@grantjs/client 1.0.0

package/dist/react/hooks/useGrant.d.ts

@@ -0,0 +1,61 @@
+import { Scope } from '../../types';
+/**
+ * Options for the useGrant hook
+ */
+export interface UseGrantOptions {
+    /** Scope to check the permission in. If provided but null/undefined, hook waits for it to become valid. */
+    scope?: Scope | null;
+    /** Whether to skip the permission check */
+    enabled?: boolean;
+    /** Whether to use cached results (default: true) */
+    useCache?: boolean;
+    /** Whether to return loading state (default: false) */
+    returnLoading?: boolean;
+    /** Context to check permissions for */
+    context?: {
+        resource?: Record<string, unknown> | null;
+    };
+}
+/**
+ * Result when returnLoading is true
+ */
+export interface UseGrantResult {
+    /** Whether the user is granted permission */
+    isGranted: boolean;
+    /** Whether the permission check is loading */
+    isLoading: boolean;
+}
+/**
+ * Hook to check if a user is granted permission for a specific resource and action
+ *
+ * By default, returns a simple boolean, defaulting to false while loading.
+ * Set `returnLoading: true` to get an object with `isGranted` and `isLoading`.
+ *
+ * @param resource - The resource slug to check
+ * @param action - The action to check
+ * @param options - Additional options
+ *
+ * @example
+ * ```tsx
+ * // Simple boolean (default)
+ * const canEdit = useGrant('document', 'update');
+ *
+ * return (
+ *   <div>
+ *     {canEdit && <EditButton />}
+ *   </div>
+ * );
+ *
+ * // With loading state
+ * const { isGranted, isLoading } = useGrant('document', 'update', {
+ *   returnLoading: true,
+ * });
+ *
+ * if (isLoading) return <Spinner />;
+ * if (!isGranted) return null;
+ *
+ * return <EditButton />;
+ * ```
+ */
+export declare function useGrant(resource: string, action: string, options?: UseGrantOptions): boolean | UseGrantResult;
+//# sourceMappingURL=useGrant.d.ts.map

package/dist/react/hooks/useGrant.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"useGrant.d.ts","sourceRoot":"","sources":["../../../src/react/hooks/useGrant.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAuB,KAAK,EAAE,MAAM,aAAa,CAAC;AAE9D;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,2GAA2G;IAC3G,KAAK,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC;IACrB,2CAA2C;IAC3C,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,oDAAoD;IACpD,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,uDAAuD;IACvD,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,uCAAuC;IACvC,OAAO,CAAC,EAAE;QACR,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;KAC3C,CAAC;CACH;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,6CAA6C;IAC7C,SAAS,EAAE,OAAO,CAAC;IACnB,8CAA8C;IAC9C,SAAS,EAAE,OAAO,CAAC;CACpB;AAWD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,wBAAgB,QAAQ,CACtB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,EACd,OAAO,GAAE,eAAoB,GAC5B,OAAO,GAAG,cAAc,CAqH1B"}

package/dist/react/index.d.ts

@@ -0,0 +1,9 @@
+export { GrantProvider, useGrantClient, useGrantClientOptional } from './context';
+export type { GrantProviderProps } from './context';
+export { useGrant } from './hooks/useGrant';
+export type { UseGrantOptions, UseGrantResult } from './hooks/useGrant';
+export { GrantGate } from './components/GrantGate';
+export type { GrantGateProps } from './components/GrantGate';
+export type { GrantClientConfig, AuthTokens, AuthorizationResult, Permission, Scope, } from '../types';
+export { GrantClient } from '../grant-client';
+//# sourceMappingURL=index.d.ts.map

package/dist/react/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/react/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,sBAAsB,EAAE,MAAM,WAAW,CAAC;AAClF,YAAY,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AAGpD,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,YAAY,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAGxE,OAAO,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AACnD,YAAY,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAG7D,YAAY,EACV,iBAAiB,EACjB,UAAU,EACV,mBAAmB,EACnB,UAAU,EACV,KAAK,GACN,MAAM,UAAU,CAAC;AAGlB,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC"}

package/dist/react.cjs

@@ -0,0 +1,139 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const jsxRuntime = require("react/jsx-runtime");
+const react = require("react");
+const index = require("./index.cjs");
+const GrantContext = react.createContext(null);
+function GrantProvider({ config, client, children }) {
+  const grantClient = react.useMemo(() => {
+    if (client) return client;
+    return new index.GrantClient(config);
+  }, [client, config]);
+  return /* @__PURE__ */ jsxRuntime.jsx(GrantContext.Provider, { value: grantClient, children });
+}
+function useGrantClient() {
+  const client = react.useContext(GrantContext);
+  if (!client) {
+    throw new Error(
+      "useGrantClient must be used within a GrantProvider. Wrap your app with <GrantProvider config={...}> to fix this error."
+    );
+  }
+  return client;
+}
+function useGrantClientOptional() {
+  return react.useContext(GrantContext);
+}
+function serializeScope(scope) {
+  if (!scope) return "";
+  return `${scope.tenant}:${scope.id}`;
+}
+function useGrant(resource, action, options = {}) {
+  const { scope, enabled = true, useCache = true, returnLoading = false, context } = options;
+  const client = useGrantClient();
+  const scopeWasProvidedRef = react.useRef("scope" in options);
+  const isEffectivelyEnabled = react.useMemo(() => {
+    const hasValidScope = scope && typeof scope === "object" && "tenant" in scope && "id" in scope && scope.id;
+    const shouldWaitForScope = scopeWasProvidedRef.current && !hasValidScope;
+    return enabled && !shouldWaitForScope;
+  }, [scope, enabled]);
+  const [data, setData] = react.useState(null);
+  const [isLoading, setIsLoading] = react.useState(isEffectivelyEnabled);
+  const [prevEffectivelyEnabled, setPrevEffectivelyEnabled] = react.useState(isEffectivelyEnabled);
+  if (isEffectivelyEnabled !== prevEffectivelyEnabled) {
+    setPrevEffectivelyEnabled(isEffectivelyEnabled);
+    if (isEffectivelyEnabled) {
+      setIsLoading(true);
+    } else {
+      setIsLoading(false);
