@grantjs/client 1.0.0 → 1.1.0

package/dist/react.mjs

@@ -1,139 +1,243 @@
+import { t as GrantClient } from "./grant-client-BuvFCpqW.js";
+import { createContext, useCallback, useContext, useEffect, useMemo, useRef, useState } from "react";
 import { jsx } from "react/jsx-runtime";
-import { useMemo, useContext, createContext, useRef, useState, useCallback, useEffect } from "react";
-import { GrantClient } from "./index.mjs";
-const GrantContext = createContext(null);
+//#region src/react/context.tsx
+/**
+* Context for the Grant client
+*/
+var GrantContext = createContext(null);
+/**
+* Provider component that makes the Grant client available to child components
+*
+* @example
+* ```tsx
+* // Option 1: Pass config (cookie-based refresh)
+* <GrantProvider
+*   config={{
+*     apiUrl: 'https://api.grant.com',
+*     getAccessToken: () => localStorage.getItem('accessToken'),
+*     onRefreshWithCredentials: async () => {
+*       const res = await fetch('https://api.grant.com/api/auth/refresh', { method: 'POST', credentials: 'include' });
+*       if (!res.ok) return false;
+*       const { data } = await res.json();
+*       if (data?.accessToken) { localStorage.setItem('accessToken', data.accessToken); return true; }
+*       return false;
+*     },
+*     onTokenRefresh: (tokens) => { localStorage.setItem('accessToken', tokens.accessToken); },
+*     onUnauthorized: () => { window.location.href = '/login'; },
+*   }}
+* >
+*   <App />
+* </GrantProvider>
+*
+* // Option 2: Pass pre-configured client
+* const grant = new GrantClient({ ... });
+* <GrantProvider client={grant}>
+*   <App />
+* </GrantProvider>
+* ```
+*/
 function GrantProvider({ config, client, children }) {
-  const grantClient = useMemo(() => {
-    if (client) return client;
-    return new GrantClient(config);
-  }, [client, config]);
-  return /* @__PURE__ */ jsx(GrantContext.Provider, { value: grantClient, children });
+	const grantClient = useMemo(() => {
+		if (client) return client;
+		return new GrantClient(config);
+	}, [client, config]);
+	return /* @__PURE__ */ jsx(GrantContext.Provider, {
+		value: grantClient,
+		children
+	});
 }
+/**
+* Hook to access the Grant client from context
+*
+* @throws Error if used outside of GrantProvider
+*
+* @example
+* ```tsx
+* const grant = useGrantClient();
+* const hasPermission = await grant.can('resource', 'action');
+* ```
+*/
 function useGrantClient() {
-  const client = useContext(GrantContext);
-  if (!client) {
-    throw new Error(
-      "useGrantClient must be used within a GrantProvider. Wrap your app with <GrantProvider config={...}> to fix this error."
-    );
-  }
-  return client;
+	const client = useContext(GrantContext);
+	if (!client) throw new Error("useGrantClient must be used within a GrantProvider. Wrap your app with <GrantProvider config={...}> to fix this error.");
+	return client;
 }
+/**
+* Hook to optionally access the Grant client
+* Returns null if not in a GrantProvider context
+*
+* Use this when you want to gracefully handle missing provider
+*/
 function useGrantClientOptional() {
-  return useContext(GrantContext);
+	return useContext(GrantContext);
 }
+//#endregion
+//#region src/react/hooks/useGrant.ts
+/**
+* Serialize scope for stable dependency comparison
+* This prevents re-fetching when scope object reference changes but values are the same
+*/
 function serializeScope(scope) {
-  if (!scope) return "";
-  return `${scope.tenant}:${scope.id}`;
+	if (!scope) return "";
+	return `${scope.tenant}:${scope.id}`;
 }
+/**
+* Hook to check if a user is granted permission for a specific resource and action
+*
+* By default, returns a simple boolean, defaulting to false while loading.
+* Set `returnLoading: true` to get an object with `isGranted` and `isLoading`.
+*
+* @param resource - The resource slug to check
+* @param action - The action to check
+* @param options - Additional options
+*
+* @example
+* ```tsx
+* // Simple boolean (default)
+* const canEdit = useGrant('document', 'update');
+*
+* return (
+*   <div>
+*     {canEdit && <EditButton />}
+*   </div>
+* );
+*
+* // With loading state
+* const { isGranted, isLoading } = useGrant('document', 'update', {
+*   returnLoading: true,
+* });
+*
+* if (isLoading) return <Spinner />;
+* if (!isGranted) return null;
+*
+* return <EditButton />;
+* ```
+*/
 function useGrant(resource, action, options = {}) {
-  const { scope, enabled = true, useCache = true, returnLoading = false, context } = options;
-  const client = useGrantClient();
-  const scopeWasProvidedRef = useRef("scope" in options);
-  const isEffectivelyEnabled = useMemo(() => {
-    const hasValidScope = scope && typeof scope === "object" && "tenant" in scope && "id" in scope && scope.id;
-    const shouldWaitForScope = scopeWasProvidedRef.current && !hasValidScope;
-    return enabled && !shouldWaitForScope;
-  }, [scope, enabled]);
-  const [data, setData] = useState(null);
-  const [isLoading, setIsLoading] = useState(isEffectivelyEnabled);
-  const [prevEffectivelyEnabled, setPrevEffectivelyEnabled] = useState(isEffectivelyEnabled);
-  if (isEffectivelyEnabled !== prevEffectivelyEnabled) {
-    setPrevEffectivelyEnabled(isEffectivelyEnabled);
-    if (isEffectivelyEnabled) {
-      setIsLoading(true);
-    } else {
-      setIsLoading(false);
-      setData(null);
-    }
-  }
-  const isMounted = useRef(true);
-  const scopeRef = useRef(scope);
-  scopeRef.current = scope;
-  const contextRef = useRef(context);
-  contextRef.current = context;
-  const scopeKey = serializeScope(scope);
-  const contextKey = useMemo(
-    () => context?.resource != null ? JSON.stringify(context.resource) : "",
-    [context?.resource]
-  );
-  const fetchPermission = useCallback(async () => {
-    if (!isEffectivelyEnabled) {
-      setIsLoading(false);
-      return;
-    }
-    setIsLoading(true);
-    try {
-      const result = await client.isAuthorized(resource, action, {
-        scope: scopeRef.current ?? void 0,
-        useCache,
-        context: contextRef.current
-      });
-      if (isMounted.current) {
-        setData(result);
-      }
-    } catch {
-      if (isMounted.current) {
-        setData(null);
-      }
-    } finally {
-      if (isMounted.current) {
-        setIsLoading(false);
-      }
-    }
-  }, [client, resource, action, scopeKey, isEffectivelyEnabled, useCache, contextKey]);
-  useEffect(() => {
-    isMounted.current = true;
-    if (!isEffectivelyEnabled && scopeWasProvidedRef.current) {
-      setData(null);
-      setIsLoading(false);
-    } else {
-      fetchPermission();
-    }
-    return () => {
-      isMounted.current = false;
-    };
-  }, [fetchPermission, isEffectivelyEnabled]);
-  const isGranted = data?.authorized ?? false;
-  if (returnLoading) {
-    return { isGranted, isLoading };
-  }
-  return isGranted;
+	const { scope, enabled = true, useCache = true, returnLoading = false, context } = options;
+	const client = useGrantClient();
+	const scopeWasProvidedRef = useRef("scope" in options);
+	const isEffectivelyEnabled = useMemo(() => {
+		const hasValidScope = scope && typeof scope === "object" && "tenant" in scope && "id" in scope && scope.id;
+		const shouldWaitForScope = scopeWasProvidedRef.current && !hasValidScope;
+		return enabled && !shouldWaitForScope;
+	}, [scope, enabled]);
+	const [data, setData] = useState(null);
+	const [isLoading, setIsLoading] = useState(isEffectivelyEnabled);
+	const [prevEffectivelyEnabled, setPrevEffectivelyEnabled] = useState(isEffectivelyEnabled);
+	if (isEffectivelyEnabled !== prevEffectivelyEnabled) {
+		setPrevEffectivelyEnabled(isEffectivelyEnabled);
+		if (isEffectivelyEnabled) setIsLoading(true);
+		else {
+			setIsLoading(false);
+			setData(null);
+		}
+	}
+	const isMounted = useRef(true);
+	const scopeRef = useRef(scope);
+	scopeRef.current = scope;
+	const contextRef = useRef(context);
+	contextRef.current = context;
+	const fetchPermission = useCallback(async () => {
+		if (!isEffectivelyEnabled) {
+			setIsLoading(false);
+			return;
+		}
+		setIsLoading(true);
+		try {
+			const result = await client.isAuthorized(resource, action, {
+				scope: scopeRef.current ?? void 0,
+				useCache,
+				context: contextRef.current
+			});
+			if (isMounted.current) setData(result);
+		} catch {
+			if (isMounted.current) setData(null);
+		} finally {
+			if (isMounted.current) setIsLoading(false);
+		}
+	}, [
+		client,
+		resource,
+		action,
+		serializeScope(scope),
+		isEffectivelyEnabled,
+		useCache,
+		useMemo(() => context?.resource != null ? JSON.stringify(context.resource) : "", [context?.resource])
+	]);
+	useEffect(() => {
+		isMounted.current = true;
+		if (!isEffectivelyEnabled && scopeWasProvidedRef.current) {
+			setData(null);
+			setIsLoading(false);
+		} else fetchPermission();
+		return () => {
+			isMounted.current = false;
+		};
+	}, [fetchPermission, isEffectivelyEnabled]);
+	const isGranted = data?.authorized ?? false;
+	if (returnLoading) return {
+		isGranted,
+		isLoading
+	};
+	return isGranted;
 }
-function GrantGate({
-  resource,
-  action,
-  scope,
-  enabled,
-  useCache,
-  children,
-  fallback = null,
-  loading = null
-}) {
-  const options = {
-    enabled,
-    useCache,
-    returnLoading: loading !== null
-  };
-  if (scope !== void 0) {
-    options.scope = scope;
-  }
-  const result = useGrant(resource, action, options);
-  const isGranted = typeof result === "boolean" ? result : result.isGranted;
-  const isLoading = typeof result === "boolean" ? false : result.isLoading;
-  if (isLoading && loading !== null) {
-    return loading;
-  }
-  if (isGranted) {
-    return children;
-  }
-  return fallback;
+//#endregion
+//#region src/react/components/GrantGate.tsx
+/**
+* Component that conditionally renders children based on permissions
+*
+* @example
+* ```tsx
+* // Basic usage - hide element if no permission
+* <GrantGate resource="document" action="update">
+*   <EditButton />
+* </GrantGate>
+*
+* // With fallback for denied access
+* <GrantGate
+*   resource="admin"
+*   action="access"
+*   fallback={<p>You don't have admin access</p>}
+* >
+*   <AdminPanel />
+* </GrantGate>
+*
+* // With loading state
+* <GrantGate
+*   resource="report"
+*   action="view"
+*   loading={<Spinner />}
+*   fallback={<AccessDenied />}
+* >
+*   <ReportViewer />
+* </GrantGate>
+*
+* // With scope for multi-tenant
