@thunderid/express 0.0.4 → 0.1.0

package/README.md

@@ -1,4 +1,4 @@
-![ThunderID Express SDK](https://raw.githubusercontent.com/thunder-id/thunderid/refs/heads/main/docs/content/sdks/assets/images/%40thunderid%3Aexpress_sdk_banner.png)
+![ThunderID Express SDK](https://raw.githubusercontent.com/thunder-id/thunderid/refs/heads/main/docs/static/assets/images/readme/repo-banner-express-sdk.png)
 
 Express.js SDK for ThunderID. Provides authentication middleware for Express applications.
 

package/dist/ThunderIDExpressClient.d.ts

@@ -15,15 +15,17 @@
  * specific language governing permissions and limitations
  * under the License.
  */
-import { LegacyThunderIDNodeClient } from '@thunderid/node';
-import { ThunderIDExpressConfig } from './models/config';
-/**
- * Base class for implementing ThunderID in Express.js based applications.
- * This class provides the core functionality for managing user authentication and sessions.
- *
- * @typeParam T - Configuration type that extends ThunderIDExpressConfig.
- */
-declare abstract class ThunderIDExpressClient<T = ThunderIDExpressConfig> extends LegacyThunderIDNodeClient<T> {
+import { ThunderIDNodeClient, Storage, TokenResponse, User } from '@thunderid/node';
+import express from 'express';
+import { ExpressClientConfig } from './models/config';
+declare class ThunderIDExpressClient<T extends ExpressClientConfig = ExpressClientConfig> extends ThunderIDNodeClient<T> {
+    private _expressConfig;
+    constructor();
+    initialize(config: T, storage?: Storage): Promise<boolean>;
+    get expressConfig(): ExpressClientConfig | undefined;
+    getUserFromRequest(req: express.Request): Promise<User | undefined>;
+    signIn(req: express.Request, res: express.Response, next: express.NextFunction, signInConfig?: Record<string, string | boolean>): Promise<TokenResponse>;
+    signOut(userId?: string): Promise<string>;
 }
 export default ThunderIDExpressClient;
 //# sourceMappingURL=ThunderIDExpressClient.d.ts.map

package/dist/ThunderIDExpressClient.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ThunderIDExpressClient.d.ts","sourceRoot":"","sources":["../src/ThunderIDExpressClient.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAC,yBAAyB,EAAC,MAAM,iBAAiB,CAAC;AAC1D,OAAO,EAAC,sBAAsB,EAAC,MAAM,iBAAiB,CAAC;AAEvD;;;;;GAKG;AACH,uBAAe,sBAAsB,CAAC,CAAC,GAAG,sBAAsB,CAAE,SAAQ,yBAAyB,CAAC,CAAC,CAAC;CAAG;AAEzG,eAAe,sBAAsB,CAAC"}
+{"version":3,"file":"ThunderIDExpressClient.d.ts","sourceRoot":"","sources":["../src/ThunderIDExpressClient.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAC,mBAAmB,EAA0B,OAAO,EAAE,aAAa,EAAE,IAAI,EAAC,MAAM,iBAAiB,CAAC;AAC1G,OAAO,OAAO,MAAM,SAAS,CAAC;AAG9B,OAAO,EAAC,mBAAmB,EAAC,MAAM,iBAAiB,CAAC;AAGpD,cAAM,sBAAsB,CAAC,CAAC,SAAS,mBAAmB,GAAG,mBAAmB,CAAE,SAAQ,mBAAmB,CAAC,CAAC,CAAC;IAC9G,OAAO,CAAC,cAAc,CAAkC;;IAMlC,UAAU,CAAC,MAAM,EAAE,CAAC,EAAE,OAAO,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IAKhF,IAAW,aAAa,IAAI,mBAAmB,GAAG,SAAS,CAE1D;IAEY,kBAAkB,CAAC,GAAG,EAAE,OAAO,CAAC,OAAO,GAAG,OAAO,CAAC,IAAI,GAAG,SAAS,CAAC;IAK1D,MAAM,CAC1B,GAAG,EAAE,OAAO,CAAC,OAAO,EACpB,GAAG,EAAE,OAAO,CAAC,QAAQ,EACrB,IAAI,EAAE,OAAO,CAAC,YAAY,EAC1B,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,GAC9C,OAAO,CAAC,aAAa,CAAC;IAuDH,OAAO,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;CAGhE;AAED,eAAe,sBAAsB,CAAC"}

package/dist/cjs/index.cjs

@@ -25,12 +25,10 @@ let __thunderid_node = require("@thunderid/node");
 __thunderid_node = __toESM(__thunderid_node);
 let uuid = require("uuid");
 uuid = __toESM(uuid);
-let express = require("express");
-express = __toESM(express);
 
