@grantjs/server 1.0.0

package/dist/grant-client-D1LZI2f4.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"grant-client-D1LZI2f4.js","sources":["../src/utils/token-extractor.ts","../src/grant-client.ts"],"sourcesContent":["import type { GrantServerConfig } from '../types';\n\n/**\n * Extract Bearer token from Authorization header\n */\nexport function extractBearerToken(authHeader: string | undefined): string | null {\n  if (!authHeader) return null;\n\n  const parts = authHeader.trim().split(/\\s+/);\n  if (parts.length !== 2 || parts[0].toLowerCase() !== 'bearer') {\n    return null;\n  }\n\n  return parts[1];\n}\n\n/**\n * Parse cookie header string into key-value pairs\n */\nfunction parseCookieHeader(cookieHeader: string): Record<string, string> {\n  const cookies: Record<string, string> = {};\n\n  cookieHeader.split(';').forEach((cookie) => {\n    const [name, ...rest] = cookie.trim().split('=');\n    if (name && rest.length > 0) {\n      cookies[name.trim()] = rest.join('=').trim();\n    }\n  });\n\n  return cookies;\n}\n\n/**\n * Extract token from cookies\n */\nexport function extractTokenFromCookies(\n  cookieHeader: string | undefined,\n  cookieName: string\n): string | null {\n  if (!cookieHeader) return null;\n\n  const cookies = parseCookieHeader(cookieHeader);\n  return cookies[cookieName] || null;\n}\n\n/**\n * Extract token from Express request\n */\nexport async function extractTokenFromRequest(\n  request: unknown,\n  config: GrantServerConfig\n): Promise<string | null> {\n  // Use custom token resolver if provided\n  if (config.getToken) {\n    const token = await config.getToken(request);\n    if (token) return token;\n  }\n\n  // Try to extract from request (Express-style or Web API / NextRequest)\n  const req = request as {\n    headers?:\n      | { authorization?: string; cookie?: string }\n      | { get: (name: string) => string | null };\n    cookies?: Record<string, string>;\n  };\n\n  if (!req?.headers) return null;\n\n  // Web API Headers (NextRequest, Request): headers.get(name)\n  const headersGet = (req.headers as { get?: (name: string) => string | null }).get;\n  if (typeof headersGet === 'function') {\n    const authHeader = headersGet.call(req.headers, 'authorization');\n    const bearerToken = extractBearerToken(authHeader ?? undefined);\n    if (bearerToken) return bearerToken;\n    const cookieName = config.cookieName || 'grant-access-token';\n    const cookieHeader = headersGet.call(req.headers, 'cookie');\n    if (cookieHeader) {\n      const cookieToken = extractTokenFromCookies(cookieHeader, cookieName);\n      if (cookieToken) return cookieToken;\n    }\n    return null;\n  }\n\n  // Express-style: headers.authorization, headers.cookie\n  const plainHeaders = req.headers as { authorization?: string; cookie?: string };\n  const authHeader = plainHeaders.authorization;\n  const bearerToken = extractBearerToken(authHeader);\n  if (bearerToken) return bearerToken;\n\n  const cookieName = config.cookieName || 'grant-access-token';\n\n  if (req.cookies?.[cookieName]) {\n    return req.cookies[cookieName];\n  }\n\n  const cookieHeader = plainHeaders.cookie;\n  if (cookieHeader) {\n    const cookieToken = extractTokenFromCookies(cookieHeader, cookieName);\n    if (cookieToken) return cookieToken;\n  }\n\n  return null;\n}\n","import { extractTokenFromRequest } from './utils/token-extractor';\n\nimport type { GrantServerConfig, AuthorizationResult, PermissionCheckOptions } from './types';\n\n/**\n * Grant Client for server-side applications\n *\n * Makes HTTP requests to the Grant API to check permissions.\n * Uses API-key exchanged tokens (scope in JWT claims); token-based and cookie-based extraction supported.\n * No caching - server-side caching is handled by grant-api.\n */\nexport class GrantClient {\n  public readonly config: Required<Pick<GrantServerConfig, 'apiUrl'>> & GrantServerConfig;\n\n  constructor(config: GrantServerConfig) {\n    this.config = config;\n  }\n\n  // ============================================================================\n  // Public API - Permission Checks\n  // ============================================================================\n\n  /**\n   * Check if the current user has a specific permission\n   *\n   * @example\n   * ```ts\n   * const canEdit = await grant.isGranted('document', 'update', { scope });\n   * if (canEdit) {\n   *   // Proceed with operation\n   * }\n   * ```\n   */\n  async isGranted(\n    resource: string,\n    action: string,\n    options?: PermissionCheckOptions,\n    request?: unknown\n  ): Promise<boolean> {\n    const result = await this.isAuthorized(resource, action, options, request);\n    return result.authorized;\n  }\n\n  /**\n   * Check authorization with full result details\n   *\n   * @example\n   * ```ts\n   * const result = await grant.isAuthorized('document', 'update', { scope }, request);\n   * if (!result.authorized) {\n   *   console.log('Denied:', result.reason);\n   * }\n   * ```\n   */\n  async isAuthorized(\n    resource: string,\n    action: string,\n    options?: PermissionCheckOptions,\n    request?: unknown\n  ): Promise<AuthorizationResult> {\n    try {\n      // API expects: { permission: { resource, action }, context: { resource?: any }, scope?: { tenant, id } }\n      const response = await this.fetchWithAuth(\n        '/api/auth/is-authorized',\n        {\n          method: 'POST',\n          body: JSON.stringify({\n            permission: {\n              resource,\n              action,\n            },\n            context: {\n              resource: options?.context?.resource || null,\n            },\n          }),\n        },\n        request\n      );\n\n      if (!response.ok) {\n        const error = await response.json().catch(() => ({}));\n        return {\n          authorized: false,\n          reason: error.message || `API error: ${response.status}`,\n        };\n      }\n\n      const json = await response.json();\n      // API returns { success: true, data: { authorized, ... } }\n      const result: AuthorizationResult = json.data ?? json;\n      return result;\n    } catch (error) {\n      return {\n        authorized: false,\n        reason: error instanceof Error ? error.message : 'Unknown error',\n      };\n    }\n  }\n\n  /**\n   * Extract token from a request object\n   * Useful for middleware that needs to extract token before making authorization calls\n   */\n  async getTokenFromRequest(request: unknown): Promise<string | null> {\n    return extractTokenFromRequest(request, this.config);\n  }\n\n  // ============================================================================\n  // Private - HTTP & Authentication\n  // ============================================================================\n\n  /**\n   * Make an authenticated fetch request (token from request; no refresh).\n   */\n  private async fetchWithAuth(\n    url: string,\n    init?: RequestInit,\n    request?: unknown\n  ): Promise<Response> {\n    return this.doFetch(url, init, request);\n  }\n\n  /**\n   * Perform the actual fetch request\n   */\n  private async doFetch(url: string, init?: RequestInit, request?: unknown): Promise<Response> {\n    const fetchFn = this.config.fetch ?? globalThis.fetch;\n    const fullUrl = url.startsWith('http') ? url : `${this.config.apiUrl}${url}`;\n\n    const headers: Record<string, string> = {\n      'Content-Type': 'application/json',\n      ...(init?.headers as Record<string, string>),\n    };\n\n    // Add authorization header if token is available\n    if (request) {\n      const token = await extractTokenFromRequest(request, this.config);\n      if (token) {\n        headers['Authorization'] = `Bearer ${token}`;\n      }\n\n      // Forward cookies if using cookie-based auth\n      const req = request as { headers?: { cookie?: string } };\n      if (req.headers?.cookie) {\n        headers['Cookie'] = req.headers.cookie;\n      }\n    }\n\n    return fetchFn(fullUrl, {\n      ...init,\n      headers,\n      // Include cookies for same-origin requests (supports cookie-based auth)\n      credentials: this.config.credentials ?? 'include',\n    });\n  }\n}\n"],"names":["authHeader","bearerToken","cookieName","cookieHeader"],"mappings":";;;AAKO,SAAS,mBAAmB,YAA+C;AAChF,MAAI,CAAC,WAAY,QAAO;AAExB,QAAM,QAAQ,WAAW,KAAA,EAAO,MAAM,KAAK;AAC3C,MAAI,MAAM,WAAW,KAAK,MAAM,CAAC,EAAE,YAAA,MAAkB,UAAU;AAC7D,WAAO;AAAA,EACT;AAEA,SAAO,MAAM,CAAC;AAChB;AAKA,SAAS,kBAAkB,cAA8C;AACvE,QAAM,UAAkC,CAAA;AAExC,eAAa,MAAM,GAAG,EAAE,QAAQ,CAAC,WAAW;AAC1C,UAAM,CAAC,MAAM,GAAG,IAAI,IAAI,OAAO,KAAA,EAAO,MAAM,GAAG;AAC/C,QAAI,QAAQ,KAAK,SAAS,GAAG;AAC3B,cAAQ,KAAK,MAAM,IAAI,KAAK,KAAK,GAAG,EAAE,KAAA;AAAA,IACxC;AAAA,EACF,CAAC;AAED,SAAO;AACT;AAKO,SAAS,wBACd,cACA,YACe;AACf,MAAI,CAAC,aAAc,QAAO;AAE1B,QAAM,UAAU,kBAAkB,YAAY;AAC9C,SAAO,QAAQ,UAAU,KAAK;AAChC;AAKA,eAAsB,wBACpB,SACA,QACwB;AAExB,MAAI,OAAO,UAAU;AACnB,UAAM,QAAQ,MAAM,OAAO,SAAS,OAAO;AAC3C,QAAI,MAAO,QAAO;AAAA,EACpB;AAGA,QAAM,MAAM;AAOZ,MAAI,CAAC,KAAK,QAAS,QAAO;AAG1B,QAAM,aAAc,IAAI,QAAsD;AAC9E,MAAI,OAAO,eAAe,YAAY;AACpC,UAAMA,cAAa,WAAW,KAAK,IAAI,SAAS,eAAe;AAC/D,UAAMC,eAAc,mBAAmBD,eAAc,MAAS;AAC9D,QAAIC,aAAa,QAAOA;AACxB,UAAMC,cAAa,OAAO,cAAc;AACxC,UAAMC,gBAAe,WAAW,KAAK,IAAI,SAAS,QAAQ;AAC1D,QAAIA,eAAc;AAChB,YAAM,cAAc,wBAAwBA,eAAcD,WAAU;AACpE,UAAI,YAAa,QAAO;AAAA,IAC1B;AACA,WAAO;AAAA,EACT;AAGA,QAAM,eAAe,IAAI;AACzB,QAAM,aAAa,aAAa;AAChC,QAAM,cAAc,mBAAmB,UAAU;AACjD,MAAI,YAAa,QAAO;AAExB,QAAM,aAAa,OAAO,cAAc;AAExC,MAAI,IAAI,UAAU,UAAU,GAAG;AAC7B,WAAO,IAAI,QAAQ,UAAU;AAAA,EAC/B;AAEA,QAAM,eAAe,aAAa;AAClC,MAAI,cAAc;AAChB,UAAM,cAAc,wBAAwB,cAAc,UAAU;AACpE,QAAI,YAAa,QAAO;AAAA,EAC1B;AAEA,SAAO;AACT;AC3FO,MAAM,YAAY;AAAA,EAGvB,YAAY,QAA2B;AAFvB;AAGd,SAAK,SAAS;AAAA,EAChB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAiBA,MAAM,UACJ,UACA,QACA,SACA,SACkB;AAClB,UAAM,SAAS,MAAM,KAAK,aAAa,UAAU,QAAQ,SAAS,OAAO;AACzE,WAAO,OAAO;AAAA,EAChB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaA,MAAM,aACJ,UACA,QACA,SACA,SAC8B;AAC9B,QAAI;AAEF,YAAM,WAAW,MAAM,KAAK;AAAA,QAC1B;AAAA,QACA;AAAA,UACE,QAAQ;AAAA,UACR,MAAM,KAAK,UAAU;AAAA,YACnB,YAAY;AAAA,cACV;AAAA,cACA;AAAA,YAAA;AAAA,YAEF,SAAS;AAAA,cACP,UAAU,SAAS,SAAS,YAAY;AAAA,YAAA;AAAA,UAC1C,CACD;AAAA,QAAA;AAAA,QAEH;AAAA,MAAA;AAGF,UAAI,CAAC,SAAS,IAAI;AAChB,cAAM,QAAQ,MAAM,SAAS,KAAA,EAAO,MAAM,OAAO,CAAA,EAAG;AACpD,eAAO;AAAA,UACL,YAAY;AAAA,UACZ,QAAQ,MAAM,WAAW,cAAc,SAAS,MAAM;AAAA,QAAA;AAAA,MAE1D;AAEA,YAAM,OAAO,MAAM,SAAS,KAAA;AAE5B,YAAM,SAA8B,KAAK,QAAQ;AACjD,aAAO;AAAA,IACT,SAAS,OAAO;AACd,aAAO;AAAA,QACL,YAAY;AAAA,QACZ,QAAQ,iBAAiB,QAAQ,MAAM,UAAU;AAAA,MAAA;AAAA,IAErD;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,oBAAoB,SAA0C;AAClE,WAAO,wBAAwB,SAAS,KAAK,MAAM;AAAA,EACrD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAc,cACZ,KACA,MACA,SACmB;AACnB,WAAO,KAAK,QAAQ,KAAK,MAAM,OAAO;AAAA,EACxC;AAAA;AAAA;AAAA;AAAA,EAKA,MAAc,QAAQ,KAAa,MAAoB,SAAsC;AAC3F,UAAM,UAAU,KAAK,OAAO,SAAS,WAAW;AAChD,UAAM,UAAU,IAAI,WAAW,MAAM,IAAI,MAAM,GAAG,KAAK,OAAO,MAAM,GAAG,GAAG;AAE1E,UAAM,UAAkC;AAAA,MACtC,gBAAgB;AAAA,MAChB,GAAI,MAAM;AAAA,IAAA;AAIZ,QAAI,SAAS;AACX,YAAM,QAAQ,MAAM,wBAAwB,SAAS,KAAK,MAAM;AAChE,UAAI,OAAO;AACT,gBAAQ,eAAe,IAAI,UAAU,KAAK;AAAA,MAC5C;AAGA,YAAM,MAAM;AACZ,UAAI,IAAI,SAAS,QAAQ;AACvB,gBAAQ,QAAQ,IAAI,IAAI,QAAQ;AAAA,MAClC;AAAA,IACF;AAEA,WAAO,QAAQ,SAAS;AAAA,MACtB,GAAG;AAAA,MACH;AAAA;AAAA,MAEA,aAAa,KAAK,OAAO,eAAe;AAAA,IAAA,CACzC;AAAA,EACH;AACF;"}

