@grantjs/server 1.0.0

package/dist/nest.cjs

@@ -0,0 +1,154 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
+var __publicField = (obj, key, value) => __defNormalProp(obj, typeof key !== "symbol" ? key + "" : key, value);
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const common = require("@nestjs/common");
+const debug = require("./debug-Crb5gNDM.cjs");
+const grantClient = require("./grant-client-DywfJN5P.cjs");
+const GRANT_OPTIONS_KEY = "grant:options";
+function Grant(resourceOrOptions, action) {
+  const options = typeof resourceOrOptions === "string" && action !== void 0 ? { resource: resourceOrOptions, action } : resourceOrOptions;
+  return common.SetMetadata(GRANT_OPTIONS_KEY, options);
+}
+var __getOwnPropDesc$1 = Object.getOwnPropertyDescriptor;
+var __decorateClass$1 = (decorators, target, key, kind) => {
+  var result = kind > 1 ? void 0 : kind ? __getOwnPropDesc$1(target, key) : target;
+  for (var i = decorators.length - 1, decorator; i >= 0; i--)
+    if (decorator = decorators[i])
+      result = decorator(result) || result;
+  return result;
+};
+const GRANT_CLIENT = "GrantClient";
+exports.GrantModule = class GrantModule {
+  static forRoot(config) {
+    const client = new grantClient.GrantClient(config);
+    return {
+      module: exports.GrantModule,
+      providers: [
+        { provide: grantClient.GrantClient, useValue: client },
+        { provide: GRANT_CLIENT, useValue: client }
+      ],
+      exports: [grantClient.GrantClient, GRANT_CLIENT]
+    };
+  }
+};
+exports.GrantModule = __decorateClass$1([
+  common.Global(),
+  common.Module({})
+], exports.GrantModule);
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __decorateClass = (decorators, target, key, kind) => {
+  var result = kind > 1 ? void 0 : kind ? __getOwnPropDesc(target, key) : target;
+  for (var i = decorators.length - 1, decorator; i >= 0; i--)
+    if (decorator = decorators[i])
+      result = decorator(result) || result;
+  return result;
+};
+var __decorateParam = (index, decorator) => (target, key) => decorator(target, key, index);
+const GRANT_GUARD = "GrantGuard";
+function isGrantGuardOptions(x) {
+  return typeof x === "object" && x !== null && "resource" in x && "action" in x && typeof x.resource === "string" && typeof x.action === "string";
+}
+exports.GrantGuard = class GrantGuard {
+  constructor(client, reflectorOrOptions) {
+    __publicField(this, "explicitOptions");
+    __publicField(this, "reflector");
+    this.client = client;
+    if (reflectorOrOptions && isGrantGuardOptions(reflectorOrOptions)) {
+      this.explicitOptions = reflectorOrOptions;
+    } else {
+      this.reflector = reflectorOrOptions;
+    }
+  }
+  getOptionsFromContext(context) {
+    const handler = context.getHandler();
+    const clazz = context.getClass();
+    if (this.reflector) {
+      const fromHandler = this.reflector.get(GRANT_OPTIONS_KEY, handler);
+      const fromClass = this.reflector.get(GRANT_OPTIONS_KEY, clazz);
+      if (fromHandler) return fromHandler;
+      if (fromClass) return fromClass;
+    }
+    if (typeof Reflect !== "undefined" && typeof Reflect.getMetadata === "function") {
+      const fromHandler = Reflect.getMetadata(GRANT_OPTIONS_KEY, handler);
+      const fromClass = Reflect.getMetadata(GRANT_OPTIONS_KEY, clazz);
+      if (fromHandler) return fromHandler;
+      if (fromClass) return fromClass;
+    }
+    return void 0;
+  }
+  async canActivate(context) {
+    const request = context.switchToHttp().getRequest();
+    const options = this.explicitOptions ?? this.getOptionsFromContext(context);
+    if (options?.resource && options?.action) {
+      debug.debugGrant("Nest", {
+        resource: options.resource,
+        action: options.action,
+        hasReflector: !!this.reflector,
+        handler: context.getHandler()?.name,
+        controller: context.getClass()?.name
+      });
+    }
+    if (!options || !options.resource || !options.action) {
+      throw new common.ForbiddenException(
+        "Grant options (resource, action) required. Use @Grant() or pass options to GrantGuard."
+      );
+    }
+    if (!this.client) {
+      throw new common.ForbiddenException(
+        "GrantGuard: GrantClient not injected. Import GrantModule.forRoot() in AppModule and register GrantGuard as a provider."
+      );
+    }
+    const token = await grantClient.extractTokenFromRequest(request, this.client.config);
+    if (!token) {
+      throw new common.UnauthorizedException({ error: "Unauthorized", code: "UNAUTHENTICATED" });
+    }
+    let resolvedResource = null;
+    const opts = options;
+    if (opts.resourceResolver) {
+      resolvedResource = await opts.resourceResolver({
+        resourceSlug: options.resource,
+        request
+      });
+      if (!resolvedResource) {
+        throw new common.NotFoundException({ error: "Resource not found", code: "NOT_FOUND" });
+      }
+    }
+    const result = await this.client.isAuthorized(
+      options.resource,
+      options.action,
+      {
+        context: {
+          resource: resolvedResource ?? void 0
+        }
+      },
+      request
+    );
+    debug.debugGrant("Nest", {
+      resource: options.resource,
+      action: options.action,
+      authorized: result.authorized,
+      ...result.authorized ? {} : { reason: result.reason }
+    });
+    if (!result.authorized) {
+      throw new common.ForbiddenException({
+        error: "Forbidden",
+        code: "FORBIDDEN",
+        reason: result.reason
+      });
+    }
+    request.authorization = result;
+    return true;
+  }
+};
+exports.GrantGuard = __decorateClass([
+  common.Injectable(),
+  __decorateParam(0, common.Inject(GRANT_CLIENT))
+], exports.GrantGuard);
+exports.GrantClient = grantClient.GrantClient;
+exports.GRANT_CLIENT = GRANT_CLIENT;
+exports.GRANT_GUARD = GRANT_GUARD;
+exports.GRANT_OPTIONS_KEY = GRANT_OPTIONS_KEY;
+exports.Grant = Grant;
+//# sourceMappingURL=nest.cjs.map

