@thunderid/nextjs 0.10.2 → 0.10.4

package/dist/cjs/server/proxy/thunderIDProxy.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"thunderIDProxy.cjs","names":["eqIdx: number","parts: string[]","updated: string[]","resolvedConfig: ThunderIDNextConfig","decorateConfigWithNextEnv","url: URL","hasCallbackParams: boolean","tempSessionToken: string | undefined","SessionManager","verifiedSession: SessionTokenPayload | undefined","getSessionFromRequest","expiredSession: SessionTokenPayload | undefined","rawToken: string | undefined","decoded: SessionTokenPayload","now: number","candidateSession: SessionTokenPayload | undefined","needsRefresh: boolean","REFRESH_BUFFER_SECONDS","activeSession: SessionTokenPayload | undefined","refreshCookieUpdate: {expiry: number; token: string} | undefined","handleRefreshToken","rawSessionCookie: string | undefined","sessionId: string | undefined","getSessionIdFromRequest","handlerResponse: NextResponse | void","referer: string | null","refererUrl: URL","requestUrl: URL","redirectUrl: string","NextResponse","cookieName: string","cookieName","requestHeaders: Headers","cleanResponse: NextResponse","requestHeaders","cookieOptions: ReturnType<typeof SessionManager.getSessionCookieOptions>","updatedCookieHeader: string","response: NextResponse"],"sources":["../../../../src/server/proxy/thunderIDProxy.ts"],"sourcesContent":["/**\n * Copyright (c) 2025, WSO2 LLC. (https://www.wso2.com).\n *\n * WSO2 LLC. licenses this file to you under the Apache License,\n * Version 2.0 (the \"License\"); you may not use this file except\n * in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing,\n * software distributed under the License is distributed on an\n * \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY\n * KIND, either express or implied. See the License for the\n * specific language governing permissions and limitations\n * under the License.\n */\n\nimport {NextRequest, NextResponse} from 'next/server';\nimport {REFRESH_BUFFER_SECONDS} from '../../constants/sessionConstants';\nimport {ThunderIDNextConfig} from '../../models/config';\nimport decorateConfigWithNextEnv from '../../utils/decorateConfigWithNextEnv';\nimport handleRefreshToken from '../../utils/handleRefreshToken';\nimport SessionManager, {SessionTokenPayload} from '../../utils/SessionManager';\nimport {getSessionFromRequest, getSessionIdFromRequest} from '../../utils/sessionUtils';\n\nexport type ThunderIDProxyOptions = Partial<ThunderIDNextConfig>;\n\nexport interface ThunderIDProxyContext {\n  /** Get the session payload from JWT session if available */\n  getSession: () => Promise<SessionTokenPayload | undefined>;\n  /** Get the session ID from the current request */\n  getSessionId: () => string | undefined;\n  /** Check if the current request has a valid ThunderID session */\n  isSignedIn: () => boolean;\n  /**\n   * Protect a route by redirecting unauthenticated users.\n   * Redirect URL fallback order:\n   * 1. options.redirect\n   * 2. resolvedOptions.signInUrl\n   * 3. resolvedOptions.defaultRedirect\n   * 4. referer (if from same origin)\n   * If none are available, falls back to '/'.\n   */\n  protectRoute: (routeOptions?: {redirect?: string}) => Promise<NextResponse | void>;\n}\n\ntype ThunderIDProxyHandler = (\n  thunderid: ThunderIDProxyContext,\n  req: NextRequest,\n) => Promise<NextResponse | void> | NextResponse | void;\n\n/**\n * Removes a named cookie from a raw Cookie header string.\n */\nconst removeCookieFromHeader = (cookieHeader: string, name: string): string =>\n  cookieHeader\n    .split(';')\n    .map((p: string) => p.trim())\n    .filter((p: string) => {\n      const eqIdx: number = p.indexOf('=');\n      const partName: string = eqIdx === -1 ? p : p.slice(0, eqIdx).trim();\n      return partName !== name;\n    })\n    .join('; ');\n\n/**\n * Replaces the value of a named cookie inside a raw Cookie header string.\n * If the cookie does not already appear in the header it is appended.\n */\nconst replaceCookieInHeader = (cookieHeader: string, name: string, value: string): string => {\n  const parts: string[] = cookieHeader\n    .split(';')\n    .map((p: string) => p.trim())\n    .filter(Boolean);\n\n  let found = false;\n  const updated: string[] = parts.map((part: string) => {\n    const eqIdx: number = part.indexOf('=');\n    const partName: string = eqIdx === -1 ? part : part.slice(0, eqIdx).trim();\n    if (partName === name) {\n      found = true;\n      return `${name}=${value}`;\n    }\n    return part;\n  });\n\n  if (!found) {\n    updated.push(`${name}=${value}`);\n  }\n\n  return updated.join('; ');\n};\n\n/**\n * ThunderID proxy that integrates authentication into your Next.js application.\n * Similar to Clerk's clerkMiddleware pattern.\n *\n * Proactively refreshes the access token when it is within REFRESH_BUFFER_SECONDS of\n * expiry so that Server Components always receive a fresh session. The refresh also\n * recovers expired tokens as long as a refresh token is present.\n *\n * The updated session cookie is written to:\n *   - The response  → browser stores the new cookie for subsequent requests.\n *   - The forwarded request headers → the same-request Server Component render sees\n *     the fresh token immediately without waiting for the next navigation.\n *\n * Token refresh requires baseUrl, clientId, and clientSecret. These are resolved from\n * the options argument first, then from the standard ThunderID environment variables\n * (NEXT_PUBLIC_THUNDERID_BASE_URL, NEXT_PUBLIC_THUNDERID_CLIENT_ID,\n * THUNDERID_CLIENT_SECRET). If none are available the refresh step is skipped silently.\n *\n * @param handler - Optional handler function to customize proxy behavior\n * @param options - Configuration options for the proxy\n * @returns Next.js middleware function\n *\n * @example\n * ```typescript\n * // middleware.ts - Basic usage (config read from env vars automatically)\n * import { thunderIDProxy } from '@thunderid/nextjs/server';\n *\n * export default thunderIDProxy();\n *\n * export const config = {\n *   matcher: ['/((?!_next/static|_next/image|favicon.ico).*)'],\n * };\n * ```\n *\n * @example\n * ```typescript\n * // With route protection\n * import { thunderIDProxy, createRouteMatcher } from '@thunderid/nextjs/server';\n *\n * const isProtectedRoute = createRouteMatcher(['/dashboard(.*)']);\n *\n * export default thunderIDProxy(async (thunderid, req) => {\n *   if (isProtectedRoute(req)) {\n *     await thunderid.protectRoute();\n *   }\n * });\n * ```\n */\nconst thunderIDProxy =\n  (\n    handler?: ThunderIDProxyHandler,\n    options?: ThunderIDProxyOptions | ((req: NextRequest) => ThunderIDProxyOptions),\n  ): ((request: NextRequest) => Promise<NextResponse>) =>\n  async (request: NextRequest): Promise<NextResponse> => {\n    const resolvedOptions: ThunderIDProxyOptions = typeof options === 'function' ? options(request) : options || {};\n\n    // Resolve full config from passed options + environment variable fallbacks.\n    const resolvedConfig: ThunderIDNextConfig = decorateConfigWithNextEnv(resolvedOptions as ThunderIDNextConfig);\n\n    // ── OAuth callback detection ──────────────────────────────────────────────\n    const url: URL = new URL(request.url);\n    const hasCallbackParams: boolean = url.searchParams.has('code') && url.searchParams.has('state');\n\n    let isValidOAuthCallback = false;\n    if (hasCallbackParams && !url.searchParams.has('error')) {\n      const tempSessionToken: string | undefined = request.cookies.get(\n        SessionManager.getTempSessionCookieName(),\n      )?.value;\n      if (tempSessionToken) {\n        try {\n          await SessionManager.verifyTempSession(tempSessionToken);\n          isValidOAuthCallback = true;\n        } catch {\n          isValidOAuthCallback = false;\n        }\n      }\n    }\n\n    // ── Session resolution ────────────────────────────────────────────────────\n    // Step 1: Attempt to get a fully verified (signature + expiry) session.\n    const verifiedSession: SessionTokenPayload | undefined = await getSessionFromRequest(request);\n\n    // Step 2: If no verified session exists, verify the raw cookie's signature\n    // without enforcing expiry. This allows the proxy to recover from an\n    // expired access token as long as the JWT is authentic and a refresh token\n    // is present. Skipping the signature check here would let a tampered cookie\n    // drive identity-confusion attacks since handleRefreshToken reuses `sub`,\n    // `sessionId`, and `organizationId` from the input payload when minting the\n    // new session JWT.\n    let expiredSession: SessionTokenPayload | undefined;\n    if (!verifiedSession) {\n      const rawToken: string | undefined = request.cookies.get(SessionManager.getSessionCookieName())?.value;\n      if (rawToken) {\n        try {\n          const decoded: SessionTokenPayload = await SessionManager.verifySessionTokenForRefresh(rawToken);\n          if (decoded.refreshToken) {\n            expiredSession = decoded;\n          }\n        } catch {\n          // Forged, tampered, wrong type, or malformed — ignore.\n        }\n      }\n    }\n\n    // ── Token refresh ─────────────────────────────────────────────────────────\n    const now: number = Math.floor(Date.now() / 1000);\n    const candidateSession: SessionTokenPayload | undefined = verifiedSession ?? expiredSession;\n\n    // Config is required to call the token endpoint.\n    const hasRefreshConfig = !!(resolvedConfig.baseUrl && resolvedConfig.clientId && resolvedConfig.clientSecret);\n\n    // Refresh when:\n    //   a) Token is verified but within the proactive buffer window, OR\n    //   b) Token has already expired but a refresh token is available.\n    const needsRefresh: boolean =\n      !isValidOAuthCallback &&\n      hasRefreshConfig &&\n      !!candidateSession?.refreshToken &&\n      ((!!verifiedSession && verifiedSession.exp <= now + REFRESH_BUFFER_SECONDS) || !!expiredSession);\n\n    let activeSession: SessionTokenPayload | undefined = verifiedSession;\n    let refreshCookieUpdate: {expiry: number; token: string} | undefined;\n\n    if (needsRefresh && candidateSession) {\n      try {\n        const {newSessionToken, sessionCookieExpiryTime} = await handleRefreshToken(candidateSession, {\n          baseUrl: resolvedConfig.baseUrl!,\n          clientId: resolvedConfig.clientId!,\n          clientSecret: resolvedConfig.clientSecret!,\n          sessionCookie: resolvedConfig.sessionCookie,\n        });\n        // Verify the newly minted token so activeSession reflects fresh claims.\n        activeSession = await SessionManager.verifySessionToken(newSessionToken);\n        refreshCookieUpdate = {expiry: sessionCookieExpiryTime, token: newSessionToken};\n      } catch {\n        // Refresh failed — clear the irrecoverable session.\n        activeSession = undefined;\n      }\n    }\n\n    // ── Session cleanup detection ─────────────────────────────────────────────\n    // Mark stale cookies for deletion when the session is irrecoverable. Skipped\n    // during OAuth callbacks where a session cookie may not exist yet.\n    const rawSessionCookie: string | undefined = request.cookies.get(SessionManager.getSessionCookieName())?.value;\n\n    let shouldClearCookie = false;\n\n    if (!isValidOAuthCallback && rawSessionCookie && !activeSession && !refreshCookieUpdate) {\n      // A cookie was present but all resolution paths (verify, decode, refresh)\n      // failed — the session is dead and cannot be recovered.\n      shouldClearCookie = true;\n    }\n\n    const sessionId: string | undefined = activeSession?.sessionId ?? (await getSessionIdFromRequest(request));\n    const isAuthenticated = !!activeSession;\n\n    // ── Proxy context ─────────────────────────────────────────────────────────\n    const thunderid: ThunderIDProxyContext = {\n      getSession: async (): Promise<SessionTokenPayload | undefined> => activeSession,\n      getSessionId: (): string | undefined => sessionId,\n      isSignedIn: (): boolean => isAuthenticated,\n      protectRoute: async (routeOptions?: {redirect?: string}): Promise<NextResponse | void> => {\n        // Skip during a valid OAuth callback to avoid redirecting before the\n        // callback action has had a chance to complete.\n        if (isValidOAuthCallback) {\n          return undefined;\n        }\n\n        if (!isAuthenticated) {\n          const referer: string | null = request.headers.get('referer');\n          let fallbackRedirect = '/';\n\n          if (referer) {\n            try {\n              const refererUrl: URL = new URL(referer);\n              const requestUrl: URL = new URL(request.url);\n              if (refererUrl.origin === requestUrl.origin) {\n                fallbackRedirect = refererUrl.pathname + refererUrl.search;\n              }\n            } catch {\n              // Invalid referer — ignore.\n            }\n          }\n\n          const redirectUrl: string = routeOptions?.redirect ?? resolvedConfig.signInUrl! ?? fallbackRedirect;\n\n          return NextResponse.redirect(new URL(redirectUrl, request.url));\n        }\n\n        return undefined;\n      },\n    };\n\n    // ── Handler ───────────────────────────────────────────────────────────────\n    const handlerResponse: NextResponse | void = handler ? await handler(thunderid, request) : undefined;\n\n    // ── Build final response ──────────────────────────────────────────────────\n    if (shouldClearCookie) {\n      const cookieName: string = SessionManager.getSessionCookieName();\n\n      if (handlerResponse) {\n        // Handler returned a response (e.g. a redirect from protectRoute).\n        // Attach the deletion so the browser discards the stale cookie.\n        handlerResponse.cookies.delete(cookieName);\n        return handlerResponse;\n      }\n\n      // Pass-through: strip the dead cookie from the forwarded request headers\n      // so the same-request Server Component render sees no session at all.\n      const requestHeaders: Headers = new Headers(request.headers);\n      requestHeaders.set('cookie', removeCookieFromHeader(request.headers.get('cookie') ?? '', cookieName));\n      const cleanResponse: NextResponse = NextResponse.next({request: {headers: requestHeaders}});\n      cleanResponse.cookies.delete(cookieName);\n      return cleanResponse;\n    }\n\n    if (!refreshCookieUpdate) {\n      return handlerResponse ?? NextResponse.next();\n    }\n\n    // A token refresh occurred — the new session cookie must be applied to:\n    //   1. The HTTP response so the browser stores the updated cookie.\n    //   2. The forwarded request headers so the same-request Server Component\n    //      render reads the fresh session token instead of the expired one.\n    const cookieName: string = SessionManager.getSessionCookieName();\n    const cookieOptions: ReturnType<typeof SessionManager.getSessionCookieOptions> =\n      SessionManager.getSessionCookieOptions(refreshCookieUpdate.expiry);\n\n    if (handlerResponse) {\n      // Handler returned a response (e.g. a redirect from protectRoute).\n      // Attach the refresh cookie so the browser receives it even on redirects.\n      handlerResponse.cookies.set(cookieName, refreshCookieUpdate.token, cookieOptions);\n      return handlerResponse;\n    }\n\n    // Default pass-through: update both the response cookie and the request\n    // Cookie header so the downstream Server Component render is not stale.\n    const requestHeaders: Headers = new Headers(request.headers);\n    const updatedCookieHeader: string = replaceCookieInHeader(\n      request.headers.get('cookie') ?? '',\n      cookieName,\n      refreshCookieUpdate.token,\n    );\n    requestHeaders.set('cookie', updatedCookieHeader);\n\n    const response: NextResponse = NextResponse.next({request: {headers: requestHeaders}});\n    response.cookies.set(cookieName, refreshCookieUpdate.token, cookieOptions);\n    return response;\n  };\n\nexport default thunderIDProxy;\n"],"mappings":";;;;;;;;;;;;;AAuDA,MAAM,0BAA0B,cAAsB,SACpD,aACG,MAAM,IAAI,CACV,KAAK,MAAc,EAAE,MAAM,CAAC,CAC5B,QAAQ,MAAc;CACrB,MAAMA,QAAgB,EAAE,QAAQ,IAAI;AAEpC,SADyB,UAAU,KAAK,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,MAChD;EACpB,CACD,KAAK,KAAK;;;;;AAMf,MAAM,yBAAyB,cAAsB,MAAc,UAA0B;CAC3F,MAAMC,QAAkB,aACrB,MAAM,IAAI,CACV,KAAK,MAAc,EAAE,MAAM,CAAC,CAC5B,OAAO,QAAQ;CAElB,IAAI,QAAQ;CACZ,MAAMC,UAAoB,MAAM,KAAK,SAAiB;EACpD,MAAMF,QAAgB,KAAK,QAAQ,IAAI;AAEvC,OADyB,UAAU,KAAK,OAAO,KAAK,MAAM,GAAG,MAAM,CAAC,MAAM,MACzD,MAAM;AACrB,WAAQ;AACR,UAAO,GAAG,KAAK,GAAG;;AAEpB,SAAO;GACP;AAEF,KAAI,CAAC,MACH,SAAQ,KAAK,GAAG,KAAK,GAAG,QAAQ;AAGlC,QAAO,QAAQ,KAAK,KAAK;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAmD3B,MAAM,kBAEF,SACA,YAEF,OAAO,YAAgD;CAIrD,MAAMG,iBAAsCC,0CAHG,OAAO,YAAY,aAAa,QAAQ,QAAQ,GAAG,WAAW,EAAE,CAGF;CAG7G,MAAMC,MAAW,IAAI,IAAI,QAAQ,IAAI;CACrC,MAAMC,oBAA6B,IAAI,aAAa,IAAI,OAAO,IAAI,IAAI,aAAa,IAAI,QAAQ;CAEhG,IAAI,uBAAuB;AAC3B,KAAI,qBAAqB,CAAC,IAAI,aAAa,IAAI,QAAQ,EAAE;EACvD,MAAMC,mBAAuC,QAAQ,QAAQ,IAC3DC,+BAAe,0BAA0B,CAC1C,EAAE;AACH,MAAI,iBACF,KAAI;AACF,SAAMA,+BAAe,kBAAkB,iBAAiB;AACxD,0BAAuB;UACjB;AACN,0BAAuB;;;CAO7B,MAAMC,kBAAmD,MAAMC,2CAAsB,QAAQ;CAS7F,IAAIC;AACJ,KAAI,CAAC,iBAAiB;EACpB,MAAMC,WAA+B,QAAQ,QAAQ,IAAIJ,+BAAe,sBAAsB,CAAC,EAAE;AACjG,MAAI,SACF,KAAI;GACF,MAAMK,UAA+B,MAAML,+BAAe,6BAA6B,SAAS;AAChG,OAAI,QAAQ,aACV,kBAAiB;UAEb;;CAOZ,MAAMM,MAAc,KAAK,MAAM,KAAK,KAAK,GAAG,IAAK;CACjD,MAAMC,mBAAoD,mBAAmB;CAG7E,MAAM,mBAAmB,CAAC,EAAE,eAAe,WAAW,eAAe,YAAY,eAAe;CAKhG,MAAMC,eACJ,CAAC,wBACD,oBACA,CAAC,CAAC,kBAAkB,iBAClB,CAAC,CAAC,mBAAmB,gBAAgB,OAAO,MAAMC,mDAA2B,CAAC,CAAC;CAEnF,IAAIC,gBAAiD;CACrD,IAAIC;AAEJ,KAAI,gBAAgB,iBAClB,KAAI;EACF,MAAM,EAAC,iBAAiB,4BAA2B,MAAMC,mCAAmB,kBAAkB;GAC5F,SAAS,eAAe;GACxB,UAAU,eAAe;GACzB,cAAc,eAAe;GAC7B,eAAe,eAAe;GAC/B,CAAC;AAEF,kBAAgB,MAAMZ,+BAAe,mBAAmB,gBAAgB;AACxE,wBAAsB;GAAC,QAAQ;GAAyB,OAAO;GAAgB;SACzE;AAEN,kBAAgB;;CAOpB,MAAMa,mBAAuC,QAAQ,QAAQ,IAAIb,+BAAe,sBAAsB,CAAC,EAAE;CAEzG,IAAI,oBAAoB;AAExB,KAAI,CAAC,wBAAwB,oBAAoB,CAAC,iBAAiB,CAAC,oBAGlE,qBAAoB;CAGtB,MAAMc,YAAgC,eAAe,aAAc,MAAMC,6CAAwB,QAAQ;CACzG,MAAM,kBAAkB,CAAC,CAAC;CAwC1B,MAAMC,kBAAuC,UAAU,MAAM,QArCpB;EACvC,YAAY,YAAsD;EAClE,oBAAwC;EACxC,kBAA2B;EAC3B,cAAc,OAAO,iBAAqE;AAGxF,OAAI,qBACF;AAGF,OAAI,CAAC,iBAAiB;IACpB,MAAMC,UAAyB,QAAQ,QAAQ,IAAI,UAAU;IAC7D,IAAI,mBAAmB;AAEvB,QAAI,QACF,KAAI;KACF,MAAMC,aAAkB,IAAI,IAAI,QAAQ;KACxC,MAAMC,aAAkB,IAAI,IAAI,QAAQ,IAAI;AAC5C,SAAI,WAAW,WAAW,WAAW,OACnC,oBAAmB,WAAW,WAAW,WAAW;YAEhD;IAKV,MAAMC,cAAsB,cAAc,YAAY,eAAe,aAAc;AAEnF,WAAOC,yBAAa,SAAS,IAAI,IAAI,aAAa,QAAQ,IAAI,CAAC;;;EAKpE,EAG+E,QAAQ,GAAG;AAG3F,KAAI,mBAAmB;EACrB,MAAMC,eAAqBtB,+BAAe,sBAAsB;AAEhE,MAAI,iBAAiB;AAGnB,mBAAgB,QAAQ,OAAOuB,aAAW;AAC1C,UAAO;;EAKT,MAAMC,mBAA0B,IAAI,QAAQ,QAAQ,QAAQ;AAC5D,mBAAe,IAAI,UAAU,uBAAuB,QAAQ,QAAQ,IAAI,SAAS,IAAI,IAAID,aAAW,CAAC;EACrG,MAAME,gBAA8BJ,yBAAa,KAAK,EAAC,SAAS,EAAC,SAASK,kBAAe,EAAC,CAAC;AAC3F,gBAAc,QAAQ,OAAOH,aAAW;AACxC,SAAO;;AAGT,KAAI,CAAC,oBACH,QAAO,mBAAmBF,yBAAa,MAAM;CAO/C,MAAMC,aAAqBtB,+BAAe,sBAAsB;CAChE,MAAM2B,gBACJ3B,+BAAe,wBAAwB,oBAAoB,OAAO;AAEpE,KAAI,iBAAiB;AAGnB,kBAAgB,QAAQ,IAAI,YAAY,oBAAoB,OAAO,cAAc;AACjF,SAAO;;CAKT,MAAMwB,iBAA0B,IAAI,QAAQ,QAAQ,QAAQ;CAC5D,MAAMI,sBAA8B,sBAClC,QAAQ,QAAQ,IAAI,SAAS,IAAI,IACjC,YACA,oBAAoB,MACrB;AACD,gBAAe,IAAI,UAAU,oBAAoB;CAEjD,MAAMC,WAAyBR,yBAAa,KAAK,EAAC,SAAS,EAAC,SAAS,gBAAe,EAAC,CAAC;AACtF,UAAS,QAAQ,IAAI,YAAY,oBAAoB,OAAO,cAAc;AAC1E,QAAO;;AAGX,6BAAe"}
