@grantjs/client 1.0.0

package/dist/index.cjs

@@ -0,0 +1,228 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
+var __publicField = (obj, key, value) => __defNormalProp(obj, typeof key !== "symbol" ? key + "" : key, value);
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+let sharedCredentialsRefreshPromise = null;
+class GrantClient {
+  constructor(config) {
+    __publicField(this, "config");
+    __publicField(this, "cache", /* @__PURE__ */ new Map());
+    __publicField(this, "defaultTtl");
+    this.config = config;
+    this.defaultTtl = config.cache?.ttl ?? 5 * 60 * 1e3;
+  }
+  // ============================================================================
+  // Public API - Permission Checks
+  // ============================================================================
+  /**
+   * Check if the current user has a specific permission
+   *
+   * @example
+   * ```ts
+   * const canEdit = await grant.can('document', 'update');
+   * if (canEdit) {
+   *   // Show edit button
+   * }
+   * ```
+   */
+  async can(resource, action, options) {
+    const result = await this.isAuthorized(resource, action, options);
+    return result.authorized;
+  }
+  /**
+   * Alias for `can` - check if user has permission
+   */
+  async hasPermission(resource, action, options) {
+    return this.can(resource, action, options);
+  }
+  // ============================================================================
+  // Public API - Project OAuth (sign-in with project app)
+  // ============================================================================
+  /**
+   * Start project-app OAuth flow (redirect only).
+   * Navigates the current window to the Grant OAuth entry page; after sign-in and consent,
+   * the user is redirected to the app's `redirect_uri` with token in the URL fragment.
+   *
+   * Requires `config.frontendUrl` and `redirectUri`.
+   */
+  async signInWithProjectApp(options) {
+    const frontendUrl = this.config.frontendUrl;
+    if (!frontendUrl) {
+      throw new Error("GrantClient: frontendUrl is required for signInWithProjectApp");
+    }
+    const locale = options.locale ?? "en";
+    const redirectUri = options.redirectUri;
+    if (!redirectUri) {
+      throw new Error("redirectUri is required for signInWithProjectApp");
+    }
+    const entryPath = `/${locale}/auth/project`;
+    const params = new URLSearchParams({
+      client_id: options.clientId,
+      redirect_uri: redirectUri,
+      state: options.state ?? ""
+    });
+    if (options.scope) params.set("scope", options.scope);
+    const entryUrl = `${frontendUrl.replace(/\/$/, "")}${entryPath}?${params.toString()}`;
+    if (typeof window !== "undefined") {
+      window.location.href = entryUrl;
+    }
+  }
+  /**
+   * Check authorization with full result details
+   *
+   * @example
+   * ```ts
+   * const result = await grant.isAuthorized('document', 'update');
+   * if (!result.authorized) {
+   *   console.log('Denied:', result.reason);
+   * }
+   * ```
+   */
+  async isAuthorized(resource, action, options) {
+    const contextResourceKey = options?.context?.resource != null ? JSON.stringify(options.context.resource) : void 0;
+    const cacheKey = this.getCacheKey("auth", resource, action, options?.scope, contextResourceKey);
+    if (options?.useCache !== false) {
+      const cached = this.getFromCache(cacheKey);
+      if (cached) return cached;
+    }
+    try {
+      const scope = options?.scope;
+      const hasValidScope = scope && typeof scope === "object" && "tenant" in scope && "id" in scope;
+      const contextResource = options?.context?.resource ?? (hasValidScope && scope && "id" in scope && scope.id != null ? { id: scope.id } : null);
+      const response = await this.fetchWithAuth("/api/auth/is-authorized", {
+        method: "POST",
+        body: JSON.stringify({
+          permission: {
+            resource,
+            action
+          },
+          context: {
+            resource: contextResource
+          },
+          // Pass scope for dynamic scope override (only works with session tokens)
+          ...hasValidScope && { scope }
+        })
+      });
+      if (!response.ok) {
+        const error = await response.json().catch(() => ({}));
+        return {
+          authorized: false,
+          reason: error.message || `API error: ${response.status}`
+        };
+      }
+      const json = await response.json();
+      const result = json.data ?? json;
+      this.setCache(cacheKey, result);
+      return result;
+    } catch (error) {
+      return {
+        authorized: false,
+        reason: error instanceof Error ? error.message : "Unknown error"
+      };
+    }
+  }
+  // ============================================================================
+  // Public API - Cache Management
+  // ============================================================================
+  /**
+   * Clear all cached data
+   */
+  clearCache() {
+    this.cache.clear();
+  }
+  /**
+   * Clear cached data for a specific scope
+   */
+  clearScopeCache(scope) {
+    const scopeKey = scope ? JSON.stringify(scope) : "default";
+    for (const key of this.cache.keys()) {
+      if (key.includes(scopeKey)) {
+        this.cache.delete(key);
+      }
+    }
+  }
+  // ============================================================================
+  // Private - HTTP & Authentication
+  // ============================================================================
+  /**
+   * Make an authenticated fetch request with automatic token refresh on 401
+   */
+  async fetchWithAuth(url, init) {
+    const response = await this.doFetch(url, init);
+    if (response.status !== 401) return response;
+    if (this.config.onRefreshWithCredentials) {
+      if (!sharedCredentialsRefreshPromise) {
+        sharedCredentialsRefreshPromise = this.config.onRefreshWithCredentials().finally(() => {
+          sharedCredentialsRefreshPromise = null;
+        });
+      }
+      const refreshed = await sharedCredentialsRefreshPromise;
+      if (refreshed) return this.doFetch(url, init);
