. `authorization_endpoint` is the application's own page and may be anywhere;
+ * everything else this extension serves. Both flags are load-bearing for a client that
+ * prefers Client ID Metadata Documents: without either it falls back to registration.
+ */
+function authorizationServer(issuer, oauth) {
+    const metadata = {
+        issuer,
+        authorization_endpoint: oauth.authorize,
+        token_endpoint: `${issuer}${TOKEN}`,
+        response_types_supported: ['code'],
+        grant_types_supported: ['authorization_code'],
+        code_challenge_methods_supported: ['S256'],
+        token_endpoint_auth_methods_supported: ['none'],
+        client_id_metadata_document_supported: true,
+        authorization_response_iss_parameter_supported: true
+    };
+    if (oauth.registration === 'open')
+        metadata.registration_endpoint = `${issuer}${REGISTRATION}`;
+    if (oauth.scopes !== undefined)
+        metadata.scopes_supported = oauth.scopes;
+    return metadata;
+}
+/**
+ * RFC 9728, keyed by the path the well-known segment is followed by: a client resolving
+ * `https://host/mcp` reads `/.well-known/oauth-protected-resource/mcp`, and one that names
+ * no path reads the document at the origin.
+ */
+function protectedResources(issuer, oauth) {
+    const map = new Map();
+    for (const path of oauth.resources ?? [])
+        map.set(canonical(path), resource(issuer, canonical(path), oauth));
+    map.set('', resource(issuer, '', oauth));
+    return map;
+}
+function resource(issuer, path, oauth) {
+    const metadata = {
+        resource: issuer + path,
+        authorization_servers: [issuer],
+        bearer_methods_supported: ['header']
+    };
+    if (oauth.scopes !== undefined)
+        metadata.scopes_supported = oauth.scopes;
+    return metadata;
+}
+/** The document a request to this path was refused against: the longest resource holding it. */
+function suffix(oauth, pathname) {
+    let longest = '';
+    for (const path of oauth.resources ?? [])
+        if (pathname.startsWith(path) && path.length > longest.length)
+            longest = path;
+    return canonical(longest);
+}
+/**
+ * A resource is identified without its trailing slash — the form MCP asks for — while a
+ * route is declared with one, so `/mcp/` identifies `…/mcp`.
+ */
+function canonical(path) {
+    return path.endsWith('/') ? path.slice(0, -1) : path;
+}
+const AUTHORIZATION_SERVER = '/.well-known/oauth-authorization-server';
+const PROTECTED_RESOURCE = '/.well-known/oauth-protected-resource';
+const OPENID_CONFIGURATION = '/.well-known/openid-configuration';
+const TOKEN = '/identity/grants/';
+const REGISTRATION = '/identity/clients/';
+//# sourceMappingURL=documents.js.map

