@grantry/nextjs 0.0.0-stage → 0.1.0

package/dist/provider.d.ts

@@ -0,0 +1,34 @@
+/**
+ * The React provider, saying "nextjs" — and reading `NEXT_PUBLIC_GRANTRY_*`.
+ *
+ * ## Why this file exists at all
+ *
+ * Everything else in this package is a straight re-export of `@grantry/react`,
+ * on the principle that a second implementation is a second thing to drift. So
+ * a wrapper needs a reason, and it has two:
+ *
+ * ⚠️ A NEXT.JS APP AND A PLAIN REACT APP ARE INDISTINGUISHABLE ON THE WIRE
+ * UNLESS ONE OF THEM SAYS SO. They render the same provider, construct the same
+ * client and send the same requests. That is normally a virtue and here it is a
+ * problem: the development Overview's setup guide watches for the merchant's
+ * app to connect and then shows them how to sign a user up *in the framework
+ * that connected*. Without this, everyone who installed `@grantry/nextjs` would
+ * be shown a plain-React snippet — no `middleware.ts`, no server helpers — on
+ * the one screen whose whole job is knowing what they are building.
+ *
+ * ⚠️ AND IT IS NOT DETECTABLE AT RUNTIME. `__NEXT_DATA__` exists only in the
+ * Pages Router, `process.env.NEXT_RUNTIME` is server-only, and sniffing for
+ * either would make the answer depend on which router the merchant chose. The
+ * honest signal is which package they installed, and this is the file that
+ * knows.
+ *
+ * ⚠️ THE SECOND REASON IS THE ENVIRONMENT VARIABLES, WHICH ONLY THIS PACKAGE
+ * CAN READ. Where the application's pages are is its own code since 0242 —
+ * `signInUrl`, `signUpUrl`, the fallback and force redirect URLs and
+ * `afterSignOutUrl`, Clerk's names — and a Next.js application sets them as
+ * `NEXT_PUBLIC_GRANTRY_*`. They become props of the React provider here, under
+ * whatever props were passed, so the rules stay `@grantry/react`'s.
+ */
+import { type GrantryProviderProps } from '@grantry/react';
+export declare function GrantryProvider(props: GrantryProviderProps): import("react").JSX.Element;
+//# sourceMappingURL=provider.d.ts.map

package/dist/provider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider.d.ts","sourceRoot":"","sources":["../src/provider.tsx"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,EAGL,KAAK,oBAAoB,EAE1B,MAAM,gBAAgB,CAAC;AAsBxB,wBAAgB,eAAe,CAAC,KAAK,EAAE,oBAAoB,+BAW1D"}

