@grantjs/server 1.0.0 → 1.1.0

package/dist/next.mjs

@@ -1,63 +1,73 @@
+import { i as extractTokenFromRequest, t as GrantClient } from "./grant-client-t3KadxFo.js";
+import { a as NotFoundError, n as AuthorizationError, r as BadRequestError, t as AuthenticationError } from "./errors-CSC_Z_KP.js";
+import { t as debugGrant } from "./debug-DICR8lwQ.js";
 import { NextResponse } from "next/server";
-import { d as debugGrant } from "./debug-C8ibbrE5.js";
-import { e as extractTokenFromRequest } from "./grant-client-D1LZI2f4.js";
-import { G } from "./grant-client-D1LZI2f4.js";
-import { AuthenticationError, AuthorizationError, BadRequestError, NotFoundError } from "./index.mjs";
+//#region src/next/with-grant.ts
+/**
+* Wrap a Next.js App Router route handler with Grant authorization.
+* Use for GET, POST, PUT, PATCH, DELETE in app/api/.../route.ts.
+*
+* Compatible with Next.js 13–16. In Next 15+, the route context's `params` is a Promise;
+* this wrapper does not use params (only `request` is passed to the resolver/handler).
+*
+* @example
+* ```ts
+* // app/api/documents/route.ts
+* import { withGrant } from '@grantjs/server/next';
+* import { GrantClient } from '@grantjs/server';
+*
+* const grantClient = new GrantClient({ apiUrl: process.env.GRANT_API_URL! });
+*
+* export const GET = withGrant(
+*   grantClient,
+*   { resource: 'Document', action: 'Query' },
+*   async (request) => NextResponse.json({ data: [] })
+* );
+*
+* export const POST = withGrant(
+*   grantClient,
+*   { resource: 'Document', action: 'Create' },
+*   async (request) => { ... }
+* );
+* ```
+*/
 function withGrant(client, options, handler) {
-  return async (request, _routeContext) => {
-    debugGrant("Next", { resource: options.resource, action: options.action });
-    const token = await extractTokenFromRequest(request, client.config);
-    if (!token) {
-      return NextResponse.json({ error: "Unauthorized", code: "UNAUTHENTICATED" }, { status: 401 });
-    }
-    let resolvedResource = null;
-    if (options.resourceResolver) {
-      resolvedResource = await options.resourceResolver({
-        resourceSlug: options.resource,
-        request
-      });
-      if (!resolvedResource) {
-        return NextResponse.json(
-          { error: "Resource not found", code: "NOT_FOUND" },
-          { status: 404 }
-        );
-      }
-    }
-    const result = await client.isAuthorized(
-      options.resource,
-      options.action,
-      {
-        context: {
-          resource: resolvedResource ?? void 0
-        }
-      },
-      request
-    );
-    debugGrant("Next", {
-      resource: options.resource,
-      action: options.action,
-      authorized: result.authorized,
-      ...result.authorized ? {} : { reason: result.reason }
-    });
-    if (!result.authorized) {
-      return NextResponse.json(
-        {
-          error: "Forbidden",
-          code: "FORBIDDEN",
-          reason: result.reason
-        },
-        { status: 403 }
-      );
-    }
-    return handler(request, { authorization: result });
-  };
+	return async (request, _routeContext) => {
+		debugGrant("Next", {
+			resource: options.resource,
+			action: options.action
+		});
+		if (!await extractTokenFromRequest(request, client.config)) return NextResponse.json({
+			error: "Unauthorized",
+			code: "UNAUTHENTICATED"
+		}, { status: 401 });
+		let resolvedResource = null;
+		if (options.resourceResolver) {
+			resolvedResource = await options.resourceResolver({
+				resourceSlug: options.resource,
+				request
+			});
+			if (!resolvedResource) return NextResponse.json({
+				error: "Resource not found",
+				code: "NOT_FOUND"
+			}, { status: 404 });
+		}
+		const result = await client.isAuthorized(options.resource, options.action, { context: { resource: resolvedResource ?? void 0 } }, request);
+		debugGrant("Next", {
+			resource: options.resource,
+			action: options.action,
+			authorized: result.authorized,
+			...result.authorized ? {} : { reason: result.reason }
+		});
+		if (!result.authorized) return NextResponse.json({
+			error: "Forbidden",
+			code: "FORBIDDEN",
+			reason: result.reason
+		}, { status: 403 });
+		return handler(request, { authorization: result });
+	};
 }
-export {
-  AuthenticationError,
-  AuthorizationError,
-  BadRequestError,
-  G as GrantClient,
-  NotFoundError,
-  withGrant
-};
-//# sourceMappingURL=next.mjs.map
+//#endregion
+export { AuthenticationError, AuthorizationError, BadRequestError, GrantClient, NotFoundError, withGrant };
+
+//# sourceMappingURL=next.mjs.map