package/dist/grant-client-DywfJN5P.cjs

@@ -0,0 +1,179 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
+var __publicField = (obj, key, value) => __defNormalProp(obj, typeof key !== "symbol" ? key + "" : key, value);
+function extractBearerToken(authHeader) {
+  if (!authHeader) return null;
+  const parts = authHeader.trim().split(/\s+/);
+  if (parts.length !== 2 || parts[0].toLowerCase() !== "bearer") {
+    return null;
+  }
+  return parts[1];
+}
+function parseCookieHeader(cookieHeader) {
+  const cookies = {};
+  cookieHeader.split(";").forEach((cookie) => {
+    const [name, ...rest] = cookie.trim().split("=");
+    if (name && rest.length > 0) {
+      cookies[name.trim()] = rest.join("=").trim();
+    }
+  });
+  return cookies;
+}
+function extractTokenFromCookies(cookieHeader, cookieName) {
+  if (!cookieHeader) return null;
+  const cookies = parseCookieHeader(cookieHeader);
+  return cookies[cookieName] || null;
+}
+async function extractTokenFromRequest(request, config) {
+  if (config.getToken) {
+    const token = await config.getToken(request);
+    if (token) return token;
+  }
+  const req = request;
+  if (!req?.headers) return null;
+  const headersGet = req.headers.get;
+  if (typeof headersGet === "function") {
+    const authHeader2 = headersGet.call(req.headers, "authorization");
+    const bearerToken2 = extractBearerToken(authHeader2 ?? void 0);
+    if (bearerToken2) return bearerToken2;
+    const cookieName2 = config.cookieName || "grant-access-token";
+    const cookieHeader2 = headersGet.call(req.headers, "cookie");
+    if (cookieHeader2) {
+      const cookieToken = extractTokenFromCookies(cookieHeader2, cookieName2);
+      if (cookieToken) return cookieToken;
+    }
+    return null;
+  }
+  const plainHeaders = req.headers;
+  const authHeader = plainHeaders.authorization;
+  const bearerToken = extractBearerToken(authHeader);
+  if (bearerToken) return bearerToken;
+  const cookieName = config.cookieName || "grant-access-token";
+  if (req.cookies?.[cookieName]) {
+    return req.cookies[cookieName];
+  }
+  const cookieHeader = plainHeaders.cookie;
+  if (cookieHeader) {
+    const cookieToken = extractTokenFromCookies(cookieHeader, cookieName);
+    if (cookieToken) return cookieToken;
+  }
+  return null;
+}
+class GrantClient {
+  constructor(config) {
+    __publicField(this, "config");
+    this.config = config;
+  }
+  // ============================================================================
+  // Public API - Permission Checks
+  // ============================================================================
+  /**
+   * Check if the current user has a specific permission
+   *
+   * @example
+   * ```ts
+   * const canEdit = await grant.isGranted('document', 'update', { scope });
+   * if (canEdit) {
+   *   // Proceed with operation
+   * }
+   * ```
+   */
+  async isGranted(resource, action, options, request) {
+    const result = await this.isAuthorized(resource, action, options, request);
+    return result.authorized;
+  }
+  /**
+   * Check authorization with full result details
+   *
+   * @example
+   * ```ts
+   * const result = await grant.isAuthorized('document', 'update', { scope }, request);
+   * if (!result.authorized) {
+   *   console.log('Denied:', result.reason);
+   * }
+   * ```
+   */
+  async isAuthorized(resource, action, options, request) {
+    try {
+      const response = await this.fetchWithAuth(
+        "/api/auth/is-authorized",
+        {
+          method: "POST",
+          body: JSON.stringify({
+            permission: {
+              resource,
+              action
+            },
+            context: {
+              resource: options?.context?.resource || null
+            }
+          })
+        },
+        request
+      );
+      if (!response.ok) {
+        const error = await response.json().catch(() => ({}));
+        return {
+          authorized: false,
+          reason: error.message || `API error: ${response.status}`
+        };
+      }
+      const json = await response.json();
+      const result = json.data ?? json;
+      return result;
+    } catch (error) {
+      return {
+        authorized: false,
+        reason: error instanceof Error ? error.message : "Unknown error"
+      };
+    }
+  }
+  /**
+   * Extract token from a request object
+   * Useful for middleware that needs to extract token before making authorization calls
+   */
+  async getTokenFromRequest(request) {
+    return extractTokenFromRequest(request, this.config);
+  }
+  // ============================================================================
+  // Private - HTTP & Authentication
+  // ============================================================================
+  /**
+   * Make an authenticated fetch request (token from request; no refresh).
+   */
+  async fetchWithAuth(url, init, request) {
+    return this.doFetch(url, init, request);
+  }
+  /**
+   * Perform the actual fetch request
+   */
+  async doFetch(url, init, request) {
+    const fetchFn = this.config.fetch ?? globalThis.fetch;
+    const fullUrl = url.startsWith("http") ? url : `${this.config.apiUrl}${url}`;
+    const headers = {
+      "Content-Type": "application/json",
+      ...init?.headers
+    };
+    if (request) {
+      const token = await extractTokenFromRequest(request, this.config);
+      if (token) {
+        headers["Authorization"] = `Bearer ${token}`;
+      }
+      const req = request;
+      if (req.headers?.cookie) {
+        headers["Cookie"] = req.headers.cookie;
+      }
+    }
+    return fetchFn(fullUrl, {
+      ...init,
+      headers,
+      // Include cookies for same-origin requests (supports cookie-based auth)
+      credentials: this.config.credentials ?? "include"
+    });
+  }
+}
+exports.GrantClient = GrantClient;
+exports.extractBearerToken = extractBearerToken;
+exports.extractTokenFromRequest = extractTokenFromRequest;
+//# sourceMappingURL=grant-client-DywfJN5P.cjs.map

