@caronte-sdk/node 0.2.0

package/README.md

@@ -0,0 +1,198 @@
+# @argos/node
+
+Node.js client for the **Argos** authorizer — handles app authentication,
+JWT validation, permission checking and automatic operation sync.
+
+## Installation
+
+```bash
+npm install @argos/node
+# With framework-specific adapter
+npm install @argos/node express        # Express
+npm install @argos/node fastify        # Fastify
+npm install @argos/node @nestjs/common # NestJS
+npm install @argos/node @apollo/server # Apollo Server
+```
+
+## Quick start
+
+### Express
+
+```ts
+import express from 'express';
+import { ArgosClient, getRegistry } from '@argos/node';
+import { argos } from '@argos/node/express';
+
+const client = new ArgosClient({
+  authorizerUrl: process.env.AUTHORIZER_URL!,
+  realmId:       process.env.REALM_ID!,
+  appId:         process.env.APP_ID!,
+  secret:        process.env.APP_SECRET!,
+});
+
+const { middleware, guard } = argos(client);
+
+const app = express();
+app.use(express.json(), middleware);
+
+app.get('/health',  guard('health:check', 'public'),    (_req, res) => res.json({ status: 'ok' }));
+app.get('/tasks',   guard('tasks:list',   'private'),   (_req, res) => res.json(tasks));
+app.post('/tasks',  guard('tasks:create', 'protected'), (req,  res) => { /* req.argosUser */ });
+
+for (const op of getRegistry()) client.registerOperation(op);
+await client.startup();
+
+app.listen(3001);
+```
+
+### Fastify
+
+```ts
+import Fastify from 'fastify';
+import { ArgosClient, getRegistry } from '@argos/node';
+import { argosFastifyPlugin } from '@argos/node/fastify';
+
+const client = new ArgosClient({ ... });
+const fastify = Fastify();
+
+await fastify.register(argosFastifyPlugin, { client });
+
+fastify.get('/health',
+  { preHandler: fastify.argosGuard('health:check', 'public') },
+  async () => ({ status: 'ok' }),
+);
+
+fastify.get('/tasks',
+  { preHandler: fastify.argosGuard('tasks:list', 'private') },
+  async (req) => { /* req.argosUser */ },
+);
+
+for (const op of getRegistry()) client.registerOperation(op);
+await client.startup();
+
+await fastify.listen({ port: 3002 });
+```
+
+### NestJS
+
+```ts
+// app.module.ts
+import { Module } from '@nestjs/common';
+import { ArgosModule } from '@argos/node/nest';
+
+@Module({
+  imports: [
+    ArgosModule.forRootAsync({
+      authorizerUrl: process.env.AUTHORIZER_URL!,
+      realmId:       process.env.REALM_ID!,
+      appId:         process.env.APP_ID!,
+      secret:        process.env.APP_SECRET!,
+    }),
+  ],
+})
+export class AppModule {}
+```
+
+```ts
+// tasks.controller.ts
+import { Controller, Get, Post, UseGuards } from '@nestjs/common';
+import { ArgosGuard, ArgosUser, Operation } from '@argos/node/nest';
+import type { TokenClaims } from '@argos/node';
+
+@Controller('tasks')
+@UseGuards(ArgosGuard)
+export class TasksController {
+
+  @Get()
+  @Operation('tasks:list', 'private')
+  list() { return tasks; }
+
+  @Post()
+  @Operation('tasks:create', 'protected')
+  create(@ArgosUser() user: TokenClaims) {
+    // user.sub, user.groups
+  }
+}
+```
+
+### Apollo Server
+
+```ts
+import { ApolloServer } from '@apollo/server';
+import { ArgosClient, getRegistry } from '@argos/node';
+import { argosPlugin, createGuard, type ArgosContext } from '@argos/node/apollo';
+
+const client = new ArgosClient({ ... });
+const guard  = createGuard(client);
+
+const resolvers = {
+  Query: {
+    health: guard('health:check', 'public',  () => 'ok'),
+    tasks:  guard('tasks:list',   'private', (_p, _a, ctx: ArgosContext) => {
+      const user = ctx.argosUser; // TokenClaims
+      return tasks;
+    }),
+  },
+  Mutation: {
+    createTask: guard('tasks:create', 'protected', (_p, { input }, ctx: ArgosContext) => {
+      // ctx.argosUser is the authenticated user
+    }),
+  },
+};
+
+for (const op of getRegistry()) client.registerOperation(op);
+await client.startup();
+
+const server = new ApolloServer<ArgosContext>({
+  typeDefs,
+  resolvers,
+  plugins: [argosPlugin(client)],
+});
+```
+
+## Operation levels
+
+| Level       | Who can access |
+|-------------|----------------|
+| `public`    | Everyone — no token required |
+| `private`   | Any authenticated user (token with at least one group) |
+| `protected` | Only users whose groups intersect the operation's `allowed_groups` |
+
+## Method auto-detection
+
+The method is inferred from the last segment of the operation id:
+
+| Operation id suffix | Detected method |
+|---------------------|-----------------|
+| `list`, `get`, `fetch`, `read` | `read` |
+| `delete`, `remove`, `destroy` | `delete` |
+| `stream`, `subscribe`, `watch`, `listen` | `stream` |
+| anything else | `write` |
+
+You can always pass the method explicitly as the third argument to `guard()`.
+
+## Configuration
+
+| Parameter      | Description |
+|----------------|-------------|
+| `authorizerUrl` | Base URL of Argos, including the API prefix (e.g. `http://host/api`) |
+| `realmId`       | Name or UUID of the realm (e.g. `purp`) |
+| `appId`         | UUID of the app registered in `auth.apps` |
+| `secret`        | Plain-text app secret — use env vars, never commit |
+
+## How it works
+
+On `startup()`, the client:
+1. **Authenticates** — exchanges `appId` + `secret` for a short-lived app JWT
+2. **Fetches JWKS** — caches the public keys for token validation
+3. **Syncs operations** — pushes the registered operation catalogue to the authorizer
+4. **Fetches operations** — retrieves the authorised operation list with group bindings
+
+On each request, the adapter:
+- Validates the Bearer token using the cached JWKS
+- Checks `TokenClaims.groups` against the operation's `allowedGroups`
+- Injects `argosUser` (`TokenClaims`) into the request context
+
+## License
+
+CC0 1.0 Universal — public domain.

