@toa.io/extensions.exposition 1.0.0-alpha.282 → 1.0.0-alpha.284

package/transpiled/directives/auth/Echo.d.ts

@@ -2,5 +2,7 @@ import type { OutgoingMessage } from '../../HTTP/index.js';
 import type { Directive, Identity, Context } from './types.js';
 export declare class Echo implements Directive {
     authorize(identity: Identity | null, context: Context): boolean;
+    /** What `authorize` answers, without inventing the identity it would go on to invent. */
+    admits(identity: Identity | null, context: Context): boolean;
     reply(context: Context): OutgoingMessage;
 }

package/transpiled/directives/auth/Echo.js

@@ -6,6 +6,10 @@ export class Echo {
         context.identity ??= create();
         return true;
     }
+    /** What `authorize` answers, without inventing the identity it would go on to invent. */
+    admits(identity, context) {
+        return !(identity === null && 'authorization' in context.request.headers);
+    }
     reply(context) {
         const body = context.identity;
         return body.scheme === null

package/transpiled/directives/auth/Echo.js.map

@@ -1 +1 @@
-{"version":3,"file":"Echo.js","sourceRoot":"","sources":["../../../source/directives/auth/Echo.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AAIpC,MAAM,OAAO,IAAI;IACR,SAAS,CAAE,QAAyB,EAAE,OAAgB;QAC3D,IAAI,QAAQ,KAAK,IAAI,IAAI,eAAe,IAAI,OAAO,CAAC,OAAO,CAAC,OAAO;YACjE,OAAO,KAAK,CAAA;QAEd,OAAO,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAA;QAE7B,OAAO,IAAI,CAAA;IACb,CAAC;IAEM,KAAK,CAAE,OAAgB;QAC5B,MAAM,IAAI,GAAG,OAAO,CAAC,QAAS,CAAA;QAE9B,OAAO,IAAI,CAAC,MAAM,KAAK,IAAI;YACzB,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE;YACvB,CAAC,CAAC,EAAE,IAAI,EAAE,CAAA;IACd,CAAC;CACF"}
+{"version":3,"file":"Echo.js","sourceRoot":"","sources":["../../../source/directives/auth/Echo.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AAIpC,MAAM,OAAO,IAAI;IACR,SAAS,CAAE,QAAyB,EAAE,OAAgB;QAC3D,IAAI,QAAQ,KAAK,IAAI,IAAI,eAAe,IAAI,OAAO,CAAC,OAAO,CAAC,OAAO;YACjE,OAAO,KAAK,CAAA;QAEd,OAAO,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAA;QAE7B,OAAO,IAAI,CAAA;IACb,CAAC;IAED,yFAAyF;IAClF,MAAM,CAAE,QAAyB,EAAE,OAAgB;QACxD,OAAO,CAAC,CAAC,QAAQ,KAAK,IAAI,IAAI,eAAe,IAAI,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;IAC3E,CAAC;IAEM,KAAK,CAAE,OAAgB;QAC5B,MAAM,IAAI,GAAG,OAAO,CAAC,QAAS,CAAA;QAE9B,OAAO,IAAI,CAAC,MAAM,KAAK,IAAI;YACzB,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE;YACvB,CAAC,CAAC,EAAE,IAAI,EAAE,CAAA;IACd,CAAC;CACF"}

package/transpiled/directives/auth/Incept.d.ts

@@ -1,7 +1,7 @@
 import * as http from '../../HTTP/index.js';
 import type { Directive, Discovery, Identity, Context } from './types.js';
 export declare class Incept implements Directive {
-    private static readonly schemes;
+    private static readonly components;
     private static discovery;
     private static bans;
     private readonly property;

package/transpiled/directives/auth/Incept.js

@@ -3,10 +3,10 @@ import { console } from 'openspan';
 import * as http from '../../HTTP/index.js';
 import { split } from './split.js';
 import { create } from './create.js';
-import { INCEPTION, UNKNOWN, provider as providerOf } from './schemes.js';
+import { INCEPTION, UNKNOWN, providers as providersOf } from './schemes.js';
 import { Role } from './Role.js';
 export class Incept {
-    static schemes = {};
+    static components = {};
     static discovery;
     static bans = null;
     property;
@@ -17,17 +17,21 @@ export class Incept {
     }
     static async incept(context, id) {
         const [scheme, credentials] = split(context.request.headers.authorization);
-        const provider = providerOf(scheme);
-        if (provider === undefined)
+        const candidates = providersOf(scheme);
+        if (candidates === undefined)
             throw new http.BadRequest('Authentication scheme is not supported');
-        if (!INCEPTION.includes(provider))
+        // a scheme several providers claim is incepted by the one that incepts; `Bearer`
+        // carries an access token this gateway issued, and an identity cannot be incepted
+        // from a credential it would itself have to exist to hold
+        const provider = candidates.find((candidate) => INCEPTION.includes(candidate));
+        if (provider === undefined)
             throw new http.Unauthorized();
         Incept.bans ??= await Incept.discovery.bans;
         const ban = await Incept.bans.invoke('observe', { query: { id } });
         if (ban.banned)
             throw new http.Unauthorized();
-        Incept.schemes[scheme] ??= await Incept.discovery[provider];
-        const identity = await Incept.schemes[scheme].invoke('incept', {
+        Incept.components[provider] ??= await Incept.discovery[provider];
+        const identity = await Incept.components[provider].invoke('incept', {
             input: {
                 scheme,
                 authority: context.authority,
@@ -38,7 +42,8 @@ export class Incept {
         if (identity instanceof Error)
             throw new http.UnprocessableEntity(identity);
         identity.scheme = scheme;
-        identity.roles = [];
+        // the roles are read where the token is minted: an Identity incepted as the principal
+        // has one already
         return identity;
     }
     /** Credentials that were rejected for any reason but being unknown are not incepted. */