package/dist/grant-client-DywfJN5P.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"grant-client-DywfJN5P.cjs","sources":["../src/utils/token-extractor.ts","../src/grant-client.ts"],"sourcesContent":["import type { GrantServerConfig } from '../types';\n\n/**\n * Extract Bearer token from Authorization header\n */\nexport function extractBearerToken(authHeader: string | undefined): string | null {\n  if (!authHeader) return null;\n\n  const parts = authHeader.trim().split(/\\s+/);\n  if (parts.length !== 2 || parts[0].toLowerCase() !== 'bearer') {\n    return null;\n  }\n\n  return parts[1];\n}\n\n/**\n * Parse cookie header string into key-value pairs\n */\nfunction parseCookieHeader(cookieHeader: string): Record<string, string> {\n  const cookies: Record<string, string> = {};\n\n  cookieHeader.split(';').forEach((cookie) => {\n    const [name, ...rest] = cookie.trim().split('=');\n    if (name && rest.length > 0) {\n      cookies[name.trim()] = rest.join('=').trim();\n    }\n  });\n\n  return cookies;\n}\n\n/**\n * Extract token from cookies\n */\nexport function extractTokenFromCookies(\n  cookieHeader: string | undefined,\n  cookieName: string\n): string | null {\n  if (!cookieHeader) return null;\n\n  const cookies = parseCookieHeader(cookieHeader);\n  return cookies[cookieName] || null;\n}\n\n/**\n * Extract token from Express request\n */\nexport async function extractTokenFromRequest(\n  request: unknown,\n  config: GrantServerConfig\n): Promise<string | null> {\n  // Use custom token resolver if provided\n  if (config.getToken) {\n    const token = await config.getToken(request);\n    if (token) return token;\n  }\n\n  // Try to extract from request (Express-style or Web API / NextRequest)\n  const req = request as {\n    headers?:\n      | { authorization?: string; cookie?: string }\n      | { get: (name: string) => string | null };\n    cookies?: Record<string, string>;\n  };\n\n  if (!req?.headers) return null;\n\n  // Web API Headers (NextRequest, Request): headers.get(name)\n  const headersGet = (req.headers as { get?: (name: string) => string | null }).get;\n  if (typeof headersGet === 'function') {\n    const authHeader = headersGet.call(req.headers, 'authorization');\n    const bearerToken = extractBearerToken(authHeader ?? undefined);\n    if (bearerToken) return bearerToken;\n    const cookieName = config.cookieName || 'grant-access-token';\n    const cookieHeader = headersGet.call(req.headers, 'cookie');\n    if (cookieHeader) {\n      const cookieToken = extractTokenFromCookies(cookieHeader, cookieName);\n      if (cookieToken) return cookieToken;\n    }\n    return null;\n  }\n\n  // Express-style: headers.authorization, headers.cookie\n  const plainHeaders = req.headers as { authorization?: string; cookie?: string };\n  const authHeader = plainHeaders.authorization;\n  const bearerToken = extractBearerToken(authHeader);\n  if (bearerToken) return bearerToken;\n\n  const cookieName = config.cookieName || 'grant-access-token';\n\n  if (req.cookies?.[cookieName]) {\n    return req.cookies[cookieName];\n  }\n\n  const cookieHeader = plainHeaders.cookie;\n  if (cookieHeader) {\n    const cookieToken = extractTokenFromCookies(cookieHeader, cookieName);\n    if (cookieToken) return cookieToken;\n  }\n\n  return null;\n}\n","import { extractTokenFromRequest } from './utils/token-extractor';\n\nimport type { GrantServerConfig, AuthorizationResult, PermissionCheckOptions } from './types';\n\n/**\n * Grant Client for server-side applications\n *\n * Makes HTTP requests to the Grant API to check permissions.\n * Uses API-key exchanged tokens (scope in JWT claims); token-based and cookie-based extraction supported.\n * No caching - server-side caching is handled by grant-api.\n */\nexport class GrantClient {\n  public readonly config: Required<Pick<GrantServerConfig, 'apiUrl'>> & GrantServerConfig;\n\n  constructor(config: GrantServerConfig) {\n    this.config = config;\n  }\n\n  // ============================================================================\n  // Public API - Permission Checks\n  // ============================================================================\n\n  /**\n   * Check if the current user has a specific permission\n   *\n   * @example\n   * ```ts\n   * const canEdit = await grant.isGranted('document', 'update', { scope });\n   * if (canEdit) {\n   *   // Proceed with operation\n   * }\n   * ```\n   */\n  async isGranted(\n    resource: string,\n    action: string,\n    options?: PermissionCheckOptions,\n    request?: unknown\n  ): Promise<boolean> {\n    const result = await this.isAuthorized(resource, action, options, request);\n    return result.authorized;\n  }\n\n  /**\n   * Check authorization with full result details\n   *\n   * @example\n   * ```ts\n   * const result = await grant.isAuthorized('document', 'update', { scope }, request);\n   * if (!result.authorized) {\n   *   console.log('Denied:', result.reason);\n   * }\n   * ```\n   */\n  async isAuthorized(\n    resource: string,\n    action: string,\n    options?: PermissionCheckOptions,\n    request?: unknown\n  ): Promise<AuthorizationResult> {\n    try {\n      // API expects: { permission: { resource, action }, context: { resource?: any }, scope?: { tenant, id } }\n      const response = await this.fetchWithAuth(\n        '/api/auth/is-authorized',\n        {\n          method: 'POST',\n          body: JSON.stringify({\n            permission: {\n              resource,\n              action,\n            },\n            context: {\n              resource: options?.context?.resource || null,\n            },\n          }),\n        },\n        request\n      );\n\n      if (!response.ok) {\n        const error = await response.json().catch(() => ({}));\n        return {\n          authorized: false,\n          reason: error.message || `API error: ${response.status}`,\n        };\n      }\n\n      const json = await response.json();\n      // API returns { success: true, data: { authorized, ... } }\n      const result: AuthorizationResult = json.data ?? json;\n      return result;\n    } catch (error) {\n      return {\n        authorized: false,\n        reason: error instanceof Error ? error.message : 'Unknown error',\n      };\n    }\n  }\n\n  /**\n   * Extract token from a request object\n   * Useful for middleware that needs to extract token before making authorization calls\n   */\n  async getTokenFromRequest(request: unknown): Promise<string | null> {\n    return extractTokenFromRequest(request, this.config);\n  }\n\n  // ============================================================================\n  // Private - HTTP & Authentication\n  // ============================================================================\n\n  /**\n   * Make an authenticated fetch request (token from request; no refresh).\n   */\n  private async fetchWithAuth(\n    url: string,\n    init?: RequestInit,\n    request?: unknown\n  ): Promise<Response> {\n    return this.doFetch(url, init, request);\n  }\n\n  /**\n   * Perform the actual fetch request\n   */\n  private async doFetch(url: string, init?: RequestInit, request?: unknown): Promise<Response> {\n    const fetchFn = this.config.fetch ?? globalThis.fetch;\n    const fullUrl = url.startsWith('http') ? url : `${this.config.apiUrl}${url}`;\n\n    const headers: Record<string, string> = {\n      'Content-Type': 'application/json',\n      ...(init?.headers as Record<string, string>),\n    };\n\n    // Add authorization header if token is available\n    if (request) {\n      const token = await extractTokenFromRequest(request, this.config);\n      if (token) {\n        headers['Authorization'] = `Bearer ${token}`;\n      }\n\n      // Forward cookies if using cookie-based auth\n      const req = request as { headers?: { cookie?: string } };\n      if (req.headers?.cookie) {\n        headers['Cookie'] = req.headers.cookie;\n      }\n    }\n\n    return fetchFn(fullUrl, {\n      ...init,\n      headers,\n      // Include cookies for same-origin requests (supports cookie-based auth)\n      credentials: this.config.credentials ?? 'include',\n    });\n  }\n}\n"],"names":["authHeader","bearerToken","cookieName","cookieHeader"],"mappings":";;;;AAKO,SAAS,mBAAmB,YAA+C;AAChF,MAAI,CAAC,WAAY,QAAO;AAExB,QAAM,QAAQ,WAAW,KAAA,EAAO,MAAM,KAAK;AAC3C,MAAI,MAAM,WAAW,KAAK,MAAM,CAAC,EAAE,YAAA,MAAkB,UAAU;AAC7D,WAAO;AAAA,EACT;AAEA,SAAO,MAAM,CAAC;AAChB;AAKA,SAAS,kBAAkB,cAA8C;AACvE,QAAM,UAAkC,CAAA;AAExC,eAAa,MAAM,GAAG,EAAE,QAAQ,CAAC,WAAW;AAC1C,UAAM,CAAC,MAAM,GAAG,IAAI,IAAI,OAAO,KAAA,EAAO,MAAM,GAAG;AAC/C,QAAI,QAAQ,KAAK,SAAS,GAAG;AAC3B,cAAQ,KAAK,MAAM,IAAI,KAAK,KAAK,GAAG,EAAE,KAAA;AAAA,IACxC;AAAA,EACF,CAAC;AAED,SAAO;AACT;AAKO,SAAS,wBACd,cACA,YACe;AACf,MAAI,CAAC,aAAc,QAAO;AAE1B,QAAM,UAAU,kBAAkB,YAAY;AAC9C,SAAO,QAAQ,UAAU,KAAK;AAChC;AAKA,eAAsB,wBACpB,SACA,QACwB;AAExB,MAAI,OAAO,UAAU;AACnB,UAAM,QAAQ,MAAM,OAAO,SAAS,OAAO;AAC3C,QAAI,MAAO,QAAO;AAAA,EACpB;AAGA,QAAM,MAAM;AAOZ,MAAI,CAAC,KAAK,QAAS,QAAO;AAG1B,QAAM,aAAc,IAAI,QAAsD;AAC9E,MAAI,OAAO,eAAe,YAAY;AACpC,UAAMA,cAAa,WAAW,KAAK,IAAI,SAAS,eAAe;AAC/D,UAAMC,eAAc,mBAAmBD,eAAc,MAAS;AAC9D,QAAIC,aAAa,QAAOA;AACxB,UAAMC,cAAa,OAAO,cAAc;AACxC,UAAMC,gBAAe,WAAW,KAAK,IAAI,SAAS,QAAQ;AAC1D,QAAIA,eAAc;AAChB,YAAM,cAAc,wBAAwBA,eAAcD,WAAU;AACpE,UAAI,YAAa,QAAO;AAAA,IAC1B;AACA,WAAO;AAAA,EACT;AAGA,QAAM,eAAe,IAAI;AACzB,QAAM,aAAa,aAAa;AAChC,QAAM,cAAc,mBAAmB,UAAU;AACjD,MAAI,YAAa,QAAO;AAExB,QAAM,aAAa,OAAO,cAAc;AAExC,MAAI,IAAI,UAAU,UAAU,GAAG;AAC7B,WAAO,IAAI,QAAQ,UAAU;AAAA,EAC/B;AAEA,QAAM,eAAe,aAAa;AAClC,MAAI,cAAc;AAChB,UAAM,cAAc,wBAAwB,cAAc,UAAU;AACpE,QAAI,YAAa,QAAO;AAAA,EAC1B;AAEA,SAAO;AACT;AC3FO,MAAM,YAAY;AAAA,EAGvB,YAAY,QAA2B;AAFvB;AAGd,SAAK,SAAS;AAAA,EAChB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAiBA,MAAM,UACJ,UACA,QACA,SACA,SACkB;AAClB,UAAM,SAAS,MAAM,KAAK,aAAa,UAAU,QAAQ,SAAS,OAAO;AACzE,WAAO,OAAO;AAAA,EAChB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaA,MAAM,aACJ,UACA,QACA,SACA,SAC8B;AAC9B,QAAI;AAEF,YAAM,WAAW,MAAM,KAAK;AAAA,QAC1B;AAAA,QACA;AAAA,UACE,QAAQ;AAAA,UACR,MAAM,KAAK,UAAU;AAAA,YACnB,YAAY;AAAA,cACV;AAAA,cACA;AAAA,YAAA;AAAA,YAEF,SAAS;AAAA,cACP,UAAU,SAAS,SAAS,YAAY;AAAA,YAAA;AAAA,UAC1C,CACD;AAAA,QAAA;AAAA,QAEH;AAAA,MAAA;AAGF,UAAI,CAAC,SAAS,IAAI;AAChB,cAAM,QAAQ,MAAM,SAAS,KAAA,EAAO,MAAM,OAAO,CAAA,EAAG;AACpD,eAAO;AAAA,UACL,YAAY;AAAA,UACZ,QAAQ,MAAM,WAAW,cAAc,SAAS,MAAM;AAAA,QAAA;AAAA,MAE1D;AAEA,YAAM,OAAO,MAAM,SAAS,KAAA;AAE5B,YAAM,SAA8B,KAAK,QAAQ;AACjD,aAAO;AAAA,IACT,SAAS,OAAO;AACd,aAAO;AAAA,QACL,YAAY;AAAA,QACZ,QAAQ,iBAAiB,QAAQ,MAAM,UAAU;AAAA,MAAA;AAAA,IAErD;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,oBAAoB,SAA0C;AAClE,WAAO,wBAAwB,SAAS,KAAK,MAAM;AAAA,EACrD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAc,cACZ,KACA,MACA,SACmB;AACnB,WAAO,KAAK,QAAQ,KAAK,MAAM,OAAO;AAAA,EACxC;AAAA;AAAA;AAAA;AAAA,EAKA,MAAc,QAAQ,KAAa,MAAoB,SAAsC;AAC3F,UAAM,UAAU,KAAK,OAAO,SAAS,WAAW;AAChD,UAAM,UAAU,IAAI,WAAW,MAAM,IAAI,MAAM,GAAG,KAAK,OAAO,MAAM,GAAG,GAAG;AAE1E,UAAM,UAAkC;AAAA,MACtC,gBAAgB;AAAA,MAChB,GAAI,MAAM;AAAA,IAAA;AAIZ,QAAI,SAAS;AACX,YAAM,QAAQ,MAAM,wBAAwB,SAAS,KAAK,MAAM;AAChE,UAAI,OAAO;AACT,gBAAQ,eAAe,IAAI,UAAU,KAAK;AAAA,MAC5C;AAGA,YAAM,MAAM;AACZ,UAAI,IAAI,SAAS,QAAQ;AACvB,gBAAQ,QAAQ,IAAI,IAAI,QAAQ;AAAA,MAClC;AAAA,IACF;AAEA,WAAO,QAAQ,SAAS;AAAA,MACtB,GAAG;AAAA,MACH;AAAA;AAAA,MAEA,aAAa,KAAK,OAAO,eAAe;AAAA,IAAA,CACzC;AAAA,EACH;AACF;;;;"}