+* <GrantGate
+*   resource="project"
+*   action="delete"
+*   scope={{ tenant: 'project', id: projectId }}
+* >
+*   <DeleteProjectButton />
+* </GrantGate>
+* ```
+*/
+function GrantGate({ resource, action, scope, enabled, useCache, children, fallback = null, loading = null }) {
+	const options = {
+		enabled,
+		useCache,
+		returnLoading: loading !== null
+	};
+	if (scope !== void 0) options.scope = scope;
+	const result = useGrant(resource, action, options);
+	const isGranted = typeof result === "boolean" ? result : result.isGranted;
+	if ((typeof result === "boolean" ? false : result.isLoading) && loading !== null) return loading;
+	if (isGranted) return children;
+	return fallback;
 }
-export {
-  GrantClient,
-  GrantGate,
-  GrantProvider,
-  useGrant,
-  useGrantClient,
-  useGrantClientOptional
-};
-//# sourceMappingURL=react.mjs.map
+//#endregion
+export { GrantClient, GrantGate, GrantProvider, useGrant, useGrantClient, useGrantClientOptional };
+
+//# sourceMappingURL=react.mjs.map

package/dist/react.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"react.mjs","sources":["../src/react/context.tsx","../src/react/hooks/useGrant.ts","../src/react/components/GrantGate.tsx"],"sourcesContent":["'use client';\n\nimport { createContext, useContext, useMemo, type ReactNode } from 'react';\n\nimport { GrantClient } from '../grant-client';\n\nimport type { GrantClientConfig } from '../types';\n\n/**\n * Context for the Grant client\n */\nconst GrantContext = createContext<GrantClient | null>(null);\n\n/**\n * Props for the GrantProvider component\n */\nexport interface GrantProviderProps {\n  /**\n   * Grant client configuration\n   */\n  config: GrantClientConfig;\n\n  /**\n   * Pre-configured GrantClient instance (alternative to config)\n   * If provided, config is ignored\n   */\n  client?: GrantClient;\n\n  /**\n   * Child components\n   */\n  children: ReactNode;\n}\n\n/**\n * Provider component that makes the Grant client available to child components\n *\n * @example\n * ```tsx\n * // Option 1: Pass config (cookie-based refresh)\n * <GrantProvider\n *   config={{\n *     apiUrl: 'https://api.grant.com',\n *     getAccessToken: () => localStorage.getItem('accessToken'),\n *     onRefreshWithCredentials: async () => {\n *       const res = await fetch('https://api.grant.com/api/auth/refresh', { method: 'POST', credentials: 'include' });\n *       if (!res.ok) return false;\n *       const { data } = await res.json();\n *       if (data?.accessToken) { localStorage.setItem('accessToken', data.accessToken); return true; }\n *       return false;\n *     },\n *     onTokenRefresh: (tokens) => { localStorage.setItem('accessToken', tokens.accessToken); },\n *     onUnauthorized: () => { window.location.href = '/login'; },\n *   }}\n * >\n *   <App />\n * </GrantProvider>\n *\n * // Option 2: Pass pre-configured client\n * const grant = new GrantClient({ ... });\n * <GrantProvider client={grant}>\n *   <App />\n * </GrantProvider>\n * ```\n */\nexport function GrantProvider({ config, client, children }: GrantProviderProps) {\n  const grantClient = useMemo(() => {\n    if (client) return client;\n    return new GrantClient(config);\n  }, [client, config]);\n\n  return <GrantContext.Provider value={grantClient}>{children}</GrantContext.Provider>;\n}\n\n/**\n * Hook to access the Grant client from context\n *\n * @throws Error if used outside of GrantProvider\n *\n * @example\n * ```tsx\n * const grant = useGrantClient();\n * const hasPermission = await grant.can('resource', 'action');\n * ```\n */\nexport function useGrantClient(): GrantClient {\n  const client = useContext(GrantContext);\n\n  if (!client) {\n    throw new Error(\n      'useGrantClient must be used within a GrantProvider. ' +\n        'Wrap your app with <GrantProvider config={...}> to fix this error.'\n    );\n  }\n\n  return client;\n}\n\n/**\n * Hook to optionally access the Grant client\n * Returns null if not in a GrantProvider context\n *\n * Use this when you want to gracefully handle missing provider\n */\nexport function useGrantClientOptional(): GrantClient | null {\n  return useContext(GrantContext);\n}\n","'use client';\n\nimport { useState, useEffect, useCallback, useRef, useMemo } from 'react';\n\nimport { useGrantClient } from '../context';\n\nimport type { AuthorizationResult, Scope } from '../../types';\n\n/**\n * Options for the useGrant hook\n */\nexport interface UseGrantOptions {\n  /** Scope to check the permission in. If provided but null/undefined, hook waits for it to become valid. */\n  scope?: Scope | null;\n  /** Whether to skip the permission check */\n  enabled?: boolean;\n  /** Whether to use cached results (default: true) */\n  useCache?: boolean;\n  /** Whether to return loading state (default: false) */\n  returnLoading?: boolean;\n  /** Context to check permissions for */\n  context?: {\n    resource?: Record<string, unknown> | null;\n  };\n}\n\n/**\n * Result when returnLoading is true\n */\nexport interface UseGrantResult {\n  /** Whether the user is granted permission */\n  isGranted: boolean;\n  /** Whether the permission check is loading */\n  isLoading: boolean;\n}\n\n/**\n * Serialize scope for stable dependency comparison\n * This prevents re-fetching when scope object reference changes but values are the same\n */\nfunction serializeScope(scope?: Scope | null): string {\n  if (!scope) return '';\n  return `${scope.tenant}:${scope.id}`;\n}\n\n/**\n * Hook to check if a user is granted permission for a specific resource and action\n *\n * By default, returns a simple boolean, defaulting to false while loading.\n * Set `returnLoading: true` to get an object with `isGranted` and `isLoading`.\n *\n * @param resource - The resource slug to check\n * @param action - The action to check\n * @param options - Additional options\n *\n * @example\n * ```tsx\n * // Simple boolean (default)\n * const canEdit = useGrant('document', 'update');\n *\n * return (\n *   <div>\n *     {canEdit && <EditButton />}\n *   </div>\n * );\n *\n * // With loading state\n * const { isGranted, isLoading } = useGrant('document', 'update', {\n *   returnLoading: true,\n * });\n *\n * if (isLoading) return <Spinner />;\n * if (!isGranted) return null;\n *\n * return <EditButton />;\n * ```\n */\nexport function useGrant(\n  resource: string,\n  action: string,\n  options: UseGrantOptions = {}\n): boolean | UseGrantResult {\n  const { scope, enabled = true, useCache = true, returnLoading = false, context } = options;\n  const client = useGrantClient();\n\n  // Track if scope was explicitly provided (even if null/undefined)\n  // This allows us to distinguish between \"scope not provided\" (optional) vs \"scope provided but falsy\" (wait for it)\n  // Check this once at the start - if scope key exists in options, it was provided\n  // Note: { scope: undefined } has the key, { } does not have the key\n  const scopeWasProvidedRef = useRef('scope' in options);\n\n  // Determine if we should wait for scope to become valid\n  // If scope was provided but is falsy or invalid, wait for it to become truthy\n  // Recalculate when scope changes\n  const isEffectivelyEnabled = useMemo(() => {\n    const hasValidScope =\n      scope && typeof scope === 'object' && 'tenant' in scope && 'id' in scope && scope.id;\n    const shouldWaitForScope = scopeWasProvidedRef.current && !hasValidScope;\n    return enabled && !shouldWaitForScope;\n  }, [scope, enabled]);\n\n  const [data, setData] = useState<AuthorizationResult | null>(null);\n  const [isLoading, setIsLoading] = useState(isEffectivelyEnabled);\n\n  // Synchronously correct isLoading when isEffectivelyEnabled transitions.\n  // useState only uses its initializer on first render, so subsequent transitions\n  // leave isLoading stale for one render cycle (the effect hasn't run yet).\n  // This uses React's \"storing information from previous renders\" pattern to\n  // immediately set isLoading before the render completes.\n  // See: https://react.dev/reference/react/useState#storing-information-from-previous-renders\n  const [prevEffectivelyEnabled, setPrevEffectivelyEnabled] = useState(isEffectivelyEnabled);\n  if (isEffectivelyEnabled !== prevEffectivelyEnabled) {\n    setPrevEffectivelyEnabled(isEffectivelyEnabled);\n    if (isEffectivelyEnabled) {\n      setIsLoading(true);\n    } else {\n      setIsLoading(false);\n      setData(null);\n    }\n  }\n\n  // Track mounted state to prevent state updates after unmount\n  const isMounted = useRef(true);\n\n  // Store scope in a ref so we always have the latest value without triggering re-renders\n  const scopeRef = useRef(scope);\n  scopeRef.current = scope;\n\n  // Store context in a ref so the callback always sends the latest context\n  const contextRef = useRef(context);\n  contextRef.current = context;\n\n  // Serialize scope to get a stable string for dependency comparison\n  const scopeKey = serializeScope(scope);\n\n  // Serialize context so we re-create the callback when context meaningfully changes\n  const contextKey = useMemo(\n    () => (context?.resource != null ? JSON.stringify(context.resource) : ''),\n    [context?.resource]\n  );\n\n  const fetchPermission = useCallback(async () => {\n    if (!isEffectivelyEnabled) {\n      setIsLoading(false);\n      return;\n    }\n\n    setIsLoading(true);\n\n    try {\n      // Use scopeRef.current and contextRef.current to get the latest values\n      // Convert null to undefined for the client (which expects Scope | undefined)\n      const result = await client.isAuthorized(resource, action, {\n        scope: scopeRef.current ?? undefined,\n        useCache,\n        context: contextRef.current,\n      });\n      if (isMounted.current) {\n        setData(result);\n      }\n    } catch {\n      // On error, set data to null (will return false)\n      if (isMounted.current) {\n        setData(null);\n      }\n    } finally {\n      if (isMounted.current) {\n        setIsLoading(false);\n      }\n    }\n    // contextKey ensures we re-run when context (e.g. resource) changes so the request gets the latest context\n    // eslint-disable-next-line react-hooks/exhaustive-deps\n  }, [client, resource, action, scopeKey, isEffectivelyEnabled, useCache, contextKey]);\n\n  useEffect(() => {\n    isMounted.current = true;\n\n    // Clear data when scope becomes invalid (waiting for valid scope)\n    if (!isEffectivelyEnabled && scopeWasProvidedRef.current) {\n      setData(null);\n      setIsLoading(false);\n    } else {\n      fetchPermission();\n    }\n\n    return () => {\n      isMounted.current = false;\n    };\n  }, [fetchPermission, isEffectivelyEnabled]);\n\n  const isGranted = data?.authorized ?? false;\n\n  // Return object with loading state if requested, otherwise just boolean\n  if (returnLoading) {\n    return { isGranted, isLoading };\n  }\n\n  return isGranted;\n}\n","'use client';\n\nimport type { ReactNode } from 'react';\n\nimport { useGrant, type UseGrantOptions } from '../hooks/useGrant';\n\n/**\n * Props for the GrantGate component\n */\nexport interface GrantGateProps extends UseGrantOptions {\n  /** The resource slug to check permission for */\n  resource: string;\n  /** The action to check */\n  action: string;\n  /** Content to render if permission is granted */\n  children: ReactNode;\n  /** Content to render if permission is denied (optional) */\n  fallback?: ReactNode;\n  /** Content to render while loading (optional) */\n  loading?: ReactNode;\n}\n\n/**\n * Component that conditionally renders children based on permissions\n *\n * @example\n * ```tsx\n * // Basic usage - hide element if no permission\n * <GrantGate resource=\"document\" action=\"update\">\n *   <EditButton />\n * </GrantGate>\n *\n * // With fallback for denied access\n * <GrantGate\n *   resource=\"admin\"\n *   action=\"access\"\n *   fallback={<p>You don't have admin access</p>}\n * >\n *   <AdminPanel />\n * </GrantGate>\n *\n * // With loading state\n * <GrantGate\n *   resource=\"report\"\n *   action=\"view\"\n *   loading={<Spinner />}\n *   fallback={<AccessDenied />}\n * >\n *   <ReportViewer />\n * </GrantGate>\n *\n * // With scope for multi-tenant\n * <GrantGate\n *   resource=\"project\"\n *   action=\"delete\"\n *   scope={{ tenant: 'project', id: projectId }}\n * >\n *   <DeleteProjectButton />\n * </GrantGate>\n * ```\n */\nexport function GrantGate({\n  resource,\n  action,\n  scope,\n  enabled,\n  useCache,\n  children,\n  fallback = null,\n  loading = null,\n}: GrantGateProps): ReactNode {\n  // Build options object conditionally\n  // Only include scope in options if it's not undefined (null is valid and means \"wait for it\")\n  // This allows the hook to distinguish between \"scope not provided\" (undefined) vs \"scope provided but null\"\n  const options: Parameters<typeof useGrant>[2] = {\n    enabled,\n    useCache,\n    returnLoading: loading !== null,\n  };\n\n  // Only add scope to options if it's explicitly null or a valid object\n  // If scope is undefined, don't include it so hook treats it as optional\n  if (scope !== undefined) {\n    options.scope = scope;\n  }\n\n  // Use loading state if loading prop is provided\n  const result = useGrant(resource, action, options);\n\n  const isGranted = typeof result === 'boolean' ? result : result.isGranted;\n  const isLoading = typeof result === 'boolean' ? false : result.isLoading;\n\n  if (isLoading && loading !== null) {\n    return loading;\n  }\n\n  if (isGranted) {\n    return children;\n  }\n\n  return fallback;\n}\n"],"names":[],"mappings":";;;AAWA,MAAM,eAAe,cAAkC,IAAI;AAsDpD,SAAS,cAAc,EAAE,QAAQ,QAAQ,YAAgC;AAC9E,QAAM,cAAc,QAAQ,MAAM;AAChC,QAAI,OAAQ,QAAO;AACnB,WAAO,IAAI,YAAY,MAAM;AAAA,EAC/B,GAAG,CAAC,QAAQ,MAAM,CAAC;AAEnB,6BAAQ,aAAa,UAAb,EAAsB,OAAO,aAAc,UAAS;AAC9D;AAaO,SAAS,iBAA8B;AAC5C,QAAM,SAAS,WAAW,YAAY;AAEtC,MAAI,CAAC,QAAQ;AACX,UAAM,IAAI;AAAA,MACR;AAAA,IAAA;AAAA,EAGJ;AAEA,SAAO;AACT;AAQO,SAAS,yBAA6C;AAC3D,SAAO,WAAW,YAAY;AAChC;AClEA,SAAS,eAAe,OAA8B;AACpD,MAAI,CAAC,MAAO,QAAO;AACnB,SAAO,GAAG,MAAM,MAAM,IAAI,MAAM,EAAE;AACpC;AAkCO,SAAS,SACd,UACA,QACA,UAA2B,CAAA,GACD;AAC1B,QAAM,EAAE,OAAO,UAAU,MAAM,WAAW,MAAM,gBAAgB,OAAO,QAAA,IAAY;AACnF,QAAM,SAAS,eAAA;AAMf,QAAM,sBAAsB,OAAO,WAAW,OAAO;AAKrD,QAAM,uBAAuB,QAAQ,MAAM;AACzC,UAAM,gBACJ,SAAS,OAAO,UAAU,YAAY,YAAY,SAAS,QAAQ,SAAS,MAAM;AACpF,UAAM,qBAAqB,oBAAoB,WAAW,CAAC;AAC3D,WAAO,WAAW,CAAC;AAAA,EACrB,GAAG,CAAC,OAAO,OAAO,CAAC;AAEnB,QAAM,CAAC,MAAM,OAAO,IAAI,SAAqC,IAAI;AACjE,QAAM,CAAC,WAAW,YAAY,IAAI,SAAS,oBAAoB;AAQ/D,QAAM,CAAC,wBAAwB,yBAAyB,IAAI,SAAS,oBAAoB;AACzF,MAAI,yBAAyB,wBAAwB;AACnD,8BAA0B,oBAAoB;AAC9C,QAAI,sBAAsB;AACxB,mBAAa,IAAI;AAAA,IACnB,OAAO;AACL,mBAAa,KAAK;AAClB,cAAQ,IAAI;AAAA,IACd;AAAA,EACF;AAGA,QAAM,YAAY,OAAO,IAAI;AAG7B,QAAM,WAAW,OAAO,KAAK;AAC7B,WAAS,UAAU;AAGnB,QAAM,aAAa,OAAO,OAAO;AACjC,aAAW,UAAU;AAGrB,QAAM,WAAW,eAAe,KAAK;AAGrC,QAAM,aAAa;AAAA,IACjB,MAAO,SAAS,YAAY,OAAO,KAAK,UAAU,QAAQ,QAAQ,IAAI;AAAA,IACtE,CAAC,SAAS,QAAQ;AAAA,EAAA;AAGpB,QAAM,kBAAkB,YAAY,YAAY;AAC9C,QAAI,CAAC,sBAAsB;AACzB,mBAAa,KAAK;AAClB;AAAA,IACF;AAEA,iBAAa,IAAI;AAEjB,QAAI;AAGF,YAAM,SAAS,MAAM,OAAO,aAAa,UAAU,QAAQ;AAAA,QACzD,OAAO,SAAS,WAAW;AAAA,QAC3B;AAAA,QACA,SAAS,WAAW;AAAA,MAAA,CACrB;AACD,UAAI,UAAU,SAAS;AACrB,gBAAQ,MAAM;AAAA,MAChB;AAAA,IACF,QAAQ;AAEN,UAAI,UAAU,SAAS;AACrB,gBAAQ,IAAI;AAAA,MACd;AAAA,IACF,UAAA;AACE,UAAI,UAAU,SAAS;AACrB,qBAAa,KAAK;AAAA,MACpB;AAAA,IACF;AAAA,EAGF,GAAG,CAAC,QAAQ,UAAU,QAAQ,UAAU,sBAAsB,UAAU,UAAU,CAAC;AAEnF,YAAU,MAAM;AACd,cAAU,UAAU;AAGpB,QAAI,CAAC,wBAAwB,oBAAoB,SAAS;AACxD,cAAQ,IAAI;AACZ,mBAAa,KAAK;AAAA,IACpB,OAAO;AACL,sBAAA;AAAA,IACF;AAEA,WAAO,MAAM;AACX,gBAAU,UAAU;AAAA,IACtB;AAAA,EACF,GAAG,CAAC,iBAAiB,oBAAoB,CAAC;AAE1C,QAAM,YAAY,MAAM,cAAc;AAGtC,MAAI,eAAe;AACjB,WAAO,EAAE,WAAW,UAAA;AAAA,EACtB;AAEA,SAAO;AACT;ACzIO,SAAS,UAAU;AAAA,EACxB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,WAAW;AAAA,EACX,UAAU;AACZ,GAA8B;AAI5B,QAAM,UAA0C;AAAA,IAC9C;AAAA,IACA;AAAA,IACA,eAAe,YAAY;AAAA,EAAA;AAK7B,MAAI,UAAU,QAAW;AACvB,YAAQ,QAAQ;AAAA,EAClB;AAGA,QAAM,SAAS,SAAS,UAAU,QAAQ,OAAO;AAEjD,QAAM,YAAY,OAAO,WAAW,YAAY,SAAS,OAAO;AAChE,QAAM,YAAY,OAAO,WAAW,YAAY,QAAQ,OAAO;AAE/D,MAAI,aAAa,YAAY,MAAM;AACjC,WAAO;AAAA,EACT;AAEA,MAAI,WAAW;AACb,WAAO;AAAA,EACT;AAEA,SAAO;AACT;"}
+{"version":3,"file":"react.mjs","names":[],"sources":["../src/react/context.tsx","../src/react/hooks/useGrant.ts","../src/react/components/GrantGate.tsx"],"sourcesContent":["'use client';\n\nimport { createContext, type ReactNode, useContext, useMemo } from 'react';\n\nimport { GrantClient } from '../grant-client';\nimport type { GrantClientConfig } from '../types';\n\n/**\n * Context for the Grant client\n */\nconst GrantContext = createContext<GrantClient | null>(null);\n\n/**\n * Props for the GrantProvider component\n */\nexport interface GrantProviderProps {\n  /**\n   * Grant client configuration\n   */\n  config: GrantClientConfig;\n\n  /**\n   * Pre-configured GrantClient instance (alternative to config)\n   * If provided, config is ignored\n   */\n  client?: GrantClient;\n\n  /**\n   * Child components\n   */\n  children: ReactNode;\n}\n\n/**\n * Provider component that makes the Grant client available to child components\n *\n * @example\n * ```tsx\n * // Option 1: Pass config (cookie-based refresh)\n * <GrantProvider\n *   config={{\n *     apiUrl: 'https://api.grant.com',\n *     getAccessToken: () => localStorage.getItem('accessToken'),\n *     onRefreshWithCredentials: async () => {\n *       const res = await fetch('https://api.grant.com/api/auth/refresh', { method: 'POST', credentials: 'include' });\n *       if (!res.ok) return false;\n *       const { data } = await res.json();\n *       if (data?.accessToken) { localStorage.setItem('accessToken', data.accessToken); return true; }\n *       return false;\n *     },\n *     onTokenRefresh: (tokens) => { localStorage.setItem('accessToken', tokens.accessToken); },\n *     onUnauthorized: () => { window.location.href = '/login'; },\n *   }}\n * >\n *   <App />\n * </GrantProvider>\n *\n * // Option 2: Pass pre-configured client\n * const grant = new GrantClient({ ... });\n * <GrantProvider client={grant}>\n *   <App />\n * </GrantProvider>\n * ```\n */\nexport function GrantProvider({ config, client, children }: GrantProviderProps) {\n  const grantClient = useMemo(() => {\n    if (client) return client;\n    return new GrantClient(config);\n  }, [client, config]);\n\n  return <GrantContext.Provider value={grantClient}>{children}</GrantContext.Provider>;\n}\n\n/**\n * Hook to access the Grant client from context\n *\n * @throws Error if used outside of GrantProvider\n *\n * @example\n * ```tsx\n * const grant = useGrantClient();\n * const hasPermission = await grant.can('resource', 'action');\n * ```\n */\nexport function useGrantClient(): GrantClient {\n  const client = useContext(GrantContext);\n\n  if (!client) {\n    throw new Error(\n      'useGrantClient must be used within a GrantProvider. ' +\n        'Wrap your app with <GrantProvider config={...}> to fix this error.'\n    );\n  }\n\n  return client;\n}\n\n/**\n * Hook to optionally access the Grant client\n * Returns null if not in a GrantProvider context\n *\n * Use this when you want to gracefully handle missing provider\n */\nexport function useGrantClientOptional(): GrantClient | null {\n  return useContext(GrantContext);\n}\n","'use client';\n\nimport { useCallback, useEffect, useMemo, useRef, useState } from 'react';\n\nimport type { AuthorizationResult, Scope } from '../../types';\nimport { useGrantClient } from '../context';\n\n/**\n * Options for the useGrant hook\n */\nexport interface UseGrantOptions {\n  /** Scope to check the permission in. If provided but null/undefined, hook waits for it to become valid. */\n  scope?: Scope | null;\n  /** Whether to skip the permission check */\n  enabled?: boolean;\n  /** Whether to use cached results (default: true) */\n  useCache?: boolean;\n  /** Whether to return loading state (default: false) */\n  returnLoading?: boolean;\n  /** Context to check permissions for */\n  context?: {\n    resource?: Record<string, unknown> | null;\n  };\n}\n\n/**\n * Result when returnLoading is true\n */\nexport interface UseGrantResult {\n  /** Whether the user is granted permission */\n  isGranted: boolean;\n  /** Whether the permission check is loading */\n  isLoading: boolean;\n}\n\n/**\n * Serialize scope for stable dependency comparison\n * This prevents re-fetching when scope object reference changes but values are the same\n */\nfunction serializeScope(scope?: Scope | null): string {\n  if (!scope) return '';\n  return `${scope.tenant}:${scope.id}`;\n}\n\n/**\n * Hook to check if a user is granted permission for a specific resource and action\n *\n * By default, returns a simple boolean, defaulting to false while loading.