@grantjs/server 1.0.0 → 1.1.0

package/dist/nest.mjs

@@ -1,156 +1,157 @@
-var __defProp = Object.defineProperty;
-var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
-var __publicField = (obj, key, value) => __defNormalProp(obj, typeof key !== "symbol" ? key + "" : key, value);
-import { SetMetadata, Global, Module, ForbiddenException, UnauthorizedException, NotFoundException, Injectable, Inject } from "@nestjs/common";
-import { d as debugGrant } from "./debug-C8ibbrE5.js";
-import { G as GrantClient, e as extractTokenFromRequest } from "./grant-client-D1LZI2f4.js";
-const GRANT_OPTIONS_KEY = "grant:options";
+import { i as extractTokenFromRequest, n as _defineProperty, t as GrantClient } from "./grant-client-t3KadxFo.js";
+import { t as debugGrant } from "./debug-DICR8lwQ.js";
+import { ForbiddenException, Global, Inject, Injectable, Module, NotFoundException, SetMetadata, UnauthorizedException } from "@nestjs/common";
+//#region src/nest/grant.decorator.ts
+/**
+* Metadata key for Grant options (resource, action) on route handlers.
+* Used by GrantGuard when options are not passed in the constructor.
+*/
+var GRANT_OPTIONS_KEY = "grant:options";
 function Grant(resourceOrOptions, action) {
-  const options = typeof resourceOrOptions === "string" && action !== void 0 ? { resource: resourceOrOptions, action } : resourceOrOptions;
-  return SetMetadata(GRANT_OPTIONS_KEY, options);
+	return SetMetadata(GRANT_OPTIONS_KEY, typeof resourceOrOptions === "string" && action !== void 0 ? {
+		resource: resourceOrOptions,
+		action
+	} : resourceOrOptions);
 }
-var __getOwnPropDesc$1 = Object.getOwnPropertyDescriptor;
-var __decorateClass$1 = (decorators, target, key, kind) => {
-  var result = kind > 1 ? void 0 : kind ? __getOwnPropDesc$1(target, key) : target;
-  for (var i = decorators.length - 1, decorator; i >= 0; i--)
-    if (decorator = decorators[i])
-      result = decorator(result) || result;
-  return result;
-};
-const GRANT_CLIENT = "GrantClient";
-let GrantModule = class {
-  static forRoot(config) {
-    const client = new GrantClient(config);
-    return {
-      module: GrantModule,
-      providers: [
-        { provide: GrantClient, useValue: client },
-        { provide: GRANT_CLIENT, useValue: client }
-      ],
-      exports: [GrantClient, GRANT_CLIENT]
-    };
-  }
-};
-GrantModule = __decorateClass$1([
-  Global(),
-  Module({})
-], GrantModule);
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __decorateClass = (decorators, target, key, kind) => {
-  var result = kind > 1 ? void 0 : kind ? __getOwnPropDesc(target, key) : target;
-  for (var i = decorators.length - 1, decorator; i >= 0; i--)
-    if (decorator = decorators[i])
-      result = decorator(result) || result;
-  return result;
+//#endregion
+//#region \0@oxc-project+runtime@0.127.0/helpers/decorate.js
+function __decorate(decorators, target, key, desc) {
+	var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+	if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+	else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+	return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+//#endregion
+//#region src/nest/grant.module.ts
+var _GrantModule;
+var GRANT_CLIENT = "GrantClient";
+var GrantModule = _GrantModule = class GrantModule {
+	static forRoot(config) {
+		const client = new GrantClient(config);
+		return {
+			module: _GrantModule,
+			providers: [{
+				provide: GrantClient,
+				useValue: client
+			}, {
+				provide: GRANT_CLIENT,
+				useValue: client
+			}],
+			exports: [GrantClient, GRANT_CLIENT]
+		};
+	}
 };
-var __decorateParam = (index, decorator) => (target, key) => decorator(target, key, index);
-const GRANT_GUARD = "GrantGuard";
+GrantModule = _GrantModule = __decorate([Global(), Module({})], GrantModule);
+//#endregion
+//#region \0@oxc-project+runtime@0.127.0/helpers/decorateMetadata.js
+function __decorateMetadata(k, v) {
+	if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+}
+//#endregion
+//#region \0@oxc-project+runtime@0.127.0/helpers/decorateParam.js
+function __decorateParam(paramIndex, decorator) {
+	return function(target, key) {
+		decorator(target, key, paramIndex);
+	};
+}
+//#endregion
+//#region src/nest/grant.guard.ts
+var _ref;
+/** Injection token for GrantGuard. Use with @UseGuards(GRANT_GUARD) so Nest resolves the guard from the container (with GrantClient injected). */
+var GRANT_GUARD = "GrantGuard";
+/**
+* NestJS guard that checks Grant authorization before allowing access to a route.
+*
+* Use in one of two ways:
+*
+* 1. With decorator (resource/action from metadata):
+*    - Import GrantModule.forRoot() in AppModule. In a feature module, add
+*      `{ provide: GRANT_GUARD, useClass: GrantGuard }` and use @Grant + @UseGuards(GRANT_GUARD).
+*    - Using the GRANT_GUARD token ensures Nest resolves the guard from the container (GrantClient injected).
+*
+* 2. With explicit options (supports resourceResolver):
+*    - @UseGuards(new GrantGuard(grantClient, { resource: 'Document', action: 'Update', resourceResolver: async ({ request }) => ... }))
+*
+* On success, the authorization result is attached to the request as request.authorization.
+* On failure, throws UnauthorizedException (401), ForbiddenException (403), or NotFoundException (404).
+*/
 function isGrantGuardOptions(x) {
-  return typeof x === "object" && x !== null && "resource" in x && "action" in x && typeof x.resource === "string" && typeof x.action === "string";
+	return typeof x === "object" && x !== null && "resource" in x && "action" in x && typeof x.resource === "string" && typeof x.action === "string";
 }
-let GrantGuard = class {
-  constructor(client, reflectorOrOptions) {
-    __publicField(this, "explicitOptions");
-    __publicField(this, "reflector");
-    this.client = client;
-    if (reflectorOrOptions && isGrantGuardOptions(reflectorOrOptions)) {
-      this.explicitOptions = reflectorOrOptions;
-    } else {
-      this.reflector = reflectorOrOptions;
-    }
-  }
-  getOptionsFromContext(context) {
-    const handler = context.getHandler();
-    const clazz = context.getClass();
-    if (this.reflector) {
-      const fromHandler = this.reflector.get(GRANT_OPTIONS_KEY, handler);
-      const fromClass = this.reflector.get(GRANT_OPTIONS_KEY, clazz);
-      if (fromHandler) return fromHandler;
-      if (fromClass) return fromClass;
-    }
-    if (typeof Reflect !== "undefined" && typeof Reflect.getMetadata === "function") {
-      const fromHandler = Reflect.getMetadata(GRANT_OPTIONS_KEY, handler);
-      const fromClass = Reflect.getMetadata(GRANT_OPTIONS_KEY, clazz);
-      if (fromHandler) return fromHandler;
-      if (fromClass) return fromClass;
-    }
-    return void 0;
-  }
-  async canActivate(context) {
-    const request = context.switchToHttp().getRequest();
-    const options = this.explicitOptions ?? this.getOptionsFromContext(context);
-    if (options?.resource && options?.action) {
-      debugGrant("Nest", {
-        resource: options.resource,
-        action: options.action,
-        hasReflector: !!this.reflector,
-        handler: context.getHandler()?.name,
-        controller: context.getClass()?.name
-      });
-    }
-    if (!options || !options.resource || !options.action) {
-      throw new ForbiddenException(
-        "Grant options (resource, action) required. Use @Grant() or pass options to GrantGuard."
-      );
-    }
-    if (!this.client) {
-      throw new ForbiddenException(
-        "GrantGuard: GrantClient not injected. Import GrantModule.forRoot() in AppModule and register GrantGuard as a provider."