-//#region src/__legacy__/constants/default-options.ts
+//#region src/constants/CookieConfig.ts
 /**
-* Copyright (c) 2026, WSO2 LLC. (https://www.wso2.com).
+* Copyright (c) 2025, WSO2 LLC. (https://www.wso2.com).
 *
 * WSO2 LLC. licenses this file to you under the Apache License,
 * Version 2.0 (the "License"); you may not use this file except
@@ -46,209 +44,345 @@ express = __toESM(express);
 * specific language governing permissions and limitations
 * under the License.
 */
-let CookieConfig = /* @__PURE__ */ function(CookieConfig$1) {
-	CookieConfig$1[CookieConfig$1["defaultMaxAge"] = 9e4] = "defaultMaxAge";
-	CookieConfig$1["defaultHttpOnly"] = "true";
-	CookieConfig$1["defaultSameSite"] = "lax";
-	CookieConfig$1["defaultSecure"] = "false";
-	return CookieConfig$1;
-}({});
-const DEFAULT_LOGIN_PATH = "/login";
-const DEFAULT_LOGOUT_PATH = "/logout";
+/** Session cookie name used across the Express SDK. */
+const SESSION_COOKIE_NAME = "THUNDERID_SESSION_ID";
+/** Default cookie configuration values. */
+const CookieConfig = {
+	defaultExpirySeconds: 86400,
+	defaultHttpOnly: true,
+	defaultSameSite: "lax",
+	defaultSecure: false
+};
+var CookieConfig_default = CookieConfig;
 
 //#endregion
-//#region src/__legacy__/middleware/protect-route.ts
-const protectRoute = (thunderIDExpressClient, callback) => {
-	return async (req, res, next) => {
-		if (req.cookies.THUNDERID_SESSION_ID === void 0) {
-			__thunderid_node.Logger.error("No session ID found in the request cookies");
-			if (callback(res, "Unauthenticated")) return;
-			return next();
-		} else if (await thunderIDExpressClient.isSignedIn(req.cookies.THUNDERID_SESSION_ID)) return next();
-		else {
-			__thunderid_node.Logger.error("Invalid session ID found in the request cookies");
-			if (callback(res, "Invalid session cookie")) return;
-			return next();
-		}
-	};
+//#region src/utils/expressUtils.ts
+/**
+* Copyright (c) 2025, WSO2 LLC. (https://www.wso2.com).
+*
+* WSO2 LLC. licenses this file to you under the Apache License,
+* Version 2.0 (the "License"); you may not use this file except
+* in compliance with the License.
+* You may obtain a copy of the License at
+*
+*     http://www.apache.org/licenses/LICENSE-2.0
+*
+* Unless required by applicable law or agreed to in writing,
+* software distributed under the License is distributed on an
+* "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+* KIND, either express or implied. See the License for the
+* specific language governing permissions and limitations
+* under the License.
+*/
+const AUTH_ERROR_REGEXP = /[?&]error=[^&]+/;
+/**
+* Returns `true` if the given URL contains an OAuth error query parameter.
+*
+* @param url - The URL to inspect.
+*/
+const hasErrorInURL = (url) => AUTH_ERROR_REGEXP.test(url);
+var expressUtils_default = hasErrorInURL;
+
+//#endregion
+//#region src/ThunderIDExpressClient.ts
+var ThunderIDExpressClient = class extends __thunderid_node.ThunderIDNodeClient {
+	_expressConfig;
+	constructor() {
+		super();
+	}
+	async initialize(config, storage) {
+		this._expressConfig = config;
+		return super.initialize(config, storage);
+	}
+	get expressConfig() {
+		return this._expressConfig;
+	}
+	async getUserFromRequest(req) {
+		const sessionId = req.cookies?.[SESSION_COOKIE_NAME];
+		return this.getUser(sessionId);
+	}
+	async signIn(req, res, next, signInConfig) {
+		if (expressUtils_default(req.originalUrl)) return Promise.reject(new __thunderid_node.ThunderIDAuthException("EXPRESS-CLIENT-SI-IV01", "Invalid login request URL", "Login request contains an error query parameter in the URL"));
+		let userId = req.cookies?.[SESSION_COOKIE_NAME];
+		if (!userId) userId = (0, uuid.v4)();
+		const sc = this._expressConfig?.sessionCookie;
+		const authRedirectCallback = (url) => {
+			if (!url) return;
+			res.cookie(SESSION_COOKIE_NAME, userId, {
+				httpOnly: sc?.httpOnly ?? CookieConfig_default.defaultHttpOnly,
+				maxAge: (sc?.expiryTime ?? CookieConfig_default.defaultExpirySeconds) * 1e3,
+				sameSite: sc?.sameSite ?? CookieConfig_default.defaultSameSite,
+				secure: sc?.secure ?? CookieConfig_default.defaultSecure
+			});
+			res.redirect(url);
+			if (typeof next === "function") next();
+		};
+		const authResponse = await super.signIn(authRedirectCallback, userId, req.query.code, req.query.session_state, req.query.state, signInConfig);
+		if (authResponse.accessToken || authResponse.idToken) return authResponse;
+		return {
+			accessToken: "",
+			createdAt: 0,
+			expiresIn: "",
+			idToken: "",
+			refreshToken: "",
+			scope: "",
+			tokenType: ""
+		};
+	}
+	async signOut(userId) {
+		return super.signOut(userId);
+	}
 };
+var ThunderIDExpressClient_default = ThunderIDExpressClient;
 