package/transpiled/directives/auth/Incept.js.map

@@ -1 +1 @@
-{"version":3,"file":"Incept.js","sourceRoot":"","sources":["../../../source/directives/auth/Incept.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAA;AAChC,OAAO,EAAE,OAAO,EAAE,MAAM,UAAU,CAAA;AAClC,OAAO,KAAK,IAAI,MAAM,qBAAqB,CAAA;AAC3C,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAA;AAClC,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACpC,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,IAAI,UAAU,EAAE,MAAM,cAAc,CAAA;AACzE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAKhC,MAAM,OAAO,MAAM;IACT,MAAM,CAAU,OAAO,GAAY,EAAwB,CAAA;IAC3D,MAAM,CAAC,SAAS,CAAW;IAC3B,MAAM,CAAC,IAAI,GAAqB,IAAI,CAAA;IAE3B,QAAQ,CAAe;IAExC,YAAoB,QAAgB,EAAE,SAAoB;QACxD,MAAM,CAAC,EAAE,CAAC,QAAQ,KAAK,IAAI,IAAI,OAAO,QAAQ,KAAK,QAAQ,EACzD,8CAA8C,CAAC,CAAA;QAEjD,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAA;QACxB,MAAM,CAAC,SAAS,KAAK,SAAS,CAAA;IAChC,CAAC;IAEM,MAAM,CAAC,KAAK,CAAC,MAAM,CAAE,OAAgB,EAAE,EAAU;QACtD,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,aAAc,CAAC,CAAA;QAC3E,MAAM,QAAQ,GAAG,UAAU,CAAC,MAAM,CAAC,CAAA;QAEnC,IAAI,QAAQ,KAAK,SAAS;YACxB,MAAM,IAAI,IAAI,CAAC,UAAU,CAAC,wCAAwC,CAAC,CAAA;QAErE,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAC/B,MAAM,IAAI,IAAI,CAAC,YAAY,EAAE,CAAA;QAE/B,MAAM,CAAC,IAAI,KAAK,MAAM,MAAM,CAAC,SAAS,CAAC,IAAI,CAAA;QAE3C,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,MAAM,CAAM,SAAS,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAA;QAEvE,IAAI,GAAG,CAAC,MAAM;YACZ,MAAM,IAAI,IAAI,CAAC,YAAY,EAAE,CAAA;QAE/B,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,MAAM,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAA;QAE3D,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,CAAkB,QAAQ,EAAE;YAC9E,KAAK,EAAE;gBACL,MAAM;gBACN,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,EAAE;gBACF,WAAW;aACZ;SACF,CAAC,CAAA;QAEF,IAAI,QAAQ,YAAY,KAAK;YAC3B,MAAM,IAAI,IAAI,CAAC,mBAAmB,CAAC,QAAQ,CAAC,CAAA;QAE9C,QAAQ,CAAC,MAAM,GAAG,MAAM,CAAA;QACxB,QAAQ,CAAC,KAAK,GAAG,EAAE,CAAA;QAEnB,OAAO,QAAQ,CAAA;IACjB,CAAC;IAED,wFAAwF;IACjF,MAAM,CAAC,UAAU,CAAE,OAAgB;QACxC,OAAO,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,aAAa,KAAK,SAAS,IAAI,OAAO,CAAC,SAAS,KAAK,OAAO,CAAA;IAC7F,CAAC;IAEM,SAAS,CAAE,QAAyB,EAAE,OAAgB;QAC3D,OAAO,QAAQ,KAAK,IAAI,IAAI,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,CAAA;IACxD,CAAC;IAEM,KAAK,CAAE,OAAgB;QAC5B,IAAI,IAAI,CAAC,QAAQ,KAAK,IAAI;YACxB,OAAO,IAAI,CAAA;QAEb,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,CAAA;QAE1D,OAAO,EAAE,IAAI,EAAE,CAAA;IACjB,CAAC;IAEM,KAAK,CAAC,MAAM,CAAE,OAAgB,EAAE,QAA8B;QACnE,MAAM,EAAE,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,CAAA;QAEjD,IAAI,EAAE,KAAK,SAAS,EAAE,CAAC;YACrB,OAAO,CAAC,KAAK,CAAC,gEAAgE,EAAE;gBAC9E,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,QAAQ;aACT,CAAC,CAAA;YAEF,OAAM;QACR,CAAC;QAED,MAAM,CAAC,OAAO,EAAE,KAAK,QAAQ,EAAE,2BAA2B,IAAI,CAAC,QAAQ,2BAA2B,CAAC,CAAA;QAEnG,IAAI,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,aAAa,KAAK,SAAS;YACrD,OAAO,CAAC,QAAQ,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC,CAAA;aAChD,CAAC;YACJ,MAAM,QAAQ,GAAG,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAA;YACpD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,CAAA;YAE9D,OAAO,CAAC,QAAQ,GAAG,EAAE,GAAG,QAAQ,EAAE,KAAK,EAAE,CAAA;QAC3C,CAAC;IACH,CAAC"}
+{"version":3,"file":"Incept.js","sourceRoot":"","sources":["../../../source/directives/auth/Incept.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAA;AAChC,OAAO,EAAE,OAAO,EAAE,MAAM,UAAU,CAAA;AAClC,OAAO,KAAK,IAAI,MAAM,qBAAqB,CAAA;AAC3C,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAA;AAClC,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACpC,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,IAAI,WAAW,EAAE,MAAM,cAAc,CAAA;AAC3E,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAKhC,MAAM,OAAO,MAAM;IACT,MAAM,CAAU,UAAU,GAAe,EAAE,CAAA;IAC3C,MAAM,CAAC,SAAS,CAAW;IAC3B,MAAM,CAAC,IAAI,GAAqB,IAAI,CAAA;IAE3B,QAAQ,CAAe;IAExC,YAAoB,QAAgB,EAAE,SAAoB;QACxD,MAAM,CAAC,EAAE,CAAC,QAAQ,KAAK,IAAI,IAAI,OAAO,QAAQ,KAAK,QAAQ,EACzD,8CAA8C,CAAC,CAAA;QAEjD,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAA;QACxB,MAAM,CAAC,SAAS,KAAK,SAAS,CAAA;IAChC,CAAC;IAEM,MAAM,CAAC,KAAK,CAAC,MAAM,CAAE,OAAgB,EAAE,EAAU;QACtD,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,aAAc,CAAC,CAAA;QAC3E,MAAM,UAAU,GAAG,WAAW,CAAC,MAAM,CAAC,CAAA;QAEtC,IAAI,UAAU,KAAK,SAAS;YAC1B,MAAM,IAAI,IAAI,CAAC,UAAU,CAAC,wCAAwC,CAAC,CAAA;QAErE,iFAAiF;QACjF,kFAAkF;QAClF,0DAA0D;QAC1D,MAAM,QAAQ,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAA;QAE9E,IAAI,QAAQ,KAAK,SAAS;YACxB,MAAM,IAAI,IAAI,CAAC,YAAY,EAAE,CAAA;QAE/B,MAAM,CAAC,IAAI,KAAK,MAAM,MAAM,CAAC,SAAS,CAAC,IAAI,CAAA;QAE3C,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,MAAM,CAAM,SAAS,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAA;QAEvE,IAAI,GAAG,CAAC,MAAM;YACZ,MAAM,IAAI,IAAI,CAAC,YAAY,EAAE,CAAA;QAE/B,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,KAAK,MAAM,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAA;QAEhE,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAE,CAAC,MAAM,CAAkB,QAAQ,EAAE;YACpF,KAAK,EAAE;gBACL,MAAM;gBACN,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,EAAE;gBACF,WAAW;aACZ;SACF,CAAC,CAAA;QAEF,IAAI,QAAQ,YAAY,KAAK;YAC3B,MAAM,IAAI,IAAI,CAAC,mBAAmB,CAAC,QAAQ,CAAC,CAAA;QAE9C,QAAQ,CAAC,MAAM,GAAG,MAAM,CAAA;QAExB,sFAAsF;QACtF,kBAAkB;QAClB,OAAO,QAAQ,CAAA;IACjB,CAAC;IAED,wFAAwF;IACjF,MAAM,CAAC,UAAU,CAAE,OAAgB;QACxC,OAAO,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,aAAa,KAAK,SAAS,IAAI,OAAO,CAAC,SAAS,KAAK,OAAO,CAAA;IAC7F,CAAC;IAEM,SAAS,CAAE,QAAyB,EAAE,OAAgB;QAC3D,OAAO,QAAQ,KAAK,IAAI,IAAI,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,CAAA;IACxD,CAAC;IAEM,KAAK,CAAE,OAAgB;QAC5B,IAAI,IAAI,CAAC,QAAQ,KAAK,IAAI;YACxB,OAAO,IAAI,CAAA;QAEb,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,CAAA;QAE1D,OAAO,EAAE,IAAI,EAAE,CAAA;IACjB,CAAC;IAEM,KAAK,CAAC,MAAM,CAAE,OAAgB,EAAE,QAA8B;QACnE,MAAM,EAAE,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,CAAA;QAEjD,IAAI,EAAE,KAAK,SAAS,EAAE,CAAC;YACrB,OAAO,CAAC,KAAK,CAAC,gEAAgE,EAAE;gBAC9E,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,QAAQ;aACT,CAAC,CAAA;YAEF,OAAM;QACR,CAAC;QAED,MAAM,CAAC,OAAO,EAAE,KAAK,QAAQ,EAAE,2BAA2B,IAAI,CAAC,QAAQ,2BAA2B,CAAC,CAAA;QAEnG,IAAI,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,aAAa,KAAK,SAAS;YACrD,OAAO,CAAC,QAAQ,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC,CAAA;aAChD,CAAC;YACJ,MAAM,QAAQ,GAAG,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAA;YACpD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,CAAA;YAE9D,OAAO,CAAC,QAAQ,GAAG,EAAE,GAAG,QAAQ,EAAE,KAAK,EAAE,CAAA;QAC3C,CAAC;IACH,CAAC"}

package/transpiled/directives/auth/Role.d.ts

@@ -9,6 +9,8 @@ export declare class Role implements Directive {
     constructor(roles: string | string[], discovery: Promise<Component>);
     static get(identity: Identity, discovery: Promise<Component>): Promise<string[]>;
     authorize(identity: Identity | null, _: unknown, parameters: Parameter[]): Promise<boolean>;
+    /** A role naming a route variable cannot be told from a description, which has no values. */
+    admits(identity: Identity | null): Promise<boolean | undefined>;
     private match;
     private substitute;
 }

package/transpiled/directives/auth/Role.js

@@ -24,6 +24,15 @@ export class Role {
         identity.roles ??= await Role.get(identity, this.discovery);
         return this.match(identity.roles, parameters);
     }
+    /** A role naming a route variable cannot be told from a description, which has no values. */
+    async admits(identity) {
+        if (this.dynamic)
+            return undefined;
+        if (identity === null)
+            return false;
+        identity.roles ??= await Role.get(identity, this.discovery);
+        return this.match(identity.roles, []);
+    }
     match(roles, parameters) {
         const required = this.dynamic ? this.substitute(parameters) : this.roles;
         for (const role of roles) {

