@grantry/nextjs 0.0.0-stage → 0.1.1

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Grantry
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,110 @@
-# Temporary Holding Version
+# @grantry/nextjs
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Grantry authentication for Next.js: the React components and hooks, `auth()` for server
+components, route handlers and server actions, and a middleware that keeps signed-out visitors
+off protected routes.
+
+```sh
+npm install @grantry/nextjs
+```
+
+Requires Next.js 15 or 16 and React 18 or 19. Everything `@grantry/react` exports is
+re-exported here, so a Next.js application does not install it separately.
+
+## Setup
+
+Set your publishable key (Grantry dashboard, API keys):
+
+```sh
+NEXT_PUBLIC_GRANTRY_PUBLISHABLE_KEY=pk_live_...
+```
+
+Wrap the application in the provider:
+
+```tsx
+// app/layout.tsx
+import { GrantryProvider } from '@grantry/nextjs';
+
+export default function RootLayout({ children }: { children: React.ReactNode }) {
+  return (
+    <html lang="en">
+      <body>
+        <GrantryProvider publishableKey={process.env.NEXT_PUBLIC_GRANTRY_PUBLISHABLE_KEY!}>
+          {children}
+        </GrantryProvider>
+      </body>
+    </html>
+  );
+}
+```
+
+## Reading the visitor on the server
+
+```tsx
+import { auth } from '@grantry/nextjs/server';
+
+export default async function Page() {
+  const { userId } = await auth();
+  if (!userId) return <p>Signed out</p>;
+  return <p>Signed in as {userId}</p>;
+}
+```
+
+`auth()` verifies the `grantry_token` cookie against Grantry's published signing keys, which are
+fetched once and cached; no request is made per render after that. It checks the signature, the
+expiry, the issuer and that the token belongs to *your* application, read from the publishable
+key. With no publishable key configured it throws `no_audience` rather than accept a token minted
+for another application.
+
+`requireAuth()` is the same but throws when nobody is signed in. For the Pages Router, or anything
+else that cannot call `next/headers`, verify the cookie yourself with `verifyToken`, which is also
+exported from `@grantry/nextjs/server`.
+
+## Protecting routes
+
+```ts
+// proxy.ts (Next.js 16) or middleware.ts (Next.js 15)
+import { grantryMiddleware } from '@grantry/nextjs/middleware';
+
+export default grantryMiddleware({
+  protectedRoutes: ['/dashboard', '/account'],
+  signInUrl: '/sign-in',
+});
+
+export const config = { matcher: ['/((?!_next|.*\\..*).*)'] };
+```
+
+A string protects that path and everything under it; pass a `RegExp` for anything else. Only what
+is listed is protected. A signed-out visitor is redirected to the sign-in page with `redirect_url`
+set to where they were going. A verified request goes on with `x-grantry-user-id` and
+`x-grantry-session-id` set; those headers are removed from every request the middleware sees, but
+a route outside the `matcher` never reaches it, so `auth()` is the safer read.
+
+With no `signInUrl`, the middleware uses `GRANTRY_SIGN_IN_URL`, then
+`NEXT_PUBLIC_GRANTRY_SIGN_IN_URL`, then the environment's hosted sign-in page, and answers `401`
+if there is none.
+
+## Environment variables
+
+| Variable | Read by |
+| --- | --- |
+| `NEXT_PUBLIC_GRANTRY_PUBLISHABLE_KEY` | `auth()`, the middleware (and pass it to the provider) |
+| `GRANTRY_PUBLISHABLE_KEY` | `auth()` and the middleware, before the public one |
+| `NEXT_PUBLIC_GRANTRY_SIGN_IN_URL` | the provider and the middleware (after `GRANTRY_SIGN_IN_URL`) |
+| `NEXT_PUBLIC_GRANTRY_SIGN_UP_URL` | the provider |
+| `NEXT_PUBLIC_GRANTRY_SIGN_IN_FALLBACK_REDIRECT_URL`, `..._SIGN_UP_FALLBACK_REDIRECT_URL` | the provider |
+| `NEXT_PUBLIC_GRANTRY_SIGN_IN_FORCE_REDIRECT_URL`, `..._SIGN_UP_FORCE_REDIRECT_URL` | the provider |
+| `NEXT_PUBLIC_GRANTRY_AFTER_SIGN_OUT_URL` | the provider |
+
+No secret key is needed or read by this package.
+
+## About the token cookie
+
+The browser SDK mirrors the short-lived access token into a `grantry_token` cookie on your domain
+(`SameSite=Lax`, `Secure` on HTTPS) so the server can see who is signed in. A cookie written by
+script cannot be `httpOnly`; the token lives about a minute and cannot mint another, and the
+credential that can stays `httpOnly` on Grantry's domain.
+
+## License
+
+MIT

package/dist/cookie.d.ts

@@ -0,0 +1,24 @@
+/**
+ * The access-token cookie, as the middleware and `auth()` both read it.
+ *
+ * ⚠️ ONE COPY OF THE NAME, AND A TEST HOLDS IT TO `@grantry/js`. It cannot be imported from there:
+ * this package depends on `@grantry/react` alone, and `@grantry/react`'s main entry is the browser
+ * half, which has no business in a middleware bundle. `server.ts` and `middleware.ts` each carried
+ * their own literal, one under a comment saying it was imported; `tests/cookie.test.ts` compares
+ * this one with the writer's.
+ */
+export declare const TOKEN_COOKIE_NAME = "grantry_token";
+/**
+ * The token in the cookie as Next.js hands it over, or null when there is none.
+ *
+ * ⚠️ NOT DECODED A SECOND TIME. Next's cookie parser already applies `decodeURIComponent` to every
+ * value, and both readers applied it again. A JWT never contains `%`, so the second pass changed
+ * nothing for a real token — and threw `URIError` for a cookie whose decoded value held a stray
+ * `%E0`. In `auth()` that error was not a `TokenVerificationError`, so it was rethrown and every
+ * server component calling `auth()` failed to render for that visitor. Anything other than a token
+ * that is still left is reported by `verifyToken` as `malformed`.
+ */
+export declare function tokenFromCookie(cookie: {
+    value: string;
+} | undefined): string | null;
+//# sourceMappingURL=cookie.d.ts.map

