@caronte-sdk/node 0.2.1 → 0.2.3

package/README.md

@@ -179,6 +179,23 @@ You can always pass the method explicitly as the third argument to `guard()`.
 | `realmId`       | Name or UUID of the realm (e.g. `purp`) |
 | `appId`         | UUID of the app registered in `auth.apps` |
 | `secret`        | Plain-text app secret — use env vars, never commit |
+| `otelCollectorUrl` | Optional. OTLP HTTP endpoint (e.g. `http://localhost:4318`) of an OpenTelemetry Collector. When set, `startup()` initializes the Node OTel SDK — traces (auto-instrumentation for HTTP/Express/Fastify/GraphQL/pg, etc.), metrics (e.g. `http.server.duration` from that same auto-instrumentation), and a bootstrap log record proving the log pipeline is wired — all tagged with `service.name=appId` and `service.namespace=realmId`. Omit to skip OTel entirely — a misconfigured or unreachable collector never breaks `startup()`. |
+
+### Running with `otelCollectorUrl` on an ESM app
+
+If your app is ESM (`"type": "module"` in `package.json` — this includes any app run via `tsx`), auto-instrumentation (HTTP/Express/Fastify/GraphQL spans and metrics) **will not work** unless a loader hook is registered before your app's own imports run. This is a Node.js platform constraint, not something `otelCollectorUrl` alone can fix from inside `startup()` — by the time `startup()` executes, your `import express from 'express'` (and everything it pulls in) has already finished loading. See [Node's ESM instrumentation docs](https://github.com/open-telemetry/opentelemetry-js/blob/main/doc/esm-support.md).
+
+`@caronte-sdk/node` ships a `caronte-node` bin that handles this for you — put it in front of whatever already runs your app:
+
+```jsonc
+// package.json
+"scripts": {
+  "dev":   "caronte-node tsx watch src/main.ts",
+  "start": "caronte-node tsx src/main.ts"
+}
+```
+
+It's a no-op when `otelCollectorUrl` is unset (the hook is registered either way, but nothing gets instrumented unless `startup()` actually calls `NodeSDK.start()`). CommonJS apps (no `"type": "module"`, e.g. via `ts-node`) aren't affected by this — auto-instrumentation there works without `caronte-node` — but running everything through it is still fine either way.
 
 ## How it works
 

package/bin/caronte-node.js

@@ -0,0 +1,62 @@
+#!/usr/bin/env node
+// Wrapper around whatever actually runs the app (tsx, ts-node, plain node,
+// ...) so consumers get working OTel auto-instrumentation for free on ESM
+// apps without editing their run command by hand.
+//
+// Why this has to exist: Node's ESM loader hooks (needed to patch core/
+// third-party modules for tracing) can only be registered *before* the
+// process starts loading the app's module graph — a static `import` at the
+// top of main.ts is already resolved by the time any of that file's own
+// code (including CaronteClient.startup()) runs, so nothing inside the SDK
+// itself can register the hook late enough to matter. It has to happen at
+// the process level, which is exactly what `caronte-node` does: it re-spawns
+// the real command with the loader hook pre-registered via NODE_OPTIONS.
+// (See https://github.com/open-telemetry/opentelemetry-js/blob/main/doc/esm-support.md)
+//
+// Always registers the hook — harmless when otelCollectorUrl isn't set,
+// since CaronteClient.startup() only calls NodeSDK.start() when it is.
+import { spawn } from 'node:child_process';
+
+const [command, ...args] = process.argv.slice(2);
+
+if (!command) {
+  console.error('Usage: caronte-node <command> [args...]');
+  console.error('Example: caronte-node tsx watch src/main.ts');
+  process.exit(1);
+}
+
+// Modern, non-experimental replacement for --experimental-loader: register()
+// via a data: URL import. Resolve hook.mjs's absolute location *from this
+// script's own position inside @caronte-sdk/node* (not from the consuming
+// app's cwd) — @opentelemetry/instrumentation is a transitive dependency of
+// @caronte-sdk/node, and npm has no obligation to hoist it into the
+// consumer's own top-level node_modules (in practice, with a `file:`
+// dependency pointing at an already-built package, it usually doesn't).
+// Resolving from here matches exactly how otel.ts itself resolves the same
+// specifier, so it works regardless of the consumer's hoisting layout.
+const hookUrl = import.meta.resolve('@opentelemetry/instrumentation/hook.mjs');
+const registerScript = `import { register } from 'node:module'; register(${JSON.stringify(hookUrl)});`;
+const importUrl = `data:text/javascript,${encodeURIComponent(registerScript)}`;
+
+const nodeOptions = [process.env.NODE_OPTIONS, `--import=${importUrl}`].filter(Boolean).join(' ');
+
+// Pass the whole invocation as a single string (not a separate args array) —
+// shell:true + an args array is deprecated (DEP0190) because the args aren't
+// escaped before being handed to the shell.
+const quote = (arg) => (/\s/.test(arg) ? JSON.stringify(arg) : arg);
+const fullCommand = [command, ...args].map(quote).join(' ');
+
+const child = spawn(fullCommand, {
+  stdio: 'inherit',
+  shell: true,
+  env: { ...process.env, NODE_OPTIONS: nodeOptions },
+});
+
+child.on('exit', (code, signal) => {
+  if (signal) process.kill(process.pid, signal);
+  else process.exit(code ?? 0);
+});
+child.on('error', (err) => {
+  console.error(`[caronte-node] failed to launch "${command}": ${err.message}`);
+  process.exit(1);
+});

package/dist/adapters/apollo.cjs

@@ -1,5 +1,9 @@
 'use strict';
 
+var api = require('@opentelemetry/api');
+
+// src/adapters/apollo.ts
+
 // src/exceptions.ts
 var CaronteError = class extends Error {
   constructor(message) {
@@ -39,6 +43,7 @@ function carontePlugin(client) {
           if (scheme?.toLowerCase() === "bearer" && token) {
             try {
               ctx.contextValue.caronteUser = await client.validateToken(token);
+              api.trace.getActiveSpan()?.setAttribute("caronte.user", ctx.contextValue.caronteUser.sub);
             } catch (err) {
               if (err instanceof CaronteTokenError) {
                 ctx.contextValue.caronteUser = void 0;
@@ -55,9 +60,19 @@ function createGuard(client) {
     const resolvedMethod = method ?? detectMethod(id);
     registerOperation({ identifier: id, method: resolvedMethod, level });
     return (parent, args, context, info) => {
-      if (level === "public") return resolver(parent, args, context, info);
-      if (!context.caronteUser) throw new Error("Unauthorized: Bearer token required.");
-      if (!client.checkPermission(context.caronteUser, id, resolvedMethod)) {
+      const span = api.trace.getActiveSpan();
+      span?.setAttribute("caronte.operation_id", id);
+      if (level === "public") {
+        span?.setAttribute("caronte.permission_result", "public");
+        return resolver(parent, args, context, info);
+      }
+      if (!context.caronteUser) {
+        span?.setAttribute("caronte.permission_result", "unauthorized");
+        throw new Error("Unauthorized: Bearer token required.");
+      }
+      const allowed = client.checkPermission(context.caronteUser, id, resolvedMethod);
+      span?.setAttribute("caronte.permission_result", allowed ? "allowed" : "forbidden");
+      if (!allowed) {
         throw new Error("Forbidden: Insufficient permissions.");
       }
       return resolver(parent, args, context, info);

