@caronte-sdk/node 0.2.0

package/dist/adapters/nest/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/adapters/nest/decorator.ts","../../../src/adapters/nest/guard.ts","../../../src/adapters/nest/module.ts"],"names":["Reflector"],"mappings":";;;;;;AAIO,IAAM,aAAA,GAAgB;AAkBtB,SAAS,SAAA,CAAU,EAAA,EAAY,KAAA,EAAe,MAAA,EAAkC;AACrF,EAAA,MAAM,cAAA,GAAiB,MAAA,IAAU,YAAA,CAAa,EAAE,CAAA;AAChD,EAAA,iBAAA,CAAkB,EAAE,UAAA,EAAY,EAAA,EAAI,MAAA,EAAQ,cAAA,EAAgB,OAAO,CAAA;AACnE,EAAA,OAAO,YAAmC,aAAA,EAAe,EAAE,IAAI,KAAA,EAAO,MAAA,EAAQ,gBAAgB,CAAA;AAChG;AAGO,IAAM,SAAA,GAAY,oBAAA;AAAA,EACvB,CAAC,KAAA,EAAgB,GAAA,KACf,IAAI,YAAA,EAAa,CAAE,YAAW,CAAE;AACpC;ACtBO,IAAM,aAAN,MAAwC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAM7C,WAAA,CACwC,QACF,SAAA,EACpC;AAFsC,IAAA,IAAA,CAAA,MAAA,GAAA,MAAA;AACF,IAAA,IAAA,CAAA,SAAA,GAAA,SAAA;AAAA,EACnC;AAAA,EAFqC,MAAA;AAAA,EACF,SAAA;AAAA,EAGtC,MAAM,YAAY,GAAA,EAAyC;AACzD,IAAA,MAAM,IAAA,GAAO,KAAK,SAAA,CAAU,GAAA;AAAA,MAC1B,aAAA;AAAA,MACA,IAAI,UAAA;AAAW,KACjB;AAEA,IAAA,IAAI,CAAC,MAAM,OAAO,IAAA;AAElB,IAAA,MAAM,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAO,GAAI,IAAA;AAC9B,IAAA,MAAM,OAAA,GAAU,GAAA,CAAI,YAAA,EAAa,CAAE,UAAA,EAAyE;AAE5G,IAAA,IAAI,KAAA,KAAU,UAAU,OAAO,IAAA;AAE/B,IAAA,MAAM,IAAA,GAAO,OAAA,CAAQ,OAAA,CAAQ,eAAe,CAAA,IAAK,EAAA;AACjD,IAAA,MAAM,CAAC,MAAA,EAAQ,KAAK,CAAA,GAAI,IAAA,CAAK,MAAM,GAAG,CAAA;AAEtC,IAAA,IAAI,MAAA,EAAQ,WAAA,EAAY,KAAM,QAAA,IAAY,CAAC,KAAA,EAAO;AAChD,MAAA,MAAM,IAAI,sBAAsB,wBAAwB,CAAA;AAAA,IAC1D;AAEA,IAAA,IAAI,MAAA;AACJ,IAAA,IAAI;AACF,MAAA,MAAA,GAAS,MAAM,IAAA,CAAK,MAAA,CAAO,aAAA,CAAc,KAAK,CAAA;AAAA,IAChD,CAAA,CAAA,MAAQ;AAIN,MAAA,MAAM,IAAI,sBAAsB,gBAAgB,CAAA;AAAA,IAClD;AACA,IAAA,OAAA,CAAQ,SAAA,GAAY,MAAA;AAEpB,IAAA,MAAM,UAAU,IAAA,CAAK,MAAA,CAAO,eAAA,CAAgB,MAAA,EAAQ,IAAI,MAAM,CAAA;AAC9D,IAAA,IAAI,CAAC,OAAA,EAAS,MAAM,IAAI,mBAAmB,2BAA2B,CAAA;AAEtE,IAAA,OAAO,IAAA;AAAA,EACT;AACF;AA/Ca,UAAA,GAAN,eAAA,CAAA;AAAA,EADN,UAAA,EAAW;AAAA,EAQP,0BAAO,WAAW,CAAA,CAAA;AAAA,EAClB,0BAAO,SAAS,CAAA;AAAA,CAAA,EARR,UAAA,CAAA;ACDN,IAAM,cAAN,MAAkB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAuBvB,OAAO,aAAa,OAAA,EAA4C;AAC9D,IAAA,OAAO;AAAA,MACL,MAAA,EAAQ,WAAA;AAAA,MACR,MAAA,EAAQ,IAAA;AAAA,MACR,SAAA,EAAW;AAAA,QACTA,SAAAA;AAAA,QACA;AAAA,UACE,OAAA,EAAS,WAAA;AAAA,UACT,YAAY,YAAY;AACtB,YAAA,MAAM,MAAA,GAAS,IAAI,WAAA,CAAY,OAAO,CAAA;AACtC,YAAA,KAAA,MAAW,EAAA,IAAM,WAAA,EAAY,EAAG,MAAA,CAAO,kBAAkB,EAAE,CAAA;AAC3D,YAAA,MAAM,OAAO,OAAA,EAAQ;AACrB,YAAA,OAAO,MAAA;AAAA,UACT;AAAA,SACF;AAAA,QACA;AAAA,OACF;AAAA,MACA,OAAA,EAAS,CAAC,WAAA,EAAa,UAAU;AAAA,KACnC;AAAA,EACF;AACF;AA3Ca,WAAA,GAAN,eAAA,CAAA;AAAA,EADN,MAAA,CAAO,EAAE;AAAA,CAAA,EACG,WAAA,CAAA","file":"index.js","sourcesContent":["import { createParamDecorator, ExecutionContext, SetMetadata } from '@nestjs/common';\nimport type { TokenClaims } from '../../models.js';\nimport { detectMethod, registerOperation } from '../../registry.js';\n\nexport const OPERATION_KEY = 'argos:operation';\n\nexport interface OperationMeta {\n  id: string;\n  level: string;\n  method: string;\n}\n\n/**\n * Marks a controller method as a argos operation.\n *\n * @example\n * ```ts\n * @Get()\n * @Operation('tasks:list', 'private')\n * listTasks(@ArgosUser() user: TokenClaims) { ... }\n * ```\n */\nexport function Operation(id: string, level: string, method?: string): MethodDecorator {\n  const resolvedMethod = method ?? detectMethod(id);\n  registerOperation({ identifier: id, method: resolvedMethod, level });\n  return SetMetadata<string, OperationMeta>(OPERATION_KEY, { id, level, method: resolvedMethod });\n}\n\n/** Injects the authenticated user's TokenClaims into a parameter. */\nexport const ArgosUser = createParamDecorator(\n  (_data: unknown, ctx: ExecutionContext): TokenClaims | undefined =>\n    ctx.switchToHttp().getRequest().argosUser,\n);","import {\n  CanActivate, ExecutionContext, ForbiddenException,\n  Inject, Injectable, UnauthorizedException,\n} from '@nestjs/common';\nimport { Reflector } from '@nestjs/core';\nimport { ArgosClient } from '../../client.js';\nimport type { TokenClaims } from '../../models.js';\nimport { OPERATION_KEY, type OperationMeta } from './decorator.js';\n\n@Injectable()\nexport class ArgosGuard implements CanActivate {\n  // @Inject() explícito -- não depender de emitDecoratorMetadata (design:paramtypes)\n  // pra resolver os parâmetros: o build desta lib usa tsup/esbuild, que não emite\n  // essa metadata (limitação conhecida do esbuild), então a injeção implícita por\n  // tipo do Nest falha silenciosamente (reflector fica undefined em runtime,\n  // TypeError em qualquer rota guardada por ArgosGuard).\n  constructor(\n    @Inject(ArgosClient) private readonly client: ArgosClient,\n    @Inject(Reflector) private readonly reflector: Reflector,\n  ) {}\n\n  async canActivate(ctx: ExecutionContext): Promise<boolean> {\n    const meta = this.reflector.get<OperationMeta | undefined>(\n      OPERATION_KEY,\n      ctx.getHandler(),\n    );\n\n    if (!meta) return true; // no @Operation — pass through\n\n    const { id, level, method } = meta;\n    const request = ctx.switchToHttp().getRequest<{ headers: Record<string, string>; argosUser?: TokenClaims }>();\n\n    if (level === 'public') return true;\n\n    const auth = request.headers['authorization'] ?? '';\n    const [scheme, token] = auth.split(' ');\n\n    if (scheme?.toLowerCase() !== 'bearer' || !token) {\n      throw new UnauthorizedException('Bearer token required.');\n    }\n\n    let claims: TokenClaims;\n    try {\n      claims = await this.client.validateToken(token);\n    } catch {\n      // Token malformado/expirado/inválido -- 401, igual aos adapters express/\n      // fastify (que engolem o erro de validateToken pelo mesmo motivo), não\n      // deixar virar 500 por exceção não tratada.\n      throw new UnauthorizedException('Invalid token.');\n    }\n    request.argosUser = claims;\n\n    const allowed = this.client.checkPermission(claims, id, method);\n    if (!allowed) throw new ForbiddenException('Insufficient permissions.');\n\n    return true;\n  }\n}","import { DynamicModule, Module } from '@nestjs/common';\nimport { Reflector } from '@nestjs/core';\nimport { ArgosClient, type ArgosClientOptions } from '../../client.js';\nimport { getRegistry } from '../../registry.js';\nimport { ArgosGuard } from './guard.js';\n\nexport interface ArgosModuleOptions extends ArgosClientOptions {}\n\n@Module({})\nexport class ArgosModule {\n  /**\n   * Register the argos module globally.\n   *\n   * Creates the `ArgosClient`, bootstraps it (authenticate + sync + fetch),\n   * and provides `ArgosGuard` for injection.\n   *\n   * @example\n   * ```ts\n   * // app.module.ts\n   * @Module({\n   *   imports: [\n   *     ArgosModule.forRootAsync({\n   *       authorizerUrl: process.env.AUTHORIZER_URL!,\n   *       realmId:       process.env.REALM_ID!,\n   *       appId:         process.env.APP_ID!,\n   *       secret:        process.env.APP_SECRET!,\n   *     }),\n   *   ],\n   * })\n   * export class AppModule {}\n   * ```\n   */\n  static forRootAsync(options: ArgosModuleOptions): DynamicModule {\n    return {\n      module: ArgosModule,\n      global: true,\n      providers: [\n        Reflector,\n        {\n          provide: ArgosClient,\n          useFactory: async () => {\n            const client = new ArgosClient(options);\n            for (const op of getRegistry()) client.registerOperation(op);\n            await client.startup();\n            return client;\n          },\n        },\n        ArgosGuard,\n      ],\n      exports: [ArgosClient, ArgosGuard],\n    };\n  }\n}"]}