package/dist/adapters/apollo.cjs

@@ -0,0 +1,71 @@
+'use strict';
+
+// src/exceptions.ts
+var ArgosError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = this.constructor.name;
+  }
+};
+var ArgosTokenError = class extends ArgosError {
+};
+
+// src/registry.ts
+var _registry = [];
+function detectMethod(id) {
+  const last = (id.split(":").pop() ?? "").toLowerCase();
+  if (/^(get|list|fetch|read)/.test(last)) return "read";
+  if (/^(delete|remove|destroy)/.test(last)) return "delete";
+  if (/(stream|subscribe|watch|listen)/.test(last)) return "stream";
+  return "write";
+}
+function registerOperation(op) {
+  const exists = _registry.some(
+    (o) => o.identifier === op.identifier && o.method === op.method
+  );
+  if (!exists) _registry.push(op);
+}
+
+// src/adapters/apollo.ts
+function argosPlugin(client) {
+  return {
+    async requestDidStart() {
+      return {
+        async didResolveOperation(ctx) {
+          const httpAuth = ctx.request.http?.headers.get("authorization") ?? "";
+          const wsAuth = ctx.contextValue?.connectionParams?.Authorization ?? "";
+          const auth = httpAuth || wsAuth;
+          const [scheme, token] = auth.split(" ");
+          if (scheme?.toLowerCase() === "bearer" && token) {
+            try {
+              ctx.contextValue.argosUser = await client.validateToken(token);
+            } catch (err) {
+              if (err instanceof ArgosTokenError) {
+                ctx.contextValue.argosUser = void 0;
+              }
+            }
+          }
+        }
+      };
+    }
+  };
+}
+function createGuard(client) {
+  return function guard(id, level, resolver, method) {
+    const resolvedMethod = method ?? detectMethod(id);
+    registerOperation({ identifier: id, method: resolvedMethod, level });
+    return (parent, args, context, info) => {
+      if (level === "public") return resolver(parent, args, context, info);
+      if (!context.argosUser) throw new Error("Unauthorized: Bearer token required.");
+      if (!client.checkPermission(context.argosUser, id, resolvedMethod)) {
+        throw new Error("Forbidden: Insufficient permissions.");
+      }
+      return resolver(parent, args, context, info);
+    };
+  };
+}
+
+exports.argosPlugin = argosPlugin;
+exports.createGuard = createGuard;
+//# sourceMappingURL=apollo.cjs.map
+//# sourceMappingURL=apollo.cjs.map

package/dist/adapters/apollo.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/exceptions.ts","../../src/registry.ts","../../src/adapters/apollo.ts"],"names":[],"mappings":";;;AAAO,IAAM,UAAA,GAAN,cAAyB,KAAA,CAAM;AAAA,EACpC,YAAY,OAAA,EAAiB;AAC3B,IAAA,KAAA,CAAM,OAAO,CAAA;AACb,IAAA,IAAA,CAAK,IAAA,GAAO,KAAK,WAAA,CAAY,IAAA;AAAA,EAC/B;AACF,CAAA;AAGO,IAAM,eAAA,GAAN,cAAgC,UAAA,CAAW;AAAC,CAAA;;;ACNnD,IAAM,YAAmC,EAAC;AAKnC,SAAS,aAAa,EAAA,EAAoB;AAC/C,EAAA,MAAM,IAAA,GAAA,CAAQ,GAAG,KAAA,CAAM,GAAG,EAAE,GAAA,EAAI,IAAK,IAAI,WAAA,EAAY;AACrD,EAAA,IAAI,wBAAA,CAAyB,IAAA,CAAK,IAAI,CAAA,EAAS,OAAO,MAAA;AACtD,EAAA,IAAI,0BAAA,CAA2B,IAAA,CAAK,IAAI,CAAA,EAAQ,OAAO,QAAA;AACvD,EAAA,IAAI,iCAAA,CAAkC,IAAA,CAAK,IAAI,CAAA,EAAG,OAAO,QAAA;AACzD,EAAA,OAAO,OAAA;AACT;AAGO,SAAS,kBAAkB,EAAA,EAA+B;AAC/D,EAAA,MAAM,SAAS,SAAA,CAAU,IAAA;AAAA,IACvB,OAAK,CAAA,CAAE,UAAA,KAAe,GAAG,UAAA,IAAc,CAAA,CAAE,WAAW,EAAA,CAAG;AAAA,GACzD;AACA,EAAA,IAAI,CAAC,MAAA,EAAQ,SAAA,CAAU,IAAA,CAAK,EAAE,CAAA;AAChC;;;ACJO,SAAS,YAAY,MAAA,EAAuD;AACjF,EAAA,OAAO;AAAA,IACL,MAAM,eAAA,GAAkB;AACtB,MAAA,OAAO;AAAA,QACL,MAAM,oBAAoB,GAAA,EAA0C;AAClE,UAAA,MAAM,WAAY,GAAA,CAAI,OAAA,CAAQ,MAAM,OAAA,CAAQ,GAAA,CAAI,eAAe,CAAA,IAAK,EAAA;AACpE,UAAA,MAAM,MAAA,GAAc,GAAA,CAAI,YAAA,EAAsB,gBAAA,EAAkB,aAAA,IAAwC,EAAA;AACxG,UAAA,MAAM,OAAY,QAAA,IAAY,MAAA;AAE9B,UAAA,MAAM,CAAC,MAAA,EAAQ,KAAK,CAAA,GAAI,IAAA,CAAK,MAAM,GAAG,CAAA;AACtC,UAAA,IAAI,MAAA,EAAQ,WAAA,EAAY,KAAM,QAAA,IAAY,KAAA,EAAO;AAC/C,YAAA,IAAI;AACF,cAAA,GAAA,CAAI,YAAA,CAAa,SAAA,GAAY,MAAM,MAAA,CAAO,cAAc,KAAK,CAAA;AAAA,YAC/D,SAAS,GAAA,EAAK;AACZ,cAAA,IAAI,eAAe,eAAA,EAAiB;AAClC,gBAAA,GAAA,CAAI,aAAa,SAAA,GAAY,MAAA;AAAA,cAC/B;AAAA,YACF;AAAA,UACF;AAAA,QACF;AAAA,OACF;AAAA,IACF;AAAA,GACF;AACF;AAmBO,SAAS,YAAY,MAAA,EAAqB;AAC/C,EAAA,OAAO,SAAS,KAAA,CACd,EAAA,EACA,KAAA,EACA,UACA,MAAA,EAC6E;AAC7E,IAAA,MAAM,cAAA,GAAiB,MAAA,IAAU,YAAA,CAAa,EAAE,CAAA;AAChD,IAAA,iBAAA,CAAkB,EAAE,UAAA,EAAY,EAAA,EAAI,MAAA,EAAQ,cAAA,EAAgB,OAAO,CAAA;AAEnE,IAAA,OAAO,CAAC,MAAA,EAAQ,IAAA,EAAM,OAAA,EAAS,IAAA,KAAS;AACtC,MAAA,IAAI,UAAU,QAAA,EAAU,OAAO,SAAS,MAAA,EAAQ,IAAA,EAAM,SAAS,IAAI,CAAA;AACnE,MAAA,IAAI,CAAC,OAAA,CAAQ,SAAA,EAAW,MAAM,IAAI,MAAM,sCAAsC,CAAA;AAC9E,MAAA,IAAI,CAAC,MAAA,CAAO,eAAA,CAAgB,QAAQ,SAAA,EAAW,EAAA,EAAI,cAAc,CAAA,EAAG;AAClE,QAAA,MAAM,IAAI,MAAM,sCAAsC,CAAA;AAAA,MACxD;AACA,MAAA,OAAO,QAAA,CAAS,MAAA,EAAQ,IAAA,EAAM,OAAA,EAAS,IAAI,CAAA;AAAA,IAC7C,CAAA;AAAA,EACF,CAAA;AACF","file":"apollo.cjs","sourcesContent":["export class ArgosError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = this.constructor.name;\n  }\n}\n\nexport class ArgosAuthError    extends ArgosError {}\nexport class ArgosTokenError   extends ArgosError {}\nexport class ArgosForbiddenError extends ArgosError {}\nexport class ArgosSyncError    extends ArgosError {}\nexport class ArgosConfigError  extends ArgosError {}","import type { OperationDescriptor } from './models.js';\n\nconst _registry: OperationDescriptor[] = [];\n\n/** Infer operation method from the last segment of the operation id.\n *  e.g. \"tasks:list\" → \"read\", \"tasks:create\" → \"write\", \"tasks:delete\" → \"delete\"\n */\nexport function detectMethod(id: string): string {\n  const last = (id.split(':').pop() ?? '').toLowerCase();\n  if (/^(get|list|fetch|read)/.test(last))       return 'read';\n  if (/^(delete|remove|destroy)/.test(last))      return 'delete';\n  if (/(stream|subscribe|watch|listen)/.test(last)) return 'stream';\n  return 'write';\n}\n\n/** Register an operation in the global registry (used by startup to sync). */\nexport function registerOperation(op: OperationDescriptor): void {\n  const exists = _registry.some(\n    o => o.identifier === op.identifier && o.method === op.method,\n  );\n  if (!exists) _registry.push(op);\n}\n\nexport function getRegistry(): OperationDescriptor[] {\n  return [..._registry];\n}\n\nexport function clearRegistry(): void {\n  _registry.length = 0;\n}","import type { ApolloServerPlugin, BaseContext, GraphQLRequestContext } from '@apollo/server';\nimport { ArgosClient } from '../client.js';\nimport { ArgosTokenError } from '../exceptions.js';\nimport type { TokenClaims } from '../models.js';\nimport { detectMethod, registerOperation } from '../registry.js';\n\nexport interface ArgosContext extends BaseContext {\n  argosUser?: TokenClaims;\n}\n\n/**\n * Apollo Server plugin for argos.\n *\n * Validates the Bearer token on every request and stores the claims in\n * `context.argosUser`. Use `createGuard(client)` to enforce per-resolver\n * permissions.\n */\nexport function argosPlugin(client: ArgosClient): ApolloServerPlugin<ArgosContext> {\n  return {\n    async requestDidStart() {\n      return {\n        async didResolveOperation(ctx: GraphQLRequestContext<ArgosContext>) {\n          const httpAuth  = ctx.request.http?.headers.get('authorization') ?? '';\n          const wsAuth    = ((ctx.contextValue as any)?.connectionParams?.Authorization as string | undefined) ?? '';\n          const auth      = httpAuth || wsAuth;\n\n          const [scheme, token] = auth.split(' ');\n          if (scheme?.toLowerCase() === 'bearer' && token) {\n            try {\n              ctx.contextValue.argosUser = await client.validateToken(token);\n            } catch (err) {\n              if (err instanceof ArgosTokenError) {\n                ctx.contextValue.argosUser = undefined;\n              }\n            }\n          }\n        },\n      };\n    },\n  };\n}\n\n/**\n * Factory that returns a per-resolver guard bound to a `ArgosClient`.\n *\n * @example\n * ```ts\n * const guard = createGuard(client);\n *\n * const resolvers = {\n *   Query: {\n *     tasks: guard('tasks:list', 'private', async (_parent, _args, context) => {\n *       const user = context.argosUser;\n *       return db.tasks.findAll();\n *     }),\n *   },\n * };\n * ```\n */\nexport function createGuard(client: ArgosClient) {\n  return function guard<TParent, TArgs, TContext extends ArgosContext, TReturn>(\n    id: string,\n    level: string,\n    resolver: (parent: TParent, args: TArgs, context: TContext, info: unknown) => TReturn,\n    method?: string,\n  ): (parent: TParent, args: TArgs, context: TContext, info: unknown) => TReturn {\n    const resolvedMethod = method ?? detectMethod(id);\n    registerOperation({ identifier: id, method: resolvedMethod, level });\n\n    return (parent, args, context, info) => {\n      if (level === 'public') return resolver(parent, args, context, info);\n      if (!context.argosUser) throw new Error('Unauthorized: Bearer token required.');\n      if (!client.checkPermission(context.argosUser, id, resolvedMethod)) {\n        throw new Error('Forbidden: Insufficient permissions.');\n      }\n      return resolver(parent, args, context, info);\n    };\n  };\n}"]}

