@caronte-sdk/node 0.2.0 → 0.2.2

package/README.md

@@ -1,4 +1,4 @@
-# @argos/node
+# @caronte-sdk/node
 
 Node.js client for the **Argos** authorizer — handles app authentication,
 JWT validation, permission checking and automatic operation sync.
@@ -6,12 +6,12 @@ JWT validation, permission checking and automatic operation sync.
 ## Installation
 
 ```bash
-npm install @argos/node
+npm install @caronte-sdk/node
 # With framework-specific adapter
-npm install @argos/node express        # Express
-npm install @argos/node fastify        # Fastify
-npm install @argos/node @nestjs/common # NestJS
-npm install @argos/node @apollo/server # Apollo Server
+npm install @caronte-sdk/node express        # Express
+npm install @caronte-sdk/node fastify        # Fastify
+npm install @caronte-sdk/node @nestjs/common # NestJS
+npm install @caronte-sdk/node @apollo/server # Apollo Server
 ```
 
 ## Quick start
@@ -20,24 +20,24 @@ npm install @argos/node @apollo/server # Apollo Server
 
 ```ts
 import express from 'express';
-import { ArgosClient, getRegistry } from '@argos/node';
-import { argos } from '@argos/node/express';
+import { CaronteClient, getRegistry } from '@caronte-sdk/node';
+import { caronte } from '@caronte-sdk/node/express';
 
-const client = new ArgosClient({
+const client = new CaronteClient({
   authorizerUrl: process.env.AUTHORIZER_URL!,
   realmId:       process.env.REALM_ID!,
   appId:         process.env.APP_ID!,
   secret:        process.env.APP_SECRET!,
 });
 
-const { middleware, guard } = argos(client);
+const { middleware, guard } = caronte(client);
 
 const app = express();
 app.use(express.json(), middleware);
 
 app.get('/health',  guard('health:check', 'public'),    (_req, res) => res.json({ status: 'ok' }));
 app.get('/tasks',   guard('tasks:list',   'private'),   (_req, res) => res.json(tasks));
-app.post('/tasks',  guard('tasks:create', 'protected'), (req,  res) => { /* req.argosUser */ });
+app.post('/tasks',  guard('tasks:create', 'protected'), (req,  res) => { /* req.caronteUser */ });
 
 for (const op of getRegistry()) client.registerOperation(op);
 await client.startup();
@@ -49,22 +49,22 @@ app.listen(3001);
 
 ```ts
 import Fastify from 'fastify';
-import { ArgosClient, getRegistry } from '@argos/node';
-import { argosFastifyPlugin } from '@argos/node/fastify';
+import { CaronteClient, getRegistry } from '@caronte-sdk/node';
+import { caronteFastifyPlugin } from '@caronte-sdk/node/fastify';
 
-const client = new ArgosClient({ ... });
+const client = new CaronteClient({ ... });
 const fastify = Fastify();
 
-await fastify.register(argosFastifyPlugin, { client });
+await fastify.register(caronteFastifyPlugin, { client });
 
 fastify.get('/health',
-  { preHandler: fastify.argosGuard('health:check', 'public') },
+  { preHandler: fastify.caronteGuard('health:check', 'public') },
   async () => ({ status: 'ok' }),
 );
 
 fastify.get('/tasks',
-  { preHandler: fastify.argosGuard('tasks:list', 'private') },
-  async (req) => { /* req.argosUser */ },
+  { preHandler: fastify.caronteGuard('tasks:list', 'private') },
+  async (req) => { /* req.caronteUser */ },
 );
 
 for (const op of getRegistry()) client.registerOperation(op);
@@ -78,11 +78,11 @@ await fastify.listen({ port: 3002 });
 ```ts
 // app.module.ts
 import { Module } from '@nestjs/common';
-import { ArgosModule } from '@argos/node/nest';
+import { CaronteModule } from '@caronte-sdk/node/nest';
 
 @Module({
   imports: [
-    ArgosModule.forRootAsync({
+    CaronteModule.forRootAsync({
       authorizerUrl: process.env.AUTHORIZER_URL!,
       realmId:       process.env.REALM_ID!,
       appId:         process.env.APP_ID!,
@@ -96,11 +96,11 @@ export class AppModule {}
 ```ts
 // tasks.controller.ts
 import { Controller, Get, Post, UseGuards } from '@nestjs/common';
-import { ArgosGuard, ArgosUser, Operation } from '@argos/node/nest';
-import type { TokenClaims } from '@argos/node';
+import { CaronteGuard, CaronteUser, Operation } from '@caronte-sdk/node/nest';
+import type { TokenClaims } from '@caronte-sdk/node';
 
 @Controller('tasks')
-@UseGuards(ArgosGuard)
+@UseGuards(CaronteGuard)
 export class TasksController {
 
   @Get()
@@ -109,7 +109,7 @@ export class TasksController {
 
   @Post()
   @Operation('tasks:create', 'protected')
-  create(@ArgosUser() user: TokenClaims) {
+  create(@CaronteUser() user: TokenClaims) {
     // user.sub, user.groups
   }
 }
@@ -119,23 +119,23 @@ export class TasksController {
 
 ```ts
 import { ApolloServer } from '@apollo/server';
-import { ArgosClient, getRegistry } from '@argos/node';
-import { argosPlugin, createGuard, type ArgosContext } from '@argos/node/apollo';
+import { CaronteClient, getRegistry } from '@caronte-sdk/node';
+import { carontePlugin, createGuard, type CaronteContext } from '@caronte-sdk/node/apollo';
 
-const client = new ArgosClient({ ... });
+const client = new CaronteClient({ ... });
 const guard  = createGuard(client);
 
 const resolvers = {
   Query: {
     health: guard('health:check', 'public',  () => 'ok'),
-    tasks:  guard('tasks:list',   'private', (_p, _a, ctx: ArgosContext) => {
-      const user = ctx.argosUser; // TokenClaims
+    tasks:  guard('tasks:list',   'private', (_p, _a, ctx: CaronteContext) => {
+      const user = ctx.caronteUser; // TokenClaims
       return tasks;
     }),
   },
   Mutation: {
-    createTask: guard('tasks:create', 'protected', (_p, { input }, ctx: ArgosContext) => {
-      // ctx.argosUser is the authenticated user
+    createTask: guard('tasks:create', 'protected', (_p, { input }, ctx: CaronteContext) => {
+      // ctx.caronteUser is the authenticated user
     }),
   },
 };
@@ -143,10 +143,10 @@ const resolvers = {
 for (const op of getRegistry()) client.registerOperation(op);
 await client.startup();
 
-const server = new ApolloServer<ArgosContext>({
+const server = new ApolloServer<CaronteContext>({
   typeDefs,
   resolvers,
-  plugins: [argosPlugin(client)],
+  plugins: [carontePlugin(client)],
 });
 ```
 
@@ -191,7 +191,7 @@ On `startup()`, the client:
 On each request, the adapter:
 - Validates the Bearer token using the cached JWKS
 - Checks `TokenClaims.groups` against the operation's `allowedGroups`
-- Injects `argosUser` (`TokenClaims`) into the request context
+- Injects `caronteUser` (`TokenClaims`) into the request context
 
 ## License
 

package/dist/adapters/apollo.cjs

@@ -1,13 +1,13 @@
 'use strict';
 
 // src/exceptions.ts
-var ArgosError = class extends Error {
+var CaronteError = class extends Error {
   constructor(message) {
     super(message);
     this.name = this.constructor.name;
   }
 };
-var ArgosTokenError = class extends ArgosError {
+var CaronteTokenError = class extends CaronteError {
 };
 
 // src/registry.ts
@@ -27,7 +27,7 @@ function registerOperation(op) {
 }
 
 // src/adapters/apollo.ts
-function argosPlugin(client) {
+function carontePlugin(client) {
   return {
     async requestDidStart() {
       return {
@@ -38,10 +38,10 @@ function argosPlugin(client) {
           const [scheme, token] = auth.split(" ");
           if (scheme?.toLowerCase() === "bearer" && token) {
             try {
-              ctx.contextValue.argosUser = await client.validateToken(token);
+              ctx.contextValue.caronteUser = await client.validateToken(token);
             } catch (err) {
-              if (err instanceof ArgosTokenError) {
-                ctx.contextValue.argosUser = void 0;
+              if (err instanceof CaronteTokenError) {
+                ctx.contextValue.caronteUser = void 0;
               }
             }
           }
@@ -56,8 +56,8 @@ function createGuard(client) {
     registerOperation({ identifier: id, method: resolvedMethod, level });
     return (parent, args, context, info) => {
       if (level === "public") return resolver(parent, args, context, info);
-      if (!context.argosUser) throw new Error("Unauthorized: Bearer token required.");
-      if (!client.checkPermission(context.argosUser, id, resolvedMethod)) {
+      if (!context.caronteUser) throw new Error("Unauthorized: Bearer token required.");
+      if (!client.checkPermission(context.caronteUser, id, resolvedMethod)) {
         throw new Error("Forbidden: Insufficient permissions.");
       }
       return resolver(parent, args, context, info);
@@ -65,7 +65,7 @@ function createGuard(client) {
   };
 }
 