package/dist/next.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"next.mjs","sources":["../src/next/with-grant.ts"],"sourcesContent":["import { NextRequest, NextResponse } from 'next/server';\n\nimport { GrantClient } from '../grant-client';\nimport { debugGrant } from '../utils/debug';\nimport { extractTokenFromRequest } from '../utils/token-extractor';\n\nimport type { ResourceResolver, AuthorizationResult } from '../types';\n\n/**\n * Options for Next.js route handler guard\n */\nexport interface GrantOptions {\n  /** The resource slug to check (e.g., \"Organization\", \"Project\", \"Document\") */\n  resource: string;\n  /** The action to check (e.g., \"Query\", \"Create\", \"Update\", \"Delete\") */\n  action: string;\n  /** Custom resource resolver for condition evaluation */\n  resourceResolver?: ResourceResolver;\n}\n\n/**\n * Context passed to the handler after authorization (for downstream use)\n */\nexport interface WithGrantContext {\n  authorization: AuthorizationResult;\n}\n\n/**\n * Next.js App Router route handler type (GET, POST, etc.)\n * Second argument is optional context; params are in the request URL for resolver use.\n */\nexport type GrantRouteHandler = (\n  request: NextRequest,\n  context?: WithGrantContext\n) => Promise<Response> | Response;\n\n/**\n * Wrap a Next.js App Router route handler with Grant authorization.\n * Use for GET, POST, PUT, PATCH, DELETE in app/api/.../route.ts.\n *\n * Compatible with Next.js 13–16. In Next 15+, the route context's `params` is a Promise;\n * this wrapper does not use params (only `request` is passed to the resolver/handler).\n *\n * @example\n * ```ts\n * // app/api/documents/route.ts\n * import { withGrant } from '@grantjs/server/next';\n * import { GrantClient } from '@grantjs/server';\n *\n * const grantClient = new GrantClient({ apiUrl: process.env.GRANT_API_URL! });\n *\n * export const GET = withGrant(\n *   grantClient,\n *   { resource: 'Document', action: 'Query' },\n *   async (request) => NextResponse.json({ data: [] })\n * );\n *\n * export const POST = withGrant(\n *   grantClient,\n *   { resource: 'Document', action: 'Create' },\n *   async (request) => { ... }\n * );\n * ```\n */\nexport function withGrant(\n  client: GrantClient,\n  options: GrantOptions,\n  handler: GrantRouteHandler\n): (\n  request: NextRequest,\n  context?: { params?: Promise<Record<string, string>> }\n) => Promise<Response> {\n  return async (\n    request: NextRequest,\n    _routeContext?: { params?: Promise<Record<string, string>> }\n  ): Promise<Response> => {\n    debugGrant('Next', { resource: options.resource, action: options.action });\n\n    const token = await extractTokenFromRequest(request, client.config);\n    if (!token) {\n      return NextResponse.json({ error: 'Unauthorized', code: 'UNAUTHENTICATED' }, { status: 401 });\n    }\n\n    let resolvedResource: Record<string, unknown> | null = null;\n\n    if (options.resourceResolver) {\n      resolvedResource = await options.resourceResolver({\n        resourceSlug: options.resource,\n        request,\n      });\n      if (!resolvedResource) {\n        return NextResponse.json(\n          { error: 'Resource not found', code: 'NOT_FOUND' },\n          { status: 404 }\n        );\n      }\n    }\n\n    const result = await client.isAuthorized(\n      options.resource,\n      options.action,\n      {\n        context: {\n          resource: resolvedResource ?? undefined,\n        },\n      },\n      request\n    );\n\n    debugGrant('Next', {\n      resource: options.resource,\n      action: options.action,\n      authorized: result.authorized,\n      ...(result.authorized ? {} : { reason: result.reason }),\n    });\n\n    if (!result.authorized) {\n      return NextResponse.json(\n        {\n          error: 'Forbidden',\n          code: 'FORBIDDEN',\n          reason: result.reason,\n        },\n        { status: 403 }\n      );\n    }\n\n    return handler(request, { authorization: result });\n  };\n}\n"],"names":[],"mappings":";;;;;AAgEO,SAAS,UACd,QACA,SACA,SAIqB;AACrB,SAAO,OACL,SACA,kBACsB;AACtB,eAAW,QAAQ,EAAE,UAAU,QAAQ,UAAU,QAAQ,QAAQ,QAAQ;AAEzE,UAAM,QAAQ,MAAM,wBAAwB,SAAS,OAAO,MAAM;AAClE,QAAI,CAAC,OAAO;AACV,aAAO,aAAa,KAAK,EAAE,OAAO,gBAAgB,MAAM,qBAAqB,EAAE,QAAQ,KAAK;AAAA,IAC9F;AAEA,QAAI,mBAAmD;AAEvD,QAAI,QAAQ,kBAAkB;AAC5B,yBAAmB,MAAM,QAAQ,iBAAiB;AAAA,QAChD,cAAc,QAAQ;AAAA,QACtB;AAAA,MAAA,CACD;AACD,UAAI,CAAC,kBAAkB;AACrB,eAAO,aAAa;AAAA,UAClB,EAAE,OAAO,sBAAsB,MAAM,YAAA;AAAA,UACrC,EAAE,QAAQ,IAAA;AAAA,QAAI;AAAA,MAElB;AAAA,IACF;AAEA,UAAM,SAAS,MAAM,OAAO;AAAA,MAC1B,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR;AAAA,QACE,SAAS;AAAA,UACP,UAAU,oBAAoB;AAAA,QAAA;AAAA,MAChC;AAAA,MAEF;AAAA,IAAA;AAGF,eAAW,QAAQ;AAAA,MACjB,UAAU,QAAQ;AAAA,MAClB,QAAQ,QAAQ;AAAA,MAChB,YAAY,OAAO;AAAA,MACnB,GAAI,OAAO,aAAa,CAAA,IAAK,EAAE,QAAQ,OAAO,OAAA;AAAA,IAAO,CACtD;AAED,QAAI,CAAC,OAAO,YAAY;AACtB,aAAO,aAAa;AAAA,QAClB;AAAA,UACE,OAAO;AAAA,UACP,MAAM;AAAA,UACN,QAAQ,OAAO;AAAA,QAAA;AAAA,QAEjB,EAAE,QAAQ,IAAA;AAAA,MAAI;AAAA,IAElB;AAEA,WAAO,QAAQ,SAAS,EAAE,eAAe,QAAQ;AAAA,EACnD;AACF;"}
+{"version":3,"file":"next.mjs","names":[],"sources":["../src/next/with-grant.ts"],"sourcesContent":["import { NextRequest, NextResponse } from 'next/server';\n\nimport { GrantClient } from '../grant-client';\nimport type { AuthorizationResult, ResourceResolver } from '../types';\nimport { debugGrant } from '../utils/debug';\nimport { extractTokenFromRequest } from '../utils/token-extractor';\n\n/**\n * Options for Next.js route handler guard\n */\nexport interface GrantOptions {\n  /** The resource slug to check (e.g., \"Organization\", \"Project\", \"Document\") */\n  resource: string;\n  /** The action to check (e.g., \"Query\", \"Create\", \"Update\", \"Delete\") */\n  action: string;\n  /** Custom resource resolver for condition evaluation */\n  resourceResolver?: ResourceResolver;\n}\n\n/**\n * Context passed to the handler after authorization (for downstream use)\n */\nexport interface WithGrantContext {\n  authorization: AuthorizationResult;\n}\n\n/**\n * Next.js App Router route handler type (GET, POST, etc.)