package/dist/cookie.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cookie.d.ts","sourceRoot":"","sources":["../src/cookie.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,eAAO,MAAM,iBAAiB,kBAAkB,CAAC;AAEjD;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI,CAEpF"}

package/dist/cookie.js

@@ -0,0 +1,24 @@
+/**
+ * The access-token cookie, as the middleware and `auth()` both read it.
+ *
+ * ⚠️ ONE COPY OF THE NAME, AND A TEST HOLDS IT TO `@grantry/js`. It cannot be imported from there:
+ * this package depends on `@grantry/react` alone, and `@grantry/react`'s main entry is the browser
+ * half, which has no business in a middleware bundle. `server.ts` and `middleware.ts` each carried
+ * their own literal, one under a comment saying it was imported; `tests/cookie.test.ts` compares
+ * this one with the writer's.
+ */
+export const TOKEN_COOKIE_NAME = 'grantry_token';
+/**
+ * The token in the cookie as Next.js hands it over, or null when there is none.
+ *
+ * ⚠️ NOT DECODED A SECOND TIME. Next's cookie parser already applies `decodeURIComponent` to every
+ * value, and both readers applied it again. A JWT never contains `%`, so the second pass changed
+ * nothing for a real token — and threw `URIError` for a cookie whose decoded value held a stray
+ * `%E0`. In `auth()` that error was not a `TokenVerificationError`, so it was rethrown and every
+ * server component calling `auth()` failed to render for that visitor. Anything other than a token
+ * that is still left is reported by `verifyToken` as `malformed`.
+ */
+export function tokenFromCookie(cookie) {
+    return cookie?.value || null;
+}
+//# sourceMappingURL=cookie.js.map