-exports.argosPlugin = argosPlugin;
+exports.carontePlugin = carontePlugin;
 exports.createGuard = createGuard;
 //# sourceMappingURL=apollo.cjs.map
 //# sourceMappingURL=apollo.cjs.map

package/dist/adapters/apollo.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/exceptions.ts","../../src/registry.ts","../../src/adapters/apollo.ts"],"names":[],"mappings":";;;AAAO,IAAM,UAAA,GAAN,cAAyB,KAAA,CAAM;AAAA,EACpC,YAAY,OAAA,EAAiB;AAC3B,IAAA,KAAA,CAAM,OAAO,CAAA;AACb,IAAA,IAAA,CAAK,IAAA,GAAO,KAAK,WAAA,CAAY,IAAA;AAAA,EAC/B;AACF,CAAA;AAGO,IAAM,eAAA,GAAN,cAAgC,UAAA,CAAW;AAAC,CAAA;;;ACNnD,IAAM,YAAmC,EAAC;AAKnC,SAAS,aAAa,EAAA,EAAoB;AAC/C,EAAA,MAAM,IAAA,GAAA,CAAQ,GAAG,KAAA,CAAM,GAAG,EAAE,GAAA,EAAI,IAAK,IAAI,WAAA,EAAY;AACrD,EAAA,IAAI,wBAAA,CAAyB,IAAA,CAAK,IAAI,CAAA,EAAS,OAAO,MAAA;AACtD,EAAA,IAAI,0BAAA,CAA2B,IAAA,CAAK,IAAI,CAAA,EAAQ,OAAO,QAAA;AACvD,EAAA,IAAI,iCAAA,CAAkC,IAAA,CAAK,IAAI,CAAA,EAAG,OAAO,QAAA;AACzD,EAAA,OAAO,OAAA;AACT;AAGO,SAAS,kBAAkB,EAAA,EAA+B;AAC/D,EAAA,MAAM,SAAS,SAAA,CAAU,IAAA;AAAA,IACvB,OAAK,CAAA,CAAE,UAAA,KAAe,GAAG,UAAA,IAAc,CAAA,CAAE,WAAW,EAAA,CAAG;AAAA,GACzD;AACA,EAAA,IAAI,CAAC,MAAA,EAAQ,SAAA,CAAU,IAAA,CAAK,EAAE,CAAA;AAChC;;;ACJO,SAAS,YAAY,MAAA,EAAuD;AACjF,EAAA,OAAO;AAAA,IACL,MAAM,eAAA,GAAkB;AACtB,MAAA,OAAO;AAAA,QACL,MAAM,oBAAoB,GAAA,EAA0C;AAClE,UAAA,MAAM,WAAY,GAAA,CAAI,OAAA,CAAQ,MAAM,OAAA,CAAQ,GAAA,CAAI,eAAe,CAAA,IAAK,EAAA;AACpE,UAAA,MAAM,MAAA,GAAc,GAAA,CAAI,YAAA,EAAsB,gBAAA,EAAkB,aAAA,IAAwC,EAAA;AACxG,UAAA,MAAM,OAAY,QAAA,IAAY,MAAA;AAE9B,UAAA,MAAM,CAAC,MAAA,EAAQ,KAAK,CAAA,GAAI,IAAA,CAAK,MAAM,GAAG,CAAA;AACtC,UAAA,IAAI,MAAA,EAAQ,WAAA,EAAY,KAAM,QAAA,IAAY,KAAA,EAAO;AAC/C,YAAA,IAAI;AACF,cAAA,GAAA,CAAI,YAAA,CAAa,SAAA,GAAY,MAAM,MAAA,CAAO,cAAc,KAAK,CAAA;AAAA,YAC/D,SAAS,GAAA,EAAK;AACZ,cAAA,IAAI,eAAe,eAAA,EAAiB;AAClC,gBAAA,GAAA,CAAI,aAAa,SAAA,GAAY,MAAA;AAAA,cAC/B;AAAA,YACF;AAAA,UACF;AAAA,QACF;AAAA,OACF;AAAA,IACF;AAAA,GACF;AACF;AAmBO,SAAS,YAAY,MAAA,EAAqB;AAC/C,EAAA,OAAO,SAAS,KAAA,CACd,EAAA,EACA,KAAA,EACA,UACA,MAAA,EAC6E;AAC7E,IAAA,MAAM,cAAA,GAAiB,MAAA,IAAU,YAAA,CAAa,EAAE,CAAA;AAChD,IAAA,iBAAA,CAAkB,EAAE,UAAA,EAAY,EAAA,EAAI,MAAA,EAAQ,cAAA,EAAgB,OAAO,CAAA;AAEnE,IAAA,OAAO,CAAC,MAAA,EAAQ,IAAA,EAAM,OAAA,EAAS,IAAA,KAAS;AACtC,MAAA,IAAI,UAAU,QAAA,EAAU,OAAO,SAAS,MAAA,EAAQ,IAAA,EAAM,SAAS,IAAI,CAAA;AACnE,MAAA,IAAI,CAAC,OAAA,CAAQ,SAAA,EAAW,MAAM,IAAI,MAAM,sCAAsC,CAAA;AAC9E,MAAA,IAAI,CAAC,MAAA,CAAO,eAAA,CAAgB,QAAQ,SAAA,EAAW,EAAA,EAAI,cAAc,CAAA,EAAG;AAClE,QAAA,MAAM,IAAI,MAAM,sCAAsC,CAAA;AAAA,MACxD;AACA,MAAA,OAAO,QAAA,CAAS,MAAA,EAAQ,IAAA,EAAM,OAAA,EAAS,IAAI,CAAA;AAAA,IAC7C,CAAA;AAAA,EACF,CAAA;AACF","file":"apollo.cjs","sourcesContent":["export class ArgosError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = this.constructor.name;\n  }\n}\n\nexport class ArgosAuthError    extends ArgosError {}\nexport class ArgosTokenError   extends ArgosError {}\nexport class ArgosForbiddenError extends ArgosError {}\nexport class ArgosSyncError    extends ArgosError {}\nexport class ArgosConfigError  extends ArgosError {}","import type { OperationDescriptor } from './models.js';\n\nconst _registry: OperationDescriptor[] = [];\n\n/** Infer operation method from the last segment of the operation id.\n *  e.g. \"tasks:list\" → \"read\", \"tasks:create\" → \"write\", \"tasks:delete\" → \"delete\"\n */\nexport function detectMethod(id: string): string {\n  const last = (id.split(':').pop() ?? '').toLowerCase();\n  if (/^(get|list|fetch|read)/.test(last))       return 'read';\n  if (/^(delete|remove|destroy)/.test(last))      return 'delete';\n  if (/(stream|subscribe|watch|listen)/.test(last)) return 'stream';\n  return 'write';\n}\n\n/** Register an operation in the global registry (used by startup to sync). */\nexport function registerOperation(op: OperationDescriptor): void {\n  const exists = _registry.some(\n    o => o.identifier === op.identifier && o.method === op.method,\n  );\n  if (!exists) _registry.push(op);\n}\n\nexport function getRegistry(): OperationDescriptor[] {\n  return [..._registry];\n}\n\nexport function clearRegistry(): void {\n  _registry.length = 0;\n}","import type { ApolloServerPlugin, BaseContext, GraphQLRequestContext } from '@apollo/server';\nimport { ArgosClient } from '../client.js';\nimport { ArgosTokenError } from '../exceptions.js';\nimport type { TokenClaims } from '../models.js';\nimport { detectMethod, registerOperation } from '../registry.js';\n\nexport interface ArgosContext extends BaseContext {\n  argosUser?: TokenClaims;\n}\n\n/**\n * Apollo Server plugin for argos.\n *\n * Validates the Bearer token on every request and stores the claims in\n * `context.argosUser`. Use `createGuard(client)` to enforce per-resolver\n * permissions.\n */\nexport function argosPlugin(client: ArgosClient): ApolloServerPlugin<ArgosContext> {\n  return {\n    async requestDidStart() {\n      return {\n        async didResolveOperation(ctx: GraphQLRequestContext<ArgosContext>) {\n          const httpAuth  = ctx.request.http?.headers.get('authorization') ?? '';\n          const wsAuth    = ((ctx.contextValue as any)?.connectionParams?.Authorization as string | undefined) ?? '';\n          const auth      = httpAuth || wsAuth;\n\n          const [scheme, token] = auth.split(' ');\n          if (scheme?.toLowerCase() === 'bearer' && token) {\n            try {\n              ctx.contextValue.argosUser = await client.validateToken(token);\n            } catch (err) {\n              if (err instanceof ArgosTokenError) {\n                ctx.contextValue.argosUser = undefined;\n              }\n            }\n          }\n        },\n      };\n    },\n  };\n}\n\n/**\n * Factory that returns a per-resolver guard bound to a `ArgosClient`.\n *\n * @example\n * ```ts\n * const guard = createGuard(client);\n *\n * const resolvers = {\n *   Query: {\n *     tasks: guard('tasks:list', 'private', async (_parent, _args, context) => {\n *       const user = context.argosUser;\n *       return db.tasks.findAll();\n *     }),\n *   },\n * };\n * ```\n */\nexport function createGuard(client: ArgosClient) {\n  return function guard<TParent, TArgs, TContext extends ArgosContext, TReturn>(\n    id: string,\n    level: string,\n    resolver: (parent: TParent, args: TArgs, context: TContext, info: unknown) => TReturn,\n    method?: string,\n  ): (parent: TParent, args: TArgs, context: TContext, info: unknown) => TReturn {\n    const resolvedMethod = method ?? detectMethod(id);\n    registerOperation({ identifier: id, method: resolvedMethod, level });\n\n    return (parent, args, context, info) => {\n      if (level === 'public') return resolver(parent, args, context, info);\n      if (!context.argosUser) throw new Error('Unauthorized: Bearer token required.');\n      if (!client.checkPermission(context.argosUser, id, resolvedMethod)) {\n        throw new Error('Forbidden: Insufficient permissions.');\n      }\n      return resolver(parent, args, context, info);\n    };\n  };\n}"]}