\n * Set `returnLoading: true` to get an object with `isGranted` and `isLoading`.\n *\n * @param resource - The resource slug to check\n * @param action - The action to check\n * @param options - Additional options\n *\n * @example\n * ```tsx\n * // Simple boolean (default)\n * const canEdit = useGrant('document', 'update');\n *\n * return (\n *   <div>\n *     {canEdit && <EditButton />}\n *   </div>\n * );\n *\n * // With loading state\n * const { isGranted, isLoading } = useGrant('document', 'update', {\n *   returnLoading: true,\n * });\n *\n * if (isLoading) return <Spinner />;\n * if (!isGranted) return null;\n *\n * return <EditButton />;\n * ```\n */\nexport function useGrant(\n  resource: string,\n  action: string,\n  options: UseGrantOptions = {}\n): boolean | UseGrantResult {\n  const { scope, enabled = true, useCache = true, returnLoading = false, context } = options;\n  const client = useGrantClient();\n\n  // Track if scope was explicitly provided (even if null/undefined)\n  // This allows us to distinguish between \"scope not provided\" (optional) vs \"scope provided but falsy\" (wait for it)\n  // Check this once at the start - if scope key exists in options, it was provided\n  // Note: { scope: undefined } has the key, { } does not have the key\n  const scopeWasProvidedRef = useRef('scope' in options);\n\n  // Determine if we should wait for scope to become valid\n  // If scope was provided but is falsy or invalid, wait for it to become truthy\n  // Recalculate when scope changes\n  const isEffectivelyEnabled = useMemo(() => {\n    const hasValidScope =\n      scope && typeof scope === 'object' && 'tenant' in scope && 'id' in scope && scope.id;\n    const shouldWaitForScope = scopeWasProvidedRef.current && !hasValidScope;\n    return enabled && !shouldWaitForScope;\n  }, [scope, enabled]);\n\n  const [data, setData] = useState<AuthorizationResult | null>(null);\n  const [isLoading, setIsLoading] = useState(isEffectivelyEnabled);\n\n  // Synchronously correct isLoading when isEffectivelyEnabled transitions.\n  // useState only uses its initializer on first render, so subsequent transitions\n  // leave isLoading stale for one render cycle (the effect hasn't run yet).\n  // This uses React's \"storing information from previous renders\" pattern to\n  // immediately set isLoading before the render completes.\n  // See: https://react.dev/reference/react/useState#storing-information-from-previous-renders\n  const [prevEffectivelyEnabled, setPrevEffectivelyEnabled] = useState(isEffectivelyEnabled);\n  if (isEffectivelyEnabled !== prevEffectivelyEnabled) {\n    setPrevEffectivelyEnabled(isEffectivelyEnabled);\n    if (isEffectivelyEnabled) {\n      setIsLoading(true);\n    } else {\n      setIsLoading(false);\n      setData(null);\n    }\n  }\n\n  // Track mounted state to prevent state updates after unmount\n  const isMounted = useRef(true);\n\n  // Store scope in a ref so we always have the latest value without triggering re-renders\n  const scopeRef = useRef(scope);\n  scopeRef.current = scope;\n\n  // Store context in a ref so the callback always sends the latest context\n  const contextRef = useRef(context);\n  contextRef.current = context;\n\n  // Serialize scope to get a stable string for dependency comparison\n  const scopeKey = serializeScope(scope);\n\n  // Serialize context so we re-create the callback when context meaningfully changes\n  const contextKey = useMemo(\n    () => (context?.resource != null ? JSON.stringify(context.resource) : ''),\n    [context?.resource]\n  );\n\n  const fetchPermission = useCallback(async () => {\n    if (!isEffectivelyEnabled) {\n      setIsLoading(false);\n      return;\n    }\n\n    setIsLoading(true);\n\n    try {\n      // Use scopeRef.current and contextRef.current to get the latest values\n      // Convert null to undefined for the client (which expects Scope | undefined)\n      const result = await client.isAuthorized(resource, action, {\n        scope: scopeRef.current ?? undefined,\n        useCache,\n        context: contextRef.current,\n      });\n      if (isMounted.current) {\n        setData(result);\n      }\n    } catch {\n      // On error, set data to null (will return false)\n      if (isMounted.current) {\n        setData(null);\n      }\n    } finally {\n      if (isMounted.current) {\n        setIsLoading(false);\n      }\n    }\n    // contextKey ensures we re-run when context (e.g. resource) changes so the request gets the latest context\n    // eslint-disable-next-line react-hooks/exhaustive-deps\n  }, [client, resource, action, scopeKey, isEffectivelyEnabled, useCache, contextKey]);\n\n  useEffect(() => {\n    isMounted.current = true;\n\n    // Clear data when scope becomes invalid (waiting for valid scope)\n    if (!isEffectivelyEnabled && scopeWasProvidedRef.current) {\n      setData(null);\n      setIsLoading(false);\n    } else {\n      fetchPermission();\n    }\n\n    return () => {\n      isMounted.current = false;\n    };\n  }, [fetchPermission, isEffectivelyEnabled]);\n\n  const isGranted = data?.authorized ?? false;\n\n  // Return object with loading state if requested, otherwise just boolean\n  if (returnLoading) {\n    return { isGranted, isLoading };\n  }\n\n  return isGranted;\n}\n","'use client';\n\nimport type { ReactNode } from 'react';\n\nimport { useGrant, type UseGrantOptions } from '../hooks/useGrant';\n\n/**\n * Props for the GrantGate component\n */\nexport interface GrantGateProps extends UseGrantOptions {\n  /** The resource slug to check permission for */\n  resource: string;\n  /** The action to check */\n  action: string;\n  /** Content to render if permission is granted */\n  children: ReactNode;\n  /** Content to render if permission is denied (optional) */\n  fallback?: ReactNode;\n  /** Content to render while loading (optional) */\n  loading?: ReactNode;\n}\n\n/**\n * Component that conditionally renders children based on permissions\n *\n * @example\n * ```tsx\n * // Basic usage - hide element if no permission\n * <GrantGate resource=\"document\" action=\"update\">\n *   <EditButton />\n * </GrantGate>\n *\n * // With fallback for denied access\n * <GrantGate\n *   resource=\"admin\"\n *   action=\"access\"\n *   fallback={<p>You don't have admin access</p>}\n * >\n *   <AdminPanel />\n * </GrantGate>\n *\n * // With loading state\n * <GrantGate\n *   resource=\"report\"\n *   action=\"view\"\n *   loading={<Spinner />}\n *   fallback={<AccessDenied />}\n * >\n *   <ReportViewer />\n * </GrantGate>\n *\n * // With scope for multi-tenant\n * <GrantGate\n *   resource=\"project\"\n *   action=\"delete\"\n *   scope={{ tenant: 'project', id: projectId }}\n * >\n *   <DeleteProjectButton />\n * </GrantGate>\n * ```\n */\nexport function GrantGate({\n  resource,\n  action,\n  scope,\n  enabled,\n  useCache,\n  children,\n  fallback = null,\n  loading = null,\n}: GrantGateProps): ReactNode {\n  // Build options object conditionally\n  // Only include scope in options if it's not undefined (null is valid and means \"wait for it\")\n  // This allows the hook to distinguish between \"scope not provided\" (undefined) vs \"scope provided but null\"\n  const options: Parameters<typeof useGrant>[2] = {\n    enabled,\n    useCache,\n    returnLoading: loading !== null,\n  };\n\n  // Only add scope to options if it's explicitly null or a valid object\n  // If scope is undefined, don't include it so hook treats it as optional\n  if (scope !== undefined) {\n    options.scope = scope;\n  }\n\n  // Use loading state if loading prop is provided\n  const result = useGrant(resource, action, options);\n\n  const isGranted = typeof result === 'boolean' ? result : result.isGranted;\n  const isLoading = typeof result === 'boolean' ? false : result.isLoading;\n\n  if (isLoading && loading !== null) {\n    return loading;\n  }\n\n  if (isGranted) {\n    return children;\n  }\n\n  return fallback;\n}\n"],"mappings":";;;;;;;AAUA,IAAM,eAAe,cAAkC,KAAK;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAsD5D,SAAgB,cAAc,EAAE,QAAQ,QAAQ,YAAgC;CAC9E,MAAM,cAAc,cAAc;AAChC,MAAI,OAAQ,QAAO;AACnB,SAAO,IAAI,YAAY,OAAO;IAC7B,CAAC,QAAQ,OAAO,CAAC;AAEpB,QAAO,oBAAC,aAAa,UAAd;EAAuB,OAAO;EAAc;EAAiC,CAAA;;;;;;;;;;;;;AActF,SAAgB,iBAA8B;CAC5C,MAAM,SAAS,WAAW,aAAa;AAEvC,KAAI,CAAC,OACH,OAAM,IAAI,MACR,yHAED;AAGH,QAAO;;;;;;;;AAST,SAAgB,yBAA6C;AAC3D,QAAO,WAAW,aAAa;;;;;;;;ACjEjC,SAAS,eAAe,OAA8B;AACpD,KAAI,CAAC,MAAO,QAAO;AACnB,QAAO,GAAG,MAAM,OAAO,GAAG,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAmClC,SAAgB,SACd,UACA,QACA,UAA2B,EAAE,EACH;CAC1B,MAAM,EAAE,OAAO,UAAU,MAAM,WAAW,MAAM,gBAAgB,OAAO,YAAY;CACnF,MAAM,SAAS,gBAAgB;CAM/B,MAAM,sBAAsB,OAAO,WAAW,QAAQ;CAKtD,MAAM,uBAAuB,cAAc;EACzC,MAAM,gBACJ,SAAS,OAAO,UAAU,YAAY,YAAY,SAAS,QAAQ,SAAS,MAAM;EACpF,MAAM,qBAAqB,oBAAoB,WAAW,CAAC;AAC3D,SAAO,WAAW,CAAC;IAClB,CAAC,OAAO,QAAQ,CAAC;CAEpB,MAAM,CAAC,MAAM,WAAW,SAAqC,KAAK;CAClE,MAAM,CAAC,WAAW,gBAAgB,SAAS,qBAAqB;CAQhE,MAAM,CAAC,wBAAwB,6BAA6B,SAAS,qBAAqB;AAC1F,KAAI,yBAAyB,wBAAwB;AACnD,4BAA0B,qBAAqB;AAC/C,MAAI,qBACF,cAAa,KAAK;OACb;AACL,gBAAa,MAAM;AACnB,WAAQ,KAAK;;;CAKjB,MAAM,YAAY,OAAO,KAAK;CAG9B,MAAM,WAAW,OAAO,MAAM;AAC9B,UAAS,UAAU;CAGnB,MAAM,aAAa,OAAO,QAAQ;AAClC,YAAW,UAAU;CAWrB,MAAM,kBAAkB,YAAY,YAAY;AAC9C,MAAI,CAAC,sBAAsB;AACzB,gBAAa,MAAM;AACnB;;AAGF,eAAa,KAAK;AAElB,MAAI;GAGF,MAAM,SAAS,MAAM,OAAO,aAAa,UAAU,QAAQ;IACzD,OAAO,SAAS,WAAW,KAAA;IAC3B;IACA,SAAS,WAAW;IACrB,CAAC;AACF,OAAI,UAAU,QACZ,SAAQ,OAAO;UAEX;AAEN,OAAI,UAAU,QACZ,SAAQ,KAAK;YAEP;AACR,OAAI,UAAU,QACZ,cAAa,MAAM;;IAKtB;EAAC;EAAQ;EAAU;EAvCL,eAAe,MAuCF;EAAU;EAAsB;EApC3C,cACV,SAAS,YAAY,OAAO,KAAK,UAAU,QAAQ,SAAS,GAAG,IACtE,CAAC,SAAS,SAAS,CAkCmD;EAAW,CAAC;AAEpF,iBAAgB;AACd,YAAU,UAAU;AAGpB,MAAI,CAAC,wBAAwB,oBAAoB,SAAS;AACxD,WAAQ,KAAK;AACb,gBAAa,MAAM;QAEnB,kBAAiB;AAGnB,eAAa;AACX,aAAU,UAAU;;IAErB,CAAC,iBAAiB,qBAAqB,CAAC;CAE3C,MAAM,YAAY,MAAM,cAAc;AAGtC,KAAI,cACF,QAAO;EAAE;EAAW;EAAW;AAGjC,QAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;ACvIT,SAAgB,UAAU,EACxB,UACA,QACA,OACA,SACA,UACA,UACA,WAAW,MACX,UAAU,QACkB;CAI5B,MAAM,UAA0C;EAC9C;EACA;EACA,eAAe,YAAY;EAC5B;AAID,KAAI,UAAU,KAAA,EACZ,SAAQ,QAAQ;CAIlB,MAAM,SAAS,SAAS,UAAU,QAAQ,QAAQ;CAElD,MAAM,YAAY,OAAO,WAAW,YAAY,SAAS,OAAO;AAGhE,MAFkB,OAAO,WAAW,YAAY,QAAQ,OAAO,cAE9C,YAAY,KAC3B,QAAO;AAGT,KAAI,UACF,QAAO;AAGT,QAAO"}

package/dist/types.d.ts

@@ -53,6 +53,12 @@ export interface GrantClientConfig {
      * Refresh tokens are not sent in the request body; the API uses only the HttpOnly refresh cookie.