package/transpiled/directives/auth/Role.js.map

@@ -1 +1 @@
-{"version":3,"file":"Role.js","sourceRoot":"","sources":["../../../source/directives/auth/Role.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAA;AAChC,OAAO,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAA;AAKvC,MAAM,OAAO,IAAI;IACR,MAAM,CAAC,MAAM,GAAqB,IAAI,CAAA;IAC5B,KAAK,CAAU;IACf,SAAS,CAAoB;IAC7B,OAAO,CAAS;IAEjC,YAAoB,KAAwB,EAAE,SAA6B;QACzE,IAAI,CAAC,KAAK,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAA;QACxD,IAAI,CAAC,SAAS,GAAG,SAAS,CAAA;QAC1B,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAA;IAC9D,CAAC;IAEM,MAAM,CAAC,KAAK,CAAC,GAAG,CAAE,QAAkB,EAAE,SAA6B;QACxE,IAAI,CAAC,MAAM,KAAK,MAAM,SAAS,CAAA;QAE/B,MAAM,KAAK,GAAU;YACnB,QAAQ,EAAE,aAAa,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE;YAC3C,KAAK,EAAE,IAAI;SACZ,CAAA;QAED,OAAO,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC,CAAA;IACpD,CAAC;IAEM,KAAK,CAAC,SAAS,CAAE,QAAyB,EAAE,CAAU,EAAE,UAAuB;QACpF,IAAI,QAAQ,KAAK,IAAI;YACnB,OAAO,KAAK,CAAA;QAEd,QAAQ,CAAC,KAAK,KAAK,MAAM,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,CAAA;QAE3D,OAAO,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC,CAAA;IAC/C,CAAC;IAEO,KAAK,CAAE,KAAe,EAAE,UAAuB;QACrD,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAA;QAExE,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,EAAE,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,KAAK,IAAI,IAAI,QAAQ,CAAC,UAAU,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC,CAAA;YAE5F,IAAI,EAAE;gBACJ,OAAO,IAAI,CAAA;QACf,CAAC;QAED,OAAO,KAAK,CAAA;IACd,CAAC;IAEO,UAAU,CAAE,UAAuB;QACzC,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE;YACrE,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,CAAA;YAE3E,MAAM,CAAC,EAAE,CAAC,KAAK,KAAK,SAAS,EAC3B,SAAS,IAAI,eAAe,GAAG,mBAAmB,CAAC,CAAA;YAErD,OAAO,KAAK,CAAA;QACd,CAAC,CAAC,CAAC,CAAA;IACL,CAAC"}
+{"version":3,"file":"Role.js","sourceRoot":"","sources":["../../../source/directives/auth/Role.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAA;AAChC,OAAO,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAA;AAKvC,MAAM,OAAO,IAAI;IACR,MAAM,CAAC,MAAM,GAAqB,IAAI,CAAA;IAC5B,KAAK,CAAU;IACf,SAAS,CAAoB;IAC7B,OAAO,CAAS;IAEjC,YAAoB,KAAwB,EAAE,SAA6B;QACzE,IAAI,CAAC,KAAK,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAA;QACxD,IAAI,CAAC,SAAS,GAAG,SAAS,CAAA;QAC1B,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAA;IAC9D,CAAC;IAEM,MAAM,CAAC,KAAK,CAAC,GAAG,CAAE,QAAkB,EAAE,SAA6B;QACxE,IAAI,CAAC,MAAM,KAAK,MAAM,SAAS,CAAA;QAE/B,MAAM,KAAK,GAAU;YACnB,QAAQ,EAAE,aAAa,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE;YAC3C,KAAK,EAAE,IAAI;SACZ,CAAA;QAED,OAAO,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC,CAAA;IACpD,CAAC;IAEM,KAAK,CAAC,SAAS,CAAE,QAAyB,EAAE,CAAU,EAAE,UAAuB;QACpF,IAAI,QAAQ,KAAK,IAAI;YACnB,OAAO,KAAK,CAAA;QAEd,QAAQ,CAAC,KAAK,KAAK,MAAM,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,CAAA;QAE3D,OAAO,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC,CAAA;IAC/C,CAAC;IAED,6FAA6F;IACtF,KAAK,CAAC,MAAM,CAAE,QAAyB;QAC5C,IAAI,IAAI,CAAC,OAAO;YACd,OAAO,SAAS,CAAA;QAElB,IAAI,QAAQ,KAAK,IAAI;YACnB,OAAO,KAAK,CAAA;QAEd,QAAQ,CAAC,KAAK,KAAK,MAAM,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,CAAA;QAE3D,OAAO,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;IACvC,CAAC;IAEO,KAAK,CAAE,KAAe,EAAE,UAAuB;QACrD,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAA;QAExE,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,EAAE,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,KAAK,IAAI,IAAI,QAAQ,CAAC,UAAU,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC,CAAA;YAE5F,IAAI,EAAE;gBACJ,OAAO,IAAI,CAAA;QACf,CAAC;QAED,OAAO,KAAK,CAAA;IACd,CAAC;IAEO,UAAU,CAAE,UAAuB;QACzC,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE;YACrE,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,CAAA;YAE3E,MAAM,CAAC,EAAE,CAAC,KAAK,KAAK,SAAS,EAC3B,SAAS,IAAI,eAAe,GAAG,mBAAmB,CAAC,CAAA;YAErD,OAAO,KAAK,CAAA;QACd,CAAC,CAAC,CAAC,CAAA;IACL,CAAC"}

package/transpiled/directives/auth/Rule.d.ts

@@ -1,7 +1,12 @@
 import { type Parameter } from '../../RTD/index.js';
+import type { Introspection } from '../../Introspection.js';
 import type { Context, Directive, Identity, Create } from './types.js';
 export declare class Rule implements Directive {
     private readonly directives;
     constructor(directives: Record<string, any>, create: Create);
     authorize(identity: Identity | null, context: Context, parameters: Parameter[]): Promise<boolean>;
+    /** Whatever each of them makes of it, in the order they were declared. */
+    describe(introspection: Introspection): Introspection;
+    /** All of them, so one that refuses ends it and one that cannot tell leaves it untold. */
+    admits(identity: Identity | null, context: Context): Promise<boolean | undefined>;
 }

package/transpiled/directives/auth/Rule.js

@@ -14,5 +14,25 @@ export class Rule {
         }
         return true;
     }
+    /** Whatever each of them makes of it, in the order they were declared. */
+    describe(introspection) {
+        for (const directive of this.directives)
+            introspection = directive.describe?.(introspection) ?? introspection;
+        return introspection;
+    }
+    /** All of them, so one that refuses ends it and one that cannot tell leaves it untold. */
+    async admits(identity, context) {
+        let untold = false;
+        for (const directive of this.directives) {
+            const admits = await directive.admits?.(identity, context);
+            if (admits === undefined) {
+                untold = true;
+                continue;
+            }
+            if (!admits)
+                return false;
+        }
+        return untold ? undefined : true;
+    }
 }
 //# sourceMappingURL=Rule.js.map

package/transpiled/directives/auth/Rule.js.map

@@ -1 +1 @@
-{"version":3,"file":"Rule.js","sourceRoot":"","sources":["../../../source/directives/auth/Rule.ts"],"names":[],"mappings":"AAGA,MAAM,OAAO,IAAI;IACE,UAAU,GAAgB,EAAE,CAAA;IAE7C,YAAoB,UAA+B,EAAE,MAAc;QACjE,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;YACvD,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;YAErC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;QACjC,CAAC;IACH,CAAC;IAEM,KAAK,CAAC,SAAS,CAAE,QAAyB,EAAE,OAAgB,EAAE,UAAuB;QAC1F,KAAK,MAAM,SAAS,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACxC,MAAM,UAAU,GAAG,MAAM,SAAS,CAAC,SAAS,CAAC,QAAQ,EAAE,OAAO,EAAE,UAAU,CAAC,CAAA;YAE3E,IAAI,CAAC,UAAU;gBACb,OAAO,KAAK,CAAA;QAChB,CAAC;QAED,OAAO,IAAI,CAAA;IACb,CAAC;CACF"}
+{"version":3,"file":"Rule.js","sourceRoot":"","sources":["../../../source/directives/auth/Rule.ts"],"names":[],"mappings":"AAIA,MAAM,OAAO,IAAI;IACE,UAAU,GAAgB,EAAE,CAAA;IAE7C,YAAoB,UAA+B,EAAE,MAAc;QACjE,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;YACvD,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;YAErC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;QACjC,CAAC;IACH,CAAC;IAEM,KAAK,CAAC,SAAS,CAAE,QAAyB,EAAE,OAAgB,EAAE,UAAuB;QAC1F,KAAK,MAAM,SAAS,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACxC,MAAM,UAAU,GAAG,MAAM,SAAS,CAAC,SAAS,CAAC,QAAQ,EAAE,OAAO,EAAE,UAAU,CAAC,CAAA;YAE3E,IAAI,CAAC,UAAU;gBACb,OAAO,KAAK,CAAA;QAChB,CAAC;QAED,OAAO,IAAI,CAAA;IACb,CAAC;IAED,0EAA0E;IACnE,QAAQ,CAAE,aAA4B;QAC3C,KAAK,MAAM,SAAS,IAAI,IAAI,CAAC,UAAU;YACrC,aAAa,GAAG,SAAS,CAAC,QAAQ,EAAE,CAAC,aAAa,CAAC,IAAI,aAAa,CAAA;QAEtE,OAAO,aAAa,CAAA;IACtB,CAAC;IAED,0FAA0F;IACnF,KAAK,CAAC,MAAM,CAAE,QAAyB,EAAE,OAAgB;QAC9D,IAAI,MAAM,GAAG,KAAK,CAAA;QAElB,KAAK,MAAM,SAAS,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACxC,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAA;YAE1D,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,MAAM,GAAG,IAAI,CAAA;gBAEb,SAAQ;YACV,CAAC;YAED,IAAI,CAAC,MAAM;gBACT,OAAO,KAAK,CAAA;QAChB,CAAC;QAED,OAAO,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAA;IAClC,CAAC;CACF"}