+{"version":3,"sources":["../../src/exceptions.ts","../../src/registry.ts","../../src/adapters/apollo.ts"],"names":[],"mappings":";;;AAAO,IAAM,YAAA,GAAN,cAA2B,KAAA,CAAM;AAAA,EACtC,YAAY,OAAA,EAAiB;AAC3B,IAAA,KAAA,CAAM,OAAO,CAAA;AACb,IAAA,IAAA,CAAK,IAAA,GAAO,KAAK,WAAA,CAAY,IAAA;AAAA,EAC/B;AACF,CAAA;AAGO,IAAM,iBAAA,GAAN,cAAkC,YAAA,CAAa;AAAC,CAAA;;;ACNvD,IAAM,YAAmC,EAAC;AAKnC,SAAS,aAAa,EAAA,EAAoB;AAC/C,EAAA,MAAM,IAAA,GAAA,CAAQ,GAAG,KAAA,CAAM,GAAG,EAAE,GAAA,EAAI,IAAK,IAAI,WAAA,EAAY;AACrD,EAAA,IAAI,wBAAA,CAAyB,IAAA,CAAK,IAAI,CAAA,EAAS,OAAO,MAAA;AACtD,EAAA,IAAI,0BAAA,CAA2B,IAAA,CAAK,IAAI,CAAA,EAAQ,OAAO,QAAA;AACvD,EAAA,IAAI,iCAAA,CAAkC,IAAA,CAAK,IAAI,CAAA,EAAG,OAAO,QAAA;AACzD,EAAA,OAAO,OAAA;AACT;AAGO,SAAS,kBAAkB,EAAA,EAA+B;AAC/D,EAAA,MAAM,SAAS,SAAA,CAAU,IAAA;AAAA,IACvB,OAAK,CAAA,CAAE,UAAA,KAAe,GAAG,UAAA,IAAc,CAAA,CAAE,WAAW,EAAA,CAAG;AAAA,GACzD;AACA,EAAA,IAAI,CAAC,MAAA,EAAQ,SAAA,CAAU,IAAA,CAAK,EAAE,CAAA;AAChC;;;ACJO,SAAS,cAAc,MAAA,EAA2D;AACvF,EAAA,OAAO;AAAA,IACL,MAAM,eAAA,GAAkB;AACtB,MAAA,OAAO;AAAA,QACL,MAAM,oBAAoB,GAAA,EAA4C;AACpE,UAAA,MAAM,WAAY,GAAA,CAAI,OAAA,CAAQ,MAAM,OAAA,CAAQ,GAAA,CAAI,eAAe,CAAA,IAAK,EAAA;AACpE,UAAA,MAAM,MAAA,GAAc,GAAA,CAAI,YAAA,EAAsB,gBAAA,EAAkB,aAAA,IAAwC,EAAA;AACxG,UAAA,MAAM,OAAY,QAAA,IAAY,MAAA;AAE9B,UAAA,MAAM,CAAC,MAAA,EAAQ,KAAK,CAAA,GAAI,IAAA,CAAK,MAAM,GAAG,CAAA;AACtC,UAAA,IAAI,MAAA,EAAQ,WAAA,EAAY,KAAM,QAAA,IAAY,KAAA,EAAO;AAC/C,YAAA,IAAI;AACF,cAAA,GAAA,CAAI,YAAA,CAAa,WAAA,GAAc,MAAM,MAAA,CAAO,cAAc,KAAK,CAAA;AAAA,YACjE,SAAS,GAAA,EAAK;AACZ,cAAA,IAAI,eAAe,iBAAA,EAAmB;AACpC,gBAAA,GAAA,CAAI,aAAa,WAAA,GAAc,MAAA;AAAA,cACjC;AAAA,YACF;AAAA,UACF;AAAA,QACF;AAAA,OACF;AAAA,IACF;AAAA,GACF;AACF;AAmBO,SAAS,YAAY,MAAA,EAAuB;AACjD,EAAA,OAAO,SAAS,KAAA,CACd,EAAA,EACA,KAAA,EACA,UACA,MAAA,EAC6E;AAC7E,IAAA,MAAM,cAAA,GAAiB,MAAA,IAAU,YAAA,CAAa,EAAE,CAAA;AAChD,IAAA,iBAAA,CAAkB,EAAE,UAAA,EAAY,EAAA,EAAI,MAAA,EAAQ,cAAA,EAAgB,OAAO,CAAA;AAEnE,IAAA,OAAO,CAAC,MAAA,EAAQ,IAAA,EAAM,OAAA,EAAS,IAAA,KAAS;AACtC,MAAA,IAAI,UAAU,QAAA,EAAU,OAAO,SAAS,MAAA,EAAQ,IAAA,EAAM,SAAS,IAAI,CAAA;AACnE,MAAA,IAAI,CAAC,OAAA,CAAQ,WAAA,EAAa,MAAM,IAAI,MAAM,sCAAsC,CAAA;AAChF,MAAA,IAAI,CAAC,MAAA,CAAO,eAAA,CAAgB,QAAQ,WAAA,EAAa,EAAA,EAAI,cAAc,CAAA,EAAG;AACpE,QAAA,MAAM,IAAI,MAAM,sCAAsC,CAAA;AAAA,MACxD;AACA,MAAA,OAAO,QAAA,CAAS,MAAA,EAAQ,IAAA,EAAM,OAAA,EAAS,IAAI,CAAA;AAAA,IAC7C,CAAA;AAAA,EACF,CAAA;AACF","file":"apollo.cjs","sourcesContent":["export class CaronteError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = this.constructor.name;\n  }\n}\n\nexport class CaronteAuthError    extends CaronteError {}\nexport class CaronteTokenError   extends CaronteError {}\nexport class CaronteForbiddenError extends CaronteError {}\nexport class CaronteSyncError    extends CaronteError {}\nexport class CaronteConfigError  extends CaronteError {}","import type { OperationDescriptor } from './models.js';\n\nconst _registry: OperationDescriptor[] = [];\n\n/** Infer operation method from the last segment of the operation id.\n *  e.g. \"tasks:list\" → \"read\", \"tasks:create\" → \"write\", \"tasks:delete\" → \"delete\"\n */\nexport function detectMethod(id: string): string {\n  const last = (id.split(':').pop() ?? '').toLowerCase();\n  if (/^(get|list|fetch|read)/.test(last))       return 'read';\n  if (/^(delete|remove|destroy)/.test(last))      return 'delete';\n  if (/(stream|subscribe|watch|listen)/.test(last)) return 'stream';\n  return 'write';\n}\n\n/** Register an operation in the global registry (used by startup to sync). */\nexport function registerOperation(op: OperationDescriptor): void {\n  const exists = _registry.some(\n    o => o.identifier === op.identifier && o.method === op.method,\n  );\n  if (!exists) _registry.push(op);\n}\n\nexport function getRegistry(): OperationDescriptor[] {\n  return [..._registry];\n}\n\nexport function clearRegistry(): void {\n  _registry.length = 0;\n}","import type { ApolloServerPlugin, BaseContext, GraphQLRequestContext } from '@apollo/server';\nimport { CaronteClient } from '../client.js';\nimport { CaronteTokenError } from '../exceptions.js';\nimport type { TokenClaims } from '../models.js';\nimport { detectMethod, registerOperation } from '../registry.js';\n\nexport interface CaronteContext extends BaseContext {\n  caronteUser?: TokenClaims;\n}\n\n/**\n * Apollo Server plugin for caronte.\n *\n * Validates the Bearer token on every request and stores the claims in\n * `context.caronteUser`. Use `createGuard(client)` to enforce per-resolver\n * permissions.\n */\nexport function carontePlugin(client: CaronteClient): ApolloServerPlugin<CaronteContext> {\n  return {\n    async requestDidStart() {\n      return {\n        async didResolveOperation(ctx: GraphQLRequestContext<CaronteContext>) {\n          const httpAuth  = ctx.request.http?.headers.get('authorization') ?? '';\n          const wsAuth    = ((ctx.contextValue as any)?.connectionParams?.Authorization as string | undefined) ?? '';\n          const auth      = httpAuth || wsAuth;\n\n          const [scheme, token] = auth.split(' ');\n          if (scheme?.toLowerCase() === 'bearer' && token) {\n            try {\n              ctx.contextValue.caronteUser = await client.validateToken(token);\n            } catch (err) {\n              if (err instanceof CaronteTokenError) {\n                ctx.contextValue.caronteUser = undefined;\n              }\n            }\n          }\n        },\n      };\n    },\n  };\n}\n\n/**\n * Factory that returns a per-resolver guard bound to a `CaronteClient`.\n *\n * @example\n * ```ts\n * const guard = createGuard(client);\n *\n * const resolvers = {\n *   Query: {\n *     tasks: guard('tasks:list', 'private', async (_parent, _args, context) => {\n *       const user = context.caronteUser;\n *       return db.tasks.findAll();\n *     }),\n *   },\n * };\n * ```\n */\nexport function createGuard(client: CaronteClient) {\n  return function guard<TParent, TArgs, TContext extends CaronteContext, TReturn>(\n    id: string,\n    level: string,\n    resolver: (parent: TParent, args: TArgs, context: TContext, info: unknown) => TReturn,\n    method?: string,\n  ): (parent: TParent, args: TArgs, context: TContext, info: unknown) => TReturn {\n    const resolvedMethod = method ?? detectMethod(id);\n    registerOperation({ identifier: id, method: resolvedMethod, level });\n\n    return (parent, args, context, info) => {\n      if (level === 'public') return resolver(parent, args, context, info);\n      if (!context.caronteUser) throw new Error('Unauthorized: Bearer token required.');\n      if (!client.checkPermission(context.caronteUser, id, resolvedMethod)) {\n        throw new Error('Forbidden: Insufficient permissions.');\n      }\n      return resolver(parent, args, context, info);\n    };\n  };\n}"]}