package/dist/nest.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"nest.cjs","sources":["../src/nest/grant.decorator.ts","../src/nest/grant.module.ts","../src/nest/grant.guard.ts"],"sourcesContent":["import { SetMetadata } from '@nestjs/common';\n\n/**\n * Metadata key for Grant options (resource, action) on route handlers.\n * Used by GrantGuard when options are not passed in the constructor.\n */\nexport const GRANT_OPTIONS_KEY = 'grant:options';\n\n/**\n * Options for the Grant guard (resource, action; resourceResolver only via guard constructor).\n */\nexport interface GrantOptions {\n  /** The resource slug to check (e.g., \"Organization\", \"Project\", \"Document\") */\n  resource: string;\n  /** The action to check (e.g., \"Query\", \"Create\", \"Update\", \"Delete\") */\n  action: string;\n}\n\n/**\n * Decorator to require a Grant permission on a route.\n * Use with GrantGuard (injected) so the guard reads resource/action from this metadata.\n *\n * @example\n * ```ts\n * @Get()\n * @Grant('Document', 'Query')\n * @UseGuards(GrantGuard)\n * list() { ... }\n *\n * @Post()\n * @Grant('Document', 'Create')\n * @UseGuards(GrantGuard)\n * create(@Body() dto: CreateDocumentDto) { ... }\n * ```\n *\n * For dynamic resource resolution (resourceResolver), use the guard with explicit options:\n * `@UseGuards(new GrantGuard(grantClient, { resource: 'Document', action: 'Update', resourceResolver: ... }))`\n */\nexport function Grant(resource: string, action: string): ReturnType<typeof SetMetadata>;\nexport function Grant(options: GrantOptions): ReturnType<typeof SetMetadata>;\nexport function Grant(\n  resourceOrOptions: string | GrantOptions,\n  action?: string\n): ReturnType<typeof SetMetadata> {\n  const options: GrantOptions =\n    typeof resourceOrOptions === 'string' && action !== undefined\n      ? { resource: resourceOrOptions, action }\n      : (resourceOrOptions as GrantOptions);\n  return SetMetadata(GRANT_OPTIONS_KEY, options);\n}\n","import { DynamicModule, Global, Module } from '@nestjs/common';\n\nimport { GrantClient } from '../grant-client';\n\nimport type { GrantServerConfig } from '../types';\n\nexport const GRANT_CLIENT = 'GrantClient';\n\n/**\n * NestJS module that provides GrantClient for injection.\n *\n * @example\n * ```ts\n * // app.module.ts\n * import { GrantModule } from '@grantjs/server/nest';\n *\n * @Module({\n *   imports: [\n *     GrantModule.forRoot({\n *       apiUrl: process.env.GRANT_API_URL!,\n *       getToken: (req) => req.headers?.authorization?.replace?.('Bearer ', '') ?? null,\n *     }),\n *   ],\n * })\n * export class AppModule {}\n * ```\n *\n * Then inject GrantClient in controllers and use with GrantGuard.\n */\n@Global()\n@Module({})\nexport class GrantModule {\n  static forRoot(config: GrantServerConfig): DynamicModule {\n    const client = new GrantClient(config);\n    return {\n      module: GrantModule,\n      providers: [\n        { provide: GrantClient, useValue: client },\n        { provide: GRANT_CLIENT, useValue: client },\n      ],\n      exports: [GrantClient, GRANT_CLIENT],\n    };\n  }\n}\n","import {\n  CanActivate,\n  ExecutionContext,\n  ForbiddenException,\n  Inject,\n  Injectable,\n  NotFoundException,\n  UnauthorizedException,\n} from '@nestjs/common';\nimport { Reflector } from '@nestjs/core';\n\nimport { GrantClient } from '../grant-client';\nimport { debugGrant } from '../utils/debug';\nimport { extractTokenFromRequest } from '../utils/token-extractor';\n\nimport { GRANT_OPTIONS_KEY } from './grant.decorator';\nimport { GRANT_CLIENT } from './grant.module';\n\n/** Injection token for GrantGuard. Use with @UseGuards(GRANT_GUARD) so Nest resolves the guard from the container (with GrantClient injected). */\nexport const GRANT_GUARD = 'GrantGuard';\n\nimport type { ResourceResolver, AuthorizationResult } from '../types';\nimport type { GrantOptions } from './grant.decorator';\n\n/**\n * Extended request type with Grant authorization result (for use in controllers).\n */\nexport interface AuthorizedRequest {\n  authorization?: AuthorizationResult;\n}\n\n/**\n * Guard options when using explicit options (includes optional resourceResolver).\n */\nexport interface GrantGuardOptions {\n  resource: string;\n  action: string;\n  resourceResolver?: ResourceResolver;\n}\n\n/**\n * NestJS guard that checks Grant authorization before allowing access to a route.\n *\n * Use in one of two ways:\n *\n * 1. With decorator (resource/action from metadata):\n *    - Import GrantModule.forRoot() in AppModule. In a feature module, add\n *      `{ provide: GRANT_GUARD, useClass: GrantGuard }` and use @Grant + @UseGuards(GRANT_GUARD).\n *    - Using the GRANT_GUARD token ensures Nest resolves the guard from the container (GrantClient injected).\n *\n * 2. With explicit options (supports resourceResolver):\n *    - @UseGuards(new GrantGuard(grantClient, { resource: 'Document', action: 'Update', resourceResolver: async ({ request }) => ... }))\n *\n * On success, the authorization result is attached to the request as request.authorization.\n * On failure, throws UnauthorizedException (401), ForbiddenException (403), or NotFoundException (404).\n */\nfunction isGrantGuardOptions(x: unknown): x is GrantGuardOptions {\n  return (\n    typeof x === 'object' &&\n    x !== null &&\n    'resource' in x &&\n    'action' in x &&\n    typeof (x as GrantGuardOptions).resource === 'string' &&\n    typeof (x as GrantGuardOptions).action === 'string'\n  );\n}\n\n@Injectable()\nexport class GrantGuard implements CanActivate {\n  private readonly explicitOptions?: GrantGuardOptions;\n  private readonly reflector?: Reflector;\n\n  constructor(\n    @Inject(GRANT_CLIENT) private readonly client: GrantClient,\n    reflectorOrOptions?: Reflector | GrantGuardOptions\n  ) {\n    if (reflectorOrOptions && isGrantGuardOptions(reflectorOrOptions)) {\n      this.explicitOptions = reflectorOrOptions;\n    } else {\n      this.reflector = reflectorOrOptions as Reflector | undefined;\n    }\n  }\n\n  private getOptionsFromContext(context: ExecutionContext): GrantOptions | undefined {\n    const handler = context.getHandler();\n    const clazz = context.getClass();\n    // Prefer Reflector when available (Nest DI)\n    if (this.reflector) {\n      const fromHandler = this.reflector.get<GrantOptions>(GRANT_OPTIONS_KEY, handler);\n      const fromClass = this.reflector.get<GrantOptions>(GRANT_OPTIONS_KEY, clazz);\n      if (fromHandler) return fromHandler;\n      if (fromClass) return fromClass;\n    }\n    // Fallback: read metadata via Reflect (works when Reflector is not injected, e.g. ESM/CJS boundary)\n    if (typeof Reflect !