package/dist/grant-client.d.ts

@@ -0,0 +1,50 @@
+import { GrantServerConfig, AuthorizationResult, PermissionCheckOptions } from './types';
+/**
+ * Grant Client for server-side applications
+ *
+ * Makes HTTP requests to the Grant API to check permissions.
+ * Uses API-key exchanged tokens (scope in JWT claims); token-based and cookie-based extraction supported.
+ * No caching - server-side caching is handled by grant-api.
+ */
+export declare class GrantClient {
+    readonly config: Required<Pick<GrantServerConfig, 'apiUrl'>> & GrantServerConfig;
+    constructor(config: GrantServerConfig);
+    /**
+     * Check if the current user has a specific permission
+     *
+     * @example
+     * ```ts
+     * const canEdit = await grant.isGranted('document', 'update', { scope });
+     * if (canEdit) {
+     *   // Proceed with operation
+     * }
+     * ```
+     */
+    isGranted(resource: string, action: string, options?: PermissionCheckOptions, request?: unknown): Promise<boolean>;
+    /**
+     * Check authorization with full result details
+     *
+     * @example
+     * ```ts
+     * const result = await grant.isAuthorized('document', 'update', { scope }, request);
+     * if (!result.authorized) {
+     *   console.log('Denied:', result.reason);
+     * }
+     * ```
+     */
+    isAuthorized(resource: string, action: string, options?: PermissionCheckOptions, request?: unknown): Promise<AuthorizationResult>;
+    /**
+     * Extract token from a request object
+     * Useful for middleware that needs to extract token before making authorization calls
+     */
+    getTokenFromRequest(request: unknown): Promise<string | null>;
+    /**
+     * Make an authenticated fetch request (token from request; no refresh).
+     */
+    private fetchWithAuth;
+    /**
+     * Perform the actual fetch request
+     */
+    private doFetch;
+}
+//# sourceMappingURL=grant-client.d.ts.map