\n * Second argument is optional context; params are in the request URL for resolver use.\n */\nexport type GrantRouteHandler = (\n  request: NextRequest,\n  context?: WithGrantContext\n) => Promise<Response> | Response;\n\n/**\n * Wrap a Next.js App Router route handler with Grant authorization.\n * Use for GET, POST, PUT, PATCH, DELETE in app/api/.../route.ts.\n *\n * Compatible with Next.js 13–16. In Next 15+, the route context's `params` is a Promise;\n * this wrapper does not use params (only `request` is passed to the resolver/handler).\n *\n * @example\n * ```ts\n * // app/api/documents/route.ts\n * import { withGrant } from '@grantjs/server/next';\n * import { GrantClient } from '@grantjs/server';\n *\n * const grantClient = new GrantClient({ apiUrl: process.env.GRANT_API_URL! });\n *\n * export const GET = withGrant(\n *   grantClient,\n *   { resource: 'Document', action: 'Query' },\n *   async (request) => NextResponse.json({ data: [] })\n * );\n *\n * export const POST = withGrant(\n *   grantClient,\n *   { resource: 'Document', action: 'Create' },\n *   async (request) => { ... }\n * );\n * ```\n */\nexport function withGrant(\n  client: GrantClient,\n  options: GrantOptions,\n  handler: GrantRouteHandler\n): (\n  request: NextRequest,\n  context?: { params?: Promise<Record<string, string>> }\n) => Promise<Response> {\n  return async (\n    request: NextRequest,\n    _routeContext?: { params?: Promise<Record<string, string>> }\n  ): Promise<Response> => {\n    debugGrant('Next', { resource: options.resource, action: options.action });\n\n    const token = await extractTokenFromRequest(request, client.config);\n    if (!token) {\n      return NextResponse.json({ error: 'Unauthorized', code: 'UNAUTHENTICATED' }, { status: 401 });\n    }\n\n    let resolvedResource: Record<string, unknown> | null = null;\n\n    if (options.resourceResolver) {\n      resolvedResource = await options.resourceResolver({\n        resourceSlug: options.resource,\n        request,\n      });\n      if (!resolvedResource) {\n        return NextResponse.json(\n          { error: 'Resource not found', code: 'NOT_FOUND' },\n          { status: 404 }\n        );\n      }\n    }\n\n    const result = await client.isAuthorized(\n      options.resource,\n      options.action,\n      {\n        context: {\n          resource: resolvedResource ?? undefined,\n        },\n      },\n      request\n    );\n\n    debugGrant('Next', {\n      resource: options.resource,\n      action: options.action,\n      authorized: result.authorized,\n      ...(result.authorized ? {} : { reason: result.reason }),\n    });\n\n    if (!result.authorized) {\n      return NextResponse.json(\n        {\n          error: 'Forbidden',\n          code: 'FORBIDDEN',\n          reason: result.reason,\n        },\n        { status: 403 }\n      );\n    }\n\n    return handler(request, { authorization: result });\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA+DA,SAAgB,UACd,QACA,SACA,SAIqB;AACrB,QAAO,OACL,SACA,kBACsB;AACtB,aAAW,QAAQ;GAAE,UAAU,QAAQ;GAAU,QAAQ,QAAQ;GAAQ,CAAC;AAG1E,MAAI,CAAC,MADe,wBAAwB,SAAS,OAAO,OAAO,CAEjE,QAAO,aAAa,KAAK;GAAE,OAAO;GAAgB,MAAM;GAAmB,EAAE,EAAE,QAAQ,KAAK,CAAC;EAG/F,IAAI,mBAAmD;AAEvD,MAAI,QAAQ,kBAAkB;AAC5B,sBAAmB,MAAM,QAAQ,iBAAiB;IAChD,cAAc,QAAQ;IACtB;IACD,CAAC;AACF,OAAI,CAAC,iBACH,QAAO,aAAa,KAClB;IAAE,OAAO;IAAsB,MAAM;IAAa,EAClD,EAAE,QAAQ,KAAK,CAChB;;EAIL,MAAM,SAAS,MAAM,OAAO,aAC1B,QAAQ,UACR,QAAQ,QACR,EACE,SAAS,EACP,UAAU,oBAAoB,KAAA,GAC/B,EACF,EACD,QACD;AAED,aAAW,QAAQ;GACjB,UAAU,QAAQ;GAClB,QAAQ,QAAQ;GAChB,YAAY,OAAO;GACnB,GAAI,OAAO,aAAa,EAAE,GAAG,EAAE,QAAQ,OAAO,QAAQ;GACvD,CAAC;AAEF,MAAI,CAAC,OAAO,WACV,QAAO,aAAa,KAClB;GACE,OAAO;GACP,MAAM;GACN,QAAQ,OAAO;GAChB,EACD,EAAE,QAAQ,KAAK,CAChB;AAGH,SAAO,QAAQ,SAAS,EAAE,eAAe,QAAQ,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@grantjs/server",
-  "version": "1.0.0",
+  "version": "1.1.0",
   "description": "Server SDK for Grant authorization - Middleware and guards for Express, Fastify, NestJS, and Next.js",
   "type": "module",
   "main": "./dist/index.cjs",
@@ -57,13 +57,13 @@
     "server"
   ],
   "author": {
-    "name": "Alejandro Heredia",
-    "email": "ale@logus.graphics",
-    "url": "https://logus.graphics"
+    "name": "Ale Heredia",
+    "email": "ale@grantjs.org",
+    "url": "https://grantjs.org"
   },
   "repository": {
     "type": "git",
-    "url": "https://github.com/logusgraphics/grant.git",
+    "url": "https://github.com/grant-js/grant.git",
     "directory": "packages/@grantjs/server"
   },
   "license": "MIT",
@@ -72,22 +72,22 @@
     "registry": "https://registry.npmjs.org/"
   },
   "dependencies": {
-    "@grantjs/schema": "1.0.0"
+    "@grantjs/schema": "1.1.0"
   },
   "devDependencies": {
     "@types/express": "^5.0.0",
-    "@types/node": "^24.7.2",
-    "@vitest/coverage-v8": "^3.2.4",
-    "eslint": "^9.37.0",
+    "@types/node": "^25.6.0",
+    "@vitest/coverage-v8": "^4.1.5",
+    "eslint": "^10.3.0",
     "express": "^5.1.0",
-    "fastify": "^5.7.2",
-    "next": "^16.0.0",
-    "@nestjs/common": "^11.0.0",
-    "@nestjs/core": "^11.0.0",
-    "typescript": "^5",