== 'undefined' && typeof Reflect.getMetadata === 'function') {\n      const fromHandler = Reflect.getMetadata(GRANT_OPTIONS_KEY, handler) as\n        | GrantOptions\n        | undefined;\n      const fromClass = Reflect.getMetadata(GRANT_OPTIONS_KEY, clazz) as GrantOptions | undefined;\n      if (fromHandler) return fromHandler;\n      if (fromClass) return fromClass;\n    }\n    return undefined;\n  }\n\n  async canActivate(context: ExecutionContext): Promise<boolean> {\n    const request = context.switchToHttp().getRequest();\n\n    const options = this.explicitOptions ?? this.getOptionsFromContext(context);\n\n    if (options?.resource && options?.action) {\n      debugGrant('Nest', {\n        resource: options.resource,\n        action: options.action,\n        hasReflector: !!this.reflector,\n        handler: context.getHandler()?.name,\n        controller: context.getClass()?.name,\n      });\n    }\n\n    if (!options || !options.resource || !options.action) {\n      throw new ForbiddenException(\n        'Grant options (resource, action) required. Use @Grant() or pass options to GrantGuard.'\n      );\n    }\n\n    if (!this.client) {\n      throw new ForbiddenException(\n        'GrantGuard: GrantClient not injected. Import GrantModule.forRoot() in AppModule and register GrantGuard as a provider.'\n      );\n    }\n\n    const token = await extractTokenFromRequest(request, this.client.config);\n    if (!token) {\n      throw new UnauthorizedException({ error: 'Unauthorized', code: 'UNAUTHENTICATED' });\n    }\n\n    let resolvedResource: Record<string, unknown> | null = null;\n\n    const opts = options as GrantGuardOptions;\n    if (opts.resourceResolver) {\n      resolvedResource = await opts.resourceResolver({\n        resourceSlug: options.resource,\n        request,\n      });\n      if (!resolvedResource) {\n        throw new NotFoundException({ error: 'Resource not found', code: 'NOT_FOUND' });\n      }\n    }\n\n    const result = await this.client.isAuthorized(\n      options.resource,\n      options.action,\n      {\n        context: {\n          resource: resolvedResource ?? undefined,\n        },\n      },\n      request\n    );\n\n    debugGrant('Nest', {\n      resource: options.resource,\n      action: options.action,\n      authorized: result.authorized,\n      ...(result.authorized ? {} : { reason: result.reason }),\n    });\n\n    if (!result.authorized) {\n      throw new ForbiddenException({\n        error: 'Forbidden',\n        code: 'FORBIDDEN',\n        reason: result.reason,\n      });\n    }\n\n    (request as AuthorizedRequest).authorization = result;\n    return true;\n  }\n}\n"],"names":["SetMetadata","GrantModule","GrantClient","__decorateClass","Global","Module","GrantGuard","debugGrant","ForbiddenException","extractTokenFromRequest","UnauthorizedException","NotFoundException","Injectable"],"mappings":";;;;;;;;AAMO,MAAM,oBAAoB;AAkC1B,SAAS,MACd,mBACA,QACgC;AAChC,QAAM,UACJ,OAAO,sBAAsB,YAAY,WAAW,SAChD,EAAE,UAAU,mBAAmB,OAAA,IAC9B;AACP,SAAOA,OAAAA,YAAY,mBAAmB,OAAO;AAC/C;;;;;;;;;AC3CO,MAAM,eAAe;AAyBfC,QAAAA,cAAN,kBAAkB;AAAA,EACvB,OAAO,QAAQ,QAA0C;AACvD,UAAM,SAAS,IAAIC,YAAAA,YAAY,MAAM;AACrC,WAAO;AAAA,MACL,QAAQD,QAAAA;AAAAA,MACR,WAAW;AAAA,QACT,EAAE,SAASC,YAAAA,aAAa,UAAU,OAAA;AAAA,QAClC,EAAE,SAAS,cAAc,UAAU,OAAA;AAAA,MAAO;AAAA,MAE5C,SAAS,CAACA,YAAAA,aAAa,YAAY;AAAA,IAAA;AAAA,EAEvC;AACF;AAZaD,QAAAA,cAANE,kBAAA;AAAA,EAFNC,cAAA;AAAA,EACAC,OAAAA,OAAO,CAAA,CAAE;AAAA,GACGJ,mBAAA;;;;;;;;;;ACZN,MAAM,cAAc;AAqC3B,SAAS,oBAAoB,GAAoC;AAC/D,SACE,OAAO,MAAM,YACb,MAAM,QACN,cAAc,KACd,YAAY,KACZ,OAAQ,EAAwB,aAAa,YAC7C,OAAQ,EAAwB,WAAW;AAE/C;AAGaK,QAAAA,aAAN,iBAAwC;AAAA,EAI7C,YACyC,QACvC,oBACA;AANe;AACA;AAGwB,SAAA,SAAA;AAGvC,QAAI,sBAAsB,oBAAoB,kBAAkB,GAAG;AACjE,WAAK,kBAAkB;AAAA,IACzB,OAAO;AACL,WAAK,YAAY;AAAA,IACnB;AAAA,EACF;AAAA,EAEQ,sBAAsB,SAAqD;AACjF,UAAM,UAAU,QAAQ,WAAA;AACxB,UAAM,QAAQ,QAAQ,SAAA;AAEtB,QAAI,KAAK,WAAW;AAClB,YAAM,cAAc,KAAK,UAAU,IAAkB,mBAAmB,OAAO;AAC/E,YAAM,YAAY,KAAK,UAAU,IAAkB,mBAAmB,KAAK;AAC3E,UAAI,YAAa,QAAO;AACxB,UAAI,UAAW,QAAO;AAAA,IACxB;AAEA,QAAI,OAAO,YAAY,eAAe,OAAO,QAAQ,gBAAgB,YAAY;AAC/E,YAAM,cAAc,QAAQ,YAAY,mBAAmB,OAAO;AAGlE,YAAM,YAAY,QAAQ,YAAY,mBAAmB,KAAK;AAC9D,UAAI,YAAa,QAAO;AACxB,UAAI,UAAW,QAAO;AAAA,IACxB;AACA,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,YAAY,SAA6C;AAC7D,UAAM,UAAU,QAAQ,aAAA,EAAe,WAAA;AAEvC,UAAM,UAAU,KAAK,mBAAmB,KAAK,sBAAsB,OAAO;AAE1E,QAAI,SAAS,YAAY,SAAS,QAAQ;AACxCC,YAAAA,WAAW,QAAQ;AAAA,QACjB,UAAU,QAAQ;AAAA,QAClB,QAAQ,QAAQ;AAAA,QAChB,cAAc,CAAC,CAAC,KAAK;AAAA,QACrB,SAAS,QAAQ,WAAA,GAAc;AAAA,QAC/B,YAAY,QAAQ,YAAY;AAAA,MAAA,CACjC;AAAA,IACH;AAEA,QAAI,CAAC,WAAW,CAAC,QAAQ,YAAY,CAAC,QAAQ,QAAQ;AACpD,YAAM,IAAIC,OAAAA;AAAAA,QACR;AAAA,MAAA;AAAA,IAEJ;AAEA,QAAI,CAAC,KAAK,QAAQ;AAChB,YAAM,IAAIA,OAAAA;AAAAA,QACR;AAAA,MAAA;AAAA,IAEJ;AAEA,UAAM,QAAQ,MAAMC,YAAAA,wBAAwB,SAAS,KAAK,OAAO,MAAM;AACvE,QAAI,CAAC,OAAO;AACV,YAAM,IAAIC,OAAAA,sBAAsB,EAAE,OAAO,gBAAgB,MAAM,mBAAmB;AAAA,IACpF;AAEA,QAAI,mBAAmD;AAEvD,UAAM,OAAO;AACb,QAAI,KAAK,kBAAkB;AACzB,yBAAmB,MAAM,KAAK,iBAAiB;AAAA,QAC7C,cAAc,QAAQ;AAAA,QACtB;AAAA,MAAA,CACD;AACD,UAAI,CAAC,kBAAkB;AACrB,cAAM,IAAIC,OAAAA,kBAAkB,EAAE,OAAO,sBAAsB,MAAM,aAAa;AAAA,MAChF;AAAA,IACF;AAEA,UAAM,SAAS,MAAM,KAAK,OAAO;AAAA,MAC/B,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR;AAAA,QACE,SAAS;AAAA,UACP,UAAU,oBAAoB;AAAA,QAAA;AAAA,MAChC;AAAA,MAEF;AAAA,IAAA;AAGFJ,UAAAA,WAAW,QAAQ;AAAA,MACjB,UAAU,QAAQ;AAAA,MAClB,QAAQ,QAAQ;AAAA,MAChB,YAAY,OAAO;AAAA,MACnB,GAAI,OAAO,aAAa,CAAA,IAAK,EAAE,QAAQ,OAAO,OAAA;AAAA,IAAO,CACtD;AAED,QAAI,CAAC,OAAO,YAAY;AACtB,YAAM,IAAIC,OAAAA,mBAAmB;AAAA,QAC3B,OAAO;AAAA,QACP,MAAM;AAAA,QACN,QAAQ,OAAO;AAAA,MAAA,CAChB;AAAA,IACH;AAEC,YAA8B,gBAAgB;AAC/C,WAAO;AAAA,EACT;AACF;AA/GaF,QAAAA,aAAN,gBAAA;AAAA,EADNM,kBAAA;AAAA,EAMI,iCAAO,YAAY,CAAA;AAAA,GALXN,kBAAA;;;;;;"}