package/dist/adapters/apollo.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/exceptions.ts","../../src/registry.ts","../../src/adapters/apollo.ts"],"names":[],"mappings":";;;AAAO,IAAM,YAAA,GAAN,cAA2B,KAAA,CAAM;AAAA,EACtC,YAAY,OAAA,EAAiB;AAC3B,IAAA,KAAA,CAAM,OAAO,CAAA;AACb,IAAA,IAAA,CAAK,IAAA,GAAO,KAAK,WAAA,CAAY,IAAA;AAAA,EAC/B;AACF,CAAA;AAGO,IAAM,iBAAA,GAAN,cAAkC,YAAA,CAAa;AAAC,CAAA;;;ACNvD,IAAM,YAAmC,EAAC;AAKnC,SAAS,aAAa,EAAA,EAAoB;AAC/C,EAAA,MAAM,IAAA,GAAA,CAAQ,GAAG,KAAA,CAAM,GAAG,EAAE,GAAA,EAAI,IAAK,IAAI,WAAA,EAAY;AACrD,EAAA,IAAI,wBAAA,CAAyB,IAAA,CAAK,IAAI,CAAA,EAAS,OAAO,MAAA;AACtD,EAAA,IAAI,0BAAA,CAA2B,IAAA,CAAK,IAAI,CAAA,EAAQ,OAAO,QAAA;AACvD,EAAA,IAAI,iCAAA,CAAkC,IAAA,CAAK,IAAI,CAAA,EAAG,OAAO,QAAA;AACzD,EAAA,OAAO,OAAA;AACT;AAGO,SAAS,kBAAkB,EAAA,EAA+B;AAC/D,EAAA,MAAM,SAAS,SAAA,CAAU,IAAA;AAAA,IACvB,OAAK,CAAA,CAAE,UAAA,KAAe,GAAG,UAAA,IAAc,CAAA,CAAE,WAAW,EAAA,CAAG;AAAA,GACzD;AACA,EAAA,IAAI,CAAC,MAAA,EAAQ,SAAA,CAAU,IAAA,CAAK,EAAE,CAAA;AAChC;;;ACJO,SAAS,cAAc,MAAA,EAA2D;AACvF,EAAA,OAAO;AAAA,IACL,MAAM,eAAA,GAAkB;AACtB,MAAA,OAAO;AAAA,QACL,MAAM,oBAAoB,GAAA,EAA4C;AACpE,UAAA,MAAM,WAAY,GAAA,CAAI,OAAA,CAAQ,MAAM,OAAA,CAAQ,GAAA,CAAI,eAAe,CAAA,IAAK,EAAA;AACpE,UAAA,MAAM,MAAA,GAAc,GAAA,CAAI,YAAA,EAAsB,gBAAA,EAAkB,aAAA,IAAwC,EAAA;AACxG,UAAA,MAAM,OAAY,QAAA,IAAY,MAAA;AAE9B,UAAA,MAAM,CAAC,MAAA,EAAQ,KAAK,CAAA,GAAI,IAAA,CAAK,MAAM,GAAG,CAAA;AACtC,UAAA,IAAI,MAAA,EAAQ,WAAA,EAAY,KAAM,QAAA,IAAY,KAAA,EAAO;AAC/C,YAAA,IAAI;AACF,cAAA,GAAA,CAAI,YAAA,CAAa,WAAA,GAAc,MAAM,MAAA,CAAO,cAAc,KAAK,CAAA;AAAA,YACjE,SAAS,GAAA,EAAK;AACZ,cAAA,IAAI,eAAe,iBAAA,EAAmB;AACpC,gBAAA,GAAA,CAAI,aAAa,WAAA,GAAc,MAAA;AAAA,cACjC;AAAA,YACF;AAAA,UACF;AAAA,QACF;AAAA,OACF;AAAA,IACF;AAAA,GACF;AACF;AAmBO,SAAS,YAAY,MAAA,EAAuB;AACjD,EAAA,OAAO,SAAS,KAAA,CACd,EAAA,EACA,KAAA,EACA,UACA,MAAA,EAC6E;AAC7E,IAAA,MAAM,cAAA,GAAiB,MAAA,IAAU,YAAA,CAAa,EAAE,CAAA;AAChD,IAAA,iBAAA,CAAkB,EAAE,UAAA,EAAY,EAAA,EAAI,MAAA,EAAQ,cAAA,EAAgB,OAAO,CAAA;AAEnE,IAAA,OAAO,CAAC,MAAA,EAAQ,IAAA,EAAM,OAAA,EAAS,IAAA,KAAS;AACtC,MAAA,IAAI,UAAU,QAAA,EAAU,OAAO,SAAS,MAAA,EAAQ,IAAA,EAAM,SAAS,IAAI,CAAA;AACnE,MAAA,IAAI,CAAC,OAAA,CAAQ,WAAA,EAAa,MAAM,IAAI,MAAM,sCAAsC,CAAA;AAChF,MAAA,IAAI,CAAC,MAAA,CAAO,eAAA,CAAgB,QAAQ,WAAA,EAAa,EAAA,EAAI,cAAc,CAAA,EAAG;AACpE,QAAA,MAAM,IAAI,MAAM,sCAAsC,CAAA;AAAA,MACxD;AACA,MAAA,OAAO,QAAA,CAAS,MAAA,EAAQ,IAAA,EAAM,OAAA,EAAS,IAAI,CAAA;AAAA,IAC7C,CAAA;AAAA,EACF,CAAA;AACF","file":"apollo.cjs","sourcesContent":["export class CaronteError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = this.constructor.name;\n  }\n}\n\nexport class CaronteAuthError    extends CaronteError {}\nexport class CaronteTokenError   extends CaronteError {}\nexport class CaronteForbiddenError extends CaronteError {}\nexport class CaronteSyncError    extends CaronteError {}\nexport class CaronteConfigError  extends CaronteError {}","import type { OperationDescriptor } from './models.js';\n\nconst _registry: OperationDescriptor[] = [];\n\n/** Infer operation method from the last segment of the operation id.\n *  e.g. \"tasks:list\" → \"read\", \"tasks:create\" → \"write\", \"tasks:delete\" → \"delete\"\n */\nexport function detectMethod(id: string): string {\n  const last = (id.split(':').pop() ?? '').toLowerCase();\n  if (/^(get|list|fetch|read)/.test(last))       return 'read';\n  if (/^(delete|remove|destroy)/.test(last))      return 'delete';\n  if (/(stream|subscribe|watch|listen)/.test(last)) return 'stream';\n  return 'write';\n}\n\n/** Register an operation in the global registry (used by startup to sync). */\nexport function registerOperation(op: OperationDescriptor): void {\n  const exists = _registry.some(\n    o => o.identifier === op.identifier && o.method === op.method,\n  );\n  if (!exists) _registry.push(op);\n}\n\nexport function getRegistry(): OperationDescriptor[] {\n  return [..._registry];\n}\n\nexport function clearRegistry(): void {\n  _registry.length = 0;\n}","import type { ApolloServerPlugin, BaseContext, GraphQLRequestContext } from '@apollo/server';\nimport { CaronteClient } from '../client.js';\nimport { CaronteTokenError } from '../exceptions.js';\nimport type { TokenClaims } from '../models.js';\nimport { detectMethod, registerOperation } from '../registry.js';\n\nexport interface CaronteContext extends BaseContext {\n  caronteUser?: TokenClaims;\n}\n\n/**\n * Apollo Server plugin for caronte.\n *\n * Validates the Bearer token on every request and stores the claims in\n * `context.caronteUser`. Use `createGuard(client)` to enforce per-resolver\n * permissions.\n */\nexport function carontePlugin(client: CaronteClient): ApolloServerPlugin<CaronteContext> {\n  return {\n    async requestDidStart() {\n      return {\n        async didResolveOperation(ctx: GraphQLRequestContext<CaronteContext>) {\n          const httpAuth  = ctx.request.http?.headers.get('authorization') ?? '';\n          const wsAuth    = ((ctx.contextValue as any)?.connectionParams?.Authorization as string | undefined) ?? '';\n          const auth      = httpAuth || wsAuth;\n\n          const [scheme, token] = auth.split(' ');\n          if (scheme?.toLowerCase() === 'bearer' && token) {\n            try {\n              ctx.contextValue.caronteUser = await client.validateToken(token);\n            } catch (err) {\n              if (err instanceof CaronteTokenError) {\n                ctx.contextValue.caronteUser = undefined;\n              }\n            }\n          }\n        },\n      };\n    },\n  };\n}\n\n/**\n * Factory that returns a per-resolver guard bound to a `CaronteClient`.\n *\n * @example\n * ```ts\n * const guard = createGuard(client);\n *\n * const resolvers = {\n *   Query: {\n *     tasks: guard('tasks:list', 'private', async (_parent, _args, context) => {\n *       const user = context.caronteUser;\n *       return db.tasks.findAll();\n *     }),\n *   },\n * };\n * ```\n */\nexport function createGuard(client: CaronteClient) {\n  return function guard<TParent, TArgs, TContext extends CaronteContext, TReturn>(\n    id: string,\n    level: string,\n    resolver: (parent: TParent, args: TArgs, context: TContext, info: unknown) => TReturn,\n    method?: string,\n  ): (parent: TParent, args: TArgs, context: TContext, info: unknown) => TReturn {\n    const resolvedMethod = method ?? detectMethod(id);\n    registerOperation({ identifier: id, method: resolvedMethod, level });\n\n    return (parent, args, context, info) => {\n      if (level === 'public') return resolver(parent, args, context, info);\n      if (!context.caronteUser) throw new Error('Unauthorized: Bearer token required.');\n      if (!client.checkPermission(context.caronteUser, id, resolvedMethod)) {\n        throw new Error('Forbidden: Insufficient permissions.');\n      }\n      return resolver(parent, args, context, info);\n    };\n  };\n}"]}
+{"version":3,"sources":["../../src/exceptions.ts","../../src/registry.ts","../../src/adapters/apollo.ts"],"names":["trace"],"mappings":";;;;;;;AAAO,IAAM,YAAA,GAAN,cAA2B,KAAA,CAAM;AAAA,EACtC,YAAY,OAAA,EAAiB;AAC3B,IAAA,KAAA,CAAM,OAAO,CAAA;AACb,IAAA,IAAA,CAAK,IAAA,GAAO,KAAK,WAAA,CAAY,IAAA;AAAA,EAC/B;AACF,CAAA;AAGO,IAAM,iBAAA,GAAN,cAAkC,YAAA,CAAa;AAAC,CAAA;;;ACNvD,IAAM,YAAmC,EAAC;AAKnC,SAAS,aAAa,EAAA,EAAoB;AAC/C,EAAA,MAAM,IAAA,GAAA,CAAQ,GAAG,KAAA,CAAM,GAAG,EAAE,GAAA,EAAI,IAAK,IAAI,WAAA,EAAY;AACrD,EAAA,IAAI,wBAAA,CAAyB,IAAA,CAAK,IAAI,CAAA,EAAS,OAAO,MAAA;AACtD,EAAA,IAAI,0BAAA,CAA2B,IAAA,CAAK,IAAI,CAAA,EAAQ,OAAO,QAAA;AACvD,EAAA,IAAI,iCAAA,CAAkC,IAAA,CAAK,IAAI,CAAA,EAAG,OAAO,QAAA;AACzD,EAAA,OAAO,OAAA;AACT;AAGO,SAAS,kBAAkB,EAAA,EAA+B;AAC/D,EAAA,MAAM,SAAS,SAAA,CAAU,IAAA;AAAA,IACvB,OAAK,CAAA,CAAE,UAAA,KAAe,GAAG,UAAA,IAAc,CAAA,CAAE,WAAW,EAAA,CAAG;AAAA,GACzD;AACA,EAAA,IAAI,CAAC,MAAA,EAAQ,SAAA,CAAU,IAAA,CAAK,EAAE,CAAA;AAChC;;;ACHO,SAAS,cAAc,MAAA,EAA2D;AACvF,EAAA,OAAO;AAAA,IACL,MAAM,eAAA,GAAkB;AACtB,MAAA,OAAO;AAAA,QACL,MAAM,oBAAoB,GAAA,EAA4C;AACpE,UAAA,MAAM,WAAY,GAAA,CAAI,OAAA,CAAQ,MAAM,OAAA,CAAQ,GAAA,CAAI,eAAe,CAAA,IAAK,EAAA;AACpE,UAAA,MAAM,MAAA,GAAc,GAAA,CAAI,YAAA,EAAsB,gBAAA,EAAkB,aAAA,IAAwC,EAAA;AACxG,UAAA,MAAM,OAAY,QAAA,IAAY,MAAA;AAE9B,UAAA,MAAM,CAAC,MAAA,EAAQ,KAAK,CAAA,GAAI,IAAA,CAAK,MAAM,GAAG,CAAA;AACtC,UAAA,IAAI,MAAA,EAAQ,WAAA,EAAY,KAAM,QAAA,IAAY,KAAA,EAAO;AAC/C,YAAA,IAAI;AACF,cAAA,GAAA,CAAI,YAAA,CAAa,WAAA,GAAc,MAAM,MAAA,CAAO,cAAc,KAAK,CAAA;AAC/D,cAAAA,SAAA,CAAM,eAAc,EAAG,YAAA,CAAa,gBAAgB,GAAA,CAAI,YAAA,CAAa,YAAY,GAAG,CAAA;AAAA,YACtF,SAAS,GAAA,EAAK;AACZ,cAAA,IAAI,eAAe,iBAAA,EAAmB;AACpC,gBAAA,GAAA,CAAI,aAAa,WAAA,GAAc,MAAA;AAAA,cACjC;AAAA,YACF;AAAA,UACF;AAAA,QACF;AAAA,OACF;AAAA,IACF;AAAA,GACF;AACF;AAmBO,SAAS,YAAY,MAAA,EAAuB;AACjD,EAAA,OAAO,SAAS,KAAA,CACd,EAAA,EACA,KAAA,EACA,UACA,MAAA,EAC6E;AAC7E,IAAA,MAAM,cAAA,GAAiB,MAAA,IAAU,YAAA,CAAa,EAAE,CAAA;AAChD,IAAA,iBAAA,CAAkB,EAAE,UAAA,EAAY,EAAA,EAAI,MAAA,EAAQ,cAAA,EAAgB,OAAO,CAAA;AAEnE,IAAA,OAAO,CAAC,MAAA,EAAQ,IAAA,EAAM,OAAA,EAAS,IAAA,KAAS;AACtC,MAAA,MAAM,IAAA,GAAOA,UAAM,aAAA,EAAc;AACjC,MAAA,IAAA,EAAM,YAAA,CAAa,wBAAwB,EAAE,CAAA;AAE7C,MAAA,IAAI,UAAU,QAAA,EAAU;AACtB,QAAA,IAAA,EAAM,YAAA,CAAa,6BAA6B,QAAQ,CAAA;AACxD,QAAA,OAAO,QAAA,CAAS,MAAA,EAAQ,IAAA,EAAM,OAAA,EAAS,IAAI,CAAA;AAAA,MAC7C;AACA,MAAA,IAAI,CAAC,QAAQ,WAAA,EAAa;AACxB,QAAA,IAAA,EAAM,YAAA,CAAa,6BAA6B,cAAc,CAAA;AAC9D,QAAA,MAAM,IAAI,MAAM,sCAAsC,CAAA;AAAA,MACxD;AACA,MAAA,MAAM,UAAU,MAAA,CAAO,eAAA,CAAgB,OAAA,CAAQ,WAAA,EAAa,IAAI,cAAc,CAAA;AAC9E,MAAA,IAAA,EAAM,YAAA,CAAa,2BAAA,EAA6B,OAAA,GAAU,SAAA,GAAY,WAAW,CAAA;AACjF,MAAA,IAAI,CAAC,OAAA,EAAS;AACZ,QAAA,MAAM,IAAI,MAAM,sCAAsC,CAAA;AAAA,MACxD;AACA,MAAA,OAAO,QAAA,CAAS,MAAA,EAAQ,IAAA,EAAM,OAAA,EAAS,IAAI,CAAA;AAAA,IAC7C,CAAA;AAAA,EACF,CAAA;AACF","file":"apollo.cjs","sourcesContent":["export class CaronteError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = this.constructor.name;\n  }\n}\n\nexport class CaronteAuthError    extends CaronteError {}\nexport class CaronteTokenError   extends CaronteError {}\nexport class CaronteForbiddenError extends CaronteError {}\nexport class CaronteSyncError    extends CaronteError {}\nexport class CaronteConfigError  extends CaronteError {}","import type { OperationDescriptor } from './models.js';\n\nconst _registry: OperationDescriptor[] = [];\n\n/** Infer operation method from the last segment of the operation id.\n *  e.g. \"tasks:list\" → \"read\", \"tasks:create\" → \"write\", \"tasks:delete\" → \"delete\"\n */\nexport function detectMethod(id: string): string {\n  const last = (id.split(':').pop() ?? '').toLowerCase();\n  if (/^(get|list|fetch|read)/.test(last))       return 'read';\n  if (/^(delete|remove|destroy)/.test(last))      return 'delete';\n  if (/(stream|subscribe|watch|listen)/.test(last)) return 'stream';\n  return 'write';\n}\n\n/** Register an operation in the global registry (used by startup to sync). */\nexport function registerOperation(op: OperationDescriptor): void {\n  const exists = _registry.some(\n    o => o.identifier === op.identifier && o.method === op.method,\n  );\n  if (!exists) _registry.push(op);\n}\n\nexport function getRegistry(): OperationDescriptor[] {\n  return [..._registry];\n}\n\nexport function clearRegistry(): void {\n  _registry.length = 0;\n}","import type { ApolloServerPlugin, BaseContext, GraphQLRequestContext } from '@apollo/server';\nimport { trace } from '@opentelemetry/api';\nimport { CaronteClient } from '../client.js';\nimport { CaronteTokenError } from '../exceptions.js';\nimport type { TokenClaims } from '../models.js';\nimport { detectMethod, registerOperation } from '../registry.js';\n\nexport interface CaronteContext extends BaseContext {\n  caronteUser?: TokenClaims;\n}\n\n/**\n * Apollo Server plugin for caronte.\n *\n * Validates the Bearer token on every request and stores the claims in\n * `context.caronteUser`. Use `createGuard(client)` to enforce per-resolver\n * permissions.\n */\nexport function carontePlugin(client: CaronteClient): ApolloServerPlugin<CaronteContext> {\n  return {\n    async requestDidStart() {\n      return {\n        async didResolveOperation(ctx: GraphQLRequestContext<CaronteContext>) {\n          const httpAuth  = ctx.request.http?.headers.get('authorization') ?? '';\n          const wsAuth    = ((ctx.contextValue as any)?.connectionParams?.Authorization as string | undefined) ?? '';\n          const auth      = httpAuth || wsAuth;\n\n          const [scheme, token] = auth.split(' ');\n          if (scheme?.toLowerCase() === 'bearer' && token) {\n            try {\n              ctx.contextValue.caronteUser = await client.validateToken(token);\n              trace.getActiveSpan()?.setAttribute('caronte.user', ctx.contextValue.caronteUser.sub);\n            } catch (err) {\n              if (err instanceof CaronteTokenError) {\n                ctx.contextValue.caronteUser = undefined;\n              }\n            }\n          }\n        },\n      };\n    },\n  };\n}\n\n/**\n * Factory that returns a per-resolver guard bound to a `CaronteClient`.\n *\n * @example\n * ```ts\n * const guard = createGuard(client);\n *\n * const resolvers = {\n *   Query: {\n *     tasks: guard('tasks:list', 'private', async (_parent, _args, context) => {\n *       const user = context.caronteUser;\n *       return db.tasks.findAll();\n *     }),\n *   },\n * };\n * ```\n */\nexport function createGuard(client: CaronteClient) {\n  return function guard<TParent, TArgs, TContext extends CaronteContext, TReturn>(\n    id: string,\n    level: string,\n    resolver: (parent: TParent, args: TArgs, context: TContext, info: unknown) => TReturn,\n    method?: string,\n  ): (parent: TParent, args: TArgs, context: TContext, info: unknown) => TReturn {\n    const resolvedMethod = method ?? detectMethod(id);\n    registerOperation({ identifier: id, method: resolvedMethod, level });\n\n    return (parent, args, context, info) => {\n      const span = trace.getActiveSpan();\n      span?.setAttribute('caronte.operation_id', id);\n\n      if (level === 'public') {\n        span?.setAttribute('caronte.permission_result', 'public');\n        return resolver(parent, args, context, info);\n      }\n      if (!context.caronteUser) {\n        span?.setAttribute('caronte.permission_result', 'unauthorized');\n        throw new Error('Unauthorized: Bearer token required.');\n      }\n      const allowed = client.checkPermission(context.caronteUser, id, resolvedMethod);\n      span?.setAttribute('caronte.permission_result', allowed ? 'allowed' : 'forbidden');\n      if (!allowed) {\n        throw new Error('Forbidden: Insufficient permissions.');\n      }\n      return resolver(parent, args, context, info);\n    };\n  };\n}"]}

package/dist/adapters/apollo.d.cts

@@ -1,5 +1,5 @@
 import { BaseContext, ApolloServerPlugin } from '@apollo/server';
-import { T as TokenClaims, C as CaronteClient } from '../client-TcOSwgrn.cjs';
+import { T as TokenClaims, C as CaronteClient } from '../client-CSokWFYn.cjs';
 
 interface CaronteContext extends BaseContext {
     caronteUser?: TokenClaims;

package/dist/adapters/apollo.d.ts

@@ -1,5 +1,5 @@
 import { BaseContext, ApolloServerPlugin } from '@apollo/server';
-import { T as TokenClaims, C as CaronteClient } from '../client-TcOSwgrn.js';
+import { T as TokenClaims, C as CaronteClient } from '../client-CSokWFYn.js';
 
 interface CaronteContext extends BaseContext {
     caronteUser?: TokenClaims;

package/dist/adapters/apollo.js

@@ -1,7 +1,7 @@
 import { CaronteTokenError } from '../chunk-VEDVQOBD.js';
 import { detectMethod, registerOperation } from '../chunk-HV6X5RJY.js';
+import { trace } from '@opentelemetry/api';
 