+      setData(null);
+    }
+  }
+  const isMounted = react.useRef(true);
+  const scopeRef = react.useRef(scope);
+  scopeRef.current = scope;
+  const contextRef = react.useRef(context);
+  contextRef.current = context;
+  const scopeKey = serializeScope(scope);
+  const contextKey = react.useMemo(
+    () => context?.resource != null ? JSON.stringify(context.resource) : "",
+    [context?.resource]
+  );
+  const fetchPermission = react.useCallback(async () => {
+    if (!isEffectivelyEnabled) {
+      setIsLoading(false);
+      return;
+    }
+    setIsLoading(true);
+    try {
+      const result = await client.isAuthorized(resource, action, {
+        scope: scopeRef.current ?? void 0,
+        useCache,
+        context: contextRef.current
+      });
+      if (isMounted.current) {
+        setData(result);
+      }
+    } catch {
+      if (isMounted.current) {
+        setData(null);
+      }
+    } finally {
+      if (isMounted.current) {
+        setIsLoading(false);
+      }
+    }
+  }, [client, resource, action, scopeKey, isEffectivelyEnabled, useCache, contextKey]);
+  react.useEffect(() => {
+    isMounted.current = true;
+    if (!isEffectivelyEnabled && scopeWasProvidedRef.current) {
+      setData(null);
+      setIsLoading(false);
+    } else {
+      fetchPermission();
+    }
+    return () => {
+      isMounted.current = false;
+    };
+  }, [fetchPermission, isEffectivelyEnabled]);
+  const isGranted = data?.authorized ?? false;
+  if (returnLoading) {
+    return { isGranted, isLoading };
+  }
+  return isGranted;
+}
+function GrantGate({
+  resource,
+  action,
+  scope,
+  enabled,
+  useCache,
+  children,
+  fallback = null,
+  loading = null
+}) {
+  const options = {
+    enabled,
+    useCache,
+    returnLoading: loading !== null
+  };
+  if (scope !== void 0) {
+    options.scope = scope;
+  }
+  const result = useGrant(resource, action, options);
+  const isGranted = typeof result === "boolean" ? result : result.isGranted;
+  const isLoading = typeof result === "boolean" ? false : result.isLoading;
+  if (isLoading && loading !== null) {
+    return loading;
+  }
+  if (isGranted) {
+    return children;
+  }
+  return fallback;
+}
+exports.GrantClient = index.GrantClient;
+exports.GrantGate = GrantGate;
+exports.GrantProvider = GrantProvider;
+exports.useGrant = useGrant;
+exports.useGrantClient = useGrantClient;
+exports.useGrantClientOptional = useGrantClientOptional;
+//# sourceMappingURL=react.cjs.map

package/dist/react.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"react.cjs","sources":["../src/react/context.tsx","../src/react/hooks/useGrant.ts","../src/react/components/GrantGate.tsx"],"sourcesContent":["'use client';\n\nimport { createContext, useContext, useMemo, type ReactNode } from 'react';\n\nimport { GrantClient } from '../grant-client';\n\nimport type { GrantClientConfig } from '../types';\n\n/**\n * Context for the Grant client\n */\nconst GrantContext = createContext<GrantClient | null>(null);\n\n/**\n * Props for the GrantProvider component\n */\nexport interface GrantProviderProps {\n  /**\n   * Grant client configuration\n   */\n  config: GrantClientConfig;\n\n  /**\n   * Pre-configured GrantClient instance (alternative to config)\n   * If provided, config is ignored\n   */\n  client?: GrantClient;\n\n  /**\n   * Child components\n   */\n  children: ReactNode;\n}\n\n/**\n * Provider component that makes the Grant client available to child components\n *\n * @example\n * ```tsx\n * // Option 1: Pass config (cookie-based refresh)\n * <GrantProvider\n *   config={{\n *     apiUrl: 'https://api.grant.com',\n *     getAccessToken: () => localStorage.getItem('accessToken'),\n *     onRefreshWithCredentials: async () => {\n *       const res = await fetch('https://api.grant.com/api/auth/refresh', { method: 'POST', credentials: 'include' });\n *       if (!res.ok) return false;\n *       const { data } = await res.json();\n *       if (data?.accessToken) { localStorage.setItem('accessToken', data.accessToken); return true; }\n *       return false;\n *     },\n *     onTokenRefresh: (tokens) => { localStorage.setItem('accessToken', tokens.accessToken); },\n *     onUnauthorized: () => { window.location.href = '/login'; },\n *   }}\n * >\n *   <App />\n * </GrantProvider>\n *\n * // Option 2: Pass pre-configured client\n * const grant = new GrantClient({ ... });\n * <GrantProvider client={grant}>\n *   <App />\n * </GrantProvider>\n * ```\n */\nexport function GrantProvider({ config, client, children }: GrantProviderProps) {\n  const grantClient = useMemo(() => {\n    if (client) return client;\n    return new GrantClient(config);\n  }, [client, config]);\n\n  return <GrantContext.Provider value={grantClient}>{children}</GrantContext.Provider>;\n}\n\n/**\n * Hook to access the Grant client from context\n *\n * @throws Error if used outside of GrantProvider\n *\n * @example\n * ```tsx\n * const grant = useGrantClient();\n * const hasPermission = await grant.can('resource', 'action');\n * ```\n */\nexport function useGrantClient(): GrantClient {\n  const client = useContext(GrantContext);\n\n  if (!client) {\n    throw new Error(\n      'useGrantClient must be used within a GrantProvider. ' +\n        'Wrap your app with <GrantProvider config={...}> to fix this error.'\n    );\n  }\n\n  return client;\n}\n\n/**\n * Hook to optionally access the Grant client\n * Returns null if not in a GrantProvider context\n *\n * Use this when you want to gracefully handle missing provider\n */\nexport function useGrantClientOptional(): GrantClient | null {\n  return useContext(GrantContext);\n}\n","'use client';\n\nimport { useState, useEffect, useCallback, useRef, useMemo } from 'react';\n\nimport { useGrantClient } from '../context';\n\nimport type { AuthorizationResult, Scope } from '../../types';\n\n/**\n * Options for the useGrant hook\n */\nexport interface UseGrantOptions {\n  /** Scope to check the permission in. If provided but null/undefined, hook waits for it to become valid. */\n  scope?: Scope | null;\n  /** Whether to skip the permission check */\n  enabled?: boolean;\n  /** Whether to use cached results (default: true) */\n  useCache?: boolean;\n  /** Whether to return loading state (default: false) */\n  returnLoading?: boolean;\n  /** Context to check permissions for */\n  context?: {\n    resource?: Record<string, unknown> | null;\n  };\n}\n\n/**\n * Result when returnLoading is true\n */\nexport interface UseGrantResult {\n  /** Whether the user is granted permission */\n  isGranted: boolean;\n  /** Whether the permission check is loading */\n  isLoading: boolean;\n}\n\n/**\n * Serialize scope for stable dependency comparison\n * This prevents re-fetching when scope object reference changes but values are the same\n */\nfunction serializeScope(scope?: Scope | null): string {\n  if (!scope) return '';\n  return `${scope.tenant}:${scope.id}`;\n}\n\n/**\n * Hook to check if a user is granted permission for a specific resource and action\n *\n * By default, returns a simple boolean, defaulting to false while loading.