package/dist/provider.js

@@ -0,0 +1,66 @@
+'use client';
+import { jsx as _jsx } from "react/jsx-runtime";
+/**
+ * The React provider, saying "nextjs" — and reading `NEXT_PUBLIC_GRANTRY_*`.
+ *
+ * ## Why this file exists at all
+ *
+ * Everything else in this package is a straight re-export of `@grantry/react`,
+ * on the principle that a second implementation is a second thing to drift. So
+ * a wrapper needs a reason, and it has two:
+ *
+ * ⚠️ A NEXT.JS APP AND A PLAIN REACT APP ARE INDISTINGUISHABLE ON THE WIRE
+ * UNLESS ONE OF THEM SAYS SO. They render the same provider, construct the same
+ * client and send the same requests. That is normally a virtue and here it is a
+ * problem: the development Overview's setup guide watches for the merchant's
+ * app to connect and then shows them how to sign a user up *in the framework
+ * that connected*. Without this, everyone who installed `@grantry/nextjs` would
+ * be shown a plain-React snippet — no `middleware.ts`, no server helpers — on
+ * the one screen whose whole job is knowing what they are building.
+ *
+ * ⚠️ AND IT IS NOT DETECTABLE AT RUNTIME. `__NEXT_DATA__` exists only in the
+ * Pages Router, `process.env.NEXT_RUNTIME` is server-only, and sniffing for
+ * either would make the answer depend on which router the merchant chose. The
+ * honest signal is which package they installed, and this is the file that
+ * knows.
+ *
+ * ⚠️ THE SECOND REASON IS THE ENVIRONMENT VARIABLES, WHICH ONLY THIS PACKAGE
+ * CAN READ. Where the application's pages are is its own code since 0242 —
+ * `signInUrl`, `signUpUrl`, the fallback and force redirect URLs and
+ * `afterSignOutUrl`, Clerk's names — and a Next.js application sets them as
+ * `NEXT_PUBLIC_GRANTRY_*`. They become props of the React provider here, under
+ * whatever props were passed, so the rules stay `@grantry/react`'s.
+ */
+import { GrantryProvider as ReactProvider, mergeRouteOptions, } from '@grantry/react';
+/**
+ * `NEXT_PUBLIC_GRANTRY_*`, as route options.
+ *
+ * ⚠️ EVERY NAME WRITTEN OUT IN FULL. Next.js puts a `NEXT_PUBLIC_` variable into
+ * the browser bundle only where `process.env.NAME` appears literally; a name
+ * built from a prefix is correct on the server and `undefined` in the browser,
+ * which is a hydration mismatch as well as a wrong link.
+ */
+function publicRouteOptions() {
+    return {
+        signInUrl: process.env.NEXT_PUBLIC_GRANTRY_SIGN_IN_URL,
+        signUpUrl: process.env.NEXT_PUBLIC_GRANTRY_SIGN_UP_URL,
+        signInFallbackRedirectUrl: process.env.NEXT_PUBLIC_GRANTRY_SIGN_IN_FALLBACK_REDIRECT_URL,
+        signUpFallbackRedirectUrl: process.env.NEXT_PUBLIC_GRANTRY_SIGN_UP_FALLBACK_REDIRECT_URL,
+        signInForceRedirectUrl: process.env.NEXT_PUBLIC_GRANTRY_SIGN_IN_FORCE_REDIRECT_URL,
+        signUpForceRedirectUrl: process.env.NEXT_PUBLIC_GRANTRY_SIGN_UP_FORCE_REDIRECT_URL,
+        afterSignOutUrl: process.env.NEXT_PUBLIC_GRANTRY_AFTER_SIGN_OUT_URL,
+    };
+}
+export function GrantryProvider(props) {
+    /*
+     * Props first, then the variables — Clerk's order — merged option by option,
+     * so a prop left undefined does not hide the variable beneath it.
+     *
+     * `props.sdk` after `sdk="nextjs"`, so it is genuinely a default rather than
+     * a lock. An application embedding this inside something else can still say
+     * what it is, and passing nothing — the normal case — reports `nextjs`.
+     */
+    const routes = mergeRouteOptions(props, publicRouteOptions());
+    return _jsx(ReactProvider, { sdk: "nextjs", ...props, ...routes });
+}
+//# sourceMappingURL=provider.js.map

package/dist/provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider.js","sourceRoot":"","sources":["../src/provider.tsx"],"names":[],"mappings":"AAAA,YAAY,CAAC;;AAEb;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,EACL,eAAe,IAAI,aAAa,EAChC,iBAAiB,GAGlB,MAAM,gBAAgB,CAAC;AAExB;;;;;;;GAOG;AACH,SAAS,kBAAkB;IACzB,OAAO;QACL,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,+BAA+B;QACtD,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,+BAA+B;QACtD,yBAAyB,EAAE,OAAO,CAAC,GAAG,CAAC,iDAAiD;QACxF,yBAAyB,EAAE,OAAO,CAAC,GAAG,CAAC,iDAAiD;QACxF,sBAAsB,EAAE,OAAO,CAAC,GAAG,CAAC,8CAA8C;QAClF,sBAAsB,EAAE,OAAO,CAAC,GAAG,CAAC,8CAA8C;QAClF,eAAe,EAAE,OAAO,CAAC,GAAG,CAAC,sCAAsC;KACpE,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,KAA2B;IACzD;;;;;;;OAOG;IACH,MAAM,MAAM,GAAG,iBAAiB,CAAC,KAAK,EAAE,kBAAkB,EAAE,CAAC,CAAC;IAC9D,OAAO,KAAC,aAAa,IAAC,GAAG,EAAC,QAAQ,KAAK,KAAK,KAAM,MAAM,GAAI,CAAC;AAC/D,CAAC"}