package/dist/nest.mjs

@@ -0,0 +1,156 @@
+var __defProp = Object.defineProperty;
+var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
+var __publicField = (obj, key, value) => __defNormalProp(obj, typeof key !== "symbol" ? key + "" : key, value);
+import { SetMetadata, Global, Module, ForbiddenException, UnauthorizedException, NotFoundException, Injectable, Inject } from "@nestjs/common";
+import { d as debugGrant } from "./debug-C8ibbrE5.js";
+import { G as GrantClient, e as extractTokenFromRequest } from "./grant-client-D1LZI2f4.js";
+const GRANT_OPTIONS_KEY = "grant:options";
+function Grant(resourceOrOptions, action) {
+  const options = typeof resourceOrOptions === "string" && action !== void 0 ? { resource: resourceOrOptions, action } : resourceOrOptions;
+  return SetMetadata(GRANT_OPTIONS_KEY, options);
+}
+var __getOwnPropDesc$1 = Object.getOwnPropertyDescriptor;
+var __decorateClass$1 = (decorators, target, key, kind) => {
+  var result = kind > 1 ? void 0 : kind ? __getOwnPropDesc$1(target, key) : target;
+  for (var i = decorators.length - 1, decorator; i >= 0; i--)
+    if (decorator = decorators[i])
+      result = decorator(result) || result;
+  return result;
+};
+const GRANT_CLIENT = "GrantClient";
+let GrantModule = class {
+  static forRoot(config) {
+    const client = new GrantClient(config);
+    return {
+      module: GrantModule,
+      providers: [
+        { provide: GrantClient, useValue: client },
+        { provide: GRANT_CLIENT, useValue: client }
+      ],
+      exports: [GrantClient, GRANT_CLIENT]
+    };
+  }
+};
+GrantModule = __decorateClass$1([
+  Global(),
+  Module({})
+], GrantModule);
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __decorateClass = (decorators, target, key, kind) => {
+  var result = kind > 1 ? void 0 : kind ? __getOwnPropDesc(target, key) : target;
+  for (var i = decorators.length - 1, decorator; i >= 0; i--)
+    if (decorator = decorators[i])
+      result = decorator(result) || result;
+  return result;
+};
+var __decorateParam = (index, decorator) => (target, key) => decorator(target, key, index);
+const GRANT_GUARD = "GrantGuard";
+function isGrantGuardOptions(x) {
+  return typeof x === "object" && x !== null && "resource" in x && "action" in x && typeof x.resource === "string" && typeof x.action === "string";
+}
+let GrantGuard = class {
+  constructor(client, reflectorOrOptions) {
+    __publicField(this, "explicitOptions");
+    __publicField(this, "reflector");
+    this.client = client;
+    if (reflectorOrOptions && isGrantGuardOptions(reflectorOrOptions)) {
+      this.explicitOptions = reflectorOrOptions;
+    } else {
+      this.reflector = reflectorOrOptions;
+    }
+  }
+  getOptionsFromContext(context) {
+    const handler = context.getHandler();
+    const clazz = context.getClass();
+    if (this.reflector) {
+      const fromHandler = this.reflector.get(GRANT_OPTIONS_KEY, handler);
+      const fromClass = this.reflector.get(GRANT_OPTIONS_KEY, clazz);
+      if (fromHandler) return fromHandler;
+      if (fromClass) return fromClass;
+    }
+    if (typeof Reflect !== "undefined" && typeof Reflect.getMetadata === "function") {
+      const fromHandler = Reflect.getMetadata(GRANT_OPTIONS_KEY, handler);
+      const fromClass = Reflect.getMetadata(GRANT_OPTIONS_KEY, clazz);
+      if (fromHandler) return fromHandler;
+      if (fromClass) return fromClass;
+    }
+    return void 0;
+  }
+  async canActivate(context) {
+    const request = context.switchToHttp().getRequest();
+    const options = this.explicitOptions ?? this.getOptionsFromContext(context);
+    if (options?.resource && options?.action) {
+      debugGrant("Nest", {
+        resource: options.resource,
+        action: options.action,
+        hasReflector: !!this.reflector,
+        handler: context.getHandler()?.name,
+        controller: context.getClass()?.name
+      });
+    }
+    if (!options || !options.resource || !options.action) {
+      throw new ForbiddenException(
+        "Grant options (resource, action) required. Use @Grant() or pass options to GrantGuard."
+      );
+    }
+    if (!this.client) {
+      throw new ForbiddenException(
+        "GrantGuard: GrantClient not injected. Import GrantModule.forRoot() in AppModule and register GrantGuard as a provider."
+      );
+    }
+    const token = await extractTokenFromRequest(request, this.client.config);
+    if (!token) {
+      throw new UnauthorizedException({ error: "Unauthorized", code: "UNAUTHENTICATED" });
+    }
+    let resolvedResource = null;
+    const opts = options;
+    if (opts.resourceResolver) {
+      resolvedResource = await opts.resourceResolver({
+        resourceSlug: options.resource,
+        request
+      });
+      if (!resolvedResource) {
+        throw new NotFoundException({ error: "Resource not found", code: "NOT_FOUND" });
+      }
+    }
+    const result = await this.client.isAuthorized(
+      options.resource,
+      options.action,
+      {
+        context: {
+          resource: resolvedResource ?? void 0
+        }
+      },
+      request
+    );
+    debugGrant("Nest", {
+      resource: options.resource,
+      action: options.action,
+      authorized: result.authorized,
+      ...result.authorized ? {} : { reason: result.reason }
+    });
+    if (!result.authorized) {
+      throw new ForbiddenException({
+        error: "Forbidden",
+        code: "FORBIDDEN",
+        reason: result.reason
+      });
+    }
+    request.authorization = result;
+    return true;
+  }
+};
+GrantGuard = __decorateClass([
+  Injectable(),
+  __decorateParam(0, Inject(GRANT_CLIENT))
+], GrantGuard);
+export {
+  GRANT_CLIENT,
+  GRANT_GUARD,
+  GRANT_OPTIONS_KEY,
+  Grant,
+  GrantClient,
+  GrantGuard,
+  GrantModule
+};
+//# sourceMappingURL=nest.mjs.map