package/dist/chunk-AKUM2UEO.js

@@ -0,0 +1,21 @@
+// src/exceptions.ts
+var ArgosError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = this.constructor.name;
+  }
+};
+var ArgosAuthError = class extends ArgosError {
+};
+var ArgosTokenError = class extends ArgosError {
+};
+var ArgosForbiddenError = class extends ArgosError {
+};
+var ArgosSyncError = class extends ArgosError {
+};
+var ArgosConfigError = class extends ArgosError {
+};
+
+export { ArgosAuthError, ArgosConfigError, ArgosError, ArgosForbiddenError, ArgosSyncError, ArgosTokenError };
+//# sourceMappingURL=chunk-AKUM2UEO.js.map
+//# sourceMappingURL=chunk-AKUM2UEO.js.map

package/dist/chunk-AKUM2UEO.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/exceptions.ts"],"names":[],"mappings":";AAAO,IAAM,UAAA,GAAN,cAAyB,KAAA,CAAM;AAAA,EACpC,YAAY,OAAA,EAAiB;AAC3B,IAAA,KAAA,CAAM,OAAO,CAAA;AACb,IAAA,IAAA,CAAK,IAAA,GAAO,KAAK,WAAA,CAAY,IAAA;AAAA,EAC/B;AACF;AAEO,IAAM,cAAA,GAAN,cAAgC,UAAA,CAAW;AAAC;AAC5C,IAAM,eAAA,GAAN,cAAgC,UAAA,CAAW;AAAC;AAC5C,IAAM,mBAAA,GAAN,cAAkC,UAAA,CAAW;AAAC;AAC9C,IAAM,cAAA,GAAN,cAAgC,UAAA,CAAW;AAAC;AAC5C,IAAM,gBAAA,GAAN,cAAgC,UAAA,CAAW;AAAC","file":"chunk-AKUM2UEO.js","sourcesContent":["export class ArgosError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = this.constructor.name;\n  }\n}\n\nexport class ArgosAuthError    extends ArgosError {}\nexport class ArgosTokenError   extends ArgosError {}\nexport class ArgosForbiddenError extends ArgosError {}\nexport class ArgosSyncError    extends ArgosError {}\nexport class ArgosConfigError  extends ArgosError {}"]}

package/dist/chunk-G73YTEJQ.js

@@ -0,0 +1,146 @@
+import { ArgosConfigError, ArgosAuthError, ArgosSyncError, ArgosError, ArgosTokenError } from './chunk-AKUM2UEO.js';
+import { getRegistry } from './chunk-HV6X5RJY.js';
+import { createRemoteJWKSet, jwtVerify } from 'jose';
+
+var ArgosClient = class _ArgosClient {
+  base;
+  realmId;
+  appId;
+  secret;
+  appToken = null;
+  jwks = null;
+  operations = [];
+  registeredOperations = [];
+  constructor(options) {
+    this.base = options.authorizerUrl.replace(/\/$/, "");
+    this.realmId = options.realmId;
+    this.appId = options.appId;
+    this.secret = options.secret;
+  }
+  get realmBase() {
+    return `${this.base}/realms/${this.realmId}`;
+  }
+  registerOperation(op) {
+    this.registeredOperations.push(op);
+  }
+  async startup() {
+    if (this.registeredOperations.length === 0) {
+      throw new ArgosConfigError(
+        "No operations registered. Call registerOperation() before startup()."
+      );
+    }
+    await this.authenticate();
+    this.initJwks();
+    await this.syncOperations();
+    await this.fetchOperations();
+  }
+  async authenticate() {
+    const res = await fetch(`${this.realmBase}/apps/token`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ app_id: this.appId, secret: this.secret })
+    });
+    if (!res.ok) {
+      throw new ArgosAuthError(
+        `Authentication failed: HTTP ${res.status} \u2014 ${await res.text()}`
+      );
+    }
+    const data = await res.json();
+    if (!data.access_token) throw new ArgosAuthError("Authorizer returned no access_token.");
+    this.appToken = data.access_token;
+  }
+  initJwks() {
+    this.jwks = createRemoteJWKSet(
+      new URL(`${this.realmBase}/protocol/openid-connect/certs`)
+    );
+  }
+  async syncOperations() {
+    this.ensureAppToken();
+    const res = await fetch(`${this.realmBase}/apps/operations/sync`, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        Authorization: `Bearer ${this.appToken}`
+      },
+      body: JSON.stringify({
+        operations: this.registeredOperations.map((op) => ({
+          identifier: op.identifier,
+          method: op.method,
+          level: op.level,
+          description: op.description ?? null
+        }))
+      })
+    });
+    if (!res.ok) {
+      throw new ArgosSyncError(`Sync failed: HTTP ${res.status} \u2014 ${await res.text()}`);
+    }
+  }
+  async fetchOperations() {
+    this.ensureAppToken();
+    const res = await fetch(`${this.realmBase}/apps/operations`, {
+      headers: { Authorization: `Bearer ${this.appToken}` }
+    });
+    if (!res.ok) {
+      throw new ArgosError(
+        `Fetch operations failed: HTTP ${res.status} \u2014 ${await res.text()}`
+      );
+    }
+    const data = await res.json();
+    this.operations = data.operations.map((op) => ({
+      operationId: op.operation_id,
+      identifier: op.identifier,
+      method: op.method,
+      level: op.level,
+      allowedGroups: op.allowed_groups ?? []
+    }));
+  }
+  async validateToken(token) {
+    if (!this.jwks) this.initJwks();
+    try {
+      const { payload } = await jwtVerify(token, this.jwks);
+      const p = payload;
+      const tokenRealm = p["realm_id"] ?? "";
+      if (tokenRealm.toLowerCase() !== this.realmId.toLowerCase()) {
+        throw new ArgosTokenError(
+          `Token realm '${tokenRealm}' does not match this app's realm '${this.realmId}'.`
+        );
+      }
+      return {
+        sub: payload.sub ?? "",
+        realmId: tokenRealm,
+        groups: p["groups"] ?? [],
+        exp: payload.exp ?? 0,
+        raw: p
+      };
+    } catch (err) {
+      if (err instanceof ArgosTokenError) throw err;
+      throw new ArgosTokenError(`Invalid token: ${err.message}`);
+    }
+  }
+  checkPermission(claims, identifier, method) {
+    const op = this.operations.find(
+      (o) => o.identifier === identifier && o.method === method
+    );
+    if (!op) return false;
+    if (op.level === "public") return true;
+    if (op.level === "private") return claims.groups.length > 0;
+    if (op.level === "protected") return claims.groups.some((g) => op.allowedGroups.includes(g));
+    return false;
+  }
+  /** Load operations from the global registry and bootstrap the client. */
+  static async create(options) {
+    const client = new _ArgosClient(options);
+    for (const op of getRegistry()) client.registerOperation(op);
+    await client.startup();
+    return client;
+  }
+  ensureAppToken() {
+    if (!this.appToken) {
+      throw new ArgosAuthError("No app token. Call authenticate() or startup() first.");
+    }
+  }
+};
+
+export { ArgosClient };
+//# sourceMappingURL=chunk-G73YTEJQ.js.map
+//# sourceMappingURL=chunk-G73YTEJQ.js.map