      */
     onRefreshWithCredentials?: () => Promise<boolean>;
+    /**
+     * Called when a request is rejected with MFA_REQUIRED (HTTP 403).
+     * Return `true` after the user completes MFA verification so the client retries the request
+     * with the updated access token, or `false` to accept the denial.
+     */
+    onMfaRequired?: () => Promise<boolean>;
     /**
      * Custom fetch implementation
      * Defaults to globalThis.fetch

package/dist/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAC;AAG7C,YAAY,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAErD;;GAEG;AACH,MAAM,WAAW,2BAA2B;IAC1C,4BAA4B;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,yFAAyF;IACzF,WAAW,EAAE,MAAM,CAAC;IACpB,qDAAqD;IACrD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,mCAAmC;IACnC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,sDAAsD;IACtD,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC;;OAEG;IACH,MAAM,EAAE,MAAM,CAAC;IAEf;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB;;;OAGG;IACH,cAAc,CAAC,EAAE,MAAM,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAE9D;;;;OAIG;IACH,cAAc,CAAC,EAAE,CAAC,MAAM,EAAE,UAAU,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE9D;;;OAGG;IACH,cAAc,CAAC,EAAE,MAAM,IAAI,CAAC;IAE5B;;;;;;;OAOG;IACH,wBAAwB,CAAC,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;IAElD;;;OAGG;IACH,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IAErB;;;OAGG;IACH,WAAW,CAAC,EAAE,kBAAkB,CAAC;IAEjC;;OAEG;IACH,KAAK,CAAC,EAAE,YAAY,CAAC;CACtB;AAED;;;GAGG;AACH,MAAM,WAAW,UAAU;IACzB,WAAW,EAAE,MAAM,CAAC;IACpB,oFAAoF;IACpF,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B;;;OAGG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;IAEb;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,uCAAuC;IACvC,UAAU,EAAE,OAAO,CAAC;IACpB,6CAA6C;IAC7C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,kDAAkD;IAClD,iBAAiB,CAAC,EAAE,UAAU,CAAC;CAChC;AAED;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACrC,oCAAoC;IACpC,KAAK,CAAC,EAAE,KAAK,CAAC;IACd,oDAAoD;IACpD,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,wCAAwC;IACxC,OAAO,CAAC,EAAE;QACR,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;KAC3C,CAAC;CACH;AAED;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,QAAQ,CAAC,EAAE,QAAQ,GAAG,IAAI,CAAC;IAC3B,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED;;GAEG;AACH,MAAM,WAAW,QAAQ;IACvB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED;;GAEG;AACH,MAAM,WAAW,QAAQ;IACvB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAC;AAG7C,YAAY,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAErD;;GAEG;AACH,MAAM,WAAW,2BAA2B;IAC1C,4BAA4B;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,yFAAyF;IACzF,WAAW,EAAE,MAAM,CAAC;IACpB,qDAAqD;IACrD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,mCAAmC;IACnC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,sDAAsD;IACtD,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC;;OAEG;IACH,MAAM,EAAE,MAAM,CAAC;IAEf;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB;;;OAGG;IACH,cAAc,CAAC,EAAE,MAAM,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAE9D;;;;OAIG;IACH,cAAc,CAAC,EAAE,CAAC,MAAM,EAAE,UAAU,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE9D;;;OAGG;IACH,cAAc,CAAC,EAAE,MAAM,IAAI,CAAC;IAE5B;;;;;;;OAOG;IACH,wBAAwB,CAAC,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;IAElD;;;;OAIG;IACH,aAAa,CAAC,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;IAEvC;;;OAGG;IACH,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IAErB;;;OAGG;IACH,WAAW,CAAC,EAAE,kBAAkB,CAAC;IAEjC;;OAEG;IACH,KAAK,CAAC,EAAE,YAAY,CAAC;CACtB;AAED;;;GAGG;AACH,MAAM,WAAW,UAAU;IACzB,WAAW,EAAE,MAAM,CAAC;IACpB,oFAAoF;IACpF,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B;;;OAGG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;IAEb;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,uCAAuC;IACvC,UAAU,EAAE,OAAO,CAAC;IACpB,6CAA6C;IAC7C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,kDAAkD;IAClD,iBAAiB,CAAC,EAAE,UAAU,CAAC;CAChC;AAED;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACrC,oCAAoC;IACpC,KAAK,CAAC,EAAE,KAAK,CAAC;IACd,oDAAoD;IACpD,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,wCAAwC;IACxC,OAAO,CAAC,EAAE;QACR,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;KAC3C,CAAC;CACH;AAED;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,QAAQ,CAAC,EAAE,QAAQ,GAAG,IAAI,CAAC;IAC3B,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED;;GAEG;AACH,MAAM,WAAW,QAAQ;IACvB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED;;GAEG;AACH,MAAM,WAAW,QAAQ;IACvB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@grantjs/client",
-  "version": "1.0.0",
+  "version": "1.1.0",
   "description": "Browser SDK for Grant authorization - React hooks and components for permission-based UI rendering",
   "type": "module",
   "main": "./dist/index.cjs",
@@ -40,13 +40,13 @@
     "browser"
   ],
   "author": {
-    "name": "Alejandro Heredia",
-    "email": "ale@logus.graphics",
-    "url": "https://logus.graphics"
+    "name": "Ale Heredia",
+    "email": "ale@grantjs.org",
+    "url": "https://grantjs.org"
   },
   "repository": {
     "type": "git",
-    "url": "https://github.com/logusgraphics/grant.git",
+    "url": "https://github.com/grant-js/grant.git",
     "directory": "packages/@grantjs/client"
   },
   "license": "MIT",
@@ -55,23 +55,23 @@
     "registry": "https://registry.npmjs.org/"
   },
   "dependencies": {
-    "@grantjs/schema": "1.0.0"
+    "@grantjs/schema": "1.1.0"
   },
   "devDependencies": {
-    "@tanstack/react-query": "^5.0.0",
+    "@tanstack/react-query": "^5.100.9",
     "@testing-library/jest-dom": "^6.9.1",
     "@testing-library/react": "^16.0.0",
-    "@types/node": "^24.7.2",
+    "@types/node": "^25.6.0",
     "@types/react": "^19",
-    "@vitejs/plugin-react": "^4.3.0",
-    "@vitest/coverage-v8": "^3.2.4",
-    "eslint": "^9.37.0",
-    "jsdom": "^26.0.0",
-    "react": "^19.0.0",
-    "typescript": "^5",
-    "vite": "^6.0.0",
-    "vite-plugin-dts": "^4.3.0",
-    "vitest": "^3.2.4"
+    "@vitejs/plugin-react": "^6.0.1",
+    "@vitest/coverage-v8": "^4.1.5",
+    "eslint": "^10.3.0",
+    "jsdom": "^29.1.1",
+    "react": "^19.2.5",
+    "typescript": "^6",
+    "vite": "^8.0.10",
+    "vite-plugin-dts": "^5.0.0",
+    "vitest": "^4.1.5"
   },
   "peerDependencies": {
     "@tanstack/react-query": "^5",

package/dist/index.cjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.cjs","sources":["../src/grant-client.ts"],"sourcesContent":["import type {\n  GrantClientConfig,\n  AuthorizationResult,\n  PermissionQueryOptions,\n  Scope,\n  SignInWithProjectAppOptions,\n} from './types';\n\n/**\n * Module-level shared promise for cookie-only refresh so that all 401s\n * (across all GrantClient instances and in-flight requests) coalesce into one refresh.\n */\nlet sharedCredentialsRefreshPromise: Promise<boolean> | null = null;\n\n/**\n * Grant Client for browser applications\n *\n * Makes HTTP requests to the Grant API to check permissions\n * and retrieve authorization data. Supports both token-based\n * and cookie-based authentication with automatic token refresh.\n */\nexport class GrantClient {\n  private config: Required<Pick<GrantClientConfig, 'apiUrl'>> & GrantClientConfig;\n  private cache: Map<string, { data: unknown; expires: number }> = new Map();\n  private defaultTtl: number;\n\n  constructor(config: GrantClientConfig) {\n    this.config = config;\n    this.defaultTtl = config.cache?.ttl ?? 5 * 60 * 1000; // 5 minutes default\n  }\n\n  // ============================================================================\n  // Public API - Permission Checks\n  // ============================================================================\n\n  /**\n   * Check if the current user has a specific permission\n   *\n   * @example\n   * ```ts\n   * const canEdit = await grant.can('document', 'update');\n   * if (canEdit) {\n   *   // Show edit button\n   * }\n   * ```\n   */\n  async can(resource: string, action: string, options?: PermissionQueryOptions): Promise<boolean> {\n    const result = await this.isAuthorized(resource, action, options);\n    return result.authorized;\n  }\n\n  /**\n   * Alias for `can` - check if user has permission\n   */\n  async hasPermission(\n    resource: string,\n    action: string,\n    options?: PermissionQueryOptions\n  ): Promise<boolean> {\n    return this.can(resource, action, options);\n  }\n\n  // ============================================================================\n  // Public API - Project OAuth (sign-in with project app)\n  // ============================================================================\n\n  /**\n   * Start project-app OAuth flow (redirect only).