package/dist/server.d.ts

@@ -0,0 +1,64 @@
+import { TokenVerificationError, verifyToken, type VerifiedToken, type VerifyFailureReason, type VerifyTokenOptions } from '@grantry/react/server';
+export interface AuthObject {
+    /** Null when the visitor is not signed in. */
+    userId: string | null;
+    sessionId: string | null;
+    environmentId: string | null;
+    emailVerified: boolean;
+    /**
+     * The operator, when this visitor is somebody from your team viewing as the user — the verified
+     * `act` claim. Refuse your own sensitive actions while it is set.
+     */
+    actor: {
+        sub: string;
+    } | null;
+    /** The verified token, for callers that want the expiry or full claims. */
+    token: VerifiedToken | null;
+    /**
+     * Why authentication failed, when it did.
+     *
+     * `expired` in particular is worth distinguishing: it usually means the tab
+     * was asleep and the client will recover on its own, not that anything is
+     * misconfigured.
+     */
+    reason: TokenVerificationError['reason'] | null;
+}
+export interface AuthOptions {
+    /** Override for self-hosted deployments and local development. */
+    apiUrl?: string;
+    /**
+     * Your publishable key — the same one the provider takes.
+     *
+     * ⚠️ IT IS WHAT SAYS WHICH APPLICATION A TOKEN MUST BELONG TO. Read from
+     * `GRANTRY_PUBLISHABLE_KEY`, then `NEXT_PUBLIC_GRANTRY_PUBLISHABLE_KEY` — the
+     * variable `<GrantryProvider>` is already given — when omitted, so the
+     * ordinary Next.js application passes nothing here. With no key and no
+     * `environmentId`, `auth()` throws `no_audience` rather than accepting a token
+     * minted for another application. See `@grantry/react/server`.
+     */
+    publishableKey?: string;
+    /** The environment id, for a deployment that configures it directly. */
+    environmentId?: string;
+}
+/**
+ * The current visitor, in a server component, route handler or server action.
+ *
+ * Never throws for an unauthenticated visitor — being signed out is an ordinary
+ * state, not an exception. The `reason` field carries the detail when a token
+ * was present but unusable.
+ */
+export declare function auth(options?: AuthOptions): Promise<AuthObject>;
+/**
+ * `auth()`, but throws when nobody is signed in.
+ *
+ * For routes where being signed out is a bug rather than a case to handle —
+ * it narrows `userId` to a string, so the call site needs no null check and
+ * cannot forget one.
+ */
+export declare function requireAuth(options?: AuthOptions): Promise<AuthObject & {
+    userId: string;
+    sessionId: string;
+}>;
+export { TokenVerificationError, verifyToken, type VerifiedToken, type VerifyFailureReason, type VerifyTokenOptions, };
+export { ReverificationCheckError, verifyReverification, type VerifiedReverification, } from '@grantry/react/server';
+//# sourceMappingURL=server.d.ts.map

package/dist/server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAkBA,OAAO,EACL,sBAAsB,EACtB,WAAW,EACX,KAAK,aAAa,EAClB,KAAK,mBAAmB,EACxB,KAAK,kBAAkB,EACxB,MAAM,uBAAuB,CAAC;AAG/B,MAAM,WAAW,UAAU;IACzB,8CAA8C;IAC9C,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,aAAa,EAAE,OAAO,CAAC;IACvB;;;OAGG;IACH,KAAK,EAAE;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IAC9B,2EAA2E;IAC3E,KAAK,EAAE,aAAa,GAAG,IAAI,CAAC;IAC5B;;;;;;OAMG;IACH,MAAM,EAAE,sBAAsB,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC;CACjD;AAYD,MAAM,WAAW,WAAW;IAC1B,kEAAkE;IAClE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;;;;;;OASG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,wEAAwE;IACxE,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;;;;;GAMG;AACH,wBAAsB,IAAI,CAAC,OAAO,GAAE,WAAgB,GAAG,OAAO,CAAC,UAAU,CAAC,CA6BzE;AAED;;;;;;GAMG;AACH,wBAAsB,WAAW,CAC/B,OAAO,GAAE,WAAgB,GACxB,OAAO,CAAC,UAAU,GAAG;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC,CAW7D;AAMD,OAAO,EACL,sBAAsB,EACtB,WAAW,EACX,KAAK,aAAa,EAClB,KAAK,mBAAmB,EACxB,KAAK,kBAAkB,GACxB,CAAC;AAMF,OAAO,EACL,wBAAwB,EACxB,oBAAoB,EACpB,KAAK,sBAAsB,GAC5B,MAAM,uBAAuB,CAAC"}