package/dist/nest.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"nest.mjs","sources":["../src/nest/grant.decorator.ts","../src/nest/grant.module.ts","../src/nest/grant.guard.ts"],"sourcesContent":["import { SetMetadata } from '@nestjs/common';\n\n/**\n * Metadata key for Grant options (resource, action) on route handlers.\n * Used by GrantGuard when options are not passed in the constructor.\n */\nexport const GRANT_OPTIONS_KEY = 'grant:options';\n\n/**\n * Options for the Grant guard (resource, action; resourceResolver only via guard constructor).\n */\nexport interface GrantOptions {\n  /** The resource slug to check (e.g., \"Organization\", \"Project\", \"Document\") */\n  resource: string;\n  /** The action to check (e.g., \"Query\", \"Create\", \"Update\", \"Delete\") */\n  action: string;\n}\n\n/**\n * Decorator to require a Grant permission on a route.\n * Use with GrantGuard (injected) so the guard reads resource/action from this metadata.\n *\n * @example\n * ```ts\n * @Get()\n * @Grant('Document', 'Query')\n * @UseGuards(GrantGuard)\n * list() { ... }\n *\n * @Post()\n * @Grant('Document', 'Create')\n * @UseGuards(GrantGuard)\n * create(@Body() dto: CreateDocumentDto) { ... }\n * ```\n *\n * For dynamic resource resolution (resourceResolver), use the guard with explicit options:\n * `@UseGuards(new GrantGuard(grantClient, { resource: 'Document', action: 'Update', resourceResolver: ... }))`\n */\nexport function Grant(resource: string, action: string): ReturnType<typeof SetMetadata>;\nexport function Grant(options: GrantOptions): ReturnType<typeof SetMetadata>;\nexport function Grant(\n  resourceOrOptions: string | GrantOptions,\n  action?: string\n): ReturnType<typeof SetMetadata> {\n  const options: GrantOptions =\n    typeof resourceOrOptions === 'string' && action !== undefined\n      ? { resource: resourceOrOptions, action }\n      : (resourceOrOptions as GrantOptions);\n  return SetMetadata(GRANT_OPTIONS_KEY, options);\n}\n","import { DynamicModule, Global, Module } from '@nestjs/common';\n\nimport { GrantClient } from '../grant-client';\n\nimport type { GrantServerConfig } from '../types';\n\nexport const GRANT_CLIENT = 'GrantClient';\n\n/**\n * NestJS module that provides GrantClient for injection.\n *\n * @example\n * ```ts\n * // app.module.ts\n * import { GrantModule } from '@grantjs/server/nest';\n *\n * @Module({\n *   imports: [\n *     GrantModule.forRoot({\n *       apiUrl: process.env.GRANT_API_URL!,\n *       getToken: (req) => req.headers?.authorization?.replace?.('Bearer ', '') ?? null,\n *     }),\n *   ],\n * })\n * export class AppModule {}\n * ```\n *\n * Then inject GrantClient in controllers and use with GrantGuard.\n */\n@Global()\n@Module({})\nexport class GrantModule {\n  static forRoot(config: GrantServerConfig): DynamicModule {\n    const client = new GrantClient(config);\n    return {\n      module: GrantModule,\n      providers: [\n        { provide: GrantClient, useValue: client },\n        { provide: GRANT_CLIENT, useValue: client },\n      ],\n      exports: [GrantClient, GRANT_CLIENT],\n    };\n  }\n}\n","import {\n  CanActivate,\n  ExecutionContext,\n  ForbiddenException,\n  Inject,\n  Injectable,\n  NotFoundException,\n  UnauthorizedException,\n} from '@nestjs/common';\nimport { Reflector } from '@nestjs/core';\n\nimport { GrantClient } from '../grant-client';\nimport { debugGrant } from '../utils/debug';\nimport { extractTokenFromRequest } from '../utils/token-extractor';\n\nimport { GRANT_OPTIONS_KEY } from './grant.decorator';\nimport { GRANT_CLIENT } from './grant.module';\n\n/** Injection token for GrantGuard. Use with @UseGuards(GRANT_GUARD) so Nest resolves the guard from the container (with GrantClient injected). */\nexport const GRANT_GUARD = 'GrantGuard';\n\nimport type { ResourceResolver, AuthorizationResult } from '../types';\nimport type { GrantOptions } from './grant.decorator';\n\n/**\n * Extended request type with Grant authorization result (for use in controllers).\n */\nexport interface AuthorizedRequest {\n  authorization?: AuthorizationResult;\n}\n\n/**\n * Guard options when using explicit options (includes optional resourceResolver).\n */\nexport interface GrantGuardOptions {\n  resource: string;\n  action: string;\n  resourceResolver?: ResourceResolver;\n}\n\n/**\n * NestJS guard that checks Grant authorization before allowing access to a route.\n *\n * Use in one of two ways:\n *\n * 1. With decorator (resource/action from metadata):\n *    - Import GrantModule.forRoot() in AppModule. In a feature module, add\n *      `{ provide: GRANT_GUARD, useClass: GrantGuard }` and use @Grant + @UseGuards(GRANT_GUARD).\n *    - Using the GRANT_GUARD token ensures Nest resolves the guard from the container (GrantClient injected).\n *\n * 2. With explicit options (supports resourceResolver):\n *    - @UseGuards(new GrantGuard(grantClient, { resource: 'Document', action: 'Update', resourceResolver: async ({ request }) => ... }))\n *\n * On success, the authorization result is attached to the request as request.authorization.\n * On failure, throws UnauthorizedException (401), ForbiddenException (403), or NotFoundException (404).\n */\nfunction isGrantGuardOptions(x: unknown): x is GrantGuardOptions {\n  return (\n    typeof x === 'object' &&\n    x !== null &&\n    'resource' in x &&\n    'action' in x &&\n    typeof (x as GrantGuardOptions).resource === 'string' &&\n    typeof (x as GrantGuardOptions).action === 'string'\n  );\n}\n\n@Injectable()\nexport class GrantGuard implements CanActivate {\n  private readonly explicitOptions?: GrantGuardOptions;\n  private readonly reflector?: Reflector;\n\n  constructor(\n    @Inject(GRANT_CLIENT) private readonly client: GrantClient,\n    reflectorOrOptions?: Reflector | GrantGuardOptions\n  ) {\n    if (reflectorOrOptions && isGrantGuardOptions(reflectorOrOptions)) {\n      this.explicitOptions = reflectorOrOptions;\n    } else {\n      this.reflector = reflectorOrOptions as Reflector | undefined;\n    }\n  }\n\n  private getOptionsFromContext(context: ExecutionContext): GrantOptions | undefined {\n    const handler = context.getHandler();\n    const clazz = context.getClass();\n    // Prefer Reflector when available (Nest DI)\n    if (this.reflector) {\n      const fromHandler = this.reflector.get<GrantOptions>(GRANT_OPTIONS_KEY, handler);\n      const fromClass = this.reflector.get<GrantOptions>(GRANT_OPTIONS_KEY, clazz);\n      if (fromHandler) return fromHandler;\n      if (fromClass) return fromClass;\n    }\n    // Fallback: read metadata via Reflect (works when Reflector is not injected, e.g. ESM/CJS boundary)\n    if (typeof Reflect !== 'undefined' && typeof Reflect.getMetadata === 'function') {\n      const fromHandler = Reflect.getMetadata(GRANT_OPTIONS_KEY, handler) as\n        | GrantOptions\n        | undefined;\n      const fromClass = Reflect.getMetadata(GRANT_OPTIONS_KEY, clazz) as GrantOptions | undefined;\n      if (fromHandler) return fromHandler;\n      if (fromClass) return fromClass;\n    }\n    return undefined;\n  }\n\n  async canActivate(context: ExecutionContext): Promise<boolean> {\n    const request = context.switchToHttp().getRequest();\n\n    const options = this.explicitOptions ?? this.getOptionsFromContext(context);\n\n    if (options?.resource && options?.action) {\n      debugGrant('Nest', {\n        resource: options.resource,\n        action: options.action,\n        hasReflector: !!this.reflector,\n        handler: context.getHandler()?.name,\n        controller: context.getClass()?.name,\n      });\n    }\n\n    if (!options || !options.resource || !options.action) {\n      throw new ForbiddenException(\n        'Grant options (resource, action) required. Use @Grant() or pass options to GrantGuard.'\n      );\n    }\n\n    if (!this.client) {\n      throw new ForbiddenException(\n        'GrantGuard: GrantClient not injected. Import GrantModule.forRoot() in AppModule and register GrantGuard as a provider.'\n      );\n    }\n\n    const token = await extractTokenFromRequest(request, this.client.config);\n    if (!token) {\n      throw new UnauthorizedException({ error: 'Unauthorized', code: 'UNAUTHENTICATED' });\n    }\n\n    let resolvedResource: Record<string, unknown> | null = null;\n\n    const opts = options as GrantGuardOptions;\n    if (opts.resourceResolver) {\n      resolvedResource = await opts.resourceResolver({\n        resourceSlug: options.resource,\n        request,\n      });\n      if (!resolvedResource) {\n        throw new NotFoundException({ error: 'Resource not found', code: 'NOT_FOUND' });\n      }\n    }\n\n    const result = await this.client.isAuthorized(\n      options.resource,\n      options.action,\n      {\n        context: {\n          resource: resolvedResource ?? undefined,\n        },\n      },\n      request\n    );\n\n    debugGrant('Nest', {\n      resource: options.resource,\n      action: options.action,\n      authorized: result.authorized,\n      ...(result.authorized ? {} : { reason: result.reason }),\n    });\n\n    if (!result.authorized) {\n      throw new ForbiddenException({\n        error: 'Forbidden',\n        code: 'FORBIDDEN',\n        reason: result.reason,\n      });\n    }\n\n    (request as AuthorizedRequest).authorization = result;\n    return true;\n  }\n}\n"],"names":["__decorateClass"],"mappings":";;;;;;AAMO,MAAM,oBAAoB;AAkC1B,SAAS,MACd,mBACA,QACgC;AAChC,QAAM,UACJ,OAAO,sBAAsB,YAAY,WAAW,SAChD,EAAE,UAAU,mBAAmB,OAAA,IAC9B;AACP,SAAO,YAAY,mBAAmB,OAAO;AAC/C;;;;;;;;;AC3CO,MAAM,eAAe;AAyBrB,IAAM,cAAN,MAAkB;AAAA,EACvB,OAAO,QAAQ,QAA0C;AACvD,UAAM,SAAS,IAAI,YAAY,MAAM;AACrC,WAAO;AAAA,MACL,QAAQ;AAAA,MACR,WAAW;AAAA,QACT,EAAE,SAAS,aAAa,UAAU,OAAA;AAAA,QAClC,EAAE,SAAS,cAAc,UAAU,OAAA;AAAA,MAAO;AAAA,MAE5C,SAAS,CAAC,aAAa,YAAY;AAAA,IAAA;AAAA,EAEvC;AACF;AAZa,cAANA,kBAAA;AAAA,EAFN,OAAA;AAAA,EACA,OAAO,CAAA,CAAE;AAAA,GACG,WAAA;;;;;;;;;;ACZN,MAAM,cAAc;AAqC3B,SAAS,oBAAoB,GAAoC;AAC/D,SACE,OAAO,MAAM,YACb,MAAM,QACN,cAAc,KACd,YAAY,KACZ,OAAQ,EAAwB,aAAa,YAC7C,OAAQ,EAAwB,WAAW;AAE/C;AAGO,IAAM,aAAN,MAAwC;AAAA,EAI7C,YACyC,QACvC,oBACA;AANe;AACA;AAGwB,SAAA,SAAA;AAGvC,QAAI,sBAAsB,oBAAoB,kBAAkB,GAAG;AACjE,WAAK,kBAAkB;AAAA,IACzB,OAAO;AACL,WAAK,YAAY;AAAA,IACnB;AAAA,EACF;AAAA,EAEQ,sBAAsB,SAAqD;AACjF,UAAM,UAAU,QAAQ,WAAA;AACxB,UAAM,QAAQ,QAAQ,SAAA;AAEtB,QAAI,KAAK,WAAW;AAClB,YAAM,cAAc,KAAK,UAAU,IAAkB,mBAAmB,OAAO;AAC/E,YAAM,YAAY,KAAK,UAAU,IAAkB,mBAAmB,KAAK;AAC3E,UAAI,YAAa,QAAO;AACxB,UAAI,UAAW,QAAO;AAAA,IACxB;AAEA,QAAI,OAAO,YAAY,eAAe,OAAO,QAAQ,gBAAgB,YAAY;AAC/E,YAAM,cAAc,QAAQ,YAAY,mBAAmB,OAAO;AAGlE,YAAM,YAAY,QAAQ,YAAY,mBAAmB,KAAK;AAC9D,UAAI,YAAa,QAAO;AACxB,UAAI,UAAW,QAAO;AAAA,IACxB;AACA,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,YAAY,SAA6C;AAC7D,UAAM,UAAU,QAAQ,aAAA,EAAe,WAAA;AAEvC,UAAM,UAAU,KAAK,mBAAmB,KAAK,sBAAsB,OAAO;AAE1E,QAAI,SAAS,YAAY,SAAS,QAAQ;AACxC,iBAAW,QAAQ;AAAA,QACjB,UAAU,QAAQ;AAAA,QAClB,QAAQ,QAAQ;AAAA,QAChB,cAAc,CAAC,CAAC,KAAK;AAAA,QACrB,SAAS,QAAQ,WAAA,GAAc;AAAA,QAC/B,YAAY,QAAQ,YAAY;AAAA,MAAA,CACjC;AAAA,IACH;AAEA,QAAI,CAAC,WAAW,CAAC,QAAQ,YAAY,CAAC,QAAQ,QAAQ;AACpD,YAAM,IAAI;AAAA,QACR;AAAA,MAAA;AAAA,IAEJ;AAEA,QAAI,CAAC,KAAK,QAAQ;AAChB,YAAM,IAAI;AAAA,QACR;AAAA,MAAA;AAAA,IAEJ;AAEA,UAAM,QAAQ,MAAM,wBAAwB,SAAS,KAAK,OAAO,MAAM;AACvE,QAAI,CAAC,OAAO;AACV,YAAM,IAAI,sBAAsB,EAAE,OAAO,gBAAgB,MAAM,mBAAmB;AAAA,IACpF;AAEA,QAAI,mBAAmD;AAEvD,UAAM,OAAO;AACb,QAAI,KAAK,kBAAkB;AACzB,yBAAmB,MAAM,KAAK,iBAAiB;AAAA,QAC7C,cAAc,QAAQ;AAAA,QACtB;AAAA,MAAA,CACD;AACD,UAAI,CAAC,kBAAkB;AACrB,cAAM,IAAI,kBAAkB,EAAE,OAAO,sBAAsB,MAAM,aAAa;AAAA,MAChF;AAAA,IACF;AAEA,UAAM,SAAS,MAAM,KAAK,OAAO;AAAA,MAC/B,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR;AAAA,QACE,SAAS;AAAA,UACP,UAAU,oBAAoB;AAAA,QAAA;AAAA,MAChC;AAAA,MAEF;AAAA,IAAA;AAGF,eAAW,QAAQ;AAAA,MACjB,UAAU,QAAQ;AAAA,MAClB,QAAQ,QAAQ;AAAA,MAChB,YAAY,OAAO;AAAA,MACnB,GAAI,OAAO,aAAa,CAAA,IAAK,EAAE,QAAQ,OAAO,OAAA;AAAA,IAAO,CACtD;AAED,QAAI,CAAC,OAAO,YAAY;AACtB,YAAM,IAAI,mBAAmB;AAAA,QAC3B,OAAO;AAAA,QACP,MAAM;AAAA,QACN,QAAQ,OAAO;AAAA,MAAA,CAChB;AAAA,IACH;AAEC,YAA8B,gBAAgB;AAC/C,WAAO;AAAA,EACT;AACF;AA/Ga,aAAN,gBAAA;AAAA,EADN,WAAA;AAAA,EAMI,0BAAO,YAAY,CAAA;AAAA,GALX,UAAA;"}