package/dist/adapters/apollo.d.cts

@@ -0,0 +1,34 @@
+import { BaseContext, ApolloServerPlugin } from '@apollo/server';
+import { T as TokenClaims, A as ArgosClient } from '../client-Cgm1csuM.cjs';
+
+interface ArgosContext extends BaseContext {
+    argosUser?: TokenClaims;
+}
+/**
+ * Apollo Server plugin for argos.
+ *
+ * Validates the Bearer token on every request and stores the claims in
+ * `context.argosUser`. Use `createGuard(client)` to enforce per-resolver
+ * permissions.
+ */
+declare function argosPlugin(client: ArgosClient): ApolloServerPlugin<ArgosContext>;
+/**
+ * Factory that returns a per-resolver guard bound to a `ArgosClient`.
+ *
+ * @example
+ * ```ts
+ * const guard = createGuard(client);
+ *
+ * const resolvers = {
+ *   Query: {
+ *     tasks: guard('tasks:list', 'private', async (_parent, _args, context) => {
+ *       const user = context.argosUser;
+ *       return db.tasks.findAll();
+ *     }),
+ *   },
+ * };
+ * ```
+ */
+declare function createGuard(client: ArgosClient): <TParent, TArgs, TContext extends ArgosContext, TReturn>(id: string, level: string, resolver: (parent: TParent, args: TArgs, context: TContext, info: unknown) => TReturn, method?: string) => (parent: TParent, args: TArgs, context: TContext, info: unknown) => TReturn;
+
+export { type ArgosContext, argosPlugin, createGuard };

package/dist/adapters/apollo.d.ts

@@ -0,0 +1,34 @@
+import { BaseContext, ApolloServerPlugin } from '@apollo/server';
+import { T as TokenClaims, A as ArgosClient } from '../client-Cgm1csuM.js';
+
+interface ArgosContext extends BaseContext {
+    argosUser?: TokenClaims;
+}
+/**
+ * Apollo Server plugin for argos.
+ *
+ * Validates the Bearer token on every request and stores the claims in
+ * `context.argosUser`. Use `createGuard(client)` to enforce per-resolver
+ * permissions.
+ */
+declare function argosPlugin(client: ArgosClient): ApolloServerPlugin<ArgosContext>;
+/**
+ * Factory that returns a per-resolver guard bound to a `ArgosClient`.
+ *
+ * @example
+ * ```ts
+ * const guard = createGuard(client);
+ *
+ * const resolvers = {
+ *   Query: {
+ *     tasks: guard('tasks:list', 'private', async (_parent, _args, context) => {
+ *       const user = context.argosUser;
+ *       return db.tasks.findAll();
+ *     }),
+ *   },
+ * };
+ * ```
+ */
+declare function createGuard(client: ArgosClient): <TParent, TArgs, TContext extends ArgosContext, TReturn>(id: string, level: string, resolver: (parent: TParent, args: TArgs, context: TContext, info: unknown) => TReturn, method?: string) => (parent: TParent, args: TArgs, context: TContext, info: unknown) => TReturn;
+
+export { type ArgosContext, argosPlugin, createGuard };