package/dist/chunk-G73YTEJQ.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/client.ts"],"names":[],"mappings":";;;;AAeO,IAAM,WAAA,GAAN,MAAM,YAAA,CAAY;AAAA,EACN,IAAA;AAAA,EACA,OAAA;AAAA,EACA,KAAA;AAAA,EACA,MAAA;AAAA,EAET,QAAA,GAA0B,IAAA;AAAA,EAC1B,IAAA,GAAqD,IAAA;AAAA,EACrD,aAAoC,EAAC;AAAA,EACrC,uBAA8C,EAAC;AAAA,EAEvD,YAAY,OAAA,EAA6B;AACvC,IAAA,IAAA,CAAK,IAAA,GAAW,OAAA,CAAQ,aAAA,CAAc,OAAA,CAAQ,OAAO,EAAE,CAAA;AACvD,IAAA,IAAA,CAAK,UAAW,OAAA,CAAQ,OAAA;AACxB,IAAA,IAAA,CAAK,QAAW,OAAA,CAAQ,KAAA;AACxB,IAAA,IAAA,CAAK,SAAW,OAAA,CAAQ,MAAA;AAAA,EAC1B;AAAA,EAEA,IAAY,SAAA,GAAoB;AAC9B,IAAA,OAAO,CAAA,EAAG,IAAA,CAAK,IAAI,CAAA,QAAA,EAAW,KAAK,OAAO,CAAA,CAAA;AAAA,EAC5C;AAAA,EAEA,kBAAkB,EAAA,EAA+B;AAC/C,IAAA,IAAA,CAAK,oBAAA,CAAqB,KAAK,EAAE,CAAA;AAAA,EACnC;AAAA,EAEA,MAAM,OAAA,GAAyB;AAC7B,IAAA,IAAI,IAAA,CAAK,oBAAA,CAAqB,MAAA,KAAW,CAAA,EAAG;AAC1C,MAAA,MAAM,IAAI,gBAAA;AAAA,QACR;AAAA,OACF;AAAA,IACF;AACA,IAAA,MAAM,KAAK,YAAA,EAAa;AACxB,IAAA,IAAA,CAAK,QAAA,EAAS;AACd,IAAA,MAAM,KAAK,cAAA,EAAe;AAC1B,IAAA,MAAM,KAAK,eAAA,EAAgB;AAAA,EAC7B;AAAA,EAEA,MAAM,YAAA,GAA8B;AAClC,IAAA,MAAM,MAAM,MAAM,KAAA,CAAM,CAAA,EAAG,IAAA,CAAK,SAAS,CAAA,WAAA,CAAA,EAAe;AAAA,MACtD,MAAA,EAAQ,MAAA;AAAA,MACR,OAAA,EAAS,EAAE,cAAA,EAAgB,kBAAA,EAAmB;AAAA,MAC9C,IAAA,EAAM,IAAA,CAAK,SAAA,CAAU,EAAE,MAAA,EAAQ,KAAK,KAAA,EAAO,MAAA,EAAQ,IAAA,CAAK,MAAA,EAAQ;AAAA,KACjE,CAAA;AACD,IAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACX,MAAA,MAAM,IAAI,cAAA;AAAA,QACR,+BAA+B,GAAA,CAAI,MAAM,WAAM,MAAM,GAAA,CAAI,MAAM,CAAA;AAAA,OACjE;AAAA,IACF;AACA,IAAA,MAAM,IAAA,GAAO,MAAM,GAAA,CAAI,IAAA,EAAK;AAC5B,IAAA,IAAI,CAAC,IAAA,CAAK,YAAA,EAAc,MAAM,IAAI,eAAe,sCAAsC,CAAA;AACvF,IAAA,IAAA,CAAK,WAAW,IAAA,CAAK,YAAA;AAAA,EACvB;AAAA,EAEQ,QAAA,GAAiB;AACvB,IAAA,IAAA,CAAK,IAAA,GAAO,kBAAA;AAAA,MACV,IAAI,GAAA,CAAI,CAAA,EAAG,IAAA,CAAK,SAAS,CAAA,8BAAA,CAAgC;AAAA,KAC3D;AAAA,EACF;AAAA,EAEA,MAAM,cAAA,GAAgC;AACpC,IAAA,IAAA,CAAK,cAAA,EAAe;AACpB,IAAA,MAAM,MAAM,MAAM,KAAA,CAAM,CAAA,EAAG,IAAA,CAAK,SAAS,CAAA,qBAAA,CAAA,EAAyB;AAAA,MAChE,MAAA,EAAQ,MAAA;AAAA,MACR,OAAA,EAAS;AAAA,QACP,cAAA,EAAgB,kBAAA;AAAA,QAChB,aAAA,EAAe,CAAA,OAAA,EAAU,IAAA,CAAK,QAAQ,CAAA;AAAA,OACxC;AAAA,MACA,IAAA,EAAM,KAAK,SAAA,CAAU;AAAA,QACnB,UAAA,EAAY,IAAA,CAAK,oBAAA,CAAqB,GAAA,CAAI,CAAA,EAAA,MAAO;AAAA,UAC/C,YAAa,EAAA,CAAG,UAAA;AAAA,UAChB,QAAa,EAAA,CAAG,MAAA;AAAA,UAChB,OAAa,EAAA,CAAG,KAAA;AAAA,UAChB,WAAA,EAAa,GAAG,WAAA,IAAe;AAAA,SACjC,CAAE;AAAA,OACH;AAAA,KACF,CAAA;AACD,IAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACX,MAAA,MAAM,IAAI,cAAA,CAAe,CAAA,kBAAA,EAAqB,GAAA,CAAI,MAAM,WAAM,MAAM,GAAA,CAAI,IAAA,EAAM,CAAA,CAAE,CAAA;AAAA,IAClF;AAAA,EACF;AAAA,EAEA,MAAM,eAAA,GAAiC;AACrC,IAAA,IAAA,CAAK,cAAA,EAAe;AACpB,IAAA,MAAM,MAAM,MAAM,KAAA,CAAM,CAAA,EAAG,IAAA,CAAK,SAAS,CAAA,gBAAA,CAAA,EAAoB;AAAA,MAC3D,SAAS,EAAE,aAAA,EAAe,CAAA,OAAA,EAAU,IAAA,CAAK,QAAQ,CAAA,CAAA;AAAG,KACrD,CAAA;AACD,IAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACX,MAAA,MAAM,IAAI,UAAA;AAAA,QACR,iCAAiC,GAAA,CAAI,MAAM,WAAM,MAAM,GAAA,CAAI,MAAM,CAAA;AAAA,OACnE;AAAA,IACF;AACA,IAAA,MAAM,IAAA,GAAO,MAAM,GAAA,CAAI,IAAA,EAAK;AAC5B,IAAA,IAAA,CAAK,UAAA,GAAa,IAAA,CAAK,UAAA,CAAW,GAAA,CAAI,CAAA,EAAA,MAAO;AAAA,MAC3C,aAAe,EAAA,CAAG,YAAA;AAAA,MAClB,YAAe,EAAA,CAAG,UAAA;AAAA,MAClB,QAAe,EAAA,CAAG,MAAA;AAAA,MAClB,OAAe,EAAA,CAAG,KAAA;AAAA,MAClB,aAAA,EAAe,EAAA,CAAG,cAAA,IAAkB;AAAC,KACvC,CAAE,CAAA;AAAA,EACJ;AAAA,EAEA,MAAM,cAAc,KAAA,EAAqC;AACvD,IAAA,IAAI,CAAC,IAAA,CAAK,IAAA,EAAM,IAAA,CAAK,QAAA,EAAS;AAC9B,IAAA,IAAI;AACF,MAAA,MAAM,EAAE,OAAA,EAAQ,GAAI,MAAM,SAAA,CAAU,KAAA,EAAO,KAAK,IAAK,CAAA;AACrD,MAAA,MAAM,CAAA,GAAI,OAAA;AACV,MAAA,MAAM,UAAA,GAAc,CAAA,CAAE,UAAU,CAAA,IAAgB,EAAA;AAOhD,MAAA,IAAI,WAAW,WAAA,EAAY,KAAM,IAAA,CAAK,OAAA,CAAQ,aAAY,EAAG;AAC3D,QAAA,MAAM,IAAI,eAAA;AAAA,UACR,CAAA,aAAA,EAAgB,UAAU,CAAA,mCAAA,EAAsC,IAAA,CAAK,OAAO,CAAA,EAAA;AAAA,SAC9E;AAAA,MACF;AAEA,MAAA,OAAO;AAAA,QACL,GAAA,EAAS,QAAQ,GAAA,IAAO,EAAA;AAAA,QACxB,OAAA,EAAS,UAAA;AAAA,QACT,MAAA,EAAU,CAAA,CAAE,QAAQ,CAAA,IAAkB,EAAC;AAAA,QACvC,GAAA,EAAS,QAAQ,GAAA,IAAO,CAAA;AAAA,QACxB,GAAA,EAAS;AAAA,OACX;AAAA,IACF,SAAS,GAAA,EAAK;AACZ,MAAA,IAAI,GAAA,YAAe,iBAAiB,MAAM,GAAA;AAC1C,MAAA,MAAM,IAAI,eAAA,CAAgB,CAAA,eAAA,EAAmB,GAAA,CAAc,OAAO,CAAA,CAAE,CAAA;AAAA,IACtE;AAAA,EACF;AAAA,EAEA,eAAA,CAAgB,MAAA,EAAqB,UAAA,EAAoB,MAAA,EAAyB;AAChF,IAAA,MAAM,EAAA,GAAK,KAAK,UAAA,CAAW,IAAA;AAAA,MACzB,CAAA,CAAA,KAAK,CAAA,CAAE,UAAA,KAAe,UAAA,IAAc,EAAE,MAAA,KAAW;AAAA,KACnD;AACA,IAAA,IAAI,CAAC,IAAI,OAAO,KAAA;AAChB,IAAA,IAAI,EAAA,CAAG,KAAA,KAAU,QAAA,EAAa,OAAO,IAAA;AACrC,IAAA,IAAI,GAAG,KAAA,KAAU,SAAA,EAAa,OAAO,MAAA,CAAO,OAAO,MAAA,GAAS,CAAA;AAC5D,IAAA,IAAI,EAAA,CAAG,KAAA,KAAU,WAAA,EAAa,OAAO,MAAA,CAAO,MAAA,CAAO,IAAA,CAAK,CAAA,CAAA,KAAK,EAAA,CAAG,aAAA,CAAc,QAAA,CAAS,CAAC,CAAC,CAAA;AACzF,IAAA,OAAO,KAAA;AAAA,EACT;AAAA;AAAA,EAGA,aAAa,OAAO,OAAA,EAAmD;AACrE,IAAA,MAAM,MAAA,GAAS,IAAI,YAAA,CAAY,OAAO,CAAA;AACtC,IAAA,KAAA,MAAW,EAAA,IAAM,WAAA,EAAY,EAAG,MAAA,CAAO,kBAAkB,EAAE,CAAA;AAC3D,IAAA,MAAM,OAAO,OAAA,EAAQ;AACrB,IAAA,OAAO,MAAA;AAAA,EACT;AAAA,EAEQ,cAAA,GAAuB;AAC7B,IAAA,IAAI,CAAC,KAAK,QAAA,EAAU;AAClB,MAAA,MAAM,IAAI,eAAe,uDAAuD,CAAA;AAAA,IAClF;AAAA,EACF;AACF","file":"chunk-G73YTEJQ.js","sourcesContent":["import { createRemoteJWKSet, jwtVerify, type JWTPayload } from 'jose';\nimport {\n  ArgosAuthError, ArgosConfigError, ArgosError,\n  ArgosSyncError, ArgosTokenError,\n} from './exceptions.js';\nimport type { OperationDescriptor, OperationWithGroups, TokenClaims } from './models.js';\nimport { getRegistry } from './registry.js';\n\nexport interface ArgosClientOptions {\n  authorizerUrl: string;\n  realmId: string;\n  appId: string;\n  secret: string;\n}\n\nexport class ArgosClient {\n  private readonly base: string;\n  private readonly realmId: string;\n  private readonly appId: string;\n  private readonly secret: string;\n\n  private appToken: string | null = null;\n  private jwks: ReturnType<typeof createRemoteJWKSet> | null = null;\n  private operations: OperationWithGroups[] = [];\n  private registeredOperations: OperationDescriptor[] = [];\n\n  constructor(options: ArgosClientOptions) {\n    this.base     = options.authorizerUrl.replace(/\\/$/, '');\n    this.realmId  = options.realmId;\n    this.appId    = options.appId;\n    this.secret   = options.secret;\n  }\n\n  private get realmBase(): string {\n    return `${this.base}/realms/${this.realmId}`;\n  }\n\n  registerOperation(op: OperationDescriptor): void {\n    this.registeredOperations.push(op);\n  }\n\n  async startup(): Promise<void> {\n    if (this.registeredOperations.length === 0) {\n      throw new ArgosConfigError(\n        'No operations registered. Call registerOperation() before startup().',\n      );\n    }\n    await this.authenticate();\n    this.initJwks();\n    await this.syncOperations();\n    await this.fetchOperations();\n  }\n\n  async authenticate(): Promise<void> {\n    const res = await fetch(`${this.realmBase}/apps/token`, {\n      method: 'POST',\n      headers: { 'Content-Type': 'application/json' },\n      body: JSON.stringify({ app_id: this.appId, secret: this.secret }),\n    });\n    if (!res.ok) {\n      throw new ArgosAuthError(\n        `Authentication failed: HTTP ${res.status} — ${await res.text()}`,\n      );\n    }\n    const data = await res.json() as { access_token?: string };\n    if (!data.access_token) throw new ArgosAuthError('Authorizer returned no access_token.');\n    this.appToken = data.access_token;\n  }\n\n  private initJwks(): void {\n    this.jwks = createRemoteJWKSet(\n      new URL(`${this.realmBase}/protocol/openid-connect/certs`),\n    );\n  }\n\n  async syncOperations(): Promise<void> {\n    this.ensureAppToken();\n    const res = await fetch(`${this.realmBase}/apps/operations/sync`, {\n      method: 'POST',\n      headers: {\n        'Content-Type': 'application/json',\n        Authorization: `Bearer ${this.appToken}`,\n      },\n      body: JSON.stringify({\n        operations: this.registeredOperations.map(op => ({\n          identifier:  op.identifier,\n          method:      op.method,\n          level:       op.level,\n          description: op.description ?? null,\n        })),\n      }),\n    });\n    if (!res.ok) {\n      throw new ArgosSyncError(`Sync failed: HTTP ${res.status} — ${await res.text()}`);\n    }\n  }\n\n  async fetchOperations(): Promise<void> {\n    this.ensureAppToken();\n    const res = await fetch(`${this.realmBase}/apps/operations`, {\n      headers: { Authorization: `Bearer ${this.appToken}` },\n    });\n    if (!res.ok) {\n      throw new ArgosError(\n        `Fetch operations failed: HTTP ${res.status} — ${await res.text()}`,\n      );\n    }\n    const data = await res.json() as { operations: any[] };\n    this.operations = data.operations.map(op => ({\n      operationId:   op.operation_id,\n      identifier:    op.identifier,\n      method:        op.method,\n      level:         op.level,\n      allowedGroups: op.allowed_groups ?? [],\n    }));\n  }\n\n  async validateToken(token: string): Promise<TokenClaims> {\n    if (!this.jwks) this.initJwks();\n    try {\n      const { payload } = await jwtVerify(token, this.jwks!);\n      const p = payload as JWTPayload & Record<string, unknown>;\n      const tokenRealm = (p['realm_id'] as string) ?? '';\n\n      // As chaves JWKS já são buscadas em /realms/{this.realmId}/... (ver\n      // realmBase), então um token de outro realm normalmente já falharia a\n      // verificação de assinatura acima. Esta checagem é defesa em\n      // profundidade explícita — não depende desse efeito colateral, e falha\n      // com uma mensagem clara em vez de erro de assinatura.\n      if (tokenRealm.toLowerCase() !== this.realmId.toLowerCase()) {\n        throw new ArgosTokenError(\n          `Token realm '${tokenRealm}' does not match this app's realm '${this.realmId}'.`,\n        );\n      }\n\n      return {\n        sub:     payload.sub ?? '',\n        realmId: tokenRealm,\n        groups:  (p['groups'] as string[]) ?? [],\n        exp:     payload.exp ?? 0,\n        raw:     p,\n      };\n    } catch (err) {\n      if (err instanceof ArgosTokenError) throw err;\n      throw new ArgosTokenError(`Invalid token: ${(err as Error).message}`);\n    }\n  }\n\n  checkPermission(claims: TokenClaims, identifier: string, method: string): boolean {\n    const op = this.operations.find(\n      o => o.identifier === identifier && o.method === method,\n    );\n    if (!op) return false;\n    if (op.level === 'public')    return true;\n    if (op.level === 'private')   return claims.groups.length > 0;\n    if (op.level === 'protected') return claims.groups.some(g => op.allowedGroups.includes(g));\n    return false;\n  }\n\n  /** Load operations from the global registry and bootstrap the client. */\n  static async create(options: ArgosClientOptions): Promise<ArgosClient> {\n    const client = new ArgosClient(options);\n    for (const op of getRegistry()) client.registerOperation(op);\n    await client.startup();\n    return client;\n  }\n\n  private ensureAppToken(): void {\n    if (!this.appToken) {\n      throw new ArgosAuthError('No app token. Call authenticate() or startup() first.');\n    }\n  }\n}"]}