+      this.config.onUnauthorized?.();
+    }
+    return response;
+  }
+  /**
+   * Perform the actual fetch request
+   */
+  async doFetch(url, init) {
+    const fetchFn = this.config.fetch ?? globalThis.fetch;
+    const fullUrl = url.startsWith("http") ? url : `${this.config.apiUrl}${url}`;
+    const headers = {
+      "Content-Type": "application/json",
+      ...init?.headers
+    };
+    const token = await this.getToken();
+    if (token) {
+      headers["Authorization"] = `Bearer ${token}`;
+    }
+    return fetchFn(fullUrl, {
+      ...init,
+      headers,
+      // Include cookies for same-origin requests (supports cookie-based auth)
+      credentials: this.config.credentials ?? "include"
+    });
+  }
+  /**
+   * Get the current access token
+   */
+  async getToken() {
+    if (this.config.getAccessToken) {
+      const token = this.config.getAccessToken();
+      return token instanceof Promise ? token : token;
+    }
+    return null;
+  }
+  // ============================================================================
+  // Private - Cache & URL Helpers
+  // ============================================================================
+  buildUrl(path, scope) {
+    const url = new URL(path, this.config.apiUrl);
+    if (scope) {
+      url.searchParams.set("scope", JSON.stringify(scope));
+    }
+    return url.toString();
+  }
+  getCacheKey(...parts) {
+    const prefix = this.config.cache?.prefix ?? "grant";
+    return `${prefix}:${parts.map((p) => p ? JSON.stringify(p) : "default").join(":")}`;
+  }
+  getFromCache(key) {
+    const entry = this.cache.get(key);
+    if (!entry) return null;
+    if (Date.now() > entry.expires) {
+      this.cache.delete(key);
+      return null;
+    }
+    return entry.data;
+  }
+  setCache(key, data) {
+    this.cache.set(key, {
+      data,
+      expires: Date.now() + this.defaultTtl
+    });
+  }
+}
+exports.GrantClient = GrantClient;
+//# sourceMappingURL=index.cjs.map

package/dist/index.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.cjs","sources":["../src/grant-client.ts"],"sourcesContent":["import type {\n  GrantClientConfig,\n  AuthorizationResult,\n  PermissionQueryOptions,\n  Scope,\n  SignInWithProjectAppOptions,\n} from './types';\n\n/**\n * Module-level shared promise for cookie-only refresh so that all 401s\n * (across all GrantClient instances and in-flight requests) coalesce into one refresh.\n */\nlet sharedCredentialsRefreshPromise: Promise<boolean> | null = null;\n\n/**\n * Grant Client for browser applications\n *\n * Makes HTTP requests to the Grant API to check permissions\n * and retrieve authorization data. Supports both token-based\n * and cookie-based authentication with automatic token refresh.\n */\nexport class GrantClient {\n  private config: Required<Pick<GrantClientConfig, 'apiUrl'>> & GrantClientConfig;\n  private cache: Map<string, { data: unknown; expires: number }> = new Map();\n  private defaultTtl: number;\n\n  constructor(config: GrantClientConfig) {\n    this.config = config;\n    this.defaultTtl = config.cache?.ttl ?? 5 * 60 * 1000; // 5 minutes default\n  }\n\n  // ============================================================================\n  // Public API - Permission Checks\n  // ============================================================================\n\n  /**\n   * Check if the current user has a specific permission\n   *\n   * @example\n   * ```ts\n   * const canEdit = await grant.can('document', 'update');\n   * if (canEdit) {\n   *   // Show edit button\n   * }\n   * ```\n   */\n  async can(resource: string, action: string, options?: PermissionQueryOptions): Promise<boolean> {\n    const result = await this.isAuthorized(resource, action, options);\n    return result.authorized;\n  }\n\n  /**\n   * Alias for `can` - check if user has permission\n   */\n  async hasPermission(\n    resource: string,\n    action: string,\n    options?: PermissionQueryOptions\n  ): Promise<boolean> {\n    return this.can(resource, action, options);\n  }\n\n  // ============================================================================\n  // Public API - Project OAuth (sign-in with project app)\n  // ============================================================================\n\n  /**\n   * Start project-app OAuth flow (redirect only).\n   * Navigates the current window to the Grant OAuth entry page; after sign-in and consent,\n   * the user is redirected to the app's `redirect_uri` with token in the URL fragment.\n   *\n   * Requires `config.frontendUrl` and `redirectUri`.\n   */\n  async signInWithProjectApp(options: SignInWithProjectAppOptions): Promise<void> {\n    const frontendUrl = this.config.frontendUrl;\n    if (!frontendUrl) {\n      throw new Error('GrantClient: frontendUrl is required for signInWithProjectApp');\n    }\n    const locale = options.locale ?? 'en';\n    const redirectUri = options.redirectUri;\n    if (!redirectUri) {\n      throw new Error('redirectUri is required for signInWithProjectApp');\n    }\n\n    const entryPath = `/${locale}/auth/project`;\n    const params = new URLSearchParams({\n      client_id: options.clientId,\n      redirect_uri: redirectUri,\n      state: options.state ?? '',\n    });\n    if (options.scope) params.set('scope', options.scope);\n\n    const entryUrl = `${frontendUrl.replace(/\\/$/, '')}${entryPath}?${params.toString()}`;\n    if (typeof window !== 'undefined') {\n      window.location.href = entryUrl;\n    }\n  }\n\n  /**\n   * Check authorization with full result details\n   *\n   * @example\n   * ```ts\n   * const result = await grant.isAuthorized('document', 'update');\n   * if (!result.authorized) {\n   *   console.log('Denied:', result.reason);\n   * }\n   * ```\n   */\n  async isAuthorized(\n    resource: string,\n    action: string,\n    options?: PermissionQueryOptions\n  ): Promise<AuthorizationResult> {\n    const contextResourceKey =\n      options?.context?.resource != null ? JSON.stringify(options.context.resource) : undefined;\n    const cacheKey = this.getCacheKey('auth', resource, action, options?.scope, contextResourceKey);\n\n    // Check cache first (unless explicitly disabled)\n    if (options?.useCache !