package/dist/server.js

@@ -0,0 +1,93 @@
+/**
+ * Server-side auth for the Next.js App Router — `@grantry/nextjs/server`.
+ *
+ *   const { userId } = await auth();
+ *   if (!userId) redirect('/sign-in');
+ *
+ * Reads the access-token cookie the client SDK mirrors onto this app's domain
+ * and verifies it against Grantry's published keys. No network call in the hot
+ * path once the keys are cached, so this is cheap enough to use on every render.
+ *
+ * ⚠️ `auth()` IS THE APP ROUTER'S ALONE, SO THE VERIFIER IS EXPORTED BESIDE IT. It reads
+ * `next/headers`, which a Pages Router `getServerSideProps` or API route cannot call; those verify
+ * `req.cookies.grantry_token` with `verifyToken` themselves. The docs said "verify in
+ * getServerSideProps" while this entry point offered nothing to verify with, and a Next.js
+ * application is told not to install `@grantry/react` beside this package (the docs audit,
+ * 1 October 2026).
+ */
+import { cookies } from 'next/headers';
+import { TokenVerificationError, verifyToken, } from '@grantry/react/server';
+import { TOKEN_COOKIE_NAME, tokenFromCookie } from './cookie.js';
+const SIGNED_OUT = {
+    userId: null,
+    sessionId: null,
+    environmentId: null,
+    emailVerified: false,
+    actor: null,
+    token: null,
+    reason: null,
+};
+/**
+ * The current visitor, in a server component, route handler or server action.
+ *
+ * Never throws for an unauthenticated visitor — being signed out is an ordinary
+ * state, not an exception. The `reason` field carries the detail when a token
+ * was present but unusable.
+ */
+export async function auth(options = {}) {
+    const store = await cookies();
+    const raw = tokenFromCookie(store.get(TOKEN_COOKIE_NAME));
+    if (!raw)
+        return SIGNED_OUT;
+    try {
+        const token = await verifyToken(raw, options);
+        return {
+            userId: token.userId,
+            sessionId: token.sessionId,
+            environmentId: token.environmentId,
+            emailVerified: token.emailVerified,
+            actor: token.actor,
+            token,
+            reason: null,
+        };
+    }
+    catch (cause) {
+        /*
+         * ⚠️ `no_audience` IS RETHROWN RATHER THAN REPORTED AS SIGNED OUT. It says
+         * this deployment never configured which application to accept tokens for,
+         * which is a fault in the app rather than a fact about the visitor —
+         * swallowing it would sign every user out at once and look like a broken
+         * cookie.
+         */
+        if (cause instanceof TokenVerificationError && cause.reason !== 'no_audience') {
+            return { ...SIGNED_OUT, reason: cause.reason };
+        }
+        throw cause;
+    }
+}
+/**
+ * `auth()`, but throws when nobody is signed in.
+ *
+ * For routes where being signed out is a bug rather than a case to handle —
+ * it narrows `userId` to a string, so the call site needs no null check and
+ * cannot forget one.
+ */
+export async function requireAuth(options = {}) {
+    const result = await auth(options);
+    if (!result.userId || !result.sessionId) {
+        throw new Error('requireAuth() was called but no user is signed in. ' +
+            'Use auth() and handle the signed-out case, or protect this route in middleware.');
+    }
+    return result;
+}
+/*
+ * `verifyToken` for the Pages Router and anything else `auth()` cannot reach — see the note at the
+ * top. The same function `@grantry/react/server` exports, not a copy.
+ */
+export { TokenVerificationError, verifyToken, };
+/*
+ * Spending a "Verify it's you" grant before a sensitive action (0330), with `auth()`'s `sessionId`
+ * and `userId` — the same function `@grantry/react/server` exports, for the reason above.
+ */
+export { ReverificationCheckError, verifyReverification, } from '@grantry/react/server';
+//# sourceMappingURL=server.js.map