package/transpiled/directives/auth/Scheme.d.ts

@@ -4,4 +4,6 @@ export declare class Scheme implements Directive {
     private readonly Scheme;
     constructor(scheme: string);
     authorize(_: Identity | null, context: Context): boolean;
+    /** It admits nobody: it is there to refuse a scheme, not to authorize one. */
+    admits(): boolean;
 }

package/transpiled/directives/auth/Scheme.js

@@ -16,5 +16,9 @@ export class Scheme {
                 ' authentication scheme is required to access this resource');
         return false;
     }
+    /** It admits nobody: it is there to refuse a scheme, not to authorize one. */
+    admits() {
+        return false;
+    }
 }
 //# sourceMappingURL=Scheme.js.map

package/transpiled/directives/auth/Scheme.js.map

@@ -1 +1 @@
-{"version":3,"file":"Scheme.js","sourceRoot":"","sources":["../../../source/directives/auth/Scheme.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,IAAI,MAAM,qBAAqB,CAAA;AAE3C,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAA;AAElC,MAAM,OAAO,MAAM;IACA,MAAM,CAAQ;IACd,MAAM,CAAQ;IAE/B,YAAoB,MAAc;QAChC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,WAAW,EAAE,CAAA;QAClC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAA;IAC7D,CAAC;IAEM,SAAS,CAAE,CAAkB,EAAE,OAAgB;QACpD,IAAI,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,aAAa,KAAK,SAAS;YACrD,OAAO,KAAK,CAAA;QAEd,MAAM,CAAC,MAAM,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,CAAA;QAE7D,IAAI,MAAM,KAAK,IAAI,CAAC,MAAM;YACxB,MAAM,IAAI,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM;gBAClC,4DAA4D,CAAC,CAAA;QAEjE,OAAO,KAAK,CAAA;IACd,CAAC;CACF"}
+{"version":3,"file":"Scheme.js","sourceRoot":"","sources":["../../../source/directives/auth/Scheme.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,IAAI,MAAM,qBAAqB,CAAA;AAE3C,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAA;AAElC,MAAM,OAAO,MAAM;IACA,MAAM,CAAQ;IACd,MAAM,CAAQ;IAE/B,YAAoB,MAAc;QAChC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,WAAW,EAAE,CAAA;QAClC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAA;IAC7D,CAAC;IAEM,SAAS,CAAE,CAAkB,EAAE,OAAgB;QACpD,IAAI,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,aAAa,KAAK,SAAS;YACrD,OAAO,KAAK,CAAA;QAEd,MAAM,CAAC,MAAM,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,CAAA;QAE7D,IAAI,MAAM,KAAK,IAAI,CAAC,MAAM;YACxB,MAAM,IAAI,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM;gBAClC,4DAA4D,CAAC,CAAA;QAEjE,OAAO,KAAK,CAAA;IACd,CAAC;IAED,8EAA8E;IACvE,MAAM;QACX,OAAO,KAAK,CAAA;IACd,CAAC;CACF"}

package/transpiled/directives/auth/schemes.d.ts

@@ -1,12 +1,24 @@
 import type { Remote, Scheme } from './types.js';
-export declare const PROVIDERS: Record<Scheme, Remote>;
+/**
+ * The providers of a scheme, in the order they are asked. More than one claims `Bearer`:
+ * an OpenID `id_token` is federated, and a token this gateway issued is presented that way
+ * by an OAuth client. Which of them a credential belongs to is each provider's own to say,
+ * so the order here is only which is asked first.
+ */
+export declare const PROVIDERS: Record<Scheme, Remote[]>;
 export declare const INCEPTION: Remote[];
-export declare const PRIMARY: Scheme;
+export declare const PRIMARY: Remote;
 /**
- * The provider of a scheme, or nothing for a scheme that is not one — including a name a
+ * The providers of a scheme, or nothing for a scheme that is not one — including a name a
  * plain object answers on its own, like `constructor`.
  */
-export declare function provider(scheme: string): Remote | undefined;
+export declare function providers(scheme: string): Remote[] | undefined;
+/**
+ * What a provider answers when the credentials are not of its kind. The next provider of
+ * the scheme is asked; a provider that declines has done nothing, so asking is free of
+ * effect — which asking one that rejects would not be.
+ */
+export declare const UNRECOGNIZED = "UNRECOGNIZED";
 /**
  * The rejection of credentials that are verifiable and owned by no identity: the one
  * inception goes ahead with.

package/transpiled/directives/auth/schemes.js

@@ -1,19 +1,31 @@
+/**
+ * The providers of a scheme, in the order they are asked. More than one claims `Bearer`:
+ * an OpenID `id_token` is federated, and a token this gateway issued is presented that way
+ * by an OAuth client. Which of them a credential belongs to is each provider's own to say,
+ * so the order here is only which is asked first.
+ */
 export const PROVIDERS = {
-    basic: 'basic',
-    token: 'tokens',
-    bearer: 'federation',
-    code: 'federation',
-    otp: 'otp'
+    basic: ['basic'],
+    token: ['tokens'],
+    bearer: ['tokens', 'federation'],
+    code: ['federation'],
+    otp: ['otp']
 };
 export const INCEPTION = ['basic', 'federation'];
-export const PRIMARY = 'token';
+export const PRIMARY = 'tokens';
 /**
- * The provider of a scheme, or nothing for a scheme that is not one — including a name a
+ * The providers of a scheme, or nothing for a scheme that is not one — including a name a
  * plain object answers on its own, like `constructor`.
  */
-export function provider(scheme) {
+export function providers(scheme) {
     return Object.hasOwn(PROVIDERS, scheme) ? PROVIDERS[scheme] : undefined;
 }
+/**
+ * What a provider answers when the credentials are not of its kind. The next provider of
+ * the scheme is asked; a provider that declines has done nothing, so asking is free of
+ * effect — which asking one that rejects would not be.
+ */
+export const UNRECOGNIZED = 'UNRECOGNIZED';
 /**
  * The rejection of credentials that are verifiable and owned by no identity: the one
  * inception goes ahead with.

package/transpiled/directives/auth/schemes.js.map

@@ -1 +1 @@
-{"version":3,"file":"schemes.js","sourceRoot":"","sources":["../../../source/directives/auth/schemes.ts"],"names":[],"mappings":"AAEA,MAAM,CAAC,MAAM,SAAS,GAA2B;IAC/C,KAAK,EAAE,OAAO;IACd,KAAK,EAAE,QAAQ;IACf,MAAM,EAAE,YAAY;IACpB,IAAI,EAAE,YAAY;IAClB,GAAG,EAAE,KAAK;CACX,CAAA;AAED,MAAM,CAAC,MAAM,SAAS,GAAa,CAAC,OAAO,EAAE,YAAY,CAAC,CAAA;AAC1D,MAAM,CAAC,MAAM,OAAO,GAAW,OAAO,CAAA;AAEtC;;;GAGG;AACH,MAAM,UAAU,QAAQ,CAAE,MAAc;IACtC,OAAO,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,MAAgB,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;AACnF,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,OAAO,GAAG,WAAW,CAAA"}
+{"version":3,"file":"schemes.js","sourceRoot":"","sources":["../../../source/directives/auth/schemes.ts"],"names":[],"mappings":"AAEA;;;;;GAKG;AACH,MAAM,CAAC,MAAM,SAAS,GAA6B;IACjD,KAAK,EAAE,CAAC,OAAO,CAAC;IAChB,KAAK,EAAE,CAAC,QAAQ,CAAC;IACjB,MAAM,EAAE,CAAC,QAAQ,EAAE,YAAY,CAAC;IAChC,IAAI,EAAE,CAAC,YAAY,CAAC;IACpB,GAAG,EAAE,CAAC,KAAK,CAAC;CACb,CAAA;AAED,MAAM,CAAC,MAAM,SAAS,GAAa,CAAC,OAAO,EAAE,YAAY,CAAC,CAAA;AAC1D,MAAM,CAAC,MAAM,OAAO,GAAW,QAAQ,CAAA;AAEvC;;;GAGG;AACH,MAAM,UAAU,SAAS,CAAE,MAAc;IACvC,OAAO,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,MAAgB,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;AACnF,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,cAAc,CAAA;AAE1C;;;GAGG;AACH,MAAM,CAAC,MAAM,OAAO,GAAG,WAAW,CAAA"}