== false) {\n      const cached = this.getFromCache<AuthorizationResult>(cacheKey);\n      if (cached) return cached;\n    }\n\n    try {\n      // API expects: { permission: { resource, action }, context: { resource?: any }, scope?: { tenant, id } }\n      // scope is optional - for session tokens it enables dynamic scope switching\n      const scope = options?.scope;\n      const hasValidScope =\n        scope && typeof scope === 'object' && 'tenant' in scope && 'id' in scope;\n      // When scope is provided and context.resource is not, derive context.resource from scope.id\n      const contextResource =\n        options?.context?.resource ??\n        (hasValidScope && scope && 'id' in scope && scope.id != null ? { id: scope.id } : null);\n\n      const response = await this.fetchWithAuth('/api/auth/is-authorized', {\n        method: 'POST',\n        body: JSON.stringify({\n          permission: {\n            resource,\n            action,\n          },\n          context: {\n            resource: contextResource,\n          },\n          // Pass scope for dynamic scope override (only works with session tokens)\n          ...(hasValidScope && { scope }),\n        }),\n      });\n\n      if (!response.ok) {\n        const error = await response.json().catch(() => ({}));\n        return {\n          authorized: false,\n          reason: error.message || `API error: ${response.status}`,\n        };\n      }\n\n      const json = await response.json();\n      // API returns { success: true, data: { authorized, ... } }\n      const result: AuthorizationResult = json.data ?? json;\n      this.setCache(cacheKey, result);\n      return result;\n    } catch (error) {\n      return {\n        authorized: false,\n        reason: error instanceof Error ? error.message : 'Unknown error',\n      };\n    }\n  }\n\n  // ============================================================================\n  // Public API - Cache Management\n  // ============================================================================\n\n  /**\n   * Clear all cached data\n   */\n  clearCache(): void {\n    this.cache.clear();\n  }\n\n  /**\n   * Clear cached data for a specific scope\n   */\n  clearScopeCache(scope?: Scope): void {\n    const scopeKey = scope ? JSON.stringify(scope) : 'default';\n    for (const key of this.cache.keys()) {\n      if (key.includes(scopeKey)) {\n        this.cache.delete(key);\n      }\n    }\n  }\n\n  // ============================================================================\n  // Private - HTTP & Authentication\n  // ============================================================================\n\n  /**\n   * Make an authenticated fetch request with automatic token refresh on 401\n   */\n  private async fetchWithAuth(url: string, init?: RequestInit): Promise<Response> {\n    const response = await this.doFetch(url, init);\n\n    if (response.status !== 401) return response;\n\n    // Cookie-based refresh (HttpOnly refresh cookie). Body-based refresh is not supported.\n    // Module-level shared promise so all 401s (any client instance) coalesce into one refresh.\n    if (this.config.onRefreshWithCredentials) {\n      if (!sharedCredentialsRefreshPromise) {\n        sharedCredentialsRefreshPromise = this.config.onRefreshWithCredentials().finally(() => {\n          sharedCredentialsRefreshPromise = null;\n        });\n      }\n      const refreshed = await sharedCredentialsRefreshPromise;\n      if (refreshed) return this.doFetch(url, init);\n      this.config.onUnauthorized?.();\n    }\n\n    return response;\n  }\n\n  /**\n   * Perform the actual fetch request\n   */\n  private async doFetch(url: string, init?: RequestInit): Promise<Response> {\n    const fetchFn = this.config.fetch ?? globalThis.fetch;\n    const fullUrl = url.startsWith('http') ? url : `${this.config.apiUrl}${url}`;\n\n    const headers: Record<string, string> = {\n      'Content-Type': 'application/json',\n      ...(init?.headers as Record<string, string>),\n    };\n\n    // Add authorization header if token is available\n    const token = await this.getToken();\n    if (token) {\n      headers['Authorization'] = `Bearer ${token}`;\n    }\n\n    return fetchFn(fullUrl, {\n      ...init,\n      headers,\n      // Include cookies for same-origin requests (supports cookie-based auth)\n      credentials: this.config.credentials ?? 'include',\n    });\n  }\n\n  /**\n   * Get the current access token\n   */\n  private async getToken(): Promise<string | null> {\n    if (this.config.getAccessToken) {\n      const token = this.config.getAccessToken();\n      return token instanceof Promise ? token : token;\n    }\n    return null;\n  }\n\n  // ============================================================================\n  // Private - Cache & URL Helpers\n  // ============================================================================\n\n  private buildUrl(path: string, scope?: Scope): string {\n    const url = new URL(path, this.config.apiUrl);\n    if (scope) {\n      url.searchParams.set('scope', JSON.stringify(scope));\n    }\n    return url.toString();\n  }\n\n  private getCacheKey(...parts: (string | Scope | undefined)[]): string {\n    const prefix = this.config.cache?.prefix ?? 