-    "vite": "^6.0.0",
-    "vite-plugin-dts": "^4.3.0",
-    "vitest": "^3.2.4"
+    "fastify": "^5.8.5",
+    "next": "^16.2.4",
+    "@nestjs/common": "^11.1.19",
+    "@nestjs/core": "^11.1.19",
+    "typescript": "^6",
+    "vite": "^8.0.10",
+    "vite-plugin-dts": "^5.0.0",
+    "vitest": "^4.1.5"
   },
   "peerDependencies": {
     "express": "^4 || ^5",

package/dist/debug-C8ibbrE5.js

@@ -1,9 +0,0 @@
-const DEBUG_GRANT_ENV = "DEBUG_GRANT";
-function debugGrant(integration, data) {
-  if (process.env[DEBUG_GRANT_ENV] !== "1") return;
-  console.debug(`[Grant ${integration}]`, data);
-}
-export {
-  debugGrant as d
-};
-//# sourceMappingURL=debug-C8ibbrE5.js.map

package/dist/debug-C8ibbrE5.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"debug-C8ibbrE5.js","sources":["../src/utils/debug.ts"],"sourcesContent":["const DEBUG_GRANT_ENV = 'DEBUG_GRANT';\n\n/** Whether Grant debug logging is enabled (set DEBUG_GRANT=1 in development). */\nexport function isDebugGrant(): boolean {\n  return process.env[DEBUG_GRANT_ENV] === '1';\n}\n\n/**\n * Log Grant integration debug info when DEBUG_GRANT=1.\n * Used by Express middleware, Fastify grant hook, Next withGrant, and Nest GrantGuard.\n * Set DEBUG_GRANT=1 in .env or the environment to see resource, action, and outcome in development.\n */\nexport function debugGrant(integration: string, data: Record<string, unknown>): void {\n  if (process.env[DEBUG_GRANT_ENV] !== '1') return;\n  console.debug(`[Grant ${integration}]`, data);\n}\n"],"names":[],"mappings":"AAAA,MAAM,kBAAkB;AAYjB,SAAS,WAAW,aAAqB,MAAqC;AACnF,MAAI,QAAQ,IAAI,eAAe,MAAM,IAAK;AAC1C,UAAQ,MAAM,UAAU,WAAW,KAAK,IAAI;AAC9C;"}

package/dist/debug-Crb5gNDM.cjs

@@ -1,8 +0,0 @@
-"use strict";
-const DEBUG_GRANT_ENV = "DEBUG_GRANT";
-function debugGrant(integration, data) {
-  if (process.env[DEBUG_GRANT_ENV] !== "1") return;
-  console.debug(`[Grant ${integration}]`, data);
-}
-exports.debugGrant = debugGrant;
-//# sourceMappingURL=debug-Crb5gNDM.cjs.map

package/dist/debug-Crb5gNDM.cjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"debug-Crb5gNDM.cjs","sources":["../src/utils/debug.ts"],"sourcesContent":["const DEBUG_GRANT_ENV = 'DEBUG_GRANT';\n\n/** Whether Grant debug logging is enabled (set DEBUG_GRANT=1 in development). */\nexport function isDebugGrant(): boolean {\n  return process.env[DEBUG_GRANT_ENV] === '1';\n}\n\n/**\n * Log Grant integration debug info when DEBUG_GRANT=1.\n * Used by Express middleware, Fastify grant hook, Next withGrant, and Nest GrantGuard.\n * Set DEBUG_GRANT=1 in .env or the environment to see resource, action, and outcome in development.\n */\nexport function debugGrant(integration: string, data: Record<string, unknown>): void {\n  if (process.env[DEBUG_GRANT_ENV] !== '1') return;\n  console.debug(`[Grant ${integration}]`, data);\n}\n"],"names":[],"mappings":";AAAA,MAAM,kBAAkB;AAYjB,SAAS,WAAW,aAAqB,MAAqC;AACnF,MAAI,QAAQ,IAAI,eAAe,MAAM,IAAK;AAC1C,UAAQ,MAAM,UAAU,WAAW,KAAK,IAAI;AAC9C;;"}

package/dist/grant-client-D1LZI2f4.js

@@ -1,180 +0,0 @@
-var __defProp = Object.defineProperty;
-var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
-var __publicField = (obj, key, value) => __defNormalProp(obj, typeof key !== "symbol" ? key + "" : key, value);
-function extractBearerToken(authHeader) {
-  if (!authHeader) return null;
-  const parts = authHeader.trim().split(/\s+/);
-  if (parts.length !== 2 || parts[0].toLowerCase() !== "bearer") {
-    return null;
-  }
-  return parts[1];
-}
-function parseCookieHeader(cookieHeader) {
-  const cookies = {};
-  cookieHeader.split(";").forEach((cookie) => {
-    const [name, ...rest] = cookie.trim().split("=");
-    if (name && rest.length > 0) {
-      cookies[name.trim()] = rest.join("=").trim();
-    }
-  });
-  return cookies;
-}
-function extractTokenFromCookies(cookieHeader, cookieName) {
-  if (!cookieHeader) return null;
-  const cookies = parseCookieHeader(cookieHeader);
-  return cookies[cookieName] || null;
-}
-async function extractTokenFromRequest(request, config) {
-  if (config.getToken) {
-    const token = await config.getToken(request);
-    if (token) return token;
-  }
-  const req = request;
-  if (!req?.headers) return null;
-  const headersGet = req.headers.get;
-  if (typeof headersGet === "function") {
-    const authHeader2 = headersGet.call(req.headers, "authorization");
-    const bearerToken2 = extractBearerToken(authHeader2 ?? void 0);
-    if (bearerToken2) return bearerToken2;
-    const cookieName2 = config.cookieName || "grant-access-token";
-    const cookieHeader2 = headersGet.call(req.headers, "cookie");
-    if (cookieHeader2) {
-      const cookieToken = extractTokenFromCookies(cookieHeader2, cookieName2);
-      if (cookieToken) return cookieToken;
-    }
-    return null;
-  }
-  const plainHeaders = req.headers;
-  const authHeader = plainHeaders.authorization;
-  const bearerToken = extractBearerToken(authHeader);
-  if (bearerToken) return bearerToken;
-  const cookieName = config.cookieName || "grant-access-token";
-  if (req.cookies?.[cookieName]) {
-    return req.cookies[cookieName];
-  }
-  const cookieHeader = plainHeaders.cookie;
-  if (cookieHeader) {
-    const cookieToken = extractTokenFromCookies(cookieHeader, cookieName);