\n * Set `returnLoading: true` to get an object with `isGranted` and `isLoading`.\n *\n * @param resource - The resource slug to check\n * @param action - The action to check\n * @param options - Additional options\n *\n * @example\n * ```tsx\n * // Simple boolean (default)\n * const canEdit = useGrant('document', 'update');\n *\n * return (\n *   <div>\n *     {canEdit && <EditButton />}\n *   </div>\n * );\n *\n * // With loading state\n * const { isGranted, isLoading } = useGrant('document', 'update', {\n *   returnLoading: true,\n * });\n *\n * if (isLoading) return <Spinner />;\n * if (!isGranted) return null;\n *\n * return <EditButton />;\n * ```\n */\nexport function useGrant(\n  resource: string,\n  action: string,\n  options: UseGrantOptions = {}\n): boolean | UseGrantResult {\n  const { scope, enabled = true, useCache = true, returnLoading = false, context } = options;\n  const client = useGrantClient();\n\n  // Track if scope was explicitly provided (even if null/undefined)\n  // This allows us to distinguish between \"scope not provided\" (optional) vs \"scope provided but falsy\" (wait for it)\n  // Check this once at the start - if scope key exists in options, it was provided\n  // Note: { scope: undefined } has the key, { } does not have the key\n  const scopeWasProvidedRef = useRef('scope' in options);\n\n  // Determine if we should wait for scope to become valid\n  // If scope was provided but is falsy or invalid, wait for it to become truthy\n  // Recalculate when scope changes\n  const isEffectivelyEnabled = useMemo(() => {\n    const hasValidScope =\n      scope && typeof scope === 'object' && 'tenant' in scope && 'id' in scope && scope.id;\n    const shouldWaitForScope = scopeWasProvidedRef.current && !hasValidScope;\n    return enabled && !shouldWaitForScope;\n  }, [scope, enabled]);\n\n  const [data, setData] = useState<AuthorizationResult | null>(null);\n  const [isLoading, setIsLoading] = useState(isEffectivelyEnabled);\n\n  // Synchronously correct isLoading when isEffectivelyEnabled transitions.\n  // useState only uses its initializer on first render, so subsequent transitions\n  // leave isLoading stale for one render cycle (the effect hasn't run yet).\n  // This uses React's \"storing information from previous renders\" pattern to\n  // immediately set isLoading before the render completes.\n  // See: https://react.dev/reference/react/useState#storing-information-from-previous-renders\n  const [prevEffectivelyEnabled, setPrevEffectivelyEnabled] = useState(isEffectivelyEnabled);\n  if (isEffectivelyEnabled !== prevEffectivelyEnabled) {\n    setPrevEffectivelyEnabled(isEffectivelyEnabled);\n    if (isEffectivelyEnabled) {\n      setIsLoading(true);\n    } else {\n      setIsLoading(false);\n      setData(null);\n    }\n  }\n\n  // Track mounted state to prevent state updates after unmount\n  const isMounted = useRef(true);\n\n  // Store scope in a ref so we always have the latest value without triggering re-renders\n  const scopeRef = useRef(scope);\n  scopeRef.current = scope;\n\n  // Store context in a ref so the callback always sends the latest context\n  const contextRef = useRef(context);\n  contextRef.current = context;\n\n  // Serialize scope to get a stable string for dependency comparison\n  const scopeKey = serializeScope(scope);\n\n  // Serialize context so we re-create the callback when context meaningfully changes\n  const contextKey = useMemo(\n    () => (context?.resource != null ? JSON.stringify(context.resource) : ''),\n    [context?.resource]\n  );\n\n  const fetchPermission = useCallback(async () => {\n    if (!isEffectivelyEnabled) {\n      setIsLoading(false);\n      return;\n    }\n\n    setIsLoading(true);\n\n    try {\n      // Use scopeRef.current and contextRef.current to get the latest values\n      // Convert null to undefined for the client (which expects Scope | undefined)\n      const result = await client.isAuthorized(resource, action, {\n        scope: scopeRef.current ?? undefined,\n        useCache,\n        context: contextRef.current,\n      });\n      if (isMounted.current) {\n        setData(result);\n      }\n    } catch {\n      // On error, set data to null (will return false)\n      if (isMounted.current) {\n        setData(null);\n      }\n    } finally {\n      if (isMounted.current) {\n        setIsLoading(false);\n      }\n    }\n    // contextKey ensures we re-run when context (e.g. resource) changes so the request gets the latest context\n    // eslint-disable-next-line react-hooks/exhaustive-deps\n  }, [client, resource, action, scopeKey, isEffectivelyEnabled, useCache, contextKey]);\n\n  useEffect(() => {\n    isMounted.current = true;\n\n    // Clear data when scope becomes invalid (waiting for valid scope)\n    if (!isEffectivelyEnabled && scopeWasProvidedRef.current) {\n      setData(null);\n      setIsLoading(false);\n    } else {\n      fetchPermission();\n    }\n\n    return () => {\n      isMounted.current = false;\n    };\n  }, [fetchPermission, isEffectivelyEnabled]);\n\n  const isGranted = data?.authorized ?? false;\n\n  // Return object with loading state if requested, otherwise just boolean\n  if (returnLoading) {\n    return { isGranted, isLoading };\n  }\n\n  return isGranted;\n}\n","'use client';\n\nimport type { ReactNode } from 'react';\n\nimport { useGrant, type UseGrantOptions } from '../hooks/useGrant';\n\n/**\n * Props for the GrantGate component\n */\nexport interface GrantGateProps extends UseGrantOptions {\n  /** The resource slug to check permission for */\n  resource: string;\n  /** The action to check */\n  action: string;\n  /** Content to render if permission is granted */\n  children: ReactNode;\n  /** Content to render if permission is denied (optional) */\n  fallback?: ReactNode;\n  /** Content to render while loading (optional) */\n  loading?: ReactNode;\n}\n\n/**\n * Component that conditionally renders children based on permissions\n *\n * @example\n * ```tsx\n * // Basic usage - hide element if no permission\n * <GrantGate resource=\"document\" action=\"update\">\n *   <EditButton />\n * </GrantGate>\n *\n * // With fallback for denied access\n * <GrantGate\n *   resource=\"admin\"\n *   action=\"access\"\n *   fallback={<p>You don't have admin access</p>}\n * >\n *   <AdminPanel />\n * </GrantGate>\n *\n * // With loading state\n * <GrantGate\n *   resource=\"report\"\n *   action=\"view\"\n *   loading={<Spinner />}\n *   fallback={<AccessDenied />}\n * >\n *   <ReportViewer />\n * </GrantGate>\n *\n * // With scope for multi-tenant\n * <GrantGate\n *   resource=\"project\"\n *   action=\"delete\"\n *   scope={{ tenant: 'project', id: projectId }}\n * >\n *   <DeleteProjectButton />\n * </GrantGate>\n * ```\n */\nexport function GrantGate({\n  resource,\n  action,\n  scope,\n  enabled,\n  useCache,\n  children,\n  fallback = null,\n  loading = null,\n}: GrantGateProps): ReactNode {\n  // Build options object conditionally\n  // Only include scope in options if it's not undefined (null is valid and means \"wait for it\")\n  // This allows the hook to distinguish between \"scope not provided\" (undefined) vs \"scope provided but null\"\n  const options: Parameters<typeof useGrant>[2] = {\n    enabled,\n    useCache,\n    returnLoading: loading !== null,\n  };\n\n  // Only add scope to options if it's explicitly null or a valid object\n  // If scope is undefined, don't include it so hook treats it as optional\n  if (scope !== undefined) {\n    options.scope = scope;\n  }\n\n  // Use loading state if loading prop is provided\n  const result = useGrant(resource, action, options);\n\n  const isGranted = typeof result === 'boolean' ? result : result.isGranted;\n  const isLoading = typeof result === 'boolean' ? false : result.isLoading;\n\n  if (isLoading && loading !== null) {\n    return loading;\n  }\n\n  if (isGranted) {\n    return children;\n  }\n\n  return fallback;\n}\n"],"names":["createContext","useMemo","GrantClient","useContext","useRef","useState","useCallback","useEffect"],"mappings":";;;;;AAWA,MAAM,eAAeA,MAAAA,cAAkC,IAAI;AAsDpD,SAAS,cAAc,EAAE,QAAQ,QAAQ,YAAgC;AAC9E,QAAM,cAAcC,MAAAA,QAAQ,MAAM;AAChC,QAAI,OAAQ,QAAO;AACnB,WAAO,IAAIC,MAAAA,YAAY,MAAM;AAAA,EAC/B,GAAG,CAAC,QAAQ,MAAM,CAAC;AAEnB,wCAAQ,aAAa,UAAb,EAAsB,OAAO,aAAc,UAAS;AAC9D;AAaO,SAAS,iBAA8B;AAC5C,QAAM,SAASC,MAAAA,WAAW,YAAY;AAEtC,MAAI,CAAC,QAAQ;AACX,UAAM,IAAI;AAAA,MACR;AAAA,IAAA;AAAA,EAGJ;AAEA,SAAO;AACT;AAQO,SAAS,yBAA6C;AAC3D,SAAOA,MAAAA,WAAW,YAAY;AAChC;AClEA,SAAS,eAAe,OAA8B;AACpD,MAAI,CAAC,MAAO,QAAO;AACnB,SAAO,GAAG,MAAM,MAAM,IAAI,MAAM,EAAE;AACpC;AAkCO,SAAS,SACd,UACA,QACA,UAA2B,CAAA,GACD;AAC1B,QAAM,EAAE,OAAO,UAAU,MAAM,WAAW,MAAM,gBAAgB,OAAO,QAAA,IAAY;AACnF,QAAM,SAAS,eAAA;AAMf,QAAM,sBAAsBC,MAAAA,OAAO,WAAW,OAAO;AAKrD,QAAM,uBAAuBH,MAAAA,QAAQ,MAAM;AACzC,UAAM,gBACJ,SAAS,OAAO,UAAU,YAAY,YAAY,SAAS,QAAQ,SAAS,MAAM;AACpF,UAAM,qBAAqB,oBAAoB,WAAW,CAAC;AAC3D,WAAO,WAAW,CAAC;AAAA,EACrB,GAAG,CAAC,OAAO,OAAO,CAAC;AAEnB,QAAM,CAAC,MAAM,OAAO,IAAII,MAAAA,SAAqC,IAAI;AACjE,QAAM,CAAC,WAAW,YAAY,IAAIA,MAAAA,SAAS,oBAAoB;AAQ/D,QAAM,CAAC,wBAAwB,yBAAyB,IAAIA,MAAAA,SAAS,oBAAoB;AACzF,MAAI,yBAAyB,wBAAwB;AACnD,8BAA0B,oBAAoB;AAC9C,QAAI,sBAAsB;AACxB,mBAAa,IAAI;AAAA,IACnB,OAAO;AACL,mBAAa,KAAK;AAClB,cAAQ,IAAI;AAAA,IACd;AAAA,EACF;AAGA,QAAM,YAAYD,MAAAA,OAAO,IAAI;AAG7B,QAAM,WAAWA,MAAAA,OAAO,KAAK;AAC7B,WAAS,UAAU;AAGnB,QAAM,aAAaA,MAAAA,OAAO,OAAO;AACjC,aAAW,UAAU;AAGrB,QAAM,WAAW,eAAe,KAAK;AAGrC,QAAM,aAAaH,MAAAA;AAAAA,IACjB,MAAO,SAAS,YAAY,OAAO,KAAK,UAAU,QAAQ,QAAQ,IAAI;AAAA,IACtE,CAAC,SAAS,QAAQ;AAAA,EAAA;AAGpB,QAAM,kBAAkBK,MAAAA,YAAY,YAAY;AAC9C,QAAI,CAAC,sBAAsB;AACzB,mBAAa,KAAK;AAClB;AAAA,IACF;AAEA,iBAAa,IAAI;AAEjB,QAAI;AAGF,YAAM,SAAS,MAAM,OAAO,aAAa,UAAU,QAAQ;AAAA,QACzD,OAAO,SAAS,WAAW;AAAA,QAC3B;AAAA,QACA,SAAS,WAAW;AAAA,MAAA,CACrB;AACD,UAAI,UAAU,SAAS;AACrB,gBAAQ,MAAM;AAAA,MAChB;AAAA,IACF,QAAQ;AAEN,UAAI,UAAU,SAAS;AACrB,gBAAQ,IAAI;AAAA,MACd;AAAA,IACF,UAAA;AACE,UAAI,UAAU,SAAS;AACrB,qBAAa,KAAK;AAAA,MACpB;AAAA,IACF;AAAA,EAGF,GAAG,CAAC,QAAQ,UAAU,QAAQ,UAAU,sBAAsB,UAAU,UAAU,CAAC;AAEnFC,QAAAA,UAAU,MAAM;AACd,cAAU,UAAU;AAGpB,QAAI,CAAC,wBAAwB,oBAAoB,SAAS;AACxD,cAAQ,IAAI;AACZ,mBAAa,KAAK;AAAA,IACpB,OAAO;AACL,sBAAA;AAAA,IACF;AAEA,WAAO,MAAM;AACX,gBAAU,UAAU;AAAA,IACtB;AAAA,EACF,GAAG,CAAC,iBAAiB,oBAAoB,CAAC;AAE1C,QAAM,YAAY,MAAM,cAAc;AAGtC,MAAI,eAAe;AACjB,WAAO,EAAE,WAAW,UAAA;AAAA,EACtB;AAEA,SAAO;AACT;ACzIO,SAAS,UAAU;AAAA,EACxB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,WAAW;AAAA,EACX,UAAU;AACZ,GAA8B;AAI5B,QAAM,UAA0C;AAAA,IAC9C;AAAA,IACA;AAAA,IACA,eAAe,YAAY;AAAA,EAAA;AAK7B,MAAI,UAAU,QAAW;AACvB,YAAQ,QAAQ;AAAA,EAClB;AAGA,QAAM,SAAS,SAAS,UAAU,QAAQ,OAAO;AAEjD,QAAM,YAAY,OAAO,WAAW,YAAY,SAAS,OAAO;AAChE,QAAM,YAAY,OAAO,WAAW,YAAY,QAAQ,OAAO;AAE/D,MAAI,aAAa,YAAY,MAAM;AACjC,WAAO;AAAA,EACT;AAEA,MAAI,WAAW;AACb,WAAO;AAAA,EACT;AAEA,SAAO;AACT;;;;;;;"}

package/dist/react.mjs

@@ -0,0 +1,139 @@
+import { jsx } from "react/jsx-runtime";
+import { useMemo, useContext, createContext, useRef, useState, useCallback, useEffect } from "react";
+import { GrantClient } from "./index.mjs";
+const GrantContext = createContext(null);
+function GrantProvider({ config, client, children }) {
+  const grantClient = useMemo(() => {
+    if (client) return client;
+    return new GrantClient(config);
+  }, [client, config]);
+  return /* @__PURE__ */ jsx(GrantContext.Provider, { value: grantClient, children });
+}
+function useGrantClient() {
+  const client = useContext(GrantContext);
+  if (!client) {
+    throw new Error(
+      "useGrantClient must be used within a GrantProvider. Wrap your app with <GrantProvider config={...}> to fix this error."
