@toa.io/extensions.exposition 1.0.0-alpha.34 → 1.0.0-alpha.340

package/transpiled/Discovery/Site.js

@@ -0,0 +1,177 @@
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import { Readable } from 'node:stream';
+import { console } from 'openspan';
+import * as http from '../HTTP/index.js';
+import { DISCOVERY } from '@toa.io/definitions/extensions.exposition';
+/**
+ * The page that reads the tree: the directory `ui` builds, and nothing else.
+ *
+ * An interceptor rather than an endpoint, for the reason the OAuth documents are one — it
+ * runs before a credential is resolved. A page is public, and one served after `auth` would
+ * refuse the client holding a stale token, who is the client most likely to have opened it.
+ * It is also what keeps `depart` off these replies: a re-issued credential sets `no-store`,
+ * which would take the build hash off every asset that carries one.
+ *
+ * It claims the whole prefix, so that nothing under it reaches the router — a crawler
+ * asking for assets that are not there would otherwise have every one of them counted as a
+ * route that has gone missing, and ping discovery about it.
+ *
+ * `OPTIONS` on the prefix itself is the exception it lets through: the tree is what answers
+ * there, and that needs the identity this stage does not have yet.
+ */
+export class Site {
+    name = 'discovery';
+    /** What a test points at a fixture; the build otherwise. */
+    override;
+    root;
+    /** Hosts MCP is served at the root of, where this page is not served. */
+    roots = new Set();
+    constructor(root) {
+        this.override = root;
+        this.root = root ?? site();
+    }
+    /**
+     * Resolved here rather than at construction because this is a module singleton, built
+     * when the module loads and before anything has said where the page is. Said once, too,
+     * because a page that is not built is otherwise a `503` per request and nothing else.
+     */
+    mount(options) {
+        this.root = this.override ?? site();
+        this.roots = new Set(Object.values(options.mcp?.hosts ?? {}).map((host) => host.toLowerCase()));
+        if (!isFile(path.join(this.root, 'index.html')))
+            console.warn('Discovery UI is not built', { root: this.root });
+    }
+    intercept(input) {
+        const { pathname } = input.url;
+        if (pathname !== DISCOVERY && !pathname.startsWith(DISCOVERY + '/'))
+            return null;
+        // the gateway answers for such a host, and what it answers there is `404`
+        if (this.roots.has(input.url.host))
+            return null;
+        // the prefix itself, as opposed to something under it
+        const bare = pathname === DISCOVERY || pathname === DISCOVERY + '/';
+        const method = input.request.method;
+        if (method !== 'GET' && method !== 'HEAD') {
+            // the tree answers here, and it needs the identity this stage does not have yet
+            if (bare && method === 'OPTIONS')
+                return null;
+            throw new http.MethodNotAllowed(new Headers({ allow: bare ? 'GET, HEAD, OPTIONS' : 'GET, HEAD' }));
+        }
+        // the page is a directory, and every asset it names is relative to it
+        if (pathname === DISCOVERY)
+            return {
+                status: 302,
+                headers: new Headers({ location: DISCOVERY + '/' + input.url.search })
+            };
+        const file = this.resolve(pathname);
+        if (file === null)
+            throw new http.NotFound();
+        return this.send(file, method);
+    }
+    /**
+     * The file a request lands on, or `null` when nothing does. A path that exists is served
+     * as it is; anything else that could be a route falls back to the page, because the
+     * client router — not this server — knows what routes there are.
+     */
+    resolve(pathname) {
+        /*
+         * Decoded after the prefix is off, so that an encoded separator cannot smuggle a
+         * segment past the test that put us here. A dot segment never arrives — `..` and
+         * `%2e%2e` alike are collapsed while the URL is parsed — but `%2f` survives that and
