@toa.io/extensions.exposition 1.0.0-alpha.30 → 1.0.0-alpha.301

package/transpiled/RTD/index.js

@@ -1,38 +1,9 @@
-"use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __exportStar = (this && this.__exportStar) || function(m, exports) {
-    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
-};
-var __importStar = (this && this.__importStar) || function (mod) {
-    if (mod && mod.__esModule) return mod;
-    var result = {};
-    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
-    __setModuleDefault(result, mod);
-    return result;
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.syntax = void 0;
-__exportStar(require("./Tree"), exports);
-__exportStar(require("./Node"), exports);
-__exportStar(require("./Match"), exports);
-__exportStar(require("./Method"), exports);
-__exportStar(require("./Context"), exports);
-__exportStar(require("./Endpoint"), exports);
-__exportStar(require("./Directives"), exports);
-exports.syntax = __importStar(require("./syntax"));
+export * from './Tree.js';
+export * from './Node.js';
+export * from './Match.js';
+export * from './Method.js';
+export * from './Context.js';
+export * from './Endpoint.js';
+export * from './Directives.js';
+export * as syntax from './syntax/index.js';
 //# sourceMappingURL=index.js.map

package/transpiled/RTD/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../source/RTD/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,yCAAsB;AACtB,yCAAsB;AACtB,0CAAuB;AACvB,2CAAwB;AACxB,4CAAyB;AACzB,6CAA0B;AAC1B,+CAA4B;AAC5B,mDAAkC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../source/RTD/index.ts"],"names":[],"mappings":"AAAA,cAAc,WAAW,CAAA;AACzB,cAAc,WAAW,CAAA;AACzB,cAAc,YAAY,CAAA;AAC1B,cAAc,aAAa,CAAA;AAC3B,cAAc,cAAc,CAAA;AAC5B,cAAc,eAAe,CAAA;AAC7B,cAAc,iBAAiB,CAAA;AAC/B,OAAO,KAAK,MAAM,MAAM,mBAAmB,CAAA"}

package/transpiled/RTD/segment.d.ts

@@ -1,3 +1,4 @@
+import type { Parameter } from './Match.ts';
 export declare function segment(path: string): Segment[];
 export declare function fragment(path: string): string[];
 export type Segment = {
@@ -5,4 +6,11 @@ export type Segment = {
 } | {
     fragment: null;
     placeholder: string | null;
+    wildcard?: boolean;
 };
+/**
+ * What a route template takes, by name. Describing has no values for them — a template is
+ * not a path — and nothing that describes a method reads one. A `*` is skipped: it stands
+ * for a segment the caller cannot name, so there is nothing to substitute.
+ */
+export declare function variables(segments: Segment[]): Parameter[];

package/transpiled/RTD/segment.js

@@ -1,11 +1,7 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.fragment = exports.segment = void 0;
-function segment(path) {
+export function segment(path) {
     return fragment(path).map(parse);
 }
-exports.segment = segment;
-function fragment(path) {
+export function fragment(path) {
     const parts = path.split('/');
     // trailing slash
     if (parts[parts.length - 1] === '')
@@ -13,13 +9,31 @@ function fragment(path) {
     // leading slash
     return parts.splice(1);
 }
-exports.fragment = fragment;
 function parse(segment) {
     if (segment[0] === ':')
         return { fragment: null, placeholder: segment.substring(1) };
     else if (segment === '*')
         return { fragment: null, placeholder: null };
+    else if (segment === '**')
+        return { fragment: null, placeholder: null, wildcard: true };
     else
         return { fragment: segment };
 }
+/**
+ * What a route template takes, by name. Describing has no values for them — a template is
+ * not a path — and nothing that describes a method reads one. A `*` is skipped: it stands
+ * for a segment the caller cannot name, so there is nothing to substitute.
+ */
+export function variables(segments) {
+    const params = [];
+    for (const segment of segments) {
+        if (segment.fragment !== null)
+            continue;
+        if (segment.wildcard === true)
+            params.push({ name: '**', value: '' });
+        else if (segment.placeholder !== null)
+            params.push({ name: segment.placeholder, value: '' });
+    }
+    return params;
+}
 //# sourceMappingURL=segment.js.map