-// src/adapters/apollo.ts
 function carontePlugin(client) {
   return {
     async requestDidStart() {
@@ -14,6 +14,7 @@ function carontePlugin(client) {
           if (scheme?.toLowerCase() === "bearer" && token) {
             try {
               ctx.contextValue.caronteUser = await client.validateToken(token);
+              trace.getActiveSpan()?.setAttribute("caronte.user", ctx.contextValue.caronteUser.sub);
             } catch (err) {
               if (err instanceof CaronteTokenError) {
                 ctx.contextValue.caronteUser = void 0;
@@ -30,9 +31,19 @@ function createGuard(client) {
     const resolvedMethod = method ?? detectMethod(id);
     registerOperation({ identifier: id, method: resolvedMethod, level });
     return (parent, args, context, info) => {
-      if (level === "public") return resolver(parent, args, context, info);
-      if (!context.caronteUser) throw new Error("Unauthorized: Bearer token required.");
-      if (!client.checkPermission(context.caronteUser, id, resolvedMethod)) {
+      const span = trace.getActiveSpan();
+      span?.setAttribute("caronte.operation_id", id);
+      if (level === "public") {
+        span?.setAttribute("caronte.permission_result", "public");
+        return resolver(parent, args, context, info);
+      }
+      if (!context.caronteUser) {
+        span?.setAttribute("caronte.permission_result", "unauthorized");
+        throw new Error("Unauthorized: Bearer token required.");
+      }
+      const allowed = client.checkPermission(context.caronteUser, id, resolvedMethod);
+      span?.setAttribute("caronte.permission_result", allowed ? "allowed" : "forbidden");
+      if (!allowed) {
         throw new Error("Forbidden: Insufficient permissions.");
       }
       return resolver(parent, args, context, info);

package/dist/adapters/apollo.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/adapters/apollo.ts"],"names":[],"mappings":";;;;AAiBO,SAAS,cAAc,MAAA,EAA2D;AACvF,EAAA,OAAO;AAAA,IACL,MAAM,eAAA,GAAkB;AACtB,MAAA,OAAO;AAAA,QACL,MAAM,oBAAoB,GAAA,EAA4C;AACpE,UAAA,MAAM,WAAY,GAAA,CAAI,OAAA,CAAQ,MAAM,OAAA,CAAQ,GAAA,CAAI,eAAe,CAAA,IAAK,EAAA;AACpE,UAAA,MAAM,MAAA,GAAc,GAAA,CAAI,YAAA,EAAsB,gBAAA,EAAkB,aAAA,IAAwC,EAAA;AACxG,UAAA,MAAM,OAAY,QAAA,IAAY,MAAA;AAE9B,UAAA,MAAM,CAAC,MAAA,EAAQ,KAAK,CAAA,GAAI,IAAA,CAAK,MAAM,GAAG,CAAA;AACtC,UAAA,IAAI,MAAA,EAAQ,WAAA,EAAY,KAAM,QAAA,IAAY,KAAA,EAAO;AAC/C,YAAA,IAAI;AACF,cAAA,GAAA,CAAI,YAAA,CAAa,WAAA,GAAc,MAAM,MAAA,CAAO,cAAc,KAAK,CAAA;AAAA,YACjE,SAAS,GAAA,EAAK;AACZ,cAAA,IAAI,eAAe,iBAAA,EAAmB;AACpC,gBAAA,GAAA,CAAI,aAAa,WAAA,GAAc,MAAA;AAAA,cACjC;AAAA,YACF;AAAA,UACF;AAAA,QACF;AAAA,OACF;AAAA,IACF;AAAA,GACF;AACF;AAmBO,SAAS,YAAY,MAAA,EAAuB;AACjD,EAAA,OAAO,SAAS,KAAA,CACd,EAAA,EACA,KAAA,EACA,UACA,MAAA,EAC6E;AAC7E,IAAA,MAAM,cAAA,GAAiB,MAAA,IAAU,YAAA,CAAa,EAAE,CAAA;AAChD,IAAA,iBAAA,CAAkB,EAAE,UAAA,EAAY,EAAA,EAAI,MAAA,EAAQ,cAAA,EAAgB,OAAO,CAAA;AAEnE,IAAA,OAAO,CAAC,MAAA,EAAQ,IAAA,EAAM,OAAA,EAAS,IAAA,KAAS;AACtC,MAAA,IAAI,UAAU,QAAA,EAAU,OAAO,SAAS,MAAA,EAAQ,IAAA,EAAM,SAAS,IAAI,CAAA;AACnE,MAAA,IAAI,CAAC,OAAA,CAAQ,WAAA,EAAa,MAAM,IAAI,MAAM,sCAAsC,CAAA;AAChF,MAAA,IAAI,CAAC,MAAA,CAAO,eAAA,CAAgB,QAAQ,WAAA,EAAa,EAAA,EAAI,cAAc,CAAA,EAAG;AACpE,QAAA,MAAM,IAAI,MAAM,sCAAsC,CAAA;AAAA,MACxD;AACA,MAAA,OAAO,QAAA,CAAS,MAAA,EAAQ,IAAA,EAAM,OAAA,EAAS,IAAI,CAAA;AAAA,IAC7C,CAAA;AAAA,EACF,CAAA;AACF","file":"apollo.js","sourcesContent":["import type { ApolloServerPlugin, BaseContext, GraphQLRequestContext } from '@apollo/server';\nimport { CaronteClient } from '../client.js';\nimport { CaronteTokenError } from '../exceptions.js';\nimport type { TokenClaims } from '../models.js';\nimport { detectMethod, registerOperation } from '../registry.js';\n\nexport interface CaronteContext extends BaseContext {\n  caronteUser?: TokenClaims;\n}\n\n/**\n * Apollo Server plugin for caronte.\n *\n * Validates the Bearer token on every request and stores the claims in\n * `context.caronteUser`. Use `createGuard(client)` to enforce per-resolver\n * permissions.\n */\nexport function carontePlugin(client: CaronteClient): ApolloServerPlugin<CaronteContext> {\n  return {\n    async requestDidStart() {\n      return {\n        async didResolveOperation(ctx: GraphQLRequestContext<CaronteContext>) {\n          const httpAuth  = ctx.request.http?.headers.get('authorization') ?? '';\n          const wsAuth    = ((ctx.contextValue as any)?.connectionParams?.Authorization as string | undefined) ?? '';\n          const auth      = httpAuth || wsAuth;\n\n          const [scheme, token] = auth.split(' ');\n          if (scheme?.toLowerCase() === 'bearer' && token) {\n            try {\n              ctx.contextValue.caronteUser = await client.validateToken(token);\n            } catch (err) {\n              if (err instanceof CaronteTokenError) {\n                ctx.contextValue.caronteUser = undefined;\n              }\n            }\n          }\n        },\n      };\n    },\n  };\n}\n\n/**\n * Factory that returns a per-resolver guard bound to a `CaronteClient`.\n *\n * @example\n * ```ts\n * const guard = createGuard(client);\n *\n * const resolvers = {\n *   Query: {\n *     tasks: guard('tasks:list', 'private', async (_parent, _args, context) => {\n *       const user = context.caronteUser;\n *       return db.tasks.findAll();\n *     }),\n *   },\n * };\n * ```\n */\nexport function createGuard(client: CaronteClient) {\n  return function guard<TParent, TArgs, TContext extends CaronteContext, TReturn>(\n    id: string,\n    level: string,\n    resolver: (parent: TParent, args: TArgs, context: TContext, info: unknown) => TReturn,\n    method?: string,\n  ): (parent: TParent, args: TArgs, context: TContext, info: unknown) => TReturn {\n    const resolvedMethod = method ?? detectMethod(id);\n    registerOperation({ identifier: id, method: resolvedMethod, level });\n\n    return (parent, args, context, info) => {\n      if (level === 'public') return resolver(parent, args, context, info);\n      if (!context.caronteUser) throw new Error('Unauthorized: Bearer token required.');\n      if (!client.checkPermission(context.caronteUser, id, resolvedMethod)) {\n        throw new Error('Forbidden: Insufficient permissions.');\n      }\n      return resolver(parent, args, context, info);\n    };\n  };\n}"]}
+{"version":3,"sources":["../../src/adapters/apollo.ts"],"names":[],"mappings":";;;;AAkBO,SAAS,cAAc,MAAA,EAA2D;AACvF,EAAA,OAAO;AAAA,IACL,MAAM,eAAA,GAAkB;AACtB,MAAA,OAAO;AAAA,QACL,MAAM,oBAAoB,GAAA,EAA4C;AACpE,UAAA,MAAM,WAAY,GAAA,CAAI,OAAA,CAAQ,MAAM,OAAA,CAAQ,GAAA,CAAI,eAAe,CAAA,IAAK,EAAA;AACpE,UAAA,MAAM,MAAA,GAAc,GAAA,CAAI,YAAA,EAAsB,gBAAA,EAAkB,aAAA,IAAwC,EAAA;AACxG,UAAA,MAAM,OAAY,QAAA,IAAY,MAAA;AAE9B,UAAA,MAAM,CAAC,MAAA,EAAQ,KAAK,CAAA,GAAI,IAAA,CAAK,MAAM,GAAG,CAAA;AACtC,UAAA,IAAI,MAAA,EAAQ,WAAA,EAAY,KAAM,QAAA,IAAY,KAAA,EAAO;AAC/C,YAAA,IAAI;AACF,cAAA,GAAA,CAAI,YAAA,CAAa,WAAA,GAAc,MAAM,MAAA,CAAO,cAAc,KAAK,CAAA;AAC/D,cAAA,KAAA,CAAM,eAAc,EAAG,YAAA,CAAa,gBAAgB,GAAA,CAAI,YAAA,CAAa,YAAY,GAAG,CAAA;AAAA,YACtF,SAAS,GAAA,EAAK;AACZ,cAAA,IAAI,eAAe,iBAAA,EAAmB;AACpC,gBAAA,GAAA,CAAI,aAAa,WAAA,GAAc,MAAA;AAAA,cACjC;AAAA,YACF;AAAA,UACF;AAAA,QACF;AAAA,OACF;AAAA,IACF;AAAA,GACF;AACF;AAmBO,SAAS,YAAY,MAAA,EAAuB;AACjD,EAAA,OAAO,SAAS,KAAA,CACd,EAAA,EACA,KAAA,EACA,UACA,MAAA,EAC6E;AAC7E,IAAA,MAAM,cAAA,GAAiB,MAAA,IAAU,YAAA,CAAa,EAAE,CAAA;AAChD,IAAA,iBAAA,CAAkB,EAAE,UAAA,EAAY,EAAA,EAAI,MAAA,EAAQ,cAAA,EAAgB,OAAO,CAAA;AAEnE,IAAA,OAAO,CAAC,MAAA,EAAQ,IAAA,EAAM,OAAA,EAAS,IAAA,KAAS;AACtC,MAAA,MAAM,IAAA,GAAO,MAAM,aAAA,EAAc;AACjC,MAAA,IAAA,EAAM,YAAA,CAAa,wBAAwB,EAAE,CAAA;AAE7C,MAAA,IAAI,UAAU,QAAA,EAAU;AACtB,QAAA,IAAA,EAAM,YAAA,CAAa,6BAA6B,QAAQ,CAAA;AACxD,QAAA,OAAO,QAAA,CAAS,MAAA,EAAQ,IAAA,EAAM,OAAA,EAAS,IAAI,CAAA;AAAA,MAC7C;AACA,MAAA,IAAI,CAAC,QAAQ,WAAA,EAAa;AACxB,QAAA,IAAA,EAAM,YAAA,CAAa,6BAA6B,cAAc,CAAA;AAC9D,QAAA,MAAM,IAAI,MAAM,sCAAsC,CAAA;AAAA,MACxD;AACA,MAAA,MAAM,UAAU,MAAA,CAAO,eAAA,CAAgB,OAAA,CAAQ,WAAA,EAAa,IAAI,cAAc,CAAA;AAC9E,MAAA,IAAA,EAAM,YAAA,CAAa,2BAAA,EAA6B,OAAA,GAAU,SAAA,GAAY,WAAW,CAAA;AACjF,MAAA,IAAI,CAAC,OAAA,EAAS;AACZ,QAAA,MAAM,IAAI,MAAM,sCAAsC,CAAA;AAAA,MACxD;AACA,MAAA,OAAO,QAAA,CAAS,MAAA,EAAQ,IAAA,EAAM,OAAA,EAAS,IAAI,CAAA;AAAA,IAC7C,CAAA;AAAA,EACF,CAAA;AACF","file":"apollo.js","sourcesContent":["import type { ApolloServerPlugin, BaseContext, GraphQLRequestContext } from '@apollo/server';\nimport { trace } from '@opentelemetry/api';\nimport { CaronteClient } from '../client.js';\nimport { CaronteTokenError } from '../exceptions.js';\nimport type { TokenClaims } from '../models.js';\nimport { detectMethod, registerOperation } from '../registry.js';\n\nexport interface CaronteContext extends BaseContext {\n  caronteUser?: TokenClaims;\n}\n\n/**\n * Apollo Server plugin for caronte.\n *\n * Validates the Bearer token on every request and stores the claims in\n * `context.caronteUser`. Use `createGuard(client)` to enforce per-resolver\n * permissions.\n */\nexport function carontePlugin(client: CaronteClient): ApolloServerPlugin<CaronteContext> {\n  return {\n    async requestDidStart() {\n      return {\n        async didResolveOperation(ctx: GraphQLRequestContext<CaronteContext>) {\n          const httpAuth  = ctx.request.http?.headers.get('authorization') ?? '';\n          const wsAuth    = ((ctx.contextValue as any)?.connectionParams?.Authorization as string | undefined) ?? '';\n          const auth      = httpAuth || wsAuth;\n\n          const [scheme, token] = auth.split(' ');\n          if (scheme?.toLowerCase() === 'bearer' && token) {\n            try {\n              ctx.contextValue.caronteUser = await client.validateToken(token);\n              trace.getActiveSpan()?.setAttribute('caronte.user', ctx.contextValue.caronteUser.sub);\n            } catch (err) {\n              if (err instanceof CaronteTokenError) {\n                ctx.contextValue.caronteUser = undefined;\n              }\n            }\n          }\n        },\n      };\n    },\n  };\n}\n\n/**\n * Factory that returns a per-resolver guard bound to a `CaronteClient`.\n *\n * @example\n * ```ts\n * const guard = createGuard(client);\n *\n * const resolvers = {\n *   Query: {\n *     tasks: guard('tasks:list', 'private', async (_parent, _args, context) => {\n *       const user = context.caronteUser;\n *       return db.tasks.findAll();\n *     }),\n *   },\n * };\n * ```\n */\nexport function createGuard(client: CaronteClient) {\n  return function guard<TParent, TArgs, TContext extends CaronteContext, TReturn>(\n    id: string,\n    level: string,\n    resolver: (parent: TParent, args: TArgs, context: TContext, info: unknown) => TReturn,\n    method?: string,\n  ): (parent: TParent, args: TArgs, context: TContext, info: unknown) => TReturn {\n    const resolvedMethod = method ?? detectMethod(id);\n    registerOperation({ identifier: id, method: resolvedMethod, level });\n\n    return (parent, args, context, info) => {\n      const span = trace.getActiveSpan();\n      span?.setAttribute('caronte.operation_id', id);\n\n      if (level === 'public') {\n        span?.setAttribute('caronte.permission_result', 'public');\n        return resolver(parent, args, context, info);\n      }\n      if (!context.caronteUser) {\n        span?.setAttribute('caronte.permission_result', 'unauthorized');\n        throw new Error('Unauthorized: Bearer token required.');\n      }\n      const allowed = client.checkPermission(context.caronteUser, id, resolvedMethod);\n      span?.setAttribute('caronte.permission_result', allowed ? 'allowed' : 'forbidden');\n      if (!allowed) {\n        throw new Error('Forbidden: Insufficient permissions.');\n      }\n      return resolver(parent, args, context, info);\n    };\n  };\n}"]}