package/dist/cookie.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cookie.js","sourceRoot":"","sources":["../src/cookie.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,eAAe,CAAC;AAEjD;;;;;;;;;GASG;AACH,MAAM,UAAU,eAAe,CAAC,MAAqC;IACnE,OAAO,MAAM,EAAE,KAAK,IAAI,IAAI,CAAC;AAC/B,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,28 @@
+/**
+ * @grantry/nextjs — authentication for Next.js.
+ *
+ *   app/layout.tsx      <GrantryProvider>       (client)
+ *   app/page.tsx        await auth()            (server)
+ *   middleware.ts       grantryMiddleware()     (edge)
+ *
+ * ⚠️ A RE-EXPORT, NOT A SECOND IMPLEMENTATION. Everything below is the React
+ * SDK unchanged, so a Next.js application installs one dependency and imports
+ * the same names it would in any React app — and there is no second copy of a
+ * component to drift from the first. The Next-specific half is `./server` and
+ * `./middleware`, which is genuinely different code.
+ *
+ * The one exception is `GrantryProvider`, which is a four-line wrapper around
+ * the React one for the sole purpose of saying "nextjs" rather than "react" on
+ * the wire. See `./provider` for why that distinction has to exist at all.
+ *
+ * ⚠️ EVERY NAME `@grantry/react` EXPORTS IS LISTED HERE, AND A TEST HOLDS IT TO
+ * THAT. The list is by name, with no `export *`, so for months each new React
+ * export was simply absent from Next.js:
+ * `AuthCard`, `OAuthConsent`, the localization contract and the entitlement
+ * helpers all had documentation pages telling Next.js readers to import them
+ * from here. `packages/sdk-react/tests/nextjs-exports.test.ts` compares the two
+ * lists, types included, and fails on the next one.
+ */
+export { GrantryProvider } from './provider.js';
+export { useAuth, useUser, useSession, useAccounts, useOAuth, useGrantry, useEntitlements, readOAuthResult, usePlans, pricingCatalogue, formatMoney, useRoutes, mergeRouteOptions, redirectTarget, requestedRedirectUrl, useSignInFlow, useSignUpFlow, entitlementsFromToken, actorFromToken, checkEntitlements, EMPTY_ENTITLEMENTS, SignedIn, SignedOut, GrantryLoading, GrantryLoaded, GrantryDegraded, GrantryFailed, useEnvironmentStatus, Protect, SignOutButton, useSignOutAction, SignIn, SignUp, CompleteAccount, UserButton, isAddingAccount, addAccountUrl, ADD_ACCOUNT_PARAM, UserAvatar, Waitlist, ResetPassword, SetupMfa, UserProfile, PricingTable, CheckoutButton, PlanDetailsButton, SubscriptionDetailsButton, ProductCard, type ProductCardProps, MenuItems, CustomAction, CustomLink, CustomPage, AuthCard, OAuthConsent, ContinueAs, ImpersonationBanner, LocalizationProvider, useTranslate, EN, AppearanceProvider, GRANTRY_STYLES, useStylesheet, variablesToStyle, THEME_COLORS, THEME_COLOR_LABELS, THEME_FONTS, THEME_LOGO_PLACEMENTS, THEME_RADII, THEME_SOCIAL_PLACEMENTS, THEME_SOCIAL_VARIANTS, brandThemeAppearance, cleanBrandTheme, themeColorScheme, DEFAULT_AVATAR_COLORS, avatarBackgroundCss, avatarInitial, avatarSeed, GrantryClient, GrantryError, TOKEN_COOKIE_NAME, useReverification, type Reverify, type ReverifyOptions, type Reverification, type ReverificationGrant, type ReverificationMethod, type GrantryProviderProps, type GrantryPreview, type SignInHostProviderProps, type ResellerHostProviderProps, type Routes, type RouteOptions, type RedirectTargets, type TokenEntitlements, type HasParams, type UseEntitlementsReturn, type SignInStatus, type SignUpStatus, type ProtectProps, type AuthCardProps, type OAuthConsentProps, type ContinueAsProps, type Localization, type LocalizationInput, type GrantryClientOptions, type SignUpParams, type SignUpResult, type BackupCodesProof, type BackupCodeEntry, type RevealedBackupCodes, type ChangeQuote, type CouponPreview, type FieldIssue, type BrandTheme, type ThemeColor, type ThemeFont, type ThemeProblem, type ThemeRadius, type AvatarStyle, type AvatarBackground, type AvatarForeground, type GrantryUser, type GrantrySession, type GrantryTrustedDevice, type GrantryBoundDevice, type GrantryBoundDevices, type GrantryAccount, type GrantryEnvironment, type GrantryErrorCode, type SignInResult, type Appearance, type ElementDescriptor, type ElementsConfig, type ElementStyle, type AppearanceVariables, type AppearanceLayout, type EnvironmentStatus, type SignOutButtonProps, type UseSignOutAction, type SignInProps, type SignUpProps, type CompleteAccountProps, type UserButtonProps, type UserProfileProps, type UseAuthReturn, type UseUserReturn, type UseSessionReturn, type UseAccountsReturn, type UseOAuthReturn, type UseSignInFlow, type UseSignUpFlow, type OAuthProviderInfo, type ConnectedAccount, type GrantryAuthorizedApp, type MfaFactor, type UserEmailAddress, type PublicPlan, type PlanPrice, type PlansResponse, type BillingSummary, type UsePlansOptions, type UsePlansReturn, type PricingCatalogue, type PricingPlan, type PricingPlanPrice, type PlanIntervalUnit, } from '@grantry/react';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAE7C,OAAO,EAEL,OAAO,EACP,OAAO,EACP,UAAU,EACV,WAAW,EACX,QAAQ,EACR,UAAU,EACV,eAAe,EACf,eAAe,EAEf,QAAQ,EACR,gBAAgB,EAChB,WAAW,EAGX,SAAS,EACT,iBAAiB,EACjB,cAAc,EACd,oBAAoB,EAGpB,aAAa,EACb,aAAa,EAGb,qBAAqB,EACrB,cAAc,EACd,iBAAiB,EACjB,kBAAkB,EAGlB,QAAQ,EACR,SAAS,EACT,cAAc,EACd,aAAa,EAMb,eAAe,EACf,aAAa,EACb,oBAAoB,EACpB,OAAO,EAGP,aAAa,EACb,gBAAgB,EAIhB,MAAM,EACN,MAAM,EAON,eAAe,EACf,UAAU,EAQV,eAAe,EACf,aAAa,EACb,iBAAiB,EAMjB,UAAU,EACV,QAAQ,EACR,aAAa,EACb,QAAQ,EACR,WAAW,EACX,YAAY,EACZ,cAAc,EACd,iBAAiB,EACjB,yBAAyB,EACzB,WAAW,EACX,KAAK,gBAAgB,EACrB,SAAS,EACT,YAAY,EACZ,UAAU,EACV,UAAU,EAEV,QAAQ,EACR,YAAY,EACZ,UAAU,EACV,mBAAmB,EAGnB,oBAAoB,EACpB,YAAY,EACZ,EAAE,EAGF,kBAAkB,EAClB,cAAc,EACd,aAAa,EACb,gBAAgB,EAGhB,YAAY,EACZ,kBAAkB,EAClB,WAAW,EACX,qBAAqB,EACrB,WAAW,EACX,uBAAuB,EACvB,qBAAqB,EACrB,oBAAoB,EACpB,eAAe,EACf,gBAAgB,EAGhB,qBAAqB,EACrB,mBAAmB,EACnB,aAAa,EACb,UAAU,EAGV,aAAa,EACb,YAAY,EACZ,iBAAiB,EAGjB,iBAAiB,EACjB,KAAK,QAAQ,EACb,KAAK,eAAe,EACpB,KAAK,cAAc,EACnB,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EAEzB,KAAK,oBAAoB,EACzB,KAAK,cAAc,EACnB,KAAK,uBAAuB,EAC5B,KAAK,yBAAyB,EAC9B,KAAK,MAAM,EACX,KAAK,YAAY,EACjB,KAAK,eAAe,EACpB,KAAK,iBAAiB,EACtB,KAAK,SAAS,EACd,KAAK,qBAAqB,EAC1B,KAAK,YAAY,EACjB,KAAK,YAAY,EACjB,KAAK,YAAY,EACjB,KAAK,aAAa,EAClB,KAAK,iBAAiB,EACtB,KAAK,eAAe,EACpB,KAAK,YAAY,EACjB,KAAK,iBAAiB,EACtB,KAAK,oBAAoB,EACzB,KAAK,YAAY,EACjB,KAAK,YAAY,EACjB,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACpB,KAAK,mBAAmB,EACxB,KAAK,WAAW,EAChB,KAAK,aAAa,EAClB,KAAK,UAAU,EACf,KAAK,UAAU,EACf,KAAK,UAAU,EACf,KAAK,SAAS,EACd,KAAK,YAAY,EACjB,KAAK,WAAW,EAChB,KAAK,WAAW,EAChB,KAAK,gBAAgB,EACrB,KAAK,gBAAgB,EACrB,KAAK,WAAW,EAChB,KAAK,cAAc,EACnB,KAAK,oBAAoB,EACzB,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,EACxB,KAAK,cAAc,EACnB,KAAK,kBAAkB,EACvB,KAAK,gBAAgB,EACrB,KAAK,YAAY,EACjB,KAAK,UAAU,EACf,KAAK,iBAAiB,EACtB,KAAK,cAAc,EACnB,KAAK,YAAY,EACjB,KAAK,mBAAmB,EACxB,KAAK,gBAAgB,EACrB,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EACvB,KAAK,gBAAgB,EACrB,KAAK,WAAW,EAChB,KAAK,WAAW,EAChB,KAAK,oBAAoB,EACzB,KAAK,eAAe,EACpB,KAAK,gBAAgB,EACrB,KAAK,aAAa,EAClB,KAAK,aAAa,EAClB,KAAK,gBAAgB,EACrB,KAAK,iBAAiB,EACtB,KAAK,cAAc,EACnB,KAAK,aAAa,EAClB,KAAK,aAAa,EAClB,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,EACrB,KAAK,oBAAoB,EACzB,KAAK,SAAS,EACd,KAAK,gBAAgB,EACrB,KAAK,UAAU,EACf,KAAK,SAAS,EACd,KAAK,aAAa,EAClB,KAAK,cAAc,EACnB,KAAK,eAAe,EACpB,KAAK,cAAc,EACnB,KAAK,gBAAgB,EACrB,KAAK,WAAW,EAChB,KAAK,gBAAgB,EACrB,KAAK,gBAAgB,GACtB,MAAM,gBAAgB,CAAC"}