package/transpiled/RTD/segment.js.map

@@ -1 +1 @@
-{"version":3,"file":"segment.js","sourceRoot":"","sources":["../../source/RTD/segment.ts"],"names":[],"mappings":";;;AAAA,SAAgB,OAAO,CAAE,IAAY;IACnC,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;AAClC,CAAC;AAFD,0BAEC;AAED,SAAgB,QAAQ,CAAE,IAAY;IACpC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAE7B,iBAAiB;IACjB,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,KAAK,EAAE;QAAE,KAAK,CAAC,MAAM,EAAE,CAAA;IAElD,gBAAgB;IAChB,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAA;AACxB,CAAC;AARD,4BAQC;AAED,SAAS,KAAK,CAAE,OAAe;IAC7B,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,GAAG;QAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAA;SAC/E,IAAI,OAAO,KAAK,GAAG;QAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,CAAA;;QACjE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAA;AACnC,CAAC"}
+{"version":3,"file":"segment.js","sourceRoot":"","sources":["../../source/RTD/segment.ts"],"names":[],"mappings":"AAEA,MAAM,UAAU,OAAO,CAAC,IAAY;IAClC,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;AAClC,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,IAAY;IACnC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAE7B,iBAAiB;IACjB,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,KAAK,EAAE;QAAE,KAAK,CAAC,MAAM,EAAE,CAAA;IAElD,gBAAgB;IAChB,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAA;AACxB,CAAC;AAED,SAAS,KAAK,CAAC,OAAe;IAC5B,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,GAAG;QAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAA;SAC/E,IAAI,OAAO,KAAK,GAAG;QAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,CAAA;SACjE,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAA;;QAClF,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAA;AACnC,CAAC;AAYD;;;;GAIG;AACH,MAAM,UAAU,SAAS,CAAC,QAAmB;IAC3C,MAAM,MAAM,GAAgB,EAAE,CAAA;IAE9B,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,IAAI,OAAO,CAAC,QAAQ,KAAK,IAAI;YAAE,SAAQ;QAEvC,IAAI,OAAO,CAAC,QAAQ,KAAK,IAAI;YAAE,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAA;aAChE,IAAI,OAAO,CAAC,WAAW,KAAK,IAAI;YACnC,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,WAAW,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAA;IACzD,CAAC;IAED,OAAO,MAAM,CAAA;AACf,CAAC"}

package/transpiled/RTD/syntax/index.d.ts

@@ -1,2 +1 @@
-export * from './parse';
-export * from './types';
+export * from '@toa.io/definitions/extensions.exposition/syntax';

package/transpiled/RTD/syntax/index.js

@@ -1,19 +1,2 @@
-"use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __exportStar = (this && this.__exportStar) || function(m, exports) {
-    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-__exportStar(require("./parse"), exports);
-__exportStar(require("./types"), exports);
+export * from '@toa.io/definitions/extensions.exposition/syntax';
 //# sourceMappingURL=index.js.map

package/transpiled/RTD/syntax/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../source/RTD/syntax/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,0CAAuB;AACvB,0CAAuB"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../source/RTD/syntax/index.ts"],"names":[],"mappings":"AAAA,cAAc,kDAAkD,CAAA"}

package/transpiled/Remotes.d.ts

@@ -1,9 +1,9 @@
-import { Connector, type Component } from '@toa.io/core';
-import { type Bootloader } from './Factory';
+import { Connector, type Remote } from '@toa.io/core';
+import { type Host } from './Factory.ts';
 export declare class Remotes extends Connector {
-    private readonly boot;
-    private readonly remotes;
-    constructor(boot: Bootloader);
-    discover(namespace: string, name: string): Promise<Component>;
-    private create;
+    private readonly host;
+    private readonly cache;
+    constructor(host: Host);
+    discover(namespace: string, name: string, version?: string): Promise<Remote>;
+    private locate;
 }