+{"version":3,"file":"thunderIDProxy.cjs","names":["eqIdx: number","parts: string[]","updated: string[]","resolvedConfig: ThunderIDNextConfig","decorateConfigWithNextEnv","url: URL","hasCallbackParams: boolean","tempSessionToken: string | undefined","SessionManager","verifiedSession: SessionTokenPayload | undefined","getSessionFromRequest","expiredSession: SessionTokenPayload | undefined","rawToken: string | undefined","decoded: SessionTokenPayload","now: number","candidateSession: SessionTokenPayload | undefined","needsRefresh: boolean","REFRESH_BUFFER_SECONDS","activeSession: SessionTokenPayload | undefined","refreshCookieUpdate: {expiry: number; token: string} | undefined","handleRefreshToken","rawSessionCookie: string | undefined","sessionId: string | undefined","getSessionIdFromRequest","handlerResponse: NextResponse | void","referer: string | null","refererUrl: URL","requestUrl: URL","redirectUrl: string","NextResponse","cookieName: string","cookieName","requestHeaders: Headers","cleanResponse: NextResponse","requestHeaders","cookieOptions: ReturnType<typeof SessionManager.getSessionCookieOptions>","updatedCookieHeader: string","response: NextResponse"],"sources":["../../../../src/server/proxy/thunderIDProxy.ts"],"sourcesContent":["// Copyright 2025 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\nimport {NextRequest, NextResponse} from 'next/server';\nimport {REFRESH_BUFFER_SECONDS} from '../../constants/sessionConstants';\nimport {ThunderIDNextConfig} from '../../models/config';\nimport decorateConfigWithNextEnv from '../../utils/decorateConfigWithNextEnv';\nimport handleRefreshToken from '../../utils/handleRefreshToken';\nimport SessionManager, {SessionTokenPayload} from '../../utils/SessionManager';\nimport {getSessionFromRequest, getSessionIdFromRequest} from '../../utils/sessionUtils';\n\nexport type ThunderIDProxyOptions = Partial<ThunderIDNextConfig>;\n\nexport interface ThunderIDProxyContext {\n  /** Get the session payload from JWT session if available */\n  getSession: () => Promise<SessionTokenPayload | undefined>;\n  /** Get the session ID from the current request */\n  getSessionId: () => string | undefined;\n  /** Check if the current request has a valid ThunderID session */\n  isSignedIn: () => boolean;\n  /**\n   * Protect a route by redirecting unauthenticated users.\n   * Redirect URL fallback order:\n   * 1. options.redirect\n   * 2. resolvedOptions.signInUrl\n   * 3. resolvedOptions.defaultRedirect\n   * 4. referer (if from same origin)\n   * If none are available, falls back to '/'.\n   */\n  protectRoute: (routeOptions?: {redirect?: string}) => Promise<NextResponse | void>;\n}\n\ntype ThunderIDProxyHandler = (\n  thunderid: ThunderIDProxyContext,\n  req: NextRequest,\n) => Promise<NextResponse | void> | NextResponse | void;\n\n/**\n * Removes a named cookie from a raw Cookie header string.\n */\nconst removeCookieFromHeader = (cookieHeader: string, name: string): string =>\n  cookieHeader\n    .split(';')\n    .map((p: string) => p.trim())\n    .filter((p: string) => {\n      const eqIdx: number = p.indexOf('=');\n      const partName: string = eqIdx === -1 ? p : p.slice(0, eqIdx).trim();\n      return partName !== name;\n    })\n    .join('; ');\n\n/**\n * Replaces the value of a named cookie inside a raw Cookie header string.\n * If the cookie does not already appear in the header it is appended.\n */\nconst replaceCookieInHeader = (cookieHeader: string, name: string, value: string): string => {\n  const parts: string[] = cookieHeader\n    .split(';')\n    .map((p: string) => p.trim())\n    .filter(Boolean);\n\n  let found = false;\n  const updated: string[] = parts.map((part: string) => {\n    const eqIdx: number = part.indexOf('=');\n    const partName: string = eqIdx === -1 ? part : part.slice(0, eqIdx).trim();\n    if (partName === name) {\n      found = true;\n      return `${name}=${value}`;\n    }\n    return part;\n  });\n\n  if (!found) {\n    updated.push(`${name}=${value}`);\n  }\n\n  return updated.join('; ');\n};\n\n/**\n * ThunderID proxy that integrates authentication into your Next.js application.\n * Similar to Clerk's clerkMiddleware pattern.\n *\n * Proactively refreshes the access token when it is within REFRESH_BUFFER_SECONDS of\n * expiry so that Server Components always receive a fresh session. The refresh also\n * recovers expired tokens as long as a refresh token is present.\n *\n * The updated session cookie is written to:\n *   - The response  → browser stores the new cookie for subsequent requests.\n *   - The forwarded request headers → the same-request Server Component render sees\n *     the fresh token immediately without waiting for the next navigation.\n *\n * Token refresh requires baseUrl, clientId, and clientSecret. These are resolved from\n * the options argument first, then from the standard ThunderID environment variables\n * (NEXT_PUBLIC_THUNDERID_BASE_URL, NEXT_PUBLIC_THUNDERID_CLIENT_ID,\n * THUNDERID_CLIENT_SECRET). If none are available the refresh step is skipped silently.\n *\n * @param handler - Optional handler function to customize proxy behavior\n * @param options - Configuration options for the proxy\n * @returns Next.js middleware function\n *\n * @example\n * ```typescript\n * // middleware.ts - Basic usage (config read from env vars automatically)\n * import { thunderIDProxy } from '@thunderid/nextjs/server';\n *\n * export default thunderIDProxy();\n *\n * export const config = {\n *   matcher: ['/((?!_next/static|_next/image|favicon.ico).*)'],\n * };\n * ```\n *\n * @example\n * ```typescript\n * // With route protection\n * import { thunderIDProxy, createRouteMatcher } from '@thunderid/nextjs/server';\n *\n * const isProtectedRoute = createRouteMatcher(['/dashboard(.*)']);\n *\n * export default thunderIDProxy(async (thunderid, req) => {\n *   if (isProtectedRoute(req)) {\n *     await thunderid.protectRoute();\n *   }\n * });\n * ```\n */\nconst thunderIDProxy =\n  (\n    handler?: ThunderIDProxyHandler,\n    options?: ThunderIDProxyOptions | ((req: NextRequest) => ThunderIDProxyOptions),\n  ): ((request: NextRequest) => Promise<NextResponse>) =>\n  async (request: NextRequest): Promise<NextResponse> => {\n    const resolvedOptions: ThunderIDProxyOptions = typeof options === 'function' ? options(request) : options || {};\n\n    // Resolve full config from passed options + environment variable fallbacks.\n    const resolvedConfig: ThunderIDNextConfig = decorateConfigWithNextEnv(resolvedOptions as ThunderIDNextConfig);\n\n    // ── OAuth callback detection ──────────────────────────────────────────────\n    const url: URL = new URL(request.url);\n    const hasCallbackParams: boolean = url.searchParams.has('code') && url.searchParams.has('state');\n\n    let isValidOAuthCallback = false;\n    if (hasCallbackParams && !url.searchParams.has('error')) {\n      const tempSessionToken: string | undefined = request.cookies.get(\n        SessionManager.getTempSessionCookieName(),\n      )?.value;\n      if (tempSessionToken) {\n        try {\n          await SessionManager.verifyTempSession(tempSessionToken);\n          isValidOAuthCallback = true;\n        } catch {\n          isValidOAuthCallback = false;\n        }\n      }\n    }\n\n    // ── Session resolution ────────────────────────────────────────────────────\n    // Step 1: Attempt to get a fully verified (signature + expiry) session.\n    const verifiedSession: SessionTokenPayload | undefined = await getSessionFromRequest(request);\n\n    // Step 2: If no verified session exists, verify the raw cookie's signature\n    // without enforcing expiry. This allows the proxy to recover from an\n    // expired access token as long as the JWT is authentic and a refresh token\n    // is present. Skipping the signature check here would let a tampered cookie\n    // drive identity-confusion attacks since handleRefreshToken reuses `sub`,\n    // `sessionId`, and `organizationId` from the input payload when minting the\n    // new session JWT.\n    let expiredSession: SessionTokenPayload | undefined;\n    if (!verifiedSession) {\n      const rawToken: string | undefined = request.cookies.get(SessionManager.getSessionCookieName())?.value;\n      if (rawToken) {\n        try {\n          const decoded: SessionTokenPayload = await SessionManager.verifySessionTokenForRefresh(rawToken);\n          if (decoded.refreshToken) {\n            expiredSession = decoded;\n          }\n        } catch {\n          // Forged, tampered, wrong type, or malformed — ignore.\n        }\n      }\n    }\n\n    // ── Token refresh ─────────────────────────────────────────────────────────\n    const now: number = Math.floor(Date.now() / 1000);\n    const candidateSession: SessionTokenPayload | undefined = verifiedSession ?? expiredSession;\n\n    // Config is required to call the token endpoint.\n    const hasRefreshConfig = !!(resolvedConfig.baseUrl && resolvedConfig.clientId && resolvedConfig.clientSecret);\n\n    // Refresh when:\n    //   a) Token is verified but within the proactive buffer window, OR\n    //   b) Token has already expired but a refresh token is available.\n    const needsRefresh: boolean =\n      !isValidOAuthCallback &&\n      hasRefreshConfig &&\n      !!candidateSession?.refreshToken &&\n      ((!!verifiedSession && verifiedSession.exp <= now + REFRESH_BUFFER_SECONDS) || !!expiredSession);\n\n    let activeSession: SessionTokenPayload | undefined = verifiedSession;\n    let refreshCookieUpdate: {expiry: number; token: string} | undefined;\n\n    if (needsRefresh && candidateSession) {\n      try {\n        const {newSessionToken, sessionCookieExpiryTime} = await handleRefreshToken(candidateSession, {\n          baseUrl: resolvedConfig.baseUrl!,\n          clientId: resolvedConfig.clientId!,\n          clientSecret: resolvedConfig.clientSecret!,\n          sessionCookie: resolvedConfig.sessionCookie,\n        });\n        // Verify the newly minted token so activeSession reflects fresh claims.\n        activeSession = await SessionManager.verifySessionToken(newSessionToken);\n        refreshCookieUpdate = {expiry: sessionCookieExpiryTime, token: newSessionToken};\n      } catch {\n        // Refresh failed — clear the irrecoverable session.\n        activeSession = undefined;\n      }\n    }\n\n    // ── Session cleanup detection ─────────────────────────────────────────────\n    // Mark stale cookies for deletion when the session is irrecoverable. Skipped\n    // during OAuth callbacks where a session cookie may not exist yet.\n    const rawSessionCookie: string | undefined = request.cookies.get(SessionManager.getSessionCookieName())?.value;\n\n    let shouldClearCookie = false;\n\n    if (!isValidOAuthCallback && rawSessionCookie && !activeSession && !refreshCookieUpdate) {\n      // A cookie was present but all resolution paths (verify, decode, refresh)\n      // failed — the session is dead and cannot be recovered.\n      shouldClearCookie = true;\n    }\n\n    const sessionId: string | undefined = activeSession?.sessionId ?? (await getSessionIdFromRequest(request));\n    const isAuthenticated = !!activeSession;\n\n    // ── Proxy context ─────────────────────────────────────────────────────────\n    const thunderid: ThunderIDProxyContext = {\n      getSession: async (): Promise<SessionTokenPayload | undefined> => activeSession,\n      getSessionId: (): string | undefined => sessionId,\n      isSignedIn: (): boolean => isAuthenticated,\n      protectRoute: async (routeOptions?: {redirect?: string}): Promise<NextResponse | void> => {\n        // Skip during a valid OAuth callback to avoid redirecting before the\n        // callback action has had a chance to complete.\n        if (isValidOAuthCallback) {\n          return undefined;\n        }\n\n        if (!isAuthenticated) {\n          const referer: string | null = request.headers.get('referer');\n          let fallbackRedirect = '/';\n\n          if (referer) {\n            try {\n              const refererUrl: URL = new URL(referer);\n              const requestUrl: URL = new URL(request.url);\n              if (refererUrl.origin === requestUrl.origin) {\n                fallbackRedirect = refererUrl.pathname + refererUrl.search;\n              }\n            } catch {\n              // Invalid referer — ignore.\n            }\n          }\n\n          const redirectUrl: string = routeOptions?.redirect ?? resolvedConfig.signInUrl! ?? fallbackRedirect;\n\n          return NextResponse.redirect(new URL(redirectUrl, request.url));\n        }\n\n        return undefined;\n      },\n    };\n\n    // ── Handler ───────────────────────────────────────────────────────────────\n    const handlerResponse: NextResponse | void = handler ? await handler(thunderid, request) : undefined;\n\n    // ── Build final response ──────────────────────────────────────────────────\n    if (shouldClearCookie) {\n      const cookieName: string = SessionManager.getSessionCookieName();\n\n      if (handlerResponse) {\n        // Handler returned a response (e.g. a redirect from protectRoute).\n        // Attach the deletion so the browser discards the stale cookie.\n        handlerResponse.cookies.delete(cookieName);\n        return handlerResponse;\n      }\n\n      // Pass-through: strip the dead cookie from the forwarded request headers\n      // so the same-request Server Component render sees no session at all.\n      const requestHeaders: Headers = new Headers(request.headers);\n      requestHeaders.set('cookie', removeCookieFromHeader(request.headers.get('cookie') ?? '', cookieName));\n      const cleanResponse: NextResponse = NextResponse.next({request: {headers: requestHeaders}});\n      cleanResponse.cookies.delete(cookieName);\n      return cleanResponse;\n    }\n\n    if (!refreshCookieUpdate) {\n      return handlerResponse ?? NextResponse.next();\n    }\n\n    // A token refresh occurred — the new session cookie must be applied to:\n    //   1. The HTTP response so the browser stores the updated cookie.\n    //   2. The forwarded request headers so the same-request Server Component\n    //      render reads the fresh session token instead of the expired one.\n    const cookieName: string = SessionManager.getSessionCookieName();\n    const cookieOptions: ReturnType<typeof SessionManager.getSessionCookieOptions> =\n      SessionManager.getSessionCookieOptions(refreshCookieUpdate.expiry);\n\n    if (handlerResponse) {\n      // Handler returned a response (e.g. a redirect from protectRoute).\n      // Attach the refresh cookie so the browser receives it even on redirects.\n      handlerResponse.cookies.set(cookieName, refreshCookieUpdate.token, cookieOptions);\n      return handlerResponse;\n    }\n\n    // Default pass-through: update both the response cookie and the request\n    // Cookie header so the downstream Server Component render is not stale.\n    const requestHeaders: Headers = new Headers(request.headers);\n    const updatedCookieHeader: string = replaceCookieInHeader(\n      request.headers.get('cookie') ?? '',\n      cookieName,\n      refreshCookieUpdate.token,\n    );\n    requestHeaders.set('cookie', updatedCookieHeader);\n\n    const response: NextResponse = NextResponse.next({request: {headers: requestHeaders}});\n    response.cookies.set(cookieName, refreshCookieUpdate.token, cookieOptions);\n    return response;\n  };\n\nexport default thunderIDProxy;\n"],"mappings":";;;;;;;;;;;;;AAwCA,MAAM,0BAA0B,cAAsB,SACpD,aACG,MAAM,IAAI,CACV,KAAK,MAAc,EAAE,MAAM,CAAC,CAC5B,QAAQ,MAAc;CACrB,MAAMA,QAAgB,EAAE,QAAQ,IAAI;AAEpC,SADyB,UAAU,KAAK,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,MAChD;EACpB,CACD,KAAK,KAAK;;;;;AAMf,MAAM,yBAAyB,cAAsB,MAAc,UAA0B;CAC3F,MAAMC,QAAkB,aACrB,MAAM,IAAI,CACV,KAAK,MAAc,EAAE,MAAM,CAAC,CAC5B,OAAO,QAAQ;CAElB,IAAI,QAAQ;CACZ,MAAMC,UAAoB,MAAM,KAAK,SAAiB;EACpD,MAAMF,QAAgB,KAAK,QAAQ,IAAI;AAEvC,OADyB,UAAU,KAAK,OAAO,KAAK,MAAM,GAAG,MAAM,CAAC,MAAM,MACzD,MAAM;AACrB,WAAQ;AACR,UAAO,GAAG,KAAK,GAAG;;AAEpB,SAAO;GACP;AAEF,KAAI,CAAC,MACH,SAAQ,KAAK,GAAG,KAAK,GAAG,QAAQ;AAGlC,QAAO,QAAQ,KAAK,KAAK;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAmD3B,MAAM,kBAEF,SACA,YAEF,OAAO,YAAgD;CAIrD,MAAMG,iBAAsCC,0CAHG,OAAO,YAAY,aAAa,QAAQ,QAAQ,GAAG,WAAW,EAAE,CAGF;CAG7G,MAAMC,MAAW,IAAI,IAAI,QAAQ,IAAI;CACrC,MAAMC,oBAA6B,IAAI,aAAa,IAAI,OAAO,IAAI,IAAI,aAAa,IAAI,QAAQ;CAEhG,IAAI,uBAAuB;AAC3B,KAAI,qBAAqB,CAAC,IAAI,aAAa,IAAI,QAAQ,EAAE;EACvD,MAAMC,mBAAuC,QAAQ,QAAQ,IAC3DC,+BAAe,0BAA0B,CAC1C,EAAE;AACH,MAAI,iBACF,KAAI;AACF,SAAMA,+BAAe,kBAAkB,iBAAiB;AACxD,0BAAuB;UACjB;AACN,0BAAuB;;;CAO7B,MAAMC,kBAAmD,MAAMC,2CAAsB,QAAQ;CAS7F,IAAIC;AACJ,KAAI,CAAC,iBAAiB;EACpB,MAAMC,WAA+B,QAAQ,QAAQ,IAAIJ,+BAAe,sBAAsB,CAAC,EAAE;AACjG,MAAI,SACF,KAAI;GACF,MAAMK,UAA+B,MAAML,+BAAe,6BAA6B,SAAS;AAChG,OAAI,QAAQ,aACV,kBAAiB;UAEb;;CAOZ,MAAMM,MAAc,KAAK,MAAM,KAAK,KAAK,GAAG,IAAK;CACjD,MAAMC,mBAAoD,mBAAmB;CAG7E,MAAM,mBAAmB,CAAC,EAAE,eAAe,WAAW,eAAe,YAAY,eAAe;CAKhG,MAAMC,eACJ,CAAC,wBACD,oBACA,CAAC,CAAC,kBAAkB,iBAClB,CAAC,CAAC,mBAAmB,gBAAgB,OAAO,MAAMC,mDAA2B,CAAC,CAAC;CAEnF,IAAIC,gBAAiD;CACrD,IAAIC;AAEJ,KAAI,gBAAgB,iBAClB,KAAI;EACF,MAAM,EAAC,iBAAiB,4BAA2B,MAAMC,mCAAmB,kBAAkB;GAC5F,SAAS,eAAe;GACxB,UAAU,eAAe;GACzB,cAAc,eAAe;GAC7B,eAAe,eAAe;GAC/B,CAAC;AAEF,kBAAgB,MAAMZ,+BAAe,mBAAmB,gBAAgB;AACxE,wBAAsB;GAAC,QAAQ;GAAyB,OAAO;GAAgB;SACzE;AAEN,kBAAgB;;CAOpB,MAAMa,mBAAuC,QAAQ,QAAQ,IAAIb,+BAAe,sBAAsB,CAAC,EAAE;CAEzG,IAAI,oBAAoB;AAExB,KAAI,CAAC,wBAAwB,oBAAoB,CAAC,iBAAiB,CAAC,oBAGlE,qBAAoB;CAGtB,MAAMc,YAAgC,eAAe,aAAc,MAAMC,6CAAwB,QAAQ;CACzG,MAAM,kBAAkB,CAAC,CAAC;CAwC1B,MAAMC,kBAAuC,UAAU,MAAM,QArCpB;EACvC,YAAY,YAAsD;EAClE,oBAAwC;EACxC,kBAA2B;EAC3B,cAAc,OAAO,iBAAqE;AAGxF,OAAI,qBACF;AAGF,OAAI,CAAC,iBAAiB;IACpB,MAAMC,UAAyB,QAAQ,QAAQ,IAAI,UAAU;IAC7D,IAAI,mBAAmB;AAEvB,QAAI,QACF,KAAI;KACF,MAAMC,aAAkB,IAAI,IAAI,QAAQ;KACxC,MAAMC,aAAkB,IAAI,IAAI,QAAQ,IAAI;AAC5C,SAAI,WAAW,WAAW,WAAW,OACnC,oBAAmB,WAAW,WAAW,WAAW;YAEhD;IAKV,MAAMC,cAAsB,cAAc,YAAY,eAAe,aAAc;AAEnF,WAAOC,yBAAa,SAAS,IAAI,IAAI,aAAa,QAAQ,IAAI,CAAC;;;EAKpE,EAG+E,QAAQ,GAAG;AAG3F,KAAI,mBAAmB;EACrB,MAAMC,eAAqBtB,+BAAe,sBAAsB;AAEhE,MAAI,iBAAiB;AAGnB,mBAAgB,QAAQ,OAAOuB,aAAW;AAC1C,UAAO;;EAKT,MAAMC,mBAA0B,IAAI,QAAQ,QAAQ,QAAQ;AAC5D,mBAAe,IAAI,UAAU,uBAAuB,QAAQ,QAAQ,IAAI,SAAS,IAAI,IAAID,aAAW,CAAC;EACrG,MAAME,gBAA8BJ,yBAAa,KAAK,EAAC,SAAS,EAAC,SAASK,kBAAe,EAAC,CAAC;AAC3F,gBAAc,QAAQ,OAAOH,aAAW;AACxC,SAAO;;AAGT,KAAI,CAAC,oBACH,QAAO,mBAAmBF,yBAAa,MAAM;CAO/C,MAAMC,aAAqBtB,+BAAe,sBAAsB;CAChE,MAAM2B,gBACJ3B,+BAAe,wBAAwB,oBAAoB,OAAO;AAEpE,KAAI,iBAAiB;AAGnB,kBAAgB,QAAQ,IAAI,YAAY,oBAAoB,OAAO,cAAc;AACjF,SAAO;;CAKT,MAAMwB,iBAA0B,IAAI,QAAQ,QAAQ,QAAQ;CAC5D,MAAMI,sBAA8B,sBAClC,QAAQ,QAAQ,IAAI,SAAS,IAAI,IACjC,YACA,oBAAoB,MACrB;AACD,gBAAe,IAAI,UAAU,oBAAoB;CAEjD,MAAMC,WAAyBR,yBAAa,KAAK,EAAC,SAAS,EAAC,SAAS,gBAAe,EAAC,CAAC;AACtF,UAAS,QAAQ,IAAI,YAAY,oBAAoB,OAAO,cAAc;AAC1E,QAAO;;AAGX,6BAAe"}