package/dist/grant-client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"grant-client.d.ts","sourceRoot":"","sources":["../src/grant-client.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,MAAM,SAAS,CAAC;AAE9F;;;;;;GAMG;AACH,qBAAa,WAAW;IACtB,SAAgB,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC,iBAAiB,EAAE,QAAQ,CAAC,CAAC,GAAG,iBAAiB,CAAC;gBAE5E,MAAM,EAAE,iBAAiB;IAQrC;;;;;;;;;;OAUG;IACG,SAAS,CACb,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,EACd,OAAO,CAAC,EAAE,sBAAsB,EAChC,OAAO,CAAC,EAAE,OAAO,GAChB,OAAO,CAAC,OAAO,CAAC;IAKnB;;;;;;;;;;OAUG;IACG,YAAY,CAChB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,EACd,OAAO,CAAC,EAAE,sBAAsB,EAChC,OAAO,CAAC,EAAE,OAAO,GAChB,OAAO,CAAC,mBAAmB,CAAC;IAwC/B;;;OAGG;IACG,mBAAmB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAQnE;;OAEG;YACW,aAAa;IAQ3B;;OAEG;YACW,OAAO;CA8BtB"}

package/dist/index.cjs

@@ -0,0 +1,50 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const grantClient = require("./grant-client-DywfJN5P.cjs");
+class GrantServerError extends Error {
+  constructor(message, code, statusCode = 500) {
+    super(message);
+    this.code = code;
+    this.statusCode = statusCode;
+    this.name = "GrantServerError";
+    Object.setPrototypeOf(this, GrantServerError.prototype);
+  }
+}
+class AuthenticationError extends GrantServerError {
+  constructor(message = "Unauthorized", code = "UNAUTHENTICATED") {
+    super(message, code, 401);
+    this.name = "AuthenticationError";
+    Object.setPrototypeOf(this, AuthenticationError.prototype);
+  }
+}
+class AuthorizationError extends GrantServerError {
+  constructor(message = "Forbidden", code = "FORBIDDEN", reason) {
+    super(message, code, 403);
+    this.reason = reason;
+    this.name = "AuthorizationError";
+    Object.setPrototypeOf(this, AuthorizationError.prototype);
+  }
+}
+class BadRequestError extends GrantServerError {
+  constructor(message = "Bad Request", code = "BAD_REQUEST") {
+    super(message, code, 400);
+    this.name = "BadRequestError";
+    Object.setPrototypeOf(this, BadRequestError.prototype);
+  }
+}
+class NotFoundError extends GrantServerError {
+  constructor(message = "Not Found", code = "NOT_FOUND") {
+    super(message, code, 404);
+    this.name = "NotFoundError";
+    Object.setPrototypeOf(this, NotFoundError.prototype);
+  }
+}
+exports.GrantClient = grantClient.GrantClient;
+exports.extractBearerToken = grantClient.extractBearerToken;
+exports.extractTokenFromRequest = grantClient.extractTokenFromRequest;
+exports.AuthenticationError = AuthenticationError;
+exports.AuthorizationError = AuthorizationError;
+exports.BadRequestError = BadRequestError;
+exports.GrantServerError = GrantServerError;
+exports.NotFoundError = NotFoundError;
+//# sourceMappingURL=index.cjs.map

package/dist/index.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.cjs","sources":["../src/errors.ts"],"sourcesContent":["/**\n * Base error class for Grant server errors\n */\nexport class GrantServerError extends Error {\n  constructor(\n    message: string,\n    public readonly code: string,\n    public readonly statusCode: number = 500\n  ) {\n    super(message);\n    this.name = 'GrantServerError';\n    Object.setPrototypeOf(this, GrantServerError.prototype);\n  }\n}\n\n/**\n * Authentication error (401)\n * Thrown when user is not authenticated\n */\nexport class AuthenticationError extends GrantServerError {\n  constructor(message: string = 'Unauthorized', code: string = 'UNAUTHENTICATED') {\n    super(message, code, 401);\n    this.name = 'AuthenticationError';\n    Object.setPrototypeOf(this, AuthenticationError.prototype);\n  }\n}\n\n/**\n * Authorization error (403)\n * Thrown when user is authenticated but lacks required permission\n */\nexport class AuthorizationError extends GrantServerError {\n  constructor(\n    message: string = 'Forbidden',\n    code: string = 'FORBIDDEN',\n    public readonly reason?: string\n  ) {\n    super(message, code, 403);\n    this.name = 'AuthorizationError';\n    Object.setPrototypeOf(this, AuthorizationError.prototype);\n  }\n}\n\n/**\n * Bad request error (400)\n * Thrown when request is malformed or missing required data\n */\nexport class BadRequestError extends GrantServerError {\n  constructor(message: string = 'Bad Request', code: string = 'BAD_REQUEST') {\n    super(message, code, 400);\n    this.name = 'BadRequestError';\n    Object.setPrototypeOf(this, BadRequestError.prototype);\n  }\n}\n\n/**\n * Not found error (404)\n * Thrown when resource is not found\n */\nexport class NotFoundError extends GrantServerError {\n  constructor(message: string = 'Not Found', code: string = 'NOT_FOUND') {\n    super(message, code, 404);\n    this.name = 'NotFoundError';\n    Object.setPrototypeOf(this, NotFoundError.prototype);\n  }\n}\n"],"names":[],"mappings":";;;AAGO,MAAM,yBAAyB,MAAM;AAAA,EAC1C,YACE,SACgB,MACA,aAAqB,KACrC;AACA,UAAM,OAAO;AAHG,SAAA,OAAA;AACA,SAAA,aAAA;AAGhB,SAAK,OAAO;AACZ,WAAO,eAAe,MAAM,iBAAiB,SAAS;AAAA,EACxD;AACF;AAMO,MAAM,4BAA4B,iBAAiB;AAAA,EACxD,YAAY,UAAkB,gBAAgB,OAAe,mBAAmB;AAC9E,UAAM,SAAS,MAAM,GAAG;AACxB,SAAK,OAAO;AACZ,WAAO,eAAe,MAAM,oBAAoB,SAAS;AAAA,EAC3D;AACF;AAMO,MAAM,2BAA2B,iBAAiB;AAAA,EACvD,YACE,UAAkB,aAClB,OAAe,aACC,QAChB;AACA,UAAM,SAAS,MAAM,GAAG;AAFR,SAAA,SAAA;AAGhB,SAAK,OAAO;AACZ,WAAO,eAAe,MAAM,mBAAmB,SAAS;AAAA,EAC1D;AACF;AAMO,MAAM,wBAAwB,iBAAiB;AAAA,EACpD,YAAY,UAAkB,eAAe,OAAe,eAAe;AACzE,UAAM,SAAS,MAAM,GAAG;AACxB,SAAK,OAAO;AACZ,WAAO,eAAe,MAAM,gBAAgB,SAAS;AAAA,EACvD;AACF;AAMO,MAAM,sBAAsB,iBAAiB;AAAA,EAClD,YAAY,UAAkB,aAAa,OAAe,aAAa;AACrE,UAAM,SAAS,MAAM,GAAG;AACxB,SAAK,OAAO;AACZ,WAAO,eAAe,MAAM,cAAc,SAAS;AAAA,EACrD;AACF;;;;;;;;;"}