package/transpiled/Remotes.js

@@ -1,25 +1,24 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.Remotes = void 0;
-const core_1 = require("@toa.io/core");
-class Remotes extends core_1.Connector {
-    boot;
-    remotes = {};
-    constructor(boot) {
+import { Locator, Connector } from '@toa.io/core';
+export class Remotes extends Connector {
+    host;
+    cache = {};
+    constructor(host) {
         super();
-        this.boot = boot;
+        this.host = host;
     }
-    async discover(namespace, name) {
-        const locator = new core_1.Locator(name, namespace);
-        this.remotes[locator.id] ??= this.create(locator);
-        return await this.remotes[locator.id];
+    async discover(namespace, name, version = 'local') {
+        const locator = new Locator(name, namespace);
+        const key = locator.id + ':' + version;
+        this.cache[key] ??= this.locate(locator);
+        return this.cache[key];
     }
-    async create(locator) {
-        const remote = await this.boot.remote(locator);
+    async locate(locator) {
+        // the gateway is the origin of every call it forwards
+        const remote = await this.host.remote(locator, SOURCE);
         this.depends(remote);
         await remote.connect();
         return remote;
     }
 }
-exports.Remotes = Remotes;
+const SOURCE = { service: 'exposition' };
 //# sourceMappingURL=Remotes.js.map

package/transpiled/Remotes.js.map

@@ -1 +1 @@
-{"version":3,"file":"Remotes.js","sourceRoot":"","sources":["../source/Remotes.ts"],"names":[],"mappings":";;;AAAA,uCAAiE;AAGjE,MAAa,OAAQ,SAAQ,gBAAS;IACnB,IAAI,CAAY;IAChB,OAAO,GAAuC,EAAE,CAAA;IAEjE,YAAoB,IAAgB;QAClC,KAAK,EAAE,CAAA;QACP,IAAI,CAAC,IAAI,GAAG,IAAI,CAAA;IAClB,CAAC;IAEM,KAAK,CAAC,QAAQ,CAAE,SAAiB,EAAE,IAAY;QACpD,MAAM,OAAO,GAAG,IAAI,cAAO,CAAC,IAAI,EAAE,SAAS,CAAC,CAAA;QAE5C,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,KAAK,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;QAEjD,OAAO,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;IACvC,CAAC;IAEO,KAAK,CAAC,MAAM,CAAE,OAAgB;QACpC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;QAE9C,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;QAEpB,MAAM,MAAM,CAAC,OAAO,EAAE,CAAA;QAEtB,OAAO,MAAM,CAAA;IACf,CAAC;CACF;AA1BD,0BA0BC"}
+{"version":3,"file":"Remotes.js","sourceRoot":"","sources":["../source/Remotes.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,SAAS,EAAe,MAAM,cAAc,CAAA;AAI9D,MAAM,OAAO,OAAQ,SAAQ,SAAS;IACnB,IAAI,CAAM;IACV,KAAK,GAAoC,EAAE,CAAA;IAE5D,YAAmB,IAAU;QAC3B,KAAK,EAAE,CAAA;QACP,IAAI,CAAC,IAAI,GAAG,IAAI,CAAA;IAClB,CAAC;IAEM,KAAK,CAAC,QAAQ,CACnB,SAAiB,EACjB,IAAY,EACZ,OAAO,GAAW,OAAO;QAEzB,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC,CAAA;QAC5C,MAAM,GAAG,GAAG,OAAO,CAAC,EAAE,GAAG,GAAG,GAAG,OAAO,CAAA;QAEtC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;QAExC,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IACxB,CAAC;IAEO,KAAK,CAAC,MAAM,CAAC,OAAgB;QACnC,sDAAsD;QACtD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;QAEtD,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;QAEpB,MAAM,MAAM,CAAC,OAAO,EAAE,CAAA;QAEtB,OAAO,MAAM,CAAA;IACf,CAAC;CACF;AAED,MAAM,MAAM,GAAW,EAAE,OAAO,EAAE,YAAY,EAAE,CAAA"}