-      );
-    }
-    const token = await extractTokenFromRequest(request, this.client.config);
-    if (!token) {
-      throw new UnauthorizedException({ error: "Unauthorized", code: "UNAUTHENTICATED" });
-    }
-    let resolvedResource = null;
-    const opts = options;
-    if (opts.resourceResolver) {
-      resolvedResource = await opts.resourceResolver({
-        resourceSlug: options.resource,
-        request
-      });
-      if (!resolvedResource) {
-        throw new NotFoundException({ error: "Resource not found", code: "NOT_FOUND" });
-      }
-    }
-    const result = await this.client.isAuthorized(
-      options.resource,
-      options.action,
-      {
-        context: {
-          resource: resolvedResource ?? void 0
-        }
-      },
-      request
-    );
-    debugGrant("Nest", {
-      resource: options.resource,
-      action: options.action,
-      authorized: result.authorized,
-      ...result.authorized ? {} : { reason: result.reason }
-    });
-    if (!result.authorized) {
-      throw new ForbiddenException({
-        error: "Forbidden",
-        code: "FORBIDDEN",
-        reason: result.reason
-      });
-    }
-    request.authorization = result;
-    return true;
-  }
+var GrantGuard = class GrantGuard {
+	constructor(client, reflectorOrOptions) {
+		_defineProperty(this, "explicitOptions", void 0);
+		_defineProperty(this, "reflector", void 0);
+		this.client = client;
+		if (reflectorOrOptions && isGrantGuardOptions(reflectorOrOptions)) this.explicitOptions = reflectorOrOptions;
+		else this.reflector = reflectorOrOptions;
+	}
+	getOptionsFromContext(context) {
+		const handler = context.getHandler();
+		const clazz = context.getClass();
+		if (this.reflector) {
+			const fromHandler = this.reflector.get(GRANT_OPTIONS_KEY, handler);
+			const fromClass = this.reflector.get(GRANT_OPTIONS_KEY, clazz);
+			if (fromHandler) return fromHandler;
+			if (fromClass) return fromClass;
+		}
+		if (typeof Reflect !== "undefined" && typeof Reflect.getMetadata === "function") {
+			const fromHandler = Reflect.getMetadata(GRANT_OPTIONS_KEY, handler);
+			const fromClass = Reflect.getMetadata(GRANT_OPTIONS_KEY, clazz);
+			if (fromHandler) return fromHandler;
+			if (fromClass) return fromClass;
+		}
+	}
+	async canActivate(context) {
+		const request = context.switchToHttp().getRequest();
+		const options = this.explicitOptions ?? this.getOptionsFromContext(context);
+		if (options?.resource && options?.action) debugGrant("Nest", {
+			resource: options.resource,
+			action: options.action,
+			hasReflector: !!this.reflector,
+			handler: context.getHandler()?.name,
+			controller: context.getClass()?.name
+		});
+		if (!options || !options.resource || !options.action) throw new ForbiddenException("Grant options (resource, action) required. Use @Grant() or pass options to GrantGuard.");
+		if (!this.client) throw new ForbiddenException("GrantGuard: GrantClient not injected. Import GrantModule.forRoot() in AppModule and register GrantGuard as a provider.");
+		if (!await extractTokenFromRequest(request, this.client.config)) throw new UnauthorizedException({
+			error: "Unauthorized",
+			code: "UNAUTHENTICATED"
+		});
+		let resolvedResource = null;
+		const opts = options;
+		if (opts.resourceResolver) {
+			resolvedResource = await opts.resourceResolver({
+				resourceSlug: options.resource,
+				request
+			});
+			if (!resolvedResource) throw new NotFoundException({
+				error: "Resource not found",
+				code: "NOT_FOUND"
+			});
+		}
+		const result = await this.client.isAuthorized(options.resource, options.action, { context: { resource: resolvedResource ?? void 0 } }, request);
+		debugGrant("Nest", {
+			resource: options.resource,
+			action: options.action,
+			authorized: result.authorized,
+			...result.authorized ? {} : { reason: result.reason }
+		});
+		if (!result.authorized) throw new ForbiddenException({
+			error: "Forbidden",
+			code: "FORBIDDEN",
+			reason: result.reason
+		});
+		request.authorization = result;
+		return true;
+	}
 };
-GrantGuard = __decorateClass([
-  Injectable(),
-  __decorateParam(0, Inject(GRANT_CLIENT))
+GrantGuard = __decorate([
+	Injectable(),
+	__decorateParam(0, Inject(GRANT_CLIENT)),
+	__decorateMetadata("design:paramtypes", [typeof (_ref = typeof GrantClient !== "undefined" && GrantClient) === "function" ? _ref : Object, Object])
 ], GrantGuard);
-export {
-  GRANT_CLIENT,
-  GRANT_GUARD,
-  GRANT_OPTIONS_KEY,
-  Grant,
-  GrantClient,
-  GrantGuard,
-  GrantModule
-};
-//# sourceMappingURL=nest.mjs.map
+//#endregion
+export { GRANT_CLIENT, GRANT_GUARD, GRANT_OPTIONS_KEY, Grant, GrantClient, GrantGuard, GrantModule };
+
+//# sourceMappingURL=nest.mjs.map

package/dist/nest.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"nest.mjs","sources":["../src/nest/grant.decorator.ts","../src/nest/grant.module.ts","../src/nest/grant.guard.ts"],"sourcesContent":["import { SetMetadata } from '@nestjs/common';\n\n/**\n * Metadata key for Grant options (resource, action) on route handlers.\n * Used by GrantGuard when options are not passed in the constructor.\n */\nexport const GRANT_OPTIONS_KEY = 'grant:options';\n\n/**\n * Options for the Grant guard (resource, action; resourceResolver only via guard constructor).\n */\nexport interface GrantOptions {\n  /** The resource slug to check (e.g., \"Organization\", \"Project\", \"Document\") */\n  resource: string;\n  /** The action to check (e.g., \"Query\", \"Create\", \"Update\", \"Delete\") */\n  action: string;\n}\n\n/**\n * Decorator to require a Grant permission on a route.\n * Use with GrantGuard (injected) so the guard reads resource/action from this metadata.\n *\n * @example\n * ```ts\n * @Get()\n * @Grant('Document', 'Query')\n * @UseGuards(GrantGuard)\n * list() { ... }\n *\n * @Post()\n * @Grant('Document', 'Create')\n * @UseGuards(GrantGuard)\n * create(@Body() dto: CreateDocumentDto) { ... }\n * ```\n *\n * For dynamic resource resolution (resourceResolver), use the guard with explicit options:\n * `@UseGuards(new GrantGuard(grantClient, { resource: 'Document', action: 'Update', resourceResolver: ... }))`\n */\nexport function Grant(resource: string, action: string): ReturnType<typeof SetMetadata>;\nexport function Grant(options: GrantOptions): ReturnType<typeof SetMetadata>;\nexport function Grant(\n  resourceOrOptions: string | GrantOptions,\n  action?: string\n): ReturnType<typeof SetMetadata> {\n  const options: GrantOptions =\n    typeof resourceOrOptions === 'string' && action !