package/dist/cjs/server/thunderid.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"thunderid.cjs","names":["getClient","getSessionIdAction"],"sources":["../../../src/server/thunderid.ts"],"sourcesContent":["/**\n * Copyright (c) 2025, WSO2 LLC. (https://www.wso2.com).\n *\n * WSO2 LLC. licenses this file to you under the Apache License,\n * Version 2.0 (the \"License\"); you may not use this file except\n * in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing,\n * software distributed under the License is distributed on an\n * \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY\n * KIND, either express or implied. See the License for the\n * specific language governing permissions and limitations\n * under the License.\n */\n\nimport {TokenExchangeRequestConfig, TokenResponse} from '@thunderid/node';\nimport getSessionIdAction from './actions/getSessionId';\nimport getClient from './getClient';\nimport {ThunderIDNextConfig} from '../models/config';\n\nconst thunderid = async (): Promise<{\n  exchangeToken: (config: TokenExchangeRequestConfig, sessionId: string) => Promise<TokenResponse | Response>;\n  getAccessToken: (sessionId: string) => Promise<string>;\n  getSessionId: () => Promise<string | undefined>;\n  reInitialize: (config: Partial<ThunderIDNextConfig>) => Promise<boolean>;\n}> => {\n  const getAccessToken = async (sessionId: string): Promise<string> => {\n    const client = getClient();\n    return client.getAccessToken(sessionId);\n  };\n\n  const getSessionId = async (): Promise<string | undefined> => getSessionIdAction();\n\n  const exchangeToken = async (\n    config: TokenExchangeRequestConfig,\n    sessionId: string,\n  ): Promise<TokenResponse | Response> => {\n    const client = getClient();\n    return client.exchangeToken(config, sessionId);\n  };\n\n  const reInitialize = async (config: Partial<ThunderIDNextConfig>): Promise<boolean> => {\n    const client = getClient();\n    return client.reInitialize(config);\n  };\n\n  return {\n    exchangeToken,\n    getAccessToken,\n    getSessionId,\n    reInitialize,\n  };\n};\n\nexport default thunderid;\n"],"mappings":";;;;AAuBA,MAAM,YAAY,YAKZ;CACJ,MAAM,iBAAiB,OAAO,cAAuC;AAEnE,SADeA,2BAAW,CACZ,eAAe,UAAU;;CAGzC,MAAM,eAAe,YAAyCC,8BAAoB;CAElF,MAAM,gBAAgB,OACpB,QACA,cACsC;AAEtC,SADeD,2BAAW,CACZ,cAAc,QAAQ,UAAU;;CAGhD,MAAM,eAAe,OAAO,WAA2D;AAErF,SADeA,2BAAW,CACZ,aAAa,OAAO;;AAGpC,QAAO;EACL;EACA;EACA;EACA;EACD;;AAGH,wBAAe"}
+{"version":3,"file":"thunderid.cjs","names":["getClient","getSessionIdAction"],"sources":["../../../src/server/thunderid.ts"],"sourcesContent":["// Copyright 2025 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\nimport {TokenExchangeRequestConfig, TokenResponse} from '@thunderid/node';\nimport getSessionIdAction from './actions/getSessionId';\nimport getClient from './getClient';\nimport {ThunderIDNextConfig} from '../models/config';\n\nconst thunderid = async (): Promise<{\n  exchangeToken: (config: TokenExchangeRequestConfig, sessionId: string) => Promise<TokenResponse | Response>;\n  getAccessToken: (sessionId: string) => Promise<string>;\n  getSessionId: () => Promise<string | undefined>;\n  reInitialize: (config: Partial<ThunderIDNextConfig>) => Promise<boolean>;\n}> => {\n  const getAccessToken = async (sessionId: string): Promise<string> => {\n    const client = getClient();\n    return client.getAccessToken(sessionId);\n  };\n\n  const getSessionId = async (): Promise<string | undefined> => getSessionIdAction();\n\n  const exchangeToken = async (\n    config: TokenExchangeRequestConfig,\n    sessionId: string,\n  ): Promise<TokenResponse | Response> => {\n    const client = getClient();\n    return client.exchangeToken(config, sessionId);\n  };\n\n  const reInitialize = async (config: Partial<ThunderIDNextConfig>): Promise<boolean> => {\n    const client = getClient();\n    return client.reInitialize(config);\n  };\n\n  return {\n    exchangeToken,\n    getAccessToken,\n    getSessionId,\n    reInitialize,\n  };\n};\n\nexport default thunderid;\n"],"mappings":";;;;AAQA,MAAM,YAAY,YAKZ;CACJ,MAAM,iBAAiB,OAAO,cAAuC;AAEnE,SADeA,2BAAW,CACZ,eAAe,UAAU;;CAGzC,MAAM,eAAe,YAAyCC,8BAAoB;CAElF,MAAM,gBAAgB,OACpB,QACA,cACsC;AAEtC,SADeD,2BAAW,CACZ,cAAc,QAAQ,UAAU;;CAGhD,MAAM,eAAe,OAAO,WAA2D;AAErF,SADeA,2BAAW,CACZ,aAAa,OAAO;;AAGpC,QAAO;EACL;EACA;EACA;EACA;EACD;;AAGH,wBAAe"}