+         * decodes to a separator here, which is what the guard below is for.
+         */
+        const relative = decode(pathname.slice(DISCOVERY.length));
+        if (relative === null || relative.includes('\0'))
+            return null;
+        const file = path.join(this.root, relative);
+        if (file !== this.root && !file.startsWith(this.root + path.sep))
+            return null;
+        if (isFile(file))
+            return file;
+        /*
+         * A missing asset is missing, but a route can look like one. What this server would
+         * have served is what it knows how to serve, so anything else is a route and falls
+         * back to the page — as does anything ending in a slash, which is no name for a file.
+         */
+        const asset = !relative.endsWith('/') && path.extname(relative) in TYPES;
+        return asset ? null : path.join(this.root, 'index.html');
+    }
+    /**
+     * Always with a `content-type` of its own: a stream without one is framed as
+     * `multipart/*` and the page arrives as an envelope of JSON-encoded buffers.
+     */
+    send(file, method) {
+        const stats = fs.statSync(file, { throwIfNoEntry: false });
+        if (stats === undefined)
+            return {
+                status: 503,
+                headers: new Headers({ 'content-type': 'text/plain; charset=utf-8' }),
+                body: Readable.from([Buffer.from(NOT_BUILT)])
+            };
+        const headers = new Headers({
+            'content-type': TYPES[path.extname(file)] ?? 'application/octet-stream',
+            'content-length': String(stats.size),
+            'cache-control': caching(path.relative(this.root, file))
+        });
+        // a HEAD reply carries no body but reports the length a GET would have returned; the
+        // HTTP/2 layer does not drop one written to it, so none is opened
+        if (method === 'HEAD')
+            return { status: 200, headers };
+        return { status: 200, headers, body: fs.createReadStream(file) };
+    }
+}
+const NOT_BUILT = 'The discovery UI is not built. Run `npm run build:ui`.\n';
+function decode(pathname) {
+    try {
+        return decodeURIComponent(pathname);
+    }
+    catch {
+        return null;
+    }
+}
+function isFile(file) {
+    return fs.statSync(file, { throwIfNoEntry: false })?.isFile() === true;
+}
+/**
+ * Where `npm run build:ui` puts the page. Two levels up because this module is a directory
+ * deeper than `source` itself, and `transpiled` mirrors that — so it resolves the same from
+ * either. The variable is the features', which run against a fixture rather than a build.
+ */
+function site() {
+    return (process.env.__TESTING_EXPOSITION_DISCOVERY_ROOT ??
+        path.resolve(import.meta.dirname, '..', '..', 'ui', 'dist'));
+}
+/** Assets under this prefix carry their build hash in the name. */
+const IMMUTABLE = path.join('_app', 'immutable');
+const FOREVER = 'public, max-age=31536000, immutable';
+/** The icons: named without a hash, so they are re-read, but rarely. */
+const ICONS = new Set(['favicon.ico', 'favicon-96x96.png', 'apple-touch-icon.png']);
+const DAY = 'public, max-age=86400';
+/**
+ * How long what is served may be held. The page is never cached — it names the assets, and
+ * their names carry the build. An icon is named for what it is rather than for its content,
+ * so it is asked about again, but not on every page load.
+ */
+function caching(relative) {
+    if (relative.startsWith(IMMUTABLE))
+        return FOREVER;
+    return ICONS.has(relative) ? DAY : 'no-cache';
+}
+const TYPES = {
+    '.css': 'text/css; charset=utf-8',
+    '.html': 'text/html; charset=utf-8',
+    '.ico': 'image/x-icon',
+    '.jpg': 'image/jpeg',
+    '.js': 'text/javascript; charset=utf-8',
+    '.json': 'application/json; charset=utf-8',
+    '.map': 'application/json; charset=utf-8',
+    '.png': 'image/png',
+    '.svg': 'image/svg+xml',
+    '.txt': 'text/plain; charset=utf-8',
+    '.webmanifest': 'application/manifest+json',
+    '.webp': 'image/webp',
+    '.woff': 'font/woff',
+    '.woff2': 'font/woff2'
+};
+//# sourceMappingURL=Site.js.map