package/dist/index.js

@@ -0,0 +1,86 @@
+/**
+ * @grantry/nextjs — authentication for Next.js.
+ *
+ *   app/layout.tsx      <GrantryProvider>       (client)
+ *   app/page.tsx        await auth()            (server)
+ *   middleware.ts       grantryMiddleware()     (edge)
+ *
+ * ⚠️ A RE-EXPORT, NOT A SECOND IMPLEMENTATION. Everything below is the React
+ * SDK unchanged, so a Next.js application installs one dependency and imports
+ * the same names it would in any React app — and there is no second copy of a
+ * component to drift from the first. The Next-specific half is `./server` and
+ * `./middleware`, which is genuinely different code.
+ *
+ * The one exception is `GrantryProvider`, which is a four-line wrapper around
+ * the React one for the sole purpose of saying "nextjs" rather than "react" on
+ * the wire. See `./provider` for why that distinction has to exist at all.
+ *
+ * ⚠️ EVERY NAME `@grantry/react` EXPORTS IS LISTED HERE, AND A TEST HOLDS IT TO
+ * THAT. The list is by name, with no `export *`, so for months each new React
+ * export was simply absent from Next.js:
+ * `AuthCard`, `OAuthConsent`, the localization contract and the entitlement
+ * helpers all had documentation pages telling Next.js readers to import them
+ * from here. `packages/sdk-react/tests/nextjs-exports.test.ts` compares the two
+ * lists, types included, and fails on the next one.
+ */
+export { GrantryProvider } from './provider.js';
+export { 
+// Hooks
+useAuth, useUser, useSession, useAccounts, useOAuth, useGrantry, useEntitlements, readOAuthResult, 
+// The public plans, for pricing cards of your own
+usePlans, pricingCatalogue, formatMoney, 
+// Where the application's own pages are: the provider's route options and their helpers.
+useRoutes, mergeRouteOptions, redirectTarget, requestedRedirectUrl, 
+// Headless flows
+useSignInFlow, useSignUpFlow, 
+// Entitlements, read straight off an access token
+entitlementsFromToken, actorFromToken, checkEntitlements, EMPTY_ENTITLEMENTS, 
+// Control
+SignedIn, SignedOut, GrantryLoading, GrantryLoaded, 
+/*
+ * ⚠️ THE CONNECTION PAIR, WHICH IS NOT THE SESSION PAIR. See the React
+ * package's `control.tsx` for why they are separate rather than four states
+ * of one machine the way Clerk's are.
+ */
+GrantryDegraded, GrantryFailed, useEnvironmentStatus, Protect, 
+// Unstyled actions
+SignOutButton, useSignOutAction, 
+// Drop-in components. Cut from a release and back; see the React package's
+// index for what changed on the way back in (the default look, not the code).
+SignIn, SignUp, 
+/*
+ * ⚠️ RE-EXPORTED BY NAME, SO A NEW COMPONENT IS UNREACHABLE FROM NEXT.JS
+ * UNTIL IT IS LISTED HERE. `<SignIn />` draws this itself when the account
+ * owes something, but an application that redirects somewhere other than its
+ * sign-in route has to render it there.
+ */
+CompleteAccount, UserButton, 
+/*
+ * ⚠️ NOT A COMPONENT, AND IT HAS TO BE HERE ANYWAY. `<UserButton />` sends
+ * "Add account" to the sign-in page with a marker on the link, and a Next.js
+ * application cannot let that visitor past its own gate without this. The
+ * list above is by name, so an unlisted helper is the same as one that does
+ * not exist -- and the failure is a redirect loop in somebody else's app.
+ */
+isAddingAccount, addAccountUrl, ADD_ACCOUNT_PARAM, 
+/*
+ * ⚠️ FOUR COMPONENTS THAT WERE EXPORTED FROM REACT AND UNREACHABLE FROM HERE,
+ * which is the same as not existing for a Next.js application — this list is
+ * by name and there is no deep-import escape hatch.
+ */
+UserAvatar, Waitlist, ResetPassword, SetupMfa, UserProfile, PricingTable, CheckoutButton, PlanDetailsButton, SubscriptionDetailsButton, ProductCard, MenuItems, CustomAction, CustomLink, CustomPage, 
+// The card itself, the consent card, "Continue as" and the support-visit banner.
+AuthCard, OAuthConsent, ContinueAs, ImpersonationBanner, 
+// Localization
+LocalizationProvider, useTranslate, EN, 
+// Appearance
+AppearanceProvider, GRANTRY_STYLES, useStylesheet, variablesToStyle, 
+// The brand theme: what Hosted sign-in → Theme stores, the hosted screens' look
+THEME_COLORS, THEME_COLOR_LABELS, THEME_FONTS, THEME_LOGO_PLACEMENTS, THEME_RADII, THEME_SOCIAL_PLACEMENTS, THEME_SOCIAL_VARIANTS, brandThemeAppearance, cleanBrandTheme, themeColorScheme, 
+// Avatars, drawn as the components draw them
+DEFAULT_AVATAR_COLORS, avatarBackgroundCss, avatarInitial, avatarSeed, 
+// The client
+GrantryClient, GrantryError, TOKEN_COOKIE_NAME, 
+// "Verify it's you" (0330): the dialog before a sensitive action, and what it resolves with.
+useReverification, } from '@grantry/react';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAE7C,OAAO;AACL,QAAQ;AACR,OAAO,EACP,OAAO,EACP,UAAU,EACV,WAAW,EACX,QAAQ,EACR,UAAU,EACV,eAAe,EACf,eAAe;AACf,kDAAkD;AAClD,QAAQ,EACR,gBAAgB,EAChB,WAAW;AAEX,yFAAyF;AACzF,SAAS,EACT,iBAAiB,EACjB,cAAc,EACd,oBAAoB;AAEpB,iBAAiB;AACjB,aAAa,EACb,aAAa;AAEb,kDAAkD;AAClD,qBAAqB,EACrB,cAAc,EACd,iBAAiB,EACjB,kBAAkB;AAElB,UAAU;AACV,QAAQ,EACR,SAAS,EACT,cAAc,EACd,aAAa;AACb;;;;GAIG;AACH,eAAe,EACf,aAAa,EACb,oBAAoB,EACpB,OAAO;AAEP,mBAAmB;AACnB,aAAa,EACb,gBAAgB;AAEhB,2EAA2E;AAC3E,8EAA8E;AAC9E,MAAM,EACN,MAAM;AACN;;;;;GAKG;AACH,eAAe,EACf,UAAU;AACV;;;;;;GAMG;AACH,eAAe,EACf,aAAa,EACb,iBAAiB;AACjB;;;;GAIG;AACH,UAAU,EACV,QAAQ,EACR,aAAa,EACb,QAAQ,EACR,WAAW,EACX,YAAY,EACZ,cAAc,EACd,iBAAiB,EACjB,yBAAyB,EACzB,WAAW,EAEX,SAAS,EACT,YAAY,EACZ,UAAU,EACV,UAAU;AACV,iFAAiF;AACjF,QAAQ,EACR,YAAY,EACZ,UAAU,EACV,mBAAmB;AAEnB,eAAe;AACf,oBAAoB,EACpB,YAAY,EACZ,EAAE;AAEF,aAAa;AACb,kBAAkB,EAClB,cAAc,EACd,aAAa,EACb,gBAAgB;AAEhB,gFAAgF;AAChF,YAAY,EACZ,kBAAkB,EAClB,WAAW,EACX,qBAAqB,EACrB,WAAW,EACX,uBAAuB,EACvB,qBAAqB,EACrB,oBAAoB,EACpB,eAAe,EACf,gBAAgB;AAEhB,6CAA6C;AAC7C,qBAAqB,EACrB,mBAAmB,EACnB,aAAa,EACb,UAAU;AAEV,aAAa;AACb,aAAa,EACb,YAAY,EACZ,iBAAiB;AAEjB,6FAA6F;AAC7F,iBAAiB,GAuFlB,MAAM,gBAAgB,CAAC"}