 //#endregion
-//#region src/__legacy__/middleware/authentication.ts
-const thunderIDExpressAuth = (thunderIDExpressClient, config, onSignIn, onSignOut, onError) => {
-	const router = new express.default.Router();
-	router.use(async (req, res, next) => {
-		req.thunderIDAuth = thunderIDExpressClient;
-		res.thunderIDAuth = thunderIDExpressClient;
+//#region src/middleware/authentication.ts
+/**
+* Returns Express middleware that initialises the ThunderID client and attaches
+* it to `req.thunderIDAuth` for use in route handlers and `protect()`.
+*
+* Unlike the old `thunderID()` router, this function does **not** mount any
+* routes automatically. Register sign-in and sign-out handlers explicitly:
+*
+* ```ts
+* app.use(thunderID(config));
+* app.get('/login',  handleSignIn());
+* app.get('/logout', handleSignOut());
+* ```
+*
+* @param config - ThunderID Express configuration.
+*/
+const thunderID = (config) => {
+	const client = new ThunderIDExpressClient_default();
+	let initPromise;
+	const getInitPromise = (req) => {
+		if (initPromise === void 0) {
+			const origin = `${req.protocol}://${req.get("host")}`;
+			initPromise = client.initialize({
+				...config,
+				afterSignInUrl: config.afterSignInUrl ?? `${origin}/login`,
+				afterSignOutUrl: config.afterSignOutUrl ?? `${origin}/logout`
+			});
+		}
+		return initPromise;
+	};
+	return async (req, res, next) => {
+		await getInitPromise(req);
+		req.thunderIDAuth = client;
+		res.thunderIDAuth = client;
 		next();
-	});
-	router.get(config.loginPath || DEFAULT_LOGIN_PATH, async (req, res, next) => {
+	};
+};
+/**
+* Returns an Express route handler for the sign-in path.
+*
+* - If the request has no `?code` query param, initiates the OAuth 2.0 redirect.
+* - If the request has `?code`, exchanges the authorization code for tokens,
+*   sets the session cookie, and calls `onSignIn`.
+*
+* Must be used after `thunderID()` middleware so that `req.thunderIDAuth` is set.
+*
+* ```ts
+* app.get('/login', handleSignIn());
+* ```
+*/
+const handleSignIn = () => {
+	return async (req, res, next) => {
+		const client = req.thunderIDAuth;
+		if (!client) {
+			__thunderid_node.logger.error("thunderID() middleware must be mounted before handleSignIn()");
+			res.status(500).end();
+			return;
+		}
+		const config = client.expressConfig;
+		const onSignIn = config?.onSignIn ?? ((r) => r.end());
+		const onError = config?.onError ?? ((r, e) => {
+			__thunderid_node.logger.error(e.message);
+			r.status(500).end();
+		});
 		try {
-			const response = await thunderIDExpressClient.signIn(req, res, next, config.signInConfig);
+			const response = await client.signIn(req, res, next, config?.signInOptions);
 			if (response.accessToken || response.idToken) onSignIn(res, response);
 		} catch (e) {
-			__thunderid_node.Logger.error(e.message);
+			__thunderid_node.logger.error(e.message);
 			onError(res, e);
 		}
-	});
-	router.get(config.logoutPath || DEFAULT_LOGOUT_PATH, async (req, res, next) => {
+	};
+};
+/**
+* Returns an Express route handler for the sign-out path.
+*
+* - Clears the session cookie and redirects to the identity provider's
+*   end-session endpoint.
+* - When the identity provider redirects back with `?state=sign_out_success`,
+*   calls `onSignOut`.
+*
+* Must be used after `thunderID()` middleware so that `req.thunderIDAuth` is set.
+*
+* ```ts
+* app.get('/logout', handleSignOut());
+* ```
+*/
+const handleSignOut = () => {
+	return async (req, res) => {
+		const client = req.thunderIDAuth;
+		if (!client) {
+			__thunderid_node.logger.error("thunderID() middleware must be mounted before handleSignOut()");
+			res.status(500).end();
+			return;
+		}
+		const config = client.expressConfig;
+		const onSignOut = config?.onSignOut ?? ((r) => r.end());
+		const onError = config?.onError ?? ((r, e) => {
+			__thunderid_node.logger.error(e.message);
+			r.status(500).end();
+		});
 		if (req.query.state === "sign_out_success") {
 			onSignOut(res);
 			return;
 		}
-		if (req.cookies.THUNDERID_SESSION_ID === void 0) {
-			onError(res, new __thunderid_node.ThunderIDAuthException("EXPRESS-AUTH_MW-LOGOUT-NF01", "No cookie found in the request", "No cookie was sent with the request. The user may not have signed in yet."));
+		const sessionId = req.cookies?.[SESSION_COOKIE_NAME];
+		if (!sessionId) {
+			onError(res, new __thunderid_node.ThunderIDRuntimeError("No cookie found in the request", "EXPRESS-AUTH_MW-LOGOUT-NF01", "express"));
 			return;
-		} else try {
-			const signOutURL = await req.thunderIDAuth.signOut(req.cookies.THUNDERID_SESSION_ID);
+		}
+		try {
+			const signOutURL = await client.signOut(sessionId);
 			if (signOutURL) {
-				res.cookie("THUNDERID_SESSION_ID", null, { maxAge: 0 });
+				res.cookie(SESSION_COOKIE_NAME, null, { maxAge: 0 });
 				res.redirect(signOutURL);
-				return;
 			}
 		} catch (e) {
 			onError(res, e);
-			return;
 		}
-	});
-	return router;
+	};
 };
 