package/transpiled/Tenant.d.ts

@@ -1,11 +1,22 @@
-import { Connector, type Locator, type bindings } from '@toa.io/core';
-import { type Label } from './discovery';
-import type * as RTD from './RTD/syntax';
+import { Connector } from '@toa.io/core';
+import type { bindings } from '@toa.io/core/types';
+import type { Label } from './discovery.ts';
+import type { Branch } from './Branch.ts';
 export declare class Tenant extends Connector {
     private readonly broadcast;
     private readonly branch;
-    constructor(broadcast: Broadcast, locator: Locator, node: RTD.Node);
+    private started;
+    private stopped;
+    constructor(broadcast: Broadcast, branch: Omit<Branch, 'timestamp'>);
     open(): Promise<void>;
+    /**
+     * Announcing is stopped where the teardown begins, not in `dispose`, which a connector
+     * runs after every one of its dependencies has gone. A component on its way out that
+     * announces itself once more has its routes held open by whoever is listening, and the
+     * requests that follow reach nothing.
+     */
+    protected close(): Promise<void>;
+    private announce;
     private expose;
 }
 type Broadcast = bindings.Broadcast<Label>;

package/transpiled/Tenant.js

@@ -1,28 +1,53 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.Tenant = void 0;
-const core_1 = require("@toa.io/core");
-class Tenant extends core_1.Connector {
+import { setTimeout } from 'node:timers/promises';
+import { Connector } from '@toa.io/core';
+import { BRANCH_TTL } from '@toa.io/definitions/extensions.exposition';
+export class Tenant extends Connector {
     broadcast;
     branch;
-    constructor(broadcast, locator, node) {
+    started = 0;
+    stopped = false;
+    constructor(broadcast, branch) {
         super();
         this.broadcast = broadcast;
-        this.branch = {
-            namespace: locator.namespace,
-            component: locator.name,
-            isolated: locator.namespace === 'identity',
-            node
-        };
+        this.branch = branch;
         this.depends(broadcast);
     }
     async open() {
+        this.started = Date.now();
         await this.expose();
         await this.broadcast.receive('ping', this.expose.bind(this));
+        void this.announce();
+    }
+    /**
+     * Announcing is stopped where the teardown begins, not in `dispose`, which a connector
+     * runs after every one of its dependencies has gone. A component on its way out that
+     * announces itself once more has its routes held open by whoever is listening, and the
+     * requests that follow reach nothing.
+     */
+    async close() {
+        this.stopped = true;
+    }
+    async announce() {
+        while (!this.stopped) {
+            const delay = exposeInterval(Date.now() - this.started);
+            await setTimeout(delay, undefined, { ref: false });
+            if (this.stopped)
+                break;
+            await this.expose();
+        }
     }
     async expose() {
-        await this.broadcast.transmit('expose', this.branch);
+        // the ping subscription outlives the announcing loop, and answering one on the way out
+        // is the same announcement by another route
+        if (this.stopped)
+            return;
+        await this.broadcast.transmit('expose', { ...this.branch, timestamp: this.started });
     }
 }
-exports.Tenant = Tenant;
+function exposeInterval(uptime) {
+    return Math.round(EXPOSE_MAX - (EXPOSE_MAX - EXPOSE_MIN) * Math.exp(-uptime / EXPOSE_TAU));
+}
+const EXPOSE_MIN = 5_000;
+const EXPOSE_MAX = Math.round(BRANCH_TTL / 2.1);
+const EXPOSE_TAU = 900_000;
 //# sourceMappingURL=Tenant.js.map