'grant';\n    return `${prefix}:${parts.map((p) => (p ? JSON.stringify(p) : 'default')).join(':')}`;\n  }\n\n  private getFromCache<T>(key: string): T | null {\n    const entry = this.cache.get(key);\n    if (!entry) return null;\n\n    if (Date.now() > entry.expires) {\n      this.cache.delete(key);\n      return null;\n    }\n\n    return entry.data as T;\n  }\n\n  private setCache(key: string, data: unknown): void {\n    this.cache.set(key, {\n      data,\n      expires: Date.now() + this.defaultTtl,\n    });\n  }\n}\n"],"names":[],"mappings":";;;;;AAYA,IAAI,kCAA2D;AASxD,MAAM,YAAY;AAAA,EAKvB,YAAY,QAA2B;AAJ/B;AACA,qDAA6D,IAAA;AAC7D;AAGN,SAAK,SAAS;AACd,SAAK,aAAa,OAAO,OAAO,OAAO,IAAI,KAAK;AAAA,EAClD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAiBA,MAAM,IAAI,UAAkB,QAAgB,SAAoD;AAC9F,UAAM,SAAS,MAAM,KAAK,aAAa,UAAU,QAAQ,OAAO;AAChE,WAAO,OAAO;AAAA,EAChB;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,cACJ,UACA,QACA,SACkB;AAClB,WAAO,KAAK,IAAI,UAAU,QAAQ,OAAO;AAAA,EAC3C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaA,MAAM,qBAAqB,SAAqD;AAC9E,UAAM,cAAc,KAAK,OAAO;AAChC,QAAI,CAAC,aAAa;AAChB,YAAM,IAAI,MAAM,+DAA+D;AAAA,IACjF;AACA,UAAM,SAAS,QAAQ,UAAU;AACjC,UAAM,cAAc,QAAQ;AAC5B,QAAI,CAAC,aAAa;AAChB,YAAM,IAAI,MAAM,kDAAkD;AAAA,IACpE;AAEA,UAAM,YAAY,IAAI,MAAM;AAC5B,UAAM,SAAS,IAAI,gBAAgB;AAAA,MACjC,WAAW,QAAQ;AAAA,MACnB,cAAc;AAAA,MACd,OAAO,QAAQ,SAAS;AAAA,IAAA,CACzB;AACD,QAAI,QAAQ,MAAO,QAAO,IAAI,SAAS,QAAQ,KAAK;AAEpD,UAAM,WAAW,GAAG,YAAY,QAAQ,OAAO,EAAE,CAAC,GAAG,SAAS,IAAI,OAAO,SAAA,CAAU;AACnF,QAAI,OAAO,WAAW,aAAa;AACjC,aAAO,SAAS,OAAO;AAAA,IACzB;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaA,MAAM,aACJ,UACA,QACA,SAC8B;AAC9B,UAAM,qBACJ,SAAS,SAAS,YAAY,OAAO,KAAK,UAAU,QAAQ,QAAQ,QAAQ,IAAI;AAClF,UAAM,WAAW,KAAK,YAAY,QAAQ,UAAU,QAAQ,SAAS,OAAO,kBAAkB;AAG9F,QAAI,SAAS,aAAa,OAAO;AAC/B,YAAM,SAAS,KAAK,aAAkC,QAAQ;AAC9D,UAAI,OAAQ,QAAO;AAAA,IACrB;AAEA,QAAI;AAGF,YAAM,QAAQ,SAAS;AACvB,YAAM,gBACJ,SAAS,OAAO,UAAU,YAAY,YAAY,SAAS,QAAQ;AAErE,YAAM,kBACJ,SAAS,SAAS,aACjB,iBAAiB,SAAS,QAAQ,SAAS,MAAM,MAAM,OAAO,EAAE,IAAI,MAAM,OAAO;AAEpF,YAAM,WAAW,MAAM,KAAK,cAAc,2BAA2B;AAAA,QACnE,QAAQ;AAAA,QACR,MAAM,KAAK,UAAU;AAAA,UACnB,YAAY;AAAA,YACV;AAAA,YACA;AAAA,UAAA;AAAA,UAEF,SAAS;AAAA,YACP,UAAU;AAAA,UAAA;AAAA;AAAA,UAGZ,GAAI,iBAAiB,EAAE,MAAA;AAAA,QAAM,CAC9B;AAAA,MAAA,CACF;AAED,UAAI,CAAC,SAAS,IAAI;AAChB,cAAM,QAAQ,MAAM,SAAS,KAAA,EAAO,MAAM,OAAO,CAAA,EAAG;AACpD,eAAO;AAAA,UACL,YAAY;AAAA,UACZ,QAAQ,MAAM,WAAW,cAAc,SAAS,MAAM;AAAA,QAAA;AAAA,MAE1D;AAEA,YAAM,OAAO,MAAM,SAAS,KAAA;AAE5B,YAAM,SAA8B,KAAK,QAAQ;AACjD,WAAK,SAAS,UAAU,MAAM;AAC9B,aAAO;AAAA,IACT,SAAS,OAAO;AACd,aAAO;AAAA,QACL,YAAY;AAAA,QACZ,QAAQ,iBAAiB,QAAQ,MAAM,UAAU;AAAA,MAAA;AAAA,IAErD;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,aAAmB;AACjB,SAAK,MAAM,MAAA;AAAA,EACb;AAAA;AAAA;AAAA;AAAA,EAKA,gBAAgB,OAAqB;AACnC,UAAM,WAAW,QAAQ,KAAK,UAAU,KAAK,IAAI;AACjD,eAAW,OAAO,KAAK,MAAM,KAAA,GAAQ;AACnC,UAAI,IAAI,SAAS,QAAQ,GAAG;AAC1B,aAAK,MAAM,OAAO,GAAG;AAAA,MACvB;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAc,cAAc,KAAa,MAAuC;AAC9E,UAAM,WAAW,MAAM,KAAK,QAAQ,KAAK,IAAI;AAE7C,QAAI,SAAS,WAAW,IAAK,QAAO;AAIpC,QAAI,KAAK,OAAO,0BAA0B;AACxC,UAAI,CAAC,iCAAiC;AACpC,0CAAkC,KAAK,OAAO,yBAAA,EAA2B,QAAQ,MAAM;AACrF,4CAAkC;AAAA,QACpC,CAAC;AAAA,MACH;AACA,YAAM,YAAY,MAAM;AACxB,UAAI,UAAW,QAAO,KAAK,QAAQ,KAAK,IAAI;AAC5C,WAAK,OAAO,iBAAA;AAAA,IACd;AAEA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAKA,MAAc,QAAQ,KAAa,MAAuC;AACxE,UAAM,UAAU,KAAK,OAAO,SAAS,WAAW;AAChD,UAAM,UAAU,IAAI,WAAW,MAAM,IAAI,MAAM,GAAG,KAAK,OAAO,MAAM,GAAG,GAAG;AAE1E,UAAM,UAAkC;AAAA,MACtC,gBAAgB;AAAA,MAChB,GAAI,MAAM;AAAA,IAAA;AAIZ,UAAM,QAAQ,MAAM,KAAK,SAAA;AACzB,QAAI,OAAO;AACT,cAAQ,eAAe,IAAI,UAAU,KAAK;AAAA,IAC5C;AAEA,WAAO,QAAQ,SAAS;AAAA,MACtB,GAAG;AAAA,MACH;AAAA;AAAA,MAEA,aAAa,KAAK,OAAO,eAAe;AAAA,IAAA,CACzC;AAAA,EACH;AAAA;AAAA;AAAA;AAAA,EAKA,MAAc,WAAmC;AAC/C,QAAI,KAAK,OAAO,gBAAgB;AAC9B,YAAM,QAAQ,KAAK,OAAO,eAAA;AAC1B,aAAO,iBAAiB,UAAU,QAAQ;AAAA,IAC5C;AACA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAMQ,SAAS,MAAc,OAAuB;AACpD,UAAM,MAAM,IAAI,IAAI,MAAM,KAAK,OAAO,MAAM;AAC5C,QAAI,OAAO;AACT,UAAI,aAAa,IAAI,SAAS,KAAK,UAAU,KAAK,CAAC;AAAA,IACrD;AACA,WAAO,IAAI,SAAA;AAAA,EACb;AAAA,EAEQ,eAAe,OAA+C;AACpE,UAAM,SAAS,KAAK,OAAO,OAAO,UAAU;AAC5C,WAAO,GAAG,MAAM,IAAI,MAAM,IAAI,CAAC,MAAO,IAAI,KAAK,UAAU,CAAC,IAAI,SAAU,EAAE,KAAK,GAAG,CAAC;AAAA,EACrF;AAAA,EAEQ,aAAgB,KAAuB;AAC7C,UAAM,QAAQ,KAAK,MAAM,IAAI,GAAG;AAChC,QAAI,CAAC,MAAO,QAAO;AAEnB,QAAI,KAAK,QAAQ,MAAM,SAAS;AAC9B,WAAK,MAAM,OAAO,GAAG;AACrB,aAAO;AAAA,IACT;AAEA,WAAO,MAAM;AAAA,EACf;AAAA,EAEQ,SAAS,KAAa,MAAqB;AACjD,SAAK,MAAM,IAAI,KAAK;AAAA,MAClB;AAAA,MACA,SAAS,KAAK,IAAA,IAAQ,KAAK;AAAA,IAAA,CAC5B;AAAA,EACH;AACF;;"}

package/dist/index.d.ts

@@ -0,0 +1,3 @@
+export { GrantClient } from './grant-client';
+export type { GrantClientConfig, AuthTokens, CacheOptions, AuthorizationResult, PermissionQueryOptions, Permission, Resource, ApiError, SignInWithProjectAppOptions, Scope, Tenant, } from './types';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAG7C,YAAY,EACV,iBAAiB,EACjB,UAAU,EACV,YAAY,EACZ,mBAAmB,EACnB,sBAAsB,EACtB,UAAU,EACV,QAAQ,EACR,QAAQ,EACR,2BAA2B,EAE3B,KAAK,EACL,MAAM,GACP,MAAM,SAAS,CAAC"}

package/dist/index.mjs

@@ -0,0 +1,228 @@
+var __defProp = Object.defineProperty;
+var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
+var __publicField = (obj, key, value) => __defNormalProp(obj, typeof key !== "symbol" ? key + "" : key, value);
+let sharedCredentialsRefreshPromise = null;
+class GrantClient {
+  constructor(config) {
+    __publicField(this, "config");
+    __publicField(this, "cache", /* @__PURE__ */ new Map());
+    __publicField(this, "defaultTtl");
+    this.config = config;
+    this.defaultTtl = config.cache?.ttl ?? 5 * 60 * 1e3;
+  }
+  // ============================================================================
+  // Public API - Permission Checks
+  // ============================================================================
+  /**
+   * Check if the current user has a specific permission
+   *
+   * @example
+   * ```ts
+   * const canEdit = await grant.can('document', 'update');
+   * if (canEdit) {
+   *   // Show edit button
+   * }
+   * ```
+   */
+  async can(resource, action, options) {
+    const result = await this.isAuthorized(resource, action, options);
+    return result.authorized;
+  }
+  /**
+   * Alias for `can` - check if user has permission
+   */
+  async hasPermission(resource, action, options) {
+    return this.can(resource, action, options);
+  }
+  // ============================================================================
+  // Public API - Project OAuth (sign-in with project app)
+  // ============================================================================
+  /**
+   * Start project-app OAuth flow (redirect only).
+   * Navigates the current window to the Grant OAuth entry page; after sign-in and consent,
+   * the user is redirected to the app's `redirect_uri` with token in the URL fragment.
+   *
+   * Requires `config.frontendUrl` and `redirectUri`.