package/dist/cjs/utils/SessionManager.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"SessionManager.cjs","names":["secret: string | undefined","ThunderIDRuntimeError","secret: Uint8Array","SignJWT","envValue: string | undefined","parsed: number","DEFAULT_SESSION_COOKIE_EXPIRY_TIME","payload: SessionTokenPayload","CookieConfig"],"sources":["../../../src/utils/SessionManager.ts"],"sourcesContent":["/**\n * Copyright (c) 2025, WSO2 LLC. (https://www.wso2.com).\n *\n * WSO2 LLC. licenses this file to you under the Apache License,\n * Version 2.0 (the \"License\"); you may not use this file except\n * in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing,\n * software distributed under the License is distributed on an\n * \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY\n * KIND, either express or implied. See the License for the\n * specific language governing permissions and limitations\n * under the License.\n */\n\nimport {ThunderIDRuntimeError, CookieConfig} from '@thunderid/node';\nimport {SignJWT, jwtVerify, compactVerify, JWTPayload} from 'jose';\nimport {DEFAULT_SESSION_COOKIE_EXPIRY_TIME} from '../constants/sessionConstants';\n\n/**\n * Session token payload interface\n */\nexport interface SessionTokenPayload extends JWTPayload {\n  /** Expiration timestamp — doubles as the access token expiry (JWT exp == access token exp) */\n  exp: number;\n  /** Issued at timestamp */\n  iat: number;\n  /** Organization ID if applicable */\n  organizationId?: string;\n  /** The refresh token; empty string if not provided by the auth server */\n  refreshToken: string;\n  /** OAuth scopes */\n  scopes: string[];\n  /** Session ID */\n  sessionId: string;\n  /** User ID */\n  sub: string;\n  /** Token type discriminant — must be 'session' for access-session JWTs */\n  type: 'session';\n}\n\n/**\n * Session management utility class for JWT-based session cookies\n */\nclass SessionManager {\n  /**\n   * Get the signing secret from environment variable\n   * Throws error in production if not set\n   */\n  private static getSecret(): Uint8Array {\n    const secret: string | undefined = process.env['THUNDERID_SECRET'];\n\n    if (!secret) {\n      if (process.env['NODE_ENV'] === 'production') {\n        throw new ThunderIDRuntimeError(\n          'THUNDERID_SECRET environment variable is required in production',\n          'session-secret-required',\n          'nextjs',\n          'Set the THUNDERID_SECRET environment variable with a secure random string',\n        );\n      }\n      // Use a default secret for development (not secure)\n      // eslint-disable-next-line no-console\n      console.warn('Using default secret for development. Set THUNDERID_SECRET for production!');\n      return new TextEncoder().encode('development-secret-not-for-production');\n    }\n\n    return new TextEncoder().encode(secret);\n  }\n\n  /**\n   * Create a temporary session cookie for login initiation\n   */\n  static async createTempSession(sessionId: string): Promise<string> {\n    const secret: Uint8Array = this.getSecret();\n\n    const jwt: string = await new SignJWT({\n      sessionId,\n      type: 'temp',\n    })\n      .setProtectedHeader({alg: 'HS256'})\n      .setIssuedAt()\n      .setExpirationTime('15m')\n      .sign(secret);\n\n    return jwt;\n  }\n\n  /**\n   * Resolve the session cookie expiry time in seconds.\n   *\n   * Resolution order (first defined value wins):\n   *   1. `configuredExpiry` — value from `ThunderIDNodeConfig.sessionCookie?.expiryTime`\n   *   2. `THUNDERID_SESSION_COOKIE_EXPIRY_TIME` environment variable\n   *   3. `DEFAULT_SESSION_COOKIE_EXPIRY_TIME` (24 hours)\n   */\n  static resolveSessionCookieExpiry(configuredExpiry?: number): number {\n    if (configuredExpiry != null && configuredExpiry > 0) {\n      return configuredExpiry;\n    }\n\n    const envValue: string | undefined = process.env['THUNDERID_SESSION_COOKIE_EXPIRY_TIME'];\n\n    if (envValue) {\n      const parsed: number = parseInt(envValue, 10);\n\n      if (!Number.isNaN(parsed) && parsed > 0) {\n        return parsed;\n      }\n    }\n\n    return DEFAULT_SESSION_COOKIE_EXPIRY_TIME;\n  }\n\n  static async createSessionToken(\n    accessToken: string,\n    userId: string,\n    sessionId: string,\n    scopes: string,\n    accessTokenTtlSeconds: number,\n    refreshToken: string,\n    organizationId?: string,\n  ): Promise<string> {\n    const secret: Uint8Array = this.getSecret();\n\n    const jwt: string = await new SignJWT({\n      accessToken,\n      organizationId,\n      refreshToken,\n      scopes,\n      sessionId,\n      type: 'session',\n    } as Omit<SessionTokenPayload, 'sub' | 'iat' | 'exp'>)\n      .setProtectedHeader({alg: 'HS256'})\n      .setSubject(userId)\n      .setIssuedAt()\n      .setExpirationTime(Math.floor(Date.now() / 1000) + accessTokenTtlSeconds)\n      .sign(secret);\n\n    return jwt;\n  }\n\n  /**\n   * Verify and decode a session token\n   */\n  static async verifySessionToken(token: string): Promise<SessionTokenPayload> {\n    try {\n      const secret: Uint8Array = this.getSecret();\n      const {payload} = await jwtVerify(token, secret);\n\n      if (payload['type'] !== 'session') {\n        throw new Error('Invalid token type');\n      }\n\n      return payload as SessionTokenPayload;\n    } catch (error) {\n      throw new ThunderIDRuntimeError(\n        `Invalid session token: ${error instanceof Error ? error.message : 'Unknown error'}`,\n        'invalid-session-token',\n        'nextjs',\n        'Session token verification failed',\n      );\n    }\n  }\n\n  /**\n   * Verify a session token for refresh. Validates the HMAC signature and the\n   * `type === 'session'` discriminant but intentionally skips the `exp` check\n   * so an expired access token can still be exchanged for a new one.\n   *\n   * Session lifetime is still bounded — the cookie's `maxAge` is set from\n   * `sessionCookieExpiryTime`, so the browser drops an over-age session regardless\n   * of the access-token exp embedded in the JWT.\n   *\n   * Never use the returned payload for authorization.\n   */\n  static async verifySessionTokenForRefresh(token: string): Promise<SessionTokenPayload> {\n    try {\n      const secret: Uint8Array = this.getSecret();\n      const {payload: rawPayload} = await compactVerify(token, secret);\n      const payload: SessionTokenPayload = JSON.parse(new TextDecoder().decode(rawPayload)) as SessionTokenPayload;\n\n      if (payload.type !== 'session') {\n        throw new Error('Invalid token type');\n      }\n\n      return payload;\n    } catch (error) {\n      throw new ThunderIDRuntimeError(\n        `Invalid session token: ${error instanceof Error ? error.message : 'Unknown error'}`,\n        'invalid-session-token-for-refresh',\n        'nextjs',\n        'Session token signature or type check failed during refresh',\n      );\n    }\n  }\n\n  /**\n   * Verify and decode a temporary session token\n   */\n  static async verifyTempSession(token: string): Promise<{sessionId: string}> {\n    try {\n      const secret: Uint8Array = this.getSecret();\n      const {payload} = await jwtVerify(token, secret);\n\n      if (payload['type'] !== 'temp') {\n        throw new Error('Invalid token type');\n      }\n\n      return {sessionId: payload['sessionId'] as string};\n    } catch (error) {\n      throw new ThunderIDRuntimeError(\n        `Invalid temporary session token: ${error instanceof Error ? error.message : 'Unknown error'}`,\n        'invalid-temp-session-token',\n        'nextjs',\n        'Temporary session token verification failed',\n      );\n    }\n  }\n\n  /**\n   * Get session cookie options\n   */\n  static getSessionCookieOptions(maxAge: number): {\n    httpOnly: boolean;\n    maxAge: number;\n    path: string;\n    sameSite: 'lax';\n    secure: boolean;\n  } {\n    return {\n      httpOnly: true,\n      maxAge,\n      path: '/',\n      sameSite: 'lax' as const,\n      secure: process.env['NODE_ENV'] === 'production',\n    };\n  }\n\n  /**\n   * Get temporary session cookie options\n   */\n  static getTempSessionCookieOptions(): {\n    httpOnly: boolean;\n    maxAge: number;\n    path: string;\n    sameSite: 'lax';\n    secure: boolean;\n  } {\n    return {\n      httpOnly: true,\n      maxAge: 15 * 60,\n      path: '/',\n      sameSite: 'lax' as const,\n      secure: process.env['NODE_ENV'] === 'production',\n    };\n  }\n\n  /**\n   * Get session cookie name\n   */\n  static getSessionCookieName(): string {\n    return CookieConfig.getSessionCookieName();\n  }\n\n  /**\n   * Get temporary session cookie name\n   */\n  static getTempSessionCookieName(): string {\n    return CookieConfig.getTempSessionCookieName();\n  }\n}\n\nexport default SessionManager;\n"],"mappings":";;;;;;;;;;;AA+CA,IAAM,iBAAN,MAAqB;;;;;CAKnB,OAAe,YAAwB;EACrC,MAAMA,SAA6B,QAAQ,IAAI;AAE/C,MAAI,CAAC,QAAQ;AACX,OAAI,QAAQ,IAAI,gBAAgB,aAC9B,OAAM,IAAIC,uCACR,mEACA,2BACA,UACA,4EACD;AAIH,WAAQ,KAAK,6EAA6E;AAC1F,UAAO,IAAI,aAAa,CAAC,OAAO,wCAAwC;;AAG1E,SAAO,IAAI,aAAa,CAAC,OAAO,OAAO;;;;;CAMzC,aAAa,kBAAkB,WAAoC;EACjE,MAAMC,SAAqB,KAAK,WAAW;AAW3C,SAToB,MAAM,IAAIC,aAAQ;GACpC;GACA,MAAM;GACP,CAAC,CACC,mBAAmB,EAAC,KAAK,SAAQ,CAAC,CAClC,aAAa,CACb,kBAAkB,MAAM,CACxB,KAAK,OAAO;;;;;;;;;;CAajB,OAAO,2BAA2B,kBAAmC;AACnE,MAAI,oBAAoB,QAAQ,mBAAmB,EACjD,QAAO;EAGT,MAAMC,WAA+B,QAAQ,IAAI;AAEjD,MAAI,UAAU;GACZ,MAAMC,SAAiB,SAAS,UAAU,GAAG;AAE7C,OAAI,CAAC,OAAO,MAAM,OAAO,IAAI,SAAS,EACpC,QAAO;;AAIX,SAAOC;;CAGT,aAAa,mBACX,aACA,QACA,WACA,QACA,uBACA,cACA,gBACiB;EACjB,MAAMJ,SAAqB,KAAK,WAAW;AAgB3C,SAdoB,MAAM,IAAIC,aAAQ;GACpC;GACA;GACA;GACA;GACA;GACA,MAAM;GACP,CAAqD,CACnD,mBAAmB,EAAC,KAAK,SAAQ,CAAC,CAClC,WAAW,OAAO,CAClB,aAAa,CACb,kBAAkB,KAAK,MAAM,KAAK,KAAK,GAAG,IAAK,GAAG,sBAAsB,CACxE,KAAK,OAAO;;;;;CAQjB,aAAa,mBAAmB,OAA6C;AAC3E,MAAI;GAEF,MAAM,EAAC,YAAW,0BAAgB,OADP,KAAK,WAAW,CACK;AAEhD,OAAI,QAAQ,YAAY,UACtB,OAAM,IAAI,MAAM,qBAAqB;AAGvC,UAAO;WACA,OAAO;AACd,SAAM,IAAIF,uCACR,0BAA0B,iBAAiB,QAAQ,MAAM,UAAU,mBACnE,yBACA,UACA,oCACD;;;;;;;;;;;;;;CAeL,aAAa,6BAA6B,OAA6C;AACrF,MAAI;GAEF,MAAM,EAAC,SAAS,eAAc,8BAAoB,OADvB,KAAK,WAAW,CACqB;GAChE,MAAMM,UAA+B,KAAK,MAAM,IAAI,aAAa,CAAC,OAAO,WAAW,CAAC;AAErF,OAAI,QAAQ,SAAS,UACnB,OAAM,IAAI,MAAM,qBAAqB;AAGvC,UAAO;WACA,OAAO;AACd,SAAM,IAAIN,uCACR,0BAA0B,iBAAiB,QAAQ,MAAM,UAAU,mBACnE,qCACA,UACA,8DACD;;;;;;CAOL,aAAa,kBAAkB,OAA6C;AAC1E,MAAI;GAEF,MAAM,EAAC,YAAW,0BAAgB,OADP,KAAK,WAAW,CACK;AAEhD,OAAI,QAAQ,YAAY,OACtB,OAAM,IAAI,MAAM,qBAAqB;AAGvC,UAAO,EAAC,WAAW,QAAQ,cAAuB;WAC3C,OAAO;AACd,SAAM,IAAIA,uCACR,oCAAoC,iBAAiB,QAAQ,MAAM,UAAU,mBAC7E,8BACA,UACA,8CACD;;;;;;CAOL,OAAO,wBAAwB,QAM7B;AACA,SAAO;GACL,UAAU;GACV;GACA,MAAM;GACN,UAAU;GACV,QAAQ,QAAQ,IAAI,gBAAgB;GACrC;;;;;CAMH,OAAO,8BAML;AACA,SAAO;GACL,UAAU;GACV,QAAQ;GACR,MAAM;GACN,UAAU;GACV,QAAQ,QAAQ,IAAI,gBAAgB;GACrC;;;;;CAMH,OAAO,uBAA+B;AACpC,SAAOO,8BAAa,sBAAsB;;;;;CAM5C,OAAO,2BAAmC;AACxC,SAAOA,8BAAa,0BAA0B;;;AAIlD,6BAAe"}
+{"version":3,"file":"SessionManager.cjs","names":["secret: string | undefined","ThunderIDRuntimeError","secret: Uint8Array","SignJWT","envValue: string | undefined","parsed: number","DEFAULT_SESSION_COOKIE_EXPIRY_TIME","payload: SessionTokenPayload","CookieConfig"],"sources":["../../../src/utils/SessionManager.ts"],"sourcesContent":["// Copyright 2025 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\nimport {ThunderIDRuntimeError, CookieConfig} from '@thunderid/node';\nimport {SignJWT, jwtVerify, compactVerify, JWTPayload} from 'jose';\nimport {DEFAULT_SESSION_COOKIE_EXPIRY_TIME} from '../constants/sessionConstants';\n\n/**\n * Session token payload interface\n */\nexport interface SessionTokenPayload extends JWTPayload {\n  /** Expiration timestamp — doubles as the access token expiry (JWT exp == access token exp) */\n  exp: number;\n  /** Issued at timestamp */\n  iat: number;\n  /** Organization ID if applicable */\n  organizationId?: string;\n  /** The refresh token; empty string if not provided by the auth server */\n  refreshToken: string;\n  /** OAuth scopes */\n  scopes: string[];\n  /** Session ID */\n  sessionId: string;\n  /** User ID */\n  sub: string;\n  /** Token type discriminant — must be 'session' for access-session JWTs */\n  type: 'session';\n}\n\n/**\n * Session management utility class for JWT-based session cookies\n */\nclass SessionManager {\n  /**\n   * Get the signing secret from environment variable\n   * Throws error in production if not set\n   */\n  private static getSecret(): Uint8Array {\n    const secret: string | undefined = process.env['THUNDERID_SECRET'];\n\n    if (!secret) {\n      if (process.env['NODE_ENV'] === 'production') {\n        throw new ThunderIDRuntimeError(\n          'THUNDERID_SECRET environment variable is required in production',\n          'session-secret-required',\n          'nextjs',\n          'Set the THUNDERID_SECRET environment variable with a secure random string',\n        );\n      }\n      // Use a default secret for development (not secure)\n      // eslint-disable-next-line no-console\n      console.warn('Using default secret for development. Set THUNDERID_SECRET for production!');\n      return new TextEncoder().encode('development-secret-not-for-production');\n    }\n\n    return new TextEncoder().encode(secret);\n  }\n\n  /**\n   * Create a temporary session cookie for login initiation\n   */\n  static async createTempSession(sessionId: string): Promise<string> {\n    const secret: Uint8Array = this.getSecret();\n\n    const jwt: string = await new SignJWT({\n      sessionId,\n      type: 'temp',\n    })\n      .setProtectedHeader({alg: 'HS256'})\n      .setIssuedAt()\n      .setExpirationTime('15m')\n      .sign(secret);\n\n    return jwt;\n  }\n\n  /**\n   * Resolve the session cookie expiry time in seconds.\n   *\n   * Resolution order (first defined value wins):\n   *   1. `configuredExpiry` — value from `ThunderIDNodeConfig.sessionCookie?.expiryTime`\n   *   2. `THUNDERID_SESSION_COOKIE_EXPIRY_TIME` environment variable\n   *   3. `DEFAULT_SESSION_COOKIE_EXPIRY_TIME` (24 hours)\n   */\n  static resolveSessionCookieExpiry(configuredExpiry?: number): number {\n    if (configuredExpiry != null && configuredExpiry > 0) {\n      return configuredExpiry;\n    }\n\n    const envValue: string | undefined = process.env['THUNDERID_SESSION_COOKIE_EXPIRY_TIME'];\n\n    if (envValue) {\n      const parsed: number = parseInt(envValue, 10);\n\n      if (!Number.isNaN(parsed) && parsed > 0) {\n        return parsed;\n      }\n    }\n\n    return DEFAULT_SESSION_COOKIE_EXPIRY_TIME;\n  }\n\n  static async createSessionToken(\n    accessToken: string,\n    userId: string,\n    sessionId: string,\n    scopes: string,\n    accessTokenTtlSeconds: number,\n    refreshToken: string,\n    organizationId?: string,\n  ): Promise<string> {\n    const secret: Uint8Array = this.getSecret();\n\n    const jwt: string = await new SignJWT({\n      accessToken,\n      organizationId,\n      refreshToken,\n      scopes,\n      sessionId,\n      type: 'session',\n    } as Omit<SessionTokenPayload, 'sub' | 'iat' | 'exp'>)\n      .setProtectedHeader({alg: 'HS256'})\n      .setSubject(userId)\n      .setIssuedAt()\n      .setExpirationTime(Math.floor(Date.now() / 1000) + accessTokenTtlSeconds)\n      .sign(secret);\n\n    return jwt;\n  }\n\n  /**\n   * Verify and decode a session token\n   */\n  static async verifySessionToken(token: string): Promise<SessionTokenPayload> {\n    try {\n      const secret: Uint8Array = this.getSecret();\n      const {payload} = await jwtVerify(token, secret);\n\n      if (payload['type'] !== 'session') {\n        throw new Error('Invalid token type');\n      }\n\n      return payload as SessionTokenPayload;\n    } catch (error) {\n      throw new ThunderIDRuntimeError(\n        `Invalid session token: ${error instanceof Error ? error.message : 'Unknown error'}`,\n        'invalid-session-token',\n        'nextjs',\n        'Session token verification failed',\n      );\n    }\n  }\n\n  /**\n   * Verify a session token for refresh. Validates the HMAC signature and the\n   * `type === 'session'` discriminant but intentionally skips the `exp` check\n   * so an expired access token can still be exchanged for a new one.\n   *\n   * Session lifetime is still bounded — the cookie's `maxAge` is set from\n   * `sessionCookieExpiryTime`, so the browser drops an over-age session regardless\n   * of the access-token exp embedded in the JWT.\n   *\n   * Never use the returned payload for authorization.\n   */\n  static async verifySessionTokenForRefresh(token: string): Promise<SessionTokenPayload> {\n    try {\n      const secret: Uint8Array = this.getSecret();\n      const {payload: rawPayload} = await compactVerify(token, secret);\n      const payload: SessionTokenPayload = JSON.parse(new TextDecoder().decode(rawPayload)) as SessionTokenPayload;\n\n      if (payload.type !== 'session') {\n        throw new Error('Invalid token type');\n      }\n\n      return payload;\n    } catch (error) {\n      throw new ThunderIDRuntimeError(\n        `Invalid session token: ${error instanceof Error ? error.message : 'Unknown error'}`,\n        'invalid-session-token-for-refresh',\n        'nextjs',\n        'Session token signature or type check failed during refresh',\n      );\n    }\n  }\n\n  /**\n   * Verify and decode a temporary session token\n   */\n  static async verifyTempSession(token: string): Promise<{sessionId: string}> {\n    try {\n      const secret: Uint8Array = this.getSecret();\n      const {payload} = await jwtVerify(token, secret);\n\n      if (payload['type'] !== 'temp') {\n        throw new Error('Invalid token type');\n      }\n\n      return {sessionId: payload['sessionId'] as string};\n    } catch (error) {\n      throw new ThunderIDRuntimeError(\n        `Invalid temporary session token: ${error instanceof Error ? error.message : 'Unknown error'}`,\n        'invalid-temp-session-token',\n        'nextjs',\n        'Temporary session token verification failed',\n      );\n    }\n  }\n\n  /**\n   * Get session cookie options\n   */\n  static getSessionCookieOptions(maxAge: number): {\n    httpOnly: boolean;\n    maxAge: number;\n    path: string;\n    sameSite: 'lax';\n    secure: boolean;\n  } {\n    return {\n      httpOnly: true,\n      maxAge,\n      path: '/',\n      sameSite: 'lax' as const,\n      secure: process.env['NODE_ENV'] === 'production',\n    };\n  }\n\n  /**\n   * Get temporary session cookie options\n   */\n  static getTempSessionCookieOptions(): {\n    httpOnly: boolean;\n    maxAge: number;\n    path: string;\n    sameSite: 'lax';\n    secure: boolean;\n  } {\n    return {\n      httpOnly: true,\n      maxAge: 15 * 60,\n      path: '/',\n      sameSite: 'lax' as const,\n      secure: process.env['NODE_ENV'] === 'production',\n    };\n  }\n\n  /**\n   * Get session cookie name\n   */\n  static getSessionCookieName(): string {\n    return CookieConfig.getSessionCookieName();\n  }\n\n  /**\n   * Get temporary session cookie name\n   */\n  static getTempSessionCookieName(): string {\n    return CookieConfig.getTempSessionCookieName();\n  }\n}\n\nexport default SessionManager;\n"],"mappings":";;;;;;;;;;;AAgCA,IAAM,iBAAN,MAAqB;;;;;CAKnB,OAAe,YAAwB;EACrC,MAAMA,SAA6B,QAAQ,IAAI;AAE/C,MAAI,CAAC,QAAQ;AACX,OAAI,QAAQ,IAAI,gBAAgB,aAC9B,OAAM,IAAIC,uCACR,mEACA,2BACA,UACA,4EACD;AAIH,WAAQ,KAAK,6EAA6E;AAC1F,UAAO,IAAI,aAAa,CAAC,OAAO,wCAAwC;;AAG1E,SAAO,IAAI,aAAa,CAAC,OAAO,OAAO;;;;;CAMzC,aAAa,kBAAkB,WAAoC;EACjE,MAAMC,SAAqB,KAAK,WAAW;AAW3C,SAToB,MAAM,IAAIC,aAAQ;GACpC;GACA,MAAM;GACP,CAAC,CACC,mBAAmB,EAAC,KAAK,SAAQ,CAAC,CAClC,aAAa,CACb,kBAAkB,MAAM,CACxB,KAAK,OAAO;;;;;;;;;;CAajB,OAAO,2BAA2B,kBAAmC;AACnE,MAAI,oBAAoB,QAAQ,mBAAmB,EACjD,QAAO;EAGT,MAAMC,WAA+B,QAAQ,IAAI;AAEjD,MAAI,UAAU;GACZ,MAAMC,SAAiB,SAAS,UAAU,GAAG;AAE7C,OAAI,CAAC,OAAO,MAAM,OAAO,IAAI,SAAS,EACpC,QAAO;;AAIX,SAAOC;;CAGT,aAAa,mBACX,aACA,QACA,WACA,QACA,uBACA,cACA,gBACiB;EACjB,MAAMJ,SAAqB,KAAK,WAAW;AAgB3C,SAdoB,MAAM,IAAIC,aAAQ;GACpC;GACA;GACA;GACA;GACA;GACA,MAAM;GACP,CAAqD,CACnD,mBAAmB,EAAC,KAAK,SAAQ,CAAC,CAClC,WAAW,OAAO,CAClB,aAAa,CACb,kBAAkB,KAAK,MAAM,KAAK,KAAK,GAAG,IAAK,GAAG,sBAAsB,CACxE,KAAK,OAAO;;;;;CAQjB,aAAa,mBAAmB,OAA6C;AAC3E,MAAI;GAEF,MAAM,EAAC,YAAW,0BAAgB,OADP,KAAK,WAAW,CACK;AAEhD,OAAI,QAAQ,YAAY,UACtB,OAAM,IAAI,MAAM,qBAAqB;AAGvC,UAAO;WACA,OAAO;AACd,SAAM,IAAIF,uCACR,0BAA0B,iBAAiB,QAAQ,MAAM,UAAU,mBACnE,yBACA,UACA,oCACD;;;;;;;;;;;;;;CAeL,aAAa,6BAA6B,OAA6C;AACrF,MAAI;GAEF,MAAM,EAAC,SAAS,eAAc,8BAAoB,OADvB,KAAK,WAAW,CACqB;GAChE,MAAMM,UAA+B,KAAK,MAAM,IAAI,aAAa,CAAC,OAAO,WAAW,CAAC;AAErF,OAAI,QAAQ,SAAS,UACnB,OAAM,IAAI,MAAM,qBAAqB;AAGvC,UAAO;WACA,OAAO;AACd,SAAM,IAAIN,uCACR,0BAA0B,iBAAiB,QAAQ,MAAM,UAAU,mBACnE,qCACA,UACA,8DACD;;;;;;CAOL,aAAa,kBAAkB,OAA6C;AAC1E,MAAI;GAEF,MAAM,EAAC,YAAW,0BAAgB,OADP,KAAK,WAAW,CACK;AAEhD,OAAI,QAAQ,YAAY,OACtB,OAAM,IAAI,MAAM,qBAAqB;AAGvC,UAAO,EAAC,WAAW,QAAQ,cAAuB;WAC3C,OAAO;AACd,SAAM,IAAIA,uCACR,oCAAoC,iBAAiB,QAAQ,MAAM,UAAU,mBAC7E,8BACA,UACA,8CACD;;;;;;CAOL,OAAO,wBAAwB,QAM7B;AACA,SAAO;GACL,UAAU;GACV;GACA,MAAM;GACN,UAAU;GACV,QAAQ,QAAQ,IAAI,gBAAgB;GACrC;;;;;CAMH,OAAO,8BAML;AACA,SAAO;GACL,UAAU;GACV,QAAQ;GACR,MAAM;GACN,UAAU;GACV,QAAQ,QAAQ,IAAI,gBAAgB;GACrC;;;;;CAMH,OAAO,uBAA+B;AACpC,SAAOO,8BAAa,sBAAsB;;;;;CAM5C,OAAO,2BAAmC;AACxC,SAAOA,8BAAa,0BAA0B;;;AAIlD,6BAAe"}