-    if (cookieToken) return cookieToken;
-  }
-  return null;
-}
-class GrantClient {
-  constructor(config) {
-    __publicField(this, "config");
-    this.config = config;
-  }
-  // ============================================================================
-  // Public API - Permission Checks
-  // ============================================================================
-  /**
-   * Check if the current user has a specific permission
-   *
-   * @example
-   * ```ts
-   * const canEdit = await grant.isGranted('document', 'update', { scope });
-   * if (canEdit) {
-   *   // Proceed with operation
-   * }
-   * ```
-   */
-  async isGranted(resource, action, options, request) {
-    const result = await this.isAuthorized(resource, action, options, request);
-    return result.authorized;
-  }
-  /**
-   * Check authorization with full result details
-   *
-   * @example
-   * ```ts
-   * const result = await grant.isAuthorized('document', 'update', { scope }, request);
-   * if (!result.authorized) {
-   *   console.log('Denied:', result.reason);
-   * }
-   * ```
-   */
-  async isAuthorized(resource, action, options, request) {
-    try {
-      const response = await this.fetchWithAuth(
-        "/api/auth/is-authorized",
-        {
-          method: "POST",
-          body: JSON.stringify({
-            permission: {
-              resource,
-              action
-            },
-            context: {
-              resource: options?.context?.resource || null
-            }
-          })
-        },
-        request
-      );
-      if (!response.ok) {
-        const error = await response.json().catch(() => ({}));
-        return {
-          authorized: false,
-          reason: error.message || `API error: ${response.status}`
-        };
-      }
-      const json = await response.json();
-      const result = json.data ?? json;
-      return result;
-    } catch (error) {
-      return {
-        authorized: false,
-        reason: error instanceof Error ? error.message : "Unknown error"
-      };
-    }
-  }
-  /**
-   * Extract token from a request object
-   * Useful for middleware that needs to extract token before making authorization calls
-   */
-  async getTokenFromRequest(request) {
-    return extractTokenFromRequest(request, this.config);
-  }
-  // ============================================================================
-  // Private - HTTP & Authentication
-  // ============================================================================
-  /**
-   * Make an authenticated fetch request (token from request; no refresh).
-   */
-  async fetchWithAuth(url, init, request) {
-    return this.doFetch(url, init, request);
-  }
-  /**
-   * Perform the actual fetch request
-   */
-  async doFetch(url, init, request) {
-    const fetchFn = this.config.fetch ?? globalThis.fetch;
-    const fullUrl = url.startsWith("http") ? url : `${this.config.apiUrl}${url}`;
-    const headers = {
-      "Content-Type": "application/json",
-      ...init?.headers
-    };
-    if (request) {
-      const token = await extractTokenFromRequest(request, this.config);
-      if (token) {
-        headers["Authorization"] = `Bearer ${token}`;
-      }
-      const req = request;
-      if (req.headers?.cookie) {
-        headers["Cookie"] = req.headers.cookie;
-      }
-    }
-    return fetchFn(fullUrl, {
-      ...init,
-      headers,
-      // Include cookies for same-origin requests (supports cookie-based auth)
-      credentials: this.config.credentials ?? "include"
-    });
-  }
-}
-export {
-  GrantClient as G,
-  extractBearerToken as a,
-  extractTokenFromRequest as e
-};
-//# sourceMappingURL=grant-client-D1LZI2f4.js.map

package/dist/grant-client-D1LZI2f4.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"grant-client-D1LZI2f4.js","sources":["../src/utils/token-extractor.ts","../src/grant-client.ts"],"sourcesContent":["import type { GrantServerConfig } from '../types';\n\n/**\n * Extract Bearer token from Authorization header\n */\nexport function extractBearerToken(authHeader: string | undefined): string | null {\n  if (!authHeader) return null;\n\n  const parts = authHeader.trim().split(/\\s+/);\n  if (parts.length !== 2 || parts[0].toLowerCase() !== 'bearer') {\n    return null;\n  }\n\n  return parts[1];\n}\n\n/**\n * Parse cookie header string into key-value pairs\n */\nfunction parseCookieHeader(cookieHeader: string): Record<string, string> {\n  const cookies: Record<string, string> = {};\n\n  cookieHeader.split(';').forEach((cookie) => {\n    const [name, ...rest] = cookie.trim().split('=');\n    if (name && rest.length > 0) {\n      cookies[name.trim()] = rest.join('=').trim();\n    }\n  });\n\n  return cookies;\n}\n\n/**\n * Extract token from cookies\n */\nexport function extractTokenFromCookies(\n  cookieHeader: string | undefined,\n  cookieName: string\n): string | null {\n  if (!cookieHeader) return null;\n\n  const cookies = parseCookieHeader(cookieHeader);\n  return cookies[cookieName] || null;\n}\n\n/**\n * Extract token from Express request\n */\nexport async function extractTokenFromRequest(\n  request: unknown,\n  config: GrantServerConfig\n): Promise<string | null> {\n  // Use custom token resolver if provided\n  if (config.getToken) {\n    const token = await config.getToken(request);\n    if (token) return token;\n  }\n\n  // Try to extract from request (Express-style or Web API / NextRequest)\n  const req = request as {\n    headers?:\n      | { authorization?: string; cookie?: string }\n      | { get: (name: string) => string | null };\n    cookies?: Record<string, string>;\n  };\n\n  if (!req?.headers) return null;\n\n  // Web API Headers (NextRequest, Request): headers.get(name)\n  const headersGet = (req.headers as { get?: (name: string) => string | null }).get;\n  if (typeof headersGet === 'function') {\n    const authHeader = headersGet.call(req.headers, 'authorization');\n    const bearerToken = extractBearerToken(authHeader ?? undefined);\n    if (bearerToken) return bearerToken;\n    const cookieName = config.cookieName || 'grant-access-token';\n    const cookieHeader = headersGet.call(req.headers, 'cookie');\n    if (cookieHeader) {\n      const cookieToken = extractTokenFromCookies(cookieHeader, cookieName);\n      if (cookieToken) return cookieToken;\n    }\n    return null;\n  }\n\n  // Express-style: headers.authorization, headers.cookie\n  const plainHeaders = req.headers as { authorization?: string; cookie?: string };\n  const authHeader = plainHeaders.authorization;\n  const bearerToken = extractBearerToken(authHeader);\n  if (bearerToken) return bearerToken;\n\n  const cookieName = config.cookieName || 'grant-access-token';\n\n  if (req.cookies?.[cookieName]) {\n    return req.cookies[cookieName];\n  }\n\n  const cookieHeader = plainHeaders.cookie;\n  if (cookieHeader) {\n    const cookieToken = extractTokenFromCookies(cookieHeader, cookieName);\n    if (cookieToken) return cookieToken;\n  }\n\n  return null;\n}\n","import { extractTokenFromRequest } from './utils/token-extractor';\n\nimport type { GrantServerConfig, AuthorizationResult, PermissionCheckOptions } from './types';\n\n/**\n * Grant Client for server-side applications\n *\n * Makes HTTP requests to the Grant API to check permissions.\n * Uses API-key exchanged tokens (scope in JWT claims); token-based and cookie-based extraction supported.\n * No caching - server-side caching is handled by grant-api.\n */\nexport class GrantClient {\n  public readonly config: Required<Pick<GrantServerConfig, 'apiUrl'>> & GrantServerConfig;\n\n  constructor(config: GrantServerConfig) {\n    this.config = config;\n  }\n\n  // ============================================================================\n  // Public API - Permission Checks\n  // ============================================================================\n\n  /**\n   * Check if the current user has a specific permission\n   *\n   * @example\n   * ```ts\n   * const canEdit = await grant.isGranted('document', 'update', { scope });\n   * if (canEdit) {\n   *   // Proceed with operation\n   * }\n   * ```\n   */\n  async isGranted(\n    resource: string,\n    action: string,\n    options?: PermissionCheckOptions,\n    request?: unknown\n  ): Promise<boolean> {\n    const result = await this.isAuthorized(resource, action, options, request);\n    return result.authorized;\n  }\n\n  /**\n   * Check authorization with full result details\n   *\n   * @example\n   * ```ts\n   * const result = await grant.isAuthorized('document', 'update', { scope }, request);\n   * if (!result.authorized) {\n   *   console.log('Denied:', result.reason);\n   * }\n   * ```\n   */\n  async isAuthorized(\n    resource: string,\n    action: string,\n    options?: PermissionCheckOptions,\n    request?: unknown\n  ): Promise<AuthorizationResult> {\n    try {\n      // API expects: { permission: { resource, action }, context: { resource?: any }, scope?: { tenant, id } }\n      const response = await this.fetchWithAuth(\n        '/api/auth/is-authorized',\n        {\n          method: 'POST',\n          body: JSON.stringify({\n            permission: {\n              resource,\n              action,\n            },\n            context: {\n              resource: options?.context?.resource || null,\n            },\n          }),\n        },\n        request\n      );\n\n      if (!response.ok) {\n        const error = await response.json().catch(() => ({}));\n        return {\n          authorized: false,\n          reason: error.message || `API error: ${response.status}`,\n        };\n      }\n\n      const json = await response.json();\n      // API returns { success: true, data: { authorized, ... } }\n      const result: AuthorizationResult = json.data ?? json;\n      return result;\n    } catch (error) {\n      return {\n        authorized: false,\n        reason: error instanceof Error ? error.message : 'Unknown error',\n      };\n    }\n  }\n\n  /**\n   * Extract token from a request object\n   * Useful for middleware that needs to extract token before making authorization calls\n   */\n  async getTokenFromRequest(request: unknown): Promise<string | null> {\n    return extractTokenFromRequest(request, this.config);\n  }\n\n  // ============================================================================\n  // Private - HTTP & Authentication\n  // ============================================================================\n\n  /**\n   * Make an authenticated fetch request (token from request; no refresh).