package/dist/adapters/apollo.js

@@ -0,0 +1,45 @@
+import { ArgosTokenError } from '../chunk-AKUM2UEO.js';
+import { detectMethod, registerOperation } from '../chunk-HV6X5RJY.js';
+
+// src/adapters/apollo.ts
+function argosPlugin(client) {
+  return {
+    async requestDidStart() {
+      return {
+        async didResolveOperation(ctx) {
+          const httpAuth = ctx.request.http?.headers.get("authorization") ?? "";
+          const wsAuth = ctx.contextValue?.connectionParams?.Authorization ?? "";
+          const auth = httpAuth || wsAuth;
+          const [scheme, token] = auth.split(" ");
+          if (scheme?.toLowerCase() === "bearer" && token) {
+            try {
+              ctx.contextValue.argosUser = await client.validateToken(token);
+            } catch (err) {
+              if (err instanceof ArgosTokenError) {
+                ctx.contextValue.argosUser = void 0;
+              }
+            }
+          }
+        }
+      };
+    }
+  };
+}
+function createGuard(client) {
+  return function guard(id, level, resolver, method) {
+    const resolvedMethod = method ?? detectMethod(id);
+    registerOperation({ identifier: id, method: resolvedMethod, level });
+    return (parent, args, context, info) => {
+      if (level === "public") return resolver(parent, args, context, info);
+      if (!context.argosUser) throw new Error("Unauthorized: Bearer token required.");
+      if (!client.checkPermission(context.argosUser, id, resolvedMethod)) {
+        throw new Error("Forbidden: Insufficient permissions.");
+      }
+      return resolver(parent, args, context, info);
+    };
+  };
+}
+
+export { argosPlugin, createGuard };
+//# sourceMappingURL=apollo.js.map
+//# sourceMappingURL=apollo.js.map

package/dist/adapters/apollo.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/adapters/apollo.ts"],"names":[],"mappings":";;;;AAiBO,SAAS,YAAY,MAAA,EAAuD;AACjF,EAAA,OAAO;AAAA,IACL,MAAM,eAAA,GAAkB;AACtB,MAAA,OAAO;AAAA,QACL,MAAM,oBAAoB,GAAA,EAA0C;AAClE,UAAA,MAAM,WAAY,GAAA,CAAI,OAAA,CAAQ,MAAM,OAAA,CAAQ,GAAA,CAAI,eAAe,CAAA,IAAK,EAAA;AACpE,UAAA,MAAM,MAAA,GAAc,GAAA,CAAI,YAAA,EAAsB,gBAAA,EAAkB,aAAA,IAAwC,EAAA;AACxG,UAAA,MAAM,OAAY,QAAA,IAAY,MAAA;AAE9B,UAAA,MAAM,CAAC,MAAA,EAAQ,KAAK,CAAA,GAAI,IAAA,CAAK,MAAM,GAAG,CAAA;AACtC,UAAA,IAAI,MAAA,EAAQ,WAAA,EAAY,KAAM,QAAA,IAAY,KAAA,EAAO;AAC/C,YAAA,IAAI;AACF,cAAA,GAAA,CAAI,YAAA,CAAa,SAAA,GAAY,MAAM,MAAA,CAAO,cAAc,KAAK,CAAA;AAAA,YAC/D,SAAS,GAAA,EAAK;AACZ,cAAA,IAAI,eAAe,eAAA,EAAiB;AAClC,gBAAA,GAAA,CAAI,aAAa,SAAA,GAAY,MAAA;AAAA,cAC/B;AAAA,YACF;AAAA,UACF;AAAA,QACF;AAAA,OACF;AAAA,IACF;AAAA,GACF;AACF;AAmBO,SAAS,YAAY,MAAA,EAAqB;AAC/C,EAAA,OAAO,SAAS,KAAA,CACd,EAAA,EACA,KAAA,EACA,UACA,MAAA,EAC6E;AAC7E,IAAA,MAAM,cAAA,GAAiB,MAAA,IAAU,YAAA,CAAa,EAAE,CAAA;AAChD,IAAA,iBAAA,CAAkB,EAAE,UAAA,EAAY,EAAA,EAAI,MAAA,EAAQ,cAAA,EAAgB,OAAO,CAAA;AAEnE,IAAA,OAAO,CAAC,MAAA,EAAQ,IAAA,EAAM,OAAA,EAAS,IAAA,KAAS;AACtC,MAAA,IAAI,UAAU,QAAA,EAAU,OAAO,SAAS,MAAA,EAAQ,IAAA,EAAM,SAAS,IAAI,CAAA;AACnE,MAAA,IAAI,CAAC,OAAA,CAAQ,SAAA,EAAW,MAAM,IAAI,MAAM,sCAAsC,CAAA;AAC9E,MAAA,IAAI,CAAC,MAAA,CAAO,eAAA,CAAgB,QAAQ,SAAA,EAAW,EAAA,EAAI,cAAc,CAAA,EAAG;AAClE,QAAA,MAAM,IAAI,MAAM,sCAAsC,CAAA;AAAA,MACxD;AACA,MAAA,OAAO,QAAA,CAAS,MAAA,EAAQ,IAAA,EAAM,OAAA,EAAS,IAAI,CAAA;AAAA,IAC7C,CAAA;AAAA,EACF,CAAA;AACF","file":"apollo.js","sourcesContent":["import type { ApolloServerPlugin, BaseContext, GraphQLRequestContext } from '@apollo/server';\nimport { ArgosClient } from '../client.js';\nimport { ArgosTokenError } from '../exceptions.js';\nimport type { TokenClaims } from '../models.js';\nimport { detectMethod, registerOperation } from '../registry.js';\n\nexport interface ArgosContext extends BaseContext {\n  argosUser?: TokenClaims;\n}\n\n/**\n * Apollo Server plugin for argos.\n *\n * Validates the Bearer token on every request and stores the claims in\n * `context.argosUser`. Use `createGuard(client)` to enforce per-resolver\n * permissions.\n */\nexport function argosPlugin(client: ArgosClient): ApolloServerPlugin<ArgosContext> {\n  return {\n    async requestDidStart() {\n      return {\n        async didResolveOperation(ctx: GraphQLRequestContext<ArgosContext>) {\n          const httpAuth  = ctx.request.http?.headers.get('authorization') ?? '';\n          const wsAuth    = ((ctx.contextValue as any)?.connectionParams?.Authorization as string | undefined) ?? '';\n          const auth      = httpAuth || wsAuth;\n\n          const [scheme, token] = auth.split(' ');\n          if (scheme?.toLowerCase() === 'bearer' && token) {\n            try {\n              ctx.contextValue.argosUser = await client.validateToken(token);\n            } catch (err) {\n              if (err instanceof ArgosTokenError) {\n                ctx.contextValue.argosUser = undefined;\n              }\n            }\n          }\n        },\n      };\n    },\n  };\n}\n\n/**\n * Factory that returns a per-resolver guard bound to a `ArgosClient`.\n *\n * @example\n * ```ts\n * const guard = createGuard(client);\n *\n * const resolvers = {\n *   Query: {\n *     tasks: guard('tasks:list', 'private', async (_parent, _args, context) => {\n *       const user = context.argosUser;\n *       return db.tasks.findAll();\n *     }),\n *   },\n * };\n * ```\n */\nexport function createGuard(client: ArgosClient) {\n  return function guard<TParent, TArgs, TContext extends ArgosContext, TReturn>(\n    id: string,\n    level: string,\n    resolver: (parent: TParent, args: TArgs, context: TContext, info: unknown) => TReturn,\n    method?: string,\n  ): (parent: TParent, args: TArgs, context: TContext, info: unknown) => TReturn {\n    const resolvedMethod = method ?? detectMethod(id);\n    registerOperation({ identifier: id, method: resolvedMethod, level });\n\n    return (parent, args, context, info) => {\n      if (level === 'public') return resolver(parent, args, context, info);\n      if (!context.argosUser) throw new Error('Unauthorized: Bearer token required.');\n      if (!client.checkPermission(context.argosUser, id, resolvedMethod)) {\n        throw new Error('Forbidden: Insufficient permissions.');\n      }\n      return resolver(parent, args, context, info);\n    };\n  };\n}"]}