package/transpiled/Tenant.js.map

@@ -1 +1 @@
-{"version":3,"file":"Tenant.js","sourceRoot":"","sources":["../source/Tenant.ts"],"names":[],"mappings":";;;AAAA,uCAAqE;AAKrE,MAAa,MAAO,SAAQ,gBAAS;IAClB,SAAS,CAAW;IACpB,MAAM,CAAQ;IAE/B,YAAoB,SAAoB,EAAE,OAAgB,EAAE,IAAc;QACxE,KAAK,EAAE,CAAA;QAEP,IAAI,CAAC,SAAS,GAAG,SAAS,CAAA;QAE1B,IAAI,CAAC,MAAM,GAAG;YACZ,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,SAAS,EAAE,OAAO,CAAC,IAAI;YACvB,QAAQ,EAAE,OAAO,CAAC,SAAS,KAAK,UAAU;YAC1C,IAAI;SACL,CAAA;QAED,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAA;IACzB,CAAC;IAEe,KAAK,CAAC,IAAI;QACxB,MAAM,IAAI,CAAC,MAAM,EAAE,CAAA;QACnB,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAA;IAC9D,CAAC;IAEO,KAAK,CAAC,MAAM;QAClB,MAAM,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,CAAA;IACtD,CAAC;CACF;AA3BD,wBA2BC"}
+{"version":3,"file":"Tenant.js","sourceRoot":"","sources":["../source/Tenant.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AACjD,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAA;AACxC,OAAO,EAAE,UAAU,EAAE,MAAM,2CAA2C,CAAA;AAKtE,MAAM,OAAO,MAAO,SAAQ,SAAS;IAClB,SAAS,CAAW;IACpB,MAAM,CAA2B;IAC1C,OAAO,GAAG,CAAC,CAAA;IACX,OAAO,GAAG,KAAK,CAAA;IAEvB,YAAmB,SAAoB,EAAE,MAAiC;QACxE,KAAK,EAAE,CAAA;QAEP,IAAI,CAAC,SAAS,GAAG,SAAS,CAAA;QAC1B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAA;QAEpB,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAA;IACzB,CAAC;IAEe,KAAK,CAAC,IAAI;QACxB,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;QAEzB,MAAM,IAAI,CAAC,MAAM,EAAE,CAAA;QACnB,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAA;QAE5D,KAAK,IAAI,CAAC,QAAQ,EAAE,CAAA;IACtB,CAAC;IAED;;;;;OAKG;IACgB,KAAK,CAAC,KAAK;QAC5B,IAAI,CAAC,OAAO,GAAG,IAAI,CAAA;IACrB,CAAC;IAEO,KAAK,CAAC,QAAQ;QACpB,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YACrB,MAAM,KAAK,GAAG,cAAc,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,CAAA;YAEvD,MAAM,UAAU,CAAC,KAAK,EAAE,SAAS,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAA;YAElD,IAAI,IAAI,CAAC,OAAO;gBAAE,MAAK;YAEvB,MAAM,IAAI,CAAC,MAAM,EAAE,CAAA;QACrB,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,MAAM;QAClB,uFAAuF;QACvF,4CAA4C;QAC5C,IAAI,IAAI,CAAC,OAAO;YAAE,OAAM;QAExB,MAAM,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,EAAE,EAAE,GAAG,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAA;IACtF,CAAC;CACF;AAED,SAAS,cAAc,CAAC,MAAc;IACpC,OAAO,IAAI,CAAC,KAAK,CACf,UAAU,GAAG,CAAC,UAAU,GAAG,UAAU,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,UAAU,CAAC,CACxE,CAAA;AACH,CAAC;AAED,MAAM,UAAU,GAAG,KAAK,CAAA;AACxB,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,GAAG,GAAG,CAAC,CAAA;AAC/C,MAAM,UAAU,GAAG,OAAO,CAAA"}

package/transpiled/directives/auth/Anonymous.d.ts

@@ -1,6 +1,21 @@
-import { type Directive, type Input } from './types';
+import { type Directive, type Context } from './types.ts';
+import type { Introspection } from '../../Introspection.ts';
 export declare class Anonymous implements Directive {
     private readonly allow;
     constructor(allow: boolean);
-    authorize(_: any, input: Input): boolean;
+    /**
+     * A credential refuses, because it would make the reply uncacheable — which is the whole
+     * of the rule, and none of it applies to a procedure, nor to a description. What a
+     * procedure answers is a value in an envelope, and the envelope is the one thing that is
+     * cached or not; what a description answers is what the resource is, which is not the
+     * reply a cache would hold and varies by who asked in any case.
+     */
+    authorize(_: any, context: Context): boolean;
+    admits(_: any, context: Context): boolean;
+    /**
+     * That nothing guards it is something said rather than something left unsaid: it is also
+     * what refuses a caller presenting a credential, and a client with one has to know which
+     * methods not to present it to.
+     */
+    describe(introspection: Introspection): Introspection;
 }