package/dist/adapters/express.cjs

@@ -1,5 +1,9 @@
 'use strict';
 
+var api = require('@opentelemetry/api');
+
+// src/adapters/express.ts
+
 // src/registry.ts
 var _registry = [];
 function detectMethod(id) {
@@ -24,6 +28,7 @@ function caronte(client) {
     if (scheme?.toLowerCase() === "bearer" && token) {
       try {
         req.caronteUser = await client.validateToken(token);
+        api.trace.getActiveSpan()?.setAttribute("caronte.user", req.caronteUser.sub);
       } catch {
       }
     }
@@ -33,15 +38,20 @@ function caronte(client) {
     const resolvedMethod = method ?? detectMethod(id);
     registerOperation({ identifier: id, method: resolvedMethod, level });
     return (req, res, next) => {
+      const span = api.trace.getActiveSpan();
+      span?.setAttribute("caronte.operation_id", id);
       if (level === "public") {
+        span?.setAttribute("caronte.permission_result", "public");
         next();
         return;
       }
       if (!req.caronteUser) {
+        span?.setAttribute("caronte.permission_result", "unauthorized");
         res.status(401).json({ error: "unauthorized", detail: "Bearer token required." });
         return;
       }
       const allowed = client.checkPermission(req.caronteUser, id, resolvedMethod);
+      span?.setAttribute("caronte.permission_result", allowed ? "allowed" : "forbidden");
       if (!allowed) {
         res.status(403).json({ error: "forbidden", detail: "Insufficient permissions." });
         return;

package/dist/adapters/express.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/registry.ts","../../src/adapters/express.ts"],"names":[],"mappings":";;;AAEA,IAAM,YAAmC,EAAC;AAKnC,SAAS,aAAa,EAAA,EAAoB;AAC/C,EAAA,MAAM,IAAA,GAAA,CAAQ,GAAG,KAAA,CAAM,GAAG,EAAE,GAAA,EAAI,IAAK,IAAI,WAAA,EAAY;AACrD,EAAA,IAAI,wBAAA,CAAyB,IAAA,CAAK,IAAI,CAAA,EAAS,OAAO,MAAA;AACtD,EAAA,IAAI,0BAAA,CAA2B,IAAA,CAAK,IAAI,CAAA,EAAQ,OAAO,QAAA;AACvD,EAAA,IAAI,iCAAA,CAAkC,IAAA,CAAK,IAAI,CAAA,EAAG,OAAO,QAAA;AACzD,EAAA,OAAO,OAAA;AACT;AAGO,SAAS,kBAAkB,EAAA,EAA+B;AAC/D,EAAA,MAAM,SAAS,SAAA,CAAU,IAAA;AAAA,IACvB,OAAK,CAAA,CAAE,UAAA,KAAe,GAAG,UAAA,IAAc,CAAA,CAAE,WAAW,EAAA,CAAG;AAAA,GACzD;AACA,EAAA,IAAI,CAAC,MAAA,EAAQ,SAAA,CAAU,IAAA,CAAK,EAAE,CAAA;AAChC;;;ACCO,SAAS,QAAQ,MAAA,EAA0C;AAEhE,EAAA,MAAM,UAAA,GAAa,OAAO,GAAA,EAAc,IAAA,EAAgB,IAAA,KAAsC;AAC5F,IAAA,MAAM,IAAA,GAAO,GAAA,CAAI,OAAA,CAAQ,aAAA,IAAiB,EAAA;AAC1C,IAAA,MAAM,CAAC,MAAA,EAAQ,KAAK,CAAA,GAAI,IAAA,CAAK,MAAM,GAAG,CAAA;AACtC,IAAA,IAAI,MAAA,EAAQ,WAAA,EAAY,KAAM,QAAA,IAAY,KAAA,EAAO;AAC/C,MAAA,IAAI;AACF,QAAA,GAAA,CAAI,WAAA,GAAc,MAAM,MAAA,CAAO,aAAA,CAAc,KAAK,CAAA;AAAA,MACpD,CAAA,CAAA,MAAQ;AAAA,MAER;AAAA,IACF;AACA,IAAA,IAAA,EAAK;AAAA,EACP,CAAA;AAEA,EAAA,MAAM,KAAA,GAAQ,CAAC,EAAA,EAAY,KAAA,EAAe,MAAA,KAAoB;AAC5D,IAAA,MAAM,cAAA,GAAiB,MAAA,IAAU,YAAA,CAAa,EAAE,CAAA;AAChD,IAAA,iBAAA,CAAkB,EAAE,UAAA,EAAY,EAAA,EAAI,MAAA,EAAQ,cAAA,EAAgB,OAAO,CAAA;AAEnE,IAAA,OAAO,CAAC,GAAA,EAAc,GAAA,EAAe,IAAA,KAA6B;AAChE,MAAA,IAAI,UAAU,QAAA,EAAU;AAAE,QAAA,IAAA,EAAK;AAAG,QAAA;AAAA,MAAQ;AAE1C,MAAA,IAAI,CAAC,IAAI,WAAA,EAAa;AACpB,QAAA,GAAA,CAAI,MAAA,CAAO,GAAG,CAAA,CAAE,IAAA,CAAK,EAAE,KAAA,EAAO,cAAA,EAAgB,MAAA,EAAQ,wBAAA,EAA0B,CAAA;AAChF,QAAA;AAAA,MACF;AAEA,MAAA,MAAM,UAAU,MAAA,CAAO,eAAA,CAAgB,GAAA,CAAI,WAAA,EAAa,IAAI,cAAc,CAAA;AAC1E,MAAA,IAAI,CAAC,OAAA,EAAS;AACZ,QAAA,GAAA,CAAI,MAAA,CAAO,GAAG,CAAA,CAAE,IAAA,CAAK,EAAE,KAAA,EAAO,WAAA,EAAa,MAAA,EAAQ,2BAAA,EAA6B,CAAA;AAChF,QAAA;AAAA,MACF;AAEA,MAAA,IAAA,EAAK;AAAA,IACP,CAAA;AAAA,EACF,CAAA;AAEA,EAAA,OAAO,EAAE,YAAY,KAAA,EAAM;AAC7B","file":"express.cjs","sourcesContent":["import type { OperationDescriptor } from './models.js';\n\nconst _registry: OperationDescriptor[] = [];\n\n/** Infer operation method from the last segment of the operation id.\n *  e.g. \"tasks:list\" → \"read\", \"tasks:create\" → \"write\", \"tasks:delete\" → \"delete\"\n */\nexport function detectMethod(id: string): string {\n  const last = (id.split(':').pop() ?? '').toLowerCase();\n  if (/^(get|list|fetch|read)/.test(last))       return 'read';\n  if (/^(delete|remove|destroy)/.test(last))      return 'delete';\n  if (/(stream|subscribe|watch|listen)/.test(last)) return 'stream';\n  return 'write';\n}\n\n/** Register an operation in the global registry (used by startup to sync). */\nexport function registerOperation(op: OperationDescriptor): void {\n  const exists = _registry.some(\n    o => o.identifier === op.identifier && o.method === op.method,\n  );\n  if (!exists) _registry.push(op);\n}\n\nexport function getRegistry(): OperationDescriptor[] {\n  return [..._registry];\n}\n\nexport function clearRegistry(): void {\n  _registry.length = 0;\n}","import type { NextFunction, Request, Response } from 'express';\nimport { CaronteClient } from '../client.js';\nimport { CaronteTokenError } from '../exceptions.js';\nimport type { TokenClaims } from '../models.js';\nimport { detectMethod, registerOperation } from '../registry.js';\n\ndeclare global {\n  namespace Express {\n    interface Request {\n      caronteUser?: TokenClaims;\n    }\n  }\n}\n\nexport interface CaronteMiddleware {\n  /** Global middleware — validates the Bearer token and injects `req.caronteUser`. */\n  middleware: (req: Request, res: Response, next: NextFunction) => Promise<void>;\n  /** Per-route guard — registers the operation and enforces permission at request time. */\n  guard: (id: string, level: string, method?: string) =>\n    (req: Request, res: Response, next: NextFunction) => void;\n}\n\nexport function caronte(client: CaronteClient): CaronteMiddleware {\n\n  const middleware = async (req: Request, _res: Response, next: NextFunction): Promise<void> => {\n    const auth = req.headers.authorization ?? '';\n    const [scheme, token] = auth.split(' ');\n    if (scheme?.toLowerCase() === 'bearer' && token) {\n      try {\n        req.caronteUser = await client.validateToken(token);\n      } catch {\n        // invalid token — caronteUser stays undefined; guard handles the 401\n      }\n    }\n    next();\n  };\n\n  const guard = (id: string, level: string, method?: string) => {\n    const resolvedMethod = method ?? detectMethod(id);\n    registerOperation({ identifier: id, method: resolvedMethod, level });\n\n    return (req: Request, res: Response, next: NextFunction): void => {\n      if (level === 'public') { next(); return; }\n\n      if (!req.caronteUser) {\n        res.status(401).json({ error: 'unauthorized', detail: 'Bearer token required.' });\n        return;\n      }\n\n      const allowed = client.checkPermission(req.caronteUser, id, resolvedMethod);\n      if (!allowed) {\n        res.status(403).json({ error: 'forbidden', detail: 'Insufficient permissions.' });\n        return;\n      }\n\n      next();\n    };\n  };\n\n  return { middleware, guard };\n}"]}
+{"version":3,"sources":["../../src/registry.ts","../../src/adapters/express.ts"],"names":["trace"],"mappings":";;;;;;;AAEA,IAAM,YAAmC,EAAC;AAKnC,SAAS,aAAa,EAAA,EAAoB;AAC/C,EAAA,MAAM,IAAA,GAAA,CAAQ,GAAG,KAAA,CAAM,GAAG,EAAE,GAAA,EAAI,IAAK,IAAI,WAAA,EAAY;AACrD,EAAA,IAAI,wBAAA,CAAyB,IAAA,CAAK,IAAI,CAAA,EAAS,OAAO,MAAA;AACtD,EAAA,IAAI,0BAAA,CAA2B,IAAA,CAAK,IAAI,CAAA,EAAQ,OAAO,QAAA;AACvD,EAAA,IAAI,iCAAA,CAAkC,IAAA,CAAK,IAAI,CAAA,EAAG,OAAO,QAAA;AACzD,EAAA,OAAO,OAAA;AACT;AAGO,SAAS,kBAAkB,EAAA,EAA+B;AAC/D,EAAA,MAAM,SAAS,SAAA,CAAU,IAAA;AAAA,IACvB,OAAK,CAAA,CAAE,UAAA,KAAe,GAAG,UAAA,IAAc,CAAA,CAAE,WAAW,EAAA,CAAG;AAAA,GACzD;AACA,EAAA,IAAI,CAAC,MAAA,EAAQ,SAAA,CAAU,IAAA,CAAK,EAAE,CAAA;AAChC;;;ACEO,SAAS,QAAQ,MAAA,EAA0C;AAEhE,EAAA,MAAM,UAAA,GAAa,OAAO,GAAA,EAAc,IAAA,EAAgB,IAAA,KAAsC;AAC5F,IAAA,MAAM,IAAA,GAAO,GAAA,CAAI,OAAA,CAAQ,aAAA,IAAiB,EAAA;AAC1C,IAAA,MAAM,CAAC,MAAA,EAAQ,KAAK,CAAA,GAAI,IAAA,CAAK,MAAM,GAAG,CAAA;AACtC,IAAA,IAAI,MAAA,EAAQ,WAAA,EAAY,KAAM,QAAA,IAAY,KAAA,EAAO;AAC/C,MAAA,IAAI;AACF,QAAA,GAAA,CAAI,WAAA,GAAc,MAAM,MAAA,CAAO,aAAA,CAAc,KAAK,CAAA;AAClD,QAAAA,SAAA,CAAM,eAAc,EAAG,YAAA,CAAa,cAAA,EAAgB,GAAA,CAAI,YAAY,GAAG,CAAA;AAAA,MACzE,CAAA,CAAA,MAAQ;AAAA,MAER;AAAA,IACF;AACA,IAAA,IAAA,EAAK;AAAA,EACP,CAAA;AAEA,EAAA,MAAM,KAAA,GAAQ,CAAC,EAAA,EAAY,KAAA,EAAe,MAAA,KAAoB;AAC5D,IAAA,MAAM,cAAA,GAAiB,MAAA,IAAU,YAAA,CAAa,EAAE,CAAA;AAChD,IAAA,iBAAA,CAAkB,EAAE,UAAA,EAAY,EAAA,EAAI,MAAA,EAAQ,cAAA,EAAgB,OAAO,CAAA;AAEnE,IAAA,OAAO,CAAC,GAAA,EAAc,GAAA,EAAe,IAAA,KAA6B;AAChE,MAAA,MAAM,IAAA,GAAOA,UAAM,aAAA,EAAc;AACjC,MAAA,IAAA,EAAM,YAAA,CAAa,wBAAwB,EAAE,CAAA;AAE7C,MAAA,IAAI,UAAU,QAAA,EAAU;AACtB,QAAA,IAAA,EAAM,YAAA,CAAa,6BAA6B,QAAQ,CAAA;AACxD,QAAA,IAAA,EAAK;AACL,QAAA;AAAA,MACF;AAEA,MAAA,IAAI,CAAC,IAAI,WAAA,EAAa;AACpB,QAAA,IAAA,EAAM,YAAA,CAAa,6BAA6B,cAAc,CAAA;AAC9D,QAAA,GAAA,CAAI,MAAA,CAAO,GAAG,CAAA,CAAE,IAAA,CAAK,EAAE,KAAA,EAAO,cAAA,EAAgB,MAAA,EAAQ,wBAAA,EAA0B,CAAA;AAChF,QAAA;AAAA,MACF;AAEA,MAAA,MAAM,UAAU,MAAA,CAAO,eAAA,CAAgB,GAAA,CAAI,WAAA,EAAa,IAAI,cAAc,CAAA;AAC1E,MAAA,IAAA,EAAM,YAAA,CAAa,2BAAA,EAA6B,OAAA,GAAU,SAAA,GAAY,WAAW,CAAA;AACjF,MAAA,IAAI,CAAC,OAAA,EAAS;AACZ,QAAA,GAAA,CAAI,MAAA,CAAO,GAAG,CAAA,CAAE,IAAA,CAAK,EAAE,KAAA,EAAO,WAAA,EAAa,MAAA,EAAQ,2BAAA,EAA6B,CAAA;AAChF,QAAA;AAAA,MACF;AAEA,MAAA,IAAA,EAAK;AAAA,IACP,CAAA;AAAA,EACF,CAAA;AAEA,EAAA,OAAO,EAAE,YAAY,KAAA,EAAM;AAC7B","file":"express.cjs","sourcesContent":["import type { OperationDescriptor } from './models.js';\n\nconst _registry: OperationDescriptor[] = [];\n\n/** Infer operation method from the last segment of the operation id.\n *  e.g. \"tasks:list\" → \"read\", \"tasks:create\" → \"write\", \"tasks:delete\" → \"delete\"\n */\nexport function detectMethod(id: string): string {\n  const last = (id.split(':').pop() ?? '').toLowerCase();\n  if (/^(get|list|fetch|read)/.test(last))       return 'read';\n  if (/^(delete|remove|destroy)/.test(last))      return 'delete';\n  if (/(stream|subscribe|watch|listen)/.test(last)) return 'stream';\n  return 'write';\n}\n\n/** Register an operation in the global registry (used by startup to sync). */\nexport function registerOperation(op: OperationDescriptor): void {\n  const exists = _registry.some(\n    o => o.identifier === op.identifier && o.method === op.method,\n  );\n  if (!exists) _registry.push(op);\n}\n\nexport function getRegistry(): OperationDescriptor[] {\n  return [..._registry];\n}\n\nexport function clearRegistry(): void {\n  _registry.length = 0;\n}","import type { NextFunction, Request, Response } from 'express';\nimport { trace } from '@opentelemetry/api';\nimport { CaronteClient } from '../client.js';\nimport { CaronteTokenError } from '../exceptions.js';\nimport type { TokenClaims } from '../models.js';\nimport { detectMethod, registerOperation } from '../registry.js';\n\ndeclare global {\n  namespace Express {\n    interface Request {\n      caronteUser?: TokenClaims;\n    }\n  }\n}\n\nexport interface CaronteMiddleware {\n  /** Global middleware — validates the Bearer token and injects `req.caronteUser`. */\n  middleware: (req: Request, res: Response, next: NextFunction) => Promise<void>;\n  /** Per-route guard — registers the operation and enforces permission at request time. */\n  guard: (id: string, level: string, method?: string) =>\n    (req: Request, res: Response, next: NextFunction) => void;\n}\n\nexport function caronte(client: CaronteClient): CaronteMiddleware {\n\n  const middleware = async (req: Request, _res: Response, next: NextFunction): Promise<void> => {\n    const auth = req.headers.authorization ?? '';\n    const [scheme, token] = auth.split(' ');\n    if (scheme?.toLowerCase() === 'bearer' && token) {\n      try {\n        req.caronteUser = await client.validateToken(token);\n        trace.getActiveSpan()?.setAttribute('caronte.user', req.caronteUser.sub);\n      } catch {\n        // invalid token — caronteUser stays undefined; guard handles the 401\n      }\n    }\n    next();\n  };\n\n  const guard = (id: string, level: string, method?: string) => {\n    const resolvedMethod = method ?? detectMethod(id);\n    registerOperation({ identifier: id, method: resolvedMethod, level });\n\n    return (req: Request, res: Response, next: NextFunction): void => {\n      const span = trace.getActiveSpan();\n      span?.setAttribute('caronte.operation_id', id);\n\n      if (level === 'public') {\n        span?.setAttribute('caronte.permission_result', 'public');\n        next();\n        return;\n      }\n\n      if (!req.caronteUser) {\n        span?.setAttribute('caronte.permission_result', 'unauthorized');\n        res.status(401).json({ error: 'unauthorized', detail: 'Bearer token required.' });\n        return;\n      }\n\n      const allowed = client.checkPermission(req.caronteUser, id, resolvedMethod);\n      span?.setAttribute('caronte.permission_result', allowed ? 'allowed' : 'forbidden');\n      if (!allowed) {\n        res.status(403).json({ error: 'forbidden', detail: 'Insufficient permissions.' });\n        return;\n      }\n\n      next();\n    };\n  };\n\n  return { middleware, guard };\n}"]}