package/transpiled/Discovery/Site.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Site.js","sourceRoot":"","sources":["../../source/Discovery/Site.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,SAAS,CAAA;AAC7B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAA;AACjC,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAA;AACtC,OAAO,EAAE,OAAO,EAAE,MAAM,UAAU,CAAA;AAClC,OAAO,KAAK,IAAI,MAAM,kBAAkB,CAAA;AACxC,OAAO,EAAE,SAAS,EAAE,MAAM,2CAA2C,CAAA;AAIrE;;;;;;;;;;;;;;;GAeG;AACH,MAAM,OAAO,IAAI;IACC,IAAI,GAAG,WAAW,CAAA;IAElC,4DAA4D;IAC3C,QAAQ,CAAoB;IACrC,IAAI,CAAQ;IAEpB,yEAAyE;IACjE,KAAK,GAAG,IAAI,GAAG,EAAU,CAAA;IAEjC,YAAmB,IAAa;QAC9B,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAA;QACpB,IAAI,CAAC,IAAI,GAAG,IAAI,IAAI,IAAI,EAAE,CAAA;IAC5B,CAAC;IAED;;;;OAIG;IACI,KAAK,CAAC,OAAqB;QAChC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,QAAQ,IAAI,IAAI,EAAE,CAAA;QACnC,IAAI,CAAC,KAAK,GAAG,IAAI,GAAG,CAClB,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAC1E,CAAA;QAED,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;YAC7C,OAAO,CAAC,IAAI,CAAC,2BAA2B,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAA;IAClE,CAAC;IAEM,SAAS,CAAC,KAAY;QAC3B,MAAM,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC,GAAG,CAAA;QAE9B,IAAI,QAAQ,KAAK,SAAS,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,SAAS,GAAG,GAAG,CAAC;YAAE,OAAO,IAAI,CAAA;QAEhF,0EAA0E;QAC1E,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAA;QAE/C,sDAAsD;QACtD,MAAM,IAAI,GAAG,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,SAAS,GAAG,GAAG,CAAA;QACnE,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAA;QAEnC,IAAI,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;YAC1C,gFAAgF;YAChF,IAAI,IAAI,IAAI,MAAM,KAAK,SAAS;gBAAE,OAAO,IAAI,CAAA;YAE7C,MAAM,IAAI,IAAI,CAAC,gBAAgB,CAC7B,IAAI,OAAO,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAClE,CAAA;QACH,CAAC;QAED,sEAAsE;QACtE,IAAI,QAAQ,KAAK,SAAS;YACxB,OAAO;gBACL,MAAM,EAAE,GAAG;gBACX,OAAO,EAAE,IAAI,OAAO,CAAC,EAAE,QAAQ,EAAE,SAAS,GAAG,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC;aACvE,CAAA;QAEH,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAA;QAEnC,IAAI,IAAI,KAAK,IAAI;YAAE,MAAM,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAA;QAE5C,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;IAChC,CAAC;IAED;;;;OAIG;IACK,OAAO,CAAC,QAAgB;QAC9B;;;;;WAKG;QACH,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAA;QAEzD,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAA;QAE7D,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAA;QAE3C,IAAI,IAAI,KAAK,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAA;QAE7E,IAAI,MAAM,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAA;QAE7B;;;;WAIG;QACH,MAAM,KAAK,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAA;QAExE,OAAO,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC,CAAA;IAC1D,CAAC;IAED;;;OAGG;IACK,IAAI,CAAC,IAAY,EAAE,MAAc;QACvC,MAAM,KAAK,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,CAAA;QAE1D,IAAI,KAAK,KAAK,SAAS;YACrB,OAAO;gBACL,MAAM,EAAE,GAAG;gBACX,OAAO,EAAE,IAAI,OAAO,CAAC,EAAE,cAAc,EAAE,2BAA2B,EAAE,CAAC;gBACrE,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;aAC9C,CAAA;QAEH,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC;YAC1B,cAAc,EAAE,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,0BAA0B;YACvE,gBAAgB,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC;YACpC,eAAe,EAAE,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;SACzD,CAAC,CAAA;QAEF,qFAAqF;QACrF,kEAAkE;QAClE,IAAI,MAAM,KAAK,MAAM;YAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,CAAA;QAEtD,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAA;IAClE,CAAC;CACF;AAED,MAAM,SAAS,GAAG,0DAA0D,CAAA;AAE5E,SAAS,MAAM,CAAC,QAAgB;IAC9B,IAAI,CAAC;QACH,OAAO,kBAAkB,CAAC,QAAQ,CAAC,CAAA;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC;AAED,SAAS,MAAM,CAAC,IAAY;IAC1B,OAAO,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,KAAK,IAAI,CAAA;AACxE,CAAC;AAED;;;;GAIG;AACH,SAAS,IAAI;IACX,OAAO,CACL,OAAO,CAAC,GAAG,CAAC,mCAAmC;QAC/C,IAAI,CAAC,OAAO,CAAC,OAAO,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,CAC5D,CAAA;AACH,CAAC;AAED,mEAAmE;AACnE,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC,CAAA;AAChD,MAAM,OAAO,GAAG,qCAAqC,CAAA;AAErD,wEAAwE;AACxE,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,CAAC,aAAa,EAAE,mBAAmB,EAAE,sBAAsB,CAAC,CAAC,CAAA;AACnF,MAAM,GAAG,GAAG,uBAAuB,CAAA;AAEnC;;;;GAIG;AACH,SAAS,OAAO,CAAC,QAAgB;IAC/B,IAAI,QAAQ,CAAC,UAAU,CAAC,SAAS,CAAC;QAAE,OAAO,OAAO,CAAA;IAElD,OAAO,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,CAAA;AAC/C,CAAC;AAED,MAAM,KAAK,GAA2B;IACpC,MAAM,EAAE,yBAAyB;IACjC,OAAO,EAAE,0BAA0B;IACnC,MAAM,EAAE,cAAc;IACtB,MAAM,EAAE,YAAY;IACpB,KAAK,EAAE,gCAAgC;IACvC,OAAO,EAAE,iCAAiC;IAC1C,MAAM,EAAE,iCAAiC;IACzC,MAAM,EAAE,WAAW;IACnB,MAAM,EAAE,eAAe;IACvB,MAAM,EAAE,2BAA2B;IACnC,cAAc,EAAE,2BAA2B;IAC3C,OAAO,EAAE,YAAY;IACrB,OAAO,EAAE,WAAW;IACpB,QAAQ,EAAE,YAAY;CACvB,CAAA"}