package/dist/chunk-HV6X5RJY.js

@@ -0,0 +1,37 @@
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __decorateClass = (decorators, target, key, kind) => {
+  var result = kind > 1 ? void 0 : kind ? __getOwnPropDesc(target, key) : target;
+  for (var i = decorators.length - 1, decorator; i >= 0; i--)
+    if (decorator = decorators[i])
+      result = (kind ? decorator(target, key, result) : decorator(result)) || result;
+  if (kind && result) __defProp(target, key, result);
+  return result;
+};
+var __decorateParam = (index, decorator) => (target, key) => decorator(target, key, index);
+
+// src/registry.ts
+var _registry = [];
+function detectMethod(id) {
+  const last = (id.split(":").pop() ?? "").toLowerCase();
+  if (/^(get|list|fetch|read)/.test(last)) return "read";
+  if (/^(delete|remove|destroy)/.test(last)) return "delete";
+  if (/(stream|subscribe|watch|listen)/.test(last)) return "stream";
+  return "write";
+}
+function registerOperation(op) {
+  const exists = _registry.some(
+    (o) => o.identifier === op.identifier && o.method === op.method
+  );
+  if (!exists) _registry.push(op);
+}
+function getRegistry() {
+  return [..._registry];
+}
+function clearRegistry() {
+  _registry.length = 0;
+}
+
+export { __decorateClass, __decorateParam, clearRegistry, detectMethod, getRegistry, registerOperation };
+//# sourceMappingURL=chunk-HV6X5RJY.js.map
+//# sourceMappingURL=chunk-HV6X5RJY.js.map