package/dist/middleware.d.ts

@@ -0,0 +1,73 @@
+/**
+ * Route protection in Next.js middleware — `@grantry/nextjs/middleware`.
+ *
+ *   export default grantryMiddleware({
+ *     protectedRoutes: ['/dashboard', '/account'],
+ *     signInUrl: '/sign-in',
+ *   });
+ *
+ *   export const config = { matcher: ['/((?!_next|.*\\..*).*)'] };
+ *
+ * Middleware runs before rendering, so an unauthenticated visitor is redirected
+ * without the protected page ever being built — which is the difference between
+ * protecting a route and merely hiding it. No request is let through signed out,
+ * a support visit's included; see `visitTicket`.
+ */
+import { NextResponse, type NextRequest } from 'next/server';
+export interface GrantryMiddlewareOptions {
+    /**
+     * Path patterns requiring a signed-in visitor.
+     *
+     * A path prefix as a string — `'/dashboard'` protects it and everything under
+     * it — or a `RegExp` for anything else. `'/dashboard(.*)'`, the spelling other
+     * libraries use, means the same prefix; any other string that looks like a
+     * pattern is refused when the middleware is made (`prefixOf`).
+     * Anything not listed is public — an allowlist would silently protect new
+     * routes, which sounds safer but produces a site where adding a public page
+     * quietly breaks it.
+     */
+    protectedRoutes?: Array<string | RegExp>;
+    /**
+     * Where to send unauthenticated visitors.
+     *
+     * Unset: `GRANTRY_SIGN_IN_URL`, then `NEXT_PUBLIC_GRANTRY_SIGN_IN_URL` — the
+     * variable `<GrantryProvider>` reads, so the two agree — then the hosted
+     * sign-in screen on the environment's sign-in URL, which is looked up with the
+     * publishable key (one request, remembered for five minutes). With none of
+     * those the visitor is answered 401 (docs/paths-and-domains.md §6).
+     * ⚠️ It defaulted to `/sign-in`, a page Grantry could only guess the
+     * application had.
+     */
+    signInUrl?: string;
+    /** Override for self-hosted deployments and local development. */
+    apiUrl?: string;
+    /**
+     * Your publishable key, which names the application these tokens must belong
+     * to, and finds the hosted sign-in screen when no sign-in page is named. Read
+     * from `GRANTRY_PUBLISHABLE_KEY`, then `NEXT_PUBLIC_GRANTRY_PUBLISHABLE_KEY`,
+     * when omitted. ⚠️ With no key and no `environmentId`, a request carrying a
+     * token makes the middleware THROW (`no_audience`) rather than redirect — no
+     * token is ever admitted without knowing the application, and a sign-in page
+     * cannot fix a server that does not know which one it is. See
+     * `@grantry/react/server`.
+     */
+    publishableKey?: string;
+    /** The environment id, for a deployment that configures it directly. */
+    environmentId?: string;
+    /** Require a verified email address, not merely a session. */
+    requireVerifiedEmail?: boolean;
+}
+/**
+ * A string route pattern, as the path prefix it protects.
+ *
+ * ⚠️ `'/dashboard(.*)'` PROTECTED NOTHING UNTIL 1 OCTOBER 2026, AND THE DOCS SAID TO WRITE IT. A
+ * string was compared as a literal prefix, so the pattern matched only a path that began with the
+ * characters `/dashboard(.*)` — none — and the middleware let every request through, signed out.
+ * The quickstart, the middleware page and this file's own example all used it (the docs audit). It
+ * is the spelling Clerk's route matcher takes, so somebody arriving from there writes it too: it is
+ * read as the prefix it means, and anything else that looks like a pattern is refused rather than
+ * silently matched against nothing.
+ */
+export declare function prefixOf(pattern: string): string;
+export declare function grantryMiddleware(options?: GrantryMiddlewareOptions): (request: NextRequest) => Promise<NextResponse>;
+//# sourceMappingURL=middleware.d.ts.map