package/transpiled/directives/oauth/documents.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"documents.js","sourceRoot":"","sources":["../../../source/directives/oauth/documents.ts"],"names":[],"mappings":"AAWA,MAAM,UAAU,SAAS,CAAE,MAAc,EAAE,KAAY;IACrD,MAAM,MAAM,GAAG,mBAAmB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAA;IACjD,MAAM,SAAS,GAAG,kBAAkB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAA;IACnD,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,YAAY,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAA;IAErF,SAAS,IAAI,CAAE,QAAgB;QAC7B,IAAI,QAAQ,KAAK,oBAAoB,IAAI,QAAQ,KAAK,oBAAoB;YACxE,OAAO,MAAM,CAAA;QAEf,IAAI,QAAQ,CAAC,UAAU,CAAC,kBAAkB,CAAC;YACzC,OAAO,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC,CAAA;QAEjE,OAAO,SAAS,CAAA;IAClB,CAAC;IAED,SAAS,SAAS,CAAE,QAAgB;QAClC,OAAO,6BAA6B,MAAM,GAAG,kBAAkB,GAAG,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,IAAI,KAAK,EAAE,CAAA;IACtG,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAA;AAC5B,CAAC;AAED;;;;GAIG;AACH,SAAS,mBAAmB,CAAE,MAAc,EAAE,KAAY;IACxD,MAAM,QAAQ,GAA4B;QACxC,MAAM;QACN,sBAAsB,EAAE,KAAK,CAAC,SAAS;QACvC,cAAc,EAAE,GAAG,MAAM,GAAG,KAAK,EAAE;QACnC,wBAAwB,EAAE,CAAC,MAAM,CAAC;QAClC,qBAAqB,EAAE,CAAC,oBAAoB,CAAC;QAC7C,gCAAgC,EAAE,CAAC,MAAM,CAAC;QAC1C,qCAAqC,EAAE,CAAC,MAAM,CAAC;QAC/C,qCAAqC,EAAE,IAAI;QAC3C,8CAA8C,EAAE,IAAI;KACrD,CAAA;IAED,IAAI,KAAK,CAAC,YAAY,KAAK,MAAM;QAC/B,QAAQ,CAAC,qBAAqB,GAAG,GAAG,MAAM,GAAG,YAAY,EAAE,CAAA;IAE7D,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS;QAC5B,QAAQ,CAAC,gBAAgB,GAAG,KAAK,CAAC,MAAM,CAAA;IAE1C,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED;;;;GAIG;AACH,SAAS,kBAAkB,CAAE,MAAc,EAAE,KAAY;IACvD,MAAM,GAAG,GAAG,IAAI,GAAG,EAAkB,CAAA;IAErC,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,SAAS,IAAI,EAAE;QACtC,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,CAAC,CAAA;IAEpE,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,QAAQ,CAAC,MAAM,EAAE,EAAE,EAAE,KAAK,CAAC,CAAC,CAAA;IAExC,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,SAAS,QAAQ,CAAE,MAAc,EAAE,IAAY,EAAE,KAAY;IAC3D,MAAM,QAAQ,GAA4B;QACxC,QAAQ,EAAE,MAAM,GAAG,IAAI;QACvB,qBAAqB,EAAE,CAAC,MAAM,CAAC;QAC/B,wBAAwB,EAAE,CAAC,QAAQ,CAAC;KACrC,CAAA;IAED,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS;QAC5B,QAAQ,CAAC,gBAAgB,GAAG,KAAK,CAAC,MAAM,CAAA;IAE1C,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED,gGAAgG;AAChG,SAAS,MAAM,CAAE,KAAY,EAAE,QAAgB;IAC7C,IAAI,OAAO,GAAG,EAAE,CAAA;IAEhB,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,SAAS,IAAI,EAAE;QACtC,IAAI,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM;YAC3D,OAAO,GAAG,IAAI,CAAA;IAElB,OAAO,SAAS,CAAC,OAAO,CAAC,CAAA;AAC3B,CAAC;AAED;;;GAGG;AACH,SAAS,SAAS,CAAE,IAAY;IAC9B,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;AACtD,CAAC;AAED,MAAM,oBAAoB,GAAG,yCAAyC,CAAA;AACtE,MAAM,kBAAkB,GAAG,uCAAuC,CAAA;AAClE,MAAM,oBAAoB,GAAG,mCAAmC,CAAA;AAChE,MAAM,KAAK,GAAG,mBAAmB,CAAA;AACjC,MAAM,YAAY,GAAG,oBAAoB,CAAA"}

package/transpiled/directives/oauth/index.d.ts

@@ -0,0 +1,2 @@
+import { Discovery } from './Discovery.js';
+export declare const discovery: Discovery;

package/transpiled/directives/oauth/index.js

@@ -0,0 +1,3 @@
+import { Discovery } from './Discovery.js';
+export const discovery = new Discovery();
+//# sourceMappingURL=index.js.map

package/transpiled/directives/oauth/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../source/directives/oauth/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAE1C,MAAM,CAAC,MAAM,SAAS,GAAG,IAAI,SAAS,EAAE,CAAA"}

package/transpiled/index.d.ts

@@ -3,3 +3,5 @@ export { deployment } from './deployment.js';
 export { components } from './Composition.js';
 export { Factory } from './Factory.js';
 export type { Remotes } from './Remotes.js';
+export type { Claims, Identity } from './userland.js';
+export type * as octets from './octets.js';

package/transpiled/userland.d.ts

@@ -0,0 +1,39 @@
+/**
+ * What Exposition puts into an operation's input, for the operation to be written against.
+ *
+ * The gateway's own types are its business; these are the application's.
+ */
+/**
+ * The identity behind the call, as `auth:delegate` embeds it:
+ *
+ * ```yaml
+ * /echo:
+ *   GET:
+ *     auth:assert: true
+ *     auth:delegate: identity
+ *     endpoint: echo
+ * ```
+ *
+ * ```javascript
+ * export async function computation ({ identity }, context) { }
+ * ```
+ */
+export interface Identity {
+    readonly id: string;
+    /** What the identity holds. Delegation resolves them, so they are always here. */
+    roles: string[];
+    permissions?: Record<string, string[]>;
+    /** How the identity was authenticated; `null` for a transient one. */
+    scheme: string | null;
+    /** Whether the credentials presented are due to be exchanged. */
+    refresh: boolean;
+    /** The token's claims, where the identity was federated. */
+    claims?: Claims;
+}
+/** A federated token's payload: what it must carry, and whatever else the issuer put there. */
+export interface Claims {
+    iss: string;
+    sub: string;
+    aud?: string | string[];
+    [claim: string]: unknown;
+}

package/transpiled/userland.js

@@ -0,0 +1,7 @@
+/**
+ * What Exposition puts into an operation's input, for the operation to be written against.
+ *
+ * The gateway's own types are its business; these are the application's.
+ */
+export {};
+//# sourceMappingURL=userland.js.map

package/transpiled/userland.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"userland.js","sourceRoot":"","sources":["../source/userland.ts"],"names":[],"mappings":"AAAA;;;;GAIG"}