package/dist/adapters/apollo.d.cts

@@ -1,19 +1,19 @@
 import { BaseContext, ApolloServerPlugin } from '@apollo/server';
-import { T as TokenClaims, A as ArgosClient } from '../client-Cgm1csuM.cjs';
+import { T as TokenClaims, C as CaronteClient } from '../client-TcOSwgrn.cjs';
 
-interface ArgosContext extends BaseContext {
-    argosUser?: TokenClaims;
+interface CaronteContext extends BaseContext {
+    caronteUser?: TokenClaims;
 }
 /**
- * Apollo Server plugin for argos.
+ * Apollo Server plugin for caronte.
  *
  * Validates the Bearer token on every request and stores the claims in
- * `context.argosUser`. Use `createGuard(client)` to enforce per-resolver
+ * `context.caronteUser`. Use `createGuard(client)` to enforce per-resolver
  * permissions.
  */
-declare function argosPlugin(client: ArgosClient): ApolloServerPlugin<ArgosContext>;
+declare function carontePlugin(client: CaronteClient): ApolloServerPlugin<CaronteContext>;
 /**
- * Factory that returns a per-resolver guard bound to a `ArgosClient`.
+ * Factory that returns a per-resolver guard bound to a `CaronteClient`.
  *
  * @example
  * ```ts
@@ -22,13 +22,13 @@ declare function argosPlugin(client: ArgosClient): ApolloServerPlugin<ArgosConte
  * const resolvers = {
  *   Query: {
  *     tasks: guard('tasks:list', 'private', async (_parent, _args, context) => {
- *       const user = context.argosUser;
+ *       const user = context.caronteUser;
  *       return db.tasks.findAll();
  *     }),
  *   },
  * };
  * ```
  */
-declare function createGuard(client: ArgosClient): <TParent, TArgs, TContext extends ArgosContext, TReturn>(id: string, level: string, resolver: (parent: TParent, args: TArgs, context: TContext, info: unknown) => TReturn, method?: string) => (parent: TParent, args: TArgs, context: TContext, info: unknown) => TReturn;
+declare function createGuard(client: CaronteClient): <TParent, TArgs, TContext extends CaronteContext, TReturn>(id: string, level: string, resolver: (parent: TParent, args: TArgs, context: TContext, info: unknown) => TReturn, method?: string) => (parent: TParent, args: TArgs, context: TContext, info: unknown) => TReturn;
 
-export { type ArgosContext, argosPlugin, createGuard };
+export { type CaronteContext, carontePlugin, createGuard };

package/dist/adapters/apollo.d.ts

@@ -1,19 +1,19 @@
 import { BaseContext, ApolloServerPlugin } from '@apollo/server';
-import { T as TokenClaims, A as ArgosClient } from '../client-Cgm1csuM.js';
+import { T as TokenClaims, C as CaronteClient } from '../client-TcOSwgrn.js';
 
-interface ArgosContext extends BaseContext {
-    argosUser?: TokenClaims;
+interface CaronteContext extends BaseContext {
+    caronteUser?: TokenClaims;
 }
 /**
- * Apollo Server plugin for argos.
+ * Apollo Server plugin for caronte.
  *
  * Validates the Bearer token on every request and stores the claims in
- * `context.argosUser`. Use `createGuard(client)` to enforce per-resolver
+ * `context.caronteUser`. Use `createGuard(client)` to enforce per-resolver
  * permissions.
  */
-declare function argosPlugin(client: ArgosClient): ApolloServerPlugin<ArgosContext>;
+declare function carontePlugin(client: CaronteClient): ApolloServerPlugin<CaronteContext>;
 /**
- * Factory that returns a per-resolver guard bound to a `ArgosClient`.
+ * Factory that returns a per-resolver guard bound to a `CaronteClient`.
  *
  * @example
  * ```ts
@@ -22,13 +22,13 @@ declare function argosPlugin(client: ArgosClient): ApolloServerPlugin<ArgosConte
  * const resolvers = {
  *   Query: {
  *     tasks: guard('tasks:list', 'private', async (_parent, _args, context) => {
- *       const user = context.argosUser;
+ *       const user = context.caronteUser;
  *       return db.tasks.findAll();
  *     }),
  *   },
  * };
  * ```
  */
-declare function createGuard(client: ArgosClient): <TParent, TArgs, TContext extends ArgosContext, TReturn>(id: string, level: string, resolver: (parent: TParent, args: TArgs, context: TContext, info: unknown) => TReturn, method?: string) => (parent: TParent, args: TArgs, context: TContext, info: unknown) => TReturn;
+declare function createGuard(client: CaronteClient): <TParent, TArgs, TContext extends CaronteContext, TReturn>(id: string, level: string, resolver: (parent: TParent, args: TArgs, context: TContext, info: unknown) => TReturn, method?: string) => (parent: TParent, args: TArgs, context: TContext, info: unknown) => TReturn;
 
-export { type ArgosContext, argosPlugin, createGuard };
+export { type CaronteContext, carontePlugin, createGuard };

package/dist/adapters/apollo.js

@@ -1,8 +1,8 @@
-import { ArgosTokenError } from '../chunk-AKUM2UEO.js';
+import { CaronteTokenError } from '../chunk-VEDVQOBD.js';
 import { detectMethod, registerOperation } from '../chunk-HV6X5RJY.js';
 
 // src/adapters/apollo.ts
-function argosPlugin(client) {
+function carontePlugin(client) {
   return {
     async requestDidStart() {
       return {
@@ -13,10 +13,10 @@ function argosPlugin(client) {
           const [scheme, token] = auth.split(" ");
           if (scheme?.toLowerCase() === "bearer" && token) {
             try {
-              ctx.contextValue.argosUser = await client.validateToken(token);
+              ctx.contextValue.caronteUser = await client.validateToken(token);
             } catch (err) {
-              if (err instanceof ArgosTokenError) {
-                ctx.contextValue.argosUser = void 0;
+              if (err instanceof CaronteTokenError) {
+                ctx.contextValue.caronteUser = void 0;
               }
             }
           }
@@ -31,8 +31,8 @@ function createGuard(client) {
     registerOperation({ identifier: id, method: resolvedMethod, level });
     return (parent, args, context, info) => {
       if (level === "public") return resolver(parent, args, context, info);
-      if (!context.argosUser) throw new Error("Unauthorized: Bearer token required.");
-      if (!client.checkPermission(context.argosUser, id, resolvedMethod)) {
+      if (!context.caronteUser) throw new Error("Unauthorized: Bearer token required.");
+      if (!client.checkPermission(context.caronteUser, id, resolvedMethod)) {
         throw new Error("Forbidden: Insufficient permissions.");
       }
       return resolver(parent, args, context, info);
@@ -40,6 +40,6 @@ function createGuard(client) {
   };
 }
 
-export { argosPlugin, createGuard };
+export { carontePlugin, createGuard };
 //# sourceMappingURL=apollo.js.map
 //# sourceMappingURL=apollo.js.map