package/transpiled/directives/auth/Anonymous.js

@@ -1,16 +1,30 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.Anonymous = void 0;
-class Anonymous {
+export class Anonymous {
     allow;
     constructor(allow) {
         this.allow = allow;
     }
-    authorize(_, input) {
-        return 'authorization' in input.request.headers
-            ? false
-            : this.allow;
+    /**
+     * A credential refuses, because it would make the reply uncacheable — which is the whole
+     * of the rule, and none of it applies to a procedure, nor to a description. What a
+     * procedure answers is a value in an envelope, and the envelope is the one thing that is
+     * cached or not; what a description answers is what the resource is, which is not the
+     * reply a cache would hold and varies by who asked in any case.
+     */
+    authorize(_, context) {
+        if (context.procedural || context.exploratory)
+            return this.allow;
+        return 'authorization' in context.request.headers ? false : this.allow;
+    }
+    admits(_, context) {
+        return this.authorize(_, context);
+    }
+    /**
+     * That nothing guards it is something said rather than something left unsaid: it is also
+     * what refuses a caller presenting a credential, and a client with one has to know which
+     * methods not to present it to.
+     */
+    describe(introspection) {
+        return this.allow ? { ...introspection, anonymous: true } : introspection;
     }
 }
-exports.Anonymous = Anonymous;
 //# sourceMappingURL=Anonymous.js.map

package/transpiled/directives/auth/Anonymous.js.map

@@ -1 +1 @@
-{"version":3,"file":"Anonymous.js","sourceRoot":"","sources":["../../../source/directives/auth/Anonymous.ts"],"names":[],"mappings":";;;AAEA,MAAa,SAAS;IACH,KAAK,CAAS;IAE/B,YAAoB,KAAc;QAChC,IAAI,CAAC,KAAK,GAAG,KAAK,CAAA;IACpB,CAAC;IAEM,SAAS,CAAE,CAAM,EAAE,KAAY;QACpC,OAAO,eAAe,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO;YAC7C,CAAC,CAAC,KAAK;YACP,CAAC,CAAC,IAAI,CAAC,KAAK,CAAA;IAChB,CAAC;CACF;AAZD,8BAYC"}
+{"version":3,"file":"Anonymous.js","sourceRoot":"","sources":["../../../source/directives/auth/Anonymous.ts"],"names":[],"mappings":"AAGA,MAAM,OAAO,SAAS;IACH,KAAK,CAAS;IAE/B,YAAmB,KAAc;QAC/B,IAAI,CAAC,KAAK,GAAG,KAAK,CAAA;IACpB,CAAC;IAED;;;;;;OAMG;IACI,SAAS,CAAC,CAAM,EAAE,OAAgB;QACvC,IAAI,OAAO,CAAC,UAAU,IAAI,OAAO,CAAC,WAAW;YAAE,OAAO,IAAI,CAAC,KAAK,CAAA;QAEhE,OAAO,eAAe,IAAI,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAA;IACxE,CAAC;IAEM,MAAM,CAAC,CAAM,EAAE,OAAgB;QACpC,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,OAAO,CAAC,CAAA;IACnC,CAAC;IAED;;;;OAIG;IACI,QAAQ,CAAC,aAA4B;QAC1C,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,GAAG,aAAa,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,aAAa,CAAA;IAC3E,CAAC;CACF"}

package/transpiled/directives/auth/Anyone.d.ts

@@ -0,0 +1,10 @@
+import { type Directive, type Context } from './types.ts';
+import type { Introspection } from '../../Introspection.ts';
+export declare class Anyone implements Directive {
+    private readonly allow;
+    constructor(allow: boolean);
+    authorize(_: any, context: Context): boolean;
+    admits(_: any, context: Context): boolean;
+    /** Whoever asks, as long as they are somebody. */
+    describe(introspection: Introspection): Introspection;
+}