package/dist/middleware.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"middleware.d.ts","sourceRoot":"","sources":["../src/middleware.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,EAAE,YAAY,EAAE,KAAK,WAAW,EAAE,MAAM,aAAa,CAAC;AAsB7D,MAAM,WAAW,wBAAwB;IACvC;;;;;;;;;;OAUG;IACH,eAAe,CAAC,EAAE,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC,CAAC;IACzC;;;;;;;;;;OAUG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,kEAAkE;IAClE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;;;;;;OASG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,wEAAwE;IACxE,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,8DAA8D;IAC9D,oBAAoB,CAAC,EAAE,OAAO,CAAC;CAChC;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAUhD;AAuED,wBAAgB,iBAAiB,CAAC,OAAO,GAAE,wBAA6B,IAiCrC,SAAS,WAAW,KAAG,OAAO,CAAC,YAAY,CAAC,CAqF9E"}

package/dist/middleware.js

@@ -0,0 +1,217 @@
+/**
+ * Route protection in Next.js middleware — `@grantry/nextjs/middleware`.
+ *
+ *   export default grantryMiddleware({
+ *     protectedRoutes: ['/dashboard', '/account'],
+ *     signInUrl: '/sign-in',
+ *   });
+ *
+ *   export const config = { matcher: ['/((?!_next|.*\\..*).*)'] };
+ *
+ * Middleware runs before rendering, so an unauthenticated visitor is redirected
+ * without the protected page ever being built — which is the difference between
+ * protecting a route and merely hiding it. No request is let through signed out,
+ * a support visit's included; see `visitTicket`.
+ */
+import { NextResponse } from 'next/server';
+import { REDIRECT_URL_PARAMETER, TICKET_PARAMETER, environmentSignInUrl, hostedSignInPage, serverRouteOptions, verifyToken, } from '@grantry/react/server';
+import { TOKEN_COOKIE_NAME, tokenFromCookie } from './cookie.js';
+/**
+ * The headers a verified request goes on with, for the application's pages to read.
+ *
+ * ⚠️ REMOVED FROM EVERY REQUEST THIS MIDDLEWARE SEES, NOT ONLY THE ONES IT VERIFIES. They were
+ * replaced on a protected route and passed through untouched everywhere else, so a visitor who sent
+ * `x-grantry-user-id: <anybody>` to a public page had it arrive as though this middleware had set
+ * it — and the docs tell a page it can trust these names. A page outside the middleware's `matcher`
+ * is still beyond reach, which is why `auth()`, which verifies the cookie itself, is the safer read.
+ */
+const FORWARDED_HEADERS = ['x-grantry-user-id', 'x-grantry-session-id'];
+/**
+ * A string route pattern, as the path prefix it protects.
+ *
+ * ⚠️ `'/dashboard(.*)'` PROTECTED NOTHING UNTIL 1 OCTOBER 2026, AND THE DOCS SAID TO WRITE IT. A
+ * string was compared as a literal prefix, so the pattern matched only a path that began with the
+ * characters `/dashboard(.*)` — none — and the middleware let every request through, signed out.
+ * The quickstart, the middleware page and this file's own example all used it (the docs audit). It
+ * is the spelling Clerk's route matcher takes, so somebody arriving from there writes it too: it is
+ * read as the prefix it means, and anything else that looks like a pattern is refused rather than
+ * silently matched against nothing.
+ */
+export function prefixOf(pattern) {
+    const prefix = pattern.endsWith('(.*)') ? pattern.slice(0, -'(.*)'.length) : pattern;
+    if (/[()*?+[\]{}|^$\\]/u.test(prefix)) {
+        throw new Error(`Grantry: the route pattern "${pattern}" is not a path prefix. ` +
+            'Use a prefix such as "/dashboard", or pass a RegExp.');
+    }
+    const trimmed = prefix.replace(/\/+$/u, '');
+    return trimmed === '' ? '/' : trimmed;
+}
+function matchesPath(pathname, patterns) {
+    return patterns.some((pattern) => {
+        if (typeof pattern === 'string') {
+            // A prefix, anchored at a path boundary so `/dashboard` does not also
+            // protect `/dashboards-public`.
+            return pattern === '/' || pathname === pattern || pathname.startsWith(`${pattern}/`);
+        }
+        /*
+         * ⚠️ `lastIndex` RESET FIRST. A RegExp with the `g` or `y` flag remembers where its last match
+         * ended and starts the next `test` there, so `/^\/admin/g` matched one request, missed the
+         * next — letting it through signed out — and matched the one after.
+         */
+        pattern.lastIndex = 0;
+        return pattern.test(pathname);
+    });
+}
+/**
+ * Whether a path is protected, as written and as decoded.
+ *
+ * ⚠️ BOTH SPELLINGS, BECAUSE THE ROUTER AND THIS CHECK MAY NOT AGREE ON ONE. `nextUrl.pathname`
+ * keeps percent-encoding (`/%64ashboard`), and a router that decodes before it matches a page
+ * would build `/dashboard` for an address the prefix never saw. Matching the decoded path too
+ * costs nothing on an ordinary request and only ever protects more.
+ */
+function matches(pathname, patterns) {
+    if (matchesPath(pathname, patterns))
+        return true;
+    let decoded;
+    try {
+        decoded = decodeURIComponent(pathname);
+    }
+    catch {
+        return false;
+    }
+    return decoded !== pathname && matchesPath(decoded, patterns);
+}
+/** The request as the application will see it, with no forwarded header the visitor wrote. */
+function withoutForwardedHeaders(request) {
+    const headers = new Headers(request.headers);
+    for (const name of FORWARDED_HEADERS)
+        headers.delete(name);
+    return headers;
+}
+/**
+ * A support visit's first request: a navigation carrying `?__grantry_ticket=`.
+ *
+ * ⚠️ CARRIED TO SIGN-IN, NEVER LET THROUGH. A view-as link opens the Home URL
+ * with its ticket (0242), and `@grantry/js` spends it on whatever page loads. A
+ * plain redirect to sign-in dropped the query string, so a protected Home URL
+ * turned every visit into a sign-in form for an operator with no password to
+ * type — and the first fix, letting the request through signed out, was a way
+ * past this middleware for anybody: the ticket is not checked here, so adding
+ * the parameter to any protected address rendered that page to a signed-out
+ * visitor. A page that trusted this middleware to keep its data from signed-out
+ * visitors would have served it.