== undefined\n      ? { resource: resourceOrOptions, action }\n      : (resourceOrOptions as GrantOptions);\n  return SetMetadata(GRANT_OPTIONS_KEY, options);\n}\n","import { DynamicModule, Global, Module } from '@nestjs/common';\n\nimport { GrantClient } from '../grant-client';\n\nimport type { GrantServerConfig } from '../types';\n\nexport const GRANT_CLIENT = 'GrantClient';\n\n/**\n * NestJS module that provides GrantClient for injection.\n *\n * @example\n * ```ts\n * // app.module.ts\n * import { GrantModule } from '@grantjs/server/nest';\n *\n * @Module({\n *   imports: [\n *     GrantModule.forRoot({\n *       apiUrl: process.env.GRANT_API_URL!,\n *       getToken: (req) => req.headers?.authorization?.replace?.('Bearer ', '') ?? null,\n *     }),\n *   ],\n * })\n * export class AppModule {}\n * ```\n *\n * Then inject GrantClient in controllers and use with GrantGuard.\n */\n@Global()\n@Module({})\nexport class GrantModule {\n  static forRoot(config: GrantServerConfig): DynamicModule {\n    const client = new GrantClient(config);\n    return {\n      module: GrantModule,\n      providers: [\n        { provide: GrantClient, useValue: client },\n        { provide: GRANT_CLIENT, useValue: client },\n      ],\n      exports: [GrantClient, GRANT_CLIENT],\n    };\n  }\n}\n","import {\n  CanActivate,\n  ExecutionContext,\n  ForbiddenException,\n  Inject,\n  Injectable,\n  NotFoundException,\n  UnauthorizedException,\n} from '@nestjs/common';\nimport { Reflector } from '@nestjs/core';\n\nimport { GrantClient } from '../grant-client';\nimport { debugGrant } from '../utils/debug';\nimport { extractTokenFromRequest } from '../utils/token-extractor';\n\nimport { GRANT_OPTIONS_KEY } from './grant.decorator';\nimport { GRANT_CLIENT } from './grant.module';\n\n/** Injection token for GrantGuard. Use with @UseGuards(GRANT_GUARD) so Nest resolves the guard from the container (with GrantClient injected). */\nexport const GRANT_GUARD = 'GrantGuard';\n\nimport type { ResourceResolver, AuthorizationResult } from '../types';\nimport type { GrantOptions } from './grant.decorator';\n\n/**\n * Extended request type with Grant authorization result (for use in controllers).\n */\nexport interface AuthorizedRequest {\n  authorization?: AuthorizationResult;\n}\n\n/**\n * Guard options when using explicit options (includes optional resourceResolver).\n */\nexport interface GrantGuardOptions {\n  resource: string;\n  action: string;\n  resourceResolver?: ResourceResolver;\n}\n\n/**\n * NestJS guard that checks Grant authorization before allowing access to a route.\n *\n * Use in one of two ways:\n *\n * 1. With decorator (resource/action from metadata):\n *    - Import GrantModule.forRoot() in AppModule. In a feature module, add\n *      `{ provide: GRANT_GUARD, useClass: GrantGuard }` and use @Grant + @UseGuards(GRANT_GUARD).\n *    - Using the GRANT_GUARD token ensures Nest resolves the guard from the container (GrantClient injected).\n *\n * 2. With explicit options (supports resourceResolver):\n *    - @UseGuards(new GrantGuard(grantClient, { resource: 'Document', action: 'Update', resourceResolver: async ({ request }) => ... }))\n *\n * On success, the authorization result is attached to the request as request.authorization.\n * On failure, throws UnauthorizedException (401), ForbiddenException (403), or NotFoundException (404).\n */\nfunction isGrantGuardOptions(x: unknown): x is GrantGuardOptions {\n  return (\n    typeof x === 'object' &&\n    x !== null &&\n    'resource' in x &&\n    'action' in x &&\n    typeof (x as GrantGuardOptions).resource === 'string' &&\n    typeof (x as GrantGuardOptions).action === 'string'\n  );\n}\n\n@Injectable()\nexport class GrantGuard implements CanActivate {\n  private readonly explicitOptions?: GrantGuardOptions;\n  private readonly reflector?: Reflector;\n\n  constructor(\n    @Inject(GRANT_CLIENT) private readonly client: GrantClient,\n    reflectorOrOptions?: Reflector | GrantGuardOptions\n  ) {\n    if (reflectorOrOptions && isGrantGuardOptions(reflectorOrOptions)) {\n      this.explicitOptions = reflectorOrOptions;\n    } else {\n      this.reflector = reflectorOrOptions as Reflector | undefined;\n    }\n  }\n\n  private getOptionsFromContext(context: ExecutionContext): GrantOptions | undefined {\n    const handler = context.getHandler();\n    const clazz = context.getClass();\n    // Prefer Reflector when available (Nest DI)\n    if (this.reflector) {\n      const fromHandler = this.reflector.get<GrantOptions>(GRANT_OPTIONS_KEY, handler);\n      const fromClass = this.reflector.get<GrantOptions>(GRANT_OPTIONS_KEY, clazz);\n      if (fromHandler) return fromHandler;\n      if (fromClass) return fromClass;\n    }\n    // Fallback: read metadata via Reflect (works when Reflector is not injected, e.g. ESM/CJS boundary)\n    if (typeof Reflect !== 'undefined' && typeof Reflect.getMetadata === 'function') {\n      const fromHandler = Reflect.getMetadata(GRANT_OPTIONS_KEY, handler) as\n        | GrantOptions\n        | undefined;\n      const fromClass = Reflect.getMetadata(GRANT_OPTIONS_KEY, clazz) as GrantOptions | undefined;\n      if (fromHandler) return fromHandler;\n      if (fromClass) return fromClass;\n    }\n    return undefined;\n  }\n\n  async canActivate(context: ExecutionContext): Promise<boolean> {\n    const request = context.switchToHttp().getRequest();\n\n    const options = this.explicitOptions ?? this.getOptionsFromContext(context);\n\n    if (options?.resource && options?.action) {\n      debugGrant('Nest', {\n        resource: options.resource,\n        action: options.action,\n        hasReflector: !!this.reflector,\n        handler: context.getHandler()?.name,\n        controller: context.getClass()?.name,\n      });\n    }\n\n    if (!options || !options.resource || !options.action) {\n      throw new ForbiddenException(\n        'Grant options (resource, action) required. Use @Grant() or pass options to GrantGuard.'\n      );\n    }\n\n    if (!this.client) {\n      throw new ForbiddenException(\n        'GrantGuard: GrantClient not injected. Import GrantModule.forRoot() in AppModule and register GrantGuard as a provider.'\n      );\n    }\n\n    const token = await extractTokenFromRequest(request, this.client.config);\n    if (!token) {\n      throw new UnauthorizedException({ error: 'Unauthorized', code: 'UNAUTHENTICATED' });\n    }\n\n    let resolvedResource: Record<string, unknown> | null = null;\n\n    const opts = options as GrantGuardOptions;\n    if (opts.resourceResolver) {\n      resolvedResource = await opts.resourceResolver({\n        resourceSlug: options.resource,\n        request,\n      });\n      if (!resolvedResource) {\n        throw new NotFoundException({ error: 'Resource not found', code: 'NOT_FOUND' });\n      }\n    }\n\n    const result = await this.client.isAuthorized(\n      options.resource,\n      options.action,\n      {\n        context: {\n          resource: resolvedResource ?? undefined,\n        },\n      },\n      request\n    );\n\n    debugGrant('Nest', {\n      resource: options.resource,\n      action: options.action,\n      authorized: result.authorized,\n      ...