package/dist/server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AACvC,OAAO,EACL,sBAAsB,EACtB,WAAW,GAIZ,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,UAAU,CAAC;AAyB9D,MAAM,UAAU,GAAe;IAC7B,MAAM,EAAE,IAAI;IACZ,SAAS,EAAE,IAAI;IACf,aAAa,EAAE,IAAI;IACnB,aAAa,EAAE,KAAK;IACpB,KAAK,EAAE,IAAI;IACX,KAAK,EAAE,IAAI;IACX,MAAM,EAAE,IAAI;CACb,CAAC;AAoBF;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,IAAI,CAAC,UAAuB,EAAE;IAClD,MAAM,KAAK,GAAG,MAAM,OAAO,EAAE,CAAC;IAC9B,MAAM,GAAG,GAAG,eAAe,CAAC,KAAK,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC;IAC1D,IAAI,CAAC,GAAG;QAAE,OAAO,UAAU,CAAC;IAE5B,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAC9C,OAAO;YACL,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,aAAa,EAAE,KAAK,CAAC,aAAa;YAClC,aAAa,EAAE,KAAK,CAAC,aAAa;YAClC,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,KAAK;YACL,MAAM,EAAE,IAAI;SACb,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf;;;;;;WAMG;QACH,IAAI,KAAK,YAAY,sBAAsB,IAAI,KAAK,CAAC,MAAM,KAAK,aAAa,EAAE,CAAC;YAC9E,OAAO,EAAE,GAAG,UAAU,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;QACjD,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,UAAuB,EAAE;IAEzB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,CAAC;IAEnC,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CACb,qDAAqD;YACnD,iFAAiF,CACpF,CAAC;IACJ,CAAC;IAED,OAAO,MAA4D,CAAC;AACtE,CAAC;AAED;;;GAGG;AACH,OAAO,EACL,sBAAsB,EACtB,WAAW,GAIZ,CAAC;AAEF;;;GAGG;AACH,OAAO,EACL,wBAAwB,EACxB,oBAAoB,GAErB,MAAM,uBAAuB,CAAC"}

package/package.json

@@ -1,6 +1,64 @@
 {
   "name": "@grantry/nextjs",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
+  "version": "0.1.0",
+  "license": "MIT",
+  "type": "module",
+  "description": "Grantry authentication for Next.js: the React components and hooks, server-side auth() and route-protecting middleware.",
+  "keywords": [
+    "grantry",
+    "nextjs",
+    "next",
+    "authentication",
+    "auth",
+    "middleware",
+    "react"
+  ],
+  "homepage": "https://grantry.dev",
+  "engines": {
+    "node": ">=18.18.0"
+  },
+  "sideEffects": false,
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    },
+    "./server": {
+      "types": "./dist/server.d.ts",
+      "default": "./dist/server.js"
+    },
+    "./middleware": {
+      "types": "./dist/middleware.d.ts",
+      "default": "./dist/middleware.js"
+    },
+    "./package.json": "./package.json"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "files": [
+    "dist",
+    "src",
+    "README.md",
+    "LICENSE"
+  ],
+  "dependencies": {
+    "@grantry/react": "0.1.0"
+  },
+  "peerDependencies": {
+    "next": "^15.0.0 || ^16.0.0",
+    "react": "^18.0.0 || ^19.0.0"
+  },
+  "devDependencies": {
+    "@types/react": "^19.0.2",
+    "next": "^16.3.1",
+    "react": "^19.2.8",
+    "typescript": "5.9.3"
+  },
+  "scripts": {
+    "build": "node build.mjs",
+    "typecheck": "tsc --noEmit",
+    "test": "node ../sdk-react/node_modules/vitest/vitest.mjs run"
+  },
+  "types": "./dist/index.d.ts"
 }

package/src/cookie.ts

@@ -0,0 +1,24 @@
+/**
+ * The access-token cookie, as the middleware and `auth()` both read it.
+ *
+ * ⚠️ ONE COPY OF THE NAME, AND A TEST HOLDS IT TO `@grantry/js`. It cannot be imported from there:
+ * this package depends on `@grantry/react` alone, and `@grantry/react`'s main entry is the browser
+ * half, which has no business in a middleware bundle. `server.ts` and `middleware.ts` each carried
+ * their own literal, one under a comment saying it was imported; `tests/cookie.test.ts` compares
+ * this one with the writer's.
+ */
+export const TOKEN_COOKIE_NAME = 'grantry_token';
+
+/**
+ * The token in the cookie as Next.js hands it over, or null when there is none.
+ *
+ * ⚠️ NOT DECODED A SECOND TIME. Next's cookie parser already applies `decodeURIComponent` to every
+ * value, and both readers applied it again. A JWT never contains `%`, so the second pass changed
+ * nothing for a real token — and threw `URIError` for a cookie whose decoded value held a stray
+ * `%E0`. In `auth()` that error was not a `TokenVerificationError`, so it was rethrown and every
+ * server component calling `auth()` failed to render for that visitor. Anything other than a token
+ * that is still left is reported by `verifyToken` as `malformed`.
+ */
+export function tokenFromCookie(cookie: { value: string } | undefined): string | null {
+  return cookie?.value || null;
+}