package/transpiled/Discovery/index.d.ts

@@ -0,0 +1,3 @@
+export { Explorer } from './Explorer.ts';
+export { Site } from './Site.ts';
+export { looking } from './trunk.ts';

package/transpiled/Discovery/index.js

@@ -0,0 +1,4 @@
+export { Explorer } from './Explorer.js';
+export { Site } from './Site.js';
+export { looking } from './trunk.js';
+//# sourceMappingURL=index.js.map

package/transpiled/Discovery/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../source/Discovery/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AACxC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EAAE,OAAO,EAAE,MAAM,YAAY,CAAA"}

package/transpiled/Discovery/tree.d.ts

@@ -0,0 +1,28 @@
+import { type Described } from '../directives/help/index.ts';
+import type * as http from '../HTTP/index.ts';
+import type { Tree } from '../RTD/index.ts';
+/**
+ * Every route in the tree this caller may reach, keyed by the template it answers at, and
+ * each described exactly as `OPTIONS` on that path describes it — so a key can be taken
+ * from the answer and sent back as a request.
+ *
+ * A route a name cannot spell is here, unlike at `/.rpc` and `/.mcp`: HTTP addresses a
+ * route by its path, so leaving one out would make this disagree with the router. A
+ * resource no method of which this caller may reach is not here at all — `OPTIONS` answers
+ * `403` to one, and an empty entry would still say it exists.
+ *
+ * Sorted, because a branch is merged whenever its tenant answers and two replicas would
+ * otherwise order the same tree differently. Verbs keep the order they were declared in,
+ * which is the order `OPTIONS` answers them in.
+ */
+export declare function describe(tree: Tree, request: http.Context): Promise<Discovered>;
+/** What the tree answers. An object, so that what is said of the whole of it has somewhere to go. */
+export interface Discovered {
+    routes: Record<string, Resource>;
+    /** Where MCP is served for the authority asked, where that is a host of its own. */
+    mcp?: string;
+}
+/** What one resource is, and what it serves; a verb is upper case, and nothing else here is. */
+export interface Resource extends Described {
+    [verb: string]: unknown;
+}

package/transpiled/Discovery/tree.js

@@ -0,0 +1,50 @@
+import { describing } from '../Introspection.js';
+import { template } from '../RPC/names.js';
+import { variables } from '../RTD/segment.js';
+import { guarded, resource } from '../directives/help/index.js';
+/**
+ * Every route in the tree this caller may reach, keyed by the template it answers at, and
+ * each described exactly as `OPTIONS` on that path describes it — so a key can be taken
+ * from the answer and sent back as a request.
+ *
+ * A route a name cannot spell is here, unlike at `/.rpc` and `/.mcp`: HTTP addresses a
+ * route by its path, so leaving one out would make this disagree with the router. A
+ * resource no method of which this caller may reach is not here at all — `OPTIONS` answers
+ * `403` to one, and an empty entry would still say it exists.
+ *
+ * Sorted, because a branch is merged whenever its tenant answers and two replicas would
+ * otherwise order the same tree differently. Verbs keep the order they were declared in,
+ * which is the order `OPTIONS` answers them in.
+ */
+export async function describe(tree, request) {
+    const context = describing(request);
+    const routes = new Map();
+    /*
+     * Sequentially: there is no I/O to overlap — an endpoint's own description is read once
+     * and memoized — so awaiting the whole tree at once would only allocate every clone of
+     * it at the same moment.
+     */
+    for (const { segments, verb, method } of tree.walk()) {
+        const introspection = await method.explain(context, variables(segments));
+        if (introspection === null)
+            continue;
+        const route = template(segments);
+        let mounted = routes.get(route);
+        if (mounted === undefined) {
+            mounted = { described: resource(method.directives), methods: {} };
+            routes.set(route, mounted);
+        }
+        // two declarations can walk to one template — `/a/b` and `/a: { /b: }` — and the walk
+        // is in the order `match` tries them, so the first is the one a request would reach
+        mounted.methods[verb] ??= introspection;
+    }
+    const described = {};
+    for (const route of Array.from(routes.keys()).sort()) {
+        const { described: stated, methods } = routes.get(route);
+        // what the resource is, beside the methods it serves; a verb is upper case and cannot
+        // collide with either key
+        described[route] = { ...stated, ...guarded(methods), ...methods };
+    }
+    return { routes: described };
+}
+//# sourceMappingURL=tree.js.map