package/dist/cjs/utils/decorateConfigWithNextEnv.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"decorateConfigWithNextEnv.cjs","names":[],"sources":["../../../src/utils/decorateConfigWithNextEnv.ts"],"sourcesContent":["/**\n * Copyright (c) 2025, WSO2 LLC. (https://www.wso2.com).\n *\n * WSO2 LLC. licenses this file to you under the Apache License,\n * Version 2.0 (the \"License\"); you may not use this file except\n * in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing,\n * software distributed under the License is distributed on an\n * \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY\n * KIND, either express or implied. See the License for the\n * specific language governing permissions and limitations\n * under the License.\n */\n\nimport {ThunderIDNextConfig} from '../models/config';\n\nconst decorateConfigWithNextEnv = (config: ThunderIDNextConfig): ThunderIDNextConfig => {\n  const {\n    organizationHandle,\n    scopes,\n    applicationId,\n    baseUrl,\n    clientId,\n    clientSecret,\n    signInUrl,\n    signUpUrl,\n    afterSignInUrl,\n    afterSignOutUrl,\n    vendor,\n    ...rest\n  } = config;\n\n  const envExpiryTime = process.env['THUNDERID_SESSION_COOKIE_EXPIRY_TIME']\n    ? parseInt(process.env['THUNDERID_SESSION_COOKIE_EXPIRY_TIME'], 10)\n    : undefined;\n\n  return {\n    ...rest,\n    afterSignInUrl: afterSignInUrl || process.env['NEXT_PUBLIC_THUNDERID_AFTER_SIGN_IN_URL']!,\n    afterSignOutUrl: afterSignOutUrl || process.env['NEXT_PUBLIC_THUNDERID_AFTER_SIGN_OUT_URL']!,\n    applicationId: applicationId || process.env['NEXT_PUBLIC_THUNDERID_APPLICATION_ID']!,\n    baseUrl: baseUrl || process.env['NEXT_PUBLIC_THUNDERID_BASE_URL']!,\n    clientId: clientId || process.env['NEXT_PUBLIC_THUNDERID_CLIENT_ID']!,\n    clientSecret: clientSecret || process.env['THUNDERID_CLIENT_SECRET']!,\n    organizationHandle: organizationHandle || process.env['NEXT_PUBLIC_THUNDERID_ORGANIZATION_HANDLE']!,\n    scopes: scopes || process.env['NEXT_PUBLIC_THUNDERID_SCOPES']!,\n    sessionCookie: {\n      ...rest.sessionCookie,\n      expiryTime: rest.sessionCookie?.expiryTime || envExpiryTime,\n    },\n    signInUrl: signInUrl || process.env['NEXT_PUBLIC_THUNDERID_SIGN_IN_URL']!,\n    signUpUrl: signUpUrl || process.env['NEXT_PUBLIC_THUNDERID_SIGN_UP_URL']!,\n    vendor: vendor || process.env['NEXT_PUBLIC_THUNDERID_VENDOR'],\n  };\n};\n\nexport default decorateConfigWithNextEnv;\n"],"mappings":";;AAoBA,MAAM,6BAA6B,WAAqD;CACtF,MAAM,EACJ,oBACA,QACA,eACA,SACA,UACA,cACA,WACA,WACA,gBACA,iBACA,OACA,GAAG,SACD;CAEJ,MAAM,gBAAgB,QAAQ,IAAI,0CAC9B,SAAS,QAAQ,IAAI,yCAAyC,GAAG,GACjE;AAEJ,QAAO;EACL,GAAG;EACH,gBAAgB,kBAAkB,QAAQ,IAAI;EAC9C,iBAAiB,mBAAmB,QAAQ,IAAI;EAChD,eAAe,iBAAiB,QAAQ,IAAI;EAC5C,SAAS,WAAW,QAAQ,IAAI;EAChC,UAAU,YAAY,QAAQ,IAAI;EAClC,cAAc,gBAAgB,QAAQ,IAAI;EAC1C,oBAAoB,sBAAsB,QAAQ,IAAI;EACtD,QAAQ,UAAU,QAAQ,IAAI;EAC9B,eAAe;GACb,GAAG,KAAK;GACR,YAAY,KAAK,eAAe,cAAc;GAC/C;EACD,WAAW,aAAa,QAAQ,IAAI;EACpC,WAAW,aAAa,QAAQ,IAAI;EACpC,QAAQ,UAAU,QAAQ,IAAI;EAC/B;;AAGH,wCAAe"}
+{"version":3,"file":"decorateConfigWithNextEnv.cjs","names":[],"sources":["../../../src/utils/decorateConfigWithNextEnv.ts"],"sourcesContent":["// Copyright 2025 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\nimport {ThunderIDNextConfig} from '../models/config';\n\nconst decorateConfigWithNextEnv = (config: ThunderIDNextConfig): ThunderIDNextConfig => {\n  const {\n    organizationHandle,\n    scopes,\n    applicationId,\n    baseUrl,\n    clientId,\n    clientSecret,\n    signInUrl,\n    signUpUrl,\n    afterSignInUrl,\n    afterSignOutUrl,\n    vendor,\n    ...rest\n  } = config;\n\n  const envExpiryTime = process.env['THUNDERID_SESSION_COOKIE_EXPIRY_TIME']\n    ? parseInt(process.env['THUNDERID_SESSION_COOKIE_EXPIRY_TIME'], 10)\n    : undefined;\n\n  return {\n    ...rest,\n    afterSignInUrl: afterSignInUrl || process.env['NEXT_PUBLIC_THUNDERID_AFTER_SIGN_IN_URL']!,\n    afterSignOutUrl: afterSignOutUrl || process.env['NEXT_PUBLIC_THUNDERID_AFTER_SIGN_OUT_URL']!,\n    applicationId: applicationId || process.env['NEXT_PUBLIC_THUNDERID_APPLICATION_ID']!,\n    baseUrl: baseUrl || process.env['NEXT_PUBLIC_THUNDERID_BASE_URL']!,\n    clientId: clientId || process.env['NEXT_PUBLIC_THUNDERID_CLIENT_ID']!,\n    clientSecret: clientSecret || process.env['THUNDERID_CLIENT_SECRET']!,\n    organizationHandle: organizationHandle || process.env['NEXT_PUBLIC_THUNDERID_ORGANIZATION_HANDLE']!,\n    scopes: scopes || process.env['NEXT_PUBLIC_THUNDERID_SCOPES']!,\n    sessionCookie: {\n      ...rest.sessionCookie,\n      expiryTime: rest.sessionCookie?.expiryTime || envExpiryTime,\n    },\n    signInUrl: signInUrl || process.env['NEXT_PUBLIC_THUNDERID_SIGN_IN_URL']!,\n    signUpUrl: signUpUrl || process.env['NEXT_PUBLIC_THUNDERID_SIGN_UP_URL']!,\n    vendor: vendor || process.env['NEXT_PUBLIC_THUNDERID_VENDOR'],\n  };\n};\n\nexport default decorateConfigWithNextEnv;\n"],"mappings":";;AAKA,MAAM,6BAA6B,WAAqD;CACtF,MAAM,EACJ,oBACA,QACA,eACA,SACA,UACA,cACA,WACA,WACA,gBACA,iBACA,OACA,GAAG,SACD;CAEJ,MAAM,gBAAgB,QAAQ,IAAI,0CAC9B,SAAS,QAAQ,IAAI,yCAAyC,GAAG,GACjE;AAEJ,QAAO;EACL,GAAG;EACH,gBAAgB,kBAAkB,QAAQ,IAAI;EAC9C,iBAAiB,mBAAmB,QAAQ,IAAI;EAChD,eAAe,iBAAiB,QAAQ,IAAI;EAC5C,SAAS,WAAW,QAAQ,IAAI;EAChC,UAAU,YAAY,QAAQ,IAAI;EAClC,cAAc,gBAAgB,QAAQ,IAAI;EAC1C,oBAAoB,sBAAsB,QAAQ,IAAI;EACtD,QAAQ,UAAU,QAAQ,IAAI;EAC9B,eAAe;GACb,GAAG,KAAK;GACR,YAAY,KAAK,eAAe,cAAc;GAC/C;EACD,WAAW,aAAa,QAAQ,IAAI;EACpC,WAAW,aAAa,QAAQ,IAAI;EACpC,QAAQ,UAAU,QAAQ,IAAI;EAC/B;;AAGH,wCAAe"}

package/dist/cjs/utils/handleRefreshToken.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"handleRefreshToken.cjs","names":["body: URLSearchParams","response: Response","tokenData: Record<string, unknown>","newAccessToken: string","expiresIn: number","newRefreshToken: string","newScopes: string","resolvedSessionCookieExpiry: number","SessionManager"],"sources":["../../../src/utils/handleRefreshToken.ts"],"sourcesContent":["/**\n * Copyright (c) 2025, WSO2 LLC. (https://www.wso2.com).\n *\n * WSO2 LLC. licenses this file to you under the Apache License,\n * Version 2.0 (the \"License\"); you may not use this file except\n * in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing,\n * software distributed under the License is distributed on an\n * \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY\n * KIND, either express or implied. See the License for the\n * specific language governing permissions and limitations\n * under the License.\n */\n\nimport type {TokenResponse, SessionCookieConfig} from '@thunderid/node';\nimport SessionManager, {SessionTokenPayload} from './SessionManager';\n\n/**\n * Config required to call the token endpoint.\n */\nexport interface HandleRefreshTokenConfig {\n  baseUrl: string;\n  clientId: string;\n  clientSecret: string;\n  sessionCookie?: SessionCookieConfig;\n}\n\n/**\n * Result returned by handleRefreshToken.\n * Callers are responsible for persisting newSessionToken in the appropriate cookie context.\n */\nexport interface HandleRefreshTokenResult {\n  newSessionToken: string;\n  sessionCookieExpiryTime: number;\n  tokenResponse: TokenResponse;\n}\n\n/**\n * Handles the OAuth refresh_token grant and builds a new session JWT string.\n *\n * Intentionally decoupled from cookie APIs so it can be called from both the Edge\n * Runtime (Next.js middleware) and the Node.js Runtime (server actions).\n * Cookie persistence is the caller's responsibility.\n */\nconst handleRefreshToken = async (\n  sessionPayload: SessionTokenPayload,\n  config: HandleRefreshTokenConfig,\n): Promise<HandleRefreshTokenResult> => {\n  const {baseUrl, clientId, clientSecret, sessionCookie} = config;\n  const {refreshToken: storedRefreshToken, sessionId, sub, scopes, organizationId} = sessionPayload;\n\n  if (!storedRefreshToken) {\n    throw new Error('No refresh token found in session payload.');\n  }\n\n  const tokenEndpoint = `${baseUrl}/oauth2/token`;\n  const body: URLSearchParams = new URLSearchParams({\n    client_id: clientId ?? '',\n    client_secret: clientSecret ?? '',\n    grant_type: 'refresh_token',\n    refresh_token: storedRefreshToken,\n  });\n\n  let response: Response;\n\n  try {\n    response = await fetch(tokenEndpoint, {\n      body: body.toString(),\n      headers: {'Content-Type': 'application/x-www-form-urlencoded'},\n      method: 'POST',\n    });\n  } catch (fetchError) {\n    throw new Error(\n      `Token refresh network error: ${fetchError instanceof Error ? fetchError.message : String(fetchError)}`,\n    );\n  }\n\n  if (!response.ok) {\n    throw new Error(`Token endpoint rejected refresh (HTTP ${response.status}).`);\n  }\n\n  let tokenData: Record<string, unknown>;\n\n  try {\n    tokenData = (await response.json()) as Record<string, unknown>;\n  } catch {\n    throw new Error('Failed to parse token endpoint response as JSON.');\n  }\n\n  const newAccessToken: string = tokenData['access_token'] as string;\n  const expiresIn: number = tokenData['expires_in'] as number;\n  // Use the rotated refresh token if the server provided one; otherwise keep the existing one.\n  const newRefreshToken: string = (tokenData['refresh_token'] as string | undefined) ?? storedRefreshToken;\n  const newScopes: string =\n    (tokenData['scope'] as string | undefined) ??\n    (Array.isArray(scopes) ? scopes.join(' ') : ((scopes as string) ?? ''));\n\n  const resolvedSessionCookieExpiry: number = SessionManager.resolveSessionCookieExpiry(sessionCookie?.expiryTime);\n\n  const newSessionToken: string = await SessionManager.createSessionToken(\n    newAccessToken,\n    sub,\n    sessionId,\n    newScopes,\n    expiresIn,\n    newRefreshToken,\n    organizationId,\n  );\n\n  return {\n    newSessionToken,\n    sessionCookieExpiryTime: resolvedSessionCookieExpiry,\n    tokenResponse: {\n      accessToken: newAccessToken,\n      createdAt: Math.floor(Date.now() / 1000),\n      expiresIn: String(expiresIn),\n      idToken: (tokenData['id_token'] as string | undefined) ?? '',\n      refreshToken: newRefreshToken,\n      scope: newScopes,\n      tokenType: (tokenData['token_type'] as string | undefined) ?? 'Bearer',\n    },\n  };\n};\n\nexport default handleRefreshToken;\n"],"mappings":";;;;;;;;;;AAgDA,MAAM,qBAAqB,OACzB,gBACA,WACsC;CACtC,MAAM,EAAC,SAAS,UAAU,cAAc,kBAAiB;CACzD,MAAM,EAAC,cAAc,oBAAoB,WAAW,KAAK,QAAQ,mBAAkB;AAEnF,KAAI,CAAC,mBACH,OAAM,IAAI,MAAM,6CAA6C;CAG/D,MAAM,gBAAgB,GAAG,QAAQ;CACjC,MAAMA,OAAwB,IAAI,gBAAgB;EAChD,WAAW,YAAY;EACvB,eAAe,gBAAgB;EAC/B,YAAY;EACZ,eAAe;EAChB,CAAC;CAEF,IAAIC;AAEJ,KAAI;AACF,aAAW,MAAM,MAAM,eAAe;GACpC,MAAM,KAAK,UAAU;GACrB,SAAS,EAAC,gBAAgB,qCAAoC;GAC9D,QAAQ;GACT,CAAC;UACK,YAAY;AACnB,QAAM,IAAI,MACR,gCAAgC,sBAAsB,QAAQ,WAAW,UAAU,OAAO,WAAW,GACtG;;AAGH,KAAI,CAAC,SAAS,GACZ,OAAM,IAAI,MAAM,yCAAyC,SAAS,OAAO,IAAI;CAG/E,IAAIC;AAEJ,KAAI;AACF,cAAa,MAAM,SAAS,MAAM;SAC5B;AACN,QAAM,IAAI,MAAM,mDAAmD;;CAGrE,MAAMC,iBAAyB,UAAU;CACzC,MAAMC,YAAoB,UAAU;CAEpC,MAAMC,kBAA2B,UAAU,oBAA2C;CACtF,MAAMC,YACH,UAAU,aACV,MAAM,QAAQ,OAAO,GAAG,OAAO,KAAK,IAAI,GAAK,UAAqB;CAErE,MAAMC,8BAAsCC,+BAAe,2BAA2B,eAAe,WAAW;AAYhH,QAAO;EACL,iBAX8B,MAAMA,+BAAe,mBACnD,gBACA,KACA,WACA,WACA,WACA,iBACA,eACD;EAIC,yBAAyB;EACzB,eAAe;GACb,aAAa;GACb,WAAW,KAAK,MAAM,KAAK,KAAK,GAAG,IAAK;GACxC,WAAW,OAAO,UAAU;GAC5B,SAAU,UAAU,eAAsC;GAC1D,cAAc;GACd,OAAO;GACP,WAAY,UAAU,iBAAwC;GAC/D;EACF;;AAGH,iCAAe"}
+{"version":3,"file":"handleRefreshToken.cjs","names":["body: URLSearchParams","response: Response","tokenData: Record<string, unknown>","newAccessToken: string","expiresIn: number","newRefreshToken: string","newScopes: string","resolvedSessionCookieExpiry: number","SessionManager"],"sources":["../../../src/utils/handleRefreshToken.ts"],"sourcesContent":["// Copyright 2025 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\nimport type {TokenResponse, SessionCookieConfig} from '@thunderid/node';\nimport SessionManager, {SessionTokenPayload} from './SessionManager';\n\n/**\n * Config required to call the token endpoint.\n */\nexport interface HandleRefreshTokenConfig {\n  baseUrl: string;\n  clientId: string;\n  clientSecret: string;\n  sessionCookie?: SessionCookieConfig;\n}\n\n/**\n * Result returned by handleRefreshToken.\n * Callers are responsible for persisting newSessionToken in the appropriate cookie context.\n */\nexport interface HandleRefreshTokenResult {\n  newSessionToken: string;\n  sessionCookieExpiryTime: number;\n  tokenResponse: TokenResponse;\n}\n\n/**\n * Handles the OAuth refresh_token grant and builds a new session JWT string.\n *\n * Intentionally decoupled from cookie APIs so it can be called from both the Edge\n * Runtime (Next.js middleware) and the Node.js Runtime (server actions).\n * Cookie persistence is the caller's responsibility.\n */\nconst handleRefreshToken = async (\n  sessionPayload: SessionTokenPayload,\n  config: HandleRefreshTokenConfig,\n): Promise<HandleRefreshTokenResult> => {\n  const {baseUrl, clientId, clientSecret, sessionCookie} = config;\n  const {refreshToken: storedRefreshToken, sessionId, sub, scopes, organizationId} = sessionPayload;\n\n  if (!storedRefreshToken) {\n    throw new Error('No refresh token found in session payload.');\n  }\n\n  const tokenEndpoint = `${baseUrl}/oauth2/token`;\n  const body: URLSearchParams = new URLSearchParams({\n    client_id: clientId ?? '',\n    client_secret: clientSecret ?? '',\n    grant_type: 'refresh_token',\n    refresh_token: storedRefreshToken,\n  });\n\n  let response: Response;\n\n  try {\n    response = await fetch(tokenEndpoint, {\n      body: body.toString(),\n      headers: {'Content-Type': 'application/x-www-form-urlencoded'},\n      method: 'POST',\n    });\n  } catch (fetchError) {\n    throw new Error(\n      `Token refresh network error: ${fetchError instanceof Error ? fetchError.message : String(fetchError)}`,\n    );\n  }\n\n  if (!response.ok) {\n    throw new Error(`Token endpoint rejected refresh (HTTP ${response.status}).`);\n  }\n\n  let tokenData: Record<string, unknown>;\n\n  try {\n    tokenData = (await response.json()) as Record<string, unknown>;\n  } catch {\n    throw new Error('Failed to parse token endpoint response as JSON.');\n  }\n\n  const newAccessToken: string = tokenData['access_token'] as string;\n  const expiresIn: number = tokenData['expires_in'] as number;\n  // Use the rotated refresh token if the server provided one; otherwise keep the existing one.\n  const newRefreshToken: string = (tokenData['refresh_token'] as string | undefined) ?? storedRefreshToken;\n  const newScopes: string =\n    (tokenData['scope'] as string | undefined) ??\n    (Array.isArray(scopes) ? scopes.join(' ') : ((scopes as string) ?? ''));\n\n  const resolvedSessionCookieExpiry: number = SessionManager.resolveSessionCookieExpiry(sessionCookie?.expiryTime);\n\n  const newSessionToken: string = await SessionManager.createSessionToken(\n    newAccessToken,\n    sub,\n    sessionId,\n    newScopes,\n    expiresIn,\n    newRefreshToken,\n    organizationId,\n  );\n\n  return {\n    newSessionToken,\n    sessionCookieExpiryTime: resolvedSessionCookieExpiry,\n    tokenResponse: {\n      accessToken: newAccessToken,\n      createdAt: Math.floor(Date.now() / 1000),\n      expiresIn: String(expiresIn),\n      idToken: (tokenData['id_token'] as string | undefined) ?? '',\n      refreshToken: newRefreshToken,\n      scope: newScopes,\n      tokenType: (tokenData['token_type'] as string | undefined) ?? 'Bearer',\n    },\n  };\n};\n\nexport default handleRefreshToken;\n"],"mappings":";;;;;;;;;;AAiCA,MAAM,qBAAqB,OACzB,gBACA,WACsC;CACtC,MAAM,EAAC,SAAS,UAAU,cAAc,kBAAiB;CACzD,MAAM,EAAC,cAAc,oBAAoB,WAAW,KAAK,QAAQ,mBAAkB;AAEnF,KAAI,CAAC,mBACH,OAAM,IAAI,MAAM,6CAA6C;CAG/D,MAAM,gBAAgB,GAAG,QAAQ;CACjC,MAAMA,OAAwB,IAAI,gBAAgB;EAChD,WAAW,YAAY;EACvB,eAAe,gBAAgB;EAC/B,YAAY;EACZ,eAAe;EAChB,CAAC;CAEF,IAAIC;AAEJ,KAAI;AACF,aAAW,MAAM,MAAM,eAAe;GACpC,MAAM,KAAK,UAAU;GACrB,SAAS,EAAC,gBAAgB,qCAAoC;GAC9D,QAAQ;GACT,CAAC;UACK,YAAY;AACnB,QAAM,IAAI,MACR,gCAAgC,sBAAsB,QAAQ,WAAW,UAAU,OAAO,WAAW,GACtG;;AAGH,KAAI,CAAC,SAAS,GACZ,OAAM,IAAI,MAAM,yCAAyC,SAAS,OAAO,IAAI;CAG/E,IAAIC;AAEJ,KAAI;AACF,cAAa,MAAM,SAAS,MAAM;SAC5B;AACN,QAAM,IAAI,MAAM,mDAAmD;;CAGrE,MAAMC,iBAAyB,UAAU;CACzC,MAAMC,YAAoB,UAAU;CAEpC,MAAMC,kBAA2B,UAAU,oBAA2C;CACtF,MAAMC,YACH,UAAU,aACV,MAAM,QAAQ,OAAO,GAAG,OAAO,KAAK,IAAI,GAAK,UAAqB;CAErE,MAAMC,8BAAsCC,+BAAe,2BAA2B,eAAe,WAAW;AAYhH,QAAO;EACL,iBAX8B,MAAMA,+BAAe,mBACnD,gBACA,KACA,WACA,WACA,WACA,iBACA,eACD;EAIC,yBAAyB;EACzB,eAAe;GACb,aAAa;GACb,WAAW,KAAK,MAAM,KAAK,KAAK,GAAG,IAAK;GACxC,WAAW,OAAO,UAAU;GAC5B,SAAU,UAAU,eAAsC;GAC1D,cAAc;GACd,OAAO;GACP,WAAY,UAAU,iBAAwC;GAC/D;EACF;;AAGH,iCAAe"}