package/transpiled/directives/auth/types.d.ts

@@ -1,11 +1,27 @@
 import { type Component } from '@toa.io/core';
-import { type Maybe } from '@toa.io/types';
+import { type Maybe } from '@toa.io/core';
 import { type Parameter } from '../../RTD/index.js';
+import type { Introspection } from '../../Introspection.js';
 import type * as http from '../../HTTP/index.js';
 import type * as io from '../../io.js';
 export interface Directive {
     priority?: number;
     authorize: (identity: Identity | null, context: Context, parameters: Parameter[]) => boolean | Promise<boolean>;
+    /**
+     * Whether this admits the identity where that can be told without a request — which is
+     * what describing a method is. `undefined` says it cannot be told: a directive reading a
+     * route variable's value or the body has neither here, and one that is not implemented
+     * says the same by its absence. Nothing here may have an effect on the request.
+     */
+    admits?: (identity: Identity | null, context: Context) => boolean | undefined | Promise<boolean | undefined>;
+    /**
+     * What this directive makes of what the method says about itself, which is the reverse of
+     * what it does to a request: a property it fills from the identity is taken out of the
+     * input, because it is not the caller's to send — and a description that offers one invites
+     * a caller to name an identity that is not theirs. Nothing here may have an effect on the
+     * request.
+     */
+    describe?: (introspection: Introspection) => Introspection;
     reply?: (context: Context) => http.OutgoingMessage | null;
     settle?: (context: Context, response: http.OutgoingMessage) => Promise<void>;
 }
@@ -14,6 +30,8 @@ export interface Identity {
     roles?: string[];
     permissions?: Record<string, string[]>;
     scheme: string | null;
+    /** The component that verified the credentials; none for a transient identity. */
+    provider?: Remote;
     refresh: boolean;
 }
 export interface Extension {
@@ -32,5 +50,5 @@ export type AuthenticationResult = Maybe<{
 export type Scheme = 'basic' | 'token' | 'bearer' | 'code' | 'otp';
 export type Remote = 'basic' | 'federation' | 'tokens' | 'roles' | 'bans' | 'otp';
 export type Discovery = Record<Remote, Promise<Component>>;
-export type Schemes = Record<Scheme, Component>;
+export type Components = Partial<Record<Remote, Component>>;
 export type Create = (name: string, value: any, ...args: any[]) => Directive;

package/transpiled/directives/cache/Cache.d.ts

@@ -6,6 +6,6 @@ export declare class Cache implements DirectiveFamily<Directive> {
     readonly name: string;
     readonly mandatory: boolean;
     create(name: string, value: any): Directive;
-    preflight(): Output;
+    precall(): Output;
     settle(directives: Directive[], context: AuthenticatedContext, response: http.OutgoingMessage): Promise<void>;
 }

package/transpiled/directives/cache/Cache.js

@@ -9,15 +9,22 @@ export class Cache {
             throw new Error(`Directive 'cache:${name}' is not implemented`);
         return new Class(value);
     }
-    preflight() {
+    precall() {
         return null;
     }
     async settle(directives, context, response) {
+        const directive = directives[0];
+        response.headers ??= new Headers();
+        // `cache:exact` sets what it is given, whatever the method: whether a reply may be
+        // stored at all is not a question about the method's cacheability, and a token
+        // endpoint answers a POST it must not have kept
+        if (directive instanceof Exact) {
+            directive.set(context, response.headers);
+            return;
+        }
         const method = context.request.method;
         if (method !== 'GET' && method !== 'HEAD')
             return;
-        const directive = directives[0];
-        response.headers ??= new Headers();
         if (directive === undefined) {
             if (context.identity !== null && !Control.disabled(response.headers)) {
                 response.headers.set('cache-control', 'private');

package/transpiled/directives/cache/Cache.js.map

@@ -1 +1 @@
-{"version":3,"file":"Cache.js","sourceRoot":"","sources":["../../../source/directives/cache/Cache.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AACtC,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAA;AAMlC,MAAM,OAAO,KAAK;IACA,IAAI,GAAW,OAAO,CAAA;IACtB,SAAS,GAAY,IAAI,CAAA;IAElC,MAAM,CAAE,IAAY,EAAE,KAAU;QACrC,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,CAAA;QAEhC,IAAI,KAAK,KAAK,SAAS;YACrB,MAAM,IAAI,KAAK,CAAC,oBAAoB,IAAI,sBAAsB,CAAC,CAAA;QAEjE,OAAO,IAAI,KAAK,CAAC,KAAK,CAAC,CAAA;IACzB,CAAC;IAEM,SAAS;QACd,OAAO,IAAI,CAAA;IACb,CAAC;IAEM,KAAK,CAAC,MAAM,CAAE,UAAuB,EAAE,OAA6B,EAAE,QAA8B;QACzG,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,CAAA;QAErC,IAAI,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,MAAM;YACvC,OAAM;QAER,MAAM,SAAS,GAAG,UAAU,CAAC,CAAC,CAAC,CAAA;QAE/B,QAAQ,CAAC,OAAO,KAAK,IAAI,OAAO,EAAE,CAAA;QAElC,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,IAAI,OAAO,CAAC,QAAQ,KAAK,IAAI,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;gBACrE,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,SAAS,CAAC,CAAA;gBAChD,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAA;YAClD,CAAC;QACH,CAAC;;YACC,SAAS,CAAC,GAAG,CAAC,OAAO,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAA;IAC5C,CAAC;CACF;AAED,MAAM,YAAY,GAAkD;IAClE,OAAO,EAAE,OAAO;IAChB,KAAK,EAAE,KAAK;CACb,CAAA"}
+{"version":3,"file":"Cache.js","sourceRoot":"","sources":["../../../source/directives/cache/Cache.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AACtC,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAA;AAMlC,MAAM,OAAO,KAAK;IACA,IAAI,GAAW,OAAO,CAAA;IACtB,SAAS,GAAY,IAAI,CAAA;IAElC,MAAM,CAAE,IAAY,EAAE,KAAU;QACrC,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,CAAA;QAEhC,IAAI,KAAK,KAAK,SAAS;YACrB,MAAM,IAAI,KAAK,CAAC,oBAAoB,IAAI,sBAAsB,CAAC,CAAA;QAEjE,OAAO,IAAI,KAAK,CAAC,KAAK,CAAC,CAAA;IACzB,CAAC;IAEM,OAAO;QACZ,OAAO,IAAI,CAAA;IACb,CAAC;IAEM,KAAK,CAAC,MAAM,CAAE,UAAuB,EAAE,OAA6B,EAAE,QAA8B;QACzG,MAAM,SAAS,GAAG,UAAU,CAAC,CAAC,CAAC,CAAA;QAE/B,QAAQ,CAAC,OAAO,KAAK,IAAI,OAAO,EAAE,CAAA;QAElC,mFAAmF;QACnF,+EAA+E;QAC/E,gDAAgD;QAChD,IAAI,SAAS,YAAY,KAAK,EAAE,CAAC;YAC/B,SAAS,CAAC,GAAG,CAAC,OAAO,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAA;YAExC,OAAM;QACR,CAAC;QAED,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,CAAA;QAErC,IAAI,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,MAAM;YACvC,OAAM;QAER,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,IAAI,OAAO,CAAC,QAAQ,KAAK,IAAI,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;gBACrE,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,SAAS,CAAC,CAAA;gBAChD,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAA;YAClD,CAAC;QACH,CAAC;;YACC,SAAS,CAAC,GAAG,CAAC,OAAO,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAA;IAC5C,CAAC;CACF;AAED,MAAM,YAAY,GAAkD;IAClE,OAAO,EAAE,OAAO;IAChB,KAAK,EAAE,KAAK;CACb,CAAA"}

package/transpiled/directives/cache/Control.js

@@ -14,8 +14,6 @@ export class Control {
         return (directives & NO_STORE) === NO_STORE;
     }
     set(context, headers) {
-        if (!['GET', 'HEAD', 'OPTIONS'].includes(context.request.method))
-            return;
         this.control ??= this.resolve(context);
         if (Control.disabled(headers))
             return;