+   */
+  async signInWithProjectApp(options) {
+    const frontendUrl = this.config.frontendUrl;
+    if (!frontendUrl) {
+      throw new Error("GrantClient: frontendUrl is required for signInWithProjectApp");
+    }
+    const locale = options.locale ?? "en";
+    const redirectUri = options.redirectUri;
+    if (!redirectUri) {
+      throw new Error("redirectUri is required for signInWithProjectApp");
+    }
+    const entryPath = `/${locale}/auth/project`;
+    const params = new URLSearchParams({
+      client_id: options.clientId,
+      redirect_uri: redirectUri,
+      state: options.state ?? ""
+    });
+    if (options.scope) params.set("scope", options.scope);
+    const entryUrl = `${frontendUrl.replace(/\/$/, "")}${entryPath}?${params.toString()}`;
+    if (typeof window !== "undefined") {
+      window.location.href = entryUrl;
+    }
+  }
+  /**
+   * Check authorization with full result details
+   *
+   * @example
+   * ```ts
+   * const result = await grant.isAuthorized('document', 'update');
+   * if (!result.authorized) {
+   *   console.log('Denied:', result.reason);
+   * }
+   * ```
+   */
+  async isAuthorized(resource, action, options) {
+    const contextResourceKey = options?.context?.resource != null ? JSON.stringify(options.context.resource) : void 0;
+    const cacheKey = this.getCacheKey("auth", resource, action, options?.scope, contextResourceKey);
+    if (options?.useCache !== false) {
+      const cached = this.getFromCache(cacheKey);
+      if (cached) return cached;
+    }
+    try {
+      const scope = options?.scope;
+      const hasValidScope = scope && typeof scope === "object" && "tenant" in scope && "id" in scope;
+      const contextResource = options?.context?.resource ?? (hasValidScope && scope && "id" in scope && scope.id != null ? { id: scope.id } : null);
+      const response = await this.fetchWithAuth("/api/auth/is-authorized", {
+        method: "POST",
+        body: JSON.stringify({
+          permission: {
+            resource,
+            action
+          },
+          context: {
+            resource: contextResource
+          },
+          // Pass scope for dynamic scope override (only works with session tokens)
+          ...hasValidScope && { scope }
+        })
+      });
+      if (!response.ok) {
+        const error = await response.json().catch(() => ({}));
+        return {
+          authorized: false,
+          reason: error.message || `API error: ${response.status}`
+        };
+      }
+      const json = await response.json();
+      const result = json.data ?? json;
+      this.setCache(cacheKey, result);
+      return result;
+    } catch (error) {
+      return {
+        authorized: false,
+        reason: error instanceof Error ? error.message : "Unknown error"
+      };
+    }
+  }
+  // ============================================================================
+  // Public API - Cache Management
+  // ============================================================================
+  /**
+   * Clear all cached data
+   */
+  clearCache() {
+    this.cache.clear();
+  }
+  /**
+   * Clear cached data for a specific scope
+   */
+  clearScopeCache(scope) {
+    const scopeKey = scope ? JSON.stringify(scope) : "default";
+    for (const key of this.cache.keys()) {
+      if (key.includes(scopeKey)) {
+        this.cache.delete(key);
+      }
+    }
+  }
+  // ============================================================================
+  // Private - HTTP & Authentication
+  // ============================================================================
+  /**
+   * Make an authenticated fetch request with automatic token refresh on 401
+   */
+  async fetchWithAuth(url, init) {
+    const response = await this.doFetch(url, init);
+    if (response.status !== 401) return response;
+    if (this.config.onRefreshWithCredentials) {
+      if (!sharedCredentialsRefreshPromise) {
+        sharedCredentialsRefreshPromise = this.config.onRefreshWithCredentials().finally(() => {
+          sharedCredentialsRefreshPromise = null;
+        });
+      }
+      const refreshed = await sharedCredentialsRefreshPromise;
+      if (refreshed) return this.doFetch(url, init);
+      this.config.onUnauthorized?.();
+    }
+    return response;
+  }
+  /**
+   * Perform the actual fetch request
+   */
+  async doFetch(url, init) {
+    const fetchFn = this.config.fetch ?? globalThis.fetch;
+    const fullUrl = url.startsWith("http") ? url : `${this.config.apiUrl}${url}`;
+    const headers = {
+      "Content-Type": "application/json",
+      ...init?.headers
+    };
+    const token = await this.getToken();
+    if (token) {
+      headers["Authorization"] = `Bearer ${token}`;
+    }
+    return fetchFn(fullUrl, {
+      ...init,
+      headers,
+      // Include cookies for same-origin requests (supports cookie-based auth)
+      credentials: this.config.credentials ?? "include"
+    });
+  }
+  /**
+   * Get the current access token
+   */
+  async getToken() {
+    if (this.config.getAccessToken) {
+      const token = this.config.getAccessToken();
+      return token instanceof Promise ? token : token;
+    }
+    return null;
+  }
+  // ============================================================================
+  // Private - Cache & URL Helpers
+  // ============================================================================
+  buildUrl(path, scope) {
+    const url = new URL(path, this.config.apiUrl);
+    if (scope) {
+      url.searchParams.set("scope", JSON.stringify(scope));
+    }
+    return url.toString();
+  }
+  getCacheKey(...parts) {
+    const prefix = this.config.cache?.prefix ?? "grant";
+    return `${prefix}:${parts.map((p) => p ? JSON.stringify(p) : "default").join(":")}`;
+  }
+  getFromCache(key) {
+    const entry = this.cache.get(key);
+    if (!entry) return null;
+    if (Date.now() > entry.expires) {
+      this.cache.delete(key);
+      return null;
+    }
+    return entry.data;
+  }
+  setCache(key, data) {
+    this.cache.set(key, {
+      data,
+      expires: Date.now() + this.defaultTtl
+    });
+  }
+}
+export {
+  GrantClient
+};
+//# sourceMappingURL=index.mjs.map