package/dist/next/index.d.ts

@@ -0,0 +1,6 @@
+export { withGrant } from './with-grant';
+export type { GrantOptions, GrantRouteHandler, WithGrantContext } from './with-grant';
+export type { GrantServerConfig, AuthorizationResult, PermissionCheckOptions, Scope, ResourceResolver, } from '../types';
+export { GrantClient } from '../grant-client';
+export { AuthenticationError, AuthorizationError, BadRequestError, NotFoundError } from '../errors';
+//# sourceMappingURL=index.d.ts.map

package/dist/next/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/next/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,YAAY,EAAE,YAAY,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAEtF,YAAY,EACV,iBAAiB,EACjB,mBAAmB,EACnB,sBAAsB,EACtB,KAAK,EACL,gBAAgB,GACjB,MAAM,UAAU,CAAC;AAElB,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAC9C,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC"}

package/dist/next/with-grant.d.ts

@@ -0,0 +1,57 @@
+import { NextRequest } from 'next/server';
+import { GrantClient } from '../grant-client';
+import { ResourceResolver, AuthorizationResult } from '../types';
+/**
+ * Options for Next.js route handler guard
+ */
+export interface GrantOptions {
+    /** The resource slug to check (e.g., "Organization", "Project", "Document") */
+    resource: string;
+    /** The action to check (e.g., "Query", "Create", "Update", "Delete") */
+    action: string;
+    /** Custom resource resolver for condition evaluation */
+    resourceResolver?: ResourceResolver;
+}
+/**
+ * Context passed to the handler after authorization (for downstream use)
+ */
+export interface WithGrantContext {
+    authorization: AuthorizationResult;
+}
+/**
+ * Next.js App Router route handler type (GET, POST, etc.)
+ * Second argument is optional context; params are in the request URL for resolver use.
+ */
+export type GrantRouteHandler = (request: NextRequest, context?: WithGrantContext) => Promise<Response> | Response;
+/**
+ * Wrap a Next.js App Router route handler with Grant authorization.
+ * Use for GET, POST, PUT, PATCH, DELETE in app/api/.../route.ts.
+ *
+ * Compatible with Next.js 13–16. In Next 15+, the route context's `params` is a Promise;
+ * this wrapper does not use params (only `request` is passed to the resolver/handler).
+ *
+ * @example
+ * ```ts
+ * // app/api/documents/route.ts
+ * import { withGrant } from '@grantjs/server/next';
+ * import { GrantClient } from '@grantjs/server';
+ *
+ * const grantClient = new GrantClient({ apiUrl: process.env.GRANT_API_URL! });
+ *
+ * export const GET = withGrant(
+ *   grantClient,
+ *   { resource: 'Document', action: 'Query' },
+ *   async (request) => NextResponse.json({ data: [] })
+ * );
+ *
+ * export const POST = withGrant(
+ *   grantClient,
+ *   { resource: 'Document', action: 'Create' },
+ *   async (request) => { ... }
+ * );
+ * ```
+ */
+export declare function withGrant(client: GrantClient, options: GrantOptions, handler: GrantRouteHandler): (request: NextRequest, context?: {
+    params?: Promise<Record<string, string>>;
+}) => Promise<Response>;
+//# sourceMappingURL=with-grant.d.ts.map

package/dist/next/with-grant.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"with-grant.d.ts","sourceRoot":"","sources":["../../src/next/with-grant.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAgB,MAAM,aAAa,CAAC;AAExD,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAI9C,OAAO,KAAK,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,UAAU,CAAC;AAEtE;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,+EAA+E;IAC/E,QAAQ,EAAE,MAAM,CAAC;IACjB,wEAAwE;IACxE,MAAM,EAAE,MAAM,CAAC;IACf,wDAAwD;IACxD,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;CACrC;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,aAAa,EAAE,mBAAmB,CAAC;CACpC;AAED;;;GAGG;AACH,MAAM,MAAM,iBAAiB,GAAG,CAC9B,OAAO,EAAE,WAAW,EACpB,OAAO,CAAC,EAAE,gBAAgB,KACvB,OAAO,CAAC,QAAQ,CAAC,GAAG,QAAQ,CAAC;AAElC;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAgB,SAAS,CACvB,MAAM,EAAE,WAAW,EACnB,OAAO,EAAE,YAAY,EACrB,OAAO,EAAE,iBAAiB,GACzB,CACD,OAAO,EAAE,WAAW,EACpB,OAAO,CAAC,EAAE;IAAE,MAAM,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;CAAE,KACnD,OAAO,CAAC,QAAQ,CAAC,CA0DrB"}