package/dist/chunk-HV6X5RJY.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/registry.ts"],"names":[],"mappings":";;;;;;;;;;;;;AAEA,IAAM,YAAmC,EAAC;AAKnC,SAAS,aAAa,EAAA,EAAoB;AAC/C,EAAA,MAAM,IAAA,GAAA,CAAQ,GAAG,KAAA,CAAM,GAAG,EAAE,GAAA,EAAI,IAAK,IAAI,WAAA,EAAY;AACrD,EAAA,IAAI,wBAAA,CAAyB,IAAA,CAAK,IAAI,CAAA,EAAS,OAAO,MAAA;AACtD,EAAA,IAAI,0BAAA,CAA2B,IAAA,CAAK,IAAI,CAAA,EAAQ,OAAO,QAAA;AACvD,EAAA,IAAI,iCAAA,CAAkC,IAAA,CAAK,IAAI,CAAA,EAAG,OAAO,QAAA;AACzD,EAAA,OAAO,OAAA;AACT;AAGO,SAAS,kBAAkB,EAAA,EAA+B;AAC/D,EAAA,MAAM,SAAS,SAAA,CAAU,IAAA;AAAA,IACvB,OAAK,CAAA,CAAE,UAAA,KAAe,GAAG,UAAA,IAAc,CAAA,CAAE,WAAW,EAAA,CAAG;AAAA,GACzD;AACA,EAAA,IAAI,CAAC,MAAA,EAAQ,SAAA,CAAU,IAAA,CAAK,EAAE,CAAA;AAChC;AAEO,SAAS,WAAA,GAAqC;AACnD,EAAA,OAAO,CAAC,GAAG,SAAS,CAAA;AACtB;AAEO,SAAS,aAAA,GAAsB;AACpC,EAAA,SAAA,CAAU,MAAA,GAAS,CAAA;AACrB","file":"chunk-HV6X5RJY.js","sourcesContent":["import type { OperationDescriptor } from './models.js';\n\nconst _registry: OperationDescriptor[] = [];\n\n/** Infer operation method from the last segment of the operation id.\n *  e.g. \"tasks:list\" → \"read\", \"tasks:create\" → \"write\", \"tasks:delete\" → \"delete\"\n */\nexport function detectMethod(id: string): string {\n  const last = (id.split(':').pop() ?? '').toLowerCase();\n  if (/^(get|list|fetch|read)/.test(last))       return 'read';\n  if (/^(delete|remove|destroy)/.test(last))      return 'delete';\n  if (/(stream|subscribe|watch|listen)/.test(last)) return 'stream';\n  return 'write';\n}\n\n/** Register an operation in the global registry (used by startup to sync). */\nexport function registerOperation(op: OperationDescriptor): void {\n  const exists = _registry.some(\n    o => o.identifier === op.identifier && o.method === op.method,\n  );\n  if (!exists) _registry.push(op);\n}\n\nexport function getRegistry(): OperationDescriptor[] {\n  return [..._registry];\n}\n\nexport function clearRegistry(): void {\n  _registry.length = 0;\n}"]}

package/dist/client-Cgm1csuM.d.cts

@@ -0,0 +1,49 @@
+interface TokenClaims {
+    sub: string;
+    realmId: string;
+    groups: string[];
+    exp: number;
+    raw: Record<string, unknown>;
+}
+interface OperationDescriptor {
+    identifier: string;
+    method: string;
+    level: string;
+    description?: string | null;
+}
+interface OperationWithGroups extends OperationDescriptor {
+    operationId: string;
+    allowedGroups: string[];
+}
+
+interface ArgosClientOptions {
+    authorizerUrl: string;
+    realmId: string;
+    appId: string;
+    secret: string;
+}
+declare class ArgosClient {
+    private readonly base;
+    private readonly realmId;
+    private readonly appId;
+    private readonly secret;
+    private appToken;
+    private jwks;
+    private operations;
+    private registeredOperations;
+    constructor(options: ArgosClientOptions);
+    private get realmBase();
+    registerOperation(op: OperationDescriptor): void;
+    startup(): Promise<void>;
+    authenticate(): Promise<void>;
+    private initJwks;
+    syncOperations(): Promise<void>;
+    fetchOperations(): Promise<void>;
+    validateToken(token: string): Promise<TokenClaims>;
+    checkPermission(claims: TokenClaims, identifier: string, method: string): boolean;
+    /** Load operations from the global registry and bootstrap the client. */
+    static create(options: ArgosClientOptions): Promise<ArgosClient>;
+    private ensureAppToken;
+}
+
+export { ArgosClient as A, type OperationDescriptor as O, type TokenClaims as T, type ArgosClientOptions as a, type OperationWithGroups as b };

package/dist/client-Cgm1csuM.d.ts

@@ -0,0 +1,49 @@
+interface TokenClaims {
+    sub: string;
+    realmId: string;
+    groups: string[];
+    exp: number;
+    raw: Record<string, unknown>;
+}
+interface OperationDescriptor {
+    identifier: string;
+    method: string;
+    level: string;
+    description?: string | null;
+}
+interface OperationWithGroups extends OperationDescriptor {
+    operationId: string;
+    allowedGroups: string[];
+}
+
+interface ArgosClientOptions {
+    authorizerUrl: string;
+    realmId: string;
+    appId: string;
+    secret: string;
+}
+declare class ArgosClient {
+    private readonly base;
+    private readonly realmId;
+    private readonly appId;
+    private readonly secret;
+    private appToken;
+    private jwks;
+    private operations;
+    private registeredOperations;
+    constructor(options: ArgosClientOptions);
+    private get realmBase();
+    registerOperation(op: OperationDescriptor): void;
+    startup(): Promise<void>;
+    authenticate(): Promise<void>;
+    private initJwks;
+    syncOperations(): Promise<void>;
+    fetchOperations(): Promise<void>;
+    validateToken(token: string): Promise<TokenClaims>;
+    checkPermission(claims: TokenClaims, identifier: string, method: string): boolean;
+    /** Load operations from the global registry and bootstrap the client. */
+    static create(options: ArgosClientOptions): Promise<ArgosClient>;
+    private ensureAppToken;
+}
+
+export { ArgosClient as A, type OperationDescriptor as O, type TokenClaims as T, type ArgosClientOptions as a, type OperationWithGroups as b };

package/dist/index.cjs

@@ -0,0 +1,199 @@
+'use strict';
+
+var jose = require('jose');
+
+// src/client.ts
+
+// src/exceptions.ts
+var ArgosError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = this.constructor.name;
+  }
+};
+var ArgosAuthError = class extends ArgosError {
+};
+var ArgosTokenError = class extends ArgosError {
+};
+var ArgosForbiddenError = class extends ArgosError {
+};
+var ArgosSyncError = class extends ArgosError {
+};
+var ArgosConfigError = class extends ArgosError {
+};
+
+// src/registry.ts
+var _registry = [];
+function detectMethod(id) {
+  const last = (id.split(":").pop() ?? "").toLowerCase();
+  if (/^(get|list|fetch|read)/.test(last)) return "read";
+  if (/^(delete|remove|destroy)/.test(last)) return "delete";
+  if (/(stream|subscribe|watch|listen)/.test(last)) return "stream";
+  return "write";
+}
+function registerOperation(op) {
+  const exists = _registry.some(
+    (o) => o.identifier === op.identifier && o.method === op.method
+  );
+  if (!exists) _registry.push(op);
+}
+function getRegistry() {
+  return [..._registry];
+}
+function clearRegistry() {
+  _registry.length = 0;
+}
+
+// src/client.ts
+var ArgosClient = class _ArgosClient {
+  base;
+  realmId;
+  appId;
+  secret;
+  appToken = null;
+  jwks = null;
+  operations = [];
+  registeredOperations = [];
+  constructor(options) {
+    this.base = options.authorizerUrl.replace(/\/$/, "");
+    this.realmId = options.realmId;
+    this.appId = options.appId;
+    this.secret = options.secret;
+  }
+  get realmBase() {
+    return `${this.base}/realms/${this.realmId}`;
+  }
+  registerOperation(op) {
+    this.registeredOperations.push(op);
+  }
+  async startup() {
+    if (this.registeredOperations.length === 0) {
+      throw new ArgosConfigError(
+        "No operations registered. Call registerOperation() before startup()."
+      );
+    }
+    await this.authenticate();
+    this.initJwks();
+    await this.syncOperations();
+    await this.fetchOperations();
+  }
+  async authenticate() {
+    const res = await fetch(`${this.realmBase}/apps/token`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ app_id: this.appId, secret: this.secret })
+    });
+    if (!res.ok) {
+      throw new ArgosAuthError(
+        `Authentication failed: HTTP ${res.status} \u2014 ${await res.text()}`
+      );
+    }
+    const data = await res.json();
+    if (!data.access_token) throw new ArgosAuthError("Authorizer returned no access_token.");
+    this.appToken = data.access_token;
+  }
+  initJwks() {
+    this.jwks = jose.createRemoteJWKSet(
+      new URL(`${this.realmBase}/protocol/openid-connect/certs`)
+    );
+  }
+  async syncOperations() {
+    this.ensureAppToken();
+    const res = await fetch(`${this.realmBase}/apps/operations/sync`, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        Authorization: `Bearer ${this.appToken}`
+      },
+      body: JSON.stringify({
+        operations: this.registeredOperations.map((op) => ({
+          identifier: op.identifier,
+          method: op.method,
+          level: op.level,
+          description: op.description ?? null
+        }))
+      })
+    });
+    if (!res.ok) {
+      throw new ArgosSyncError(`Sync failed: HTTP ${res.status} \u2014 ${await res.text()}`);
+    }
+  }
+  async fetchOperations() {
+    this.ensureAppToken();
+    const res = await fetch(`${this.realmBase}/apps/operations`, {
+      headers: { Authorization: `Bearer ${this.appToken}` }
+    });
+    if (!res.ok) {
+      throw new ArgosError(
+        `Fetch operations failed: HTTP ${res.status} \u2014 ${await res.text()}`
+      );
+    }
+    const data = await res.json();
+    this.operations = data.operations.map((op) => ({
+      operationId: op.operation_id,
+      identifier: op.identifier,
+      method: op.method,
+      level: op.level,
+      allowedGroups: op.allowed_groups ?? []
+    }));
+  }
+  async validateToken(token) {
+    if (!this.jwks) this.initJwks();
+    try {
+      const { payload } = await jose.jwtVerify(token, this.jwks);
+      const p = payload;
+      const tokenRealm = p["realm_id"] ?? "";
+      if (tokenRealm.toLowerCase() !== this.realmId.toLowerCase()) {
+        throw new ArgosTokenError(
+          `Token realm '${tokenRealm}' does not match this app's realm '${this.realmId}'.`
+        );
+      }
+      return {
+        sub: payload.sub ?? "",
+        realmId: tokenRealm,
+        groups: p["groups"] ?? [],
+        exp: payload.exp ?? 0,
+        raw: p
+      };
+    } catch (err) {
+      if (err instanceof ArgosTokenError) throw err;
+      throw new ArgosTokenError(`Invalid token: ${err.message}`);
+    }
+  }
+  checkPermission(claims, identifier, method) {
+    const op = this.operations.find(
+      (o) => o.identifier === identifier && o.method === method
+    );
+    if (!op) return false;
+    if (op.level === "public") return true;
+    if (op.level === "private") return claims.groups.length > 0;
+    if (op.level === "protected") return claims.groups.some((g) => op.allowedGroups.includes(g));
+    return false;
+  }
+  /** Load operations from the global registry and bootstrap the client. */
+  static async create(options) {
+    const client = new _ArgosClient(options);
+    for (const op of getRegistry()) client.registerOperation(op);
+    await client.startup();
+    return client;
+  }
+  ensureAppToken() {
+    if (!this.appToken) {
+      throw new ArgosAuthError("No app token. Call authenticate() or startup() first.");
+    }
+  }
+};
+
+exports.ArgosAuthError = ArgosAuthError;
+exports.ArgosClient = ArgosClient;
+exports.ArgosConfigError = ArgosConfigError;
+exports.ArgosError = ArgosError;
+exports.ArgosForbiddenError = ArgosForbiddenError;
+exports.ArgosSyncError = ArgosSyncError;
+exports.ArgosTokenError = ArgosTokenError;
+exports.clearRegistry = clearRegistry;
+exports.detectMethod = detectMethod;
+exports.getRegistry = getRegistry;
+exports.registerOperation = registerOperation;
+//# sourceMappingURL=index.cjs.map
+//# sourceMappingURL=index.cjs.map