package/dist/index.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.mjs","sources":["../src/grant-client.ts"],"sourcesContent":["import type {\n  GrantClientConfig,\n  AuthorizationResult,\n  PermissionQueryOptions,\n  Scope,\n  SignInWithProjectAppOptions,\n} from './types';\n\n/**\n * Module-level shared promise for cookie-only refresh so that all 401s\n * (across all GrantClient instances and in-flight requests) coalesce into one refresh.\n */\nlet sharedCredentialsRefreshPromise: Promise<boolean> | null = null;\n\n/**\n * Grant Client for browser applications\n *\n * Makes HTTP requests to the Grant API to check permissions\n * and retrieve authorization data. Supports both token-based\n * and cookie-based authentication with automatic token refresh.\n */\nexport class GrantClient {\n  private config: Required<Pick<GrantClientConfig, 'apiUrl'>> & GrantClientConfig;\n  private cache: Map<string, { data: unknown; expires: number }> = new Map();\n  private defaultTtl: number;\n\n  constructor(config: GrantClientConfig) {\n    this.config = config;\n    this.defaultTtl = config.cache?.ttl ?? 5 * 60 * 1000; // 5 minutes default\n  }\n\n  // ============================================================================\n  // Public API - Permission Checks\n  // ============================================================================\n\n  /**\n   * Check if the current user has a specific permission\n   *\n   * @example\n   * ```ts\n   * const canEdit = await grant.can('document', 'update');\n   * if (canEdit) {\n   *   // Show edit button\n   * }\n   * ```\n   */\n  async can(resource: string, action: string, options?: PermissionQueryOptions): Promise<boolean> {\n    const result = await this.isAuthorized(resource, action, options);\n    return result.authorized;\n  }\n\n  /**\n   * Alias for `can` - check if user has permission\n   */\n  async hasPermission(\n    resource: string,\n    action: string,\n    options?: PermissionQueryOptions\n  ): Promise<boolean> {\n    return this.can(resource, action, options);\n  }\n\n  // ============================================================================\n  // Public API - Project OAuth (sign-in with project app)\n  // ============================================================================\n\n  /**\n   * Start project-app OAuth flow (redirect only).\n   * Navigates the current window to the Grant OAuth entry page; after sign-in and consent,\n   * the user is redirected to the app's `redirect_uri` with token in the URL fragment.\n   *\n   * Requires `config.frontendUrl` and `redirectUri`.\n   */\n  async signInWithProjectApp(options: SignInWithProjectAppOptions): Promise<void> {\n    const frontendUrl = this.config.frontendUrl;\n    if (!frontendUrl) {\n      throw new Error('GrantClient: frontendUrl is required for signInWithProjectApp');\n    }\n    const locale = options.locale ?? 'en';\n    const redirectUri = options.redirectUri;\n    if (!redirectUri) {\n      throw new Error('redirectUri is required for signInWithProjectApp');\n    }\n\n    const entryPath = `/${locale}/auth/project`;\n    const params = new URLSearchParams({\n      client_id: options.clientId,\n      redirect_uri: redirectUri,\n      state: options.state ?? '',\n    });\n    if (options.scope) params.set('scope', options.scope);\n\n    const entryUrl = `${frontendUrl.replace(/\\/$/, '')}${entryPath}?${params.toString()}`;\n    if (typeof window !== 'undefined') {\n      window.location.href = entryUrl;\n    }\n  }\n\n  /**\n   * Check authorization with full result details\n   *\n   * @example\n   * ```ts\n   * const result = await grant.isAuthorized('document', 'update');\n   * if (!result.authorized) {\n   *   console.log('Denied:', result.reason);\n   * }\n   * ```\n   */\n  async isAuthorized(\n    resource: string,\n    action: string,\n    options?: PermissionQueryOptions\n  ): Promise<AuthorizationResult> {\n    const contextResourceKey =\n      options?.context?.resource != null ? JSON.stringify(options.context.resource) : undefined;\n    const cacheKey = this.getCacheKey('auth', resource, action, options?.scope, contextResourceKey);\n\n    // Check cache first (unless explicitly disabled)\n    if (options?.useCache !== false) {\n      const cached = this.getFromCache<AuthorizationResult>(cacheKey);\n      if (cached) return cached;\n    }\n\n    try {\n      // API expects: { permission: { resource, action }, context: { resource?: any }, scope?: { tenant, id } }\n      // scope is optional - for session tokens it enables dynamic scope switching\n      const scope = options?.scope;\n      const hasValidScope =\n        scope && typeof scope === 'object' && 'tenant' in scope && 'id' in scope;\n      // When scope is provided and context.resource is not, derive context.resource from scope.id\n      const contextResource =\n        options?.context?.resource ??\n        (hasValidScope && scope && 'id' in scope && scope.id != null ? { id: scope.id } : null);\n\n      const response = await this.fetchWithAuth('/api/auth/is-authorized', {\n        method: 'POST',\n        body: JSON.stringify({\n          permission: {\n            resource,\n            action,\n          },\n          context: {\n            resource: contextResource,\n          },\n          // Pass scope for dynamic scope override (only works with session tokens)\n          ...(hasValidScope && { scope }),\n        }),\n      });\n\n      if (!response.ok) {\n        const error = await response.json().catch(() => ({}));\n        return {\n          authorized: false,\n          reason: error.message || `API error: ${response.status}`,\n        };\n      }\n\n      const json = await response.json();\n      // API returns { success: true, data: { authorized, ... } }\n      const result: AuthorizationResult = json.data ?? json;\n      this.setCache(cacheKey, result);\n      return result;\n    } catch (error) {\n      return {\n        authorized: false,\n        reason: error instanceof Error ? error.message : 'Unknown error',\n      };\n    }\n  }\n\n  // ============================================================================\n  // Public API - Cache Management\n  // ============================================================================\n\n  /**\n   * Clear all cached data\n   */\n  clearCache(): void {\n    this.cache.clear();\n  }\n\n  /**\n   * Clear cached data for a specific scope\n   */\n  clearScopeCache(scope?: Scope): void {\n    const scopeKey = scope ? JSON.stringify(scope) : 'default';\n    for (const key of this.cache.keys()) {\n      if (key.includes(scopeKey)) {\n        this.cache.delete(key);\n      }\n    }\n  }\n\n  // ============================================================================\n  // Private - HTTP & Authentication\n  // ============================================================================\n\n  /**\n   * Make an authenticated fetch request with automatic token refresh on 401\n   */\n  private async fetchWithAuth(url: string, init?: RequestInit): Promise<Response> {\n    const response = await this.doFetch(url, init);\n\n    if (response.status !