package/dist/cjs/utils/logger.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"logger.cjs","names":["logger: any"],"sources":["../../../src/utils/logger.ts"],"sourcesContent":["/**\n * Copyright (c) 2025, WSO2 LLC. (https://www.wso2.com).\n *\n * WSO2 LLC. licenses this file to you under the Apache License,\n * Version 2.0 (the \"License\"); you may not use this file except\n * in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing,\n * software distributed under the License is distributed on an\n * \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY\n * KIND, either express or implied. See the License for the\n * specific language governing permissions and limitations\n * under the License.\n */\n\nimport {createLogger} from '@thunderid/node';\n\nconst logger: any = createLogger({\n  level: 'error',\n});\n\nexport default logger;\n"],"mappings":";;;;;AAoBA,MAAMA,4CAA2B,EAC/B,OAAO,SACR,CAAC;AAEF,qBAAe"}
+{"version":3,"file":"logger.cjs","names":["logger: any"],"sources":["../../../src/utils/logger.ts"],"sourcesContent":["// Copyright 2025 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\nimport {createLogger} from '@thunderid/node';\n\nconst logger: any = createLogger({\n  level: 'error',\n});\n\nexport default logger;\n"],"mappings":";;;;;AAKA,MAAMA,4CAA2B,EAC/B,OAAO,SACR,CAAC;AAEF,qBAAe"}

package/dist/cjs/utils/sessionUtils.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"sessionUtils.cjs","names":["sessionToken: string | undefined","SessionManager","sessionPayload: SessionTokenPayload | undefined"],"sources":["../../../src/utils/sessionUtils.ts"],"sourcesContent":["/**\n * Copyright (c) 2025, WSO2 LLC. (https://www.wso2.com).\n *\n * WSO2 LLC. licenses this file to you under the Apache License,\n * Version 2.0 (the \"License\"); you may not use this file except\n * in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing,\n * software distributed under the License is distributed on an\n * \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY\n * KIND, either express or implied. See the License for the\n * specific language governing permissions and limitations\n * under the License.\n */\n\nimport {NextRequest} from 'next/server';\nimport SessionManager, {SessionTokenPayload} from './SessionManager';\n\n/**\n * Checks if a request has a valid session cookie (JWT).\n * This verifies the JWT signature and expiration.\n *\n * @param request - The Next.js request object\n * @returns True if a valid session exists, false otherwise\n */\nexport const hasValidSession = async (request: NextRequest): Promise<boolean> => {\n  try {\n    const sessionToken: string | undefined = request.cookies.get(SessionManager.getSessionCookieName())?.value;\n    if (!sessionToken) {\n      return false;\n    }\n\n    await SessionManager.verifySessionToken(sessionToken);\n    return true;\n  } catch {\n    return false;\n  }\n};\n\n/**\n * Gets the session payload from the request cookies.\n * This includes user ID, session ID, and scopes.\n *\n * @param request - The Next.js request object\n * @returns The session payload if valid, undefined otherwise\n */\nexport const getSessionFromRequest = async (request: NextRequest): Promise<SessionTokenPayload | undefined> => {\n  try {\n    const sessionToken: string | undefined = request.cookies.get(SessionManager.getSessionCookieName())?.value;\n    if (!sessionToken) {\n      return undefined;\n    }\n\n    return await SessionManager.verifySessionToken(sessionToken);\n  } catch {\n    return undefined;\n  }\n};\n\n/**\n * Gets the session ID from the request cookies (legacy support).\n * First tries to get from JWT session, then falls back to legacy session ID cookie.\n *\n * @param request - The Next.js request object\n * @returns The session ID if it exists, undefined otherwise\n */\nexport const getSessionIdFromRequest = async (request: NextRequest): Promise<string | undefined> => {\n  try {\n    const sessionPayload: SessionTokenPayload | undefined = await getSessionFromRequest(request);\n\n    if (sessionPayload) {\n      return sessionPayload.sessionId;\n    }\n\n    return await Promise.resolve(undefined);\n  } catch {\n    return Promise.resolve(undefined);\n  }\n};\n\n/**\n * Gets the temporary session ID from request cookies.\n *\n * @param request - The Next.js request object\n * @returns The temporary session ID if valid, undefined otherwise\n */\nexport const getTempSessionFromRequest = async (request: NextRequest): Promise<string | undefined> => {\n  try {\n    const tempToken: string | undefined = request.cookies.get(SessionManager.getTempSessionCookieName())?.value;\n    if (!tempToken) {\n      return undefined;\n    }\n\n    const tempSession: {sessionId: string} = await SessionManager.verifyTempSession(tempToken);\n    return tempSession.sessionId;\n  } catch {\n    return undefined;\n  }\n};\n"],"mappings":";;;;;;;;;;AAiDA,MAAa,wBAAwB,OAAO,YAAmE;AAC7G,KAAI;EACF,MAAMA,eAAmC,QAAQ,QAAQ,IAAIC,+BAAe,sBAAsB,CAAC,EAAE;AACrG,MAAI,CAAC,aACH;AAGF,SAAO,MAAMA,+BAAe,mBAAmB,aAAa;SACtD;AACN;;;;;;;;;;AAWJ,MAAa,0BAA0B,OAAO,YAAsD;AAClG,KAAI;EACF,MAAMC,iBAAkD,MAAM,sBAAsB,QAAQ;AAE5F,MAAI,eACF,QAAO,eAAe;AAGxB,SAAO,MAAM,QAAQ,QAAQ,OAAU;SACjC;AACN,SAAO,QAAQ,QAAQ,OAAU"}
+{"version":3,"file":"sessionUtils.cjs","names":["sessionToken: string | undefined","SessionManager","sessionPayload: SessionTokenPayload | undefined"],"sources":["../../../src/utils/sessionUtils.ts"],"sourcesContent":["// Copyright 2025 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\nimport {NextRequest} from 'next/server';\nimport SessionManager, {SessionTokenPayload} from './SessionManager';\n\n/**\n * Checks if a request has a valid session cookie (JWT).\n * This verifies the JWT signature and expiration.\n *\n * @param request - The Next.js request object\n * @returns True if a valid session exists, false otherwise\n */\nexport const hasValidSession = async (request: NextRequest): Promise<boolean> => {\n  try {\n    const sessionToken: string | undefined = request.cookies.get(SessionManager.getSessionCookieName())?.value;\n    if (!sessionToken) {\n      return false;\n    }\n\n    await SessionManager.verifySessionToken(sessionToken);\n    return true;\n  } catch {\n    return false;\n  }\n};\n\n/**\n * Gets the session payload from the request cookies.\n * This includes user ID, session ID, and scopes.\n *\n * @param request - The Next.js request object\n * @returns The session payload if valid, undefined otherwise\n */\nexport const getSessionFromRequest = async (request: NextRequest): Promise<SessionTokenPayload | undefined> => {\n  try {\n    const sessionToken: string | undefined = request.cookies.get(SessionManager.getSessionCookieName())?.value;\n    if (!sessionToken) {\n      return undefined;\n    }\n\n    return await SessionManager.verifySessionToken(sessionToken);\n  } catch {\n    return undefined;\n  }\n};\n\n/**\n * Gets the session ID from the request cookies (legacy support).\n * First tries to get from JWT session, then falls back to legacy session ID cookie.\n *\n * @param request - The Next.js request object\n * @returns The session ID if it exists, undefined otherwise\n */\nexport const getSessionIdFromRequest = async (request: NextRequest): Promise<string | undefined> => {\n  try {\n    const sessionPayload: SessionTokenPayload | undefined = await getSessionFromRequest(request);\n\n    if (sessionPayload) {\n      return sessionPayload.sessionId;\n    }\n\n    return await Promise.resolve(undefined);\n  } catch {\n    return Promise.resolve(undefined);\n  }\n};\n\n/**\n * Gets the temporary session ID from request cookies.\n *\n * @param request - The Next.js request object\n * @returns The temporary session ID if valid, undefined otherwise\n */\nexport const getTempSessionFromRequest = async (request: NextRequest): Promise<string | undefined> => {\n  try {\n    const tempToken: string | undefined = request.cookies.get(SessionManager.getTempSessionCookieName())?.value;\n    if (!tempToken) {\n      return undefined;\n    }\n\n    const tempSession: {sessionId: string} = await SessionManager.verifyTempSession(tempToken);\n    return tempSession.sessionId;\n  } catch {\n    return undefined;\n  }\n};\n"],"mappings":";;;;;;;;;;AAkCA,MAAa,wBAAwB,OAAO,YAAmE;AAC7G,KAAI;EACF,MAAMA,eAAmC,QAAQ,QAAQ,IAAIC,+BAAe,sBAAsB,CAAC,EAAE;AACrG,MAAI,CAAC,aACH;AAGF,SAAO,MAAMA,+BAAe,mBAAmB,aAAa;SACtD;AACN;;;;;;;;;;AAWJ,MAAa,0BAA0B,OAAO,YAAsD;AAClG,KAAI;EACF,MAAMC,iBAAkD,MAAM,sBAAsB,QAAQ;AAE5F,MAAI,eACF,QAAO,eAAe;AAGxB,SAAO,MAAM,QAAQ,QAAQ,OAAU;SACjC;AACN,SAAO,QAAQ,QAAQ,OAAU"}

package/dist/client/components/actions/SignInButton/SignInButton.d.ts

@@ -1,20 +1,3 @@
-/**
- * Copyright (c) 2025, WSO2 LLC. (https://www.wso2.com).
- *
- * WSO2 LLC. licenses this file to you under the Apache License,
- * Version 2.0 (the "License"); you may not use this file except
- * in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied. See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
 import { BaseSignInButtonProps } from '@thunderid/react';
 import { ForwardRefExoticComponent, RefAttributes } from 'react';
 /**

package/dist/client/components/actions/SignInButton/SignInButton.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"SignInButton.d.ts","sourceRoot":"","sources":["../../../../../src/client/components/actions/SignInButton/SignInButton.tsx"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAKH,OAAO,EAAmB,qBAAqB,EAAiB,MAAM,kBAAkB,CAAC;AAGzF,OAAO,EAAa,yBAAyB,EAAqB,aAAa,EAAuB,MAAM,OAAO,CAAC;AAGpH;;GAEG;AACH,MAAM,MAAM,iBAAiB,GAAG,qBAAqB,GAAG;IACtD;;OAEG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;CACrC,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,QAAA,MAAM,YAAY,EAAE,yBAAyB,CAAC,iBAAiB,GAAG,aAAa,CAAC,iBAAiB,CAAC,CA0DjG,CAAC;AAIF,eAAe,YAAY,CAAC"}
+{"version":3,"file":"SignInButton.d.ts","sourceRoot":"","sources":["../../../../../src/client/components/actions/SignInButton/SignInButton.tsx"],"names":[],"mappings":"AAMA,OAAO,EAAmB,qBAAqB,EAAiB,MAAM,kBAAkB,CAAC;AAGzF,OAAO,EAAa,yBAAyB,EAAqB,aAAa,EAAuB,MAAM,OAAO,CAAC;AAGpH;;GAEG;AACH,MAAM,MAAM,iBAAiB,GAAG,qBAAqB,GAAG;IACtD;;OAEG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;CACrC,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,QAAA,MAAM,YAAY,EAAE,yBAAyB,CAAC,iBAAiB,GAAG,aAAa,CAAC,iBAAiB,CAAC,CA0DjG,CAAC;AAIF,eAAe,YAAY,CAAC"}