 //#endregion
-//#region src/__legacy__/utils/express-utils.ts
-var ExpressUtils = class {
-	static AUTH_CODE_REGEXP = /[?&]error=[^&]+/;
-	/**
-	* Copyright (c) 2026, WSO2 LLC. (https://www.wso2.com).
-	*
-	* WSO2 LLC. licenses this file to you under the Apache License,
-	* Version 2.0 (the "License"); you may not use this file except
-	* in compliance with the License.
-	* You may obtain a copy of the License at
-	*
-	*     http://www.apache.org/licenses/LICENSE-2.0
-	*
-	* Unless required by applicable law or agreed to in writing,
-	* software distributed under the License is distributed on an
-	* "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
-	* KIND, either express or implied. See the License for the
-	* specific language governing permissions and limitations
-	* under the License.
-	*/
-	static hasErrorInURL(url) {
-		return this.AUTH_CODE_REGEXP.test(url);
-	}
+//#region src/middleware/protect.ts
+/**
+* Returns Express middleware that blocks unauthenticated requests.
+* Requires `thunderID()` to be mounted before this middleware so that
+* `req.thunderIDAuth` is populated.
+*
+* @param onUnauthenticated - Called when the session is missing or invalid.
+*   Defaults to sending a 401 response.
+*/
+const protect = (onUnauthenticated) => {
+	return async (req, res, next) => {
+		const client = req.thunderIDAuth;
+		const sessionId = req.cookies?.[SESSION_COOKIE_NAME];
+		const reject = () => {
+			if (onUnauthenticated) onUnauthenticated(res);
+			else res.status(401).end();
+		};
+		if (!client || !sessionId) {
+			__thunderid_node.logger.error("No session ID found in the request cookies");
+			reject();
+			return;
+		}
+		if (await client.isSignedIn(sessionId)) return next();
+		__thunderid_node.logger.error("Invalid session ID found in the request cookies");
+		reject();
+	};
 };
+var protect_default = protect;
 