(result.authorized ? {} : { reason: result.reason }),\n    });\n\n    if (!result.authorized) {\n      throw new ForbiddenException({\n        error: 'Forbidden',\n        code: 'FORBIDDEN',\n        reason: result.reason,\n      });\n    }\n\n    (request as AuthorizedRequest).authorization = result;\n    return true;\n  }\n}\n"],"names":["__decorateClass"],"mappings":";;;;;;AAMO,MAAM,oBAAoB;AAkC1B,SAAS,MACd,mBACA,QACgC;AAChC,QAAM,UACJ,OAAO,sBAAsB,YAAY,WAAW,SAChD,EAAE,UAAU,mBAAmB,OAAA,IAC9B;AACP,SAAO,YAAY,mBAAmB,OAAO;AAC/C;;;;;;;;;AC3CO,MAAM,eAAe;AAyBrB,IAAM,cAAN,MAAkB;AAAA,EACvB,OAAO,QAAQ,QAA0C;AACvD,UAAM,SAAS,IAAI,YAAY,MAAM;AACrC,WAAO;AAAA,MACL,QAAQ;AAAA,MACR,WAAW;AAAA,QACT,EAAE,SAAS,aAAa,UAAU,OAAA;AAAA,QAClC,EAAE,SAAS,cAAc,UAAU,OAAA;AAAA,MAAO;AAAA,MAE5C,SAAS,CAAC,aAAa,YAAY;AAAA,IAAA;AAAA,EAEvC;AACF;AAZa,cAANA,kBAAA;AAAA,EAFN,OAAA;AAAA,EACA,OAAO,CAAA,CAAE;AAAA,GACG,WAAA;;;;;;;;;;ACZN,MAAM,cAAc;AAqC3B,SAAS,oBAAoB,GAAoC;AAC/D,SACE,OAAO,MAAM,YACb,MAAM,QACN,cAAc,KACd,YAAY,KACZ,OAAQ,EAAwB,aAAa,YAC7C,OAAQ,EAAwB,WAAW;AAE/C;AAGO,IAAM,aAAN,MAAwC;AAAA,EAI7C,YACyC,QACvC,oBACA;AANe;AACA;AAGwB,SAAA,SAAA;AAGvC,QAAI,sBAAsB,oBAAoB,kBAAkB,GAAG;AACjE,WAAK,kBAAkB;AAAA,IACzB,OAAO;AACL,WAAK,YAAY;AAAA,IACnB;AAAA,EACF;AAAA,EAEQ,sBAAsB,SAAqD;AACjF,UAAM,UAAU,QAAQ,WAAA;AACxB,UAAM,QAAQ,QAAQ,SAAA;AAEtB,QAAI,KAAK,WAAW;AAClB,YAAM,cAAc,KAAK,UAAU,IAAkB,mBAAmB,OAAO;AAC/E,YAAM,YAAY,KAAK,UAAU,IAAkB,mBAAmB,KAAK;AAC3E,UAAI,YAAa,QAAO;AACxB,UAAI,UAAW,QAAO;AAAA,IACxB;AAEA,QAAI,OAAO,YAAY,eAAe,OAAO,QAAQ,gBAAgB,YAAY;AAC/E,YAAM,cAAc,QAAQ,YAAY,mBAAmB,OAAO;AAGlE,YAAM,YAAY,QAAQ,YAAY,mBAAmB,KAAK;AAC9D,UAAI,YAAa,QAAO;AACxB,UAAI,UAAW,QAAO;AAAA,IACxB;AACA,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,YAAY,SAA6C;AAC7D,UAAM,UAAU,QAAQ,aAAA,EAAe,WAAA;AAEvC,UAAM,UAAU,KAAK,mBAAmB,KAAK,sBAAsB,OAAO;AAE1E,QAAI,SAAS,YAAY,SAAS,QAAQ;AACxC,iBAAW,QAAQ;AAAA,QACjB,UAAU,QAAQ;AAAA,QAClB,QAAQ,QAAQ;AAAA,QAChB,cAAc,CAAC,CAAC,KAAK;AAAA,QACrB,SAAS,QAAQ,WAAA,GAAc;AAAA,QAC/B,YAAY,QAAQ,YAAY;AAAA,MAAA,CACjC;AAAA,IACH;AAEA,QAAI,CAAC,WAAW,CAAC,QAAQ,YAAY,CAAC,QAAQ,QAAQ;AACpD,YAAM,IAAI;AAAA,QACR;AAAA,MAAA;AAAA,IAEJ;AAEA,QAAI,CAAC,KAAK,QAAQ;AAChB,YAAM,IAAI;AAAA,QACR;AAAA,MAAA;AAAA,IAEJ;AAEA,UAAM,QAAQ,MAAM,wBAAwB,SAAS,KAAK,OAAO,MAAM;AACvE,QAAI,CAAC,OAAO;AACV,YAAM,IAAI,sBAAsB,EAAE,OAAO,gBAAgB,MAAM,mBAAmB;AAAA,IACpF;AAEA,QAAI,mBAAmD;AAEvD,UAAM,OAAO;AACb,QAAI,KAAK,kBAAkB;AACzB,yBAAmB,MAAM,KAAK,iBAAiB;AAAA,QAC7C,cAAc,QAAQ;AAAA,QACtB;AAAA,MAAA,CACD;AACD,UAAI,CAAC,kBAAkB;AACrB,cAAM,IAAI,kBAAkB,EAAE,OAAO,sBAAsB,MAAM,aAAa;AAAA,MAChF;AAAA,IACF;AAEA,UAAM,SAAS,MAAM,KAAK,OAAO;AAAA,MAC/B,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR;AAAA,QACE,SAAS;AAAA,UACP,UAAU,oBAAoB;AAAA,QAAA;AAAA,MAChC;AAAA,MAEF;AAAA,IAAA;AAGF,eAAW,QAAQ;AAAA,MACjB,UAAU,QAAQ;AAAA,MAClB,QAAQ,QAAQ;AAAA,MAChB,YAAY,OAAO;AAAA,MACnB,GAAI,OAAO,aAAa,CAAA,IAAK,EAAE,QAAQ,OAAO,OAAA;AAAA,IAAO,CACtD;AAED,QAAI,CAAC,OAAO,YAAY;AACtB,YAAM,IAAI,mBAAmB;AAAA,QAC3B,OAAO;AAAA,QACP,MAAM;AAAA,QACN,QAAQ,OAAO;AAAA,MAAA,CAChB;AAAA,IACH;AAEC,YAA8B,gBAAgB;AAC/C,WAAO;AAAA,EACT;AACF;AA/Ga,aAAN,gBAAA;AAAA,EADN,WAAA;AAAA,EAMI,0BAAO,YAAY,CAAA;AAAA,GALX,UAAA;"}
+{"version":3,"file":"nest.mjs","names":[],"sources":["../src/nest/grant.decorator.ts","../src/nest/grant.module.ts","../src/nest/grant.guard.ts"],"sourcesContent":["import { SetMetadata } from '@nestjs/common';\n\n/**\n * Metadata key for Grant options (resource, action) on route handlers.\n * Used by GrantGuard when options are not passed in the constructor.\n */\nexport const GRANT_OPTIONS_KEY = 'grant:options';\n\n/**\n * Options for the Grant guard (resource, action; resourceResolver only via guard constructor).\n */\nexport interface GrantOptions {\n  /** The resource slug to check (e.g., \"Organization\", \"Project\", \"Document\") */\n  resource: string;\n  /** The action to check (e.g., \"Query\", \"Create\", \"Update\", \"Delete\") */\n  action: string;\n}\n\n/**\n * Decorator to require a Grant permission on a route.\n * Use with GrantGuard (injected) so the guard reads resource/action from this metadata.\n *\n * @example\n * ```ts\n * @Get()\n * @Grant('Document', 'Query')\n * @UseGuards(GrantGuard)\n * list() { ... }\n *\n * @Post()\n * @Grant('Document', 'Create')\n * @UseGuards(GrantGuard)\n * create(@Body() dto: CreateDocumentDto) { ... }\n * ```\n *\n * For dynamic resource resolution (resourceResolver), use the guard with explicit options:\n * `@UseGuards(new GrantGuard(grantClient, { resource: 'Document', action: 'Update', resourceResolver: ... }))`\n */\nexport function Grant(resource: string, action: string): ReturnType<typeof SetMetadata>;\nexport function Grant(options: GrantOptions): ReturnType<typeof SetMetadata>;\nexport function Grant(\n  resourceOrOptions: string | GrantOptions,\n  action?: string\n): ReturnType<typeof SetMetadata> {\n  const options: GrantOptions =\n    typeof resourceOrOptions === 'string' && action !== undefined\n      ? { resource: resourceOrOptions, action }\n      : (resourceOrOptions as GrantOptions);\n  return SetMetadata(GRANT_OPTIONS_KEY, options);\n}\n","import { DynamicModule, Global, Module } from '@nestjs/common';\n\nimport { GrantClient } from '../grant-client';\nimport type { GrantServerConfig } from '../types';\n\nexport const GRANT_CLIENT = 'GrantClient';\n\n/**\n * NestJS module that provides GrantClient for injection.\n *\n * @example\n * ```ts\n * // app.module.ts\n * import { GrantModule } from '@grantjs/server/nest';\n *\n * @Module({\n *   imports: [\n *     GrantModule.forRoot({\n *       apiUrl: process.env.GRANT_API_URL!,\n *       getToken: (req) => req.headers?.authorization?.replace?.('Bearer ', '') ?? null,\n *     }),\n *   ],\n * })\n * export class AppModule {}\n * ```\n *\n * Then inject GrantClient in controllers and use with GrantGuard.