package/src/index.ts

@@ -0,0 +1,249 @@
+/**
+ * @grantry/nextjs — authentication for Next.js.
+ *
+ *   app/layout.tsx      <GrantryProvider>       (client)
+ *   app/page.tsx        await auth()            (server)
+ *   middleware.ts       grantryMiddleware()     (edge)
+ *
+ * ⚠️ A RE-EXPORT, NOT A SECOND IMPLEMENTATION. Everything below is the React
+ * SDK unchanged, so a Next.js application installs one dependency and imports
+ * the same names it would in any React app — and there is no second copy of a
+ * component to drift from the first. The Next-specific half is `./server` and
+ * `./middleware`, which is genuinely different code.
+ *
+ * The one exception is `GrantryProvider`, which is a four-line wrapper around
+ * the React one for the sole purpose of saying "nextjs" rather than "react" on
+ * the wire. See `./provider` for why that distinction has to exist at all.
+ *
+ * ⚠️ EVERY NAME `@grantry/react` EXPORTS IS LISTED HERE, AND A TEST HOLDS IT TO
+ * THAT. The list is by name, with no `export *`, so for months each new React
+ * export was simply absent from Next.js:
+ * `AuthCard`, `OAuthConsent`, the localization contract and the entitlement
+ * helpers all had documentation pages telling Next.js readers to import them
+ * from here. `packages/sdk-react/tests/nextjs-exports.test.ts` compares the two
+ * lists, types included, and fails on the next one.
+ */
+
+export { GrantryProvider } from './provider';
+
+export {
+  // Hooks
+  useAuth,
+  useUser,
+  useSession,
+  useAccounts,
+  useOAuth,
+  useGrantry,
+  useEntitlements,
+  readOAuthResult,
+  // The public plans, for pricing cards of your own
+  usePlans,
+  pricingCatalogue,
+  formatMoney,
+
+  // Where the application's own pages are: the provider's route options and their helpers.
+  useRoutes,
+  mergeRouteOptions,
+  redirectTarget,
+  requestedRedirectUrl,
+
+  // Headless flows
+  useSignInFlow,
+  useSignUpFlow,
+
+  // Entitlements, read straight off an access token
+  entitlementsFromToken,
+  actorFromToken,
+  checkEntitlements,
+  EMPTY_ENTITLEMENTS,
+
+  // Control
+  SignedIn,
+  SignedOut,
+  GrantryLoading,
+  GrantryLoaded,
+  /*
+   * ⚠️ THE CONNECTION PAIR, WHICH IS NOT THE SESSION PAIR. See the React
+   * package's `control.tsx` for why they are separate rather than four states
+   * of one machine the way Clerk's are.
+   */
+  GrantryDegraded,
+  GrantryFailed,
+  useEnvironmentStatus,
+  Protect,
+
+  // Unstyled actions
+  SignOutButton,
+  useSignOutAction,
+
+  // Drop-in components. Cut from a release and back; see the React package's
+  // index for what changed on the way back in (the default look, not the code).
+  SignIn,
+  SignUp,
+  /*
+   * ⚠️ RE-EXPORTED BY NAME, SO A NEW COMPONENT IS UNREACHABLE FROM NEXT.JS
+   * UNTIL IT IS LISTED HERE. `<SignIn />` draws this itself when the account
+   * owes something, but an application that redirects somewhere other than its
+   * sign-in route has to render it there.
+   */
+  CompleteAccount,
+  UserButton,
+  /*
+   * ⚠️ NOT A COMPONENT, AND IT HAS TO BE HERE ANYWAY. `<UserButton />` sends
+   * "Add account" to the sign-in page with a marker on the link, and a Next.js
+   * application cannot let that visitor past its own gate without this. The
+   * list above is by name, so an unlisted helper is the same as one that does
+   * not exist -- and the failure is a redirect loop in somebody else's app.
+   */
+  isAddingAccount,
+  addAccountUrl,
+  ADD_ACCOUNT_PARAM,
+  /*