package/transpiled/directives/cache/Control.js.map

@@ -1 +1 @@
-{"version":3,"file":"Control.js","sourceRoot":"","sources":["../../../source/directives/cache/Control.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,WAAW,CAAA;AAGjC,MAAM,OAAO,OAAO;IACC,KAAK,CAAQ;IACxB,OAAO,GAAkB,IAAI,CAAA;IAC7B,IAAI,GAAY,KAAK,CAAA;IAE7B,YAAoB,KAAa;QAC/B,IAAI,CAAC,KAAK,GAAG,KAAK,CAAA;IACpB,CAAC;IAEM,MAAM,CAAC,QAAQ,CAAE,OAAgB;QACtC,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAA;QAE1C,IAAI,KAAK,KAAK,IAAI;YAChB,OAAO,KAAK,CAAA;QAEd,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,CAAA;QAE9B,OAAO,CAAC,UAAU,GAAG,QAAQ,CAAC,KAAK,QAAQ,CAAA;IAC7C,CAAC;IAEM,GAAG,CAAE,OAA6B,EAAE,OAAgB;QACzD,IAAI,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC;YAC9D,OAAM;QAER,IAAI,CAAC,OAAO,KAAK,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;QAEtC,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;YAC3B,OAAM;QAER,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,IAAI,CAAC,OAAO,CAAC,CAAA;QAE1C,IAAI,IAAI,CAAC,IAAI;YACX,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAA;IAC3C,CAAC;IAES,OAAO,CAAE,OAA6B;QAC9C,IAAI,OAAO,CAAC,QAAQ,KAAK,IAAI;YAC3B,OAAO,IAAI,CAAC,KAAK,CAAA;QAEnB,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAEnC,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,KAAK,OAAO;YACpC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAA;QAElB,IAAI,CAAC,UAAU,GAAG,CAAC,MAAM,GAAG,QAAQ,CAAC,CAAC,KAAK,MAAM;YAC/C,OAAO,YAAY,GAAG,IAAI,CAAC,KAAK,CAAA;QAElC,IAAI,CAAC,UAAU,GAAG,CAAC,MAAM,GAAG,OAAO,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;YAC5C,IAAI,CAAC,IAAI,GAAG,IAAI,CAAA;YAEhB,OAAO,WAAW,GAAG,IAAI,CAAC,KAAK,CAAA;QACjC,CAAC;QAED,OAAO,IAAI,CAAC,KAAK,CAAA;IACnB,CAAC;CACF;AAED,SAAS,IAAI,CAAE,KAAa;IAC1B,MAAM,UAAU,GAAG,KAAK,CAAC,KAAK,CAAC,aAAa,CAAC,CAAA;IAE7C,IAAI,UAAU,KAAK,IAAI;QACrB,OAAO,CAAC,CAAA;IAEV,IAAI,IAAI,GAAG,CAAC,CAAA;IAEZ,KAAK,MAAM,SAAS,IAAI,UAAU;QAChC,IAAI,IAAI,KAAK,CAAS,SAAS,EAC7B,SAAS,EAAE,OAAO,EAClB,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,QAAQ,EACpB,UAAU,EAAE,QAAQ,EACpB,CAAC,CAAC,CAAA;IAEN,OAAO,IAAI,CAAA;AACb,CAAC;AAED,MAAM,aAAa,GAAG,0CAA0C,CAAA;AAEhE,MAAM,MAAM,GAAG,CAAC,CAAA;AAChB,MAAM,OAAO,GAAG,CAAC,CAAA;AACjB,MAAM,QAAQ,GAAG,CAAC,CAAA;AAClB,MAAM,QAAQ,GAAG,CAAC,CAAA"}
+{"version":3,"file":"Control.js","sourceRoot":"","sources":["../../../source/directives/cache/Control.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,WAAW,CAAA;AAGjC,MAAM,OAAO,OAAO;IACC,KAAK,CAAQ;IACxB,OAAO,GAAkB,IAAI,CAAA;IAC7B,IAAI,GAAY,KAAK,CAAA;IAE7B,YAAoB,KAAa;QAC/B,IAAI,CAAC,KAAK,GAAG,KAAK,CAAA;IACpB,CAAC;IAEM,MAAM,CAAC,QAAQ,CAAE,OAAgB;QACtC,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAA;QAE1C,IAAI,KAAK,KAAK,IAAI;YAChB,OAAO,KAAK,CAAA;QAEd,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,CAAA;QAE9B,OAAO,CAAC,UAAU,GAAG,QAAQ,CAAC,KAAK,QAAQ,CAAA;IAC7C,CAAC;IAEM,GAAG,CAAE,OAA6B,EAAE,OAAgB;QACzD,IAAI,CAAC,OAAO,KAAK,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;QAEtC,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;YAC3B,OAAM;QAER,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,IAAI,CAAC,OAAO,CAAC,CAAA;QAE1C,IAAI,IAAI,CAAC,IAAI;YACX,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAA;IAC3C,CAAC;IAES,OAAO,CAAE,OAA6B;QAC9C,IAAI,OAAO,CAAC,QAAQ,KAAK,IAAI;YAC3B,OAAO,IAAI,CAAC,KAAK,CAAA;QAEnB,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAEnC,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,KAAK,OAAO;YACpC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAA;QAElB,IAAI,CAAC,UAAU,GAAG,CAAC,MAAM,GAAG,QAAQ,CAAC,CAAC,KAAK,MAAM;YAC/C,OAAO,YAAY,GAAG,IAAI,CAAC,KAAK,CAAA;QAElC,IAAI,CAAC,UAAU,GAAG,CAAC,MAAM,GAAG,OAAO,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;YAC5C,IAAI,CAAC,IAAI,GAAG,IAAI,CAAA;YAEhB,OAAO,WAAW,GAAG,IAAI,CAAC,KAAK,CAAA;QACjC,CAAC;QAED,OAAO,IAAI,CAAC,KAAK,CAAA;IACnB,CAAC;CACF;AAED,SAAS,IAAI,CAAE,KAAa;IAC1B,MAAM,UAAU,GAAG,KAAK,CAAC,KAAK,CAAC,aAAa,CAAC,CAAA;IAE7C,IAAI,UAAU,KAAK,IAAI;QACrB,OAAO,CAAC,CAAA;IAEV,IAAI,IAAI,GAAG,CAAC,CAAA;IAEZ,KAAK,MAAM,SAAS,IAAI,UAAU;QAChC,IAAI,IAAI,KAAK,CAAS,SAAS,EAC7B,SAAS,EAAE,OAAO,EAClB,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,QAAQ,EACpB,UAAU,EAAE,QAAQ,EACpB,CAAC,CAAC,CAAA;IAEN,OAAO,IAAI,CAAA;AACb,CAAC;AAED,MAAM,aAAa,GAAG,0CAA0C,CAAA;AAEhE,MAAM,MAAM,GAAG,CAAC,CAAA;AAChB,MAAM,OAAO,GAAG,CAAC,CAAA;AACjB,MAAM,QAAQ,GAAG,CAAC,CAAA;AAClB,MAAM,QAAQ,GAAG,CAAC,CAAA"}

package/transpiled/directives/dev/Development.d.ts

@@ -5,5 +5,5 @@ export declare class Development implements DirectiveFamily<Directive> {
     readonly name: string;
     readonly mandatory: boolean;
     create(name: string, value: unknown): Directive;
-    preflight(directives: Directive[], input: Input): Promise<Output>;
+    precall(directives: Directive[], input: Input): Promise<Output>;
 }

package/transpiled/directives/dev/Development.js

@@ -11,7 +11,7 @@ export class Development {
             throw new Error(`Directive 'dev:${name}' is not implemented`);
         return new Class(value);
     }
-    async preflight(directives, input) {
+    async precall(directives, input) {
         let output = null;
         for (const directive of directives) {
             const out = await directive.apply(input);

package/transpiled/directives/dev/Development.js.map

@@ -1 +1 @@
-{"version":3,"file":"Development.js","sourceRoot":"","sources":["../../../source/directives/dev/Development.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAA;AAClC,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAA;AAClC,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AAKpC,MAAM,OAAO,WAAW;IACN,IAAI,GAAW,KAAK,CAAA;IACpB,SAAS,GAAY,KAAK,CAAA;IAEnC,MAAM,CAAE,IAAY,EAAE,KAAc;QACzC,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,CAAA;QAEhC,IAAI,KAAK,KAAK,SAAS;YACrB,MAAM,IAAI,KAAK,CAAC,kBAAkB,IAAI,sBAAsB,CAAC,CAAA;QAE/D,OAAO,IAAI,KAAK,CAAC,KAAK,CAAC,CAAA;IACzB,CAAC;IAEM,KAAK,CAAC,SAAS,CAAE,UAAuB,EAAE,KAAY;QAC3D,IAAI,MAAM,GAAG,IAAI,CAAA;QAEjB,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;YACnC,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;YAExC,IAAI,GAAG,KAAK,IAAI;gBACd,IAAI,MAAM,KAAK,IAAI;oBAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAA;;oBACpE,MAAM,GAAG,GAAG,CAAA;QACrB,CAAC;QAED,OAAO,MAAM,CAAA;IACf,CAAC;CACF;AAED,MAAM,YAAY,GAAkD;IAClE,IAAI,EAAE,IAAI;IACV,KAAK,EAAE,KAAK;IACZ,KAAK,EAAE,KAAK;IACZ,MAAM,EAAE,MAAM;CACf,CAAA"}
+{"version":3,"file":"Development.js","sourceRoot":"","sources":["../../../source/directives/dev/Development.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAA;AAClC,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAA;AAClC,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AAKpC,MAAM,OAAO,WAAW;IACN,IAAI,GAAW,KAAK,CAAA;IACpB,SAAS,GAAY,KAAK,CAAA;IAEnC,MAAM,CAAE,IAAY,EAAE,KAAc;QACzC,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,CAAA;QAEhC,IAAI,KAAK,KAAK,SAAS;YACrB,MAAM,IAAI,KAAK,CAAC,kBAAkB,IAAI,sBAAsB,CAAC,CAAA;QAE/D,OAAO,IAAI,KAAK,CAAC,KAAK,CAAC,CAAA;IACzB,CAAC;IAEM,KAAK,CAAC,OAAO,CAAE,UAAuB,EAAE,KAAY;QACzD,IAAI,MAAM,GAAG,IAAI,CAAA;QAEjB,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;YACnC,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;YAExC,IAAI,GAAG,KAAK,IAAI;gBACd,IAAI,MAAM,KAAK,IAAI;oBAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAA;;oBACpE,MAAM,GAAG,GAAG,CAAA;QACrB,CAAC;QAED,OAAO,MAAM,CAAA;IACf,CAAC;CACF;AAED,MAAM,YAAY,GAAkD;IAClE,IAAI,EAAE,IAAI;IACV,KAAK,EAAE,KAAK;IACZ,KAAK,EAAE,KAAK;IACZ,MAAM,EAAE,MAAM;CACf,CAAA"}