\n   * Navigates the current window to the Grant OAuth entry page; after sign-in and consent,\n   * the user is redirected to the app's `redirect_uri` with token in the URL fragment.\n   *\n   * Requires `config.frontendUrl` and `redirectUri`.\n   */\n  async signInWithProjectApp(options: SignInWithProjectAppOptions): Promise<void> {\n    const frontendUrl = this.config.frontendUrl;\n    if (!frontendUrl) {\n      throw new Error('GrantClient: frontendUrl is required for signInWithProjectApp');\n    }\n    const locale = options.locale ?? 'en';\n    const redirectUri = options.redirectUri;\n    if (!redirectUri) {\n      throw new Error('redirectUri is required for signInWithProjectApp');\n    }\n\n    const entryPath = `/${locale}/auth/project`;\n    const params = new URLSearchParams({\n      client_id: options.clientId,\n      redirect_uri: redirectUri,\n      state: options.state ?? '',\n    });\n    if (options.scope) params.set('scope', options.scope);\n\n    const entryUrl = `${frontendUrl.replace(/\\/$/, '')}${entryPath}?${params.toString()}`;\n    if (typeof window !== 'undefined') {\n      window.location.href = entryUrl;\n    }\n  }\n\n  /**\n   * Check authorization with full result details\n   *\n   * @example\n   * ```ts\n   * const result = await grant.isAuthorized('document', 'update');\n   * if (!result.authorized) {\n   *   console.log('Denied:', result.reason);\n   * }\n   * ```\n   */\n  async isAuthorized(\n    resource: string,\n    action: string,\n    options?: PermissionQueryOptions\n  ): Promise<AuthorizationResult> {\n    const contextResourceKey =\n      options?.context?.resource != null ? JSON.stringify(options.context.resource) : undefined;\n    const cacheKey = this.getCacheKey('auth', resource, action, options?.scope, contextResourceKey);\n\n    // Check cache first (unless explicitly disabled)\n    if (options?.useCache !== false) {\n      const cached = this.getFromCache<AuthorizationResult>(cacheKey);\n      if (cached) return cached;\n    }\n\n    try {\n      // API expects: { permission: { resource, action }, context: { resource?: any }, scope?: { tenant, id } }\n      // scope is optional - for session tokens it enables dynamic scope switching\n      const scope = options?.scope;\n      const hasValidScope =\n        scope && typeof scope === 'object' && 'tenant' in scope && 'id' in scope;\n      // When scope is provided and context.resource is not, derive context.resource from scope.id\n      const contextResource =\n        options?.context?.resource ??\n        (hasValidScope && scope && 'id' in scope && scope.id != null ? { id: scope.id } : null);\n\n      const response = await this.fetchWithAuth('/api/auth/is-authorized', {\n        method: 'POST',\n        body: JSON.stringify({\n          permission: {\n            resource,\n            action,\n          },\n          context: {\n            resource: contextResource,\n          },\n          // Pass scope for dynamic scope override (only works with session tokens)\n          ...(hasValidScope && { scope }),\n        }),\n      });\n\n      if (!response.ok) {\n        const error = await response.json().catch(() => ({}));\n        return {\n          authorized: false,\n          reason: error.message || `API error: ${response.status}`,\n        };\n      }\n\n      const json = await response.json();\n      // API returns { success: true, data: { authorized, ... } }\n      const result: AuthorizationResult = json.data ?? json;\n      this.setCache(cacheKey, result);\n      return result;\n    } catch (error) {\n      return {\n        authorized: false,\n        reason: error instanceof Error ? error.message : 'Unknown error',\n      };\n    }\n  }\n\n  // ============================================================================\n  // Public API - Cache Management\n  // ============================================================================\n\n  /**\n   * Clear all cached data\n   */\n  clearCache(): void {\n    this.cache.clear();\n  }\n\n  /**\n   * Clear cached data for a specific scope\n   */\n  clearScopeCache(scope?: Scope): void {\n    const scopeKey = scope ? JSON.stringify(scope) : 'default';\n    for (const key of this.cache.keys()) {\n      if (key.includes(scopeKey)) {\n        this.cache.delete(key);\n      }\n    }\n  }\n\n  // ============================================================================\n  // Private - HTTP & Authentication\n  // ============================================================================\n\n  /**\n   * Make an authenticated fetch request with automatic token refresh on 401\n   */\n  private async fetchWithAuth(url: string, init?: RequestInit): Promise<Response> {\n    const response = await this.doFetch(url, init);\n\n    if (response.status !== 401) return response;\n\n    // Cookie-based refresh (HttpOnly refresh cookie). Body-based refresh is not supported.\n    // Module-level shared promise so all 401s (any client instance) coalesce into one refresh.\n    if (this.config.onRefreshWithCredentials) {\n      if (!sharedCredentialsRefreshPromise) {\n        sharedCredentialsRefreshPromise = this.config.onRefreshWithCredentials().finally(() => {\n          sharedCredentialsRefreshPromise = null;\n        });\n      }\n      const refreshed = await sharedCredentialsRefreshPromise;\n      if (refreshed) return this.doFetch(url, init);\n      this.config.onUnauthorized?.();\n    }\n\n    return response;\n  }\n\n  /**\n   * Perform the actual fetch request\n   */\n  private async doFetch(url: string, init?: RequestInit): Promise<Response> {\n    const fetchFn = this.config.fetch ?? globalThis.fetch;\n    const fullUrl = url.startsWith('http') ? url : `${this.config.apiUrl}${url}`;\n\n    const headers: Record<string, string> = {\n      'Content-Type': 'application/json',\n      ...(init?.headers as Record<string, string>),\n    };\n\n    // Add authorization header if token is available\n    const token = await this.getToken();\n    if (token) {\n      headers['Authorization'] = `Bearer ${token}`;\n    }\n\n    return fetchFn(fullUrl, {\n      ...init,\n      headers,\n      // Include cookies for same-origin requests (supports cookie-based auth)\n      credentials: this.config.credentials ?? 'include',\n    });\n  }\n\n  /**\n   * Get the current access token\n   */\n  private async getToken(): Promise<string | null> {\n    if (this.config.getAccessToken) {\n      const token = this.config.getAccessToken();\n      return token instanceof Promise ? token : token;\n    }\n    return null;\n  }\n\n  // ============================================================================\n  // Private - Cache & URL Helpers\n  // ============================================================================\n\n  private buildUrl(path: string, scope?: Scope): string {\n    const url = new URL(path, this.config.apiUrl);\n    if (scope) {\n      url.searchParams.set('scope', JSON.stringify(scope));\n    }\n    return url.toString();\n  }\n\n  private getCacheKey(...parts: (string | Scope | undefined)[]): string {\n    const prefix = this.config.cache?.prefix ?? 'grant';\n    return `${prefix}:${parts.map((p) => (p ? JSON.stringify(p) : 'default')).join(':')}`;\n  }\n\n  private getFromCache<T>(key: string): T | null {\n    const entry = this.cache.get(key);\n    if (!entry) return null;\n\n    if (Date.now() > entry.expires) {\n      this.cache.delete(key);\n      return null;\n    }\n\n    return entry.data as T;\n  }\n\n  private setCache(key: string, data: unknown): void {\n    this.cache.set(key, {\n      data,\n      expires: Date.now() + this.defaultTtl,\n    });\n  }\n}\n"],"names":[],"mappings":";;;;;AAYA,IAAI,kCAA2D;AASxD,MAAM,YAAY;AAAA,EAKvB,YAAY,QAA2B;AAJ/B;AACA,qDAA6D,IAAA;AAC7D;AAGN,SAAK,SAAS;AACd,SAAK,aAAa,OAAO,OAAO,OAAO,IAAI,KAAK;AAAA,EAClD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAiBA,MAAM,IAAI,UAAkB,QAAgB,SAAoD;AAC9F,UAAM,SAAS,MAAM,KAAK,aAAa,UAAU,QAAQ,OAAO;AAChE,WAAO,OAAO;AAAA,EAChB;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,cACJ,UACA,QACA,SACkB;AAClB,WAAO,KAAK,IAAI,UAAU,QAAQ,OAAO;AAAA,EAC3C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaA,MAAM,qBAAqB,SAAqD;AAC9E,UAAM,cAAc,KAAK,OAAO;AAChC,QAAI,CAAC,aAAa;AAChB,YAAM,IAAI,MAAM,+DAA+D;AAAA,IACjF;AACA,UAAM,SAAS,QAAQ,UAAU;AACjC,UAAM,cAAc,QAAQ;AAC5B,QAAI,CAAC,aAAa;AAChB,YAAM,IAAI,MAAM,kDAAkD;AAAA,IACpE;AAEA,UAAM,YAAY,IAAI,MAAM;AAC5B,UAAM,SAAS,IAAI,gBAAgB;AAAA,MACjC,WAAW,QAAQ;AAAA,MACnB,cAAc;AAAA,MACd,OAAO,QAAQ,SAAS;AAAA,IAAA,CACzB;AACD,QAAI,QAAQ,MAAO,QAAO,IAAI,SAAS,QAAQ,KAAK;AAEpD,UAAM,WAAW,GAAG,YAAY,QAAQ,OAAO,EAAE,CAAC,GAAG,SAAS,IAAI,OAAO,SAAA,CAAU;AACnF,QAAI,OAAO,WAAW,aAAa;AACjC,aAAO,SAAS,OAAO;AAAA,IACzB;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaA,MAAM,aACJ,UACA,QACA,SAC8B;AAC9B,UAAM,qBACJ,SAAS,SAAS,YAAY,OAAO,KAAK,UAAU,QAAQ,QAAQ,QAAQ,IAAI;AAClF,UAAM,WAAW,KAAK,YAAY,QAAQ,UAAU,QAAQ,SAAS,OAAO,kBAAkB;AAG9F,QAAI,SAAS,aAAa,OAAO;AAC/B,YAAM,SAAS,KAAK,aAAkC,QAAQ;AAC9D,UAAI,OAAQ,QAAO;AAAA,IACrB;AAEA,QAAI;AAGF,YAAM,QAAQ,SAAS;AACvB,YAAM,gBACJ,SAAS,OAAO,UAAU,YAAY,YAAY,SAAS,QAAQ;AAErE,YAAM,kBACJ,SAAS,SAAS,aACjB,iBAAiB,SAAS,QAAQ,SAAS,MAAM,MAAM,OAAO,EAAE,IAAI,MAAM,OAAO;AAEpF,YAAM,WAAW,MAAM,KAAK,cAAc,2BAA2B;AAAA,QACnE,QAAQ;AAAA,QACR,MAAM,KAAK,UAAU;AAAA,UACnB,YAAY;AAAA,YACV;AAAA,YACA;AAAA,UAAA;AAAA,UAEF,SAAS;AAAA,YACP,UAAU;AAAA,UAAA;AAAA;AAAA,UAGZ,GAAI,iBAAiB,EAAE,MAAA;AAAA,QAAM,CAC9B;AAAA,MAAA,CACF;AAED,UAAI,CAAC,SAAS,IAAI;AAChB,cAAM,QAAQ,MAAM,SAAS,KAAA,EAAO,MAAM,OAAO,CAAA,EAAG;AACpD,eAAO;AAAA,UACL,YAAY;AAAA,UACZ,QAAQ,MAAM,WAAW,cAAc,SAAS,MAAM;AAAA,QAAA;AAAA,MAE1D;AAEA,YAAM,OAAO,MAAM,SAAS,KAAA;AAE5B,YAAM,SAA8B,KAAK,QAAQ;AACjD,WAAK,SAAS,UAAU,MAAM;AAC9B,aAAO;AAAA,IACT,SAAS,OAAO;AACd,aAAO;AAAA,QACL,YAAY;AAAA,QACZ,QAAQ,iBAAiB,QAAQ,MAAM,UAAU;AAAA,MAAA;AAAA,IAErD;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,aAAmB;AACjB,SAAK,MAAM,MAAA;AAAA,EACb;AAAA;AAAA;AAAA;AAAA,EAKA,gBAAgB,OAAqB;AACnC,UAAM,WAAW,QAAQ,KAAK,UAAU,KAAK,IAAI;AACjD,eAAW,OAAO,KAAK,MAAM,KAAA,GAAQ;AACnC,UAAI,IAAI,SAAS,QAAQ,GAAG;AAC1B,aAAK,MAAM,OAAO,GAAG;AAAA,MACvB;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAc,cAAc,KAAa,MAAuC;AAC9E,UAAM,WAAW,MAAM,KAAK,QAAQ,KAAK,IAAI;AAE7C,QAAI,SAAS,WAAW,IAAK,QAAO;AAIpC,QAAI,KAAK,OAAO,0BAA0B;AACxC,UAAI,CAAC,iCAAiC;AACpC,0CAAkC,KAAK,OAAO,yBAAA,EAA2B,QAAQ,MAAM;AACrF,4CAAkC;AAAA,QACpC,CAAC;AAAA,MACH;AACA,YAAM,YAAY,MAAM;AACxB,UAAI,UAAW,QAAO,KAAK,QAAQ,KAAK,IAAI;AAC5C,WAAK,OAAO,iBAAA;AAAA,IACd;AAEA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAKA,MAAc,QAAQ,KAAa,MAAuC;AACxE,UAAM,UAAU,KAAK,OAAO,SAAS,WAAW;AAChD,UAAM,UAAU,IAAI,WAAW,MAAM,IAAI,MAAM,GAAG,KAAK,OAAO,MAAM,GAAG,GAAG;AAE1E,UAAM,UAAkC;AAAA,MACtC,gBAAgB;AAAA,MAChB,GAAI,MAAM;AAAA,IAAA;AAIZ,UAAM,QAAQ,MAAM,KAAK,SAAA;AACzB,QAAI,OAAO;AACT,cAAQ,eAAe,IAAI,UAAU,KAAK;AAAA,IAC5C;AAEA,WAAO,QAAQ,SAAS;AAAA,MACtB,GAAG;AAAA,MACH;AAAA;AAAA,MAEA,aAAa,KAAK,OAAO,eAAe;AAAA,IAAA,CACzC;AAAA,EACH;AAAA;AAAA;AAAA;AAAA,EAKA,MAAc,WAAmC;AAC/C,QAAI,KAAK,OAAO,gBAAgB;AAC9B,YAAM,QAAQ,KAAK,OAAO,eAAA;AAC1B,aAAO,iBAAiB,UAAU,QAAQ;AAAA,IAC5C;AACA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAMQ,SAAS,MAAc,OAAuB;AACpD,UAAM,MAAM,IAAI,IAAI,MAAM,KAAK,OAAO,MAAM;AAC5C,QAAI,OAAO;AACT,UAAI,aAAa,IAAI,SAAS,KAAK,UAAU,KAAK,CAAC;AAAA,IACrD;AACA,WAAO,IAAI,SAAA;AAAA,EACb;AAAA,EAEQ,eAAe,OAA+C;AACpE,UAAM,SAAS,KAAK,OAAO,OAAO,UAAU;AAC5C,WAAO,GAAG,MAAM,IAAI,MAAM,IAAI,CAAC,MAAO,IAAI,KAAK,UAAU,CAAC,IAAI,SAAU,EAAE,KAAK,GAAG,CAAC;AAAA,EACrF;AAAA,EAEQ,aAAgB,KAAuB;AAC7C,UAAM,QAAQ,KAAK,MAAM,IAAI,GAAG;AAChC,QAAI,CAAC,MAAO,QAAO;AAEnB,QAAI,KAAK,QAAQ,MAAM,SAAS;AAC9B,WAAK,MAAM,OAAO,GAAG;AACrB,aAAO;AAAA,IACT;AAEA,WAAO,MAAM;AAAA,EACf;AAAA,EAEQ,SAAS,KAAa,MAAqB;AACjD,SAAK,MAAM,IAAI,KAAK;AAAA,MAClB;AAAA,MACA,SAAS,KAAK,IAAA,IAAQ,KAAK;AAAA,IAAA,CAC5B;AAAA,EACH;AACF;;"}

package/dist/index.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.mjs","sources":["../src/grant-client.ts"],"sourcesContent":["import type {\n  GrantClientConfig,\n  AuthorizationResult,\n  PermissionQueryOptions,\n  Scope,\n  SignInWithProjectAppOptions,\n} from './types';\n\n/**\n * Module-level shared promise for cookie-only refresh so that all 401s\n * (across all GrantClient instances and in-flight requests) coalesce into one refresh.\n */\nlet sharedCredentialsRefreshPromise: Promise<boolean> | null = null;\n\n/**\n * Grant Client for browser applications\n *\n * Makes HTTP requests to the Grant API to check permissions\n * and retrieve authorization data. Supports both token-based\n * and cookie-based authentication with automatic token refresh.\n */\nexport class GrantClient {\n  private config: Required<Pick<GrantClientConfig, 'apiUrl'>> & GrantClientConfig;\n  private cache: Map<string, { data: unknown; expires: number }> = new Map();\n  private defaultTtl: number;\n\n  constructor(config: GrantClientConfig) {\n    this.config = config;\n    this.defaultTtl = config.cache?.ttl ?? 5 * 60 * 1000; // 5 minutes default\n  }\n\n  // ============================================================================\n  // Public API - Permission Checks\n  // ============================================================================\n\n  /**\n   * Check if the current user has a specific permission\n   *\n   * @example\n   * ```ts\n   * const canEdit = await grant.can('document', 'update');\n   * if (canEdit) {\n   *   // Show edit button\n   * }\n   * ```\n   */\n  async can(resource: string, action: string, options?: PermissionQueryOptions): Promise<boolean> {\n    const result = await this.isAuthorized(resource, action, options);\n    return result.authorized;\n  }\n\n  /**\n   * Alias for `can` - check if user has permission\n   */\n  async hasPermission(\n    resource: string,\n    action: string,\n    options?: PermissionQueryOptions\n  ): Promise<boolean> {\n    return this.can(resource, action, options);\n  }\n\n  // ============================================================================\n  // Public API - Project OAuth (sign-in with project app)\n  // ============================================================================\n\n  /**\n   * Start project-app OAuth flow (redirect only).\n   * Navigates the current window to the Grant OAuth entry page; after sign-in and consent,\n   * the user is redirected to the app's `redirect_uri` with token in the URL fragment.\n   *\n   * Requires `config.frontendUrl` and `redirectUri`.\n   */\n  async signInWithProjectApp(options: SignInWithProjectAppOptions): Promise<void> {\n    const frontendUrl = this.config.frontendUrl;\n    if (!frontendUrl) {\n      throw new Error('GrantClient: frontendUrl is required for signInWithProjectApp');\n    }\n    const locale = options.locale ?? 'en';\n    const redirectUri = options.redirectUri;\n    if (!redirectUri) {\n      throw new Error('redirectUri is required for signInWithProjectApp');\n    }\n\n    const entryPath = `/${locale}/auth/project`;\n    const params = new URLSearchParams({\n      client_id: options.clientId,\n      redirect_uri: redirectUri,\n      state: options.state ?? '',\n    });\n    if (options.scope) params.set('scope', options.scope);\n\n    const entryUrl = `${frontendUrl.replace(/\\/$/, '')}${entryPath}?${params.toString()}`;\n    if (typeof window !== 'undefined') {\n      window.location.href = entryUrl;\n    }\n  }\n\n  /**\n   * Check authorization with full result details\n   *\n   * @example\n   * ```ts\n   * const result = await grant.isAuthorized('document', 'update');\n   * if (!result.authorized) {\n   *   console.log('Denied:', result.reason);\n   * }\n   * ```\n   */\n  async isAuthorized(\n    resource: string,\n    action: string,\n    options?: PermissionQueryOptions\n  ): Promise<AuthorizationResult> {\n    const contextResourceKey =\n      options?.context?.resource != null ? JSON.stringify(options.context.resource) : undefined;\n    const cacheKey = this.getCacheKey('auth', resource, action, options?.scope, contextResourceKey);\n\n    // Check cache first (unless explicitly disabled)\n    if (options?.useCache !== false) {\n      const cached = this.getFromCache<AuthorizationResult>(cacheKey);\n      if (cached) return cached;\n    }\n\n    try {\n      // API expects: { permission: { resource, action }, context: { resource?: any }, scope?: { tenant, id } }\n      // scope is optional - for session tokens it enables dynamic scope switching\n      const scope = options?.scope;\n      const hasValidScope =\n        scope && typeof scope === 'object' && 'tenant' in scope && 'id' in scope;\n      // When scope is provided and context.resource is not, derive context.resource from scope.id\n      const contextResource =\n        options?.context?.resource ??\n        (hasValidScope && scope && 'id' in scope && scope.id != null ? { id: scope.id } : null);\n\n      const response = await this.fetchWithAuth('/api/auth/is-authorized', {\n        method: 'POST',\n        body: JSON.stringify({\n          permission: {\n            resource,\n            action,\n          },\n          context: {\n            resource: contextResource,\n          },\n          // Pass scope for dynamic scope override (only works with session tokens)\n          ...