package/transpiled/Discovery/tree.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tree.js","sourceRoot":"","sources":["../../source/Discovery/tree.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAA;AAChD,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAA;AAC1C,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAA;AAC7C,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAkB,MAAM,6BAA6B,CAAA;AAK/E;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,IAAU,EAAE,OAAqB;IAC9D,MAAM,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC,CAAA;IACnC,MAAM,MAAM,GAAG,IAAI,GAAG,EAAmB,CAAA;IAEzC;;;;OAIG;IACH,KAAK,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC;QACrD,MAAM,aAAa,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAA;QAExE,IAAI,aAAa,KAAK,IAAI;YAAE,SAAQ;QAEpC,MAAM,KAAK,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAA;QAChC,IAAI,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;QAE/B,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,OAAO,GAAG,EAAE,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAA;YACjE,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,OAAO,CAAC,CAAA;QAC5B,CAAC;QAED,sFAAsF;QACtF,oFAAoF;QACpF,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,aAAa,CAAA;IACzC,CAAC;IAED,MAAM,SAAS,GAA6B,EAAE,CAAA;IAE9C,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QACrD,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAE,CAAA;QAEzD,sFAAsF;QACtF,0BAA0B;QAC1B,SAAS,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,MAAM,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,EAAE,GAAG,OAAO,EAAE,CAAA;IACnE,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAA;AAC9B,CAAC"}

package/transpiled/Discovery/trunk.d.ts

@@ -0,0 +1,13 @@
+import type { Context, OutgoingMessage } from '../HTTP/index.ts';
+/**
+ * Where a browser that asked for the trunk is sent. An application serves what it declares,
+ * and `/` is usually not one of those — a person who typed the address into a browser is
+ * looking for something to look at, and the page is the only thing here that is one.
+ *
+ * A client that asked for something in particular gets what it asked for: only an `accept`
+ * that prefers a page, or one that names no preference at all, is sent here. The second is
+ * what an unfurler sends — several ask for anything, and a link to an application would
+ * otherwise show nothing — and what `curl` sends, which the page serves no worse than the
+ * `405` it used to get.
+ */
+export declare function looking(context: Context): OutgoingMessage | null;

package/transpiled/Discovery/trunk.js

@@ -0,0 +1,29 @@
+import Negotiator from 'negotiator';
+import { types } from '../HTTP/formats/index.js';
+import { DISCOVERY } from '@toa.io/definitions/extensions.exposition';
+/** What a browser asks for, and what nothing else here answers with. */
+const HTML = 'text/html';
+/**
+ * Where a browser that asked for the trunk is sent. An application serves what it declares,
+ * and `/` is usually not one of those — a person who typed the address into a browser is
+ * looking for something to look at, and the page is the only thing here that is one.
+ *
+ * A client that asked for something in particular gets what it asked for: only an `accept`
+ * that prefers a page, or one that names no preference at all, is sent here. The second is
+ * what an unfurler sends — several ask for anything, and a link to an application would
+ * otherwise show nothing — and what `curl` sends, which the page serves no worse than the
+ * `405` it used to get.
+ */
+export function looking(context) {
+    if (context.request.method !== 'GET' || context.procedural)
+        return null;
+    const accept = context.request.headers.accept;
+    if (accept !== undefined && accept.trim() !== ANYTHING) {
+        if (new Negotiator(context.request).mediaType([...types, HTML]) !== HTML)
+            return null;
+    }
+    return { status: 302, headers: new Headers({ location: DISCOVERY + '/' }) };
+}
+/** An `accept` that names nothing, which is the same as naming none. */
+const ANYTHING = '*/*';
+//# sourceMappingURL=trunk.js.map