package/transpiled/directives/flow/Flow.d.ts

@@ -6,5 +6,5 @@ export declare class Flow implements DirectiveFamily<Directive> {
     readonly name: string;
     readonly mandatory: boolean;
     create(name: string, value: unknown, remotes: Remotes): Directive;
-    preflight(directives: Directive[], input: Input, parameters: Parameter[]): Promise<Output>;
+    precall(directives: Directive[], input: Input, parameters: Parameter[]): Promise<Output>;
 }

package/transpiled/directives/flow/Flow.js

@@ -9,7 +9,7 @@ export class Flow {
             throw new Error(`Directive '${this.name}:${name}' is not implemented`);
         return new Class(value, remotes);
     }
-    async preflight(directives, input, parameters) {
+    async precall(directives, input, parameters) {
         for (const directive of directives) {
             if (directive.attach !== undefined)
                 directive.attach(input);

package/transpiled/directives/flow/Flow.js.map

@@ -1 +1 @@
-{"version":3,"file":"Flow.js","sourceRoot":"","sources":["../../../source/directives/flow/Flow.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAA;AAClC,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AAMtC,MAAM,OAAO,IAAI;IACC,IAAI,GAAW,MAAM,CAAA;IACrB,SAAS,GAAY,KAAK,CAAA;IAEnC,MAAM,CAAE,IAAY,EAAE,KAAc,EAAE,OAAgB;QAC3D,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,CAAA;QAEhC,IAAI,KAAK,KAAK,SAAS;YACrB,MAAM,IAAI,KAAK,CAAC,cAAc,IAAI,CAAC,IAAI,IAAI,IAAI,sBAAsB,CAAC,CAAA;QAExE,OAAO,IAAI,KAAK,CAAC,KAAK,EAAE,OAAO,CAAC,CAAA;IAClC,CAAC;IAEM,KAAK,CAAC,SAAS,CAAE,UAAuB,EAAE,KAAY,EAAE,UAAuB;QACpF,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;YACnC,IAAI,SAAS,CAAC,MAAM,KAAK,SAAS;gBAChC,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;YAEzB,IAAI,SAAS,CAAC,KAAK,KAAK,SAAS;gBAC/B,SAAQ;YAEV,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,KAAK,EAAE,UAAU,CAAC,CAAA;YAEvD,IAAI,MAAM,KAAK,IAAI;gBACjB,OAAO,MAAM,CAAA;QACjB,CAAC;QAED,OAAO,IAAI,CAAA;IACb,CAAC;CACF;AAED,MAAM,YAAY,GAAsE;IACtF,KAAK,EAAE,KAAK;IACZ,OAAO,EAAE,OAAO;CACjB,CAAA"}
+{"version":3,"file":"Flow.js","sourceRoot":"","sources":["../../../source/directives/flow/Flow.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAA;AAClC,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AAMtC,MAAM,OAAO,IAAI;IACC,IAAI,GAAW,MAAM,CAAA;IACrB,SAAS,GAAY,KAAK,CAAA;IAEnC,MAAM,CAAE,IAAY,EAAE,KAAc,EAAE,OAAgB;QAC3D,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,CAAA;QAEhC,IAAI,KAAK,KAAK,SAAS;YACrB,MAAM,IAAI,KAAK,CAAC,cAAc,IAAI,CAAC,IAAI,IAAI,IAAI,sBAAsB,CAAC,CAAA;QAExE,OAAO,IAAI,KAAK,CAAC,KAAK,EAAE,OAAO,CAAC,CAAA;IAClC,CAAC;IAEM,KAAK,CAAC,OAAO,CAAE,UAAuB,EAAE,KAAY,EAAE,UAAuB;QAClF,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;YACnC,IAAI,SAAS,CAAC,MAAM,KAAK,SAAS;gBAChC,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;YAEzB,IAAI,SAAS,CAAC,KAAK,KAAK,SAAS;gBAC/B,SAAQ;YAEV,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,KAAK,EAAE,UAAU,CAAC,CAAA;YAEvD,IAAI,MAAM,KAAK,IAAI;gBACjB,OAAO,MAAM,CAAA;QACjB,CAAC;QAED,OAAO,IAAI,CAAA;IACb,CAAC;CACF;AAED,MAAM,YAAY,GAAsE;IACtF,KAAK,EAAE,KAAK;IACZ,OAAO,EAAE,OAAO;CACjB,CAAA"}

package/transpiled/directives/index.js

@@ -5,8 +5,10 @@ import { dev } from './dev/index.js';
 import { octets } from './octets/index.js';
 import { io } from './io/index.js';
 import { map } from './map/index.js';
+import { mcp } from './mcp/index.js';
 import { req } from './require/index.js';
 import { flow } from './flow/index.js';
-export const families = [authorization, io, cache, map, req, flow, octets, dev];
-export const interceptors = [cors];
+import { discovery } from './oauth/index.js';
+export const families = [authorization, io, cache, map, mcp, req, flow, octets, dev];
+export const interceptors = [cors, discovery];
 //# sourceMappingURL=index.js.map

package/transpiled/directives/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../source/directives/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAA;AAC/C,OAAO,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAA;AACxC,OAAO,EAAE,IAAI,EAAE,MAAM,iBAAiB,CAAA;AACtC,OAAO,EAAE,GAAG,EAAE,MAAM,gBAAgB,CAAA;AACpC,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAA;AAC1C,OAAO,EAAE,EAAE,EAAE,MAAM,eAAe,CAAA;AAClC,OAAO,EAAE,GAAG,EAAE,MAAM,gBAAgB,CAAA;AACpC,OAAO,EAAE,GAAG,EAAE,MAAM,oBAAoB,CAAA;AACxC,OAAO,EAAE,IAAI,EAAE,MAAM,iBAAiB,CAAA;AAItC,MAAM,CAAC,MAAM,QAAQ,GAAsB,CAAC,aAAa,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,CAAA;AAClG,MAAM,CAAC,MAAM,YAAY,GAAkB,CAAC,IAAI,CAAC,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../source/directives/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAA;AAC/C,OAAO,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAA;AACxC,OAAO,EAAE,IAAI,EAAE,MAAM,iBAAiB,CAAA;AACtC,OAAO,EAAE,GAAG,EAAE,MAAM,gBAAgB,CAAA;AACpC,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAA;AAC1C,OAAO,EAAE,EAAE,EAAE,MAAM,eAAe,CAAA;AAClC,OAAO,EAAE,GAAG,EAAE,MAAM,gBAAgB,CAAA;AACpC,OAAO,EAAE,GAAG,EAAE,MAAM,gBAAgB,CAAA;AACpC,OAAO,EAAE,GAAG,EAAE,MAAM,oBAAoB,CAAA;AACxC,OAAO,EAAE,IAAI,EAAE,MAAM,iBAAiB,CAAA;AACtC,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AAI5C,MAAM,CAAC,MAAM,QAAQ,GACnB,CAAC,aAAa,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,CAAA;AAC9D,MAAM,CAAC,MAAM,YAAY,GAAkB,CAAC,IAAI,EAAE,SAAS,CAAC,CAAA"}

package/transpiled/directives/io/Directive.d.ts

@@ -3,7 +3,7 @@ import type { Parameter } from '../../RTD/index.js';
 import type { Input as Context } from '../../io.js';
 import type * as http from '../../HTTP/index.js';
 export interface Directive {
-    preflight: (context: Context, parameters: Parameter[]) => void;
+    precall: (context: Context, parameters: Parameter[]) => void;
     /** Synchronous by contract: settling holds the response, and none of it needs I/O. */
     settle?: (context: Context, response: http.OutgoingMessage) => void;
 }

package/transpiled/directives/io/IO.d.ts

@@ -2,6 +2,7 @@ import type * as http from '../../HTTP/index.js';
 import type { Parameter, DirectiveFamily } from '../../RTD/index.js';
 import type { Remotes } from '../../Remotes.js';
 import type { Directive } from './Directive.js';
+import type { Introspection } from '../../Introspection.js';
 import type { extensions } from '@toa.io/core';
 export declare class IO implements DirectiveFamily<Directive> {
     readonly name = "io";
@@ -11,7 +12,12 @@ export declare class IO implements DirectiveFamily<Directive> {
     private sync;
     mount(host: extensions.Host): void;
     create(name: string, value: unknown, remotes: Remotes, route: string): Directive;
-    preflight(directives: Directive[], context: http.Context, parameters: Parameter[]): null;
+    precall(directives: Directive[], context: http.Context, parameters: Parameter[]): null;
+    /**
+     * What a whitelist admits is what the schema states. Without an `io:output` the reply is
+     * dropped before it is sent, so there is no output to describe at all.
+     */
+    explain(directives: Directive[], _: http.Context, introspection: Introspection): Introspection;
     settle(directives: Directive[], context: http.Context, output: http.OutgoingMessage): void;
     /**
      * The ticker belongs to the family rather than to any route's directives, and the