+ *
+ * So the ticket rides the redirect instead. The sign-in page is public, the SDK
+ * spends the ticket there before anything else runs, and `<SignIn />` moves a
+ * visit on to `redirect_url` — the address the link pointed at, without the
+ * ticket. The protected page is only ever built for a signed-in request.
+ *
+ * Only GET and HEAD: a form post or a server action is never a navigation from a
+ * link, and carries nothing anywhere.
+ */
+function visitTicket(request) {
+    if (request.method !== 'GET' && request.method !== 'HEAD')
+        return null;
+    return request.nextUrl.searchParams.get(TICKET_PARAMETER) || null;
+}
+export function grantryMiddleware(options = {}) {
+    const { protectedRoutes: patterns = [], apiUrl, publishableKey, environmentId, requireVerifiedEmail = false, } = options;
+    // Read once, here, so a pattern that cannot work fails the deploy and not a visitor.
+    const protectedRoutes = patterns.map((pattern) => typeof pattern === 'string' ? prefixOf(pattern) : pattern);
+    /**
+     * Where sign-in is: the option, the server's variables, the hosted sign-in screen.
+     *
+     * ⚠️ THE ONE SDK THAT DOES NOT DEFAULT TO REDIRECT SIGN-IN, because it cannot.
+     * A redirect sign-in keeps its verifier in the browser and spends its code
+     * there (docs/hosted-sign-in.md §6), and the only page this middleware knows
+     * is the protected one it is turning the visitor away from. Name a sign-in
+     * page — `<SignIn mode="redirect" />` makes one a single line.
+     */
+    async function signInPage() {
+        const configured = options.signInUrl ?? serverRouteOptions().signInUrl;
+        if (configured)
+            return configured;
+        const signInUrl = await environmentSignInUrl({
+            ...(publishableKey ? { publishableKey } : {}),
+            ...(apiUrl ? { apiUrl } : {}),
+        });
+        return hostedSignInPage(signInUrl, 'sign-in');
+    }
+    return async function middleware(request) {
+        if (!matches(request.nextUrl.pathname, protectedRoutes)) {
+            // A public page: through, with nothing that claims to be this middleware's word.
+            return FORWARDED_HEADERS.some((name) => request.headers.has(name))
+                ? NextResponse.next({ request: { headers: withoutForwardedHeaders(request) } })
+                : NextResponse.next();
+        }
+        const token = tokenFromCookie(request.cookies.get(TOKEN_COOKIE_NAME));
+        const turnAway = async () => {
+            const signIn = await signInPage();
+            if (!signIn) {
+                return new NextResponse('Sign-in is required, and this application has no sign-in page.', {
+                    status: 401,
+                });
+            }
+            const target = new URL(signIn, request.url);
+            const here = new URL(request.url);
+            // A support visit: the sign-in page spends the ticket, and the visit goes on to
+            // where the link pointed, without it. See `visitTicket`.
+            const ticket = visitTicket(request);
+            if (ticket) {
+                here.searchParams.delete(TICKET_PARAMETER);
+                target.searchParams.set(TICKET_PARAMETER, ticket);
+            }
+            /*
+             * So the app can return the visitor where they were headed rather than
+             * dumping them on a home page after signing in. ⚠️ A PATH WHEN SIGN-IN IS
+             * ON THIS ORIGIN, THE WHOLE ADDRESS WHEN IT IS NOT: on the hosted sign-in
+             * screen a path would name a page of the sign-in URL's. The query
+             * string goes too: `/dashboard?tab=billing` came back as `/dashboard`.
+             * The sign-in page follows it only on its own origin (`requestedRedirectUrl`).
+             */
+            target.searchParams.set(REDIRECT_URL_PARAMETER, target.origin === here.origin ? `${here.pathname}${here.search}` : here.href);
+            const response = NextResponse.redirect(target);
+            // The ticket is in this address; the page it leads to has no need to be told where it came from.
+            if (ticket)
+                response.headers.set('Referrer-Policy', 'no-referrer');
+            return response;
+        };
+        if (!token)
+            return turnAway();
+        try {
+            const verified = await verifyToken(token, {
+                ...(apiUrl ? { apiUrl } : {}),
+                ...(publishableKey ? { publishableKey } : {}),
+                ...(environmentId ? { environmentId } : {}),
+            });
+            if (requireVerifiedEmail && !verified.emailVerified) {
+                return turnAway();
+            }
+            // Passed to the application so a server component can read the user
+            // without verifying a second time. Set on the *outgoing* request headers,
+            // which the visitor cannot forge — anything they send under these names
+            // is replaced here (and removed on public pages; see `FORWARDED_HEADERS`).
+            const headers = withoutForwardedHeaders(request);
+            headers.set('x-grantry-user-id', verified.userId);
+            headers.set('x-grantry-session-id', verified.sessionId);
+            return NextResponse.next({ request: { headers } });
+        }
+        catch (cause) {
+            /*
+             * ⚠️ A MISSING AUDIENCE IS THE ONE FAILURE THAT MUST NOT REDIRECT. Every
+             * other reason means this request cannot be trusted, and the sign-in page
+             * is the honest answer; `no_audience` means the application never said
+             * which Grantry environment it belongs to, and sending the visitor to
+             * sign in would loop them forever against a check that can never pass.
+             */
+            if (cause instanceof Error &&
+                cause.name === 'TokenVerificationError' &&
+                cause.reason === 'no_audience') {
+                throw cause;
+            }
+            return turnAway();
+        }
+    };
+}
+//# sourceMappingURL=middleware.js.map