+   * ⚠️ FOUR COMPONENTS THAT WERE EXPORTED FROM REACT AND UNREACHABLE FROM HERE,
+   * which is the same as not existing for a Next.js application — this list is
+   * by name and there is no deep-import escape hatch.
+   */
+  UserAvatar,
+  Waitlist,
+  ResetPassword,
+  SetupMfa,
+  UserProfile,
+  PricingTable,
+  CheckoutButton,
+  PlanDetailsButton,
+  SubscriptionDetailsButton,
+  ProductCard,
+  type ProductCardProps,
+  MenuItems,
+  CustomAction,
+  CustomLink,
+  CustomPage,
+  // The card itself, the consent card, "Continue as" and the support-visit banner.
+  AuthCard,
+  OAuthConsent,
+  ContinueAs,
+  ImpersonationBanner,
+
+  // Localization
+  LocalizationProvider,
+  useTranslate,
+  EN,
+
+  // Appearance
+  AppearanceProvider,
+  GRANTRY_STYLES,
+  useStylesheet,
+  variablesToStyle,
+
+  // The brand theme: what Hosted sign-in → Theme stores, the hosted screens' look
+  THEME_COLORS,
+  THEME_COLOR_LABELS,
+  THEME_FONTS,
+  THEME_LOGO_PLACEMENTS,
+  THEME_RADII,
+  THEME_SOCIAL_PLACEMENTS,
+  THEME_SOCIAL_VARIANTS,
+  brandThemeAppearance,
+  cleanBrandTheme,
+  themeColorScheme,
+
+  // Avatars, drawn as the components draw them
+  DEFAULT_AVATAR_COLORS,
+  avatarBackgroundCss,
+  avatarInitial,
+  avatarSeed,
+
+  // The client
+  GrantryClient,
+  GrantryError,
+  TOKEN_COOKIE_NAME,
+
+  // "Verify it's you" (0330): the dialog before a sensitive action, and what it resolves with.
+  useReverification,
+  type Reverify,
+  type ReverifyOptions,
+  type Reverification,
+  type ReverificationGrant,
+  type ReverificationMethod,
+
+  type GrantryProviderProps,
+  type GrantryPreview,
+  type SignInHostProviderProps,
+  type ResellerHostProviderProps,
+  type Routes,
+  type RouteOptions,
+  type RedirectTargets,
+  type TokenEntitlements,
+  type HasParams,
+  type UseEntitlementsReturn,
+  type SignInStatus,
+  type SignUpStatus,
+  type ProtectProps,
+  type AuthCardProps,
+  type OAuthConsentProps,
+  type ContinueAsProps,
+  type Localization,
+  type LocalizationInput,
+  type GrantryClientOptions,
+  type SignUpParams,
+  type SignUpResult,
+  type BackupCodesProof,
+  type BackupCodeEntry,
+  type RevealedBackupCodes,
+  type ChangeQuote,
+  type CouponPreview,
+  type FieldIssue,
+  type BrandTheme,
+  type ThemeColor,
+  type ThemeFont,
+  type ThemeProblem,
+  type ThemeRadius,
+  type AvatarStyle,
+  type AvatarBackground,
+  type AvatarForeground,
+  type GrantryUser,
+  type GrantrySession,
+  type GrantryTrustedDevice,
+  type GrantryBoundDevice,
+  type GrantryBoundDevices,
+  type GrantryAccount,
+  type GrantryEnvironment,
+  type GrantryErrorCode,
+  type SignInResult,
+  type Appearance,
+  type ElementDescriptor,
+  type ElementsConfig,
+  type ElementStyle,
+  type AppearanceVariables,
+  type AppearanceLayout,
+  type EnvironmentStatus,
+  type SignOutButtonProps,
+  type UseSignOutAction,
+  type SignInProps,
+  type SignUpProps,
+  type CompleteAccountProps,
+  type UserButtonProps,
+  type UserProfileProps,
+  type UseAuthReturn,
+  type UseUserReturn,
+  type UseSessionReturn,
+  type UseAccountsReturn,
+  type UseOAuthReturn,
+  type UseSignInFlow,
+  type UseSignUpFlow,
+  type OAuthProviderInfo,
+  type ConnectedAccount,
+  type GrantryAuthorizedApp,
+  type MfaFactor,
+  type UserEmailAddress,
+  type PublicPlan,
+  type PlanPrice,
+  type PlansResponse,
+  type BillingSummary,
+  type UsePlansOptions,
+  type UsePlansReturn,
+  type PricingCatalogue,
+  type PricingPlan,
+  type PricingPlanPrice,
+  type PlanIntervalUnit,
+} from '@grantry/react';