package/dist/adapters/apollo.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/adapters/apollo.ts"],"names":[],"mappings":";;;;AAiBO,SAAS,YAAY,MAAA,EAAuD;AACjF,EAAA,OAAO;AAAA,IACL,MAAM,eAAA,GAAkB;AACtB,MAAA,OAAO;AAAA,QACL,MAAM,oBAAoB,GAAA,EAA0C;AAClE,UAAA,MAAM,WAAY,GAAA,CAAI,OAAA,CAAQ,MAAM,OAAA,CAAQ,GAAA,CAAI,eAAe,CAAA,IAAK,EAAA;AACpE,UAAA,MAAM,MAAA,GAAc,GAAA,CAAI,YAAA,EAAsB,gBAAA,EAAkB,aAAA,IAAwC,EAAA;AACxG,UAAA,MAAM,OAAY,QAAA,IAAY,MAAA;AAE9B,UAAA,MAAM,CAAC,MAAA,EAAQ,KAAK,CAAA,GAAI,IAAA,CAAK,MAAM,GAAG,CAAA;AACtC,UAAA,IAAI,MAAA,EAAQ,WAAA,EAAY,KAAM,QAAA,IAAY,KAAA,EAAO;AAC/C,YAAA,IAAI;AACF,cAAA,GAAA,CAAI,YAAA,CAAa,SAAA,GAAY,MAAM,MAAA,CAAO,cAAc,KAAK,CAAA;AAAA,YAC/D,SAAS,GAAA,EAAK;AACZ,cAAA,IAAI,eAAe,eAAA,EAAiB;AAClC,gBAAA,GAAA,CAAI,aAAa,SAAA,GAAY,MAAA;AAAA,cAC/B;AAAA,YACF;AAAA,UACF;AAAA,QACF;AAAA,OACF;AAAA,IACF;AAAA,GACF;AACF;AAmBO,SAAS,YAAY,MAAA,EAAqB;AAC/C,EAAA,OAAO,SAAS,KAAA,CACd,EAAA,EACA,KAAA,EACA,UACA,MAAA,EAC6E;AAC7E,IAAA,MAAM,cAAA,GAAiB,MAAA,IAAU,YAAA,CAAa,EAAE,CAAA;AAChD,IAAA,iBAAA,CAAkB,EAAE,UAAA,EAAY,EAAA,EAAI,MAAA,EAAQ,cAAA,EAAgB,OAAO,CAAA;AAEnE,IAAA,OAAO,CAAC,MAAA,EAAQ,IAAA,EAAM,OAAA,EAAS,IAAA,KAAS;AACtC,MAAA,IAAI,UAAU,QAAA,EAAU,OAAO,SAAS,MAAA,EAAQ,IAAA,EAAM,SAAS,IAAI,CAAA;AACnE,MAAA,IAAI,CAAC,OAAA,CAAQ,SAAA,EAAW,MAAM,IAAI,MAAM,sCAAsC,CAAA;AAC9E,MAAA,IAAI,CAAC,MAAA,CAAO,eAAA,CAAgB,QAAQ,SAAA,EAAW,EAAA,EAAI,cAAc,CAAA,EAAG;AAClE,QAAA,MAAM,IAAI,MAAM,sCAAsC,CAAA;AAAA,MACxD;AACA,MAAA,OAAO,QAAA,CAAS,MAAA,EAAQ,IAAA,EAAM,OAAA,EAAS,IAAI,CAAA;AAAA,IAC7C,CAAA;AAAA,EACF,CAAA;AACF","file":"apollo.js","sourcesContent":["import type { ApolloServerPlugin, BaseContext, GraphQLRequestContext } from '@apollo/server';\nimport { ArgosClient } from '../client.js';\nimport { ArgosTokenError } from '../exceptions.js';\nimport type { TokenClaims } from '../models.js';\nimport { detectMethod, registerOperation } from '../registry.js';\n\nexport interface ArgosContext extends BaseContext {\n  argosUser?: TokenClaims;\n}\n\n/**\n * Apollo Server plugin for argos.\n *\n * Validates the Bearer token on every request and stores the claims in\n * `context.argosUser`. Use `createGuard(client)` to enforce per-resolver\n * permissions.\n */\nexport function argosPlugin(client: ArgosClient): ApolloServerPlugin<ArgosContext> {\n  return {\n    async requestDidStart() {\n      return {\n        async didResolveOperation(ctx: GraphQLRequestContext<ArgosContext>) {\n          const httpAuth  = ctx.request.http?.headers.get('authorization') ?? '';\n          const wsAuth    = ((ctx.contextValue as any)?.connectionParams?.Authorization as string | undefined) ?? '';\n          const auth      = httpAuth || wsAuth;\n\n          const [scheme, token] = auth.split(' ');\n          if (scheme?.toLowerCase() === 'bearer' && token) {\n            try {\n              ctx.contextValue.argosUser = await client.validateToken(token);\n            } catch (err) {\n              if (err instanceof ArgosTokenError) {\n                ctx.contextValue.argosUser = undefined;\n              }\n            }\n          }\n        },\n      };\n    },\n  };\n}\n\n/**\n * Factory that returns a per-resolver guard bound to a `ArgosClient`.\n *\n * @example\n * ```ts\n * const guard = createGuard(client);\n *\n * const resolvers = {\n *   Query: {\n *     tasks: guard('tasks:list', 'private', async (_parent, _args, context) => {\n *       const user = context.argosUser;\n *       return db.tasks.findAll();\n *     }),\n *   },\n * };\n * ```\n */\nexport function createGuard(client: ArgosClient) {\n  return function guard<TParent, TArgs, TContext extends ArgosContext, TReturn>(\n    id: string,\n    level: string,\n    resolver: (parent: TParent, args: TArgs, context: TContext, info: unknown) => TReturn,\n    method?: string,\n  ): (parent: TParent, args: TArgs, context: TContext, info: unknown) => TReturn {\n    const resolvedMethod = method ?? detectMethod(id);\n    registerOperation({ identifier: id, method: resolvedMethod, level });\n\n    return (parent, args, context, info) => {\n      if (level === 'public') return resolver(parent, args, context, info);\n      if (!context.argosUser) throw new Error('Unauthorized: Bearer token required.');\n      if (!client.checkPermission(context.argosUser, id, resolvedMethod)) {\n        throw new Error('Forbidden: Insufficient permissions.');\n      }\n      return resolver(parent, args, context, info);\n    };\n  };\n}"]}
+{"version":3,"sources":["../../src/adapters/apollo.ts"],"names":[],"mappings":";;;;AAiBO,SAAS,cAAc,MAAA,EAA2D;AACvF,EAAA,OAAO;AAAA,IACL,MAAM,eAAA,GAAkB;AACtB,MAAA,OAAO;AAAA,QACL,MAAM,oBAAoB,GAAA,EAA4C;AACpE,UAAA,MAAM,WAAY,GAAA,CAAI,OAAA,CAAQ,MAAM,OAAA,CAAQ,GAAA,CAAI,eAAe,CAAA,IAAK,EAAA;AACpE,UAAA,MAAM,MAAA,GAAc,GAAA,CAAI,YAAA,EAAsB,gBAAA,EAAkB,aAAA,IAAwC,EAAA;AACxG,UAAA,MAAM,OAAY,QAAA,IAAY,MAAA;AAE9B,UAAA,MAAM,CAAC,MAAA,EAAQ,KAAK,CAAA,GAAI,IAAA,CAAK,MAAM,GAAG,CAAA;AACtC,UAAA,IAAI,MAAA,EAAQ,WAAA,EAAY,KAAM,QAAA,IAAY,KAAA,EAAO;AAC/C,YAAA,IAAI;AACF,cAAA,GAAA,CAAI,YAAA,CAAa,WAAA,GAAc,MAAM,MAAA,CAAO,cAAc,KAAK,CAAA;AAAA,YACjE,SAAS,GAAA,EAAK;AACZ,cAAA,IAAI,eAAe,iBAAA,EAAmB;AACpC,gBAAA,GAAA,CAAI,aAAa,WAAA,GAAc,MAAA;AAAA,cACjC;AAAA,YACF;AAAA,UACF;AAAA,QACF;AAAA,OACF;AAAA,IACF;AAAA,GACF;AACF;AAmBO,SAAS,YAAY,MAAA,EAAuB;AACjD,EAAA,OAAO,SAAS,KAAA,CACd,EAAA,EACA,KAAA,EACA,UACA,MAAA,EAC6E;AAC7E,IAAA,MAAM,cAAA,GAAiB,MAAA,IAAU,YAAA,CAAa,EAAE,CAAA;AAChD,IAAA,iBAAA,CAAkB,EAAE,UAAA,EAAY,EAAA,EAAI,MAAA,EAAQ,cAAA,EAAgB,OAAO,CAAA;AAEnE,IAAA,OAAO,CAAC,MAAA,EAAQ,IAAA,EAAM,OAAA,EAAS,IAAA,KAAS;AACtC,MAAA,IAAI,UAAU,QAAA,EAAU,OAAO,SAAS,MAAA,EAAQ,IAAA,EAAM,SAAS,IAAI,CAAA;AACnE,MAAA,IAAI,CAAC,OAAA,CAAQ,WAAA,EAAa,MAAM,IAAI,MAAM,sCAAsC,CAAA;AAChF,MAAA,IAAI,CAAC,MAAA,CAAO,eAAA,CAAgB,QAAQ,WAAA,EAAa,EAAA,EAAI,cAAc,CAAA,EAAG;AACpE,QAAA,MAAM,IAAI,MAAM,sCAAsC,CAAA;AAAA,MACxD;AACA,MAAA,OAAO,QAAA,CAAS,MAAA,EAAQ,IAAA,EAAM,OAAA,EAAS,IAAI,CAAA;AAAA,IAC7C,CAAA;AAAA,EACF,CAAA;AACF","file":"apollo.js","sourcesContent":["import type { ApolloServerPlugin, BaseContext, GraphQLRequestContext } from '@apollo/server';\nimport { CaronteClient } from '../client.js';\nimport { CaronteTokenError } from '../exceptions.js';\nimport type { TokenClaims } from '../models.js';\nimport { detectMethod, registerOperation } from '../registry.js';\n\nexport interface CaronteContext extends BaseContext {\n  caronteUser?: TokenClaims;\n}\n\n/**\n * Apollo Server plugin for caronte.\n *\n * Validates the Bearer token on every request and stores the claims in\n * `context.caronteUser`. Use `createGuard(client)` to enforce per-resolver\n * permissions.\n */\nexport function carontePlugin(client: CaronteClient): ApolloServerPlugin<CaronteContext> {\n  return {\n    async requestDidStart() {\n      return {\n        async didResolveOperation(ctx: GraphQLRequestContext<CaronteContext>) {\n          const httpAuth  = ctx.request.http?.headers.get('authorization') ?? '';\n          const wsAuth    = ((ctx.contextValue as any)?.connectionParams?.Authorization as string | undefined) ?? '';\n          const auth      = httpAuth || wsAuth;\n\n          const [scheme, token] = auth.split(' ');\n          if (scheme?.toLowerCase() === 'bearer' && token) {\n            try {\n              ctx.contextValue.caronteUser = await client.validateToken(token);\n            } catch (err) {\n              if (err instanceof CaronteTokenError) {\n                ctx.contextValue.caronteUser = undefined;\n              }\n            }\n          }\n        },\n      };\n    },\n  };\n}\n\n/**\n * Factory that returns a per-resolver guard bound to a `CaronteClient`.\n *\n * @example\n * ```ts\n * const guard = createGuard(client);\n *\n * const resolvers = {\n *   Query: {\n *     tasks: guard('tasks:list', 'private', async (_parent, _args, context) => {\n *       const user = context.caronteUser;\n *       return db.tasks.findAll();\n *     }),\n *   },\n * };\n * ```\n */\nexport function createGuard(client: CaronteClient) {\n  return function guard<TParent, TArgs, TContext extends CaronteContext, TReturn>(\n    id: string,\n    level: string,\n    resolver: (parent: TParent, args: TArgs, context: TContext, info: unknown) => TReturn,\n    method?: string,\n  ): (parent: TParent, args: TArgs, context: TContext, info: unknown) => TReturn {\n    const resolvedMethod = method ?? detectMethod(id);\n    registerOperation({ identifier: id, method: resolvedMethod, level });\n\n    return (parent, args, context, info) => {\n      if (level === 'public') return resolver(parent, args, context, info);\n      if (!context.caronteUser) throw new Error('Unauthorized: Bearer token required.');\n      if (!client.checkPermission(context.caronteUser, id, resolvedMethod)) {\n        throw new Error('Forbidden: Insufficient permissions.');\n      }\n      return resolver(parent, args, context, info);\n    };\n  };\n}"]}

package/dist/adapters/express.cjs

@@ -17,13 +17,13 @@ function registerOperation(op) {
 }
 
 // src/adapters/express.ts
-function argos(client) {
+function caronte(client) {
   const middleware = async (req, _res, next) => {
     const auth = req.headers.authorization ?? "";
     const [scheme, token] = auth.split(" ");
     if (scheme?.toLowerCase() === "bearer" && token) {
       try {
-        req.argosUser = await client.validateToken(token);
+        req.caronteUser = await client.validateToken(token);
       } catch {
       }
     }
@@ -37,11 +37,11 @@ function argos(client) {
         next();
         return;
       }
-      if (!req.argosUser) {
+      if (!req.caronteUser) {
         res.status(401).json({ error: "unauthorized", detail: "Bearer token required." });
         return;
       }
-      const allowed = client.checkPermission(req.argosUser, id, resolvedMethod);
+      const allowed = client.checkPermission(req.caronteUser, id, resolvedMethod);
       if (!allowed) {
         res.status(403).json({ error: "forbidden", detail: "Insufficient permissions." });
         return;
@@ -52,6 +52,6 @@ function argos(client) {
   return { middleware, guard };
 }
 