== 401) return response;\n\n    // Cookie-based refresh (HttpOnly refresh cookie). Body-based refresh is not supported.\n    // Module-level shared promise so all 401s (any client instance) coalesce into one refresh.\n    if (this.config.onRefreshWithCredentials) {\n      if (!sharedCredentialsRefreshPromise) {\n        sharedCredentialsRefreshPromise = this.config.onRefreshWithCredentials().finally(() => {\n          sharedCredentialsRefreshPromise = null;\n        });\n      }\n      const refreshed = await sharedCredentialsRefreshPromise;\n      if (refreshed) return this.doFetch(url, init);\n      this.config.onUnauthorized?.();\n    }\n\n    return response;\n  }\n\n  /**\n   * Perform the actual fetch request\n   */\n  private async doFetch(url: string, init?: RequestInit): Promise<Response> {\n    const fetchFn = this.config.fetch ?? globalThis.fetch;\n    const fullUrl = url.startsWith('http') ? url : `${this.config.apiUrl}${url}`;\n\n    const headers: Record<string, string> = {\n      'Content-Type': 'application/json',\n      ...(init?.headers as Record<string, string>),\n    };\n\n    // Add authorization header if token is available\n    const token = await this.getToken();\n    if (token) {\n      headers['Authorization'] = `Bearer ${token}`;\n    }\n\n    return fetchFn(fullUrl, {\n      ...init,\n      headers,\n      // Include cookies for same-origin requests (supports cookie-based auth)\n      credentials: this.config.credentials ?? 'include',\n    });\n  }\n\n  /**\n   * Get the current access token\n   */\n  private async getToken(): Promise<string | null> {\n    if (this.config.getAccessToken) {\n      const token = this.config.getAccessToken();\n      return token instanceof Promise ? token : token;\n    }\n    return null;\n  }\n\n  // ============================================================================\n  // Private - Cache & URL Helpers\n  // ============================================================================\n\n  private buildUrl(path: string, scope?: Scope): string {\n    const url = new URL(path, this.config.apiUrl);\n    if (scope) {\n      url.searchParams.set('scope', JSON.stringify(scope));\n    }\n    return url.toString();\n  }\n\n  private getCacheKey(...parts: (string | Scope | undefined)[]): string {\n    const prefix = this.config.cache?.prefix ?? 'grant';\n    return `${prefix}:${parts.map((p) => (p ? JSON.stringify(p) : 'default')).join(':')}`;\n  }\n\n  private getFromCache<T>(key: string): T | null {\n    const entry = this.cache.get(key);\n    if (!entry) return null;\n\n    if (Date.now() > entry.expires) {\n      this.cache.delete(key);\n      return null;\n    }\n\n    return entry.data as T;\n  }\n\n  private setCache(key: string, data: unknown): void {\n    this.cache.set(key, {\n      data,\n      expires: Date.now() + this.defaultTtl,\n    });\n  }\n}\n"],"names":[],"mappings":";;;AAYA,IAAI,kCAA2D;AASxD,MAAM,YAAY;AAAA,EAKvB,YAAY,QAA2B;AAJ/B;AACA,qDAA6D,IAAA;AAC7D;AAGN,SAAK,SAAS;AACd,SAAK,aAAa,OAAO,OAAO,OAAO,IAAI,KAAK;AAAA,EAClD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAiBA,MAAM,IAAI,UAAkB,QAAgB,SAAoD;AAC9F,UAAM,SAAS,MAAM,KAAK,aAAa,UAAU,QAAQ,OAAO;AAChE,WAAO,OAAO;AAAA,EAChB;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,cACJ,UACA,QACA,SACkB;AAClB,WAAO,KAAK,IAAI,UAAU,QAAQ,OAAO;AAAA,EAC3C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaA,MAAM,qBAAqB,SAAqD;AAC9E,UAAM,cAAc,KAAK,OAAO;AAChC,QAAI,CAAC,aAAa;AAChB,YAAM,IAAI,MAAM,+DAA+D;AAAA,IACjF;AACA,UAAM,SAAS,QAAQ,UAAU;AACjC,UAAM,cAAc,QAAQ;AAC5B,QAAI,CAAC,aAAa;AAChB,YAAM,IAAI,MAAM,kDAAkD;AAAA,IACpE;AAEA,UAAM,YAAY,IAAI,MAAM;AAC5B,UAAM,SAAS,IAAI,gBAAgB;AAAA,MACjC,WAAW,QAAQ;AAAA,MACnB,cAAc;AAAA,MACd,OAAO,QAAQ,SAAS;AAAA,IAAA,CACzB;AACD,QAAI,QAAQ,MAAO,QAAO,IAAI,SAAS,QAAQ,KAAK;AAEpD,UAAM,WAAW,GAAG,YAAY,QAAQ,OAAO,EAAE,CAAC,GAAG,SAAS,IAAI,OAAO,SAAA,CAAU;AACnF,QAAI,OAAO,WAAW,aAAa;AACjC,aAAO,SAAS,OAAO;AAAA,IACzB;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaA,MAAM,aACJ,UACA,QACA,SAC8B;AAC9B,UAAM,qBACJ,SAAS,SAAS,YAAY,OAAO,KAAK,UAAU,QAAQ,QAAQ,QAAQ,IAAI;AAClF,UAAM,WAAW,KAAK,YAAY,QAAQ,UAAU,QAAQ,SAAS,OAAO,kBAAkB;AAG9F,QAAI,SAAS,aAAa,OAAO;AAC/B,YAAM,SAAS,KAAK,aAAkC,QAAQ;AAC9D,UAAI,OAAQ,QAAO;AAAA,IACrB;AAEA,QAAI;AAGF,YAAM,QAAQ,SAAS;AACvB,YAAM,gBACJ,SAAS,OAAO,UAAU,YAAY,YAAY,SAAS,QAAQ;AAErE,YAAM,kBACJ,SAAS,SAAS,aACjB,iBAAiB,SAAS,QAAQ,SAAS,MAAM,MAAM,OAAO,EAAE,IAAI,MAAM,OAAO;AAEpF,YAAM,WAAW,MAAM,KAAK,cAAc,2BAA2B;AAAA,QACnE,QAAQ;AAAA,QACR,MAAM,KAAK,UAAU;AAAA,UACnB,YAAY;AAAA,YACV;AAAA,YACA;AAAA,UAAA;AAAA,UAEF,SAAS;AAAA,YACP,UAAU;AAAA,UAAA;AAAA;AAAA,UAGZ,GAAI,iBAAiB,EAAE,MAAA;AAAA,QAAM,CAC9B;AAAA,MAAA,CACF;AAED,UAAI,CAAC,SAAS,IAAI;AAChB,cAAM,QAAQ,MAAM,SAAS,KAAA,EAAO,MAAM,OAAO,CAAA,EAAG;AACpD,eAAO;AAAA,UACL,YAAY;AAAA,UACZ,QAAQ,MAAM,WAAW,cAAc,SAAS,MAAM;AAAA,QAAA;AAAA,MAE1D;AAEA,YAAM,OAAO,MAAM,SAAS,KAAA;AAE5B,YAAM,SAA8B,KAAK,QAAQ;AACjD,WAAK,SAAS,UAAU,MAAM;AAC9B,aAAO;AAAA,IACT,SAAS,OAAO;AACd,aAAO;AAAA,QACL,YAAY;AAAA,QACZ,QAAQ,iBAAiB,QAAQ,MAAM,UAAU;AAAA,MAAA;AAAA,IAErD;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,aAAmB;AACjB,SAAK,MAAM,MAAA;AAAA,EACb;AAAA;AAAA;AAAA;AAAA,EAKA,gBAAgB,OAAqB;AACnC,UAAM,WAAW,QAAQ,KAAK,UAAU,KAAK,IAAI;AACjD,eAAW,OAAO,KAAK,MAAM,KAAA,GAAQ;AACnC,UAAI,IAAI,SAAS,QAAQ,GAAG;AAC1B,aAAK,MAAM,OAAO,GAAG;AAAA,MACvB;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAc,cAAc,KAAa,MAAuC;AAC9E,UAAM,WAAW,MAAM,KAAK,QAAQ,KAAK,IAAI;AAE7C,QAAI,SAAS,WAAW,IAAK,QAAO;AAIpC,QAAI,KAAK,OAAO,0BAA0B;AACxC,UAAI,CAAC,iCAAiC;AACpC,0CAAkC,KAAK,OAAO,yBAAA,EAA2B,QAAQ,MAAM;AACrF,4CAAkC;AAAA,QACpC,CAAC;AAAA,MACH;AACA,YAAM,YAAY,MAAM;AACxB,UAAI,UAAW,QAAO,KAAK,QAAQ,KAAK,IAAI;AAC5C,WAAK,OAAO,iBAAA;AAAA,IACd;AAEA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAKA,MAAc,QAAQ,KAAa,MAAuC;AACxE,UAAM,UAAU,KAAK,OAAO,SAAS,WAAW;AAChD,UAAM,UAAU,IAAI,WAAW,MAAM,IAAI,MAAM,GAAG,KAAK,OAAO,MAAM,GAAG,GAAG;AAE1E,UAAM,UAAkC;AAAA,MACtC,gBAAgB;AAAA,MAChB,GAAI,MAAM;AAAA,IAAA;AAIZ,UAAM,QAAQ,MAAM,KAAK,SAAA;AACzB,QAAI,OAAO;AACT,cAAQ,eAAe,IAAI,UAAU,KAAK;AAAA,IAC5C;AAEA,WAAO,QAAQ,SAAS;AAAA,MACtB,GAAG;AAAA,MACH;AAAA;AAAA,MAEA,aAAa,KAAK,OAAO,eAAe;AAAA,IAAA,CACzC;AAAA,EACH;AAAA;AAAA;AAAA;AAAA,EAKA,MAAc,WAAmC;AAC/C,QAAI,KAAK,OAAO,gBAAgB;AAC9B,YAAM,QAAQ,KAAK,OAAO,eAAA;AAC1B,aAAO,iBAAiB,UAAU,QAAQ;AAAA,IAC5C;AACA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAMQ,SAAS,MAAc,OAAuB;AACpD,UAAM,MAAM,IAAI,IAAI,MAAM,KAAK,OAAO,MAAM;AAC5C,QAAI,OAAO;AACT,UAAI,aAAa,IAAI,SAAS,KAAK,UAAU,KAAK,CAAC;AAAA,IACrD;AACA,WAAO,IAAI,SAAA;AAAA,EACb;AAAA,EAEQ,eAAe,OAA+C;AACpE,UAAM,SAAS,KAAK,OAAO,OAAO,UAAU;AAC5C,WAAO,GAAG,MAAM,IAAI,MAAM,IAAI,CAAC,MAAO,IAAI,KAAK,UAAU,CAAC,IAAI,SAAU,EAAE,KAAK,GAAG,CAAC;AAAA,EACrF;AAAA,EAEQ,aAAgB,KAAuB;AAC7C,UAAM,QAAQ,KAAK,MAAM,IAAI,GAAG;AAChC,QAAI,CAAC,MAAO,QAAO;AAEnB,QAAI,KAAK,QAAQ,MAAM,SAAS;AAC9B,WAAK,MAAM,OAAO,GAAG;AACrB,aAAO;AAAA,IACT;AAEA,WAAO,MAAM;AAAA,EACf;AAAA,EAEQ,SAAS,KAAa,MAAqB;AACjD,SAAK,MAAM,IAAI,KAAK;AAAA,MAClB;AAAA,MACA,SAAS,KAAK,IAAA,IAAQ,KAAK;AAAA,IAAA,CAC5B;AAAA,EACH;AACF;"}