(hasValidScope && { scope }),\n        }),\n      });\n\n      if (!response.ok) {\n        const error = await response.json().catch(() => ({}));\n        return {\n          authorized: false,\n          reason: error.message || `API error: ${response.status}`,\n        };\n      }\n\n      const json = await response.json();\n      // API returns { success: true, data: { authorized, ... } }\n      const result: AuthorizationResult = json.data ?? json;\n      this.setCache(cacheKey, result);\n      return result;\n    } catch (error) {\n      return {\n        authorized: false,\n        reason: error instanceof Error ? error.message : 'Unknown error',\n      };\n    }\n  }\n\n  // ============================================================================\n  // Public API - Cache Management\n  // ============================================================================\n\n  /**\n   * Clear all cached data\n   */\n  clearCache(): void {\n    this.cache.clear();\n  }\n\n  /**\n   * Clear cached data for a specific scope\n   */\n  clearScopeCache(scope?: Scope): void {\n    const scopeKey = scope ? JSON.stringify(scope) : 'default';\n    for (const key of this.cache.keys()) {\n      if (key.includes(scopeKey)) {\n        this.cache.delete(key);\n      }\n    }\n  }\n\n  // ============================================================================\n  // Private - HTTP & Authentication\n  // ============================================================================\n\n  /**\n   * Make an authenticated fetch request with automatic token refresh on 401\n   */\n  private async fetchWithAuth(url: string, init?: RequestInit): Promise<Response> {\n    const response = await this.doFetch(url, init);\n\n    if (response.status !== 401) return response;\n\n    // Cookie-based refresh (HttpOnly refresh cookie). Body-based refresh is not supported.\n    // Module-level shared promise so all 401s (any client instance) coalesce into one refresh.\n    if (this.config.onRefreshWithCredentials) {\n      if (!sharedCredentialsRefreshPromise) {\n        sharedCredentialsRefreshPromise = this.config.onRefreshWithCredentials().finally(() => {\n          sharedCredentialsRefreshPromise = null;\n        });\n      }\n      const refreshed = await sharedCredentialsRefreshPromise;\n      if (refreshed) return this.doFetch(url, init);\n      this.config.onUnauthorized?.();\n    }\n\n    return response;\n  }\n\n  /**\n   * Perform the actual fetch request\n   */\n  private async doFetch(url: string, init?: RequestInit): Promise<Response> {\n    const fetchFn = this.config.fetch ?? globalThis.fetch;\n    const fullUrl = url.startsWith('http') ? url : `${this.config.apiUrl}${url}`;\n\n    const headers: Record<string, string> = {\n      'Content-Type': 'application/json',\n      ...(init?.headers as Record<string, string>),\n    };\n\n    // Add authorization header if token is available\n    const token = await this.getToken();\n    if (token) {\n      headers['Authorization'] = `Bearer ${token}`;\n    }\n\n    return fetchFn(fullUrl, {\n      ...init,\n      headers,\n      // Include cookies for same-origin requests (supports cookie-based auth)\n      credentials: this.config.credentials ?? 'include',\n    });\n  }\n\n  /**\n   * Get the current access token\n   */\n  private async getToken(): Promise<string | null> {\n    if (this.config.getAccessToken) {\n      const token = this.config.getAccessToken();\n      return token instanceof Promise ? token : token;\n    }\n    return null;\n  }\n\n  // ============================================================================\n  // Private - Cache & URL Helpers\n  // ============================================================================\n\n  private buildUrl(path: string, scope?: Scope): string {\n    const url = new URL(path, this.config.apiUrl);\n    if (scope) {\n      url.searchParams.set('scope', JSON.stringify(scope));\n    }\n    return url.toString();\n  }\n\n  private getCacheKey(...parts: (string | Scope | undefined)[]): string {\n    const prefix = this.config.cache?.prefix ?? 'grant';\n    return `${prefix}:${parts.map((p) => (p ? JSON.stringify(p) : 'default')).join(':')}`;\n  }\n\n  private getFromCache<T>(key: string): T | null {\n    const entry = this.cache.get(key);\n    if (!entry) return null;\n\n    if (Date.now() > entry.expires) {\n      this.cache.delete(key);\n      return null;\n    }\n\n    return entry.data as T;\n  }\n\n  private setCache(key: string, data: unknown): void {\n    this.cache.set(key, {\n      data,\n      expires: Date.now() + this.defaultTtl,\n    });\n  }\n}\n"],"names":[],"mappings":";;;AAYA,IAAI,kCAA2D;AASxD,MAAM,YAAY;AAAA,EAKvB,YAAY,QAA2B;AAJ/B;AACA,qDAA6D,IAAA;AAC7D;AAGN,SAAK,SAAS;AACd,SAAK,aAAa,OAAO,OAAO,OAAO,IAAI,KAAK;AAAA,EAClD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAiBA,MAAM,IAAI,UAAkB,QAAgB,SAAoD;AAC9F,UAAM,SAAS,MAAM,KAAK,aAAa,UAAU,QAAQ,OAAO;AAChE,WAAO,OAAO;AAAA,EAChB;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,cACJ,UACA,QACA,SACkB;AAClB,WAAO,KAAK,IAAI,UAAU,QAAQ,OAAO;AAAA,EAC3C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaA,MAAM,qBAAqB,SAAqD;AAC9E,UAAM,cAAc,KAAK,OAAO;AAChC,QAAI,CAAC,aAAa;AAChB,YAAM,IAAI,MAAM,+DAA+D;AAAA,IACjF;AACA,UAAM,SAAS,QAAQ,UAAU;AACjC,UAAM,cAAc,QAAQ;AAC5B,QAAI,CAAC,aAAa;AAChB,YAAM,IAAI,MAAM,kDAAkD;AAAA,IACpE;AAEA,UAAM,YAAY,IAAI,MAAM;AAC5B,UAAM,SAAS,IAAI,gBAAgB;AAAA,MACjC,WAAW,QAAQ;AAAA,MACnB,cAAc;AAAA,MACd,OAAO,QAAQ,SAAS;AAAA,IAAA,CACzB;AACD,QAAI,QAAQ,MAAO,QAAO,IAAI,SAAS,QAAQ,KAAK;AAEpD,UAAM,WAAW,GAAG,YAAY,QAAQ,OAAO,EAAE,CAAC,GAAG,SAAS,IAAI,OAAO,SAAA,CAAU;AACnF,QAAI,OAAO,WAAW,aAAa;AACjC,aAAO,SAAS,OAAO;AAAA,IACzB;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaA,MAAM,aACJ,UACA,QACA,SAC8B;AAC9B,UAAM,qBACJ,SAAS,SAAS,YAAY,OAAO,KAAK,UAAU,QAAQ,QAAQ,QAAQ,IAAI;AAClF,UAAM,WAAW,KAAK,YAAY,QAAQ,UAAU,QAAQ,SAAS,OAAO,kBAAkB;AAG9F,QAAI,SAAS,aAAa,OAAO;AAC/B,YAAM,SAAS,KAAK,aAAkC,QAAQ;AAC9D,UAAI,OAAQ,QAAO;AAAA,IACrB;AAEA,QAAI;AAGF,YAAM,QAAQ,SAAS;AACvB,YAAM,gBACJ,SAAS,OAAO,UAAU,YAAY,YAAY,SAAS,QAAQ;AAErE,YAAM,kBACJ,SAAS,SAAS,aACjB,iBAAiB,SAAS,QAAQ,SAAS,MAAM,MAAM,OAAO,EAAE,IAAI,MAAM,OAAO;AAEpF,YAAM,WAAW,MAAM,KAAK,cAAc,2BAA2B;AAAA,QACnE,QAAQ;AAAA,QACR,MAAM,KAAK,UAAU;AAAA,UACnB,YAAY;AAAA,YACV;AAAA,YACA;AAAA,UAAA;AAAA,UAEF,SAAS;AAAA,YACP,UAAU;AAAA,UAAA;AAAA;AAAA,UAGZ,GAAI,iBAAiB,EAAE,MAAA;AAAA,QAAM,CAC9B;AAAA,MAAA,CACF;AAED,UAAI,CAAC,SAAS,IAAI;AAChB,cAAM,QAAQ,MAAM,SAAS,KAAA,EAAO,MAAM,OAAO,CAAA,EAAG;AACpD,eAAO;AAAA,UACL,YAAY;AAAA,UACZ,QAAQ,MAAM,WAAW,cAAc,SAAS,MAAM;AAAA,QAAA;AAAA,MAE1D;AAEA,YAAM,OAAO,MAAM,SAAS,KAAA;AAE5B,YAAM,SAA8B,KAAK,QAAQ;AACjD,WAAK,SAAS,UAAU,MAAM;AAC9B,aAAO;AAAA,IACT,SAAS,OAAO;AACd,aAAO;AAAA,QACL,YAAY;AAAA,QACZ,QAAQ,iBAAiB,QAAQ,MAAM,UAAU;AAAA,MAAA;AAAA,IAErD;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,aAAmB;AACjB,SAAK,MAAM,MAAA;AAAA,EACb;AAAA;AAAA;AAAA;AAAA,EAKA,gBAAgB,OAAqB;AACnC,UAAM,WAAW,QAAQ,KAAK,UAAU,KAAK,IAAI;AACjD,eAAW,OAAO,KAAK,MAAM,KAAA,GAAQ;AACnC,UAAI,IAAI,SAAS,QAAQ,GAAG;AAC1B,aAAK,MAAM,OAAO,GAAG;AAAA,MACvB;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAc,cAAc,KAAa,MAAuC;AAC9E,UAAM,WAAW,MAAM,KAAK,QAAQ,KAAK,IAAI;AAE7C,QAAI,SAAS,WAAW,IAAK,QAAO;AAIpC,QAAI,KAAK,OAAO,0BAA0B;AACxC,UAAI,CAAC,iCAAiC;AACpC,0CAAkC,KAAK,OAAO,yBAAA,EAA2B,QAAQ,MAAM;AACrF,4CAAkC;AAAA,QACpC,CAAC;AAAA,MACH;AACA,YAAM,YAAY,MAAM;AACxB,UAAI,UAAW,QAAO,KAAK,QAAQ,KAAK,IAAI;AAC5C,WAAK,OAAO,iBAAA;AAAA,IACd;AAEA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAKA,MAAc,QAAQ,KAAa,MAAuC;AACxE,UAAM,UAAU,KAAK,OAAO,SAAS,WAAW;AAChD,UAAM,UAAU,IAAI,WAAW,MAAM,IAAI,MAAM,GAAG,KAAK,OAAO,MAAM,GAAG,GAAG;AAE1E,UAAM,UAAkC;AAAA,MACtC,gBAAgB;AAAA,MAChB,GAAI,MAAM;AAAA,IAAA;AAIZ,UAAM,QAAQ,MAAM,KAAK,SAAA;AACzB,QAAI,OAAO;AACT,cAAQ,eAAe,IAAI,UAAU,KAAK;AAAA,IAC5C;AAEA,WAAO,QAAQ,SAAS;AAAA,MACtB,GAAG;AAAA,MACH;AAAA;AAAA,MAEA,aAAa,KAAK,OAAO,eAAe;AAAA,IAAA,CACzC;AAAA,EACH;AAAA;AAAA;AAAA;AAAA,EAKA,MAAc,WAAmC;AAC/C,QAAI,KAAK,OAAO,gBAAgB;AAC9B,YAAM,QAAQ,KAAK,OAAO,eAAA;AAC1B,aAAO,iBAAiB,UAAU,QAAQ;AAAA,IAC5C;AACA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAMQ,SAAS,MAAc,OAAuB;AACpD,UAAM,MAAM,IAAI,IAAI,MAAM,KAAK,OAAO,MAAM;AAC5C,QAAI,OAAO;AACT,UAAI,aAAa,IAAI,SAAS,KAAK,UAAU,KAAK,CAAC;AAAA,IACrD;AACA,WAAO,IAAI,SAAA;AAAA,EACb;AAAA,EAEQ,eAAe,OAA+C;AACpE,UAAM,SAAS,KAAK,OAAO,OAAO,UAAU;AAC5C,WAAO,GAAG,MAAM,IAAI,MAAM,IAAI,CAAC,MAAO,IAAI,KAAK,UAAU,CAAC,IAAI,SAAU,EAAE,KAAK,GAAG,CAAC;AAAA,EACrF;AAAA,EAEQ,aAAgB,KAAuB;AAC7C,UAAM,QAAQ,KAAK,MAAM,IAAI,GAAG;AAChC,QAAI,CAAC,MAAO,QAAO;AAEnB,QAAI,KAAK,QAAQ,MAAM,SAAS;AAC9B,WAAK,MAAM,OAAO,GAAG;AACrB,aAAO;AAAA,IACT;AAEA,WAAO,MAAM;AAAA,EACf;AAAA,EAEQ,SAAS,KAAa,MAAqB;AACjD,SAAK,MAAM,IAAI,KAAK;AAAA,MAClB;AAAA,MACA,SAAS,KAAK,IAAA,IAAQ,KAAK;AAAA,IAAA,CAC5B;AAAA,EACH;AACF;"}