package/dist/index.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/exceptions.ts","../src/registry.ts","../src/client.ts"],"names":["createRemoteJWKSet","jwtVerify"],"mappings":";;;;;;;AAAO,IAAM,UAAA,GAAN,cAAyB,KAAA,CAAM;AAAA,EACpC,YAAY,OAAA,EAAiB;AAC3B,IAAA,KAAA,CAAM,OAAO,CAAA;AACb,IAAA,IAAA,CAAK,IAAA,GAAO,KAAK,WAAA,CAAY,IAAA;AAAA,EAC/B;AACF;AAEO,IAAM,cAAA,GAAN,cAAgC,UAAA,CAAW;AAAC;AAC5C,IAAM,eAAA,GAAN,cAAgC,UAAA,CAAW;AAAC;AAC5C,IAAM,mBAAA,GAAN,cAAkC,UAAA,CAAW;AAAC;AAC9C,IAAM,cAAA,GAAN,cAAgC,UAAA,CAAW;AAAC;AAC5C,IAAM,gBAAA,GAAN,cAAgC,UAAA,CAAW;AAAC;;;ACTnD,IAAM,YAAmC,EAAC;AAKnC,SAAS,aAAa,EAAA,EAAoB;AAC/C,EAAA,MAAM,IAAA,GAAA,CAAQ,GAAG,KAAA,CAAM,GAAG,EAAE,GAAA,EAAI,IAAK,IAAI,WAAA,EAAY;AACrD,EAAA,IAAI,wBAAA,CAAyB,IAAA,CAAK,IAAI,CAAA,EAAS,OAAO,MAAA;AACtD,EAAA,IAAI,0BAAA,CAA2B,IAAA,CAAK,IAAI,CAAA,EAAQ,OAAO,QAAA;AACvD,EAAA,IAAI,iCAAA,CAAkC,IAAA,CAAK,IAAI,CAAA,EAAG,OAAO,QAAA;AACzD,EAAA,OAAO,OAAA;AACT;AAGO,SAAS,kBAAkB,EAAA,EAA+B;AAC/D,EAAA,MAAM,SAAS,SAAA,CAAU,IAAA;AAAA,IACvB,OAAK,CAAA,CAAE,UAAA,KAAe,GAAG,UAAA,IAAc,CAAA,CAAE,WAAW,EAAA,CAAG;AAAA,GACzD;AACA,EAAA,IAAI,CAAC,MAAA,EAAQ,SAAA,CAAU,IAAA,CAAK,EAAE,CAAA;AAChC;AAEO,SAAS,WAAA,GAAqC;AACnD,EAAA,OAAO,CAAC,GAAG,SAAS,CAAA;AACtB;AAEO,SAAS,aAAA,GAAsB;AACpC,EAAA,SAAA,CAAU,MAAA,GAAS,CAAA;AACrB;;;ACdO,IAAM,WAAA,GAAN,MAAM,YAAA,CAAY;AAAA,EACN,IAAA;AAAA,EACA,OAAA;AAAA,EACA,KAAA;AAAA,EACA,MAAA;AAAA,EAET,QAAA,GAA0B,IAAA;AAAA,EAC1B,IAAA,GAAqD,IAAA;AAAA,EACrD,aAAoC,EAAC;AAAA,EACrC,uBAA8C,EAAC;AAAA,EAEvD,YAAY,OAAA,EAA6B;AACvC,IAAA,IAAA,CAAK,IAAA,GAAW,OAAA,CAAQ,aAAA,CAAc,OAAA,CAAQ,OAAO,EAAE,CAAA;AACvD,IAAA,IAAA,CAAK,UAAW,OAAA,CAAQ,OAAA;AACxB,IAAA,IAAA,CAAK,QAAW,OAAA,CAAQ,KAAA;AACxB,IAAA,IAAA,CAAK,SAAW,OAAA,CAAQ,MAAA;AAAA,EAC1B;AAAA,EAEA,IAAY,SAAA,GAAoB;AAC9B,IAAA,OAAO,CAAA,EAAG,IAAA,CAAK,IAAI,CAAA,QAAA,EAAW,KAAK,OAAO,CAAA,CAAA;AAAA,EAC5C;AAAA,EAEA,kBAAkB,EAAA,EAA+B;AAC/C,IAAA,IAAA,CAAK,oBAAA,CAAqB,KAAK,EAAE,CAAA;AAAA,EACnC;AAAA,EAEA,MAAM,OAAA,GAAyB;AAC7B,IAAA,IAAI,IAAA,CAAK,oBAAA,CAAqB,MAAA,KAAW,CAAA,EAAG;AAC1C,MAAA,MAAM,IAAI,gBAAA;AAAA,QACR;AAAA,OACF;AAAA,IACF;AACA,IAAA,MAAM,KAAK,YAAA,EAAa;AACxB,IAAA,IAAA,CAAK,QAAA,EAAS;AACd,IAAA,MAAM,KAAK,cAAA,EAAe;AAC1B,IAAA,MAAM,KAAK,eAAA,EAAgB;AAAA,EAC7B;AAAA,EAEA,MAAM,YAAA,GAA8B;AAClC,IAAA,MAAM,MAAM,MAAM,KAAA,CAAM,CAAA,EAAG,IAAA,CAAK,SAAS,CAAA,WAAA,CAAA,EAAe;AAAA,MACtD,MAAA,EAAQ,MAAA;AAAA,MACR,OAAA,EAAS,EAAE,cAAA,EAAgB,kBAAA,EAAmB;AAAA,MAC9C,IAAA,EAAM,IAAA,CAAK,SAAA,CAAU,EAAE,MAAA,EAAQ,KAAK,KAAA,EAAO,MAAA,EAAQ,IAAA,CAAK,MAAA,EAAQ;AAAA,KACjE,CAAA;AACD,IAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACX,MAAA,MAAM,IAAI,cAAA;AAAA,QACR,+BAA+B,GAAA,CAAI,MAAM,WAAM,MAAM,GAAA,CAAI,MAAM,CAAA;AAAA,OACjE;AAAA,IACF;AACA,IAAA,MAAM,IAAA,GAAO,MAAM,GAAA,CAAI,IAAA,EAAK;AAC5B,IAAA,IAAI,CAAC,IAAA,CAAK,YAAA,EAAc,MAAM,IAAI,eAAe,sCAAsC,CAAA;AACvF,IAAA,IAAA,CAAK,WAAW,IAAA,CAAK,YAAA;AAAA,EACvB;AAAA,EAEQ,QAAA,GAAiB;AACvB,IAAA,IAAA,CAAK,IAAA,GAAOA,uBAAA;AAAA,MACV,IAAI,GAAA,CAAI,CAAA,EAAG,IAAA,CAAK,SAAS,CAAA,8BAAA,CAAgC;AAAA,KAC3D;AAAA,EACF;AAAA,EAEA,MAAM,cAAA,GAAgC;AACpC,IAAA,IAAA,CAAK,cAAA,EAAe;AACpB,IAAA,MAAM,MAAM,MAAM,KAAA,CAAM,CAAA,EAAG,IAAA,CAAK,SAAS,CAAA,qBAAA,CAAA,EAAyB;AAAA,MAChE,MAAA,EAAQ,MAAA;AAAA,MACR,OAAA,EAAS;AAAA,QACP,cAAA,EAAgB,kBAAA;AAAA,QAChB,aAAA,EAAe,CAAA,OAAA,EAAU,IAAA,CAAK,QAAQ,CAAA;AAAA,OACxC;AAAA,MACA,IAAA,EAAM,KAAK,SAAA,CAAU;AAAA,QACnB,UAAA,EAAY,IAAA,CAAK,oBAAA,CAAqB,GAAA,CAAI,CAAA,EAAA,MAAO;AAAA,UAC/C,YAAa,EAAA,CAAG,UAAA;AAAA,UAChB,QAAa,EAAA,CAAG,MAAA;AAAA,UAChB,OAAa,EAAA,CAAG,KAAA;AAAA,UAChB,WAAA,EAAa,GAAG,WAAA,IAAe;AAAA,SACjC,CAAE;AAAA,OACH;AAAA,KACF,CAAA;AACD,IAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACX,MAAA,MAAM,IAAI,cAAA,CAAe,CAAA,kBAAA,EAAqB,GAAA,CAAI,MAAM,WAAM,MAAM,GAAA,CAAI,IAAA,EAAM,CAAA,CAAE,CAAA;AAAA,IAClF;AAAA,EACF;AAAA,EAEA,MAAM,eAAA,GAAiC;AACrC,IAAA,IAAA,CAAK,cAAA,EAAe;AACpB,IAAA,MAAM,MAAM,MAAM,KAAA,CAAM,CAAA,EAAG,IAAA,CAAK,SAAS,CAAA,gBAAA,CAAA,EAAoB;AAAA,MAC3D,SAAS,EAAE,aAAA,EAAe,CAAA,OAAA,EAAU,IAAA,CAAK,QAAQ,CAAA,CAAA;AAAG,KACrD,CAAA;AACD,IAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACX,MAAA,MAAM,IAAI,UAAA;AAAA,QACR,iCAAiC,GAAA,CAAI,MAAM,WAAM,MAAM,GAAA,CAAI,MAAM,CAAA;AAAA,OACnE;AAAA,IACF;AACA,IAAA,MAAM,IAAA,GAAO,MAAM,GAAA,CAAI,IAAA,EAAK;AAC5B,IAAA,IAAA,CAAK,UAAA,GAAa,IAAA,CAAK,UAAA,CAAW,GAAA,CAAI,CAAA,EAAA,MAAO;AAAA,MAC3C,aAAe,EAAA,CAAG,YAAA;AAAA,MAClB,YAAe,EAAA,CAAG,UAAA;AAAA,MAClB,QAAe,EAAA,CAAG,MAAA;AAAA,MAClB,OAAe,EAAA,CAAG,KAAA;AAAA,MAClB,aAAA,EAAe,EAAA,CAAG,cAAA,IAAkB;AAAC,KACvC,CAAE,CAAA;AAAA,EACJ;AAAA,EAEA,MAAM,cAAc,KAAA,EAAqC;AACvD,IAAA,IAAI,CAAC,IAAA,CAAK,IAAA,EAAM,IAAA,CAAK,QAAA,EAAS;AAC9B,IAAA,IAAI;AACF,MAAA,MAAM,EAAE,OAAA,EAAQ,GAAI,MAAMC,cAAA,CAAU,KAAA,EAAO,KAAK,IAAK,CAAA;AACrD,MAAA,MAAM,CAAA,GAAI,OAAA;AACV,MAAA,MAAM,UAAA,GAAc,CAAA,CAAE,UAAU,CAAA,IAAgB,EAAA;AAOhD,MAAA,IAAI,WAAW,WAAA,EAAY,KAAM,IAAA,CAAK,OAAA,CAAQ,aAAY,EAAG;AAC3D,QAAA,MAAM,IAAI,eAAA;AAAA,UACR,CAAA,aAAA,EAAgB,UAAU,CAAA,mCAAA,EAAsC,IAAA,CAAK,OAAO,CAAA,EAAA;AAAA,SAC9E;AAAA,MACF;AAEA,MAAA,OAAO;AAAA,QACL,GAAA,EAAS,QAAQ,GAAA,IAAO,EAAA;AAAA,QACxB,OAAA,EAAS,UAAA;AAAA,QACT,MAAA,EAAU,CAAA,CAAE,QAAQ,CAAA,IAAkB,EAAC;AAAA,QACvC,GAAA,EAAS,QAAQ,GAAA,IAAO,CAAA;AAAA,QACxB,GAAA,EAAS;AAAA,OACX;AAAA,IACF,SAAS,GAAA,EAAK;AACZ,MAAA,IAAI,GAAA,YAAe,iBAAiB,MAAM,GAAA;AAC1C,MAAA,MAAM,IAAI,eAAA,CAAgB,CAAA,eAAA,EAAmB,GAAA,CAAc,OAAO,CAAA,CAAE,CAAA;AAAA,IACtE;AAAA,EACF;AAAA,EAEA,eAAA,CAAgB,MAAA,EAAqB,UAAA,EAAoB,MAAA,EAAyB;AAChF,IAAA,MAAM,EAAA,GAAK,KAAK,UAAA,CAAW,IAAA;AAAA,MACzB,CAAA,CAAA,KAAK,CAAA,CAAE,UAAA,KAAe,UAAA,IAAc,EAAE,MAAA,KAAW;AAAA,KACnD;AACA,IAAA,IAAI,CAAC,IAAI,OAAO,KAAA;AAChB,IAAA,IAAI,EAAA,CAAG,KAAA,KAAU,QAAA,EAAa,OAAO,IAAA;AACrC,IAAA,IAAI,GAAG,KAAA,KAAU,SAAA,EAAa,OAAO,MAAA,CAAO,OAAO,MAAA,GAAS,CAAA;AAC5D,IAAA,IAAI,EAAA,CAAG,KAAA,KAAU,WAAA,EAAa,OAAO,MAAA,CAAO,MAAA,CAAO,IAAA,CAAK,CAAA,CAAA,KAAK,EAAA,CAAG,aAAA,CAAc,QAAA,CAAS,CAAC,CAAC,CAAA;AACzF,IAAA,OAAO,KAAA;AAAA,EACT;AAAA;AAAA,EAGA,aAAa,OAAO,OAAA,EAAmD;AACrE,IAAA,MAAM,MAAA,GAAS,IAAI,YAAA,CAAY,OAAO,CAAA;AACtC,IAAA,KAAA,MAAW,EAAA,IAAM,WAAA,EAAY,EAAG,MAAA,CAAO,kBAAkB,EAAE,CAAA;AAC3D,IAAA,MAAM,OAAO,OAAA,EAAQ;AACrB,IAAA,OAAO,MAAA;AAAA,EACT;AAAA,EAEQ,cAAA,GAAuB;AAC7B,IAAA,IAAI,CAAC,KAAK,QAAA,EAAU;AAClB,MAAA,MAAM,IAAI,eAAe,uDAAuD,CAAA;AAAA,IAClF;AAAA,EACF;AACF","file":"index.cjs","sourcesContent":["export class ArgosError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = this.constructor.name;\n  }\n}\n\nexport class ArgosAuthError    extends ArgosError {}\nexport class ArgosTokenError   extends ArgosError {}\nexport class ArgosForbiddenError extends ArgosError {}\nexport class ArgosSyncError    extends ArgosError {}\nexport class ArgosConfigError  extends ArgosError {}","import type { OperationDescriptor } from './models.js';\n\nconst _registry: OperationDescriptor[] = [];\n\n/** Infer operation method from the last segment of the operation id.