-exports.argos = argos;
+exports.caronte = caronte;
 //# sourceMappingURL=express.cjs.map
 //# sourceMappingURL=express.cjs.map

package/dist/adapters/express.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/registry.ts","../../src/adapters/express.ts"],"names":[],"mappings":";;;AAEA,IAAM,YAAmC,EAAC;AAKnC,SAAS,aAAa,EAAA,EAAoB;AAC/C,EAAA,MAAM,IAAA,GAAA,CAAQ,GAAG,KAAA,CAAM,GAAG,EAAE,GAAA,EAAI,IAAK,IAAI,WAAA,EAAY;AACrD,EAAA,IAAI,wBAAA,CAAyB,IAAA,CAAK,IAAI,CAAA,EAAS,OAAO,MAAA;AACtD,EAAA,IAAI,0BAAA,CAA2B,IAAA,CAAK,IAAI,CAAA,EAAQ,OAAO,QAAA;AACvD,EAAA,IAAI,iCAAA,CAAkC,IAAA,CAAK,IAAI,CAAA,EAAG,OAAO,QAAA;AACzD,EAAA,OAAO,OAAA;AACT;AAGO,SAAS,kBAAkB,EAAA,EAA+B;AAC/D,EAAA,MAAM,SAAS,SAAA,CAAU,IAAA;AAAA,IACvB,OAAK,CAAA,CAAE,UAAA,KAAe,GAAG,UAAA,IAAc,CAAA,CAAE,WAAW,EAAA,CAAG;AAAA,GACzD;AACA,EAAA,IAAI,CAAC,MAAA,EAAQ,SAAA,CAAU,IAAA,CAAK,EAAE,CAAA;AAChC;;;ACCO,SAAS,MAAM,MAAA,EAAsC;AAE1D,EAAA,MAAM,UAAA,GAAa,OAAO,GAAA,EAAc,IAAA,EAAgB,IAAA,KAAsC;AAC5F,IAAA,MAAM,IAAA,GAAO,GAAA,CAAI,OAAA,CAAQ,aAAA,IAAiB,EAAA;AAC1C,IAAA,MAAM,CAAC,MAAA,EAAQ,KAAK,CAAA,GAAI,IAAA,CAAK,MAAM,GAAG,CAAA;AACtC,IAAA,IAAI,MAAA,EAAQ,WAAA,EAAY,KAAM,QAAA,IAAY,KAAA,EAAO;AAC/C,MAAA,IAAI;AACF,QAAA,GAAA,CAAI,SAAA,GAAY,MAAM,MAAA,CAAO,aAAA,CAAc,KAAK,CAAA;AAAA,MAClD,CAAA,CAAA,MAAQ;AAAA,MAER;AAAA,IACF;AACA,IAAA,IAAA,EAAK;AAAA,EACP,CAAA;AAEA,EAAA,MAAM,KAAA,GAAQ,CAAC,EAAA,EAAY,KAAA,EAAe,MAAA,KAAoB;AAC5D,IAAA,MAAM,cAAA,GAAiB,MAAA,IAAU,YAAA,CAAa,EAAE,CAAA;AAChD,IAAA,iBAAA,CAAkB,EAAE,UAAA,EAAY,EAAA,EAAI,MAAA,EAAQ,cAAA,EAAgB,OAAO,CAAA;AAEnE,IAAA,OAAO,CAAC,GAAA,EAAc,GAAA,EAAe,IAAA,KAA6B;AAChE,MAAA,IAAI,UAAU,QAAA,EAAU;AAAE,QAAA,IAAA,EAAK;AAAG,QAAA;AAAA,MAAQ;AAE1C,MAAA,IAAI,CAAC,IAAI,SAAA,EAAW;AAClB,QAAA,GAAA,CAAI,MAAA,CAAO,GAAG,CAAA,CAAE,IAAA,CAAK,EAAE,KAAA,EAAO,cAAA,EAAgB,MAAA,EAAQ,wBAAA,EAA0B,CAAA;AAChF,QAAA;AAAA,MACF;AAEA,MAAA,MAAM,UAAU,MAAA,CAAO,eAAA,CAAgB,GAAA,CAAI,SAAA,EAAW,IAAI,cAAc,CAAA;AACxE,MAAA,IAAI,CAAC,OAAA,EAAS;AACZ,QAAA,GAAA,CAAI,MAAA,CAAO,GAAG,CAAA,CAAE,IAAA,CAAK,EAAE,KAAA,EAAO,WAAA,EAAa,MAAA,EAAQ,2BAAA,EAA6B,CAAA;AAChF,QAAA;AAAA,MACF;AAEA,MAAA,IAAA,EAAK;AAAA,IACP,CAAA;AAAA,EACF,CAAA;AAEA,EAAA,OAAO,EAAE,YAAY,KAAA,EAAM;AAC7B","file":"express.cjs","sourcesContent":["import type { OperationDescriptor } from './models.js';\n\nconst _registry: OperationDescriptor[] = [];\n\n/** Infer operation method from the last segment of the operation id.\n *  e.g. \"tasks:list\" → \"read\", \"tasks:create\" → \"write\", \"tasks:delete\" → \"delete\"\n */\nexport function detectMethod(id: string): string {\n  const last = (id.split(':').pop() ?? '').toLowerCase();\n  if (/^(get|list|fetch|read)/.test(last))       return 'read';\n  if (/^(delete|remove|destroy)/.test(last))      return 'delete';\n  if (/(stream|subscribe|watch|listen)/.test(last)) return 'stream';\n  return 'write';\n}\n\n/** Register an operation in the global registry (used by startup to sync). */\nexport function registerOperation(op: OperationDescriptor): void {\n  const exists = _registry.some(\n    o => o.identifier === op.identifier && o.method === op.method,\n  );\n  if (!exists) _registry.push(op);\n}\n\nexport function getRegistry(): OperationDescriptor[] {\n  return [..._registry];\n}\n\nexport function clearRegistry(): void {\n  _registry.length = 0;\n}","import type { NextFunction, Request, Response } from 'express';\nimport { ArgosClient } from '../client.js';\nimport { ArgosTokenError } from '../exceptions.js';\nimport type { TokenClaims } from '../models.js';\nimport { detectMethod, registerOperation } from '../registry.js';\n\ndeclare global {\n  namespace Express {\n    interface Request {\n      argosUser?: TokenClaims;\n    }\n  }\n}\n\nexport interface ArgosMiddleware {\n  /** Global middleware — validates the Bearer token and injects `req.argosUser`. */\n  middleware: (req: Request, res: Response, next: NextFunction) => Promise<void>;\n  /** Per-route guard — registers the operation and enforces permission at request time. */\n  guard: (id: string, level: string, method?: string) =>\n    (req: Request, res: Response, next: NextFunction) => void;\n}\n\nexport function argos(client: ArgosClient): ArgosMiddleware {\n\n  const middleware = async (req: Request, _res: Response, next: NextFunction): Promise<void> => {\n    const auth = req.headers.authorization ?? '';\n    const [scheme, token] = auth.split(' ');\n    if (scheme?.toLowerCase() === 'bearer' && token) {\n      try {\n        req.argosUser = await client.validateToken(token);\n      } catch {\n        // invalid token — argosUser stays undefined; guard handles the 401\n      }\n    }\n    next();\n  };\n\n  const guard = (id: string, level: string, method?: string) => {\n    const resolvedMethod = method ?? detectMethod(id);\n    registerOperation({ identifier: id, method: resolvedMethod, level });\n\n    return (req: Request, res: Response, next: NextFunction): void => {\n      if (level === 'public') { next(); return; }\n\n      if (!req.argosUser) {\n        res.status(401).json({ error: 'unauthorized', detail: 'Bearer token required.' });\n        return;\n      }\n\n      const allowed = client.checkPermission(req.argosUser, id, resolvedMethod);\n      if (!allowed) {\n        res.status(403).json({ error: 'forbidden', detail: 'Insufficient permissions.' });\n        return;\n      }\n\n      next();\n    };\n  };\n\n  return { middleware, guard };\n}"]}
+{"version":3,"sources":["../../src/registry.ts","../../src/adapters/express.ts"],"names":[],"mappings":";;;AAEA,IAAM,YAAmC,EAAC;AAKnC,SAAS,aAAa,EAAA,EAAoB;AAC/C,EAAA,MAAM,IAAA,GAAA,CAAQ,GAAG,KAAA,CAAM,GAAG,EAAE,GAAA,EAAI,IAAK,IAAI,WAAA,EAAY;AACrD,EAAA,IAAI,wBAAA,CAAyB,IAAA,CAAK,IAAI,CAAA,EAAS,OAAO,MAAA;AACtD,EAAA,IAAI,0BAAA,CAA2B,IAAA,CAAK,IAAI,CAAA,EAAQ,OAAO,QAAA;AACvD,EAAA,IAAI,iCAAA,CAAkC,IAAA,CAAK,IAAI,CAAA,EAAG,OAAO,QAAA;AACzD,EAAA,OAAO,OAAA;AACT;AAGO,SAAS,kBAAkB,EAAA,EAA+B;AAC/D,EAAA,MAAM,SAAS,SAAA,CAAU,IAAA;AAAA,IACvB,OAAK,CAAA,CAAE,UAAA,KAAe,GAAG,UAAA,IAAc,CAAA,CAAE,WAAW,EAAA,CAAG;AAAA,GACzD;AACA,EAAA,IAAI,CAAC,MAAA,EAAQ,SAAA,CAAU,IAAA,CAAK,EAAE,CAAA;AAChC;;;ACCO,SAAS,QAAQ,MAAA,EAA0C;AAEhE,EAAA,MAAM,UAAA,GAAa,OAAO,GAAA,EAAc,IAAA,EAAgB,IAAA,KAAsC;AAC5F,IAAA,MAAM,IAAA,GAAO,GAAA,CAAI,OAAA,CAAQ,aAAA,IAAiB,EAAA;AAC1C,IAAA,MAAM,CAAC,MAAA,EAAQ,KAAK,CAAA,GAAI,IAAA,CAAK,MAAM,GAAG,CAAA;AACtC,IAAA,IAAI,MAAA,EAAQ,WAAA,EAAY,KAAM,QAAA,IAAY,KAAA,EAAO;AAC/C,MAAA,IAAI;AACF,QAAA,GAAA,CAAI,WAAA,GAAc,MAAM,MAAA,CAAO,aAAA,CAAc,KAAK,CAAA;AAAA,MACpD,CAAA,CAAA,MAAQ;AAAA,MAER;AAAA,IACF;AACA,IAAA,IAAA,EAAK;AAAA,EACP,CAAA;AAEA,EAAA,MAAM,KAAA,GAAQ,CAAC,EAAA,EAAY,KAAA,EAAe,MAAA,KAAoB;AAC5D,IAAA,MAAM,cAAA,GAAiB,MAAA,IAAU,YAAA,CAAa,EAAE,CAAA;AAChD,IAAA,iBAAA,CAAkB,EAAE,UAAA,EAAY,EAAA,EAAI,MAAA,EAAQ,cAAA,EAAgB,OAAO,CAAA;AAEnE,IAAA,OAAO,CAAC,GAAA,EAAc,GAAA,EAAe,IAAA,KAA6B;AAChE,MAAA,IAAI,UAAU,QAAA,EAAU;AAAE,QAAA,IAAA,EAAK;AAAG,QAAA;AAAA,MAAQ;AAE1C,MAAA,IAAI,CAAC,IAAI,WAAA,EAAa;AACpB,QAAA,GAAA,CAAI,MAAA,CAAO,GAAG,CAAA,CAAE,IAAA,CAAK,EAAE,KAAA,EAAO,cAAA,EAAgB,MAAA,EAAQ,wBAAA,EAA0B,CAAA;AAChF,QAAA;AAAA,MACF;AAEA,MAAA,MAAM,UAAU,MAAA,CAAO,eAAA,CAAgB,GAAA,CAAI,WAAA,EAAa,IAAI,cAAc,CAAA;AAC1E,MAAA,IAAI,CAAC,OAAA,EAAS;AACZ,QAAA,GAAA,CAAI,MAAA,CAAO,GAAG,CAAA,CAAE,IAAA,CAAK,EAAE,KAAA,EAAO,WAAA,EAAa,MAAA,EAAQ,2BAAA,EAA6B,CAAA;AAChF,QAAA;AAAA,MACF;AAEA,MAAA,IAAA,EAAK;AAAA,IACP,CAAA;AAAA,EACF,CAAA;AAEA,EAAA,OAAO,EAAE,YAAY,KAAA,EAAM;AAC7B","file":"express.cjs","sourcesContent":["import type { OperationDescriptor } from './models.js';\n\nconst _registry: OperationDescriptor[] = [];\n\n/** Infer operation method from the last segment of the operation id.\n *  e.g. \"tasks:list\" → \"read\", \"tasks:create\" → \"write\", \"tasks:delete\" → \"delete\"\n */\nexport function detectMethod(id: string): string {\n  const last = (id.split(':').pop() ?? '').toLowerCase();\n  if (/^(get|list|fetch|read)/.test(last))       return 'read';\n  if (/^(delete|remove|destroy)/.test(last))      return 'delete';\n  if (/(stream|subscribe|watch|listen)/.test(last)) return 'stream';\n  return 'write';\n}\n\n/** Register an operation in the global registry (used by startup to sync). */\nexport function registerOperation(op: OperationDescriptor): void {\n  const exists = _registry.some(\n    o => o.identifier === op.identifier && o.method === op.method,\n  );\n  if (!exists) _registry.push(op);\n}\n\nexport function getRegistry(): OperationDescriptor[] {\n  return [..._registry];\n}\n\nexport function clearRegistry(): void {\n  _registry.length = 0;\n}","import type { NextFunction, Request, Response } from 'express';\nimport { CaronteClient } from '../client.js';\nimport { CaronteTokenError } from '../exceptions.js';\nimport type { TokenClaims } from '../models.js';\nimport { detectMethod, registerOperation } from '../registry.js';\n\ndeclare global {\n  namespace Express {\n    interface Request {\n      caronteUser?: TokenClaims;\n    }\n  }\n}\n\nexport interface CaronteMiddleware {\n  /** Global middleware — validates the Bearer token and injects `req.caronteUser`. */\n  middleware: (req: Request, res: Response, next: NextFunction) => Promise<void>;\n  /** Per-route guard — registers the operation and enforces permission at request time. */\n  guard: (id: string, level: string, method?: string) =>\n    (req: Request, res: Response, next: NextFunction) => void;\n}\n\nexport function caronte(client: CaronteClient): CaronteMiddleware {\n\n  const middleware = async (req: Request, _res: Response, next: NextFunction): Promise<void> => {\n    const auth = req.headers.authorization ?? '';\n    const [scheme, token] = auth.split(' ');\n    if (scheme?.toLowerCase() === 'bearer' && token) {\n      try {\n        req.caronteUser = await client.validateToken(token);\n      } catch {\n        // invalid token — caronteUser stays undefined; guard handles the 401\n      }\n    }\n    next();\n  };\n\n  const guard = (id: string, level: string, method?: string) => {\n    const resolvedMethod = method ?? detectMethod(id);\n    registerOperation({ identifier: id, method: resolvedMethod, level });\n\n    return (req: Request, res: Response, next: NextFunction): void => {\n      if (level === 'public') { next(); return; }\n\n      if (!req.caronteUser) {\n        res.status(401).json({ error: 'unauthorized', detail: 'Bearer token required.' });\n        return;\n      }\n\n      const allowed = client.checkPermission(req.caronteUser, id, resolvedMethod);\n      if (!allowed) {\n        res.status(403).json({ error: 'forbidden', detail: 'Insufficient permissions.' });\n        return;\n      }\n\n      next();\n    };\n  };\n\n  return { middleware, guard };\n}"]}