+    );
+  }
+  return client;
+}
+function useGrantClientOptional() {
+  return useContext(GrantContext);
+}
+function serializeScope(scope) {
+  if (!scope) return "";
+  return `${scope.tenant}:${scope.id}`;
+}
+function useGrant(resource, action, options = {}) {
+  const { scope, enabled = true, useCache = true, returnLoading = false, context } = options;
+  const client = useGrantClient();
+  const scopeWasProvidedRef = useRef("scope" in options);
+  const isEffectivelyEnabled = useMemo(() => {
+    const hasValidScope = scope && typeof scope === "object" && "tenant" in scope && "id" in scope && scope.id;
+    const shouldWaitForScope = scopeWasProvidedRef.current && !hasValidScope;
+    return enabled && !shouldWaitForScope;
+  }, [scope, enabled]);
+  const [data, setData] = useState(null);
+  const [isLoading, setIsLoading] = useState(isEffectivelyEnabled);
+  const [prevEffectivelyEnabled, setPrevEffectivelyEnabled] = useState(isEffectivelyEnabled);
+  if (isEffectivelyEnabled !== prevEffectivelyEnabled) {
+    setPrevEffectivelyEnabled(isEffectivelyEnabled);
+    if (isEffectivelyEnabled) {
+      setIsLoading(true);
+    } else {
+      setIsLoading(false);
+      setData(null);
+    }
+  }
+  const isMounted = useRef(true);
+  const scopeRef = useRef(scope);
+  scopeRef.current = scope;
+  const contextRef = useRef(context);
+  contextRef.current = context;
+  const scopeKey = serializeScope(scope);
+  const contextKey = useMemo(
+    () => context?.resource != null ? JSON.stringify(context.resource) : "",
+    [context?.resource]
+  );
+  const fetchPermission = useCallback(async () => {
+    if (!isEffectivelyEnabled) {
+      setIsLoading(false);
+      return;
+    }
+    setIsLoading(true);
+    try {
+      const result = await client.isAuthorized(resource, action, {
+        scope: scopeRef.current ?? void 0,
+        useCache,
+        context: contextRef.current
+      });
+      if (isMounted.current) {
+        setData(result);
+      }
+    } catch {
+      if (isMounted.current) {
+        setData(null);
+      }
+    } finally {
+      if (isMounted.current) {
+        setIsLoading(false);
+      }
+    }
+  }, [client, resource, action, scopeKey, isEffectivelyEnabled, useCache, contextKey]);
+  useEffect(() => {
+    isMounted.current = true;
+    if (!isEffectivelyEnabled && scopeWasProvidedRef.current) {
+      setData(null);
+      setIsLoading(false);
+    } else {
+      fetchPermission();
+    }
+    return () => {
+      isMounted.current = false;
+    };
+  }, [fetchPermission, isEffectivelyEnabled]);
+  const isGranted = data?.authorized ?? false;
+  if (returnLoading) {
+    return { isGranted, isLoading };
+  }
+  return isGranted;
+}
+function GrantGate({
+  resource,
+  action,
+  scope,
+  enabled,
+  useCache,
+  children,
+  fallback = null,
+  loading = null
+}) {
+  const options = {
+    enabled,
+    useCache,
+    returnLoading: loading !== null
+  };
+  if (scope !== void 0) {
+    options.scope = scope;
+  }
+  const result = useGrant(resource, action, options);
+  const isGranted = typeof result === "boolean" ? result : result.isGranted;
+  const isLoading = typeof result === "boolean" ? false : result.isLoading;
+  if (isLoading && loading !== null) {
+    return loading;
+  }
+  if (isGranted) {
+    return children;
+  }
+  return fallback;
+}
+export {
+  GrantClient,
+  GrantGate,
+  GrantProvider,
+  useGrant,
+  useGrantClient,
+  useGrantClientOptional
+};
+//# sourceMappingURL=react.mjs.map

package/dist/react.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"react.mjs","sources":["../src/react/context.tsx","../src/react/hooks/useGrant.ts","../src/react/components/GrantGate.tsx"],"sourcesContent":["'use client';\n\nimport { createContext, useContext, useMemo, type ReactNode } from 'react';\n\nimport { GrantClient } from '../grant-client';\n\nimport type { GrantClientConfig } from '../types';\n\n/**\n * Context for the Grant client\n */\nconst GrantContext = createContext<GrantClient | null>(null);\n\n/**\n * Props for the GrantProvider component\n */\nexport interface GrantProviderProps {\n  /**\n   * Grant client configuration\n   */\n  config: GrantClientConfig;\n\n  /**\n   * Pre-configured GrantClient instance (alternative to config)\n   * If provided, config is ignored\n   */\n  client?: GrantClient;\n\n  /**\n   * Child components\n   */\n  children: ReactNode;\n}\n\n/**\n * Provider component that makes the Grant client available to child components\n *\n * @example\n * ```tsx\n * // Option 1: Pass config (cookie-based refresh)\n * <GrantProvider\n *   config={{\n *     apiUrl: 'https://api.grant.com',\n *     getAccessToken: () => localStorage.getItem('accessToken'),\n *     onRefreshWithCredentials: async () => {\n *       const res = await fetch('https://api.grant.com/api/auth/refresh', { method: 'POST', credentials: 'include' });\n *       if (!res.ok) return false;\n *       const { data } = await res.json();\n *       if (data?.accessToken) { localStorage.setItem('accessToken', data.accessToken); return true; }\n *       return false;\n *     },\n *     onTokenRefresh: (tokens) => { localStorage.setItem('accessToken', tokens.accessToken); },\n *     onUnauthorized: () => { window.location.href = '/login'; },\n *   }}\n * >\n *   <App />\n * </GrantProvider>\n *\n * // Option 2: Pass pre-configured client\n * const grant = new GrantClient({ ... });\n * <GrantProvider client={grant}>\n *   <App />\n * </GrantProvider>\n * ```\n */\nexport function GrantProvider({ config, client, children }: GrantProviderProps) {\n  const grantClient = useMemo(() => {\n    if (client) return client;\n    return new GrantClient(config);\n  }, [client, config]);\n\n  return <GrantContext.Provider value={grantClient}>{children}</GrantContext.Provider>;\n}\n\n/**\n * Hook to access the Grant client from context\n *\n * @throws Error if used outside of GrantProvider\n *\n * @example\n * ```tsx\n * const grant = useGrantClient();\n * const hasPermission = await grant.can('resource', 'action');\n * ```\n */\nexport function useGrantClient(): GrantClient {\n  const client = useContext(GrantContext);\n\n  if (!client) {\n    throw new Error(\n      'useGrantClient must be used within a GrantProvider. ' +\n        'Wrap your app with <GrantProvider config={...