package/transpiled/Discovery/trunk.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"trunk.js","sourceRoot":"","sources":["../../source/Discovery/trunk.ts"],"names":[],"mappings":"AAAA,OAAO,UAAU,MAAM,YAAY,CAAA;AACnC,OAAO,EAAE,KAAK,EAAE,MAAM,0BAA0B,CAAA;AAChD,OAAO,EAAE,SAAS,EAAE,MAAM,2CAA2C,CAAA;AAGrE,wEAAwE;AACxE,MAAM,IAAI,GAAG,WAAW,CAAA;AAExB;;;;;;;;;;GAUG;AACH,MAAM,UAAU,OAAO,CAAC,OAAgB;IACtC,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,KAAK,KAAK,IAAI,OAAO,CAAC,UAAU;QAAE,OAAO,IAAI,CAAA;IAEvE,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAA;IAE7C,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,IAAI,EAAE,KAAK,QAAQ,EAAE,CAAC;QACvD,IAAI,IAAI,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,CAAC,GAAG,KAAK,EAAE,IAAI,CAAC,CAAC,KAAK,IAAI;YAAE,OAAO,IAAI,CAAA;IACvF,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,OAAO,CAAC,EAAE,QAAQ,EAAE,SAAS,GAAG,GAAG,EAAE,CAAC,EAAE,CAAA;AAC7E,CAAC;AAED,wEAAwE;AACxE,MAAM,QAAQ,GAAG,KAAK,CAAA"}

package/transpiled/Endpoint.d.ts

@@ -1,16 +1,30 @@
-import { type Component } from '@toa.io/core';
-import { type Remotes } from './Remotes';
-import { Mapping } from './Mapping';
-import { type Context } from './Context';
-import * as http from './HTTP';
-import type * as RTD from './RTD';
+import { Mapping } from './Mapping.ts';
+import * as http from './HTTP/index.ts';
+import type { Introspection, Schema } from './Introspection.ts';
+import type { Remote } from '@toa.io/core';
+import type { Remotes } from './Remotes.ts';
+import type { Context } from './Context.ts';
+import type * as RTD from './RTD/index.ts';
 export declare class Endpoint implements RTD.Endpoint {
     private readonly endpoint;
     private readonly mapping;
     private readonly discovery;
     private remote;
-    constructor(endpoint: string, mapping: Mapping, discovery: Promise<Component>);
-    call(context: http.Context, parameters: RTD.Parameter[]): Promise<http.OutgoingMessage>;
+    /** Whether the method this serves is a safe one, which `io:readonly` overrides per request. */
+    private readonly safe;
+    /** What the operation says, with what the route takes already split out of it. */
+    private introspection;
+    constructor(endpoint: string, mapping: Mapping, discovery: Promise<Remote>, safe?: boolean);
+    call(context: http.Context & Authenticated, parameters: RTD.Parameter[]): Promise<http.OutgoingMessage>;
+    selection(): Record<string, Schema> | null;
+    explain(parameters: RTD.Parameter[]): Promise<Introspection>;
+    /**
+     * `Remote.explain` answers the contract's own object, whose `input` is the manifest's by
+     * reference. What follows takes properties out of it, and two routes mounting one endpoint
+     * share one remote — so the copy is what keeps the second from describing what the first
+     * took away.
+     */
+    private introspect;
     close(): Promise<void>;
     private query;
     private version;
@@ -20,3 +34,13 @@ export declare class EndpointsFactory implements RTD.EndpointsFactory {
     constructor(remotes: Remotes);
     create(method: RTD.syntax.Method, context: Context): Endpoint;
 }
+/**
+ * What the auth family leaves on the context, as much of it as this reads. Declared here rather
+ * than imported, the way `cache` declares its own: the property is that family's.
+ */
+interface Authenticated {
+    identity?: {
+        id: string;
+    } | null;
+}
+export {};