package/dist/adapters/express.d.cts

@@ -1,5 +1,5 @@
 import { Request, Response, NextFunction } from 'express';
-import { T as TokenClaims, C as CaronteClient } from '../client-TcOSwgrn.cjs';
+import { T as TokenClaims, C as CaronteClient } from '../client-CSokWFYn.cjs';
 
 declare global {
     namespace Express {

package/dist/adapters/express.d.ts

@@ -1,5 +1,5 @@
 import { Request, Response, NextFunction } from 'express';
-import { T as TokenClaims, C as CaronteClient } from '../client-TcOSwgrn.js';
+import { T as TokenClaims, C as CaronteClient } from '../client-CSokWFYn.js';
 
 declare global {
     namespace Express {

package/dist/adapters/express.js

@@ -1,6 +1,6 @@
 import { detectMethod, registerOperation } from '../chunk-HV6X5RJY.js';
+import { trace } from '@opentelemetry/api';
 
-// src/adapters/express.ts
 function caronte(client) {
   const middleware = async (req, _res, next) => {
     const auth = req.headers.authorization ?? "";
@@ -8,6 +8,7 @@ function caronte(client) {
     if (scheme?.toLowerCase() === "bearer" && token) {
       try {
         req.caronteUser = await client.validateToken(token);
+        trace.getActiveSpan()?.setAttribute("caronte.user", req.caronteUser.sub);
       } catch {
       }
     }
@@ -17,15 +18,20 @@ function caronte(client) {
     const resolvedMethod = method ?? detectMethod(id);
     registerOperation({ identifier: id, method: resolvedMethod, level });
     return (req, res, next) => {
+      const span = trace.getActiveSpan();
+      span?.setAttribute("caronte.operation_id", id);
       if (level === "public") {
+        span?.setAttribute("caronte.permission_result", "public");
         next();
         return;
       }
       if (!req.caronteUser) {
+        span?.setAttribute("caronte.permission_result", "unauthorized");
         res.status(401).json({ error: "unauthorized", detail: "Bearer token required." });
         return;
       }
       const allowed = client.checkPermission(req.caronteUser, id, resolvedMethod);
+      span?.setAttribute("caronte.permission_result", allowed ? "allowed" : "forbidden");
       if (!allowed) {
         res.status(403).json({ error: "forbidden", detail: "Insufficient permissions." });
         return;