\n */\n@Global()\n@Module({})\nexport class GrantModule {\n  static forRoot(config: GrantServerConfig): DynamicModule {\n    const client = new GrantClient(config);\n    return {\n      module: GrantModule,\n      providers: [\n        { provide: GrantClient, useValue: client },\n        { provide: GRANT_CLIENT, useValue: client },\n      ],\n      exports: [GrantClient, GRANT_CLIENT],\n    };\n  }\n}\n","import {\n  CanActivate,\n  ExecutionContext,\n  ForbiddenException,\n  Inject,\n  Injectable,\n  NotFoundException,\n  UnauthorizedException,\n} from '@nestjs/common';\nimport { Reflector } from '@nestjs/core';\n\nimport { GrantClient } from '../grant-client';\nimport { debugGrant } from '../utils/debug';\nimport { extractTokenFromRequest } from '../utils/token-extractor';\nimport { GRANT_OPTIONS_KEY } from './grant.decorator';\nimport { GRANT_CLIENT } from './grant.module';\n\n/** Injection token for GrantGuard. Use with @UseGuards(GRANT_GUARD) so Nest resolves the guard from the container (with GrantClient injected). */\nexport const GRANT_GUARD = 'GrantGuard';\n\nimport type { AuthorizationResult, ResourceResolver } from '../types';\nimport type { GrantOptions } from './grant.decorator';\n\n/**\n * Extended request type with Grant authorization result (for use in controllers).\n */\nexport interface AuthorizedRequest {\n  authorization?: AuthorizationResult;\n}\n\n/**\n * Guard options when using explicit options (includes optional resourceResolver).\n */\nexport interface GrantGuardOptions {\n  resource: string;\n  action: string;\n  resourceResolver?: ResourceResolver;\n}\n\n/**\n * NestJS guard that checks Grant authorization before allowing access to a route.\n *\n * Use in one of two ways:\n *\n * 1. With decorator (resource/action from metadata):\n *    - Import GrantModule.forRoot() in AppModule. In a feature module, add\n *      `{ provide: GRANT_GUARD, useClass: GrantGuard }` and use @Grant + @UseGuards(GRANT_GUARD).\n *    - Using the GRANT_GUARD token ensures Nest resolves the guard from the container (GrantClient injected).\n *\n * 2. With explicit options (supports resourceResolver):\n *    - @UseGuards(new GrantGuard(grantClient, { resource: 'Document', action: 'Update', resourceResolver: async ({ request }) => ... }))\n *\n * On success, the authorization result is attached to the request as request.authorization.\n * On failure, throws UnauthorizedException (401), ForbiddenException (403), or NotFoundException (404).\n */\nfunction isGrantGuardOptions(x: unknown): x is GrantGuardOptions {\n  return (\n    typeof x === 'object' &&\n    x !== null &&\n    'resource' in x &&\n    'action' in x &&\n    typeof (x as GrantGuardOptions).resource === 'string' &&\n    typeof (x as GrantGuardOptions).action === 'string'\n  );\n}\n\n@Injectable()\nexport class GrantGuard implements CanActivate {\n  private readonly explicitOptions?: GrantGuardOptions;\n  private readonly reflector?: Reflector;\n\n  constructor(\n    @Inject(GRANT_CLIENT) private readonly client: GrantClient,\n    reflectorOrOptions?: Reflector | GrantGuardOptions\n  ) {\n    if (reflectorOrOptions && isGrantGuardOptions(reflectorOrOptions)) {\n      this.explicitOptions = reflectorOrOptions;\n    } else {\n      this.reflector = reflectorOrOptions as Reflector | undefined;\n    }\n  }\n\n  private getOptionsFromContext(context: ExecutionContext): GrantOptions | undefined {\n    const handler = context.getHandler();\n    const clazz = context.getClass();\n    // Prefer Reflector when available (Nest DI)\n    if (this.reflector) {\n      const fromHandler = this.reflector.get<GrantOptions>(GRANT_OPTIONS_KEY, handler);\n      const fromClass = this.reflector.get<GrantOptions>(GRANT_OPTIONS_KEY, clazz);\n      if (fromHandler) return fromHandler;\n      if (fromClass) return fromClass;\n    }\n    // Fallback: read metadata via Reflect (works when Reflector is not injected, e.g. ESM/CJS boundary)\n    if (typeof Reflect !== 'undefined' && typeof Reflect.getMetadata === 'function') {\n      const fromHandler = Reflect.getMetadata(GRANT_OPTIONS_KEY, handler) as\n        | GrantOptions\n        | undefined;\n      const fromClass = Reflect.getMetadata(GRANT_OPTIONS_KEY, clazz) as GrantOptions | undefined;\n      if (fromHandler) return fromHandler;\n      if (fromClass) return fromClass;\n    }\n    return undefined;\n  }\n\n  async canActivate(context: ExecutionContext): Promise<boolean> {\n    const request = context.switchToHttp().getRequest();\n\n    const options = this.explicitOptions ?? this.getOptionsFromContext(context);\n\n    if (options?.resource && options?.action) {\n      debugGrant('Nest', {\n        resource: options.resource,\n        action: options.action,\n        hasReflector: !!this.reflector,\n        handler: context.getHandler()?.name,\n        controller: context.getClass()?.name,\n      });\n    }\n\n    if (!options || !options.resource || !options.action) {\n      throw new ForbiddenException(\n        'Grant options (resource, action) required. Use @Grant() or pass options to GrantGuard.'\n      );\n    }\n\n    if (!this.client) {\n      throw new ForbiddenException(\n        'GrantGuard: GrantClient not injected. Import GrantModule.forRoot() in AppModule and register GrantGuard as a provider.'\n      );\n    }\n\n    const token = await extractTokenFromRequest(request, this.client.config);\n    if (!token) {\n      throw new UnauthorizedException({ error: 'Unauthorized', code: 'UNAUTHENTICATED' });\n    }\n\n    let resolvedResource: Record<string, unknown> | null = null;\n\n    const opts = options as GrantGuardOptions;\n    if (opts.resourceResolver) {\n      resolvedResource = await opts.resourceResolver({\n        resourceSlug: options.resource,\n        request,\n      });\n      if (!resolvedResource) {\n        throw new NotFoundException({ error: 'Resource not found', code: 'NOT_FOUND' });\n      }\n    }\n\n    const result = await this.client.isAuthorized(\n      options.resource,\n      options.action,\n      {\n        context: {\n          resource: resolvedResource ?? undefined,\n        },\n      },\n      request\n    );\n\n    debugGrant('Nest', {\n      resource: options.resource,\n      action: options.action,\n      authorized: result.authorized,\n      ...