package/dist/adapters/express.cjs

@@ -0,0 +1,57 @@
+'use strict';
+
+// src/registry.ts
+var _registry = [];
+function detectMethod(id) {
+  const last = (id.split(":").pop() ?? "").toLowerCase();
+  if (/^(get|list|fetch|read)/.test(last)) return "read";
+  if (/^(delete|remove|destroy)/.test(last)) return "delete";
+  if (/(stream|subscribe|watch|listen)/.test(last)) return "stream";
+  return "write";
+}
+function registerOperation(op) {
+  const exists = _registry.some(
+    (o) => o.identifier === op.identifier && o.method === op.method
+  );
+  if (!exists) _registry.push(op);
+}
+
+// src/adapters/express.ts
+function argos(client) {
+  const middleware = async (req, _res, next) => {
+    const auth = req.headers.authorization ?? "";
+    const [scheme, token] = auth.split(" ");
+    if (scheme?.toLowerCase() === "bearer" && token) {
+      try {
+        req.argosUser = await client.validateToken(token);
+      } catch {
+      }
+    }
+    next();
+  };
+  const guard = (id, level, method) => {
+    const resolvedMethod = method ?? detectMethod(id);
+    registerOperation({ identifier: id, method: resolvedMethod, level });
+    return (req, res, next) => {
+      if (level === "public") {
+        next();
+        return;
+      }
+      if (!req.argosUser) {
+        res.status(401).json({ error: "unauthorized", detail: "Bearer token required." });
+        return;
+      }
+      const allowed = client.checkPermission(req.argosUser, id, resolvedMethod);
+      if (!allowed) {
+        res.status(403).json({ error: "forbidden", detail: "Insufficient permissions." });
+        return;
+      }
+      next();
+    };
+  };
+  return { middleware, guard };
+}
+
+exports.argos = argos;
+//# sourceMappingURL=express.cjs.map
+//# sourceMappingURL=express.cjs.map

package/dist/adapters/express.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/registry.ts","../../src/adapters/express.ts"],"names":[],"mappings":";;;AAEA,IAAM,YAAmC,EAAC;AAKnC,SAAS,aAAa,EAAA,EAAoB;AAC/C,EAAA,MAAM,IAAA,GAAA,CAAQ,GAAG,KAAA,CAAM,GAAG,EAAE,GAAA,EAAI,IAAK,IAAI,WAAA,EAAY;AACrD,EAAA,IAAI,wBAAA,CAAyB,IAAA,CAAK,IAAI,CAAA,EAAS,OAAO,MAAA;AACtD,EAAA,IAAI,0BAAA,CAA2B,IAAA,CAAK,IAAI,CAAA,EAAQ,OAAO,QAAA;AACvD,EAAA,IAAI,iCAAA,CAAkC,IAAA,CAAK,IAAI,CAAA,EAAG,OAAO,QAAA;AACzD,EAAA,OAAO,OAAA;AACT;AAGO,SAAS,kBAAkB,EAAA,EAA+B;AAC/D,EAAA,MAAM,SAAS,SAAA,CAAU,IAAA;AAAA,IACvB,OAAK,CAAA,CAAE,UAAA,KAAe,GAAG,UAAA,IAAc,CAAA,CAAE,WAAW,EAAA,CAAG;AAAA,GACzD;AACA,EAAA,IAAI,CAAC,MAAA,EAAQ,SAAA,CAAU,IAAA,CAAK,EAAE,CAAA;AAChC;;;ACCO,SAAS,MAAM,MAAA,EAAsC;AAE1D,EAAA,MAAM,UAAA,GAAa,OAAO,GAAA,EAAc,IAAA,EAAgB,IAAA,KAAsC;AAC5F,IAAA,MAAM,IAAA,GAAO,GAAA,CAAI,OAAA,CAAQ,aAAA,IAAiB,EAAA;AAC1C,IAAA,MAAM,CAAC,MAAA,EAAQ,KAAK,CAAA,GAAI,IAAA,CAAK,MAAM,GAAG,CAAA;AACtC,IAAA,IAAI,MAAA,EAAQ,WAAA,EAAY,KAAM,QAAA,IAAY,KAAA,EAAO;AAC/C,MAAA,IAAI;AACF,QAAA,GAAA,CAAI,SAAA,GAAY,MAAM,MAAA,CAAO,aAAA,CAAc,KAAK,CAAA;AAAA,MAClD,CAAA,CAAA,MAAQ;AAAA,MAER;AAAA,IACF;AACA,IAAA,IAAA,EAAK;AAAA,EACP,CAAA;AAEA,EAAA,MAAM,KAAA,GAAQ,CAAC,EAAA,EAAY,KAAA,EAAe,MAAA,KAAoB;AAC5D,IAAA,MAAM,cAAA,GAAiB,MAAA,IAAU,YAAA,CAAa,EAAE,CAAA;AAChD,IAAA,iBAAA,CAAkB,EAAE,UAAA,EAAY,EAAA,EAAI,MAAA,EAAQ,cAAA,EAAgB,OAAO,CAAA;AAEnE,IAAA,OAAO,CAAC,GAAA,EAAc,GAAA,EAAe,IAAA,KAA6B;AAChE,MAAA,IAAI,UAAU,QAAA,EAAU;AAAE,QAAA,IAAA,EAAK;AAAG,QAAA;AAAA,MAAQ;AAE1C,MAAA,IAAI,CAAC,IAAI,SAAA,EAAW;AAClB,QAAA,GAAA,CAAI,MAAA,CAAO,GAAG,CAAA,CAAE,IAAA,CAAK,EAAE,KAAA,EAAO,cAAA,EAAgB,MAAA,EAAQ,wBAAA,EAA0B,CAAA;AAChF,QAAA;AAAA,MACF;AAEA,MAAA,MAAM,UAAU,MAAA,CAAO,eAAA,CAAgB,GAAA,CAAI,SAAA,EAAW,IAAI,cAAc,CAAA;AACxE,MAAA,IAAI,CAAC,OAAA,EAAS;AACZ,QAAA,GAAA,CAAI,MAAA,CAAO,GAAG,CAAA,CAAE,IAAA,CAAK,EAAE,KAAA,EAAO,WAAA,EAAa,MAAA,EAAQ,2BAAA,EAA6B,CAAA;AAChF,QAAA;AAAA,MACF;AAEA,MAAA,IAAA,EAAK;AAAA,IACP,CAAA;AAAA,EACF,CAAA;AAEA,EAAA,OAAO,EAAE,YAAY,KAAA,EAAM;AAC7B","file":"express.cjs","sourcesContent":["import type { OperationDescriptor } from './models.js';\n\nconst _registry: OperationDescriptor[] = [];\n\n/** Infer operation method from the last segment of the operation id.\n *  e.g. \"tasks:list\" → \"read\", \"tasks:create\" → \"write\", \"tasks:delete\" → \"delete\"\n */\nexport function detectMethod(id: string): string {\n  const last = (id.split(':').pop() ?? '').toLowerCase();\n  if (/^(get|list|fetch|read)/.test(last))       return 'read';\n  if (/^(delete|remove|destroy)/.test(last))      return 'delete';\n  if (/(stream|subscribe|watch|listen)/.test(last)) return 'stream';\n  return 'write';\n}\n\n/** Register an operation in the global registry (used by startup to sync). */\nexport function registerOperation(op: OperationDescriptor): void {\n  const exists = _registry.some(\n    o => o.identifier === op.identifier && o.method === op.method,\n  );\n  if (!exists) _registry.push(op);\n}\n\nexport function getRegistry(): OperationDescriptor[] {\n  return [..._registry];\n}\n\nexport function clearRegistry(): void {\n  _registry.length = 0;\n}","import type { NextFunction, Request, Response } from 'express';\nimport { ArgosClient } from '../client.js';\nimport { ArgosTokenError } from '../exceptions.js';\nimport type { TokenClaims } from '../models.js';\nimport { detectMethod, registerOperation } from '../registry.js';\n\ndeclare global {\n  namespace Express {\n    interface Request {\n      argosUser?: TokenClaims;\n    }\n  }\n}\n\nexport interface ArgosMiddleware {\n  /** Global middleware — validates the Bearer token and injects `req.argosUser`. */\n  middleware: (req: Request, res: Response, next: NextFunction) => Promise<void>;\n  /** Per-route guard — registers the operation and enforces permission at request time. */\n  guard: (id: string, level: string, method?: string) =>\n    (req: Request, res: Response, next: NextFunction) => void;\n}\n\nexport function argos(client: ArgosClient): ArgosMiddleware {\n\n  const middleware = async (req: Request, _res: Response, next: NextFunction): Promise<void> => {\n    const auth = req.headers.authorization ?? '';\n    const [scheme, token] = auth.split(' ');\n    if (scheme?.toLowerCase() === 'bearer' && token) {\n      try {\n        req.argosUser = await client.validateToken(token);\n      } catch {\n        // invalid token — argosUser stays undefined; guard handles the 401\n      }\n    }\n    next();\n  };\n\n  const guard = (id: string, level: string, method?: string) => {\n    const resolvedMethod = method ?? detectMethod(id);\n    registerOperation({ identifier: id, method: resolvedMethod, level });\n\n    return (req: Request, res: Response, next: NextFunction): void => {\n      if (level === 'public') { next(); return; }\n\n      if (!req.argosUser) {\n        res.status(401).json({ error: 'unauthorized', detail: 'Bearer token required.' });\n        return;\n      }\n\n      const allowed = client.checkPermission(req.argosUser, id, resolvedMethod);\n      if (!allowed) {\n        res.status(403).json({ error: 'forbidden', detail: 'Insufficient permissions.' });\n        return;\n      }\n\n      next();\n    };\n  };\n\n  return { middleware, guard };\n}"]}