}> to fix this error.'\n    );\n  }\n\n  return client;\n}\n\n/**\n * Hook to optionally access the Grant client\n * Returns null if not in a GrantProvider context\n *\n * Use this when you want to gracefully handle missing provider\n */\nexport function useGrantClientOptional(): GrantClient | null {\n  return useContext(GrantContext);\n}\n","'use client';\n\nimport { useState, useEffect, useCallback, useRef, useMemo } from 'react';\n\nimport { useGrantClient } from '../context';\n\nimport type { AuthorizationResult, Scope } from '../../types';\n\n/**\n * Options for the useGrant hook\n */\nexport interface UseGrantOptions {\n  /** Scope to check the permission in. If provided but null/undefined, hook waits for it to become valid. */\n  scope?: Scope | null;\n  /** Whether to skip the permission check */\n  enabled?: boolean;\n  /** Whether to use cached results (default: true) */\n  useCache?: boolean;\n  /** Whether to return loading state (default: false) */\n  returnLoading?: boolean;\n  /** Context to check permissions for */\n  context?: {\n    resource?: Record<string, unknown> | null;\n  };\n}\n\n/**\n * Result when returnLoading is true\n */\nexport interface UseGrantResult {\n  /** Whether the user is granted permission */\n  isGranted: boolean;\n  /** Whether the permission check is loading */\n  isLoading: boolean;\n}\n\n/**\n * Serialize scope for stable dependency comparison\n * This prevents re-fetching when scope object reference changes but values are the same\n */\nfunction serializeScope(scope?: Scope | null): string {\n  if (!scope) return '';\n  return `${scope.tenant}:${scope.id}`;\n}\n\n/**\n * Hook to check if a user is granted permission for a specific resource and action\n *\n * By default, returns a simple boolean, defaulting to false while loading.\n * Set `returnLoading: true` to get an object with `isGranted` and `isLoading`.\n *\n * @param resource - The resource slug to check\n * @param action - The action to check\n * @param options - Additional options\n *\n * @example\n * ```tsx\n * // Simple boolean (default)\n * const canEdit = useGrant('document', 'update');\n *\n * return (\n *   <div>\n *     {canEdit && <EditButton />}\n *   </div>\n * );\n *\n * // With loading state\n * const { isGranted, isLoading } = useGrant('document', 'update', {\n *   returnLoading: true,\n * });\n *\n * if (isLoading) return <Spinner />;\n * if (!isGranted) return null;\n *\n * return <EditButton />;\n * ```\n */\nexport function useGrant(\n  resource: string,\n  action: string,\n  options: UseGrantOptions = {}\n): boolean | UseGrantResult {\n  const { scope, enabled = true, useCache = true, returnLoading = false, context } = options;\n  const client = useGrantClient();\n\n  // Track if scope was explicitly provided (even if null/undefined)\n  // This allows us to distinguish between \"scope not provided\" (optional) vs \"scope provided but falsy\" (wait for it)\n  // Check this once at the start - if scope key exists in options, it was provided\n  // Note: { scope: undefined } has the key, { } does not have the key\n  const scopeWasProvidedRef = useRef('scope' in options);\n\n  // Determine if we should wait for scope to become valid\n  // If scope was provided but is falsy or invalid, wait for it to become truthy\n  // Recalculate when scope changes\n  const isEffectivelyEnabled = useMemo(() => {\n    const hasValidScope =\n      scope && typeof scope === 'object' && 'tenant' in scope && 'id' in scope && scope.id;\n    const shouldWaitForScope = scopeWasProvidedRef.current && !hasValidScope;\n    return enabled && !shouldWaitForScope;\n  }, [scope, enabled]);\n\n  const [data, setData] = useState<AuthorizationResult | null>(null);\n  const [isLoading, setIsLoading] = useState(isEffectivelyEnabled);\n\n  // Synchronously correct isLoading when isEffectivelyEnabled transitions.\n  // useState only uses its initializer on first render, so subsequent transitions\n  // leave isLoading stale for one render cycle (the effect hasn't run yet).\n  // This uses React's \"storing information from previous renders\" pattern to\n  // immediately set isLoading before the render completes.\n  // See: https://react.dev/reference/react/useState#storing-information-from-previous-renders\n  const [prevEffectivelyEnabled, setPrevEffectivelyEnabled] = useState(isEffectivelyEnabled);\n  if (isEffectivelyEnabled !== prevEffectivelyEnabled) {\n    setPrevEffectivelyEnabled(isEffectivelyEnabled);\n    if (isEffectivelyEnabled) {\n      setIsLoading(true);\n    } else {\n      setIsLoading(false);\n      setData(null);\n    }\n  }\n\n  // Track mounted state to prevent state updates after unmount\n  const isMounted = useRef(true);\n\n  // Store scope in a ref so we always have the latest value without triggering re-renders\n  const scopeRef = useRef(scope);\n  scopeRef.current = scope;\n\n  // Store context in a ref so the callback always sends the latest context\n  const contextRef = useRef(context);\n  contextRef.current = context;\n\n  // Serialize scope to get a stable string for dependency comparison\n  const scopeKey = serializeScope(scope);\n\n  // Serialize context so we re-create the callback when context meaningfully changes\n  const contextKey = useMemo(\n    () => (context?.resource != null ? JSON.stringify(context.resource) : ''),\n    [context?.resource]\n  );\n\n  const fetchPermission = useCallback(async () => {\n    if (!isEffectivelyEnabled) {\n      setIsLoading(false);\n      return;\n    }\n\n    setIsLoading(true);\n\n    try {\n      // Use scopeRef.current and contextRef.current to get the latest values\n      // Convert null to undefined for the client (which expects Scope | undefined)\n      const result = await client.isAuthorized(resource, action, {\n        scope: scopeRef.current ?? undefined,\n        useCache,\n        context: contextRef.current,\n      });\n      if (isMounted.current) {\n        setData(result);\n      }\n    } catch {\n      // On error, set data to null (will return false)\n      if (isMounted.current) {\n        setData(null);\n      }\n    } finally {\n      if (isMounted.current) {\n        setIsLoading(false);\n      }\n    }\n    // contextKey ensures we re-run when context (e.g. resource) changes so