package/dist/next.cjs

@@ -0,0 +1,62 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const server = require("next/server");
+const debug = require("./debug-Crb5gNDM.cjs");
+const grantClient = require("./grant-client-DywfJN5P.cjs");
+const index = require("./index.cjs");
+function withGrant(client, options, handler) {
+  return async (request, _routeContext) => {
+    debug.debugGrant("Next", { resource: options.resource, action: options.action });
+    const token = await grantClient.extractTokenFromRequest(request, client.config);
+    if (!token) {
+      return server.NextResponse.json({ error: "Unauthorized", code: "UNAUTHENTICATED" }, { status: 401 });
+    }
+    let resolvedResource = null;
+    if (options.resourceResolver) {
+      resolvedResource = await options.resourceResolver({
+        resourceSlug: options.resource,
+        request
+      });
+      if (!resolvedResource) {
+        return server.NextResponse.json(
+          { error: "Resource not found", code: "NOT_FOUND" },
+          { status: 404 }
+        );
+      }
+    }
+    const result = await client.isAuthorized(
+      options.resource,
+      options.action,
+      {
+        context: {
+          resource: resolvedResource ?? void 0
+        }
+      },
+      request
+    );
+    debug.debugGrant("Next", {
+      resource: options.resource,
+      action: options.action,
+      authorized: result.authorized,
+      ...result.authorized ? {} : { reason: result.reason }
+    });
+    if (!result.authorized) {
+      return server.NextResponse.json(
+        {
+          error: "Forbidden",
+          code: "FORBIDDEN",
+          reason: result.reason
+        },
+        { status: 403 }
+      );
+    }
+    return handler(request, { authorization: result });
+  };
+}
+exports.GrantClient = grantClient.GrantClient;
+exports.AuthenticationError = index.AuthenticationError;
+exports.AuthorizationError = index.AuthorizationError;
+exports.BadRequestError = index.BadRequestError;
+exports.NotFoundError = index.NotFoundError;
+exports.withGrant = withGrant;
+//# sourceMappingURL=next.cjs.map

package/dist/next.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"next.cjs","sources":["../src/next/with-grant.ts"],"sourcesContent":["import { NextRequest, NextResponse } from 'next/server';\n\nimport { GrantClient } from '../grant-client';\nimport { debugGrant } from '../utils/debug';\nimport { extractTokenFromRequest } from '../utils/token-extractor';\n\nimport type { ResourceResolver, AuthorizationResult } from '../types';\n\n/**\n * Options for Next.js route handler guard\n */\nexport interface GrantOptions {\n  /** The resource slug to check (e.g., \"Organization\", \"Project\", \"Document\") */\n  resource: string;\n  /** The action to check (e.g., \"Query\", \"Create\", \"Update\", \"Delete\") */\n  action: string;\n  /** Custom resource resolver for condition evaluation */\n  resourceResolver?: ResourceResolver;\n}\n\n/**\n * Context passed to the handler after authorization (for downstream use)\n */\nexport interface WithGrantContext {\n  authorization: AuthorizationResult;\n}\n\n/**\n * Next.js App Router route handler type (GET, POST, etc.)\n * Second argument is optional context; params are in the request URL for resolver use.\n */\nexport type GrantRouteHandler = (\n  request: NextRequest,\n  context?: WithGrantContext\n) => Promise<Response> | Response;\n\n/**\n * Wrap a Next.js App Router route handler with Grant authorization.\n * Use for GET, POST, PUT, PATCH, DELETE in app/api/.../route.ts.\n *\n * Compatible with Next.js 13–16. In Next 15+, the route context's `params` is a Promise;\n * this wrapper does not use params (only `request` is passed to the resolver/handler).\n *\n * @example\n * ```ts\n * // app/api/documents/route.ts\n * import { withGrant } from '@grantjs/server/next';\n * import { GrantClient } from '@grantjs/server';\n *\n * const grantClient = new GrantClient({ apiUrl: process.env.GRANT_API_URL! });\n *\n * export const GET = withGrant(\n *   grantClient,\n *   { resource: 'Document', action: 'Query' },\n *   async (request) => NextResponse.json({ data: [] })\n * );\n *\n * export const POST = withGrant(\n *   grantClient,\n *   { resource: 'Document', action: 'Create' },\n *   async (request) => { ... }\n * );\n * ```\n */\nexport function withGrant(\n  client: GrantClient,\n  options: GrantOptions,\n  handler: GrantRouteHandler\n): (\n  request: NextRequest,\n  context?: { params?: Promise<Record<string, string>> }\n) => Promise<Response> {\n  return async (\n    request: NextRequest,\n    _routeContext?: { params?: Promise<Record<string, string>> }\n  ): Promise<Response> => {\n    debugGrant('Next', { resource: options.resource, action: options.action });\n\n    const token = await extractTokenFromRequest(request, client.config);\n    if (!token) {\n      return NextResponse.json({ error: 'Unauthorized', code: 'UNAUTHENTICATED' }, { status: 401 });\n    }\n\n    let resolvedResource: Record<string, unknown> | null = null;\n\n    if (options.resourceResolver) {\n      resolvedResource = await options.resourceResolver({\n        resourceSlug: options.resource,\n        request,\n      });\n      if (!resolvedResource) {\n        return NextResponse.json(\n          { error: 'Resource not found', code: 'NOT_FOUND' },\n          { status: 404 }\n        );\n      }\n    }\n\n    const result = await client.isAuthorized(\n      options.resource,\n      options.action,\n      {\n        context: {\n          resource: resolvedResource ?? undefined,\n        },\n      },\n      request\n    );\n\n    debugGrant('Next', {\n      resource: options.resource,\n      action: options.action,\n      authorized: result.authorized,\n      ...(result.authorized ? {} : { reason: result.reason }),\n    });\n\n    if (!result.authorized) {\n      return NextResponse.json(\n        {\n          error: 'Forbidden',\n          code: 'FORBIDDEN',\n          reason: result.reason,\n        },\n        { status: 403 }\n      );\n    }\n\n    return handler(request, { authorization: result });\n  };\n}\n"],"names":["debugGrant","extractTokenFromRequest","NextResponse"],"mappings":";;;;;;AAgEO,SAAS,UACd,QACA,SACA,SAIqB;AACrB,SAAO,OACL,SACA,kBACsB;AACtBA,qBAAW,QAAQ,EAAE,UAAU,QAAQ,UAAU,QAAQ,QAAQ,QAAQ;AAEzE,UAAM,QAAQ,MAAMC,YAAAA,wBAAwB,SAAS,OAAO,MAAM;AAClE,QAAI,CAAC,OAAO;AACV,aAAOC,oBAAa,KAAK,EAAE,OAAO,gBAAgB,MAAM,qBAAqB,EAAE,QAAQ,KAAK;AAAA,IAC9F;AAEA,QAAI,mBAAmD;AAEvD,QAAI,QAAQ,kBAAkB;AAC5B,yBAAmB,MAAM,QAAQ,iBAAiB;AAAA,QAChD,cAAc,QAAQ;AAAA,QACtB;AAAA,MAAA,CACD;AACD,UAAI,CAAC,kBAAkB;AACrB,eAAOA,OAAAA,aAAa;AAAA,UAClB,EAAE,OAAO,sBAAsB,MAAM,YAAA;AAAA,UACrC,EAAE,QAAQ,IAAA;AAAA,QAAI;AAAA,MAElB;AAAA,IACF;AAEA,UAAM,SAAS,MAAM,OAAO;AAAA,MAC1B,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR;AAAA,QACE,SAAS;AAAA,UACP,UAAU,oBAAoB;AAAA,QAAA;AAAA,MAChC;AAAA,MAEF;AAAA,IAAA;AAGFF,UAAAA,WAAW,QAAQ;AAAA,MACjB,UAAU,QAAQ;AAAA,MAClB,QAAQ,QAAQ;AAAA,MAChB,YAAY,OAAO;AAAA,MACnB,GAAI,OAAO,aAAa,CAAA,IAAK,EAAE,QAAQ,OAAO,OAAA;AAAA,IAAO,CACtD;AAED,QAAI,CAAC,OAAO,YAAY;AACtB,aAAOE,OAAAA,aAAa;AAAA,QAClB;AAAA,UACE,OAAO;AAAA,UACP,MAAM;AAAA,UACN,QAAQ,OAAO;AAAA,QAAA;AAAA,QAEjB,EAAE,QAAQ,IAAA;AAAA,MAAI;AAAA,IAElB;AAEA,WAAO,QAAQ,SAAS,EAAE,eAAe,QAAQ;AAAA,EACnD;AACF;;;;;;;"}