package/dist/adapters/express.d.cts

@@ -1,19 +1,19 @@
 import { Request, Response, NextFunction } from 'express';
-import { T as TokenClaims, A as ArgosClient } from '../client-Cgm1csuM.cjs';
+import { T as TokenClaims, C as CaronteClient } from '../client-TcOSwgrn.cjs';
 
 declare global {
     namespace Express {
         interface Request {
-            argosUser?: TokenClaims;
+            caronteUser?: TokenClaims;
         }
     }
 }
-interface ArgosMiddleware {
-    /** Global middleware — validates the Bearer token and injects `req.argosUser`. */
+interface CaronteMiddleware {
+    /** Global middleware — validates the Bearer token and injects `req.caronteUser`. */
     middleware: (req: Request, res: Response, next: NextFunction) => Promise<void>;
     /** Per-route guard — registers the operation and enforces permission at request time. */
     guard: (id: string, level: string, method?: string) => (req: Request, res: Response, next: NextFunction) => void;
 }
-declare function argos(client: ArgosClient): ArgosMiddleware;
+declare function caronte(client: CaronteClient): CaronteMiddleware;
 
-export { type ArgosMiddleware, argos };
+export { type CaronteMiddleware, caronte };

package/dist/adapters/express.d.ts

@@ -1,19 +1,19 @@
 import { Request, Response, NextFunction } from 'express';
-import { T as TokenClaims, A as ArgosClient } from '../client-Cgm1csuM.js';
+import { T as TokenClaims, C as CaronteClient } from '../client-TcOSwgrn.js';
 
 declare global {
     namespace Express {
         interface Request {
-            argosUser?: TokenClaims;
+            caronteUser?: TokenClaims;
         }
     }
 }
-interface ArgosMiddleware {
-    /** Global middleware — validates the Bearer token and injects `req.argosUser`. */
+interface CaronteMiddleware {
+    /** Global middleware — validates the Bearer token and injects `req.caronteUser`. */
     middleware: (req: Request, res: Response, next: NextFunction) => Promise<void>;
     /** Per-route guard — registers the operation and enforces permission at request time. */
     guard: (id: string, level: string, method?: string) => (req: Request, res: Response, next: NextFunction) => void;
 }
-declare function argos(client: ArgosClient): ArgosMiddleware;
+declare function caronte(client: CaronteClient): CaronteMiddleware;
 
-export { type ArgosMiddleware, argos };
+export { type CaronteMiddleware, caronte };

package/dist/adapters/express.js

@@ -1,13 +1,13 @@
 import { detectMethod, registerOperation } from '../chunk-HV6X5RJY.js';
 
 // src/adapters/express.ts
-function argos(client) {
+function caronte(client) {
   const middleware = async (req, _res, next) => {
     const auth = req.headers.authorization ?? "";
     const [scheme, token] = auth.split(" ");
     if (scheme?.toLowerCase() === "bearer" && token) {
       try {
-        req.argosUser = await client.validateToken(token);
+        req.caronteUser = await client.validateToken(token);
       } catch {
       }
     }
@@ -21,11 +21,11 @@ function argos(client) {
         next();
         return;
       }
-      if (!req.argosUser) {
+      if (!req.caronteUser) {
         res.status(401).json({ error: "unauthorized", detail: "Bearer token required." });
         return;
       }
-      const allowed = client.checkPermission(req.argosUser, id, resolvedMethod);
+      const allowed = client.checkPermission(req.caronteUser, id, resolvedMethod);
       if (!allowed) {
         res.status(403).json({ error: "forbidden", detail: "Insufficient permissions." });
         return;
@@ -36,6 +36,6 @@ function argos(client) {
   return { middleware, guard };
 }
 