 //#endregion
-//#region src/__legacy__/client.ts
-var ThunderIDExpressClient = class ThunderIDExpressClient {
-	_authClient;
-	_storage;
-	static _clientConfig;
-	static _instance;
-	constructor(config, storage) {
-		ThunderIDExpressClient._clientConfig = { ...config };
-		const nodeClientConfig = {
-			...config,
-			afterSignInUrl: config.appURL + (config.loginPath || DEFAULT_LOGIN_PATH),
-			afterSignOutUrl: config.appURL + (config.logoutPath || DEFAULT_LOGOUT_PATH)
-		};
-		if (storage) {
-			__thunderid_node.Logger.debug("Initializing user provided storage");
-			this._storage = storage;
+//#region src/middleware/flow.ts
+/**
+* Returns an Express route handler that drives the embedded sign-in flow loop.
+*
+* Requires `thunderID()` middleware with `mode: 'embedded'` to be mounted first.
+* On each POST, the handler advances the flow one step and returns JSON.
+*
+* **First call** — no `executionId`:
+* ```json
+* { "applicationId": "app-id", "flowType": "SIGN_IN" }
+* ```
+* Response includes `executionId`, `challengeToken`, `authId`, and `components`
+* (the UI elements to render).
+*
+* **Subsequent calls** — continue the flow:
+* ```json
+* { "executionId": "...", "challengeToken": "...", "authId": "...", "inputs": { ... } }
+* ```
+*
+* **On completion** — flow returns `{ "done": true, "redirectUrl": "/login?code=..." }`.
+* The client navigates to `redirectUrl`, which is handled by `handleSignIn()` to
+* exchange the code and set the session cookie.
+*
+* ```ts
+* app.use(thunderID({ ..., mode: 'embedded' }));
+* app.get('/login',          handleSignIn());
+* app.post('/flow/sign-in',  handleFlow());
+* app.get('/logout',         handleSignOut());
+* ```
+*/
+const handleFlow = () => {
+	return async (req, res) => {
+		const client = req.thunderIDAuth;
+		if (!client) {
+			__thunderid_node.logger.error("thunderID() middleware must be mounted before handleFlow()");
+			res.status(500).json({ error: "SDK not initialised" });
+			return;
 		}
-		this._authClient = new __thunderid_node.LegacyThunderIDNodeClient();
-		this._authClient.initialize(nodeClientConfig, this._storage);
-	}
-	static getInstance(config, storage) {
-		if (!ThunderIDExpressClient._instance && config) {
-			ThunderIDExpressClient._instance = new ThunderIDExpressClient(config, storage);
-			__thunderid_node.Logger.debug("Initialized ThunderIDExpressClient successfully");
+		const baseUrl = client.expressConfig?.baseUrl;
+		if (!baseUrl) {
+			res.status(500).json({ error: "baseUrl is not configured" });
+			return;
 		}
-		if (!ThunderIDExpressClient._instance && !config) throw Error(new __thunderid_node.ThunderIDAuthException("EXPRESS-CLIENT-GI1-NF01", "User configuration  is not found", "User config has not been passed to initialize ThunderIDExpressClient").toString());
-		return ThunderIDExpressClient._instance;
-	}
-	async signIn(req, res, next, signInConfig) {
-		if (ExpressUtils.hasErrorInURL(req.originalUrl)) return Promise.reject(new __thunderid_node.ThunderIDAuthException("EXPRESS-CLIENT-SI-IV01", "Invalid login request URL", "Login request contains an error query parameter in the URL"));
-		let userId = req.cookies.THUNDERID_SESSION_ID;
-		if (!userId) userId = (0, uuid.v4)();
-		const authRedirectCallback = (url) => {
-			if (url) {
-				__thunderid_node.Logger.debug("Redirecting to: " + url);
-				res.cookie("THUNDERID_SESSION_ID", userId, {
-					maxAge: ThunderIDExpressClient._clientConfig.cookieConfig?.maxAge ? ThunderIDExpressClient._clientConfig.cookieConfig.maxAge : CookieConfig.defaultMaxAge,
-					httpOnly: ThunderIDExpressClient._clientConfig.cookieConfig?.httpOnly ?? CookieConfig.defaultHttpOnly,
-					sameSite: ThunderIDExpressClient._clientConfig.cookieConfig?.sameSite ?? CookieConfig.defaultSameSite,