the request gets the latest context\n    // eslint-disable-next-line react-hooks/exhaustive-deps\n  }, [client, resource, action, scopeKey, isEffectivelyEnabled, useCache, contextKey]);\n\n  useEffect(() => {\n    isMounted.current = true;\n\n    // Clear data when scope becomes invalid (waiting for valid scope)\n    if (!isEffectivelyEnabled && scopeWasProvidedRef.current) {\n      setData(null);\n      setIsLoading(false);\n    } else {\n      fetchPermission();\n    }\n\n    return () => {\n      isMounted.current = false;\n    };\n  }, [fetchPermission, isEffectivelyEnabled]);\n\n  const isGranted = data?.authorized ?? false;\n\n  // Return object with loading state if requested, otherwise just boolean\n  if (returnLoading) {\n    return { isGranted, isLoading };\n  }\n\n  return isGranted;\n}\n","'use client';\n\nimport type { ReactNode } from 'react';\n\nimport { useGrant, type UseGrantOptions } from '../hooks/useGrant';\n\n/**\n * Props for the GrantGate component\n */\nexport interface GrantGateProps extends UseGrantOptions {\n  /** The resource slug to check permission for */\n  resource: string;\n  /** The action to check */\n  action: string;\n  /** Content to render if permission is granted */\n  children: ReactNode;\n  /** Content to render if permission is denied (optional) */\n  fallback?: ReactNode;\n  /** Content to render while loading (optional) */\n  loading?: ReactNode;\n}\n\n/**\n * Component that conditionally renders children based on permissions\n *\n * @example\n * ```tsx\n * // Basic usage - hide element if no permission\n * <GrantGate resource=\"document\" action=\"update\">\n *   <EditButton />\n * </GrantGate>\n *\n * // With fallback for denied access\n * <GrantGate\n *   resource=\"admin\"\n *   action=\"access\"\n *   fallback={<p>You don't have admin access</p>}\n * >\n *   <AdminPanel />\n * </GrantGate>\n *\n * // With loading state\n * <GrantGate\n *   resource=\"report\"\n *   action=\"view\"\n *   loading={<Spinner />}\n *   fallback={<AccessDenied />}\n * >\n *   <ReportViewer />\n * </GrantGate>\n *\n * // With scope for multi-tenant\n * <GrantGate\n *   resource=\"project\"\n *   action=\"delete\"\n *   scope={{ tenant: 'project', id: projectId }}\n * >\n *   <DeleteProjectButton />\n * </GrantGate>\n * ```\n */\nexport function GrantGate({\n  resource,\n  action,\n  scope,\n  enabled,\n  useCache,\n  children,\n  fallback = null,\n  loading = null,\n}: GrantGateProps): ReactNode {\n  // Build options object conditionally\n  // Only include scope in options if it's not undefined (null is valid and means \"wait for it\")\n  // This allows the hook to distinguish between \"scope not provided\" (undefined) vs \"scope provided but null\"\n  const options: Parameters<typeof useGrant>[2] = {\n    enabled,\n    useCache,\n    returnLoading: loading !== null,\n  };\n\n  // Only add scope to options if it's explicitly null or a valid object\n  // If scope is undefined, don't include it so hook treats it as optional\n  if (scope !== undefined) {\n    options.scope = scope;\n  }\n\n  // Use loading state if loading prop is provided\n  const result = useGrant(resource, action, options);\n\n  const isGranted = typeof result === 'boolean' ? result : result.isGranted;\n  const isLoading = typeof result === 'boolean' ? false : result.isLoading;\n\n  if (isLoading && loading !== null) {\n    return loading;\n  }\n\n  if (isGranted) {\n    return children;\n  }\n\n  return fallback;\n}\n"],"names":[],"mappings":";;;AAWA,MAAM,eAAe,cAAkC,IAAI;AAsDpD,SAAS,cAAc,EAAE,QAAQ,QAAQ,YAAgC;AAC9E,QAAM,cAAc,QAAQ,MAAM;AAChC,QAAI,OAAQ,QAAO;AACnB,WAAO,IAAI,YAAY,MAAM;AAAA,EAC/B,GAAG,CAAC,QAAQ,MAAM,CAAC;AAEnB,6BAAQ,aAAa,UAAb,EAAsB,OAAO,aAAc,UAAS;AAC9D;AAaO,SAAS,iBAA8B;AAC5C,QAAM,SAAS,WAAW,YAAY;AAEtC,MAAI,CAAC,QAAQ;AACX,UAAM,IAAI;AAAA,MACR;AAAA,IAAA;AAAA,EAGJ;AAEA,SAAO;AACT;AAQO,SAAS,yBAA6C;AAC3D,SAAO,WAAW,YAAY;AAChC;AClEA,SAAS,eAAe,OAA8B;AACpD,MAAI,CAAC,MAAO,QAAO;AACnB,SAAO,GAAG,MAAM,MAAM,IAAI,MAAM,EAAE;AACpC;AAkCO,SAAS,SACd,UACA,QACA,UAA2B,CAAA,GACD;AAC1B,QAAM,EAAE,OAAO,UAAU,MAAM,WAAW,MAAM,gBAAgB,OAAO,QAAA,IAAY;AACnF,QAAM,SAAS,eAAA;AAMf,QAAM,sBAAsB,OAAO,WAAW,OAAO;AAKrD,QAAM,uBAAuB,QAAQ,MAAM;AACzC,UAAM,gBACJ,SAAS,OAAO,UAAU,YAAY,YAAY,SAAS,QAAQ,SAAS,MAAM;AACpF,UAAM,qBAAqB,oBAAoB,WAAW,CAAC;AAC3D,WAAO,WAAW,CAAC;AAAA,EACrB,GAAG,CAAC,OAAO,OAAO,CAAC;AAEnB,QAAM,CAAC,MAAM,OAAO,IAAI,SAAqC,IAAI;AACjE,QAAM,CAAC,WAAW,YAAY,IAAI,SAAS,oBAAoB;AAQ/D,QAAM,CAAC,wBAAwB,yBAAyB,IAAI,SAAS,oBAAoB;AACzF,MAAI,yBAAyB,wBAAwB;AACnD,8BAA0B,oBAAoB;AAC9C,QAAI,sBAAsB;AACxB,mBAAa,IAAI;AAAA,IACnB,OAAO;AACL,mBAAa,KAAK;AAClB,cAAQ,IAAI;AAAA,IACd;AAAA,EACF;AAGA,QAAM,YAAY,OAAO,IAAI;AAG7B,QAAM,WAAW,OAAO,KAAK;AAC7B,WAAS,UAAU;AAGnB,QAAM,aAAa,OAAO,OAAO;AACjC,aAAW,UAAU;AAGrB,QAAM,WAAW,eAAe,KAAK;AAGrC,QAAM,aAAa;AAAA,IACjB,MAAO,SAAS,YAAY,OAAO,KAAK,UAAU,QAAQ,QAAQ,IAAI;AAAA,IACtE,CAAC,SAAS,QAAQ;AAAA,EAAA;AAGpB,QAAM,kBAAkB,YAAY,YAAY;AAC9C,QAAI,CAAC,sBAAsB;AACzB,mBAAa,KAAK;AAClB;AAAA,IACF;AAEA,iBAAa,IAAI;AAEjB,QAAI;AAGF,YAAM,SAAS,MAAM,OAAO,aAAa,UAAU,QAAQ;AAAA,QACzD,OAAO,SAAS,WAAW;AAAA,QAC3B;AAAA,QACA,SAAS,WAAW;AAAA,MAAA,CACrB;AACD,UAAI,UAAU,SAAS;AACrB,gBAAQ,MAAM;AAAA,MAChB;AAAA,IACF,QAAQ;AAEN,UAAI,UAAU,SAAS;AACrB,gBAAQ,IAAI;AAAA,MACd;AAAA,IACF,UAAA;AACE,UAAI,UAAU,SAAS;AACrB,qBAAa,KAAK;AAAA,MACpB;AAAA,IACF;AAAA,EAGF,GAAG,CAAC,QAAQ,UAAU,QAAQ,UAAU,sBAAsB,UAAU,UAAU,CAAC;AAEnF,YAAU,MAAM;AACd,cAAU,UAAU;AAGpB,QAAI,CAAC,wBAAwB,oBAAoB,SAAS;AACxD,cAAQ,IAAI;AACZ,mBAAa,KAAK;AAAA,IACpB,OAAO;AACL,sBAAA;AAAA,IACF;AAEA,WAAO,MAAM;AACX,gBAAU,UAAU;AAAA,IACtB;AAAA,EACF,GAAG,CAAC,iBAAiB,oBAAoB,CAAC;AAE1C,QAAM,YAAY,MAAM,cAAc;AAGtC,MAAI,eAAe;AACjB,WAAO,EAAE,WAAW,UAAA;AAAA,EACtB;AAEA,SAAO;AACT;ACzIO,SAAS,UAAU;AAAA,EACxB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,WAAW;AAAA,EACX,UAAU;AACZ,GAA8B;AAI5B,QAAM,UAA0C;AAAA,IAC9C;AAAA,IACA;AAAA,IACA,eAAe,YAAY;AAAA,EAAA;AAK7B,MAAI,UAAU,QAAW;AACvB,YAAQ,QAAQ;AAAA,EAClB;AAGA,QAAM,SAAS,SAAS,UAAU,QAAQ,OAAO;AAEjD,QAAM,YAAY,OAAO,WAAW,YAAY,SAAS,OAAO;AAChE,QAAM,YAAY,OAAO,WAAW,YAAY,QAAQ,OAAO;AAE/D,MAAI,aAAa,YAAY,MAAM;AACjC,WAAO;AAAA,EACT;AAEA,MAAI,WAAW;AACb,WAAO;AAAA,EACT;AAEA,SAAO;AACT;"}

package/dist/types.d.ts

@@ -0,0 +1,149 @@
+import { Scope } from '../../schema/src/index.ts';
+export type { Scope, Tenant } from '../../schema/src/index.ts';
+/**
+ * Options for project-app OAuth sign-in (redirect only).