\n   */\n  private async fetchWithAuth(\n    url: string,\n    init?: RequestInit,\n    request?: unknown\n  ): Promise<Response> {\n    return this.doFetch(url, init, request);\n  }\n\n  /**\n   * Perform the actual fetch request\n   */\n  private async doFetch(url: string, init?: RequestInit, request?: unknown): Promise<Response> {\n    const fetchFn = this.config.fetch ?? globalThis.fetch;\n    const fullUrl = url.startsWith('http') ? url : `${this.config.apiUrl}${url}`;\n\n    const headers: Record<string, string> = {\n      'Content-Type': 'application/json',\n      ...(init?.headers as Record<string, string>),\n    };\n\n    // Add authorization header if token is available\n    if (request) {\n      const token = await extractTokenFromRequest(request, this.config);\n      if (token) {\n        headers['Authorization'] = `Bearer ${token}`;\n      }\n\n      // Forward cookies if using cookie-based auth\n      const req = request as { headers?: { cookie?: string } };\n      if (req.headers?.cookie) {\n        headers['Cookie'] = req.headers.cookie;\n      }\n    }\n\n    return fetchFn(fullUrl, {\n      ...init,\n      headers,\n      // Include cookies for same-origin requests (supports cookie-based auth)\n      credentials: this.config.credentials ?? 'include',\n    });\n  }\n}\n"],"names":["authHeader","bearerToken","cookieName","cookieHeader"],"mappings":";;;AAKO,SAAS,mBAAmB,YAA+C;AAChF,MAAI,CAAC,WAAY,QAAO;AAExB,QAAM,QAAQ,WAAW,KAAA,EAAO,MAAM,KAAK;AAC3C,MAAI,MAAM,WAAW,KAAK,MAAM,CAAC,EAAE,YAAA,MAAkB,UAAU;AAC7D,WAAO;AAAA,EACT;AAEA,SAAO,MAAM,CAAC;AAChB;AAKA,SAAS,kBAAkB,cAA8C;AACvE,QAAM,UAAkC,CAAA;AAExC,eAAa,MAAM,GAAG,EAAE,QAAQ,CAAC,WAAW;AAC1C,UAAM,CAAC,MAAM,GAAG,IAAI,IAAI,OAAO,KAAA,EAAO,MAAM,GAAG;AAC/C,QAAI,QAAQ,KAAK,SAAS,GAAG;AAC3B,cAAQ,KAAK,MAAM,IAAI,KAAK,KAAK,GAAG,EAAE,KAAA;AAAA,IACxC;AAAA,EACF,CAAC;AAED,SAAO;AACT;AAKO,SAAS,wBACd,cACA,YACe;AACf,MAAI,CAAC,aAAc,QAAO;AAE1B,QAAM,UAAU,kBAAkB,YAAY;AAC9C,SAAO,QAAQ,UAAU,KAAK;AAChC;AAKA,eAAsB,wBACpB,SACA,QACwB;AAExB,MAAI,OAAO,UAAU;AACnB,UAAM,QAAQ,MAAM,OAAO,SAAS,OAAO;AAC3C,QAAI,MAAO,QAAO;AAAA,EACpB;AAGA,QAAM,MAAM;AAOZ,MAAI,CAAC,KAAK,QAAS,QAAO;AAG1B,QAAM,aAAc,IAAI,QAAsD;AAC9E,MAAI,OAAO,eAAe,YAAY;AACpC,UAAMA,cAAa,WAAW,KAAK,IAAI,SAAS,eAAe;AAC/D,UAAMC,eAAc,mBAAmBD,eAAc,MAAS;AAC9D,QAAIC,aAAa,QAAOA;AACxB,UAAMC,cAAa,OAAO,cAAc;AACxC,UAAMC,gBAAe,WAAW,KAAK,IAAI,SAAS,QAAQ;AAC1D,QAAIA,eAAc;AAChB,YAAM,cAAc,wBAAwBA,eAAcD,WAAU;AACpE,UAAI,YAAa,QAAO;AAAA,IAC1B;AACA,WAAO;AAAA,EACT;AAGA,QAAM,eAAe,IAAI;AACzB,QAAM,aAAa,aAAa;AAChC,QAAM,cAAc,mBAAmB,UAAU;AACjD,MAAI,YAAa,QAAO;AAExB,QAAM,aAAa,OAAO,cAAc;AAExC,MAAI,IAAI,UAAU,UAAU,GAAG;AAC7B,WAAO,IAAI,QAAQ,UAAU;AAAA,EAC/B;AAEA,QAAM,eAAe,aAAa;AAClC,MAAI,cAAc;AAChB,UAAM,cAAc,wBAAwB,cAAc,UAAU;AACpE,QAAI,YAAa,QAAO;AAAA,EAC1B;AAEA,SAAO;AACT;AC3FO,MAAM,YAAY;AAAA,EAGvB,YAAY,QAA2B;AAFvB;AAGd,SAAK,SAAS;AAAA,EAChB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAiBA,MAAM,UACJ,UACA,QACA,SACA,SACkB;AAClB,UAAM,SAAS,MAAM,KAAK,aAAa,UAAU,QAAQ,SAAS,OAAO;AACzE,WAAO,OAAO;AAAA,EAChB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaA,MAAM,aACJ,UACA,QACA,SACA,SAC8B;AAC9B,QAAI;AAEF,YAAM,WAAW,MAAM,KAAK;AAAA,QAC1B;AAAA,QACA;AAAA,UACE,QAAQ;AAAA,UACR,MAAM,KAAK,UAAU;AAAA,YACnB,YAAY;AAAA,cACV;AAAA,cACA;AAAA,YAAA;AAAA,YAEF,SAAS;AAAA,cACP,UAAU,SAAS,SAAS,YAAY;AAAA,YAAA;AAAA,UAC1C,CACD;AAAA,QAAA;AAAA,QAEH;AAAA,MAAA;AAGF,UAAI,CAAC,SAAS,IAAI;AAChB,cAAM,QAAQ,MAAM,SAAS,KAAA,EAAO,MAAM,OAAO,CAAA,EAAG;AACpD,eAAO;AAAA,UACL,YAAY;AAAA,UACZ,QAAQ,MAAM,WAAW,cAAc,SAAS,MAAM;AAAA,QAAA;AAAA,MAE1D;AAEA,YAAM,OAAO,MAAM,SAAS,KAAA;AAE5B,YAAM,SAA8B,KAAK,QAAQ;AACjD,aAAO;AAAA,IACT,SAAS,OAAO;AACd,aAAO;AAAA,QACL,YAAY;AAAA,QACZ,QAAQ,iBAAiB,QAAQ,MAAM,UAAU;AAAA,MAAA;AAAA,IAErD;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,oBAAoB,SAA0C;AAClE,WAAO,wBAAwB,SAAS,KAAK,MAAM;AAAA,EACrD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAc,cACZ,KACA,MACA,SACmB;AACnB,WAAO,KAAK,QAAQ,KAAK,MAAM,OAAO;AAAA,EACxC;AAAA;AAAA;AAAA;AAAA,EAKA,MAAc,QAAQ,KAAa,MAAoB,SAAsC;AAC3F,UAAM,UAAU,KAAK,OAAO,SAAS,WAAW;AAChD,UAAM,UAAU,IAAI,WAAW,MAAM,IAAI,MAAM,GAAG,KAAK,OAAO,MAAM,GAAG,GAAG;AAE1E,UAAM,UAAkC;AAAA,MACtC,gBAAgB;AAAA,MAChB,GAAI,MAAM;AAAA,IAAA;AAIZ,QAAI,SAAS;AACX,YAAM,QAAQ,MAAM,wBAAwB,SAAS,KAAK,MAAM;AAChE,UAAI,OAAO;AACT,gBAAQ,eAAe,IAAI,UAAU,KAAK;AAAA,MAC5C;AAGA,YAAM,MAAM;AACZ,UAAI,IAAI,SAAS,QAAQ;AACvB,gBAAQ,QAAQ,IAAI,IAAI,QAAQ;AAAA,MAClC;AAAA,IACF;AAEA,WAAO,QAAQ,SAAS;AAAA,MACtB,GAAG;AAAA,MACH;AAAA;AAAA,MAEA,aAAa,KAAK,OAAO,eAAe;AAAA,IAAA,CACzC;AAAA,EACH;AACF;"}

package/dist/grant-client-DywfJN5P.cjs

@@ -1,179 +0,0 @@
-"use strict";
-var __defProp = Object.defineProperty;
-var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
-var __publicField = (obj, key, value) => __defNormalProp(obj, typeof key !== "symbol" ? key + "" : key, value);
-function extractBearerToken(authHeader) {
-  if (!authHeader) return null;
-  const parts = authHeader.trim().split(/\s+/);
-  if (parts.length !== 2 || parts[0].toLowerCase() !== "bearer") {
-    return null;
-  }
-  return parts[1];
-}
-function parseCookieHeader(cookieHeader) {
-  const cookies = {};
-  cookieHeader.split(";").forEach((cookie) => {
-    const [name, ...rest] = cookie.trim().split("=");
-    if (name && rest.length > 0) {
-      cookies[name.trim()] = rest.join("=").trim();
-    }