(result.authorized ? {} : { reason: result.reason }),\n    });\n\n    if (!result.authorized) {\n      throw new ForbiddenException({\n        error: 'Forbidden',\n        code: 'FORBIDDEN',\n        reason: result.reason,\n      });\n    }\n\n    (request as AuthorizedRequest).authorization = result;\n    return true;\n  }\n}\n"],"mappings":";;;;;;;;AAMA,IAAa,oBAAoB;AAkCjC,SAAgB,MACd,mBACA,QACgC;AAKhC,QAAO,YAAY,mBAHjB,OAAO,sBAAsB,YAAY,WAAW,KAAA,IAChD;EAAE,UAAU;EAAmB;EAAQ,GACtC,kBACuC;;;;;;;;;;;;;AC3ChD,IAAa,eAAe;AAyBrB,IAAA,cAAA,eAAA,MAAM,YAAY;CACvB,OAAO,QAAQ,QAA0C;EACvD,MAAM,SAAS,IAAI,YAAY,OAAO;AACtC,SAAO;GACL,QAAA;GACA,WAAW,CACT;IAAE,SAAS;IAAa,UAAU;IAAQ,EAC1C;IAAE,SAAS;IAAc,UAAU;IAAQ,CAC5C;GACD,SAAS,CAAC,aAAa,aAAa;GACrC;;;yCAZJ,QAAQ,EACR,OAAO,EAAE,CAAC,CAAA,EAAA,YAAA;;;;;;;;;;;;;;;;;ACXX,IAAa,cAAc;;;;;;;;;;;;;;;;;AAqC3B,SAAS,oBAAoB,GAAoC;AAC/D,QACE,OAAO,MAAM,YACb,MAAM,QACN,cAAc,KACd,YAAY,KACZ,OAAQ,EAAwB,aAAa,YAC7C,OAAQ,EAAwB,WAAW;;AAKxC,IAAA,aAAA,MAAM,WAAkC;CAI7C,YACE,QACA,oBACA;wBANF,mBAAA,KAAA,EAAiB;wBACjB,aAAA,KAAA,EAAiB;AAGwB,OAAA,SAAA;AAGvC,MAAI,sBAAsB,oBAAoB,mBAAmB,CAC/D,MAAK,kBAAkB;MAEvB,MAAK,YAAY;;CAIrB,sBAA8B,SAAqD;EACjF,MAAM,UAAU,QAAQ,YAAY;EACpC,MAAM,QAAQ,QAAQ,UAAU;AAEhC,MAAI,KAAK,WAAW;GAClB,MAAM,cAAc,KAAK,UAAU,IAAkB,mBAAmB,QAAQ;GAChF,MAAM,YAAY,KAAK,UAAU,IAAkB,mBAAmB,MAAM;AAC5E,OAAI,YAAa,QAAO;AACxB,OAAI,UAAW,QAAO;;AAGxB,MAAI,OAAO,YAAY,eAAe,OAAO,QAAQ,gBAAgB,YAAY;GAC/E,MAAM,cAAc,QAAQ,YAAY,mBAAmB,QAAQ;GAGnE,MAAM,YAAY,QAAQ,YAAY,mBAAmB,MAAM;AAC/D,OAAI,YAAa,QAAO;AACxB,OAAI,UAAW,QAAO;;;CAK1B,MAAM,YAAY,SAA6C;EAC7D,MAAM,UAAU,QAAQ,cAAc,CAAC,YAAY;EAEnD,MAAM,UAAU,KAAK,mBAAmB,KAAK,sBAAsB,QAAQ;AAE3E,MAAI,SAAS,YAAY,SAAS,OAChC,YAAW,QAAQ;GACjB,UAAU,QAAQ;GAClB,QAAQ,QAAQ;GAChB,cAAc,CAAC,CAAC,KAAK;GACrB,SAAS,QAAQ,YAAY,EAAE;GAC/B,YAAY,QAAQ,UAAU,EAAE;GACjC,CAAC;AAGJ,MAAI,CAAC,WAAW,CAAC,QAAQ,YAAY,CAAC,QAAQ,OAC5C,OAAM,IAAI,mBACR,yFACD;AAGH,MAAI,CAAC,KAAK,OACR,OAAM,IAAI,mBACR,yHACD;AAIH,MAAI,CAAC,MADe,wBAAwB,SAAS,KAAK,OAAO,OAAO,CAEtE,OAAM,IAAI,sBAAsB;GAAE,OAAO;GAAgB,MAAM;GAAmB,CAAC;EAGrF,IAAI,mBAAmD;EAEvD,MAAM,OAAO;AACb,MAAI,KAAK,kBAAkB;AACzB,sBAAmB,MAAM,KAAK,iBAAiB;IAC7C,cAAc,QAAQ;IACtB;IACD,CAAC;AACF,OAAI,CAAC,iBACH,OAAM,IAAI,kBAAkB;IAAE,OAAO;IAAsB,MAAM;IAAa,CAAC;;EAInF,MAAM,SAAS,MAAM,KAAK,OAAO,aAC/B,QAAQ,UACR,QAAQ,QACR,EACE,SAAS,EACP,UAAU,oBAAoB,KAAA,GAC/B,EACF,EACD,QACD;AAED,aAAW,QAAQ;GACjB,UAAU,QAAQ;GAClB,QAAQ,QAAQ;GAChB,YAAY,OAAO;GACnB,GAAI,OAAO,aAAa,EAAE,GAAG,EAAE,QAAQ,OAAO,QAAQ;GACvD,CAAC;AAEF,MAAI,CAAC,OAAO,WACV,OAAM,IAAI,mBAAmB;GAC3B,OAAO;GACP,MAAM;GACN,QAAQ,OAAO;GAChB,CAAC;AAGH,UAA8B,gBAAgB;AAC/C,SAAO;;;;CA9GV,YAAY;oBAMR,OAAO,aAAa,CAAA"}

package/dist/next/index.d.ts

@@ -1,6 +1,6 @@
-export { withGrant } from './with-grant';
-export type { GrantOptions, GrantRouteHandler, WithGrantContext } from './with-grant';
-export type { GrantServerConfig, AuthorizationResult, PermissionCheckOptions, Scope, ResourceResolver, } from '../types';
-export { GrantClient } from '../grant-client';
 export { AuthenticationError, AuthorizationError, BadRequestError, NotFoundError } from '../errors';
+export { GrantClient } from '../grant-client';
+export type { AuthorizationResult, GrantServerConfig, PermissionCheckOptions, ResourceResolver, Scope, } from '../types';
+export type { GrantOptions, GrantRouteHandler, WithGrantContext } from './with-grant';
+export { withGrant } from './with-grant';
 //# sourceMappingURL=index.d.ts.map

package/dist/next/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/next/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,YAAY,EAAE,YAAY,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAEtF,YAAY,EACV,iBAAiB,EACjB,mBAAmB,EACnB,sBAAsB,EACtB,KAAK,EACL,gBAAgB,GACjB,MAAM,UAAU,CAAC;AAElB,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAC9C,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/next/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AACpG,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAC9C,YAAY,EACV,mBAAmB,EACnB,iBAAiB,EACjB,sBAAsB,EACtB,gBAAgB,EAChB,KAAK,GACN,MAAM,UAAU,CAAC;AAClB,YAAY,EAAE,YAAY,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACtF,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC"}

package/dist/next/with-grant.d.ts

@@ -1,6 +1,6 @@
 import { NextRequest } from 'next/server';
 import { GrantClient } from '../grant-client';
-import { ResourceResolver, AuthorizationResult } from '../types';
+import { AuthorizationResult, ResourceResolver } from '../types';
 /**
  * Options for Next.js route handler guard
  */

package/dist/next/with-grant.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"with-grant.d.ts","sourceRoot":"","sources":["../../src/next/with-grant.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAgB,MAAM,aAAa,CAAC;AAExD,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAI9C,OAAO,KAAK,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,UAAU,CAAC;AAEtE;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,+EAA+E;IAC/E,QAAQ,EAAE,MAAM,CAAC;IACjB,wEAAwE;IACxE,MAAM,EAAE,MAAM,CAAC;IACf,wDAAwD;IACxD,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;CACrC;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,aAAa,EAAE,mBAAmB,CAAC;CACpC;AAED;;;GAGG;AACH,MAAM,MAAM,iBAAiB,GAAG,CAC9B,OAAO,EAAE,WAAW,EACpB,OAAO,CAAC,EAAE,gBAAgB,KACvB,OAAO,CAAC,QAAQ,CAAC,GAAG,QAAQ,CAAC;AAElC;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAgB,SAAS,CACvB,MAAM,EAAE,WAAW,EACnB,OAAO,EAAE,YAAY,EACrB,OAAO,EAAE,iBAAiB,GACzB,CACD,OAAO,EAAE,WAAW,EACpB,OAAO,CAAC,EAAE;IAAE,MAAM,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;CAAE,KACnD,OAAO,CAAC,QAAQ,CAAC,CA0DrB"}
+{"version":3,"file":"with-grant.d.ts","sourceRoot":"","sources":["../../src/next/with-grant.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAgB,MAAM,aAAa,CAAC;AAExD,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAC9C,OAAO,KAAK,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAC;AAItE;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,+EAA+E;IAC/E,QAAQ,EAAE,MAAM,CAAC;IACjB,wEAAwE;IACxE,MAAM,EAAE,MAAM,CAAC;IACf,wDAAwD;IACxD,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;CACrC;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,aAAa,EAAE,mBAAmB,CAAC;CACpC;AAED;;;GAGG;AACH,MAAM,MAAM,iBAAiB,GAAG,CAC9B,OAAO,EAAE,WAAW,EACpB,OAAO,CAAC,EAAE,gBAAgB,KACvB,OAAO,CAAC,QAAQ,CAAC,GAAG,QAAQ,CAAC;AAElC;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAgB,SAAS,CACvB,MAAM,EAAE,WAAW,EACnB,OAAO,EAAE,YAAY,EACrB,OAAO,EAAE,iBAAiB,GACzB,CACD,OAAO,EAAE,WAAW,EACpB,OAAO,CAAC,EAAE;IAAE,MAAM,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;CAAE,KACnD,OAAO,CAAC,QAAQ,CAAC,CA0DrB"}

package/dist/next.cjs

@@ -1,62 +1,79 @@
-"use strict";
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const server = require("next/server");
-const debug = require("./debug-Crb5gNDM.cjs");
-const grantClient = require("./grant-client-DywfJN5P.cjs");
-const index = require("./index.cjs");
+const require_grant_client = require("./grant-client-f6IKMyk5.cjs");
+const require_errors = require("./errors-BUeTn_3G.cjs");
+const require_debug = require("./debug-DInHA4QB.cjs");
+let next_server = require("next/server");
+//#region src/next/with-grant.ts
+/**
+* Wrap a Next.js App Router route handler with Grant authorization.
+* Use for GET, POST, PUT, PATCH, DELETE in app/api/.../route.ts.
+*
+* Compatible with Next.js 13–16. In Next 15+, the route context's `params` is a Promise;
+* this wrapper does not use params (only `request` is passed to the resolver/handler).