-					secure: ThunderIDExpressClient._clientConfig.cookieConfig?.secure ?? CookieConfig.defaultSecure
+		const { applicationId, flowType, executionId, challengeToken, authId, inputs } = req.body ?? {};
+		try {
+			let resolvedAuthId = authId;
+			if (!executionId && !resolvedAuthId) {
+				const authUrl = await client.getSignInUrl();
+				resolvedAuthId = new URL(authUrl).searchParams.get("authId") ?? void 0;
+			}
+			const flowResponse = await (0, __thunderid_node.executeEmbeddedSignInFlowV2)({
+				authId: resolvedAuthId,
+				baseUrl,
+				payload: executionId ? {
+					action: "submit",
+					challengeToken,
+					executionId,
+					inputs
+				} : {
+					applicationId,
+					flowType: flowType ?? "SIGN_IN"
+				}
+			});
+			if (flowResponse.redirectUrl) {
+				res.json({
+					done: true,
+					redirectUrl: flowResponse.redirectUrl
 				});
-				res.redirect(url);
-				next && typeof next === "function" && next();
+				return;
 			}
-		};
-		const authResponse = await this._authClient.signIn(authRedirectCallback, userId, req.query.code, req.query.session_state, req.query.state, signInConfig);
-		if (authResponse.accessToken || authResponse.idToken) return authResponse;
-		else return {
-			accessToken: "",
-			createdAt: 0,
-			expiresIn: "",
-			idToken: "",
-			refreshToken: "",
-			scope: "",
-			tokenType: ""
-		};
-	}
-	async signOut(userId) {
-		return this._authClient.signOut(userId);
-	}
-	async isSignedIn(userId) {
-		return this._authClient.isSignedIn(userId);
-	}
-	async getIdToken(userId) {
-		return this._authClient.getIdToken(userId);
-	}
-	async getUser(userId) {
-		return this._authClient.getUser(userId);
-	}
-	async getOpenIDProviderEndpoints() {
-		return this._authClient.getOpenIDProviderEndpoints();
-	}
-	async getDecodedIdToken(userId) {
-		return this._authClient.getDecodedIdToken(userId);
-	}
-	async getAccessToken(userId) {
-		return this._authClient.getAccessToken(userId);
-	}
-	async exchangeToken(config, userId) {
-		return this._authClient.exchangeToken(config, userId);
-	}
-	async reInitialize(config) {
-		return this._authClient.reInitialize(config);
-	}
-	async revokeAccessToken(userId) {
-		return this._authClient.revokeAccessToken(userId);
-	}
-	static didSignOutFail(afterSignOutUrl) {
-		return __thunderid_node.LegacyThunderIDNodeClient.didSignOutFail(afterSignOutUrl);
-	}
-	static isSignOutSuccessful(afterSignOutUrl) {
-		return __thunderid_node.LegacyThunderIDNodeClient.isSignOutSuccessful(afterSignOutUrl);
-	}
-	static protectRoute(callback) {
-		if (!this._instance) throw new __thunderid_node.ThunderIDAuthException("EXPRESS-CLIENT-PR-NF01", "ThunderIDExpressClient is not instantiated", "Create an instance of ThunderIDExpressClient before using calling this method.");
-		return protectRoute(this._instance, callback);
-	}
-	static thunderIDExpressAuth(onSignIn, onSignOut, onError) {
-		if (!this._instance) throw new __thunderid_node.ThunderIDAuthException("EXPRESS-CLIENT-AEA-NF01", "ThunderIDExpressClient is not instantiated", "Create an instance of ThunderIDExpressClient before using calling this method.");
-		return thunderIDExpressAuth(this._instance, ThunderIDExpressClient._clientConfig, onSignIn, onSignOut, onError);
-	}
-	async getStorageManager() {
-		return this._authClient.getStorageManager();
-	}
+			res.json({
+				authId: resolvedAuthId,
+				challengeToken: flowResponse.challengeToken,
+				components: flowResponse.data?.meta?.components ?? [],
+				executionId: flowResponse.executionId,
+				flowStatus: flowResponse.flowStatus
+			});
+		} catch (e) {
+			__thunderid_node.logger.error(e.message);
+			res.status(500).json({ error: e.message ?? "Flow execution failed" });
+		}
+	};
 };
+var flow_default = handleFlow;
 