-  });
-  return cookies;
-}
-function extractTokenFromCookies(cookieHeader, cookieName) {
-  if (!cookieHeader) return null;
-  const cookies = parseCookieHeader(cookieHeader);
-  return cookies[cookieName] || null;
-}
-async function extractTokenFromRequest(request, config) {
-  if (config.getToken) {
-    const token = await config.getToken(request);
-    if (token) return token;
-  }
-  const req = request;
-  if (!req?.headers) return null;
-  const headersGet = req.headers.get;
-  if (typeof headersGet === "function") {
-    const authHeader2 = headersGet.call(req.headers, "authorization");
-    const bearerToken2 = extractBearerToken(authHeader2 ?? void 0);
-    if (bearerToken2) return bearerToken2;
-    const cookieName2 = config.cookieName || "grant-access-token";
-    const cookieHeader2 = headersGet.call(req.headers, "cookie");
-    if (cookieHeader2) {
-      const cookieToken = extractTokenFromCookies(cookieHeader2, cookieName2);
-      if (cookieToken) return cookieToken;
-    }
-    return null;
-  }
-  const plainHeaders = req.headers;
-  const authHeader = plainHeaders.authorization;
-  const bearerToken = extractBearerToken(authHeader);
-  if (bearerToken) return bearerToken;
-  const cookieName = config.cookieName || "grant-access-token";
-  if (req.cookies?.[cookieName]) {
-    return req.cookies[cookieName];
-  }
-  const cookieHeader = plainHeaders.cookie;
-  if (cookieHeader) {
-    const cookieToken = extractTokenFromCookies(cookieHeader, cookieName);
-    if (cookieToken) return cookieToken;
-  }
-  return null;
-}
-class GrantClient {
-  constructor(config) {
-    __publicField(this, "config");
-    this.config = config;
-  }
-  // ============================================================================
-  // Public API - Permission Checks
-  // ============================================================================
-  /**
-   * Check if the current user has a specific permission
-   *
-   * @example
-   * ```ts
-   * const canEdit = await grant.isGranted('document', 'update', { scope });
-   * if (canEdit) {
-   *   // Proceed with operation
-   * }
-   * ```
-   */
-  async isGranted(resource, action, options, request) {
-    const result = await this.isAuthorized(resource, action, options, request);
-    return result.authorized;
-  }
-  /**
-   * Check authorization with full result details
-   *
-   * @example
-   * ```ts
-   * const result = await grant.isAuthorized('document', 'update', { scope }, request);
-   * if (!result.authorized) {
-   *   console.log('Denied:', result.reason);
-   * }
-   * ```
-   */
-  async isAuthorized(resource, action, options, request) {
-    try {
-      const response = await this.fetchWithAuth(
-        "/api/auth/is-authorized",
-        {
-          method: "POST",
-          body: JSON.stringify({
-            permission: {
-              resource,
-              action
-            },
-            context: {
-              resource: options?.context?.resource || null
-            }
-          })
-        },
-        request
-      );
-      if (!response.ok) {
-        const error = await response.json().catch(() => ({}));
-        return {
-          authorized: false,
-          reason: error.message || `API error: ${response.status}`
-        };
-      }
-      const json = await response.json();
-      const result = json.data ?? json;
-      return result;
-    } catch (error) {
-      return {
-        authorized: false,
-        reason: error instanceof Error ? error.message : "Unknown error"
-      };
-    }
-  }
-  /**
-   * Extract token from a request object
-   * Useful for middleware that needs to extract token before making authorization calls
-   */
-  async getTokenFromRequest(request) {
-    return extractTokenFromRequest(request, this.config);
-  }
-  // ============================================================================
-  // Private - HTTP & Authentication
-  // ============================================================================
-  /**
-   * Make an authenticated fetch request (token from request; no refresh).
-   */
-  async fetchWithAuth(url, init, request) {
-    return this.doFetch(url, init, request);
-  }
-  /**
-   * Perform the actual fetch request
-   */
-  async doFetch(url, init, request) {
-    const fetchFn = this.config.fetch ?? globalThis.fetch;
-    const fullUrl = url.startsWith("http") ? url : `${this.config.apiUrl}${url}`;
-    const headers = {
-      "Content-Type": "application/json",
-      ...init?.headers
-    };
-    if (request) {
-      const token = await extractTokenFromRequest(request, this.config);
-      if (token) {
-        headers["Authorization"] = `Bearer ${token}`;
-      }
-      const req = request;
-      if (req.headers?.cookie) {
-        headers["Cookie"] = req.headers.cookie;
-      }
-    }
-    return fetchFn(fullUrl, {
-      ...init,
-      headers,
-      // Include cookies for same-origin requests (supports cookie-based auth)
-      credentials: this.config.credentials ?? "include"
-    });
-  }
-}
-exports.GrantClient = GrantClient;
-exports.extractBearerToken = extractBearerToken;
-exports.extractTokenFromRequest = extractTokenFromRequest;
-//# sourceMappingURL=grant-client-DywfJN5P.cjs.map