package/dist/client/components/actions/SignInButton/SignInButton.js.map

@@ -1 +1 @@
-{"version":3,"file":"SignInButton.js","names":["SignInButton: ForwardRefExoticComponent<SignInButtonProps & RefAttributes<HTMLButtonElement>>","useThunderID","router: AppRouterInstance"],"sources":["../../../../../src/client/components/actions/SignInButton/SignInButton.tsx"],"sourcesContent":["/**\n * Copyright (c) 2025, WSO2 LLC. (https://www.wso2.com).\n *\n * WSO2 LLC. licenses this file to you under the Apache License,\n * Version 2.0 (the \"License\"); you may not use this file except\n * in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing,\n * software distributed under the License is distributed on an\n * \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY\n * KIND, either express or implied. See the License for the\n * specific language governing permissions and limitations\n * under the License.\n */\n\n'use client';\n\nimport {ThunderIDRuntimeError} from '@thunderid/node';\nimport {BaseSignInButton, BaseSignInButtonProps, useTranslation} from '@thunderid/react';\nimport {AppRouterInstance} from 'next/dist/shared/lib/app-router-context.shared-runtime';\nimport {useRouter} from 'next/navigation';\nimport {forwardRef, ForwardRefExoticComponent, ReactElement, Ref, RefAttributes, MouseEvent, useState} from 'react';\nimport useThunderID from '../../../contexts/ThunderID/useThunderID';\n\n/**\n * Props interface of {@link SignInButton}\n */\nexport type SignInButtonProps = BaseSignInButtonProps & {\n  /**\n   * Additional parameters to pass to the `authorize` request.\n   */\n  signInOptions?: Record<string, any>;\n};\n\n/**\n * SignInButton component that uses server actions for authentication in Next.js.\n *\n * @example Using render props\n * ```tsx\n * <SignInButton>\n *   {({isLoading}) => (\n *     <button type=\"submit\" disabled={isLoading}>\n *       {isLoading ? 'Signing in...' : 'Sign In'}\n *     </button>\n *   )}\n * </SignInButton>\n * ```\n *\n * @example Using traditional props\n * ```tsx\n * <SignInButton className=\"custom-button\">Sign In</SignInButton>\n * ```\n *\n * @remarks\n * In Next.js with server actions, the sign-in is handled via the server action.\n * When using render props, the custom button should use `type=\"submit\"` instead of `onClick={signIn}`.\n * The `signIn` function in render props is provided for API consistency but should not be used directly.\n */\nconst SignInButton: ForwardRefExoticComponent<SignInButtonProps & RefAttributes<HTMLButtonElement>> = forwardRef<\n  HTMLButtonElement,\n  SignInButtonProps\n>(\n  (\n    {className, style, children, preferences, onClick, signInOptions = {}, ...rest}: SignInButtonProps,\n    ref: Ref<HTMLButtonElement>,\n  ): ReactElement => {\n    const {signIn, signInUrl} = useThunderID();\n    const router: AppRouterInstance = useRouter();\n    const {t} = useTranslation(preferences?.i18n);\n\n    const [isLoading, setIsLoading] = useState(false);\n\n    const handleSignIn = async (): Promise<void> => {\n      try {\n        setIsLoading(true);\n\n        // If a custom `signInUrl` is provided, use it for navigation.\n        if (signInUrl) {\n          router.push(signInUrl);\n        } else if (signIn) {\n          await signIn(signInOptions);\n        }\n      } catch (error) {\n        throw new ThunderIDRuntimeError(\n          `Sign in failed: ${error instanceof Error ? error.message : String(error)}`,\n          'SignInButton-handleSignIn-RuntimeError-001',\n          'nextjs',\n          'Something went wrong while trying to sign in. Please try again later.',\n        );\n      } finally {\n        setIsLoading(false);\n      }\n    };\n\n    const handleOnClick = async (e: MouseEvent<HTMLButtonElement>): Promise<void> => {\n      await handleSignIn();\n      if (onClick) {\n        onClick(e);\n      }\n    };\n\n    return (\n      <BaseSignInButton\n        className={className}\n        style={style}\n        ref={ref}\n        preferences={preferences}\n        isLoading={isLoading}\n        signIn={handleSignIn}\n        onClick={handleOnClick}\n        {...rest}\n      >\n        {children ?? t('elements.buttons.signin.text')}\n      </BaseSignInButton>\n    );\n  },\n);\n\nSignInButton.displayName = 'SignInButton';\n\nexport default SignInButton;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA6DA,MAAMA,eAAgG,YAKlG,EAAC,WAAW,OAAO,UAAU,aAAa,SAAS,gBAAgB,EAAE,CAAE,GAAG,QAC1E,QACiB;CACjB,MAAM,EAAC,QAAQ,cAAaC,sBAAc;CAC1C,MAAMC,SAA4B,WAAW;CAC7C,MAAM,EAAC,MAAK,eAAe,aAAa,KAAK;CAE7C,MAAM,CAAC,WAAW,gBAAgB,SAAS,MAAM;CAEjD,MAAM,eAAe,YAA2B;AAC9C,MAAI;AACF,gBAAa,KAAK;AAGlB,OAAI,UACF,QAAO,KAAK,UAAU;YACb,OACT,OAAM,OAAO,cAAc;WAEtB,OAAO;AACd,SAAM,IAAI,sBACR,mBAAmB,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM,IACzE,8CACA,UACA,wEACD;YACO;AACR,gBAAa,MAAM;;;CAIvB,MAAM,gBAAgB,OAAO,MAAoD;AAC/E,QAAM,cAAc;AACpB,MAAI,QACF,SAAQ,EAAE;;AAId,QACE,oBAAC;EACY;EACJ;EACF;EACQ;EACF;EACX,QAAQ;EACR,SAAS;EACT,GAAI;YAEH,YAAY,EAAE,+BAA+B;GAC7B;EAGxB;AAED,aAAa,cAAc;AAE3B,2BAAe"}
+{"version":3,"file":"SignInButton.js","names":["SignInButton: ForwardRefExoticComponent<SignInButtonProps & RefAttributes<HTMLButtonElement>>","useThunderID","router: AppRouterInstance"],"sources":["../../../../../src/client/components/actions/SignInButton/SignInButton.tsx"],"sourcesContent":["// Copyright 2025 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\n'use client';\n\nimport {ThunderIDRuntimeError} from '@thunderid/node';\nimport {BaseSignInButton, BaseSignInButtonProps, useTranslation} from '@thunderid/react';\nimport {AppRouterInstance} from 'next/dist/shared/lib/app-router-context.shared-runtime';\nimport {useRouter} from 'next/navigation';\nimport {forwardRef, ForwardRefExoticComponent, ReactElement, Ref, RefAttributes, MouseEvent, useState} from 'react';\nimport useThunderID from '../../../contexts/ThunderID/useThunderID';\n\n/**\n * Props interface of {@link SignInButton}\n */\nexport type SignInButtonProps = BaseSignInButtonProps & {\n  /**\n   * Additional parameters to pass to the `authorize` request.\n   */\n  signInOptions?: Record<string, any>;\n};\n\n/**\n * SignInButton component that uses server actions for authentication in Next.js.\n *\n * @example Using render props\n * ```tsx\n * <SignInButton>\n *   {({isLoading}) => (\n *     <button type=\"submit\" disabled={isLoading}>\n *       {isLoading ? 'Signing in...' : 'Sign In'}\n *     </button>\n *   )}\n * </SignInButton>\n * ```\n *\n * @example Using traditional props\n * ```tsx\n * <SignInButton className=\"custom-button\">Sign In</SignInButton>\n * ```\n *\n * @remarks\n * In Next.js with server actions, the sign-in is handled via the server action.\n * When using render props, the custom button should use `type=\"submit\"` instead of `onClick={signIn}`.\n * The `signIn` function in render props is provided for API consistency but should not be used directly.\n */\nconst SignInButton: ForwardRefExoticComponent<SignInButtonProps & RefAttributes<HTMLButtonElement>> = forwardRef<\n  HTMLButtonElement,\n  SignInButtonProps\n>(\n  (\n    {className, style, children, preferences, onClick, signInOptions = {}, ...rest}: SignInButtonProps,\n    ref: Ref<HTMLButtonElement>,\n  ): ReactElement => {\n    const {signIn, signInUrl} = useThunderID();\n    const router: AppRouterInstance = useRouter();\n    const {t} = useTranslation(preferences?.i18n);\n\n    const [isLoading, setIsLoading] = useState(false);\n\n    const handleSignIn = async (): Promise<void> => {\n      try {\n        setIsLoading(true);\n\n        // If a custom `signInUrl` is provided, use it for navigation.\n        if (signInUrl) {\n          router.push(signInUrl);\n        } else if (signIn) {\n          await signIn(signInOptions);\n        }\n      } catch (error) {\n        throw new ThunderIDRuntimeError(\n          `Sign in failed: ${error instanceof Error ? error.message : String(error)}`,\n          'SignInButton-handleSignIn-RuntimeError-001',\n          'nextjs',\n          'Something went wrong while trying to sign in. Please try again later.',\n        );\n      } finally {\n        setIsLoading(false);\n      }\n    };\n\n    const handleOnClick = async (e: MouseEvent<HTMLButtonElement>): Promise<void> => {\n      await handleSignIn();\n      if (onClick) {\n        onClick(e);\n      }\n    };\n\n    return (\n      <BaseSignInButton\n        className={className}\n        style={style}\n        ref={ref}\n        preferences={preferences}\n        isLoading={isLoading}\n        signIn={handleSignIn}\n        onClick={handleOnClick}\n        {...rest}\n      >\n        {children ?? t('elements.buttons.signin.text')}\n      </BaseSignInButton>\n    );\n  },\n);\n\nSignInButton.displayName = 'SignInButton';\n\nexport default SignInButton;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA8CA,MAAMA,eAAgG,YAKlG,EAAC,WAAW,OAAO,UAAU,aAAa,SAAS,gBAAgB,EAAE,CAAE,GAAG,QAC1E,QACiB;CACjB,MAAM,EAAC,QAAQ,cAAaC,sBAAc;CAC1C,MAAMC,SAA4B,WAAW;CAC7C,MAAM,EAAC,MAAK,eAAe,aAAa,KAAK;CAE7C,MAAM,CAAC,WAAW,gBAAgB,SAAS,MAAM;CAEjD,MAAM,eAAe,YAA2B;AAC9C,MAAI;AACF,gBAAa,KAAK;AAGlB,OAAI,UACF,QAAO,KAAK,UAAU;YACb,OACT,OAAM,OAAO,cAAc;WAEtB,OAAO;AACd,SAAM,IAAI,sBACR,mBAAmB,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM,IACzE,8CACA,UACA,wEACD;YACO;AACR,gBAAa,MAAM;;;CAIvB,MAAM,gBAAgB,OAAO,MAAoD;AAC/E,QAAM,cAAc;AACpB,MAAI,QACF,SAAQ,EAAE;;AAId,QACE,oBAAC;EACY;EACJ;EACF;EACQ;EACF;EACX,QAAQ;EACR,SAAS;EACT,GAAI;YAEH,YAAY,EAAE,+BAA+B;GAC7B;EAGxB;AAED,aAAa,cAAc;AAE3B,2BAAe"}

package/dist/client/components/actions/SignOutButton/SignOutButton.d.ts

@@ -1,20 +1,3 @@
-/**
- * Copyright (c) 2025, WSO2 LLC. (https://www.wso2.com).
- *
- * WSO2 LLC. licenses this file to you under the Apache License,
- * Version 2.0 (the "License"); you may not use this file except
- * in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied. See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
 import { BaseSignOutButtonProps } from '@thunderid/react';
 import { ForwardRefExoticComponent, RefAttributes } from 'react';
 /**

package/dist/client/components/actions/SignOutButton/SignOutButton.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"SignOutButton.d.ts","sourceRoot":"","sources":["../../../../../src/client/components/actions/SignOutButton/SignOutButton.tsx"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAIH,OAAO,EAAoB,sBAAsB,EAAiB,MAAM,kBAAkB,CAAC;AAC3F,OAAO,EAAa,yBAAyB,EAAqB,aAAa,EAAuB,MAAM,OAAO,CAAC;AAIpH;;GAEG;AACH,MAAM,MAAM,kBAAkB,GAAG,sBAAsB,CAAC;AAExD;;;;;;;;;;;;;;;;GAgBG;AACH,QAAA,MAAM,aAAa,EAAE,yBAAyB,CAAC,kBAAkB,GAAG,aAAa,CAAC,iBAAiB,CAAC,CAqCnG,CAAC;AAEF,eAAe,aAAa,CAAC"}
+{"version":3,"file":"SignOutButton.d.ts","sourceRoot":"","sources":["../../../../../src/client/components/actions/SignOutButton/SignOutButton.tsx"],"names":[],"mappings":"AAKA,OAAO,EAAoB,sBAAsB,EAAiB,MAAM,kBAAkB,CAAC;AAC3F,OAAO,EAAa,yBAAyB,EAAqB,aAAa,EAAuB,MAAM,OAAO,CAAC;AAIpH;;GAEG;AACH,MAAM,MAAM,kBAAkB,GAAG,sBAAsB,CAAC;AAExD;;;;;;;;;;;;;;;;GAgBG;AACH,QAAA,MAAM,aAAa,EAAE,yBAAyB,CAAC,kBAAkB,GAAG,aAAa,CAAC,iBAAiB,CAAC,CAqCnG,CAAC;AAEF,eAAe,aAAa,CAAC"}

package/dist/client/components/actions/SignOutButton/SignOutButton.js.map

@@ -1 +1 @@
-{"version":3,"file":"SignOutButton.js","names":["SignOutButton: ForwardRefExoticComponent<SignOutButtonProps & RefAttributes<HTMLButtonElement>>","useThunderID"],"sources":["../../../../../src/client/components/actions/SignOutButton/SignOutButton.tsx"],"sourcesContent":["/**\n * Copyright (c) 2025, WSO2 LLC. (https://www.wso2.com).\n *\n * WSO2 LLC. licenses this file to you under the Apache License,\n * Version 2.0 (the \"License\"); you may not use this file except\n * in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing,\n * software distributed under the License is distributed on an\n * \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY\n * KIND, either express or implied. See the License for the\n * specific language governing permissions and limitations\n * under the License.\n */\n\n'use client';\n\nimport {BaseSignOutButton, BaseSignOutButtonProps, useTranslation} from '@thunderid/react';\nimport {forwardRef, ForwardRefExoticComponent, ReactElement, Ref, RefAttributes, useState, MouseEvent} from 'react';\nimport logger from '../../../../utils/logger';\nimport useThunderID from '../../../contexts/ThunderID/useThunderID';\n\n/**\n * Interface for SignInButton component props.\n */\nexport type SignOutButtonProps = BaseSignOutButtonProps;\n\n/**\n * SignInButton component. This button initiates the sign-in process when clicked.\n *\n * @example\n * ```tsx\n * import { SignInButton } from '@thunderid/auth-react';\n *\n * const App = () => {\n *   const buttonRef = useRef<HTMLButtonElement>(null);\n *   return (\n *     <SignInButton ref={buttonRef} className=\"custom-class\" style={{ backgroundColor: 'blue' }}>\n *       Sign In\n *     </SignInButton>\n *   );\n * }\n * ```\n */\nconst SignOutButton: ForwardRefExoticComponent<SignOutButtonProps & RefAttributes<HTMLButtonElement>> = forwardRef<\n  HTMLButtonElement,\n  SignOutButtonProps\n>(\n  (\n    {className, style, preferences, onClick, children, ...rest}: SignOutButtonProps,\n    ref: Ref<HTMLButtonElement>,\n  ): ReactElement => {\n    const {signOut} = useThunderID();\n    const {t} = useTranslation(preferences?.i18n);\n\n    const [isLoading, setIsLoading] = useState(false);\n\n    const handleOnClick = async (e: MouseEvent<HTMLButtonElement>): Promise<void> => {\n      try {\n        setIsLoading(true);\n\n        logger.debug('[SignOutButton] Initiating a sign-out from a button click');\n\n        await signOut();\n\n        if (onClick) {\n          onClick(e);\n        }\n      } catch (error) {\n        logger.error('[SignOutButton] Error occurred initiating sign-out from a button click:', error);\n      } finally {\n        setIsLoading(false);\n      }\n    };\n\n    return (\n      <BaseSignOutButton ref={ref} onClick={handleOnClick} isLoading={isLoading} preferences={preferences} {...rest}>\n        {children ?? t('elements.buttons.signout.text')}\n      </BaseSignOutButton>\n    );\n  },\n);\n\nexport default SignOutButton;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;AA+CA,MAAMA,gBAAkG,YAKpG,EAAC,WAAW,OAAO,aAAa,SAAS,SAAU,GAAG,QACtD,QACiB;CACjB,MAAM,EAAC,YAAWC,sBAAc;CAChC,MAAM,EAAC,MAAK,eAAe,aAAa,KAAK;CAE7C,MAAM,CAAC,WAAW,gBAAgB,SAAS,MAAM;CAEjD,MAAM,gBAAgB,OAAO,MAAoD;AAC/E,MAAI;AACF,gBAAa,KAAK;AAElB,kBAAO,MAAM,4DAA4D;AAEzE,SAAM,SAAS;AAEf,OAAI,QACF,SAAQ,EAAE;WAEL,OAAO;AACd,kBAAO,MAAM,2EAA2E,MAAM;YACtF;AACR,gBAAa,MAAM;;;AAIvB,QACE,oBAAC;EAAuB;EAAK,SAAS;EAA0B;EAAwB;EAAa,GAAI;YACtG,YAAY,EAAE,gCAAgC;GAC7B;EAGzB;AAED,4BAAe"}
+{"version":3,"file":"SignOutButton.js","names":["SignOutButton: ForwardRefExoticComponent<SignOutButtonProps & RefAttributes<HTMLButtonElement>>","useThunderID"],"sources":["../../../../../src/client/components/actions/SignOutButton/SignOutButton.tsx"],"sourcesContent":["// Copyright 2025 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\n'use client';\n\nimport {BaseSignOutButton, BaseSignOutButtonProps, useTranslation} from '@thunderid/react';\nimport {forwardRef, ForwardRefExoticComponent, ReactElement, Ref, RefAttributes, useState, MouseEvent} from 'react';\nimport logger from '../../../../utils/logger';\nimport useThunderID from '../../../contexts/ThunderID/useThunderID';\n\n/**\n * Interface for SignInButton component props.\n */\nexport type SignOutButtonProps = BaseSignOutButtonProps;\n\n/**\n * SignInButton component. This button initiates the sign-in process when clicked.\n *\n * @example\n * ```tsx\n * import { SignInButton } from '@thunderid/auth-react';\n *\n * const App = () => {\n *   const buttonRef = useRef<HTMLButtonElement>(null);\n *   return (\n *     <SignInButton ref={buttonRef} className=\"custom-class\" style={{ backgroundColor: 'blue' }}>\n *       Sign In\n *     </SignInButton>\n *   );\n * }\n * ```\n */\nconst SignOutButton: ForwardRefExoticComponent<SignOutButtonProps & RefAttributes<HTMLButtonElement>> = forwardRef<\n  HTMLButtonElement,\n  SignOutButtonProps\n>(\n  (\n    {className, style, preferences, onClick, children, ...rest}: SignOutButtonProps,\n    ref: Ref<HTMLButtonElement>,\n  ): ReactElement => {\n    const {signOut} = useThunderID();\n    const {t} = useTranslation(preferences?.i18n);\n\n    const [isLoading, setIsLoading] = useState(false);\n\n    const handleOnClick = async (e: MouseEvent<HTMLButtonElement>): Promise<void> => {\n      try {\n        setIsLoading(true);\n\n        logger.debug('[SignOutButton] Initiating a sign-out from a button click');\n\n        await signOut();\n\n        if (onClick) {\n          onClick(e);\n        }\n      } catch (error) {\n        logger.error('[SignOutButton] Error occurred initiating sign-out from a button click:', error);\n      } finally {\n        setIsLoading(false);\n      }\n    };\n\n    return (\n      <BaseSignOutButton ref={ref} onClick={handleOnClick} isLoading={isLoading} preferences={preferences} {...rest}>\n        {children ?? t('elements.buttons.signout.text')}\n      </BaseSignOutButton>\n    );\n  },\n);\n\nexport default SignOutButton;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;AAgCA,MAAMA,gBAAkG,YAKpG,EAAC,WAAW,OAAO,aAAa,SAAS,SAAU,GAAG,QACtD,QACiB;CACjB,MAAM,EAAC,YAAWC,sBAAc;CAChC,MAAM,EAAC,MAAK,eAAe,aAAa,KAAK;CAE7C,MAAM,CAAC,WAAW,gBAAgB,SAAS,MAAM;CAEjD,MAAM,gBAAgB,OAAO,MAAoD;AAC/E,MAAI;AACF,gBAAa,KAAK;AAElB,kBAAO,MAAM,4DAA4D;AAEzE,SAAM,SAAS;AAEf,OAAI,QACF,SAAQ,EAAE;WAEL,OAAO;AACd,kBAAO,MAAM,2EAA2E,MAAM;YACtF;AACR,gBAAa,MAAM;;;AAIvB,QACE,oBAAC;EAAuB;EAAK,SAAS;EAA0B;EAAwB;EAAa,GAAI;YACtG,YAAY,EAAE,gCAAgC;GAC7B;EAGzB;AAED,4BAAe"}