package/dist/adapters/express.d.cts

@@ -0,0 +1,19 @@
+import { Request, Response, NextFunction } from 'express';
+import { T as TokenClaims, A as ArgosClient } from '../client-Cgm1csuM.cjs';
+
+declare global {
+    namespace Express {
+        interface Request {
+            argosUser?: TokenClaims;
+        }
+    }
+}
+interface ArgosMiddleware {
+    /** Global middleware — validates the Bearer token and injects `req.argosUser`. */
+    middleware: (req: Request, res: Response, next: NextFunction) => Promise<void>;
+    /** Per-route guard — registers the operation and enforces permission at request time. */
+    guard: (id: string, level: string, method?: string) => (req: Request, res: Response, next: NextFunction) => void;
+}
+declare function argos(client: ArgosClient): ArgosMiddleware;
+
+export { type ArgosMiddleware, argos };

package/dist/adapters/express.d.ts

@@ -0,0 +1,19 @@
+import { Request, Response, NextFunction } from 'express';
+import { T as TokenClaims, A as ArgosClient } from '../client-Cgm1csuM.js';
+
+declare global {
+    namespace Express {
+        interface Request {
+            argosUser?: TokenClaims;
+        }
+    }
+}
+interface ArgosMiddleware {
+    /** Global middleware — validates the Bearer token and injects `req.argosUser`. */
+    middleware: (req: Request, res: Response, next: NextFunction) => Promise<void>;
+    /** Per-route guard — registers the operation and enforces permission at request time. */
+    guard: (id: string, level: string, method?: string) => (req: Request, res: Response, next: NextFunction) => void;
+}
+declare function argos(client: ArgosClient): ArgosMiddleware;
+
+export { type ArgosMiddleware, argos };

package/dist/adapters/express.js

@@ -0,0 +1,41 @@
+import { detectMethod, registerOperation } from '../chunk-HV6X5RJY.js';
+
+// src/adapters/express.ts
+function argos(client) {
+  const middleware = async (req, _res, next) => {
+    const auth = req.headers.authorization ?? "";
+    const [scheme, token] = auth.split(" ");
+    if (scheme?.toLowerCase() === "bearer" && token) {
+      try {
+        req.argosUser = await client.validateToken(token);
+      } catch {
+      }
+    }
+    next();
+  };
+  const guard = (id, level, method) => {
+    const resolvedMethod = method ?? detectMethod(id);
+    registerOperation({ identifier: id, method: resolvedMethod, level });
+    return (req, res, next) => {
+      if (level === "public") {
+        next();
+        return;
+      }
+      if (!req.argosUser) {
+        res.status(401).json({ error: "unauthorized", detail: "Bearer token required." });
+        return;
+      }
+      const allowed = client.checkPermission(req.argosUser, id, resolvedMethod);
+      if (!allowed) {
+        res.status(403).json({ error: "forbidden", detail: "Insufficient permissions." });
+        return;
+      }
+      next();
+    };
+  };
+  return { middleware, guard };
+}
+
+export { argos };
+//# sourceMappingURL=express.js.map
+//# sourceMappingURL=express.js.map