package/transpiled/Endpoint.js

@@ -1,103 +1,179 @@
-"use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || function (mod) {
-    if (mod && mod.__esModule) return mod;
-    var result = {};
-    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
-    __setModuleDefault(result, mod);
-    return result;
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.EndpointsFactory = exports.Endpoint = void 0;
-const Mapping_1 = require("./Mapping");
-const http = __importStar(require("./HTTP"));
-class Endpoint {
+import { Readable } from 'node:stream';
+import { entities } from '@toa.io/core';
+import { Mapping } from './Mapping.js';
+import { take } from './Introspection.js';
+import { parse } from './directives/cache/etag.js';
+import * as http from './HTTP/index.js';
+/** What a reply may travel as bytes in, which is the one format a component encodes. */
+const JSON_TYPE = 'application/json';
+export class Endpoint {
     endpoint;
     mapping;
     discovery;
     remote = null;
-    constructor(endpoint, mapping, discovery) {
+    /** Whether the method this serves is a safe one, which `io:readonly` overrides per request. */
+    safe;
+    /** What the operation says, with what the route takes already split out of it. */
+    introspection = null;
+    // eslint-disable-next-line max-params
+    constructor(endpoint, mapping, discovery, safe = false) {
         this.endpoint = endpoint;
         this.mapping = mapping;
         this.discovery = discovery;
+        this.safe = safe;
     }
     async call(context, parameters) {
         const body = await context.body();
         const query = this.query(context);
         const request = this.mapping.fit(body, query, parameters);
+        // a header sent twice is an ambiguity, not a key; the client repeats one value or none
+        const key = context.request.headers[IDEMPOTENCY_KEY];
+        if (typeof key === 'string' && key !== '')
+            request.id = identity(context, key);
+        // the process a stateful operation is called on, where the route carries one
+        if (context.instance !== undefined)
+            request.instance = context.instance;
+        // what this request receives of the output, which the operation answers of it
+        if (context.output !== undefined)
+            request.output = context.output;
+        /*
+         * Bytes to write on rather than values to read: the response is JSON, nothing on the way out
+         * reads the body, and this is a request to a resource rather than a procedure of one, whose
+         * reply is wrapped in an envelope of its own.
+         */
+        if (context.encoder?.type === JSON_TYPE &&
+            context.reads !== true &&
+            !context.procedural)
+            request.encoded = true;
+        // what the method means, unless a route said otherwise; see `documentation/readonly.md`
+        if (context.readonly ?? this.safe)
+            request.readonly = true;
         this.remote ??= await this.discovery;
         const reply = await this.remote.invoke(this.endpoint, request);
-        if (context.debug)
-            console.debug('Call', `${this.remote.locator.id}.${this.endpoint}`, request);
+        // a body that outgrew what the route takes was cut, whatever the operation made of that
+        if (context.exceeded === true)
+            throw new http.RequestEntityTooLarge();
         if (reply instanceof Error)
             throw new http.UnprocessableEntity(reply);
-        const message = {};
-        if (typeof reply === 'object' && reply !== null && '_version' in reply) {
-            const etag = context.request.headers['if-none-match'];
-            message.headers ??= new Headers();
-            if (etag !== undefined && reply._version === this.version(etag)) {
-                message.status = 304;
-                message.headers.set('etag', etag);
-                return message;
-            }
-            else
-                message.headers.set('etag', `"${reply._version.toString()}"`);
+        if (context.answers === undefined)
+            return { body: reply };
+        // a route that states what it produces answers bytes, and a value is not one of those
+        if (!(reply instanceof Readable) || reply.readableObjectMode)
+            throw new http.UnprocessableEntity();
+        return { body: reply, headers: new Headers({ 'content-type': context.answers }) };
+    }
+    selection() {
+        return this.mapping.selection();
+    }
+    async explain(parameters) {
+        this.introspection ??= await this.introspect(parameters);
+        // what a directive narrows is this caller's answer, not the next caller's
+        return structuredClone(this.introspection);
+    }
+    /**
+     * `Remote.explain` answers the contract's own object, whose `input` is the manifest's by
+     * reference. What follows takes properties out of it, and two routes mounting one endpoint
+     * share one remote — so the copy is what keeps the second from describing what the first
+     * took away.
+     */
+    async introspect(parameters) {
+        this.remote ??= await this.discovery;
+        const operation = structuredClone(await this.remote.explain(this.endpoint));
+        // what the operation states it is, is the Introspection's to read and not a resource's:
+        // an operation is written without knowledge of any route, and the same one mounted twice
+        // is two methods. What a method states is what its route states, which `mcp:tool` gives.