package/dist/next.mjs

@@ -0,0 +1,63 @@
+import { NextResponse } from "next/server";
+import { d as debugGrant } from "./debug-C8ibbrE5.js";
+import { e as extractTokenFromRequest } from "./grant-client-D1LZI2f4.js";
+import { G } from "./grant-client-D1LZI2f4.js";
+import { AuthenticationError, AuthorizationError, BadRequestError, NotFoundError } from "./index.mjs";
+function withGrant(client, options, handler) {
+  return async (request, _routeContext) => {
+    debugGrant("Next", { resource: options.resource, action: options.action });
+    const token = await extractTokenFromRequest(request, client.config);
+    if (!token) {
+      return NextResponse.json({ error: "Unauthorized", code: "UNAUTHENTICATED" }, { status: 401 });
+    }
+    let resolvedResource = null;
+    if (options.resourceResolver) {
+      resolvedResource = await options.resourceResolver({
+        resourceSlug: options.resource,
+        request
+      });
+      if (!resolvedResource) {
+        return NextResponse.json(
+          { error: "Resource not found", code: "NOT_FOUND" },
+          { status: 404 }
+        );
+      }
+    }
+    const result = await client.isAuthorized(
+      options.resource,
+      options.action,
+      {
+        context: {
+          resource: resolvedResource ?? void 0
+        }
+      },
+      request
+    );
+    debugGrant("Next", {
+      resource: options.resource,
+      action: options.action,
+      authorized: result.authorized,
+      ...result.authorized ? {} : { reason: result.reason }
+    });
+    if (!result.authorized) {
+      return NextResponse.json(
+        {
+          error: "Forbidden",
+          code: "FORBIDDEN",
+          reason: result.reason
+        },
+        { status: 403 }
+      );
+    }
+    return handler(request, { authorization: result });
+  };
+}
+export {
+  AuthenticationError,
+  AuthorizationError,
+  BadRequestError,
+  G as GrantClient,
+  NotFoundError,
+  withGrant
+};
+//# sourceMappingURL=next.mjs.map

package/dist/next.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"next.mjs","sources":["../src/next/with-grant.ts"],"sourcesContent":["import { NextRequest, NextResponse } from 'next/server';\n\nimport { GrantClient } from '../grant-client';\nimport { debugGrant } from '../utils/debug';\nimport { extractTokenFromRequest } from '../utils/token-extractor';\n\nimport type { ResourceResolver, AuthorizationResult } from '../types';\n\n/**\n * Options for Next.js route handler guard\n */\nexport interface GrantOptions {\n  /** The resource slug to check (e.g., \"Organization\", \"Project\", \"Document\") */\n  resource: string;\n  /** The action to check (e.g., \"Query\", \"Create\", \"Update\", \"Delete\") */\n  action: string;\n  /** Custom resource resolver for condition evaluation */\n  resourceResolver?: ResourceResolver;\n}\n\n/**\n * Context passed to the handler after authorization (for downstream use)\n */\nexport interface WithGrantContext {\n  authorization: AuthorizationResult;\n}\n\n/**\n * Next.js App Router route handler type (GET, POST, etc.)\n * Second argument is optional context; params are in the request URL for resolver use.\n */\nexport type GrantRouteHandler = (\n  request: NextRequest,\n  context?: WithGrantContext\n) => Promise<Response> | Response;\n\n/**\n * Wrap a Next.js App Router route handler with Grant authorization.\n * Use for GET, POST, PUT, PATCH, DELETE in app/api/.../route.ts.\n *\n * Compatible with Next.js 13–16. In Next 15+, the route context's `params` is a Promise;\n * this wrapper does not use params (only `request` is passed to the resolver/handler).\n *\n * @example\n * ```ts\n * // app/api/documents/route.ts\n * import { withGrant } from '@grantjs/server/next';\n * import { GrantClient } from '@grantjs/server';\n *\n * const grantClient = new GrantClient({ apiUrl: process.env.GRANT_API_URL! });\n *\n * export const GET = withGrant(\n *   grantClient,\n *   { resource: 'Document', action: 'Query' },\n *   async (request) => NextResponse.json({ data: [] })\n * );\n *\n * export const POST = withGrant(\n *   grantClient,\n *   { resource: 'Document', action: 'Create' },\n *   async (request) => { ... }\n * );\n * ```\n */\nexport function withGrant(\n  client: GrantClient,\n  options: GrantOptions,\n  handler: GrantRouteHandler\n): (\n  request: NextRequest,\n  context?: { params?: Promise<Record<string, string>> }\n) => Promise<Response> {\n  return async (\n    request: NextRequest,\n    _routeContext?: { params?: Promise<Record<string, string>> }\n  ): Promise<Response> => {\n    debugGrant('Next', { resource: options.resource, action: options.action });\n\n    const token = await extractTokenFromRequest(request, client.config);\n    if (!token) {\n      return NextResponse.json({ error: 'Unauthorized', code: 'UNAUTHENTICATED' }, { status: 401 });\n    }\n\n    let resolvedResource: Record<string, unknown> | null = null;\n\n    if (options.resourceResolver) {\n      resolvedResource = await options.resourceResolver({\n        resourceSlug: options.resource,\n        request,\n      });\n      if (!resolvedResource) {\n        return NextResponse.json(\n          { error: 'Resource not found', code: 'NOT_FOUND' },\n          { status: 404 }\n        );\n      }\n    }\n\n    const result = await client.isAuthorized(\n      options.resource,\n      options.action,\n      {\n        context: {\n          resource: resolvedResource ?? undefined,\n        },\n      },\n      request\n    );\n\n    debugGrant('Next', {\n      resource: options.resource,\n      action: options.action,\n      authorized: result.authorized,\n      ...(result.authorized ? {} : { reason: result.reason }),\n    });\n\n    if (!result.authorized) {\n      return NextResponse.json(\n        {\n          error: 'Forbidden',\n          code: 'FORBIDDEN',\n          reason: result.reason,\n        },\n        { status: 403 }\n      );\n    }\n\n    return handler(request, { authorization: result });\n  };\n}\n"],"names":[],"mappings":";;;;;AAgEO,SAAS,UACd,QACA,SACA,SAIqB;AACrB,SAAO,OACL,SACA,kBACsB;AACtB,eAAW,QAAQ,EAAE,UAAU,QAAQ,UAAU,QAAQ,QAAQ,QAAQ;AAEzE,UAAM,QAAQ,MAAM,wBAAwB,SAAS,OAAO,MAAM;AAClE,QAAI,CAAC,OAAO;AACV,aAAO,aAAa,KAAK,EAAE,OAAO,gBAAgB,MAAM,qBAAqB,EAAE,QAAQ,KAAK;AAAA,IAC9F;AAEA,QAAI,mBAAmD;AAEvD,QAAI,QAAQ,kBAAkB;AAC5B,yBAAmB,MAAM,QAAQ,iBAAiB;AAAA,QAChD,cAAc,QAAQ;AAAA,QACtB;AAAA,MAAA,CACD;AACD,UAAI,CAAC,kBAAkB;AACrB,eAAO,aAAa;AAAA,UAClB,EAAE,OAAO,sBAAsB,MAAM,YAAA;AAAA,UACrC,EAAE,QAAQ,IAAA;AAAA,QAAI;AAAA,MAElB;AAAA,IACF;AAEA,UAAM,SAAS,MAAM,OAAO;AAAA,MAC1B,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR;AAAA,QACE,SAAS;AAAA,UACP,UAAU,oBAAoB;AAAA,QAAA;AAAA,MAChC;AAAA,MAEF;AAAA,IAAA;AAGF,eAAW,QAAQ;AAAA,MACjB,UAAU,QAAQ;AAAA,MAClB,QAAQ,QAAQ;AAAA,MAChB,YAAY,OAAO;AAAA,MACnB,GAAI,OAAO,aAAa,CAAA,IAAK,EAAE,QAAQ,OAAO,OAAA;AAAA,IAAO,CACtD;AAED,QAAI,CAAC,OAAO,YAAY;AACtB,aAAO,aAAa;AAAA,QAClB;AAAA,UACE,OAAO;AAAA,UACP,MAAM;AAAA,UACN,QAAQ,OAAO;AAAA,QAAA;AAAA,QAEjB,EAAE,QAAQ,IAAA;AAAA,MAAI;AAAA,IAElB;AAEA,WAAO,QAAQ,SAAS,EAAE,eAAe,QAAQ;AAAA,EACnD;AACF;"}