package/transpiled/directives/io/IO.js

@@ -1,6 +1,8 @@
+import { restrict } from '../../Introspection.js';
 import { Output } from './Output.js';
 import { Input } from './Input.js';
 import { Throttle } from './Throttle.js';
+import { Status } from './Status.js';
 import { Sync } from './lib/throttle/index.js';
 import { ATOM_GROUP } from '../../const.js';
 export class IO {
@@ -22,16 +24,35 @@ export class IO {
             this.sync ??= new Sync(this.host.atom(ATOM_GROUP));
         return new Directive(value, this.sync, route);
     }
-    preflight(directives, context, parameters) {
+    precall(directives, context, parameters) {
         let restricted = false;
         for (const directive of directives) {
             restricted ||= directive instanceof Output;
-            directive.preflight(context, parameters);
+            directive.precall(context, parameters);
         }
         if (!restricted)
-            DENIAL.preflight(context, parameters);
+            DENIAL.precall(context, parameters);
         return null;
     }
+    /**
+     * What a whitelist admits is what the schema states. Without an `io:output` the reply is
+     * dropped before it is sent, so there is no output to describe at all.
+     */
+    explain(directives, _, introspection) {
+        let restricted = false;
+        for (const directive of directives) {
+            if (directive instanceof Input)
+                introspection.input = restrict(introspection.input, directive.allowed);
+            if (!(directive instanceof Output))
+                continue;
+            restricted = true;
+            if (!directive.disabled)
+                introspection.output = restrict(introspection.output, directive.allowed);
+        }
+        if (!restricted)
+            delete introspection.output;
+        return introspection;
+    }
     settle(directives, context, output) {
         for (const directive of directives)
             directive.settle?.(context, output);
@@ -48,6 +69,7 @@ export class IO {
 const constructors = {
     input: Input,
     output: Output,
+    status: Status,
     throttle: Throttle
 };
 const DENIAL = new Output([]);

package/transpiled/directives/io/IO.js.map

@@ -1 +1 @@
-{"version":3,"file":"IO.js","sourceRoot":"","sources":["../../../source/directives/io/IO.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACpC,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAA;AAClC,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AACxC,OAAO,EAAE,IAAI,EAAE,MAAM,yBAAyB,CAAA;AAK9C,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAG3C,MAAM,OAAO,EAAE;IACG,IAAI,GAAG,IAAI,CAAA;IACX,SAAS,GAAG,IAAI,CAAA;IAExB,IAAI,CAAkB;IAE9B,uFAAuF;IAC/E,IAAI,GAAgB,IAAI,CAAA;IAEzB,KAAK,CAAE,IAAqB;QACjC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAA;IAClB,CAAC;IAED,sCAAsC;IAC/B,MAAM,CAAE,IAAY,EAAE,KAAc,EAAE,OAAgB,EAAE,KAAa;QAC1E,IAAI,CAAC,CAAC,IAAI,IAAI,YAAY,CAAC;YACzB,MAAM,IAAI,KAAK,CAAC,iBAAiB,IAAI,sBAAsB,CAAC,CAAA;QAE9D,MAAM,SAAS,GAAG,YAAY,CAAC,IAAI,CAAC,CAAA;QAEpC,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;QAEzB,IAAI,IAAI,KAAK,UAAU;YACrB,IAAI,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAA;QAEpD,OAAO,IAAI,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,IAAK,EAAE,KAAK,CAAC,CAAA;IAChD,CAAC;IAEM,SAAS,CAAE,UAAuB,EAAE,OAAqB,EAC9D,UAAuB;QACvB,IAAI,UAAU,GAAG,KAAK,CAAA;QAEtB,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;YACnC,UAAU,KAAK,SAAS,YAAY,MAAM,CAAA;YAE1C,SAAS,CAAC,SAAS,CAAC,OAAO,EAAE,UAAU,CAAC,CAAA;QAC1C,CAAC;QAED,IAAI,CAAC,UAAU;YACb,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,UAAU,CAAC,CAAA;QAEvC,OAAO,IAAI,CAAA;IACb,CAAC;IAEM,MAAM,CAAE,UAAuB,EAAE,OAAqB,EAC3D,MAA4B;QAC5B,KAAK,MAAM,SAAS,IAAI,UAAU;YAChC,SAAS,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;IACvC,CAAC;IAED;;;;OAIG;IACI,OAAO;QACZ,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,CAAA;IACtB,CAAC;CACF;AAED,MAAM,YAAY,GAAgC;IAChD,KAAK,EAAE,KAAK;IACZ,MAAM,EAAE,MAAM;IACd,QAAQ,EAAE,QAAQ;CACnB,CAAA;AAED,MAAM,MAAM,GAAc,IAAI,MAAM,CAAC,EAAE,CAAC,CAAA"}
+{"version":3,"file":"IO.js","sourceRoot":"","sources":["../../../source/directives/io/IO.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAA;AACjD,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACpC,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAA;AAClC,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AACxC,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACpC,OAAO,EAAE,IAAI,EAAE,MAAM,yBAAyB,CAAA;AAM9C,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAG3C,MAAM,OAAO,EAAE;IACG,IAAI,GAAG,IAAI,CAAA;IACX,SAAS,GAAG,IAAI,CAAA;IAExB,IAAI,CAAkB;IAE9B,uFAAuF;IAC/E,IAAI,GAAgB,IAAI,CAAA;IAEzB,KAAK,CAAE,IAAqB;QACjC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAA;IAClB,CAAC;IAED,sCAAsC;IAC/B,MAAM,CAAE,IAAY,EAAE,KAAc,EAAE,OAAgB,EAAE,KAAa;QAC1E,IAAI,CAAC,CAAC,IAAI,IAAI,YAAY,CAAC;YACzB,MAAM,IAAI,KAAK,CAAC,iBAAiB,IAAI,sBAAsB,CAAC,CAAA;QAE9D,MAAM,SAAS,GAAG,YAAY,CAAC,IAAI,CAAC,CAAA;QAEpC,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;QAEzB,IAAI,IAAI,KAAK,UAAU;YACrB,IAAI,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAA;QAEpD,OAAO,IAAI,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,IAAK,EAAE,KAAK,CAAC,CAAA;IAChD,CAAC;IAEM,OAAO,CAAE,UAAuB,EAAE,OAAqB,EAC5D,UAAuB;QACvB,IAAI,UAAU,GAAG,KAAK,CAAA;QAEtB,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;YACnC,UAAU,KAAK,SAAS,YAAY,MAAM,CAAA;YAE1C,SAAS,CAAC,OAAO,CAAC,OAAO,EAAE,UAAU,CAAC,CAAA;QACxC,CAAC;QAED,IAAI,CAAC,UAAU;YACb,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,UAAU,CAAC,CAAA;QAErC,OAAO,IAAI,CAAA;IACb,CAAC;IAED;;;OAGG;IACI,OAAO,CAAE,UAAuB,EAAE,CAAe,EACtD,aAA4B;QAC5B,IAAI,UAAU,GAAG,KAAK,CAAA;QAEtB,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;YACnC,IAAI,SAAS,YAAY,KAAK;gBAC5B,aAAa,CAAC,KAAK,GAAG,QAAQ,CAAC,aAAa,CAAC,KAAK,EAAE,SAAS,CAAC,OAAO,CAAC,CAAA;YAExE,IAAI,CAAC,CAAC,SAAS,YAAY,MAAM,CAAC;gBAChC,SAAQ;YAEV,UAAU,GAAG,IAAI,CAAA;YAEjB,IAAI,CAAC,SAAS,CAAC,QAAQ;gBACrB,aAAa,CAAC,MAAM,GAAG,QAAQ,CAAC,aAAa,CAAC,MAAM,EAAE,SAAS,CAAC,OAAO,CAAC,CAAA;QAC5E,CAAC;QAED,IAAI,CAAC,UAAU;YACb,OAAO,aAAa,CAAC,MAAM,CAAA;QAE7B,OAAO,aAAa,CAAA;IACtB,CAAC;IAEM,MAAM,CAAE,UAAuB,EAAE,OAAqB,EAC3D,MAA4B;QAC5B,KAAK,MAAM,SAAS,IAAI,UAAU;YAChC,SAAS,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;IACvC,CAAC;IAED;;;;OAIG;IACI,OAAO;QACZ,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,CAAA;IACtB,CAAC;CACF;AAED,MAAM,YAAY,GAAgC;IAChD,KAAK,EAAE,KAAK;IACZ,MAAM,EAAE,MAAM;IACd,MAAM,EAAE,MAAM;IACd,QAAQ,EAAE,QAAQ;CACnB,CAAA;AAED,MAAM,MAAM,GAAc,IAAI,MAAM,CAAC,EAAE,CAAC,CAAA"}

package/transpiled/directives/io/Input.d.ts

@@ -1,10 +1,11 @@
 import type { Directive } from './Directive.js';
 import type { Input as Context } from '../../io.js';
 export declare class Input implements Directive {
-    private readonly allowed;
+    /** what a client may send, which is therefore what the input schema states */
+    readonly allowed: Set<string>;
     constructor(permissions: Permissions);
     static validate(permissions: unknown): asserts permissions is Permissions;
-    preflight(context: Context): void;
+    precall(context: Context): void;
     private check;
     private violation;
 }