 //#endregion
-exports.ThunderIDExpressClient = ThunderIDExpressClient;
+exports.CookieConfig = CookieConfig_default;
+exports.SESSION_COOKIE_NAME = SESSION_COOKIE_NAME;
+exports.ThunderIDExpressClient = ThunderIDExpressClient_default;
+exports.handleFlow = flow_default;
+exports.handleSignIn = handleSignIn;
+exports.handleSignOut = handleSignOut;
+exports.protect = protect_default;
+exports.thunderID = thunderID;
 Object.keys(__thunderid_node).forEach(function (k) {
   if (k !== 'default' && !Object.prototype.hasOwnProperty.call(exports, k)) Object.defineProperty(exports, k, {
     enumerable: true,

package/dist/{__legacy__/constants/logger-config.d.ts → constants/CookieConfig.d.ts}

@@ -1,5 +1,5 @@
 /**
- * Copyright (c) 2026, WSO2 LLC. (https://www.wso2.com).
+ * Copyright (c) 2025, WSO2 LLC. (https://www.wso2.com).
  *
  * WSO2 LLC. licenses this file to you under the Apache License,
  * Version 2.0 (the "License"); you may not use this file except
@@ -15,14 +15,14 @@
  * specific language governing permissions and limitations
  * under the License.
  */
-export declare const LOGGER_CONFIG: {
-    bgGreen: string;
-    bgRed: string;
-    bgYellow: string;
-    fgBlack: string;
-    fgGreen: string;
-    fgRed: string;
-    fgYellow: string;
-    reset: string;
+/** Session cookie name used across the Express SDK. */
+export declare const SESSION_COOKIE_NAME = "THUNDERID_SESSION_ID";
+/** Default cookie configuration values. */
+declare const CookieConfig: {
+    defaultExpirySeconds: number;
+    defaultHttpOnly: boolean;
+    defaultSameSite: "lax";
+    defaultSecure: boolean;
 };
-//# sourceMappingURL=logger-config.d.ts.map
+export default CookieConfig;
+//# sourceMappingURL=CookieConfig.d.ts.map

package/dist/constants/CookieConfig.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"CookieConfig.d.ts","sourceRoot":"","sources":["../../src/constants/CookieConfig.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,uDAAuD;AACvD,eAAO,MAAM,mBAAmB,yBAAyB,CAAC;AAE1D,2CAA2C;AAC3C,QAAA,MAAM,YAAY;;;;;CAKjB,CAAC;AAEF,eAAe,YAAY,CAAC"}