package/dist/index.d.ts

@@ -0,0 +1,6 @@
+export { GrantClient } from './grant-client';
+export type { GrantServerConfig, AuthorizationResult, PermissionCheckOptions } from './types';
+export { GrantServerError, AuthenticationError, AuthorizationError, BadRequestError, NotFoundError, } from './errors';
+export { extractTokenFromRequest, extractBearerToken } from './utils/token-extractor';
+export type { Scope, Tenant, ResourceResolver, ResourceResolverParams, ResourceResolverResult, } from './types';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7C,YAAY,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,MAAM,SAAS,CAAC;AAG9F,OAAO,EACL,gBAAgB,EAChB,mBAAmB,EACnB,kBAAkB,EAClB,eAAe,EACf,aAAa,GACd,MAAM,UAAU,CAAC;AAGlB,OAAO,EAAE,uBAAuB,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAGtF,YAAY,EACV,KAAK,EACL,MAAM,EACN,gBAAgB,EAChB,sBAAsB,EACtB,sBAAsB,GACvB,MAAM,SAAS,CAAC"}

package/dist/index.mjs

@@ -0,0 +1,50 @@
+import { G, a, e } from "./grant-client-D1LZI2f4.js";
+class GrantServerError extends Error {
+  constructor(message, code, statusCode = 500) {
+    super(message);
+    this.code = code;
+    this.statusCode = statusCode;
+    this.name = "GrantServerError";
+    Object.setPrototypeOf(this, GrantServerError.prototype);
+  }
+}
+class AuthenticationError extends GrantServerError {
+  constructor(message = "Unauthorized", code = "UNAUTHENTICATED") {
+    super(message, code, 401);
+    this.name = "AuthenticationError";
+    Object.setPrototypeOf(this, AuthenticationError.prototype);
+  }
+}
+class AuthorizationError extends GrantServerError {
+  constructor(message = "Forbidden", code = "FORBIDDEN", reason) {
+    super(message, code, 403);
+    this.reason = reason;
+    this.name = "AuthorizationError";
+    Object.setPrototypeOf(this, AuthorizationError.prototype);
+  }
+}
+class BadRequestError extends GrantServerError {
+  constructor(message = "Bad Request", code = "BAD_REQUEST") {
+    super(message, code, 400);
+    this.name = "BadRequestError";
+    Object.setPrototypeOf(this, BadRequestError.prototype);
+  }
+}
+class NotFoundError extends GrantServerError {
+  constructor(message = "Not Found", code = "NOT_FOUND") {
+    super(message, code, 404);
+    this.name = "NotFoundError";
+    Object.setPrototypeOf(this, NotFoundError.prototype);
+  }
+}
+export {
+  AuthenticationError,
+  AuthorizationError,
+  BadRequestError,
+  G as GrantClient,
+  GrantServerError,
+  NotFoundError,
+  a as extractBearerToken,
+  e as extractTokenFromRequest
+};
+//# sourceMappingURL=index.mjs.map

package/dist/index.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.mjs","sources":["../src/errors.ts"],"sourcesContent":["/**\n * Base error class for Grant server errors\n */\nexport class GrantServerError extends Error {\n  constructor(\n    message: string,\n    public readonly code: string,\n    public readonly statusCode: number = 500\n  ) {\n    super(message);\n    this.name = 'GrantServerError';\n    Object.setPrototypeOf(this, GrantServerError.prototype);\n  }\n}\n\n/**\n * Authentication error (401)\n * Thrown when user is not authenticated\n */\nexport class AuthenticationError extends GrantServerError {\n  constructor(message: string = 'Unauthorized', code: string = 'UNAUTHENTICATED') {\n    super(message, code, 401);\n    this.name = 'AuthenticationError';\n    Object.setPrototypeOf(this, AuthenticationError.prototype);\n  }\n}\n\n/**\n * Authorization error (403)\n * Thrown when user is authenticated but lacks required permission\n */\nexport class AuthorizationError extends GrantServerError {\n  constructor(\n    message: string = 'Forbidden',\n    code: string = 'FORBIDDEN',\n    public readonly reason?: string\n  ) {\n    super(message, code, 403);\n    this.name = 'AuthorizationError';\n    Object.setPrototypeOf(this, AuthorizationError.prototype);\n  }\n}\n\n/**\n * Bad request error (400)\n * Thrown when request is malformed or missing required data\n */\nexport class BadRequestError extends GrantServerError {\n  constructor(message: string = 'Bad Request', code: string = 'BAD_REQUEST') {\n    super(message, code, 400);\n    this.name = 'BadRequestError';\n    Object.setPrototypeOf(this, BadRequestError.prototype);\n  }\n}\n\n/**\n * Not found error (404)\n * Thrown when resource is not found\n */\nexport class NotFoundError extends GrantServerError {\n  constructor(message: string = 'Not Found', code: string = 'NOT_FOUND') {\n    super(message, code, 404);\n    this.name = 'NotFoundError';\n    Object.setPrototypeOf(this, NotFoundError.prototype);\n  }\n}\n"],"names":[],"mappings":";AAGO,MAAM,yBAAyB,MAAM;AAAA,EAC1C,YACE,SACgB,MACA,aAAqB,KACrC;AACA,UAAM,OAAO;AAHG,SAAA,OAAA;AACA,SAAA,aAAA;AAGhB,SAAK,OAAO;AACZ,WAAO,eAAe,MAAM,iBAAiB,SAAS;AAAA,EACxD;AACF;AAMO,MAAM,4BAA4B,iBAAiB;AAAA,EACxD,YAAY,UAAkB,gBAAgB,OAAe,mBAAmB;AAC9E,UAAM,SAAS,MAAM,GAAG;AACxB,SAAK,OAAO;AACZ,WAAO,eAAe,MAAM,oBAAoB,SAAS;AAAA,EAC3D;AACF;AAMO,MAAM,2BAA2B,iBAAiB;AAAA,EACvD,YACE,UAAkB,aAClB,OAAe,aACC,QAChB;AACA,UAAM,SAAS,MAAM,GAAG;AAFR,SAAA,SAAA;AAGhB,SAAK,OAAO;AACZ,WAAO,eAAe,MAAM,mBAAmB,SAAS;AAAA,EAC1D;AACF;AAMO,MAAM,wBAAwB,iBAAiB;AAAA,EACpD,YAAY,UAAkB,eAAe,OAAe,eAAe;AACzE,UAAM,SAAS,MAAM,GAAG;AACxB,SAAK,OAAO;AACZ,WAAO,eAAe,MAAM,gBAAgB,SAAS;AAAA,EACvD;AACF;AAMO,MAAM,sBAAsB,iBAAiB;AAAA,EAClD,YAAY,UAAkB,aAAa,OAAe,aAAa;AACrE,UAAM,SAAS,MAAM,GAAG;AACxB,SAAK,OAAO;AACZ,WAAO,eAAe,MAAM,cAAc,SAAS;AAAA,EACrD;AACF;"}