\n *  e.g. \"tasks:list\" → \"read\", \"tasks:create\" → \"write\", \"tasks:delete\" → \"delete\"\n */\nexport function detectMethod(id: string): string {\n  const last = (id.split(':').pop() ?? '').toLowerCase();\n  if (/^(get|list|fetch|read)/.test(last))       return 'read';\n  if (/^(delete|remove|destroy)/.test(last))      return 'delete';\n  if (/(stream|subscribe|watch|listen)/.test(last)) return 'stream';\n  return 'write';\n}\n\n/** Register an operation in the global registry (used by startup to sync). */\nexport function registerOperation(op: OperationDescriptor): void {\n  const exists = _registry.some(\n    o => o.identifier === op.identifier && o.method === op.method,\n  );\n  if (!exists) _registry.push(op);\n}\n\nexport function getRegistry(): OperationDescriptor[] {\n  return [..._registry];\n}\n\nexport function clearRegistry(): void {\n  _registry.length = 0;\n}","import { createRemoteJWKSet, jwtVerify, type JWTPayload } from 'jose';\nimport {\n  ArgosAuthError, ArgosConfigError, ArgosError,\n  ArgosSyncError, ArgosTokenError,\n} from './exceptions.js';\nimport type { OperationDescriptor, OperationWithGroups, TokenClaims } from './models.js';\nimport { getRegistry } from './registry.js';\n\nexport interface ArgosClientOptions {\n  authorizerUrl: string;\n  realmId: string;\n  appId: string;\n  secret: string;\n}\n\nexport class ArgosClient {\n  private readonly base: string;\n  private readonly realmId: string;\n  private readonly appId: string;\n  private readonly secret: string;\n\n  private appToken: string | null = null;\n  private jwks: ReturnType<typeof createRemoteJWKSet> | null = null;\n  private operations: OperationWithGroups[] = [];\n  private registeredOperations: OperationDescriptor[] = [];\n\n  constructor(options: ArgosClientOptions) {\n    this.base     = options.authorizerUrl.replace(/\\/$/, '');\n    this.realmId  = options.realmId;\n    this.appId    = options.appId;\n    this.secret   = options.secret;\n  }\n\n  private get realmBase(): string {\n    return `${this.base}/realms/${this.realmId}`;\n  }\n\n  registerOperation(op: OperationDescriptor): void {\n    this.registeredOperations.push(op);\n  }\n\n  async startup(): Promise<void> {\n    if (this.registeredOperations.length === 0) {\n      throw new ArgosConfigError(\n        'No operations registered. Call registerOperation() before startup().',\n      );\n    }\n    await this.authenticate();\n    this.initJwks();\n    await this.syncOperations();\n    await this.fetchOperations();\n  }\n\n  async authenticate(): Promise<void> {\n    const res = await fetch(`${this.realmBase}/apps/token`, {\n      method: 'POST',\n      headers: { 'Content-Type': 'application/json' },\n      body: JSON.stringify({ app_id: this.appId, secret: this.secret }),\n    });\n    if (!res.ok) {\n      throw new ArgosAuthError(\n        `Authentication failed: HTTP ${res.status} — ${await res.text()}`,\n      );\n    }\n    const data = await res.json() as { access_token?: string };\n    if (!data.access_token) throw new ArgosAuthError('Authorizer returned no access_token.');\n    this.appToken = data.access_token;\n  }\n\n  private initJwks(): void {\n    this.jwks = createRemoteJWKSet(\n      new URL(`${this.realmBase}/protocol/openid-connect/certs`),\n    );\n  }\n\n  async syncOperations(): Promise<void> {\n    this.ensureAppToken();\n    const res = await fetch(`${this.realmBase}/apps/operations/sync`, {\n      method: 'POST',\n      headers: {\n        'Content-Type': 'application/json',\n        Authorization: `Bearer ${this.appToken}`,\n      },\n      body: JSON.stringify({\n        operations: this.registeredOperations.map(op => ({\n          identifier:  op.identifier,\n          method:      op.method,\n          level:       op.level,\n          description: op.description ?? null,\n        })),\n      }),\n    });\n    if (!res.ok) {\n      throw new ArgosSyncError(`Sync failed: HTTP ${res.status} — ${await res.text()}`);\n    }\n  }\n\n  async fetchOperations(): Promise<void> {\n    this.ensureAppToken();\n    const res = await fetch(`${this.realmBase}/apps/operations`, {\n      headers: { Authorization: `Bearer ${this.appToken}` },\n    });\n    if (!res.ok) {\n      throw new ArgosError(\n        `Fetch operations failed: HTTP ${res.status} — ${await res.text()}`,\n      );\n    }\n    const data = await res.json() as { operations: any[] };\n    this.operations = data.operations.map(op => ({\n      operationId:   op.operation_id,\n      identifier:    op.identifier,\n      method:        op.method,\n      level:         op.level,\n      allowedGroups: op.allowed_groups ?? [],\n    }));\n  }\n\n  async validateToken(token: string): Promise<TokenClaims> {\n    if (!this.jwks) this.initJwks();\n    try {\n      const { payload } = await jwtVerify(token, this.jwks!);\n      const p = payload as JWTPayload & Record<string, unknown>;\n      const tokenRealm = (p['realm_id'] as string) ?? '';\n\n      // As chaves JWKS já são buscadas em /realms/{this.realmId}/... (ver\n      // realmBase), então um token de outro realm normalmente já falharia a\n      // verificação de assinatura acima. Esta checagem é defesa em\n      // profundidade explícita — não depende desse efeito colateral, e falha\n      // com uma mensagem clara em vez de erro de assinatura.\n      if (tokenRealm.toLowerCase() !== this.realmId.toLowerCase()) {\n        throw new ArgosTokenError(\n          `Token realm '${tokenRealm}' does not match this app's realm '${this.realmId}'.`,\n        );\n      }\n\n      return {\n        sub:     payload.sub ?? '',\n        realmId: tokenRealm,\n        groups:  (p['groups'] as string[]) ?? [],\n        exp:     payload.exp ?? 0,\n        raw:     p,\n      };\n    } catch (err) {\n      if (err instanceof ArgosTokenError) throw err;\n      throw new ArgosTokenError(`Invalid token: ${(err as Error).message}`);\n    }\n  }\n\n  checkPermission(claims: TokenClaims, identifier: string, method: string): boolean {\n    const op = this.operations.find(\n      o => o.identifier === identifier && o.method === method,\n    );\n    if (!op) return false;\n    if (op.level === 'public')    return true;\n    if (op.level === 'private')   return claims.groups.length > 0;\n    if (op.level === 'protected') return claims.groups.some(g => op.allowedGroups.includes(g));\n    return false;\n  }\n\n  /** Load operations from the global registry and bootstrap the client. */\n  static async create(options: ArgosClientOptions): Promise<ArgosClient> {\n    const client = new ArgosClient(options);\n    for (const op of getRegistry()) client.registerOperation(op);\n    await client.startup();\n    return client;\n  }\n\n  private ensureAppToken(): void {\n    if (!this.appToken) {\n      throw new ArgosAuthError('No app token. Call authenticate() or startup() first.');\n    }\n  }\n}"]}