package/dist/adapters/express.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/adapters/express.ts"],"names":[],"mappings":";;;AAsBO,SAAS,QAAQ,MAAA,EAA0C;AAEhE,EAAA,MAAM,UAAA,GAAa,OAAO,GAAA,EAAc,IAAA,EAAgB,IAAA,KAAsC;AAC5F,IAAA,MAAM,IAAA,GAAO,GAAA,CAAI,OAAA,CAAQ,aAAA,IAAiB,EAAA;AAC1C,IAAA,MAAM,CAAC,MAAA,EAAQ,KAAK,CAAA,GAAI,IAAA,CAAK,MAAM,GAAG,CAAA;AACtC,IAAA,IAAI,MAAA,EAAQ,WAAA,EAAY,KAAM,QAAA,IAAY,KAAA,EAAO;AAC/C,MAAA,IAAI;AACF,QAAA,GAAA,CAAI,WAAA,GAAc,MAAM,MAAA,CAAO,aAAA,CAAc,KAAK,CAAA;AAAA,MACpD,CAAA,CAAA,MAAQ;AAAA,MAER;AAAA,IACF;AACA,IAAA,IAAA,EAAK;AAAA,EACP,CAAA;AAEA,EAAA,MAAM,KAAA,GAAQ,CAAC,EAAA,EAAY,KAAA,EAAe,MAAA,KAAoB;AAC5D,IAAA,MAAM,cAAA,GAAiB,MAAA,IAAU,YAAA,CAAa,EAAE,CAAA;AAChD,IAAA,iBAAA,CAAkB,EAAE,UAAA,EAAY,EAAA,EAAI,MAAA,EAAQ,cAAA,EAAgB,OAAO,CAAA;AAEnE,IAAA,OAAO,CAAC,GAAA,EAAc,GAAA,EAAe,IAAA,KAA6B;AAChE,MAAA,IAAI,UAAU,QAAA,EAAU;AAAE,QAAA,IAAA,EAAK;AAAG,QAAA;AAAA,MAAQ;AAE1C,MAAA,IAAI,CAAC,IAAI,WAAA,EAAa;AACpB,QAAA,GAAA,CAAI,MAAA,CAAO,GAAG,CAAA,CAAE,IAAA,CAAK,EAAE,KAAA,EAAO,cAAA,EAAgB,MAAA,EAAQ,wBAAA,EAA0B,CAAA;AAChF,QAAA;AAAA,MACF;AAEA,MAAA,MAAM,UAAU,MAAA,CAAO,eAAA,CAAgB,GAAA,CAAI,WAAA,EAAa,IAAI,cAAc,CAAA;AAC1E,MAAA,IAAI,CAAC,OAAA,EAAS;AACZ,QAAA,GAAA,CAAI,MAAA,CAAO,GAAG,CAAA,CAAE,IAAA,CAAK,EAAE,KAAA,EAAO,WAAA,EAAa,MAAA,EAAQ,2BAAA,EAA6B,CAAA;AAChF,QAAA;AAAA,MACF;AAEA,MAAA,IAAA,EAAK;AAAA,IACP,CAAA;AAAA,EACF,CAAA;AAEA,EAAA,OAAO,EAAE,YAAY,KAAA,EAAM;AAC7B","file":"express.js","sourcesContent":["import type { NextFunction, Request, Response } from 'express';\nimport { CaronteClient } from '../client.js';\nimport { CaronteTokenError } from '../exceptions.js';\nimport type { TokenClaims } from '../models.js';\nimport { detectMethod, registerOperation } from '../registry.js';\n\ndeclare global {\n  namespace Express {\n    interface Request {\n      caronteUser?: TokenClaims;\n    }\n  }\n}\n\nexport interface CaronteMiddleware {\n  /** Global middleware — validates the Bearer token and injects `req.caronteUser`. */\n  middleware: (req: Request, res: Response, next: NextFunction) => Promise<void>;\n  /** Per-route guard — registers the operation and enforces permission at request time. */\n  guard: (id: string, level: string, method?: string) =>\n    (req: Request, res: Response, next: NextFunction) => void;\n}\n\nexport function caronte(client: CaronteClient): CaronteMiddleware {\n\n  const middleware = async (req: Request, _res: Response, next: NextFunction): Promise<void> => {\n    const auth = req.headers.authorization ?? '';\n    const [scheme, token] = auth.split(' ');\n    if (scheme?.toLowerCase() === 'bearer' && token) {\n      try {\n        req.caronteUser = await client.validateToken(token);\n      } catch {\n        // invalid token — caronteUser stays undefined; guard handles the 401\n      }\n    }\n    next();\n  };\n\n  const guard = (id: string, level: string, method?: string) => {\n    const resolvedMethod = method ?? detectMethod(id);\n    registerOperation({ identifier: id, method: resolvedMethod, level });\n\n    return (req: Request, res: Response, next: NextFunction): void => {\n      if (level === 'public') { next(); return; }\n\n      if (!req.caronteUser) {\n        res.status(401).json({ error: 'unauthorized', detail: 'Bearer token required.' });\n        return;\n      }\n\n      const allowed = client.checkPermission(req.caronteUser, id, resolvedMethod);\n      if (!allowed) {\n        res.status(403).json({ error: 'forbidden', detail: 'Insufficient permissions.' });\n        return;\n      }\n\n      next();\n    };\n  };\n\n  return { middleware, guard };\n}"]}
+{"version":3,"sources":["../../src/adapters/express.ts"],"names":[],"mappings":";;;AAuBO,SAAS,QAAQ,MAAA,EAA0C;AAEhE,EAAA,MAAM,UAAA,GAAa,OAAO,GAAA,EAAc,IAAA,EAAgB,IAAA,KAAsC;AAC5F,IAAA,MAAM,IAAA,GAAO,GAAA,CAAI,OAAA,CAAQ,aAAA,IAAiB,EAAA;AAC1C,IAAA,MAAM,CAAC,MAAA,EAAQ,KAAK,CAAA,GAAI,IAAA,CAAK,MAAM,GAAG,CAAA;AACtC,IAAA,IAAI,MAAA,EAAQ,WAAA,EAAY,KAAM,QAAA,IAAY,KAAA,EAAO;AAC/C,MAAA,IAAI;AACF,QAAA,GAAA,CAAI,WAAA,GAAc,MAAM,MAAA,CAAO,aAAA,CAAc,KAAK,CAAA;AAClD,QAAA,KAAA,CAAM,eAAc,EAAG,YAAA,CAAa,cAAA,EAAgB,GAAA,CAAI,YAAY,GAAG,CAAA;AAAA,MACzE,CAAA,CAAA,MAAQ;AAAA,MAER;AAAA,IACF;AACA,IAAA,IAAA,EAAK;AAAA,EACP,CAAA;AAEA,EAAA,MAAM,KAAA,GAAQ,CAAC,EAAA,EAAY,KAAA,EAAe,MAAA,KAAoB;AAC5D,IAAA,MAAM,cAAA,GAAiB,MAAA,IAAU,YAAA,CAAa,EAAE,CAAA;AAChD,IAAA,iBAAA,CAAkB,EAAE,UAAA,EAAY,EAAA,EAAI,MAAA,EAAQ,cAAA,EAAgB,OAAO,CAAA;AAEnE,IAAA,OAAO,CAAC,GAAA,EAAc,GAAA,EAAe,IAAA,KAA6B;AAChE,MAAA,MAAM,IAAA,GAAO,MAAM,aAAA,EAAc;AACjC,MAAA,IAAA,EAAM,YAAA,CAAa,wBAAwB,EAAE,CAAA;AAE7C,MAAA,IAAI,UAAU,QAAA,EAAU;AACtB,QAAA,IAAA,EAAM,YAAA,CAAa,6BAA6B,QAAQ,CAAA;AACxD,QAAA,IAAA,EAAK;AACL,QAAA;AAAA,MACF;AAEA,MAAA,IAAI,CAAC,IAAI,WAAA,EAAa;AACpB,QAAA,IAAA,EAAM,YAAA,CAAa,6BAA6B,cAAc,CAAA;AAC9D,QAAA,GAAA,CAAI,MAAA,CAAO,GAAG,CAAA,CAAE,IAAA,CAAK,EAAE,KAAA,EAAO,cAAA,EAAgB,MAAA,EAAQ,wBAAA,EAA0B,CAAA;AAChF,QAAA;AAAA,MACF;AAEA,MAAA,MAAM,UAAU,MAAA,CAAO,eAAA,CAAgB,GAAA,CAAI,WAAA,EAAa,IAAI,cAAc,CAAA;AAC1E,MAAA,IAAA,EAAM,YAAA,CAAa,2BAAA,EAA6B,OAAA,GAAU,SAAA,GAAY,WAAW,CAAA;AACjF,MAAA,IAAI,CAAC,OAAA,EAAS;AACZ,QAAA,GAAA,CAAI,MAAA,CAAO,GAAG,CAAA,CAAE,IAAA,CAAK,EAAE,KAAA,EAAO,WAAA,EAAa,MAAA,EAAQ,2BAAA,EAA6B,CAAA;AAChF,QAAA;AAAA,MACF;AAEA,MAAA,IAAA,EAAK;AAAA,IACP,CAAA;AAAA,EACF,CAAA;AAEA,EAAA,OAAO,EAAE,YAAY,KAAA,EAAM;AAC7B","file":"express.js","sourcesContent":["import type { NextFunction, Request, Response } from 'express';\nimport { trace } from '@opentelemetry/api';\nimport { CaronteClient } from '../client.js';\nimport { CaronteTokenError } from '../exceptions.js';\nimport type { TokenClaims } from '../models.js';\nimport { detectMethod, registerOperation } from '../registry.js';\n\ndeclare global {\n  namespace Express {\n    interface Request {\n      caronteUser?: TokenClaims;\n    }\n  }\n}\n\nexport interface CaronteMiddleware {\n  /** Global middleware — validates the Bearer token and injects `req.caronteUser`. */\n  middleware: (req: Request, res: Response, next: NextFunction) => Promise<void>;\n  /** Per-route guard — registers the operation and enforces permission at request time. */\n  guard: (id: string, level: string, method?: string) =>\n    (req: Request, res: Response, next: NextFunction) => void;\n}\n\nexport function caronte(client: CaronteClient): CaronteMiddleware {\n\n  const middleware = async (req: Request, _res: Response, next: NextFunction): Promise<void> => {\n    const auth = req.headers.authorization ?? '';\n    const [scheme, token] = auth.split(' ');\n    if (scheme?.toLowerCase() === 'bearer' && token) {\n      try {\n        req.caronteUser = await client.validateToken(token);\n        trace.getActiveSpan()?.setAttribute('caronte.user', req.caronteUser.sub);\n      } catch {\n        // invalid token — caronteUser stays undefined; guard handles the 401\n      }\n    }\n    next();\n  };\n\n  const guard = (id: string, level: string, method?: string) => {\n    const resolvedMethod = method ?? detectMethod(id);\n    registerOperation({ identifier: id, method: resolvedMethod, level });\n\n    return (req: Request, res: Response, next: NextFunction): void => {\n      const span = trace.getActiveSpan();\n      span?.setAttribute('caronte.operation_id', id);\n\n      if (level === 'public') {\n        span?.setAttribute('caronte.permission_result', 'public');\n        next();\n        return;\n      }\n\n      if (!req.caronteUser) {\n        span?.setAttribute('caronte.permission_result', 'unauthorized');\n        res.status(401).json({ error: 'unauthorized', detail: 'Bearer token required.' });\n        return;\n      }\n\n      const allowed = client.checkPermission(req.caronteUser, id, resolvedMethod);\n      span?.setAttribute('caronte.permission_result', allowed ? 'allowed' : 'forbidden');\n      if (!allowed) {\n        res.status(403).json({ error: 'forbidden', detail: 'Insufficient permissions.' });\n        return;\n      }\n\n      next();\n    };\n  };\n\n  return { middleware, guard };\n}"]}

package/dist/adapters/fastify.cjs

@@ -1,6 +1,7 @@
 'use strict';
 
 var fp = require('fastify-plugin');
+var api = require('@opentelemetry/api');
 
 function _interopDefault (e) { return e && e.__esModule ? e : { default: e }; }
 
@@ -33,6 +34,7 @@ var carontePlugin = async (fastify, { client }) => {
     if (scheme?.toLowerCase() === "bearer" && token) {
       try {
         request.caronteUser = await client.validateToken(token);
+        api.trace.getActiveSpan()?.setAttribute("caronte.user", request.caronteUser.sub);
       } catch {
       }
     }
@@ -43,12 +45,19 @@ var carontePlugin = async (fastify, { client }) => {
       const resolvedMethod = method ?? detectMethod(id);
       registerOperation({ identifier: id, method: resolvedMethod, level });
       return async (request, reply) => {
-        if (level === "public") return;
+        const span = api.trace.getActiveSpan();
+        span?.setAttribute("caronte.operation_id", id);
+        if (level === "public") {
+          span?.setAttribute("caronte.permission_result", "public");
+          return;
+        }
         if (!request.caronteUser) {
+          span?.setAttribute("caronte.permission_result", "unauthorized");
           await reply.status(401).send({ error: "unauthorized", detail: "Bearer token required." });
           return;
         }
         const allowed = client.checkPermission(request.caronteUser, id, resolvedMethod);
+        span?.setAttribute("caronte.permission_result", allowed ? "allowed" : "forbidden");
         if (!allowed) {
           await reply.status(403).send({ error: "forbidden", detail: "Insufficient permissions." });
         }