package/dist/nest/grant.decorator.d.ts

@@ -0,0 +1,38 @@
+import { SetMetadata } from '@nestjs/common';
+/**
+ * Metadata key for Grant options (resource, action) on route handlers.
+ * Used by GrantGuard when options are not passed in the constructor.
+ */
+export declare const GRANT_OPTIONS_KEY = "grant:options";
+/**
+ * Options for the Grant guard (resource, action; resourceResolver only via guard constructor).
+ */
+export interface GrantOptions {
+    /** The resource slug to check (e.g., "Organization", "Project", "Document") */
+    resource: string;
+    /** The action to check (e.g., "Query", "Create", "Update", "Delete") */
+    action: string;
+}
+/**
+ * Decorator to require a Grant permission on a route.
+ * Use with GrantGuard (injected) so the guard reads resource/action from this metadata.
+ *
+ * @example
+ * ```ts
+ * @Get()
+ * @Grant('Document', 'Query')
+ * @UseGuards(GrantGuard)
+ * list() { ... }
+ *
+ * @Post()
+ * @Grant('Document', 'Create')
+ * @UseGuards(GrantGuard)
+ * create(@Body() dto: CreateDocumentDto) { ... }
+ * ```
+ *
+ * For dynamic resource resolution (resourceResolver), use the guard with explicit options:
+ * `@UseGuards(new GrantGuard(grantClient, { resource: 'Document', action: 'Update', resourceResolver: ... }))`
+ */
+export declare function Grant(resource: string, action: string): ReturnType<typeof SetMetadata>;
+export declare function Grant(options: GrantOptions): ReturnType<typeof SetMetadata>;
+//# sourceMappingURL=grant.decorator.d.ts.map

package/dist/nest/grant.decorator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"grant.decorator.d.ts","sourceRoot":"","sources":["../../src/nest/grant.decorator.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAE7C;;;GAGG;AACH,eAAO,MAAM,iBAAiB,kBAAkB,CAAC;AAEjD;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,+EAA+E;IAC/E,QAAQ,EAAE,MAAM,CAAC;IACjB,wEAAwE;IACxE,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,KAAK,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,UAAU,CAAC,OAAO,WAAW,CAAC,CAAC;AACxF,wBAAgB,KAAK,CAAC,OAAO,EAAE,YAAY,GAAG,UAAU,CAAC,OAAO,WAAW,CAAC,CAAC"}

package/dist/nest/grant.guard.d.ts

@@ -0,0 +1,29 @@
+import { CanActivate, ExecutionContext } from '@nestjs/common';
+import { Reflector } from '@nestjs/core';
+import { GrantClient } from '../grant-client';
+import { ResourceResolver, AuthorizationResult } from '../types';
+/** Injection token for GrantGuard. Use with @UseGuards(GRANT_GUARD) so Nest resolves the guard from the container (with GrantClient injected). */
+export declare const GRANT_GUARD = "GrantGuard";
+/**
+ * Extended request type with Grant authorization result (for use in controllers).
+ */
+export interface AuthorizedRequest {
+    authorization?: AuthorizationResult;
+}
+/**
+ * Guard options when using explicit options (includes optional resourceResolver).
+ */
+export interface GrantGuardOptions {
+    resource: string;
+    action: string;
+    resourceResolver?: ResourceResolver;
+}
+export declare class GrantGuard implements CanActivate {
+    private readonly client;
+    private readonly explicitOptions?;
+    private readonly reflector?;
+    constructor(client: GrantClient, reflectorOrOptions?: Reflector | GrantGuardOptions);
+    private getOptionsFromContext;
+    canActivate(context: ExecutionContext): Promise<boolean>;
+}
+//# sourceMappingURL=grant.guard.d.ts.map

package/dist/nest/grant.guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"grant.guard.d.ts","sourceRoot":"","sources":["../../src/nest/grant.guard.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,WAAW,EACX,gBAAgB,EAMjB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAEzC,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAO9C,kJAAkJ;AAClJ,eAAO,MAAM,WAAW,eAAe,CAAC;AAExC,OAAO,KAAK,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,UAAU,CAAC;AAGtE;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,aAAa,CAAC,EAAE,mBAAmB,CAAC;CACrC;AAED;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;CACrC;AA6BD,qBACa,UAAW,YAAW,WAAW;IAKpB,OAAO,CAAC,QAAQ,CAAC,MAAM;IAJ/C,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAoB;IACrD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAY;gBAGE,MAAM,EAAE,WAAW,EAC1D,kBAAkB,CAAC,EAAE,SAAS,GAAG,iBAAiB;IASpD,OAAO,CAAC,qBAAqB;IAsBvB,WAAW,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC;CA0E/D"}

package/dist/nest/grant.module.d.ts

@@ -0,0 +1,28 @@
+import { DynamicModule } from '@nestjs/common';
+import { GrantServerConfig } from '../types';
+export declare const GRANT_CLIENT = "GrantClient";
+/**
+ * NestJS module that provides GrantClient for injection.
+ *
+ * @example
+ * ```ts
+ * // app.module.ts
+ * import { GrantModule } from '@grantjs/server/nest';
+ *
+ * @Module({
+ *   imports: [
+ *     GrantModule.forRoot({
+ *       apiUrl: process.env.GRANT_API_URL!,
+ *       getToken: (req) => req.headers?.authorization?.replace?.('Bearer ', '') ?? null,
+ *     }),
+ *   ],
+ * })
+ * export class AppModule {}
+ * ```
+ *
+ * Then inject GrantClient in controllers and use with GrantGuard.
+ */
+export declare class GrantModule {
+    static forRoot(config: GrantServerConfig): DynamicModule;
+}
+//# sourceMappingURL=grant.module.d.ts.map

package/dist/nest/grant.module.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"grant.module.d.ts","sourceRoot":"","sources":["../../src/nest/grant.module.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAkB,MAAM,gBAAgB,CAAC;AAI/D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAC;AAElD,eAAO,MAAM,YAAY,gBAAgB,CAAC;AAE1C;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,qBAEa,WAAW;IACtB,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,iBAAiB,GAAG,aAAa;CAWzD"}

package/dist/nest/index.d.ts

@@ -0,0 +1,8 @@
+export { GrantGuard, GRANT_GUARD } from './grant.guard';
+export type { AuthorizedRequest, GrantGuardOptions } from './grant.guard';
+export { Grant, GRANT_OPTIONS_KEY } from './grant.decorator';
+export type { GrantOptions } from './grant.decorator';
+export { GrantModule, GRANT_CLIENT } from './grant.module';
+export type { GrantServerConfig, AuthorizationResult, PermissionCheckOptions, Scope, ResourceResolver, } from '../types';
+export { GrantClient } from '../grant-client';
+//# sourceMappingURL=index.d.ts.map

package/dist/nest/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/nest/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AACxD,YAAY,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAE1E,OAAO,EAAE,KAAK,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAC7D,YAAY,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAEtD,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAE3D,YAAY,EACV,iBAAiB,EACjB,mBAAmB,EACnB,sBAAsB,EACtB,KAAK,EACL,gBAAgB,GACjB,MAAM,UAAU,CAAC;AAElB,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC"}