package/dist/adapters/express.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/adapters/express.ts"],"names":[],"mappings":";;;AAsBO,SAAS,MAAM,MAAA,EAAsC;AAE1D,EAAA,MAAM,UAAA,GAAa,OAAO,GAAA,EAAc,IAAA,EAAgB,IAAA,KAAsC;AAC5F,IAAA,MAAM,IAAA,GAAO,GAAA,CAAI,OAAA,CAAQ,aAAA,IAAiB,EAAA;AAC1C,IAAA,MAAM,CAAC,MAAA,EAAQ,KAAK,CAAA,GAAI,IAAA,CAAK,MAAM,GAAG,CAAA;AACtC,IAAA,IAAI,MAAA,EAAQ,WAAA,EAAY,KAAM,QAAA,IAAY,KAAA,EAAO;AAC/C,MAAA,IAAI;AACF,QAAA,GAAA,CAAI,SAAA,GAAY,MAAM,MAAA,CAAO,aAAA,CAAc,KAAK,CAAA;AAAA,MAClD,CAAA,CAAA,MAAQ;AAAA,MAER;AAAA,IACF;AACA,IAAA,IAAA,EAAK;AAAA,EACP,CAAA;AAEA,EAAA,MAAM,KAAA,GAAQ,CAAC,EAAA,EAAY,KAAA,EAAe,MAAA,KAAoB;AAC5D,IAAA,MAAM,cAAA,GAAiB,MAAA,IAAU,YAAA,CAAa,EAAE,CAAA;AAChD,IAAA,iBAAA,CAAkB,EAAE,UAAA,EAAY,EAAA,EAAI,MAAA,EAAQ,cAAA,EAAgB,OAAO,CAAA;AAEnE,IAAA,OAAO,CAAC,GAAA,EAAc,GAAA,EAAe,IAAA,KAA6B;AAChE,MAAA,IAAI,UAAU,QAAA,EAAU;AAAE,QAAA,IAAA,EAAK;AAAG,QAAA;AAAA,MAAQ;AAE1C,MAAA,IAAI,CAAC,IAAI,SAAA,EAAW;AAClB,QAAA,GAAA,CAAI,MAAA,CAAO,GAAG,CAAA,CAAE,IAAA,CAAK,EAAE,KAAA,EAAO,cAAA,EAAgB,MAAA,EAAQ,wBAAA,EAA0B,CAAA;AAChF,QAAA;AAAA,MACF;AAEA,MAAA,MAAM,UAAU,MAAA,CAAO,eAAA,CAAgB,GAAA,CAAI,SAAA,EAAW,IAAI,cAAc,CAAA;AACxE,MAAA,IAAI,CAAC,OAAA,EAAS;AACZ,QAAA,GAAA,CAAI,MAAA,CAAO,GAAG,CAAA,CAAE,IAAA,CAAK,EAAE,KAAA,EAAO,WAAA,EAAa,MAAA,EAAQ,2BAAA,EAA6B,CAAA;AAChF,QAAA;AAAA,MACF;AAEA,MAAA,IAAA,EAAK;AAAA,IACP,CAAA;AAAA,EACF,CAAA;AAEA,EAAA,OAAO,EAAE,YAAY,KAAA,EAAM;AAC7B","file":"express.js","sourcesContent":["import type { NextFunction, Request, Response } from 'express';\nimport { ArgosClient } from '../client.js';\nimport { ArgosTokenError } from '../exceptions.js';\nimport type { TokenClaims } from '../models.js';\nimport { detectMethod, registerOperation } from '../registry.js';\n\ndeclare global {\n  namespace Express {\n    interface Request {\n      argosUser?: TokenClaims;\n    }\n  }\n}\n\nexport interface ArgosMiddleware {\n  /** Global middleware — validates the Bearer token and injects `req.argosUser`. */\n  middleware: (req: Request, res: Response, next: NextFunction) => Promise<void>;\n  /** Per-route guard — registers the operation and enforces permission at request time. */\n  guard: (id: string, level: string, method?: string) =>\n    (req: Request, res: Response, next: NextFunction) => void;\n}\n\nexport function argos(client: ArgosClient): ArgosMiddleware {\n\n  const middleware = async (req: Request, _res: Response, next: NextFunction): Promise<void> => {\n    const auth = req.headers.authorization ?? '';\n    const [scheme, token] = auth.split(' ');\n    if (scheme?.toLowerCase() === 'bearer' && token) {\n      try {\n        req.argosUser = await client.validateToken(token);\n      } catch {\n        // invalid token — argosUser stays undefined; guard handles the 401\n      }\n    }\n    next();\n  };\n\n  const guard = (id: string, level: string, method?: string) => {\n    const resolvedMethod = method ?? detectMethod(id);\n    registerOperation({ identifier: id, method: resolvedMethod, level });\n\n    return (req: Request, res: Response, next: NextFunction): void => {\n      if (level === 'public') { next(); return; }\n\n      if (!req.argosUser) {\n        res.status(401).json({ error: 'unauthorized', detail: 'Bearer token required.' });\n        return;\n      }\n\n      const allowed = client.checkPermission(req.argosUser, id, resolvedMethod);\n      if (!allowed) {\n        res.status(403).json({ error: 'forbidden', detail: 'Insufficient permissions.' });\n        return;\n      }\n\n      next();\n    };\n  };\n\n  return { middleware, guard };\n}"]}

package/dist/adapters/fastify.cjs

@@ -0,0 +1,66 @@
+'use strict';
+
+var fp = require('fastify-plugin');
+
+function _interopDefault (e) { return e && e.__esModule ? e : { default: e }; }
+
+var fp__default = /*#__PURE__*/_interopDefault(fp);
+
+// src/adapters/fastify.ts
+
+// src/registry.ts
+var _registry = [];
+function detectMethod(id) {
+  const last = (id.split(":").pop() ?? "").toLowerCase();
+  if (/^(get|list|fetch|read)/.test(last)) return "read";
+  if (/^(delete|remove|destroy)/.test(last)) return "delete";
+  if (/(stream|subscribe|watch|listen)/.test(last)) return "stream";
+  return "write";
+}
+function registerOperation(op) {
+  const exists = _registry.some(
+    (o) => o.identifier === op.identifier && o.method === op.method
+  );
+  if (!exists) _registry.push(op);
+}
+
+// src/adapters/fastify.ts
+var argosPlugin = async (fastify, { client }) => {
+  fastify.decorateRequest("argosUser", void 0);
+  fastify.addHook("onRequest", async (request) => {
+    const auth = request.headers.authorization ?? "";
+    const [scheme, token] = auth.split(" ");
+    if (scheme?.toLowerCase() === "bearer" && token) {
+      try {
+        request.argosUser = await client.validateToken(token);
+      } catch {
+      }
+    }
+  });
+  fastify.decorate(
+    "argosGuard",
+    (id, level, method) => {
+      const resolvedMethod = method ?? detectMethod(id);
+      registerOperation({ identifier: id, method: resolvedMethod, level });
+      return async (request, reply) => {
+        if (level === "public") return;
+        if (!request.argosUser) {
+          await reply.status(401).send({ error: "unauthorized", detail: "Bearer token required." });
+          return;
+        }
+        const allowed = client.checkPermission(request.argosUser, id, resolvedMethod);
+        if (!allowed) {
+          await reply.status(403).send({ error: "forbidden", detail: "Insufficient permissions." });
+        }
+      };
+    }
+  );
+};
+var argosFastifyPlugin = fp__default.default(argosPlugin, {
+  name: "argos",
+  fastify: ">=4"
+});
+
+exports.argosFastifyPlugin = argosFastifyPlugin;
+//# sourceMappingURL=fastify.cjs.map
+//# sourceMappingURL=fastify.cjs.map