+*
+* @example
+* ```ts
+* // app/api/documents/route.ts
+* import { withGrant } from '@grantjs/server/next';
+* import { GrantClient } from '@grantjs/server';
+*
+* const grantClient = new GrantClient({ apiUrl: process.env.GRANT_API_URL! });
+*
+* export const GET = withGrant(
+*   grantClient,
+*   { resource: 'Document', action: 'Query' },
+*   async (request) => NextResponse.json({ data: [] })
+* );
+*
+* export const POST = withGrant(
+*   grantClient,
+*   { resource: 'Document', action: 'Create' },
+*   async (request) => { ... }
+* );
+* ```
+*/
 function withGrant(client, options, handler) {
-  return async (request, _routeContext) => {
-    debug.debugGrant("Next", { resource: options.resource, action: options.action });
-    const token = await grantClient.extractTokenFromRequest(request, client.config);
-    if (!token) {
-      return server.NextResponse.json({ error: "Unauthorized", code: "UNAUTHENTICATED" }, { status: 401 });
-    }
-    let resolvedResource = null;
-    if (options.resourceResolver) {
-      resolvedResource = await options.resourceResolver({
-        resourceSlug: options.resource,
-        request
-      });
-      if (!resolvedResource) {
-        return server.NextResponse.json(
-          { error: "Resource not found", code: "NOT_FOUND" },
-          { status: 404 }
-        );
-      }
-    }
-    const result = await client.isAuthorized(
-      options.resource,
-      options.action,
-      {
-        context: {
-          resource: resolvedResource ?? void 0
-        }
-      },
-      request
-    );
-    debug.debugGrant("Next", {
-      resource: options.resource,
-      action: options.action,
-      authorized: result.authorized,
-      ...result.authorized ? {} : { reason: result.reason }
-    });
-    if (!result.authorized) {
-      return server.NextResponse.json(
-        {
-          error: "Forbidden",
-          code: "FORBIDDEN",
-          reason: result.reason
-        },
-        { status: 403 }
-      );
-    }
-    return handler(request, { authorization: result });
-  };
+	return async (request, _routeContext) => {
+		require_debug.debugGrant("Next", {
+			resource: options.resource,
+			action: options.action
+		});
+		if (!await require_grant_client.extractTokenFromRequest(request, client.config)) return next_server.NextResponse.json({
+			error: "Unauthorized",
+			code: "UNAUTHENTICATED"
+		}, { status: 401 });
+		let resolvedResource = null;
+		if (options.resourceResolver) {
+			resolvedResource = await options.resourceResolver({
+				resourceSlug: options.resource,
+				request
+			});
+			if (!resolvedResource) return next_server.NextResponse.json({
+				error: "Resource not found",
+				code: "NOT_FOUND"
+			}, { status: 404 });
+		}
+		const result = await client.isAuthorized(options.resource, options.action, { context: { resource: resolvedResource ?? void 0 } }, request);
+		require_debug.debugGrant("Next", {
+			resource: options.resource,
+			action: options.action,
+			authorized: result.authorized,
+			...result.authorized ? {} : { reason: result.reason }
+		});
+		if (!result.authorized) return next_server.NextResponse.json({
+			error: "Forbidden",
+			code: "FORBIDDEN",
+			reason: result.reason
+		}, { status: 403 });
+		return handler(request, { authorization: result });
+	};
 }
-exports.GrantClient = grantClient.GrantClient;
-exports.AuthenticationError = index.AuthenticationError;
-exports.AuthorizationError = index.AuthorizationError;
-exports.BadRequestError = index.BadRequestError;
-exports.NotFoundError = index.NotFoundError;
+//#endregion
+exports.AuthenticationError = require_errors.AuthenticationError;
+exports.AuthorizationError = require_errors.AuthorizationError;
+exports.BadRequestError = require_errors.BadRequestError;
+exports.GrantClient = require_grant_client.GrantClient;
+exports.NotFoundError = require_errors.NotFoundError;
 exports.withGrant = withGrant;
-//# sourceMappingURL=next.cjs.map
+
+//# sourceMappingURL=next.cjs.map

package/dist/next.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"next.cjs","sources":["../src/next/with-grant.ts"],"sourcesContent":["import { NextRequest, NextResponse } from 'next/server';\n\nimport { GrantClient } from '../grant-client';\nimport { debugGrant } from '../utils/debug';\nimport { extractTokenFromRequest } from '../utils/token-extractor';\n\nimport type { ResourceResolver, AuthorizationResult } from '../types';\n\n/**\n * Options for Next.js route handler guard\n */\nexport interface GrantOptions {\n  /** The resource slug to check (e.g., \"Organization\", \"Project\", \"Document\") */\n  resource: string;\n  /** The action to check (e.g., \"Query\", \"Create\", \"Update\", \"Delete\") */\n  action: string;\n  /** Custom resource resolver for condition evaluation */\n  resourceResolver?: ResourceResolver;\n}\n\n/**\n * Context passed to the handler after authorization (for downstream use)\n */\nexport interface WithGrantContext {\n  authorization: AuthorizationResult;\n}\n\n/**\n * Next.js App Router route handler type (GET, POST, etc.)\n * Second argument is optional context; params are in the request URL for resolver use.\n */\nexport type GrantRouteHandler = (\n  request: NextRequest,\n  context?: WithGrantContext\n) => Promise<Response> | Response;\n\n/**\n * Wrap a Next.js App Router route handler with Grant authorization.\n * Use for GET, POST, PUT, PATCH, DELETE in app/api/.../route.ts.\n *\n * Compatible with Next.js 13–16. In Next 15+, the route context's `params` is a Promise;\n * this wrapper does not use params (only `request` is passed to the resolver/handler).\n *\n * @example\n * ```ts\n * // app/api/documents/route.ts\n * import { withGrant } from '@grantjs/server/next';\n * import { GrantClient } from '@grantjs/server';\n *\n * const grantClient = new GrantClient({ apiUrl: process.env.GRANT_API_URL! });\n *\n * export const GET = withGrant(\n *   grantClient,\n *   { resource: 'Document', action: 'Query' },\n *   async (request) => NextResponse.json({ data: [] })\n * );\n *\n * export const POST = withGrant(\n *   grantClient,\n *   { resource: 'Document', action: 'Create' },\n *   async (request) => { ... }\n * );\n * ```\n */\nexport function withGrant(\n  client: GrantClient,\n  options: GrantOptions,\n  handler: GrantRouteHandler\n): (\n  request: NextRequest,\n  context?: { params?: Promise<Record<string, string>> }\n) => Promise<Response> {\n  return async (\n    request: NextRequest,\n    _routeContext?: { params?: Promise<Record<string, string>> }\n  ): Promise<Response> => {\n    debugGrant('Next', { resource: options.resource, action: options.action });\n\n    const token = await extractTokenFromRequest(request, client.config);\n    if (!token) {\n      return NextResponse.json({ error: 'Unauthorized', code: 'UNAUTHENTICATED' }, { status: 401 });\n    }\n\n    let resolvedResource: Record<string, unknown> | null = null;\n\n    if (options.resourceResolver) {\n      resolvedResource = await options.resourceResolver({\n        resourceSlug: options.resource,\n        request,\n      });\n      if (!resolvedResource) {\n        return NextResponse.json(\n          { error: 'Resource not found', code: 'NOT_FOUND' },\n          { status: 404 }\n        );\n      }\n    }\n\n    const result = await client.isAuthorized(\n      options.resource,\n      options.action,\n      {\n        context: {\n          resource: resolvedResource ?? undefined,\n        },\n      },\n      request\n    );\n\n    debugGrant('Next', {\n      resource: options.resource,\n      action: options.action,\n      authorized: result.authorized,\n      ...