-export { argos };
+export { caronte };
 //# sourceMappingURL=express.js.map
 //# sourceMappingURL=express.js.map

package/dist/adapters/express.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/adapters/express.ts"],"names":[],"mappings":";;;AAsBO,SAAS,MAAM,MAAA,EAAsC;AAE1D,EAAA,MAAM,UAAA,GAAa,OAAO,GAAA,EAAc,IAAA,EAAgB,IAAA,KAAsC;AAC5F,IAAA,MAAM,IAAA,GAAO,GAAA,CAAI,OAAA,CAAQ,aAAA,IAAiB,EAAA;AAC1C,IAAA,MAAM,CAAC,MAAA,EAAQ,KAAK,CAAA,GAAI,IAAA,CAAK,MAAM,GAAG,CAAA;AACtC,IAAA,IAAI,MAAA,EAAQ,WAAA,EAAY,KAAM,QAAA,IAAY,KAAA,EAAO;AAC/C,MAAA,IAAI;AACF,QAAA,GAAA,CAAI,SAAA,GAAY,MAAM,MAAA,CAAO,aAAA,CAAc,KAAK,CAAA;AAAA,MAClD,CAAA,CAAA,MAAQ;AAAA,MAER;AAAA,IACF;AACA,IAAA,IAAA,EAAK;AAAA,EACP,CAAA;AAEA,EAAA,MAAM,KAAA,GAAQ,CAAC,EAAA,EAAY,KAAA,EAAe,MAAA,KAAoB;AAC5D,IAAA,MAAM,cAAA,GAAiB,MAAA,IAAU,YAAA,CAAa,EAAE,CAAA;AAChD,IAAA,iBAAA,CAAkB,EAAE,UAAA,EAAY,EAAA,EAAI,MAAA,EAAQ,cAAA,EAAgB,OAAO,CAAA;AAEnE,IAAA,OAAO,CAAC,GAAA,EAAc,GAAA,EAAe,IAAA,KAA6B;AAChE,MAAA,IAAI,UAAU,QAAA,EAAU;AAAE,QAAA,IAAA,EAAK;AAAG,QAAA;AAAA,MAAQ;AAE1C,MAAA,IAAI,CAAC,IAAI,SAAA,EAAW;AAClB,QAAA,GAAA,CAAI,MAAA,CAAO,GAAG,CAAA,CAAE,IAAA,CAAK,EAAE,KAAA,EAAO,cAAA,EAAgB,MAAA,EAAQ,wBAAA,EAA0B,CAAA;AAChF,QAAA;AAAA,MACF;AAEA,MAAA,MAAM,UAAU,MAAA,CAAO,eAAA,CAAgB,GAAA,CAAI,SAAA,EAAW,IAAI,cAAc,CAAA;AACxE,MAAA,IAAI,CAAC,OAAA,EAAS;AACZ,QAAA,GAAA,CAAI,MAAA,CAAO,GAAG,CAAA,CAAE,IAAA,CAAK,EAAE,KAAA,EAAO,WAAA,EAAa,MAAA,EAAQ,2BAAA,EAA6B,CAAA;AAChF,QAAA;AAAA,MACF;AAEA,MAAA,IAAA,EAAK;AAAA,IACP,CAAA;AAAA,EACF,CAAA;AAEA,EAAA,OAAO,EAAE,YAAY,KAAA,EAAM;AAC7B","file":"express.js","sourcesContent":["import type { NextFunction, Request, Response } from 'express';\nimport { ArgosClient } from '../client.js';\nimport { ArgosTokenError } from '../exceptions.js';\nimport type { TokenClaims } from '../models.js';\nimport { detectMethod, registerOperation } from '../registry.js';\n\ndeclare global {\n  namespace Express {\n    interface Request {\n      argosUser?: TokenClaims;\n    }\n  }\n}\n\nexport interface ArgosMiddleware {\n  /** Global middleware — validates the Bearer token and injects `req.argosUser`. */\n  middleware: (req: Request, res: Response, next: NextFunction) => Promise<void>;\n  /** Per-route guard — registers the operation and enforces permission at request time. */\n  guard: (id: string, level: string, method?: string) =>\n    (req: Request, res: Response, next: NextFunction) => void;\n}\n\nexport function argos(client: ArgosClient): ArgosMiddleware {\n\n  const middleware = async (req: Request, _res: Response, next: NextFunction): Promise<void> => {\n    const auth = req.headers.authorization ?? '';\n    const [scheme, token] = auth.split(' ');\n    if (scheme?.toLowerCase() === 'bearer' && token) {\n      try {\n        req.argosUser = await client.validateToken(token);\n      } catch {\n        // invalid token — argosUser stays undefined; guard handles the 401\n      }\n    }\n    next();\n  };\n\n  const guard = (id: string, level: string, method?: string) => {\n    const resolvedMethod = method ?? detectMethod(id);\n    registerOperation({ identifier: id, method: resolvedMethod, level });\n\n    return (req: Request, res: Response, next: NextFunction): void => {\n      if (level === 'public') { next(); return; }\n\n      if (!req.argosUser) {\n        res.status(401).json({ error: 'unauthorized', detail: 'Bearer token required.' });\n        return;\n      }\n\n      const allowed = client.checkPermission(req.argosUser, id, resolvedMethod);\n      if (!allowed) {\n        res.status(403).json({ error: 'forbidden', detail: 'Insufficient permissions.' });\n        return;\n      }\n\n      next();\n    };\n  };\n\n  return { middleware, guard };\n}"]}
+{"version":3,"sources":["../../src/adapters/express.ts"],"names":[],"mappings":";;;AAsBO,SAAS,QAAQ,MAAA,EAA0C;AAEhE,EAAA,MAAM,UAAA,GAAa,OAAO,GAAA,EAAc,IAAA,EAAgB,IAAA,KAAsC;AAC5F,IAAA,MAAM,IAAA,GAAO,GAAA,CAAI,OAAA,CAAQ,aAAA,IAAiB,EAAA;AAC1C,IAAA,MAAM,CAAC,MAAA,EAAQ,KAAK,CAAA,GAAI,IAAA,CAAK,MAAM,GAAG,CAAA;AACtC,IAAA,IAAI,MAAA,EAAQ,WAAA,EAAY,KAAM,QAAA,IAAY,KAAA,EAAO;AAC/C,MAAA,IAAI;AACF,QAAA,GAAA,CAAI,WAAA,GAAc,MAAM,MAAA,CAAO,aAAA,CAAc,KAAK,CAAA;AAAA,MACpD,CAAA,CAAA,MAAQ;AAAA,MAER;AAAA,IACF;AACA,IAAA,IAAA,EAAK;AAAA,EACP,CAAA;AAEA,EAAA,MAAM,KAAA,GAAQ,CAAC,EAAA,EAAY,KAAA,EAAe,MAAA,KAAoB;AAC5D,IAAA,MAAM,cAAA,GAAiB,MAAA,IAAU,YAAA,CAAa,EAAE,CAAA;AAChD,IAAA,iBAAA,CAAkB,EAAE,UAAA,EAAY,EAAA,EAAI,MAAA,EAAQ,cAAA,EAAgB,OAAO,CAAA;AAEnE,IAAA,OAAO,CAAC,GAAA,EAAc,GAAA,EAAe,IAAA,KAA6B;AAChE,MAAA,IAAI,UAAU,QAAA,EAAU;AAAE,QAAA,IAAA,EAAK;AAAG,QAAA;AAAA,MAAQ;AAE1C,MAAA,IAAI,CAAC,IAAI,WAAA,EAAa;AACpB,QAAA,GAAA,CAAI,MAAA,CAAO,GAAG,CAAA,CAAE,IAAA,CAAK,EAAE,KAAA,EAAO,cAAA,EAAgB,MAAA,EAAQ,wBAAA,EAA0B,CAAA;AAChF,QAAA;AAAA,MACF;AAEA,MAAA,MAAM,UAAU,MAAA,CAAO,eAAA,CAAgB,GAAA,CAAI,WAAA,EAAa,IAAI,cAAc,CAAA;AAC1E,MAAA,IAAI,CAAC,OAAA,EAAS;AACZ,QAAA,GAAA,CAAI,MAAA,CAAO,GAAG,CAAA,CAAE,IAAA,CAAK,EAAE,KAAA,EAAO,WAAA,EAAa,MAAA,EAAQ,2BAAA,EAA6B,CAAA;AAChF,QAAA;AAAA,MACF;AAEA,MAAA,IAAA,EAAK;AAAA,IACP,CAAA;AAAA,EACF,CAAA;AAEA,EAAA,OAAO,EAAE,YAAY,KAAA,EAAM;AAC7B","file":"express.js","sourcesContent":["import type { NextFunction, Request, Response } from 'express';\nimport { CaronteClient } from '../client.js';\nimport { CaronteTokenError } from '../exceptions.js';\nimport type { TokenClaims } from '../models.js';\nimport { detectMethod, registerOperation } from '../registry.js';\n\ndeclare global {\n  namespace Express {\n    interface Request {\n      caronteUser?: TokenClaims;\n    }\n  }\n}\n\nexport interface CaronteMiddleware {\n  /** Global middleware — validates the Bearer token and injects `req.caronteUser`. */\n  middleware: (req: Request, res: Response, next: NextFunction) => Promise<void>;\n  /** Per-route guard — registers the operation and enforces permission at request time. */\n  guard: (id: string, level: string, method?: string) =>\n    (req: Request, res: Response, next: NextFunction) => void;\n}\n\nexport function caronte(client: CaronteClient): CaronteMiddleware {\n\n  const middleware = async (req: Request, _res: Response, next: NextFunction): Promise<void> => {\n    const auth = req.headers.authorization ?? '';\n    const [scheme, token] = auth.split(' ');\n    if (scheme?.toLowerCase() === 'bearer' && token) {\n      try {\n        req.caronteUser = await client.validateToken(token);\n      } catch {\n        // invalid token — caronteUser stays undefined; guard handles the 401\n      }\n    }\n    next();\n  };\n\n  const guard = (id: string, level: string, method?: string) => {\n    const resolvedMethod = method ?? detectMethod(id);\n    registerOperation({ identifier: id, method: resolvedMethod, level });\n\n    return (req: Request, res: Response, next: NextFunction): void => {\n      if (level === 'public') { next(); return; }\n\n      if (!req.caronteUser) {\n        res.status(401).json({ error: 'unauthorized', detail: 'Bearer token required.' });\n        return;\n      }\n\n      const allowed = client.checkPermission(req.caronteUser, id, resolvedMethod);\n      if (!allowed) {\n        res.status(403).json({ error: 'forbidden', detail: 'Insufficient permissions.' });\n        return;\n      }\n\n      next();\n    };\n  };\n\n  return { middleware, guard };\n}"]}