package/dist/adapters/fastify.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/registry.ts","../../src/adapters/fastify.ts"],"names":["fp"],"mappings":";;;;;;;;;;;AAEA,IAAM,YAAmC,EAAC;AAKnC,SAAS,aAAa,EAAA,EAAoB;AAC/C,EAAA,MAAM,IAAA,GAAA,CAAQ,GAAG,KAAA,CAAM,GAAG,EAAE,GAAA,EAAI,IAAK,IAAI,WAAA,EAAY;AACrD,EAAA,IAAI,wBAAA,CAAyB,IAAA,CAAK,IAAI,CAAA,EAAS,OAAO,MAAA;AACtD,EAAA,IAAI,0BAAA,CAA2B,IAAA,CAAK,IAAI,CAAA,EAAQ,OAAO,QAAA;AACvD,EAAA,IAAI,iCAAA,CAAkC,IAAA,CAAK,IAAI,CAAA,EAAG,OAAO,QAAA;AACzD,EAAA,OAAO,OAAA;AACT;AAGO,SAAS,kBAAkB,EAAA,EAA+B;AAC/D,EAAA,MAAM,SAAS,SAAA,CAAU,IAAA;AAAA,IACvB,OAAK,CAAA,CAAE,UAAA,KAAe,GAAG,UAAA,IAAc,CAAA,CAAE,WAAW,EAAA,CAAG;AAAA,GACzD;AACA,EAAA,IAAI,CAAC,MAAA,EAAQ,SAAA,CAAU,IAAA,CAAK,EAAE,CAAA;AAChC;;;ACLA,IAAM,WAAA,GAAsD,OAC1D,OAAA,EACA,EAAE,QAAO,KACN;AAEH,EAAA,OAAA,CAAQ,eAAA,CAAyC,aAAa,MAAS,CAAA;AAGvE,EAAA,OAAA,CAAQ,OAAA,CAAQ,WAAA,EAAa,OAAO,OAAA,KAA4B;AAC9D,IAAA,MAAM,IAAA,GAAO,OAAA,CAAQ,OAAA,CAAQ,aAAA,IAAiB,EAAA;AAC9C,IAAA,MAAM,CAAC,MAAA,EAAQ,KAAK,CAAA,GAAI,IAAA,CAAK,MAAM,GAAG,CAAA;AACtC,IAAA,IAAI,MAAA,EAAQ,WAAA,EAAY,KAAM,QAAA,IAAY,KAAA,EAAO;AAC/C,MAAA,IAAI;AACF,QAAA,OAAA,CAAQ,SAAA,GAAY,MAAM,MAAA,CAAO,aAAA,CAAc,KAAK,CAAA;AAAA,MACtD,CAAA,CAAA,MAAQ;AAAA,MAER;AAAA,IACF;AAAA,EACF,CAAC,CAAA;AAGD,EAAA,OAAA,CAAQ,QAAA;AAAA,IACN,YAAA;AAAA,IACA,CAAC,EAAA,EAAY,KAAA,EAAe,MAAA,KAAoB;AAC9C,MAAA,MAAM,cAAA,GAAiB,MAAA,IAAU,YAAA,CAAa,EAAE,CAAA;AAChD,MAAA,iBAAA,CAAkB,EAAE,UAAA,EAAY,EAAA,EAAI,MAAA,EAAQ,cAAA,EAAgB,OAAO,CAAA;AAEnE,MAAA,OAAO,OAAO,SAAyB,KAAA,KAAuC;AAC5E,QAAA,IAAI,UAAU,QAAA,EAAU;AAExB,QAAA,IAAI,CAAC,QAAQ,SAAA,EAAW;AACtB,UAAA,MAAM,KAAA,CAAM,MAAA,CAAO,GAAG,CAAA,CAAE,IAAA,CAAK,EAAE,KAAA,EAAO,cAAA,EAAgB,MAAA,EAAQ,wBAAA,EAA0B,CAAA;AACxF,UAAA;AAAA,QACF;AAEA,QAAA,MAAM,UAAU,MAAA,CAAO,eAAA,CAAgB,OAAA,CAAQ,SAAA,EAAW,IAAI,cAAc,CAAA;AAC5E,QAAA,IAAI,CAAC,OAAA,EAAS;AACZ,UAAA,MAAM,KAAA,CAAM,MAAA,CAAO,GAAG,CAAA,CAAE,IAAA,CAAK,EAAE,KAAA,EAAO,WAAA,EAAa,MAAA,EAAQ,2BAAA,EAA6B,CAAA;AAAA,QAC1F;AAAA,MACF,CAAA;AAAA,IACF;AAAA,GACF;AACF,CAAA;AAEO,IAAM,kBAAA,GAAqBA,oBAAG,WAAA,EAAa;AAAA,EAChD,IAAA,EAAM,OAAA;AAAA,EACN,OAAA,EAAS;AACX,CAAC","file":"fastify.cjs","sourcesContent":["import type { OperationDescriptor } from './models.js';\n\nconst _registry: OperationDescriptor[] = [];\n\n/** Infer operation method from the last segment of the operation id.\n *  e.g. \"tasks:list\" → \"read\", \"tasks:create\" → \"write\", \"tasks:delete\" → \"delete\"\n */\nexport function detectMethod(id: string): string {\n  const last = (id.split(':').pop() ?? '').toLowerCase();\n  if (/^(get|list|fetch|read)/.test(last))       return 'read';\n  if (/^(delete|remove|destroy)/.test(last))      return 'delete';\n  if (/(stream|subscribe|watch|listen)/.test(last)) return 'stream';\n  return 'write';\n}\n\n/** Register an operation in the global registry (used by startup to sync). */\nexport function registerOperation(op: OperationDescriptor): void {\n  const exists = _registry.some(\n    o => o.identifier === op.identifier && o.method === op.method,\n  );\n  if (!exists) _registry.push(op);\n}\n\nexport function getRegistry(): OperationDescriptor[] {\n  return [..._registry];\n}\n\nexport function clearRegistry(): void {\n  _registry.length = 0;\n}","import type { FastifyInstance, FastifyPluginAsync, FastifyReply, FastifyRequest } from 'fastify';\nimport fp from 'fastify-plugin';\nimport { ArgosClient } from '../client.js';\nimport type { TokenClaims } from '../models.js';\nimport { detectMethod, registerOperation } from '../registry.js';\n\ndeclare module 'fastify' {\n  interface FastifyRequest {\n    argosUser?: TokenClaims;\n  }\n}\n\nexport interface ArgosPluginOptions {\n  client: ArgosClient;\n}\n\nconst argosPlugin: FastifyPluginAsync<ArgosPluginOptions> = async (\n  fastify: FastifyInstance,\n  { client }: ArgosPluginOptions,\n) => {\n  // Decorate request with argosUser\n  fastify.decorateRequest<TokenClaims | undefined>('argosUser', undefined);\n\n  // Global hook — validates Bearer token on every request\n  fastify.addHook('onRequest', async (request: FastifyRequest) => {\n    const auth = request.headers.authorization ?? '';\n    const [scheme, token] = auth.split(' ');\n    if (scheme?.toLowerCase() === 'bearer' && token) {\n      try {\n        request.argosUser = await client.validateToken(token);\n      } catch {\n        // invalid token — argosUser stays null; guard handles the 401\n      }\n    }\n  });\n\n  // Decorate fastify with a guard factory\n  fastify.decorate(\n    'argosGuard',\n    (id: string, level: string, method?: string) => {\n      const resolvedMethod = method ?? detectMethod(id);\n      registerOperation({ identifier: id, method: resolvedMethod, level });\n\n      return async (request: FastifyRequest, reply: FastifyReply): Promise<void> => {\n        if (level === 'public') return;\n\n        if (!request.argosUser) {\n          await reply.status(401).send({ error: 'unauthorized', detail: 'Bearer token required.' });\n          return;\n        }\n\n        const allowed = client.checkPermission(request.argosUser, id, resolvedMethod);\n        if (!allowed) {\n          await reply.status(403).send({ error: 'forbidden', detail: 'Insufficient permissions.' });\n        }\n      };\n    },\n  );\n};\n\nexport const argosFastifyPlugin = fp(argosPlugin, {\n  name: 'argos',\n  fastify: '>=4',\n});\n\ndeclare module 'fastify' {\n  interface FastifyInstance {\n    argosGuard: (\n      id: string,\n      level: string,\n      method?: string,\n    ) => (req: FastifyRequest, reply: FastifyReply) => Promise<void>;\n  }\n}"]}