package/transpiled/directives/auth/Anyone.js

@@ -0,0 +1,17 @@
+export class Anyone {
+    allow;
+    constructor(allow) {
+        this.allow = allow;
+    }
+    authorize(_, context) {
+        return context.identity !== null && this.allow;
+    }
+    admits(_, context) {
+        return this.authorize(_, context);
+    }
+    /** Whoever asks, as long as they are somebody. */
+    describe(introspection) {
+        return this.allow ? { ...introspection, authenticated: true } : introspection;
+    }
+}
+//# sourceMappingURL=Anyone.js.map

package/transpiled/directives/auth/Anyone.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Anyone.js","sourceRoot":"","sources":["../../../source/directives/auth/Anyone.ts"],"names":[],"mappings":"AAGA,MAAM,OAAO,MAAM;IACA,KAAK,CAAS;IAE/B,YAAmB,KAAc;QAC/B,IAAI,CAAC,KAAK,GAAG,KAAK,CAAA;IACpB,CAAC;IAEM,SAAS,CAAC,CAAM,EAAE,OAAgB;QACvC,OAAO,OAAO,CAAC,QAAQ,KAAK,IAAI,IAAI,IAAI,CAAC,KAAK,CAAA;IAChD,CAAC;IAEM,MAAM,CAAC,CAAM,EAAE,OAAgB;QACpC,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,OAAO,CAAC,CAAA;IACnC,CAAC;IAED,kDAAkD;IAC3C,QAAQ,CAAC,aAA4B;QAC1C,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,GAAG,aAAa,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,aAAa,CAAA;IAC/E,CAAC;CACF"}

package/transpiled/directives/auth/Assert.d.ts

@@ -0,0 +1,9 @@
+import type { Context, Directive, Identity } from './types.ts';
+export declare class Assert implements Directive {
+    private readonly disabled;
+    constructor(enabled: boolean);
+    /** It admits nobody: it is there to require a credential, not to authorize one. */
+    admits(): boolean;
+    authorize(identity: Identity | null, context: Context): Promise<boolean>;
+    private incept;
+}

package/transpiled/directives/auth/Assert.js

@@ -0,0 +1,33 @@
+import { newid } from '@toa.io/generic';
+import * as http from '../../HTTP/index.js';
+import { Incept } from './Incept.js';
+export class Assert {
+    disabled;
+    constructor(enabled) {
+        if (typeof enabled !== 'boolean')
+            throw new Error('`auth:assert` directive value must be a boolean');
+        this.disabled = !enabled;
+    }
+    /** It admits nobody: it is there to require a credential, not to authorize one. */
+    admits() {
+        return false;
+    }
+    async authorize(identity, context) {
+        if (!this.disabled)
+            await this.incept(context, identity);
+        return false;
+    }
+    async incept(context, identity) {
+        if (context.request.headers.authorization === undefined)
+            throw new http.Unauthorized();
+        if (identity === null) {
+            if (!Incept.acceptable(context))
+                throw new http.Unauthorized();
+            context.identity = await Incept.incept(context, newid());
+            context.pipelines.response.push((response) => {
+                response.status = 201;
+            });
+        }
+    }
+}
+//# sourceMappingURL=Assert.js.map

package/transpiled/directives/auth/Assert.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Assert.js","sourceRoot":"","sources":["../../../source/directives/auth/Assert.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAA;AACvC,OAAO,KAAK,IAAI,MAAM,qBAAqB,CAAA;AAC3C,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AAGpC,MAAM,OAAO,MAAM;IACA,QAAQ,CAAS;IAElC,YAAmB,OAAgB;QACjC,IAAI,OAAO,OAAO,KAAK,SAAS;YAC9B,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAA;QAEpE,IAAI,CAAC,QAAQ,GAAG,CAAC,OAAO,CAAA;IAC1B,CAAC;IAED,mFAAmF;IAC5E,MAAM;QACX,OAAO,KAAK,CAAA;IACd,CAAC;IAEM,KAAK,CAAC,SAAS,CAAC,QAAyB,EAAE,OAAgB;QAChE,IAAI,CAAC,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAA;QAExD,OAAO,KAAK,CAAA;IACd,CAAC;IAEO,KAAK,CAAC,MAAM,CAAC,OAAgB,EAAE,QAAyB;QAC9D,IAAI,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,aAAa,KAAK,SAAS;YAAE,MAAM,IAAI,IAAI,CAAC,YAAY,EAAE,CAAA;QAEtF,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YACtB,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC;gBAAE,MAAM,IAAI,IAAI,CAAC,YAAY,EAAE,CAAA;YAE9D,OAAO,CAAC,QAAQ,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC,CAAA;YAExD,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE;gBAC3C,QAAQ,CAAC,MAAM,GAAG,GAAG,CAAA;YACvB,CAAC,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;CACF"}