(result.authorized ? {} : { reason: result.reason }),\n    });\n\n    if (!result.authorized) {\n      return NextResponse.json(\n        {\n          error: 'Forbidden',\n          code: 'FORBIDDEN',\n          reason: result.reason,\n        },\n        { status: 403 }\n      );\n    }\n\n    return handler(request, { authorization: result });\n  };\n}\n"],"names":["debugGrant","extractTokenFromRequest","NextResponse"],"mappings":";;;;;;AAgEO,SAAS,UACd,QACA,SACA,SAIqB;AACrB,SAAO,OACL,SACA,kBACsB;AACtBA,qBAAW,QAAQ,EAAE,UAAU,QAAQ,UAAU,QAAQ,QAAQ,QAAQ;AAEzE,UAAM,QAAQ,MAAMC,YAAAA,wBAAwB,SAAS,OAAO,MAAM;AAClE,QAAI,CAAC,OAAO;AACV,aAAOC,oBAAa,KAAK,EAAE,OAAO,gBAAgB,MAAM,qBAAqB,EAAE,QAAQ,KAAK;AAAA,IAC9F;AAEA,QAAI,mBAAmD;AAEvD,QAAI,QAAQ,kBAAkB;AAC5B,yBAAmB,MAAM,QAAQ,iBAAiB;AAAA,QAChD,cAAc,QAAQ;AAAA,QACtB;AAAA,MAAA,CACD;AACD,UAAI,CAAC,kBAAkB;AACrB,eAAOA,OAAAA,aAAa;AAAA,UAClB,EAAE,OAAO,sBAAsB,MAAM,YAAA;AAAA,UACrC,EAAE,QAAQ,IAAA;AAAA,QAAI;AAAA,MAElB;AAAA,IACF;AAEA,UAAM,SAAS,MAAM,OAAO;AAAA,MAC1B,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR;AAAA,QACE,SAAS;AAAA,UACP,UAAU,oBAAoB;AAAA,QAAA;AAAA,MAChC;AAAA,MAEF;AAAA,IAAA;AAGFF,UAAAA,WAAW,QAAQ;AAAA,MACjB,UAAU,QAAQ;AAAA,MAClB,QAAQ,QAAQ;AAAA,MAChB,YAAY,OAAO;AAAA,MACnB,GAAI,OAAO,aAAa,CAAA,IAAK,EAAE,QAAQ,OAAO,OAAA;AAAA,IAAO,CACtD;AAED,QAAI,CAAC,OAAO,YAAY;AACtB,aAAOE,OAAAA,aAAa;AAAA,QAClB;AAAA,UACE,OAAO;AAAA,UACP,MAAM;AAAA,UACN,QAAQ,OAAO;AAAA,QAAA;AAAA,QAEjB,EAAE,QAAQ,IAAA;AAAA,MAAI;AAAA,IAElB;AAEA,WAAO,QAAQ,SAAS,EAAE,eAAe,QAAQ;AAAA,EACnD;AACF;;;;;;;"}
+{"version":3,"file":"next.cjs","names":[],"sources":["../src/next/with-grant.ts"],"sourcesContent":["import { NextRequest, NextResponse } from 'next/server';\n\nimport { GrantClient } from '../grant-client';\nimport type { AuthorizationResult, ResourceResolver } from '../types';\nimport { debugGrant } from '../utils/debug';\nimport { extractTokenFromRequest } from '../utils/token-extractor';\n\n/**\n * Options for Next.js route handler guard\n */\nexport interface GrantOptions {\n  /** The resource slug to check (e.g., \"Organization\", \"Project\", \"Document\") */\n  resource: string;\n  /** The action to check (e.g., \"Query\", \"Create\", \"Update\", \"Delete\") */\n  action: string;\n  /** Custom resource resolver for condition evaluation */\n  resourceResolver?: ResourceResolver;\n}\n\n/**\n * Context passed to the handler after authorization (for downstream use)\n */\nexport interface WithGrantContext {\n  authorization: AuthorizationResult;\n}\n\n/**\n * Next.js App Router route handler type (GET, POST, etc.)\n * Second argument is optional context; params are in the request URL for resolver use.\n */\nexport type GrantRouteHandler = (\n  request: NextRequest,\n  context?: WithGrantContext\n) => Promise<Response> | Response;\n\n/**\n * Wrap a Next.js App Router route handler with Grant authorization.\n * Use for GET, POST, PUT, PATCH, DELETE in app/api/.../route.ts.\n *\n * Compatible with Next.js 13–16. In Next 15+, the route context's `params` is a Promise;\n * this wrapper does not use params (only `request` is passed to the resolver/handler).\n *\n * @example\n * ```ts\n * // app/api/documents/route.ts\n * import { withGrant } from '@grantjs/server/next';\n * import { GrantClient } from '@grantjs/server';\n *\n * const grantClient = new GrantClient({ apiUrl: process.env.GRANT_API_URL! });\n *\n * export const GET = withGrant(\n *   grantClient,\n *   { resource: 'Document', action: 'Query' },\n *   async (request) => NextResponse.json({ data: [] })\n * );\n *\n * export const POST = withGrant(\n *   grantClient,\n *   { resource: 'Document', action: 'Create' },\n *   async (request) => { ... }\n * );\n * ```\n */\nexport function withGrant(\n  client: GrantClient,\n  options: GrantOptions,\n  handler: GrantRouteHandler\n): (\n  request: NextRequest,\n  context?: { params?: Promise<Record<string, string>> }\n) => Promise<Response> {\n  return async (\n    request: NextRequest,\n    _routeContext?: { params?: Promise<Record<string, string>> }\n  ): Promise<Response> => {\n    debugGrant('Next', { resource: options.resource, action: options.action });\n\n    const token = await extractTokenFromRequest(request, client.config);\n    if (!token) {\n      return NextResponse.json({ error: 'Unauthorized', code: 'UNAUTHENTICATED' }, { status: 401 });\n    }\n\n    let resolvedResource: Record<string, unknown> | null = null;\n\n    if (options.resourceResolver) {\n      resolvedResource = await options.resourceResolver({\n        resourceSlug: options.resource,\n        request,\n      });\n      if (!resolvedResource) {\n        return NextResponse.json(\n          { error: 'Resource not found', code: 'NOT_FOUND' },\n          { status: 404 }\n        );\n      }\n    }\n\n    const result = await client.isAuthorized(\n      options.resource,\n      options.action,\n      {\n        context: {\n          resource: resolvedResource ?? undefined,\n        },\n      },\n      request\n    );\n\n    debugGrant('Next', {\n      resource: options.resource,\n      action: options.action,\n      authorized: result.authorized,\n      ...(result.authorized ? {} : { reason: result.reason }),\n    });\n\n    if (!result.authorized) {\n      return NextResponse.json(\n        {\n          error: 'Forbidden',\n          code: 'FORBIDDEN',\n          reason: result.reason,\n        },\n        { status: 403 }\n      );\n    }\n\n    return handler(request, { authorization: result });\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA+DA,SAAgB,UACd,QACA,SACA,SAIqB;AACrB,QAAO,OACL,SACA,kBACsB;AACtB,gBAAA,WAAW,QAAQ;GAAE,UAAU,QAAQ;GAAU,QAAQ,QAAQ;GAAQ,CAAC;AAG1E,MAAI,CAAC,MADe,qBAAA,wBAAwB,SAAS,OAAO,OAAO,CAEjE,QAAO,YAAA,aAAa,KAAK;GAAE,OAAO;GAAgB,MAAM;GAAmB,EAAE,EAAE,QAAQ,KAAK,CAAC;EAG/F,IAAI,mBAAmD;AAEvD,MAAI,QAAQ,kBAAkB;AAC5B,sBAAmB,MAAM,QAAQ,iBAAiB;IAChD,cAAc,QAAQ;IACtB;IACD,CAAC;AACF,OAAI,CAAC,iBACH,QAAO,YAAA,aAAa,KAClB;IAAE,OAAO;IAAsB,MAAM;IAAa,EAClD,EAAE,QAAQ,KAAK,CAChB;;EAIL,MAAM,SAAS,MAAM,OAAO,aAC1B,QAAQ,UACR,QAAQ,QACR,EACE,SAAS,EACP,UAAU,oBAAoB,KAAA,GAC/B,EACF,EACD,QACD;AAED,gBAAA,WAAW,QAAQ;GACjB,UAAU,QAAQ;GAClB,QAAQ,QAAQ;GAChB,YAAY,OAAO;GACnB,GAAI,OAAO,aAAa,EAAE,GAAG,EAAE,QAAQ,OAAO,QAAQ;GACvD,CAAC;AAEF,MAAI,CAAC,OAAO,WACV,QAAO,YAAA,aAAa,KAClB;GACE,OAAO;GACP,MAAM;GACN,QAAQ,OAAO;GAChB,EACD,EAAE,QAAQ,KAAK,CAChB;AAGH,SAAO,QAAQ,SAAS,EAAE,eAAe,QAAQ,CAAC"}