package/dist/react/components/GrantGate.d.ts

@@ -0,0 +1,58 @@
+import { ReactNode } from 'react';
+import { UseGrantOptions } from '../hooks/useGrant';
+/**
+ * Props for the GrantGate component
+ */
+export interface GrantGateProps extends UseGrantOptions {
+    /** The resource slug to check permission for */
+    resource: string;
+    /** The action to check */
+    action: string;
+    /** Content to render if permission is granted */
+    children: ReactNode;
+    /** Content to render if permission is denied (optional) */
+    fallback?: ReactNode;
+    /** Content to render while loading (optional) */
+    loading?: ReactNode;
+}
+/**
+ * Component that conditionally renders children based on permissions
+ *
+ * @example
+ * ```tsx
+ * // Basic usage - hide element if no permission
+ * <GrantGate resource="document" action="update">
+ *   <EditButton />
+ * </GrantGate>
+ *
+ * // With fallback for denied access
+ * <GrantGate
+ *   resource="admin"
+ *   action="access"
+ *   fallback={<p>You don't have admin access</p>}
+ * >
+ *   <AdminPanel />
+ * </GrantGate>
+ *
+ * // With loading state
+ * <GrantGate
+ *   resource="report"
+ *   action="view"
+ *   loading={<Spinner />}
+ *   fallback={<AccessDenied />}
+ * >
+ *   <ReportViewer />
+ * </GrantGate>
+ *
+ * // With scope for multi-tenant
+ * <GrantGate
+ *   resource="project"
+ *   action="delete"
+ *   scope={{ tenant: 'project', id: projectId }}
+ * >
+ *   <DeleteProjectButton />
+ * </GrantGate>
+ * ```
+ */
+export declare function GrantGate({ resource, action, scope, enabled, useCache, children, fallback, loading, }: GrantGateProps): ReactNode;
+//# sourceMappingURL=GrantGate.d.ts.map

package/dist/react/components/GrantGate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"GrantGate.d.ts","sourceRoot":"","sources":["../../../src/react/components/GrantGate.tsx"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,OAAO,CAAC;AAEvC,OAAO,EAAY,KAAK,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAEnE;;GAEG;AACH,MAAM,WAAW,cAAe,SAAQ,eAAe;IACrD,gDAAgD;IAChD,QAAQ,EAAE,MAAM,CAAC;IACjB,0BAA0B;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,iDAAiD;IACjD,QAAQ,EAAE,SAAS,CAAC;IACpB,2DAA2D;IAC3D,QAAQ,CAAC,EAAE,SAAS,CAAC;IACrB,iDAAiD;IACjD,OAAO,CAAC,EAAE,SAAS,CAAC;CACrB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,wBAAgB,SAAS,CAAC,EACxB,QAAQ,EACR,MAAM,EACN,KAAK,EACL,OAAO,EACP,QAAQ,EACR,QAAQ,EACR,QAAe,EACf,OAAc,GACf,EAAE,cAAc,GAAG,SAAS,CA+B5B"}

package/dist/react/context.d.ts

@@ -0,0 +1,73 @@
+import { ReactNode } from 'react';
+import { GrantClient } from '../grant-client';
+import { GrantClientConfig } from '../types';
+/**
+ * Props for the GrantProvider component
+ */
+export interface GrantProviderProps {
+    /**
+     * Grant client configuration
+     */
+    config: GrantClientConfig;
+    /**
+     * Pre-configured GrantClient instance (alternative to config)
+     * If provided, config is ignored
+     */
+    client?: GrantClient;
+    /**
+     * Child components
+     */
+    children: ReactNode;
+}
+/**
+ * Provider component that makes the Grant client available to child components
+ *
+ * @example
+ * ```tsx
+ * // Option 1: Pass config (cookie-based refresh)
+ * <GrantProvider
+ *   config={{
+ *     apiUrl: 'https://api.grant.com',
+ *     getAccessToken: () => localStorage.getItem('accessToken'),
+ *     onRefreshWithCredentials: async () => {
+ *       const res = await fetch('https://api.grant.com/api/auth/refresh', { method: 'POST', credentials: 'include' });
+ *       if (!res.ok) return false;
+ *       const { data } = await res.json();
+ *       if (data?.accessToken) { localStorage.setItem('accessToken', data.accessToken); return true; }
+ *       return false;
+ *     },
+ *     onTokenRefresh: (tokens) => { localStorage.setItem('accessToken', tokens.accessToken); },
+ *     onUnauthorized: () => { window.location.href = '/login'; },
+ *   }}
+ * >
+ *   <App />
+ * </GrantProvider>
+ *
+ * // Option 2: Pass pre-configured client
+ * const grant = new GrantClient({ ... });
+ * <GrantProvider client={grant}>
+ *   <App />
+ * </GrantProvider>
+ * ```
+ */
+export declare function GrantProvider({ config, client, children }: GrantProviderProps): import("react/jsx-runtime").JSX.Element;
+/**
+ * Hook to access the Grant client from context
+ *
+ * @throws Error if used outside of GrantProvider
+ *
+ * @example
+ * ```tsx
+ * const grant = useGrantClient();
+ * const hasPermission = await grant.can('resource', 'action');
+ * ```
+ */
+export declare function useGrantClient(): GrantClient;
+/**
+ * Hook to optionally access the Grant client
+ * Returns null if not in a GrantProvider context
+ *
+ * Use this when you want to gracefully handle missing provider
+ */
+export declare function useGrantClientOptional(): GrantClient | null;
+//# sourceMappingURL=context.d.ts.map

package/dist/react/context.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"context.d.ts","sourceRoot":"","sources":["../../src/react/context.tsx"],"names":[],"mappings":"AAEA,OAAO,EAAsC,KAAK,SAAS,EAAE,MAAM,OAAO,CAAC;AAE3E,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAE9C,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAC;AAOlD;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC;;OAEG;IACH,MAAM,EAAE,iBAAiB,CAAC;IAE1B;;;OAGG;IACH,MAAM,CAAC,EAAE,WAAW,CAAC;IAErB;;OAEG;IACH,QAAQ,EAAE,SAAS,CAAC;CACrB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,wBAAgB,aAAa,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,kBAAkB,2CAO7E;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,cAAc,IAAI,WAAW,CAW5C;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,IAAI,WAAW,GAAG,IAAI,CAE3D"}