package/dist/index.d.cts

@@ -0,0 +1,27 @@
+import { O as OperationDescriptor } from './client-Cgm1csuM.cjs';
+export { A as ArgosClient, a as ArgosClientOptions, b as OperationWithGroups, T as TokenClaims } from './client-Cgm1csuM.cjs';
+
+declare class ArgosError extends Error {
+    constructor(message: string);
+}
+declare class ArgosAuthError extends ArgosError {
+}
+declare class ArgosTokenError extends ArgosError {
+}
+declare class ArgosForbiddenError extends ArgosError {
+}
+declare class ArgosSyncError extends ArgosError {
+}
+declare class ArgosConfigError extends ArgosError {
+}
+
+/** Infer operation method from the last segment of the operation id.
+ *  e.g. "tasks:list" → "read", "tasks:create" → "write", "tasks:delete" → "delete"
+ */
+declare function detectMethod(id: string): string;
+/** Register an operation in the global registry (used by startup to sync). */
+declare function registerOperation(op: OperationDescriptor): void;
+declare function getRegistry(): OperationDescriptor[];
+declare function clearRegistry(): void;
+
+export { ArgosAuthError, ArgosConfigError, ArgosError, ArgosForbiddenError, ArgosSyncError, ArgosTokenError, OperationDescriptor, clearRegistry, detectMethod, getRegistry, registerOperation };

package/dist/index.d.ts

@@ -0,0 +1,27 @@
+import { O as OperationDescriptor } from './client-Cgm1csuM.js';
+export { A as ArgosClient, a as ArgosClientOptions, b as OperationWithGroups, T as TokenClaims } from './client-Cgm1csuM.js';
+
+declare class ArgosError extends Error {
+    constructor(message: string);
+}
+declare class ArgosAuthError extends ArgosError {
+}
+declare class ArgosTokenError extends ArgosError {
+}
+declare class ArgosForbiddenError extends ArgosError {
+}
+declare class ArgosSyncError extends ArgosError {
+}
+declare class ArgosConfigError extends ArgosError {
+}
+
+/** Infer operation method from the last segment of the operation id.
+ *  e.g. "tasks:list" → "read", "tasks:create" → "write", "tasks:delete" → "delete"
+ */
+declare function detectMethod(id: string): string;
+/** Register an operation in the global registry (used by startup to sync). */
+declare function registerOperation(op: OperationDescriptor): void;
+declare function getRegistry(): OperationDescriptor[];
+declare function clearRegistry(): void;
+
+export { ArgosAuthError, ArgosConfigError, ArgosError, ArgosForbiddenError, ArgosSyncError, ArgosTokenError, OperationDescriptor, clearRegistry, detectMethod, getRegistry, registerOperation };

package/dist/index.js

@@ -0,0 +1,5 @@
+export { ArgosClient } from './chunk-G73YTEJQ.js';
+export { ArgosAuthError, ArgosConfigError, ArgosError, ArgosForbiddenError, ArgosSyncError, ArgosTokenError } from './chunk-AKUM2UEO.js';
+export { clearRegistry, detectMethod, getRegistry, registerOperation } from './chunk-HV6X5RJY.js';
+//# sourceMappingURL=index.js.map
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"names":[],"mappings":"","file":"index.js"}