package/dist/middleware.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"middleware.js","sourceRoot":"","sources":["../src/middleware.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,EAAE,YAAY,EAAoB,MAAM,aAAa,CAAC;AAC7D,OAAO,EACL,sBAAsB,EACtB,gBAAgB,EAChB,oBAAoB,EACpB,gBAAgB,EAChB,kBAAkB,EAClB,WAAW,GACZ,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,UAAU,CAAC;AAE9D;;;;;;;;GAQG;AACH,MAAM,iBAAiB,GAAG,CAAC,mBAAmB,EAAE,sBAAsB,CAAU,CAAC;AA8CjF;;;;;;;;;;GAUG;AACH,MAAM,UAAU,QAAQ,CAAC,OAAe;IACtC,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;IACrF,IAAI,oBAAoB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CACb,+BAA+B,OAAO,0BAA0B;YAC9D,sDAAsD,CACzD,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IAC5C,OAAO,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC;AACxC,CAAC;AAED,SAAS,WAAW,CAAC,QAAgB,EAAE,QAAgC;IACrE,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE;QAC/B,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;YAChC,sEAAsE;YACtE,gCAAgC;YAChC,OAAO,OAAO,KAAK,GAAG,IAAI,QAAQ,KAAK,OAAO,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,OAAO,GAAG,CAAC,CAAC;QACvF,CAAC;QACD;;;;WAIG;QACH,OAAO,CAAC,SAAS,GAAG,CAAC,CAAC;QACtB,OAAO,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAChC,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,OAAO,CAAC,QAAgB,EAAE,QAAgC;IACjE,IAAI,WAAW,CAAC,QAAQ,EAAE,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IACjD,IAAI,OAAe,CAAC;IACpB,IAAI,CAAC;QACH,OAAO,GAAG,kBAAkB,CAAC,QAAQ,CAAC,CAAC;IACzC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,OAAO,KAAK,QAAQ,IAAI,WAAW,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;AAChE,CAAC;AAED,8FAA8F;AAC9F,SAAS,uBAAuB,CAAC,OAAoB;IACnD,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAC7C,KAAK,MAAM,IAAI,IAAI,iBAAiB;QAAE,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC3D,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,SAAS,WAAW,CAAC,OAAoB;IACvC,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC;IACvE,OAAO,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,IAAI,CAAC;AACpE,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,UAAoC,EAAE;IACtE,MAAM,EACJ,eAAe,EAAE,QAAQ,GAAG,EAAE,EAC9B,MAAM,EACN,cAAc,EACd,aAAa,EACb,oBAAoB,GAAG,KAAK,GAC7B,GAAG,OAAO,CAAC;IAEZ,qFAAqF;IACrF,MAAM,eAAe,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAC/C,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAC1D,CAAC;IAEF;;;;;;;;OAQG;IACH,KAAK,UAAU,UAAU;QACvB,MAAM,UAAU,GAAG,OAAO,CAAC,SAAS,IAAI,kBAAkB,EAAE,CAAC,SAAS,CAAC;QACvE,IAAI,UAAU;YAAE,OAAO,UAAU,CAAC;QAClC,MAAM,SAAS,GAAG,MAAM,oBAAoB,CAAC;YAC3C,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7C,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9B,CAAC,CAAC;QACH,OAAO,gBAAgB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;IAChD,CAAC;IAED,OAAO,KAAK,UAAU,UAAU,CAAC,OAAoB;QACnD,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,EAAE,eAAe,CAAC,EAAE,CAAC;YACxD,iFAAiF;YACjF,OAAO,iBAAiB,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBAChE,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,uBAAuB,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;gBAC/E,CAAC,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC;QAC1B,CAAC;QAED,MAAM,KAAK,GAAG,eAAe,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC;QAEtE,MAAM,QAAQ,GAAG,KAAK,IAA2B,EAAE;YACjD,MAAM,MAAM,GAAG,MAAM,UAAU,EAAE,CAAC;YAClC,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,OAAO,IAAI,YAAY,CAAC,gEAAgE,EAAE;oBACxF,MAAM,EAAE,GAAG;iBACZ,CAAC,CAAC;YACL,CAAC;YAED,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;YAC5C,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YAClC,gFAAgF;YAChF,yDAAyD;YACzD,MAAM,MAAM,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;YACpC,IAAI,MAAM,EAAE,CAAC;gBACX,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;gBAC3C,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,gBAAgB,EAAE,MAAM,CAAC,CAAC;YACpD,CAAC;YACD;;;;;;;eAOG;YACH,MAAM,CAAC,YAAY,CAAC,GAAG,CACrB,sBAAsB,EACtB,MAAM,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAC7E,CAAC;YACF,MAAM,QAAQ,GAAG,YAAY,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YAC/C,iGAAiG;YACjG,IAAI,MAAM;gBAAE,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,aAAa,CAAC,CAAC;YACnE,OAAO,QAAQ,CAAC;QAClB,CAAC,CAAC;QAEF,IAAI,CAAC,KAAK;YAAE,OAAO,QAAQ,EAAE,CAAC;QAE9B,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,KAAK,EAAE;gBACxC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC7B,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC7C,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC5C,CAAC,CAAC;YAEH,IAAI,oBAAoB,IAAI,CAAC,QAAQ,CAAC,aAAa,EAAE,CAAC;gBACpD,OAAO,QAAQ,EAAE,CAAC;YACpB,CAAC;YAED,oEAAoE;YACpE,0EAA0E;YAC1E,wEAAwE;YACxE,2EAA2E;YAC3E,MAAM,OAAO,GAAG,uBAAuB,CAAC,OAAO,CAAC,CAAC;YACjD,OAAO,CAAC,GAAG,CAAC,mBAAmB,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;YAClD,OAAO,CAAC,GAAG,CAAC,sBAAsB,EAAE,QAAQ,CAAC,SAAS,CAAC,CAAC;YAExD,OAAO,YAAY,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC;QACrD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf;;;;;;eAMG;YACH,IACE,KAAK,YAAY,KAAK;gBACtB,KAAK,CAAC,IAAI,KAAK,wBAAwB;gBACtC,KAA6B,CAAC,MAAM,KAAK,aAAa,EACvD,CAAC;gBACD,MAAM,KAAK,CAAC;YACd,CAAC;YACD,OAAO,QAAQ,EAAE,CAAC;QACpB,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}