package/transpiled/directives/auth/Authorization.d.ts

@@ -1,19 +1,61 @@
-import * as http from '../../HTTP';
-import type { Output } from '../../io';
-import type { Remotes } from '../../Remotes';
-import type { Parameter, DirectiveFamily } from '../../RTD';
-import type { Directive, Extension, Input } from './types';
+import * as http from '../../HTTP/index.ts';
+import type { Output } from '../../io.ts';
+import type { Introspection } from '../../Introspection.ts';
+import type { Remotes } from '../../Remotes.ts';
+import type { Parameter, DirectiveFamily } from '../../RTD/index.ts';
+import type { Host } from '../../Factory.ts';
+import type { Directive, Extension, Context } from './types.ts';
 export declare class Authorization implements DirectiveFamily<Directive, Extension> {
     readonly depends: string[];
     readonly name: string;
     readonly mandatory: boolean;
-    private readonly schemes;
+    private readonly components;
     private readonly discovery;
     private tokens;
     private bans;
+    /** Failed authentications per address, reconciled with the other gateways. */
+    private meter;
+    private sync;
+    mount(host: Host, options: http.Options): void;
+    dispose(): void;
     create(name: string, value: any, remotes: Remotes): Directive;
-    preflight(directives: Directive[], input: Input, parameters: Parameter[]): Promise<Output>;
-    settle(directives: Directive[], request: Input, response: http.OutgoingMessage): Promise<void>;
+    arrange(directives: Directive[]): void;
+    /**
+     * Authentication: who the credential names, if one is presented. A credential belongs to
+     * the request, so it is read once however many calls the request carries.
+     */
+    preflight(context: Context): Promise<void>;
+    /** Authorization: whether that identity may make this call, which every call asks anew. */
+    precall(directives: Directive[], context: Context, parameters: Parameter[]): Promise<Output>;
+    /**
+     * The same disjunction as `precall`, over what can be told without a request. A method no
+     * directive admits, and none is undecided about, is not this caller's to be told about —
+     * `null` takes it out of the answer.
+     *
+     * A permission is matched against a path, and a description is not a request to one, so
+     * `permits` has no say here. The call it describes is still checked, which is where a
+     * token's permissions belong.
+     *
+     * A method that is described is then described by each of them, which is a separate pass:
+     * admission is a disjunction and stops at the first that admits, while what the directives
+     * fill is not any one of them's to state alone.
+     */
+    explain(directives: Directive[], context: Context, introspection: Introspection): Promise<Introspection | null>;
+    settle(directives: Directive[], context: Context, response: http.OutgoingMessage): Promise<void>;
+    /**
+     * Re-issuing a credential, and refusing a ban, are the request's business: the header
+     * carries one token however many calls were made, and a ban refuses all of them.
+     */
+    depart(context: Context, response: http.OutgoingMessage): Promise<void>;
     private resolve;
+    private permitted;
     private banned;
 }
+/** Whether the permissions admit the method on the path the request is routed by. */
+export declare function permits(permissions: Record<string, string[]>, method: string, pathname: string): boolean;
+/**
+ * Whether the request is one the token's `aud` was issued for. A path is a prefix of the
+ * entry; an origin (empty or `/`) is every path on that host. A URI whose host is not
+ * this request's is not this resource.
+ */
+export declare function audience(audiences: string[], url: URL): boolean;