+        delete operation.description;
+        let route = null;
+        // a variable the operation names is taken by the path, so it is not the body's to send
+        for (const parameter of parameters) {
+            const schema = take(operation, parameter.name);
+            if (schema === undefined)
+                continue;
+            route ??= {};
+            route[parameter.name] = schema;
         }
-        message.body = reply;
-        return message;
+        const query = this.mapping.explain(operation);
+        const selection = this.mapping.selection();
+        const introspection = {};
+        if (route !== null)
+            introspection.route = route;
+        if (query !== null)
+            introspection.query = query;
+        if (selection !== null)
+            introspection.selection = selection;
+        Object.assign(introspection, operation);
+        return introspection;
     }
     async close() {
         this.remote ??= await this.discovery;
         await this.remote.disconnect(INTERRUPT);
     }
     query(context) {
-        const query = Object.fromEntries(context.url.searchParams);
+        // a URL without a query builds no parameters to read nothing out of
+        const query = context.url.search === '' ? {} : Object.fromEntries(context.url.searchParams);
         const etag = context.request.headers['if-match'];
-        if (etag !== undefined)
+        if (etag !== undefined && this.mapping.queryable)
             query.version = this.version(etag);
         return query;
     }
     version(etag) {
-        const match = etag.match(ETAG);
-        if (match === null)
-            throw new http.BadRequest('Invalid ETag.');
-        return Number.parseInt(match.groups.version);
+        const version = parse(etag);
+        if (version === null)
+            throw new http.BadRequest('Invalid ETag');
+        return version;
     }
 }
-exports.Endpoint = Endpoint;
-class EndpointsFactory {
+export class EndpointsFactory {
     remotes;
     constructor(remotes) {
         this.remotes = remotes;
     }
     create(method, context) {
         if (method.mapping === undefined)
-            throw new Error('Cannot create Endpoint without mapping.');
-        const mapping = Mapping_1.Mapping.create(method.mapping.query);
-        const namespace = method.mapping.namespace ?? context.extension?.namespace;
-        const component = method.mapping.component ?? context.extension?.component;
+            throw new Error('Cannot create Endpoint without mapping');
+        const mapping = Mapping.create(method.mapping.query, method.mapping.paged, method.mapping.streamed);
+        const branch = context.extension;
+        const namespace = method.mapping.namespace ?? branch?.namespace;
+        const component = method.mapping.component ?? branch?.component;
         if (namespace === undefined || component === undefined)
-            throw new Error('Annotation endpoints must be fully qualified.');
-        const discovery = this.remotes.discover(namespace, component);
-        return new Endpoint(method.mapping.endpoint, mapping, discovery);
+            throw new Error('Annotation endpoints must be fully qualified');
+        const discovery = this.remotes.discover(namespace, component, branch?.contract);
+        return new Endpoint(method.mapping.endpoint, mapping, discovery, SAFE.has(method.verb));
     }
 }
-exports.EndpointsFactory = EndpointsFactory;
-const ETAG = /^"(?<version>\d{1,32})"$/;
+/**
+ * The methods that only read, as RFC 9110 defines safe ones. `OPTIONS` is not among them because it
+ * reaches no endpoint, and `TRACE` because the server answers it `501`.
+ */
+const SAFE = new Set(['GET', 'HEAD']);
 const INTERRUPT = true;
+/**
+ * What a client's idempotency key names, as an identity the runtime can hold: it is what the
+ * operation records the call under, so a retry under the same key is the same call.
+ *
+ * Four things, and each of them earns its place. The **principal**, because two clients that
+ * both pick `1` would otherwise be answered with each other's replies — and worse, either could
+ * suppress the other's write by getting there first. The **key** itself, which is what the
+ * client repeats. The **method** and the **path**, because one key sent to two routes is two
+ * calls: the path carries the record the call is about, so a key reused across orders does not
+ * collapse them into one.
+ *
+ * Not the payload. A client that sends one key with two different bodies is answered with what
+ * the first one answered, which is what an idempotency key means; telling them off for it costs
+ * a stored fingerprint and buys a diagnostic.
+ *
+ * Hashed rather than taken as it is, so that a key is opaque input: a client cannot name an
+ * identity the runtime would have minted, and cannot reach one another client's key derives.
+ */
+function identity(context, key) {
+    return entities.derive(context.identity?.id ?? ANONYMOUS, key, context.request.method, context.url.pathname);
+}
+/**
+ * A route nothing authenticates has no principal to scope a key by, so every client of one
+ * shares a namespace. Keys are still honoured there — the alternative is refusing a header the
+ * client is entitled to send — and what it costs is that two anonymous clients picking one key
+ * on one path collide. Anonymous routes that change state are the case to watch.
+ */
+const ANONYMOUS = '';
+const IDEMPOTENCY_KEY = 'idempotency-key';
 //# sourceMappingURL=Endpoint.js.map