package/dist/adapters/fastify.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/registry.ts","../../src/adapters/fastify.ts"],"names":["fp"],"mappings":";;;;;;;;;;;AAEA,IAAM,YAAmC,EAAC;AAKnC,SAAS,aAAa,EAAA,EAAoB;AAC/C,EAAA,MAAM,IAAA,GAAA,CAAQ,GAAG,KAAA,CAAM,GAAG,EAAE,GAAA,EAAI,IAAK,IAAI,WAAA,EAAY;AACrD,EAAA,IAAI,wBAAA,CAAyB,IAAA,CAAK,IAAI,CAAA,EAAS,OAAO,MAAA;AACtD,EAAA,IAAI,0BAAA,CAA2B,IAAA,CAAK,IAAI,CAAA,EAAQ,OAAO,QAAA;AACvD,EAAA,IAAI,iCAAA,CAAkC,IAAA,CAAK,IAAI,CAAA,EAAG,OAAO,QAAA;AACzD,EAAA,OAAO,OAAA;AACT;AAGO,SAAS,kBAAkB,EAAA,EAA+B;AAC/D,EAAA,MAAM,SAAS,SAAA,CAAU,IAAA;AAAA,IACvB,OAAK,CAAA,CAAE,UAAA,KAAe,GAAG,UAAA,IAAc,CAAA,CAAE,WAAW,EAAA,CAAG;AAAA,GACzD;AACA,EAAA,IAAI,CAAC,MAAA,EAAQ,SAAA,CAAU,IAAA,CAAK,EAAE,CAAA;AAChC;;;ACLA,IAAM,aAAA,GAA0D,OAC9D,OAAA,EACA,EAAE,QAAO,KACN;AAEH,EAAA,OAAA,CAAQ,eAAA,CAAyC,eAAe,MAAS,CAAA;AAGzE,EAAA,OAAA,CAAQ,OAAA,CAAQ,WAAA,EAAa,OAAO,OAAA,KAA4B;AAC9D,IAAA,MAAM,IAAA,GAAO,OAAA,CAAQ,OAAA,CAAQ,aAAA,IAAiB,EAAA;AAC9C,IAAA,MAAM,CAAC,MAAA,EAAQ,KAAK,CAAA,GAAI,IAAA,CAAK,MAAM,GAAG,CAAA;AACtC,IAAA,IAAI,MAAA,EAAQ,WAAA,EAAY,KAAM,QAAA,IAAY,KAAA,EAAO;AAC/C,MAAA,IAAI;AACF,QAAA,OAAA,CAAQ,WAAA,GAAc,MAAM,MAAA,CAAO,aAAA,CAAc,KAAK,CAAA;AAAA,MACxD,CAAA,CAAA,MAAQ;AAAA,MAER;AAAA,IACF;AAAA,EACF,CAAC,CAAA;AAGD,EAAA,OAAA,CAAQ,QAAA;AAAA,IACN,cAAA;AAAA,IACA,CAAC,EAAA,EAAY,KAAA,EAAe,MAAA,KAAoB;AAC9C,MAAA,MAAM,cAAA,GAAiB,MAAA,IAAU,YAAA,CAAa,EAAE,CAAA;AAChD,MAAA,iBAAA,CAAkB,EAAE,UAAA,EAAY,EAAA,EAAI,MAAA,EAAQ,cAAA,EAAgB,OAAO,CAAA;AAEnE,MAAA,OAAO,OAAO,SAAyB,KAAA,KAAuC;AAC5E,QAAA,IAAI,UAAU,QAAA,EAAU;AAExB,QAAA,IAAI,CAAC,QAAQ,WAAA,EAAa;AACxB,UAAA,MAAM,KAAA,CAAM,MAAA,CAAO,GAAG,CAAA,CAAE,IAAA,CAAK,EAAE,KAAA,EAAO,cAAA,EAAgB,MAAA,EAAQ,wBAAA,EAA0B,CAAA;AACxF,UAAA;AAAA,QACF;AAEA,QAAA,MAAM,UAAU,MAAA,CAAO,eAAA,CAAgB,OAAA,CAAQ,WAAA,EAAa,IAAI,cAAc,CAAA;AAC9E,QAAA,IAAI,CAAC,OAAA,EAAS;AACZ,UAAA,MAAM,KAAA,CAAM,MAAA,CAAO,GAAG,CAAA,CAAE,IAAA,CAAK,EAAE,KAAA,EAAO,WAAA,EAAa,MAAA,EAAQ,2BAAA,EAA6B,CAAA;AAAA,QAC1F;AAAA,MACF,CAAA;AAAA,IACF;AAAA,GACF;AACF,CAAA;AAEO,IAAM,oBAAA,GAAuBA,oBAAG,aAAA,EAAe;AAAA,EACpD,IAAA,EAAM,SAAA;AAAA,EACN,OAAA,EAAS;AACX,CAAC","file":"fastify.cjs","sourcesContent":["import type { OperationDescriptor } from './models.js';\n\nconst _registry: OperationDescriptor[] = [];\n\n/** Infer operation method from the last segment of the operation id.\n *  e.g. \"tasks:list\" → \"read\", \"tasks:create\" → \"write\", \"tasks:delete\" → \"delete\"\n */\nexport function detectMethod(id: string): string {\n  const last = (id.split(':').pop() ?? '').toLowerCase();\n  if (/^(get|list|fetch|read)/.test(last))       return 'read';\n  if (/^(delete|remove|destroy)/.test(last))      return 'delete';\n  if (/(stream|subscribe|watch|listen)/.test(last)) return 'stream';\n  return 'write';\n}\n\n/** Register an operation in the global registry (used by startup to sync). */\nexport function registerOperation(op: OperationDescriptor): void {\n  const exists = _registry.some(\n    o => o.identifier === op.identifier && o.method === op.method,\n  );\n  if (!exists) _registry.push(op);\n}\n\nexport function getRegistry(): OperationDescriptor[] {\n  return [..._registry];\n}\n\nexport function clearRegistry(): void {\n  _registry.length = 0;\n}","import type { FastifyInstance, FastifyPluginAsync, FastifyReply, FastifyRequest } from 'fastify';\nimport fp from 'fastify-plugin';\nimport { CaronteClient } from '../client.js';\nimport type { TokenClaims } from '../models.js';\nimport { detectMethod, registerOperation } from '../registry.js';\n\ndeclare module 'fastify' {\n  interface FastifyRequest {\n    caronteUser?: TokenClaims;\n  }\n}\n\nexport interface CarontePluginOptions {\n  client: CaronteClient;\n}\n\nconst carontePlugin: FastifyPluginAsync<CarontePluginOptions> = async (\n  fastify: FastifyInstance,\n  { client }: CarontePluginOptions,\n) => {\n  // Decorate request with caronteUser\n  fastify.decorateRequest<TokenClaims | undefined>('caronteUser', undefined);\n\n  // Global hook — validates Bearer token on every request\n  fastify.addHook('onRequest', async (request: FastifyRequest) => {\n    const auth = request.headers.authorization ?? '';\n    const [scheme, token] = auth.split(' ');\n    if (scheme?.toLowerCase() === 'bearer' && token) {\n      try {\n        request.caronteUser = await client.validateToken(token);\n      } catch {\n        // invalid token — caronteUser stays null; guard handles the 401\n      }\n    }\n  });\n\n  // Decorate fastify with a guard factory\n  fastify.decorate(\n    'caronteGuard',\n    (id: string, level: string, method?: string) => {\n      const resolvedMethod = method ?? detectMethod(id);\n      registerOperation({ identifier: id, method: resolvedMethod, level });\n\n      return async (request: FastifyRequest, reply: FastifyReply): Promise<void> => {\n        if (level === 'public') return;\n\n        if (!request.caronteUser) {\n          await reply.status(401).send({ error: 'unauthorized', detail: 'Bearer token required.' });\n          return;\n        }\n\n        const allowed = client.checkPermission(request.caronteUser, id, resolvedMethod);\n        if (!allowed) {\n          await reply.status(403).send({ error: 'forbidden', detail: 'Insufficient permissions.' });\n        }\n      };\n    },\n  );\n};\n\nexport const caronteFastifyPlugin = fp(carontePlugin, {\n  name: 'caronte',\n  fastify: '>=4',\n});\n\ndeclare module 'fastify' {\n  interface FastifyInstance {\n    caronteGuard: (\n      id: string,\n      level: string,\n      method?: string,\n    ) => (req: FastifyRequest, reply: FastifyReply) => Promise<void>;\n  }\n}"]}
+{"version":3,"sources":["../../src/registry.ts","../../src/adapters/fastify.ts"],"names":["trace","fp"],"mappings":";;;;;;;;;;;;AAEA,IAAM,YAAmC,EAAC;AAKnC,SAAS,aAAa,EAAA,EAAoB;AAC/C,EAAA,MAAM,IAAA,GAAA,CAAQ,GAAG,KAAA,CAAM,GAAG,EAAE,GAAA,EAAI,IAAK,IAAI,WAAA,EAAY;AACrD,EAAA,IAAI,wBAAA,CAAyB,IAAA,CAAK,IAAI,CAAA,EAAS,OAAO,MAAA;AACtD,EAAA,IAAI,0BAAA,CAA2B,IAAA,CAAK,IAAI,CAAA,EAAQ,OAAO,QAAA;AACvD,EAAA,IAAI,iCAAA,CAAkC,IAAA,CAAK,IAAI,CAAA,EAAG,OAAO,QAAA;AACzD,EAAA,OAAO,OAAA;AACT;AAGO,SAAS,kBAAkB,EAAA,EAA+B;AAC/D,EAAA,MAAM,SAAS,SAAA,CAAU,IAAA;AAAA,IACvB,OAAK,CAAA,CAAE,UAAA,KAAe,GAAG,UAAA,IAAc,CAAA,CAAE,WAAW,EAAA,CAAG;AAAA,GACzD;AACA,EAAA,IAAI,CAAC,MAAA,EAAQ,SAAA,CAAU,IAAA,CAAK,EAAE,CAAA;AAChC;;;ACJA,IAAM,aAAA,GAA0D,OAC9D,OAAA,EACA,EAAE,QAAO,KACN;AAEH,EAAA,OAAA,CAAQ,eAAA,CAAyC,eAAe,MAAS,CAAA;AAGzE,EAAA,OAAA,CAAQ,OAAA,CAAQ,WAAA,EAAa,OAAO,OAAA,KAA4B;AAC9D,IAAA,MAAM,IAAA,GAAO,OAAA,CAAQ,OAAA,CAAQ,aAAA,IAAiB,EAAA;AAC9C,IAAA,MAAM,CAAC,MAAA,EAAQ,KAAK,CAAA,GAAI,IAAA,CAAK,MAAM,GAAG,CAAA;AACtC,IAAA,IAAI,MAAA,EAAQ,WAAA,EAAY,KAAM,QAAA,IAAY,KAAA,EAAO;AAC/C,MAAA,IAAI;AACF,QAAA,OAAA,CAAQ,WAAA,GAAc,MAAM,MAAA,CAAO,aAAA,CAAc,KAAK,CAAA;AACtD,QAAAA,SAAA,CAAM,eAAc,EAAG,YAAA,CAAa,cAAA,EAAgB,OAAA,CAAQ,YAAY,GAAG,CAAA;AAAA,MAC7E,CAAA,CAAA,MAAQ;AAAA,MAER;AAAA,IACF;AAAA,EACF,CAAC,CAAA;AAGD,EAAA,OAAA,CAAQ,QAAA;AAAA,IACN,cAAA;AAAA,IACA,CAAC,EAAA,EAAY,KAAA,EAAe,MAAA,KAAoB;AAC9C,MAAA,MAAM,cAAA,GAAiB,MAAA,IAAU,YAAA,CAAa,EAAE,CAAA;AAChD,MAAA,iBAAA,CAAkB,EAAE,UAAA,EAAY,EAAA,EAAI,MAAA,EAAQ,cAAA,EAAgB,OAAO,CAAA;AAEnE,MAAA,OAAO,OAAO,SAAyB,KAAA,KAAuC;AAC5E,QAAA,MAAM,IAAA,GAAOA,UAAM,aAAA,EAAc;AACjC,QAAA,IAAA,EAAM,YAAA,CAAa,wBAAwB,EAAE,CAAA;AAE7C,QAAA,IAAI,UAAU,QAAA,EAAU;AACtB,UAAA,IAAA,EAAM,YAAA,CAAa,6BAA6B,QAAQ,CAAA;AACxD,UAAA;AAAA,QACF;AAEA,QAAA,IAAI,CAAC,QAAQ,WAAA,EAAa;AACxB,UAAA,IAAA,EAAM,YAAA,CAAa,6BAA6B,cAAc,CAAA;AAC9D,UAAA,MAAM,KAAA,CAAM,MAAA,CAAO,GAAG,CAAA,CAAE,IAAA,CAAK,EAAE,KAAA,EAAO,cAAA,EAAgB,MAAA,EAAQ,wBAAA,EAA0B,CAAA;AACxF,UAAA;AAAA,QACF;AAEA,QAAA,MAAM,UAAU,MAAA,CAAO,eAAA,CAAgB,OAAA,CAAQ,WAAA,EAAa,IAAI,cAAc,CAAA;AAC9E,QAAA,IAAA,EAAM,YAAA,CAAa,2BAAA,EAA6B,OAAA,GAAU,SAAA,GAAY,WAAW,CAAA;AACjF,QAAA,IAAI,CAAC,OAAA,EAAS;AACZ,UAAA,MAAM,KAAA,CAAM,MAAA,CAAO,GAAG,CAAA,CAAE,IAAA,CAAK,EAAE,KAAA,EAAO,WAAA,EAAa,MAAA,EAAQ,2BAAA,EAA6B,CAAA;AAAA,QAC1F;AAAA,MACF,CAAA;AAAA,IACF;AAAA,GACF;AACF,CAAA;AAEO,IAAM,oBAAA,GAAuBC,oBAAG,aAAA,EAAe;AAAA,EACpD,IAAA,EAAM,SAAA;AAAA,EACN,OAAA,EAAS;AACX,CAAC","file":"fastify.cjs","sourcesContent":["import type { OperationDescriptor } from './models.js';\n\nconst _registry: OperationDescriptor[] = [];\n\n/** Infer operation method from the last segment of the operation id.\n *  e.g. \"tasks:list\" → \"read\", \"tasks:create\" → \"write\", \"tasks:delete\" → \"delete\"\n */\nexport function detectMethod(id: string): string {\n  const last = (id.split(':').pop() ?? '').toLowerCase();\n  if (/^(get|list|fetch|read)/.test(last))       return 'read';\n  if (/^(delete|remove|destroy)/.test(last))      return 'delete';\n  if (/(stream|subscribe|watch|listen)/.test(last)) return 'stream';\n  return 'write';\n}\n\n/** Register an operation in the global registry (used by startup to sync). */\nexport function registerOperation(op: OperationDescriptor): void {\n  const exists = _registry.some(\n    o => o.identifier === op.identifier && o.method === op.method,\n  );\n  if (!exists) _registry.push(op);\n}\n\nexport function getRegistry(): OperationDescriptor[] {\n  return [..._registry];\n}\n\nexport function clearRegistry(): void {\n  _registry.length = 0;\n}","import type { FastifyInstance, FastifyPluginAsync, FastifyReply, FastifyRequest } from 'fastify';\nimport fp from 'fastify-plugin';\nimport { trace } from '@opentelemetry/api';\nimport { CaronteClient } from '../client.js';\nimport type { TokenClaims } from '../models.js';\nimport { detectMethod, registerOperation } from '../registry.js';\n\ndeclare module 'fastify' {\n  interface FastifyRequest {\n    caronteUser?: TokenClaims;\n  }\n}\n\nexport interface CarontePluginOptions {\n  client: CaronteClient;\n}\n\nconst carontePlugin: FastifyPluginAsync<CarontePluginOptions> = async (\n  fastify: FastifyInstance,\n  { client }: CarontePluginOptions,\n) => {\n  // Decorate request with caronteUser\n  fastify.decorateRequest<TokenClaims | undefined>('caronteUser', undefined);\n\n  // Global hook — validates Bearer token on every request\n  fastify.addHook('onRequest', async (request: FastifyRequest) => {\n    const auth = request.headers.authorization ?? '';\n    const [scheme, token] = auth.split(' ');\n    if (scheme?.toLowerCase() === 'bearer' && token) {\n      try {\n        request.caronteUser = await client.validateToken(token);\n        trace.getActiveSpan()?.setAttribute('caronte.user', request.caronteUser.sub);\n      } catch {\n        // invalid token — caronteUser stays null; guard handles the 401\n      }\n    }\n  });\n\n  // Decorate fastify with a guard factory\n  fastify.decorate(\n    'caronteGuard',\n    (id: string, level: string, method?: string) => {\n      const resolvedMethod = method ?? detectMethod(id);\n      registerOperation({ identifier: id, method: resolvedMethod, level });\n\n      return async (request: FastifyRequest, reply: FastifyReply): Promise<void> => {\n        const span = trace.getActiveSpan();\n        span?.setAttribute('caronte.operation_id', id);\n\n        if (level === 'public') {\n          span?.setAttribute('caronte.permission_result', 'public');\n          return;\n        }\n\n        if (!request.caronteUser) {\n          span?.setAttribute('caronte.permission_result', 'unauthorized');\n          await reply.status(401).send({ error: 'unauthorized', detail: 'Bearer token required.' });\n          return;\n        }\n\n        const allowed = client.checkPermission(request.caronteUser, id, resolvedMethod);\n        span?.setAttribute('caronte.permission_result', allowed ? 'allowed' : 'forbidden');\n        if (!allowed) {\n          await reply.status(403).send({ error: 'forbidden', detail: 'Insufficient permissions.' });\n        }\n      };\n    },\n  );\n};\n\nexport const caronteFastifyPlugin = fp(carontePlugin, {\n  name: 'caronte',\n  fastify: '>=4',\n});\n\ndeclare module 'fastify' {\n  interface FastifyInstance {\n    caronteGuard: (\n      id: string,\n      level: string,\n      method?: string,\n    ) => (req: FastifyRequest, reply: FastifyReply) => Promise<void>;\n  }\n}"]}

package/dist/adapters/fastify.d.cts

@@ -1,5 +1,5 @@
 import { FastifyReply, FastifyPluginAsync } from 'fastify';
-import { T as TokenClaims, C as CaronteClient } from '../client-TcOSwgrn.cjs';
+import { T as TokenClaims, C as CaronteClient } from '../client-CSokWFYn.cjs';
 
 interface CarontePluginOptions {
     client: CaronteClient;

package/dist/adapters/fastify.d.ts

@@ -1,5 +1,5 @@
 import { FastifyReply, FastifyPluginAsync } from 'fastify';
-import { T as TokenClaims, C as CaronteClient } from '../client-TcOSwgrn.js';
+import { T as TokenClaims, C as CaronteClient } from '../client-CSokWFYn.js';
 
 interface CarontePluginOptions {
     client: CaronteClient;

package/dist/adapters/fastify.js

@@ -1,5 +1,6 @@
 import { detectMethod, registerOperation } from '../chunk-HV6X5RJY.js';
 import fp from 'fastify-plugin';
+import { trace } from '@opentelemetry/api';
 