+ */
+export interface SignInWithProjectAppOptions {
+    /** Project app client_id */
+    clientId: string;
+    /** Callback URL; user is redirected here with token in the URL fragment after consent */
+    redirectUri: string;
+    /** Optional scope (if app supports dynamic scope) */
+    scope?: string;
+    /** Optional state to round-trip */
+    state?: string;
+    /** Locale for entry URL (e.g. 'en'). Default 'en'. */
+    locale?: string;
+}
+/**
+ * Configuration for the Grant client
+ */
+export interface GrantClientConfig {
+    /**
+     * Grant API URL (e.g., "https://api.grant.com")
+     */
+    apiUrl: string;
+    /**
+     * Grant web app (frontend) URL for project OAuth entry (e.g. "https://app.grant.com").
+     * Required for signInWithProjectApp. Entry URL: {frontendUrl}/{locale}/auth/project.
+     */
+    frontendUrl?: string;
+    /**
+     * Function to get the current access token
+     * Return null if not authenticated
+     */
+    getAccessToken?: () => string | null | Promise<string | null>;
+    /**
+     * Callback when the access token is updated after a cookie-based refresh.
+     * The API returns only `accessToken` in the refresh response body; the refresh token stays in an HttpOnly cookie.
+     * Use this to update your in-memory or cookie-based access token so subsequent requests use the new token.
+     */
+    onTokenRefresh?: (tokens: AuthTokens) => void | Promise<void>;
+    /**
+     * Callback when authentication fails (after refresh attempt)
+     * Use this to redirect to login
+     */
+    onUnauthorized?: () => void;
+    /**
+     * **Session refresh (cookie-based).** Called on 401 to refresh the session using the HttpOnly refresh cookie.
+     * Your callback should: (1) call `POST /api/auth/refresh` with `credentials: 'include'`, (2) parse the
+     * response for the new `accessToken`, (3) update your app token storage (e.g. set the new access token so
+     * `getAccessToken` returns it), and optionally call the same logic you pass to `onTokenRefresh`. Return `true`
+     * if refresh succeeded so the client can retry the request.
+     * Refresh tokens are not sent in the request body; the API uses only the HttpOnly refresh cookie.
+     */
+    onRefreshWithCredentials?: () => Promise<boolean>;
+    /**
+     * Custom fetch implementation
+     * Defaults to globalThis.fetch
+     */
+    fetch?: typeof fetch;
+    /**
+     * Credentials mode for fetch requests
+     * Defaults to 'include' for cookie support
+     */
+    credentials?: RequestCredentials;
+    /**
+     * Cache configuration
+     */
+    cache?: CacheOptions;
+}
+/**
+ * Auth tokens from the refresh endpoint. With cookie-based refresh, the API returns only `accessToken` in the
+ * response body; `refreshToken` is set in an HttpOnly cookie and is not exposed to JS, so it may be undefined.
+ */
+export interface AuthTokens {
+    accessToken: string;
+    /** Undefined when using cookie-based refresh (refresh token is HttpOnly cookie). */
+    refreshToken?: string;
+}
+/**
+ * Cache configuration options
+ */
+export interface CacheOptions {
+    /**
+     * Default TTL in milliseconds
+     * @default 300000 (5 minutes)
+     */
+    ttl?: number;
+    /**
+     * Key prefix for cache entries
+     * @default 'grant'
+     */
+    prefix?: string;
+}
+/**
+ * Result of an authorization check
+ */
+export interface AuthorizationResult {
+    /** Whether the action is authorized */
+    authorized: boolean;
+    /** Human-readable reason for the decision */
+    reason?: string;
+    /** The permission that matched (if authorized) */
+    matchedPermission?: Permission;
+}
+/**
+ * Options for permission queries
+ */
+export interface PermissionQueryOptions {
+    /** Scope to check permissions in */
+    scope?: Scope;
+    /** Whether to use cached results (default: true) */
+    useCache?: boolean;
+    /** Resource to check permissions for */
+    context?: {
+        resource?: Record<string, unknown> | null;
+    };
+}
+/**
+ * Permission entity
+ */
+export interface Permission {
+    id: string;
+    name: string;
+    description?: string | null;
+    action: string;
+    resourceId?: string | null;
+    resource?: Resource | null;
+    condition?: unknown;
+}
+/**
+ * Resource entity
+ */
+export interface Resource {
+    id: string;
+    name: string;
+    slug: string;
+    description?: string | null;
+    actions: string[];
+}
+/**
+ * Error response from the API
+ */
+export interface ApiError {
+    error: string;
+    message?: string;
+    statusCode?: number;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAC;AAG7C,YAAY,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAErD;;GAEG;AACH,MAAM,WAAW,2BAA2B;IAC1C,4BAA4B;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,yFAAyF;IACzF,WAAW,EAAE,MAAM,CAAC;IACpB,qDAAqD;IACrD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,mCAAmC;IACnC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,sDAAsD;IACtD,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC;;OAEG;IACH,MAAM,EAAE,MAAM,CAAC;IAEf;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB;;;OAGG;IACH,cAAc,CAAC,EAAE,MAAM,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAE9D;;;;OAIG;IACH,cAAc,CAAC,EAAE,CAAC,MAAM,EAAE,UAAU,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE9D;;;OAGG;IACH,cAAc,CAAC,EAAE,MAAM,IAAI,CAAC;IAE5B;;;;;;;OAOG;IACH,wBAAwB,CAAC,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;IAElD;;;OAGG;IACH,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IAErB;;;OAGG;IACH,WAAW,CAAC,EAAE,kBAAkB,CAAC;IAEjC;;OAEG;IACH,KAAK,CAAC,EAAE,YAAY,CAAC;CACtB;AAED;;;GAGG;AACH,MAAM,WAAW,UAAU;IACzB,WAAW,EAAE,MAAM,CAAC;IACpB,oFAAoF;IACpF,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B;;;OAGG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;IAEb;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,uCAAuC;IACvC,UAAU,EAAE,OAAO,CAAC;IACpB,6CAA6C;IAC7C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,kDAAkD;IAClD,iBAAiB,CAAC,EAAE,UAAU,CAAC;CAChC;AAED;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACrC,oCAAoC;IACpC,KAAK,CAAC,EAAE,KAAK,CAAC;IACd,oDAAoD;IACpD,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,wCAAwC;IACxC,OAAO,CAAC,EAAE;QACR,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;KAC3C,CAAC;CACH;AAED;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,QAAQ,CAAC,EAAE,QAAQ,GAAG,IAAI,CAAC;IAC3B,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED;;GAEG;AACH,MAAM,WAAW,QAAQ;IACvB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED;;GAEG;AACH,MAAM,WAAW,QAAQ;IACvB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB"}