 var carontePlugin = async (fastify, { client }) => {
   fastify.decorateRequest("caronteUser", void 0);
@@ -9,6 +10,7 @@ var carontePlugin = async (fastify, { client }) => {
     if (scheme?.toLowerCase() === "bearer" && token) {
       try {
         request.caronteUser = await client.validateToken(token);
+        trace.getActiveSpan()?.setAttribute("caronte.user", request.caronteUser.sub);
       } catch {
       }
     }
@@ -19,12 +21,19 @@ var carontePlugin = async (fastify, { client }) => {
       const resolvedMethod = method ?? detectMethod(id);
       registerOperation({ identifier: id, method: resolvedMethod, level });
       return async (request, reply) => {
-        if (level === "public") return;
+        const span = trace.getActiveSpan();
+        span?.setAttribute("caronte.operation_id", id);
+        if (level === "public") {
+          span?.setAttribute("caronte.permission_result", "public");
+          return;
+        }
         if (!request.caronteUser) {
+          span?.setAttribute("caronte.permission_result", "unauthorized");
           await reply.status(401).send({ error: "unauthorized", detail: "Bearer token required." });
           return;
         }
         const allowed = client.checkPermission(request.caronteUser, id, resolvedMethod);
+        span?.setAttribute("caronte.permission_result", allowed ? "allowed" : "forbidden");
         if (!allowed) {
           await reply.status(403).send({ error: "forbidden", detail: "Insufficient permissions." });
         }

package/dist/adapters/fastify.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/adapters/fastify.ts"],"names":[],"mappings":";;;AAgBA,IAAM,aAAA,GAA0D,OAC9D,OAAA,EACA,EAAE,QAAO,KACN;AAEH,EAAA,OAAA,CAAQ,eAAA,CAAyC,eAAe,MAAS,CAAA;AAGzE,EAAA,OAAA,CAAQ,OAAA,CAAQ,WAAA,EAAa,OAAO,OAAA,KAA4B;AAC9D,IAAA,MAAM,IAAA,GAAO,OAAA,CAAQ,OAAA,CAAQ,aAAA,IAAiB,EAAA;AAC9C,IAAA,MAAM,CAAC,MAAA,EAAQ,KAAK,CAAA,GAAI,IAAA,CAAK,MAAM,GAAG,CAAA;AACtC,IAAA,IAAI,MAAA,EAAQ,WAAA,EAAY,KAAM,QAAA,IAAY,KAAA,EAAO;AAC/C,MAAA,IAAI;AACF,QAAA,OAAA,CAAQ,WAAA,GAAc,MAAM,MAAA,CAAO,aAAA,CAAc,KAAK,CAAA;AAAA,MACxD,CAAA,CAAA,MAAQ;AAAA,MAER;AAAA,IACF;AAAA,EACF,CAAC,CAAA;AAGD,EAAA,OAAA,CAAQ,QAAA;AAAA,IACN,cAAA;AAAA,IACA,CAAC,EAAA,EAAY,KAAA,EAAe,MAAA,KAAoB;AAC9C,MAAA,MAAM,cAAA,GAAiB,MAAA,IAAU,YAAA,CAAa,EAAE,CAAA;AAChD,MAAA,iBAAA,CAAkB,EAAE,UAAA,EAAY,EAAA,EAAI,MAAA,EAAQ,cAAA,EAAgB,OAAO,CAAA;AAEnE,MAAA,OAAO,OAAO,SAAyB,KAAA,KAAuC;AAC5E,QAAA,IAAI,UAAU,QAAA,EAAU;AAExB,QAAA,IAAI,CAAC,QAAQ,WAAA,EAAa;AACxB,UAAA,MAAM,KAAA,CAAM,MAAA,CAAO,GAAG,CAAA,CAAE,IAAA,CAAK,EAAE,KAAA,EAAO,cAAA,EAAgB,MAAA,EAAQ,wBAAA,EAA0B,CAAA;AACxF,UAAA;AAAA,QACF;AAEA,QAAA,MAAM,UAAU,MAAA,CAAO,eAAA,CAAgB,OAAA,CAAQ,WAAA,EAAa,IAAI,cAAc,CAAA;AAC9E,QAAA,IAAI,CAAC,OAAA,EAAS;AACZ,UAAA,MAAM,KAAA,CAAM,MAAA,CAAO,GAAG,CAAA,CAAE,IAAA,CAAK,EAAE,KAAA,EAAO,WAAA,EAAa,MAAA,EAAQ,2BAAA,EAA6B,CAAA;AAAA,QAC1F;AAAA,MACF,CAAA;AAAA,IACF;AAAA,GACF;AACF,CAAA;AAEO,IAAM,oBAAA,GAAuB,GAAG,aAAA,EAAe;AAAA,EACpD,IAAA,EAAM,SAAA;AAAA,EACN,OAAA,EAAS;AACX,CAAC","file":"fastify.js","sourcesContent":["import type { FastifyInstance, FastifyPluginAsync, FastifyReply, FastifyRequest } from 'fastify';\nimport fp from 'fastify-plugin';\nimport { CaronteClient } from '../client.js';\nimport type { TokenClaims } from '../models.js';\nimport { detectMethod, registerOperation } from '../registry.js';\n\ndeclare module 'fastify' {\n  interface FastifyRequest {\n    caronteUser?: TokenClaims;\n  }\n}\n\nexport interface CarontePluginOptions {\n  client: CaronteClient;\n}\n\nconst carontePlugin: FastifyPluginAsync<CarontePluginOptions> = async (\n  fastify: FastifyInstance,\n  { client }: CarontePluginOptions,\n) => {\n  // Decorate request with caronteUser\n  fastify.decorateRequest<TokenClaims | undefined>('caronteUser', undefined);\n\n  // Global hook — validates Bearer token on every request\n  fastify.addHook('onRequest', async (request: FastifyRequest) => {\n    const auth = request.headers.authorization ?? '';\n    const [scheme, token] = auth.split(' ');\n    if (scheme?.toLowerCase() === 'bearer' && token) {\n      try {\n        request.caronteUser = await client.validateToken(token);\n      } catch {\n        // invalid token — caronteUser stays null; guard handles the 401\n      }\n    }\n  });\n\n  // Decorate fastify with a guard factory\n  fastify.decorate(\n    'caronteGuard',\n    (id: string, level: string, method?: string) => {\n      const resolvedMethod = method ?? detectMethod(id);\n      registerOperation({ identifier: id, method: resolvedMethod, level });\n\n      return async (request: FastifyRequest, reply: FastifyReply): Promise<void> => {\n        if (level === 'public') return;\n\n        if (!request.caronteUser) {\n          await reply.status(401).send({ error: 'unauthorized', detail: 'Bearer token required.' });\n          return;\n        }\n\n        const allowed = client.checkPermission(request.caronteUser, id, resolvedMethod);\n        if (!allowed) {\n          await reply.status(403).send({ error: 'forbidden', detail: 'Insufficient permissions.' });\n        }\n      };\n    },\n  );\n};\n\nexport const caronteFastifyPlugin = fp(carontePlugin, {\n  name: 'caronte',\n  fastify: '>=4',\n});\n\ndeclare module 'fastify' {\n  interface FastifyInstance {\n    caronteGuard: (\n      id: string,\n      level: string,\n      method?: string,\n    ) => (req: FastifyRequest, reply: FastifyReply) => Promise<void>;\n  }\n}"]}
+{"version":3,"sources":["../../src/adapters/fastify.ts"],"names":[],"mappings":";;;;AAiBA,IAAM,aAAA,GAA0D,OAC9D,OAAA,EACA,EAAE,QAAO,KACN;AAEH,EAAA,OAAA,CAAQ,eAAA,CAAyC,eAAe,MAAS,CAAA;AAGzE,EAAA,OAAA,CAAQ,OAAA,CAAQ,WAAA,EAAa,OAAO,OAAA,KAA4B;AAC9D,IAAA,MAAM,IAAA,GAAO,OAAA,CAAQ,OAAA,CAAQ,aAAA,IAAiB,EAAA;AAC9C,IAAA,MAAM,CAAC,MAAA,EAAQ,KAAK,CAAA,GAAI,IAAA,CAAK,MAAM,GAAG,CAAA;AACtC,IAAA,IAAI,MAAA,EAAQ,WAAA,EAAY,KAAM,QAAA,IAAY,KAAA,EAAO;AAC/C,MAAA,IAAI;AACF,QAAA,OAAA,CAAQ,WAAA,GAAc,MAAM,MAAA,CAAO,aAAA,CAAc,KAAK,CAAA;AACtD,QAAA,KAAA,CAAM,eAAc,EAAG,YAAA,CAAa,cAAA,EAAgB,OAAA,CAAQ,YAAY,GAAG,CAAA;AAAA,MAC7E,CAAA,CAAA,MAAQ;AAAA,MAER;AAAA,IACF;AAAA,EACF,CAAC,CAAA;AAGD,EAAA,OAAA,CAAQ,QAAA;AAAA,IACN,cAAA;AAAA,IACA,CAAC,EAAA,EAAY,KAAA,EAAe,MAAA,KAAoB;AAC9C,MAAA,MAAM,cAAA,GAAiB,MAAA,IAAU,YAAA,CAAa,EAAE,CAAA;AAChD,MAAA,iBAAA,CAAkB,EAAE,UAAA,EAAY,EAAA,EAAI,MAAA,EAAQ,cAAA,EAAgB,OAAO,CAAA;AAEnE,MAAA,OAAO,OAAO,SAAyB,KAAA,KAAuC;AAC5E,QAAA,MAAM,IAAA,GAAO,MAAM,aAAA,EAAc;AACjC,QAAA,IAAA,EAAM,YAAA,CAAa,wBAAwB,EAAE,CAAA;AAE7C,QAAA,IAAI,UAAU,QAAA,EAAU;AACtB,UAAA,IAAA,EAAM,YAAA,CAAa,6BAA6B,QAAQ,CAAA;AACxD,UAAA;AAAA,QACF;AAEA,QAAA,IAAI,CAAC,QAAQ,WAAA,EAAa;AACxB,UAAA,IAAA,EAAM,YAAA,CAAa,6BAA6B,cAAc,CAAA;AAC9D,UAAA,MAAM,KAAA,CAAM,MAAA,CAAO,GAAG,CAAA,CAAE,IAAA,CAAK,EAAE,KAAA,EAAO,cAAA,EAAgB,MAAA,EAAQ,wBAAA,EAA0B,CAAA;AACxF,UAAA;AAAA,QACF;AAEA,QAAA,MAAM,UAAU,MAAA,CAAO,eAAA,CAAgB,OAAA,CAAQ,WAAA,EAAa,IAAI,cAAc,CAAA;AAC9E,QAAA,IAAA,EAAM,YAAA,CAAa,2BAAA,EAA6B,OAAA,GAAU,SAAA,GAAY,WAAW,CAAA;AACjF,QAAA,IAAI,CAAC,OAAA,EAAS;AACZ,UAAA,MAAM,KAAA,CAAM,MAAA,CAAO,GAAG,CAAA,CAAE,IAAA,CAAK,EAAE,KAAA,EAAO,WAAA,EAAa,MAAA,EAAQ,2BAAA,EAA6B,CAAA;AAAA,QAC1F;AAAA,MACF,CAAA;AAAA,IACF;AAAA,GACF;AACF,CAAA;AAEO,IAAM,oBAAA,GAAuB,GAAG,aAAA,EAAe;AAAA,EACpD,IAAA,EAAM,SAAA;AAAA,EACN,OAAA,EAAS;AACX,CAAC","file":"fastify.js","sourcesContent":["import type { FastifyInstance, FastifyPluginAsync, FastifyReply, FastifyRequest } from 'fastify';\nimport fp from 'fastify-plugin';\nimport { trace } from '@opentelemetry/api';\nimport { CaronteClient } from '../client.js';\nimport type { TokenClaims } from '../models.js';\nimport { detectMethod, registerOperation } from '../registry.js';\n\ndeclare module 'fastify' {\n  interface FastifyRequest {\n    caronteUser?: TokenClaims;\n  }\n}\n\nexport interface CarontePluginOptions {\n  client: CaronteClient;\n}\n\nconst carontePlugin: FastifyPluginAsync<CarontePluginOptions> = async (\n  fastify: FastifyInstance,\n  { client }: CarontePluginOptions,\n) => {\n  // Decorate request with caronteUser\n  fastify.decorateRequest<TokenClaims | undefined>('caronteUser', undefined);\n\n  // Global hook — validates Bearer token on every request\n  fastify.addHook('onRequest', async (request: FastifyRequest) => {\n    const auth = request.headers.authorization ?? '';\n    const [scheme, token] = auth.split(' ');\n    if (scheme?.toLowerCase() === 'bearer' && token) {\n      try {\n        request.caronteUser = await client.validateToken(token);\n        trace.getActiveSpan()?.setAttribute('caronte.user', request.caronteUser.sub);\n      } catch {\n        // invalid token — caronteUser stays null; guard handles the 401\n      }\n    }\n  });\n\n  // Decorate fastify with a guard factory\n  fastify.decorate(\n    'caronteGuard',\n    (id: string, level: string, method?: string) => {\n      const resolvedMethod = method ?? detectMethod(id);\n      registerOperation({ identifier: id, method: resolvedMethod, level });\n\n      return async (request: FastifyRequest, reply: FastifyReply): Promise<void> => {\n        const span = trace.getActiveSpan();\n        span?.setAttribute('caronte.operation_id', id);\n\n        if (level === 'public') {\n          span?.setAttribute('caronte.permission_result', 'public');\n          return;\n        }\n\n        if (!request.caronteUser) {\n          span?.setAttribute('caronte.permission_result', 'unauthorized');\n          await reply.status(401).send({ error: 'unauthorized', detail: 'Bearer token required.' });\n          return;\n        }\n\n        const allowed = client.checkPermission(request.caronteUser, id, resolvedMethod);\n        span?.setAttribute('caronte.permission_result', allowed ? 'allowed' : 'forbidden');\n        if (!allowed) {\n          await reply.status(403).send({ error: 'forbidden', detail: 'Insufficient permissions.' });\n        }\n      };\n    },\n  );\n};\n\nexport const caronteFastifyPlugin = fp(carontePlugin, {\n  name: 'caronte',\n  fastify: '>=4',\n});\n\ndeclare module 'fastify' {\n  interface FastifyInstance {\n    caronteGuard: (\n      id: string,\n      level: string,\n      method?: string,\n    ) => (req: FastifyRequest, reply: FastifyReply) => Promise<void>;\n  }\n}"]}