package/dist/client/components/actions/SignUpButton/SignUpButton.d.ts

@@ -1,20 +1,3 @@
-/**
- * Copyright (c) 2025, WSO2 LLC. (https://www.wso2.com).
- *
- * WSO2 LLC. licenses this file to you under the Apache License,
- * Version 2.0 (the "License"); you may not use this file except
- * in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied. See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
 import { BaseSignUpButtonProps } from '@thunderid/react';
 import { ForwardRefExoticComponent, RefAttributes } from 'react';
 /**

package/dist/client/components/actions/SignUpButton/SignUpButton.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"SignUpButton.d.ts","sourceRoot":"","sources":["../../../../../src/client/components/actions/SignUpButton/SignUpButton.tsx"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAKH,OAAO,EAAmB,qBAAqB,EAAiB,MAAM,kBAAkB,CAAC;AAGzF,OAAO,EAAa,yBAAyB,EAAiC,aAAa,EAAW,MAAM,OAAO,CAAC;AAGpH;;GAEG;AACH,MAAM,MAAM,iBAAiB,GAAG,qBAAqB,CAAC;AAEtD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AACH,QAAA,MAAM,YAAY,EAAE,yBAAyB,CAAC,iBAAiB,GAAG,aAAa,CAAC,iBAAiB,CAAC,CAgDhG,CAAC;AAIH,eAAe,YAAY,CAAC"}
+{"version":3,"file":"SignUpButton.d.ts","sourceRoot":"","sources":["../../../../../src/client/components/actions/SignUpButton/SignUpButton.tsx"],"names":[],"mappings":"AAMA,OAAO,EAAmB,qBAAqB,EAAiB,MAAM,kBAAkB,CAAC;AAGzF,OAAO,EAAa,yBAAyB,EAAiC,aAAa,EAAW,MAAM,OAAO,CAAC;AAGpH;;GAEG;AACH,MAAM,MAAM,iBAAiB,GAAG,qBAAqB,CAAC;AAEtD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AACH,QAAA,MAAM,YAAY,EAAE,yBAAyB,CAAC,iBAAiB,GAAG,aAAa,CAAC,iBAAiB,CAAC,CAgDhG,CAAC;AAIH,eAAe,YAAY,CAAC"}

package/dist/client/components/actions/SignUpButton/SignUpButton.js.map

@@ -1 +1 @@
-{"version":3,"file":"SignUpButton.js","names":["SignUpButton: ForwardRefExoticComponent<SignUpButtonProps & RefAttributes<HTMLButtonElement>>","useThunderID","router: AppRouterInstance"],"sources":["../../../../../src/client/components/actions/SignUpButton/SignUpButton.tsx"],"sourcesContent":["/**\n * Copyright (c) 2025, WSO2 LLC. (https://www.wso2.com).\n *\n * WSO2 LLC. licenses this file to you under the Apache License,\n * Version 2.0 (the \"License\"); you may not use this file except\n * in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing,\n * software distributed under the License is distributed on an\n * \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY\n * KIND, either express or implied. See the License for the\n * specific language governing permissions and limitations\n * under the License.\n */\n\n'use client';\n\nimport {ThunderIDRuntimeError} from '@thunderid/node';\nimport {BaseSignUpButton, BaseSignUpButtonProps, useTranslation} from '@thunderid/react';\nimport {AppRouterInstance} from 'next/dist/shared/lib/app-router-context.shared-runtime';\nimport {useRouter} from 'next/navigation';\nimport {forwardRef, ForwardRefExoticComponent, MouseEvent, ReactElement, Ref, RefAttributes, useState} from 'react';\nimport useThunderID from '../../../contexts/ThunderID/useThunderID';\n\n/**\n * Props interface of {@link SignUpButton}\n */\nexport type SignUpButtonProps = BaseSignUpButtonProps;\n\n/**\n * SignUpButton component that supports both render props and traditional props patterns.\n * It redirects the user to the ThunderID sign-up page configured for the application.\n *\n * @remarks This component is only supported in browser based React applications (CSR).\n *\n * @example Using render props pattern\n * ```tsx\n * <SignUpButton>\n *   {({ signUp, isLoading }) => (\n *     <button onClick={signUp} disabled={isLoading}>\n *       {isLoading ? 'Creating Account...' : 'Create Account'}\n *     </button>\n *   )}\n * </SignUpButton>\n * ```\n *\n * @example Using traditional props pattern\n * ```tsx\n * <SignUpButton className=\"custom-button\">Create Account</SignUpButton>\n * ```\n *\n * @example Using component-level preferences\n * ```tsx\n * <SignUpButton\n *   preferences={{\n *     i18n: {\n *       bundles: {\n *         'en-US': {\n *           translations: {\n *             'buttons.signUp': 'Custom Sign Up Text'\n *           }\n *         }\n *       }\n *     }\n *   }}\n * >\n *   Custom Sign Up\n * </SignUpButton>\n * ```\n */\nconst SignUpButton: ForwardRefExoticComponent<SignUpButtonProps & RefAttributes<HTMLButtonElement>> = forwardRef<\n  HTMLButtonElement,\n  SignUpButtonProps\n>(({children, onClick, preferences, ...rest}: SignUpButtonProps, ref: Ref<HTMLButtonElement>): ReactElement => {\n  const {signUp, signUpUrl} = useThunderID();\n  const router: AppRouterInstance = useRouter();\n  const {t} = useTranslation(preferences?.i18n);\n\n  const [isLoading, setIsLoading] = useState(false);\n\n  const handleSignUp = async (e?: MouseEvent<HTMLButtonElement>): Promise<void> => {\n    try {\n      setIsLoading(true);\n\n      // If a custom `signUpUrl` is provided, use it for navigation.\n      if (signUpUrl) {\n        router.push(signUpUrl);\n      } else if (signUp) {\n        await signUp();\n      }\n\n      if (onClick) {\n        onClick(e!);\n      }\n    } catch (error) {\n      throw new ThunderIDRuntimeError(\n        `Sign up failed: ${error instanceof Error ? error.message : String(error)}`,\n        'SignUpButton-handleSignUp-RuntimeError-001',\n        'nextjs',\n        'Something went wrong while trying to sign up. Please try again later.',\n      );\n    } finally {\n      setIsLoading(false);\n    }\n  };\n\n  return (\n    <BaseSignUpButton\n      ref={ref}\n      onClick={handleSignUp}\n      isLoading={isLoading}\n      signUp={handleSignUp}\n      preferences={preferences}\n      {...rest}\n    >\n      {children ?? t('elements.buttons.signup.text')}\n    </BaseSignUpButton>\n  );\n});\n\nSignUpButton.displayName = 'SignUpButton';\n\nexport default SignUpButton;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAyEA,MAAMA,eAAgG,YAGnG,EAAC,UAAU,SAAS,YAAa,GAAG,QAA0B,QAA8C;CAC7G,MAAM,EAAC,QAAQ,cAAaC,sBAAc;CAC1C,MAAMC,SAA4B,WAAW;CAC7C,MAAM,EAAC,MAAK,eAAe,aAAa,KAAK;CAE7C,MAAM,CAAC,WAAW,gBAAgB,SAAS,MAAM;CAEjD,MAAM,eAAe,OAAO,MAAqD;AAC/E,MAAI;AACF,gBAAa,KAAK;AAGlB,OAAI,UACF,QAAO,KAAK,UAAU;YACb,OACT,OAAM,QAAQ;AAGhB,OAAI,QACF,SAAQ,EAAG;WAEN,OAAO;AACd,SAAM,IAAI,sBACR,mBAAmB,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM,IACzE,8CACA,UACA,wEACD;YACO;AACR,gBAAa,MAAM;;;AAIvB,QACE,oBAAC;EACM;EACL,SAAS;EACE;EACX,QAAQ;EACK;EACb,GAAI;YAEH,YAAY,EAAE,+BAA+B;GAC7B;EAErB;AAEF,aAAa,cAAc;AAE3B,2BAAe"}
+{"version":3,"file":"SignUpButton.js","names":["SignUpButton: ForwardRefExoticComponent<SignUpButtonProps & RefAttributes<HTMLButtonElement>>","useThunderID","router: AppRouterInstance"],"sources":["../../../../../src/client/components/actions/SignUpButton/SignUpButton.tsx"],"sourcesContent":["// Copyright 2025 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\n'use client';\n\nimport {ThunderIDRuntimeError} from '@thunderid/node';\nimport {BaseSignUpButton, BaseSignUpButtonProps, useTranslation} from '@thunderid/react';\nimport {AppRouterInstance} from 'next/dist/shared/lib/app-router-context.shared-runtime';\nimport {useRouter} from 'next/navigation';\nimport {forwardRef, ForwardRefExoticComponent, MouseEvent, ReactElement, Ref, RefAttributes, useState} from 'react';\nimport useThunderID from '../../../contexts/ThunderID/useThunderID';\n\n/**\n * Props interface of {@link SignUpButton}\n */\nexport type SignUpButtonProps = BaseSignUpButtonProps;\n\n/**\n * SignUpButton component that supports both render props and traditional props patterns.\n * It redirects the user to the ThunderID sign-up page configured for the application.\n *\n * @remarks This component is only supported in browser based React applications (CSR).\n *\n * @example Using render props pattern\n * ```tsx\n * <SignUpButton>\n *   {({ signUp, isLoading }) => (\n *     <button onClick={signUp} disabled={isLoading}>\n *       {isLoading ? 'Creating Account...' : 'Create Account'}\n *     </button>\n *   )}\n * </SignUpButton>\n * ```\n *\n * @example Using traditional props pattern\n * ```tsx\n * <SignUpButton className=\"custom-button\">Create Account</SignUpButton>\n * ```\n *\n * @example Using component-level preferences\n * ```tsx\n * <SignUpButton\n *   preferences={{\n *     i18n: {\n *       bundles: {\n *         'en-US': {\n *           translations: {\n *             'buttons.signUp': 'Custom Sign Up Text'\n *           }\n *         }\n *       }\n *     }\n *   }}\n * >\n *   Custom Sign Up\n * </SignUpButton>\n * ```\n */\nconst SignUpButton: ForwardRefExoticComponent<SignUpButtonProps & RefAttributes<HTMLButtonElement>> = forwardRef<\n  HTMLButtonElement,\n  SignUpButtonProps\n>(({children, onClick, preferences, ...rest}: SignUpButtonProps, ref: Ref<HTMLButtonElement>): ReactElement => {\n  const {signUp, signUpUrl} = useThunderID();\n  const router: AppRouterInstance = useRouter();\n  const {t} = useTranslation(preferences?.i18n);\n\n  const [isLoading, setIsLoading] = useState(false);\n\n  const handleSignUp = async (e?: MouseEvent<HTMLButtonElement>): Promise<void> => {\n    try {\n      setIsLoading(true);\n\n      // If a custom `signUpUrl` is provided, use it for navigation.\n      if (signUpUrl) {\n        router.push(signUpUrl);\n      } else if (signUp) {\n        await signUp();\n      }\n\n      if (onClick) {\n        onClick(e!);\n      }\n    } catch (error) {\n      throw new ThunderIDRuntimeError(\n        `Sign up failed: ${error instanceof Error ? error.message : String(error)}`,\n        'SignUpButton-handleSignUp-RuntimeError-001',\n        'nextjs',\n        'Something went wrong while trying to sign up. Please try again later.',\n      );\n    } finally {\n      setIsLoading(false);\n    }\n  };\n\n  return (\n    <BaseSignUpButton\n      ref={ref}\n      onClick={handleSignUp}\n      isLoading={isLoading}\n      signUp={handleSignUp}\n      preferences={preferences}\n      {...rest}\n    >\n      {children ?? t('elements.buttons.signup.text')}\n    </BaseSignUpButton>\n  );\n});\n\nSignUpButton.displayName = 'SignUpButton';\n\nexport default SignUpButton;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA0DA,MAAMA,eAAgG,YAGnG,EAAC,UAAU,SAAS,YAAa,GAAG,QAA0B,QAA8C;CAC7G,MAAM,EAAC,QAAQ,cAAaC,sBAAc;CAC1C,MAAMC,SAA4B,WAAW;CAC7C,MAAM,EAAC,MAAK,eAAe,aAAa,KAAK;CAE7C,MAAM,CAAC,WAAW,gBAAgB,SAAS,MAAM;CAEjD,MAAM,eAAe,OAAO,MAAqD;AAC/E,MAAI;AACF,gBAAa,KAAK;AAGlB,OAAI,UACF,QAAO,KAAK,UAAU;YACb,OACT,OAAM,QAAQ;AAGhB,OAAI,QACF,SAAQ,EAAG;WAEN,OAAO;AACd,SAAM,IAAI,sBACR,mBAAmB,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM,IACzE,8CACA,UACA,wEACD;YACO;AACR,gBAAa,MAAM;;;AAIvB,QACE,oBAAC;EACM;EACL,SAAS;EACE;EACX,QAAQ;EACK;EACb,GAAI;YAEH,YAAY,EAAE,+BAA+B;GAC7B;EAErB;AAEF,aAAa,cAAc;AAE3B,2BAAe"}

package/dist/client/components/control/Loading/Loading.d.ts

@@ -1,20 +1,3 @@
-/**
- * Copyright (c) 2025, WSO2 LLC. (https://www.wso2.com).
- *
- * WSO2 LLC. licenses this file to you under the Apache License,
- * Version 2.0 (the "License"); you may not use this file except
- * in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied. See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
 import { FC, PropsWithChildren, ReactNode } from 'react';
 /**
  * Props for the Loading component.

package/dist/client/components/control/Loading/Loading.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Loading.d.ts","sourceRoot":"","sources":["../../../../../src/client/components/control/Loading/Loading.tsx"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAIH,OAAO,EAAC,EAAE,EAAE,iBAAiB,EAAE,SAAS,EAAC,MAAM,OAAO,CAAC;AAGvD;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B;;OAEG;IACH,QAAQ,CAAC,EAAE,SAAS,CAAC;CACtB;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,QAAA,MAAM,OAAO,EAAE,EAAE,CAAC,iBAAiB,CAAC,YAAY,CAAC,CAQhD,CAAC;AAIF,eAAe,OAAO,CAAC"}
+{"version":3,"file":"Loading.d.ts","sourceRoot":"","sources":["../../../../../src/client/components/control/Loading/Loading.tsx"],"names":[],"mappings":"AAKA,OAAO,EAAC,EAAE,EAAE,iBAAiB,EAAE,SAAS,EAAC,MAAM,OAAO,CAAC;AAGvD;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B;;OAEG;IACH,QAAQ,CAAC,EAAE,SAAS,CAAC;CACtB;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,QAAA,MAAM,OAAO,EAAE,EAAE,CAAC,iBAAiB,CAAC,YAAY,CAAC,CAQhD,CAAC;AAIF,eAAe,OAAO,CAAC"}

package/dist/client/components/control/SignedIn/SignedIn.d.ts

@@ -1,20 +1,3 @@
-/**
- * Copyright (c) 2025, WSO2 LLC. (https://www.wso2.com).
- *
- * WSO2 LLC. licenses this file to you under the Apache License,
- * Version 2.0 (the "License"); you may not use this file except
- * in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied. See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
 import { FC, PropsWithChildren, ReactNode } from 'react';
 /**
  * Props interface of {@link SignedIn}

package/dist/client/components/control/SignedIn/SignedIn.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"SignedIn.d.ts","sourceRoot":"","sources":["../../../../../src/client/components/control/SignedIn/SignedIn.tsx"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAIH,OAAO,EAAC,EAAE,EAAE,iBAAiB,EAAE,SAAS,EAAC,MAAM,OAAO,CAAC;AAGvD;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B;;OAEG;IACH,QAAQ,CAAC,EAAE,SAAS,CAAC;CACtB;AAED;;;;;;;;;;;;;;;GAeG;AACH,QAAA,MAAM,QAAQ,EAAE,EAAE,CAAC,iBAAiB,CAAC,aAAa,CAAC,CAOlD,CAAC;AAEF,eAAe,QAAQ,CAAC"}
+{"version":3,"file":"SignedIn.d.ts","sourceRoot":"","sources":["../../../../../src/client/components/control/SignedIn/SignedIn.tsx"],"names":[],"mappings":"AAKA,OAAO,EAAC,EAAE,EAAE,iBAAiB,EAAE,SAAS,EAAC,MAAM,OAAO,CAAC;AAGvD;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B;;OAEG;IACH,QAAQ,CAAC,EAAE,SAAS,CAAC;CACtB;AAED;;;;;;;;;;;;;;;GAeG;AACH,QAAA,MAAM,QAAQ,EAAE,EAAE,CAAC,iBAAiB,CAAC,aAAa,CAAC,CAOlD,CAAC;AAEF,eAAe,QAAQ,CAAC"}

package/dist/client/components/control/SignedIn/SignedIn.js.map

@@ -1 +1 @@
-{"version":3,"file":"SignedIn.js","names":["SignedIn: FC<PropsWithChildren<SignedInProps>>","useThunderID"],"sources":["../../../../../src/client/components/control/SignedIn/SignedIn.tsx"],"sourcesContent":["/**\n * Copyright (c) 2025, WSO2 LLC. (https://www.wso2.com).\n *\n * WSO2 LLC. licenses this file to you under the Apache License,\n * Version 2.0 (the \"License\"); you may not use this file except\n * in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing,\n * software distributed under the License is distributed on an\n * \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY\n * KIND, either express or implied. See the License for the\n * specific language governing permissions and limitations\n * under the License.\n */\n\n'use client';\n\nimport {FC, PropsWithChildren, ReactNode} from 'react';\nimport useThunderID from '../../../contexts/ThunderID/useThunderID';\n\n/**\n * Props interface of {@link SignedIn}\n */\nexport interface SignedInProps {\n  /**\n   * Content to show when the user is not signed in.\n   */\n  fallback?: ReactNode;\n}\n\n/**\n * A component that only renders its children when the user is signed in.\n *\n * @example\n * ```tsx\n * import { SignedIn } from '@thunderid/auth-next';\n *\n * const App = () => {\n *   return (\n *     <SignedIn fallback={<p>Please sign in to continue</p>}>\n *       <p>Welcome! You are signed in.</p>\n *     </SignedIn>\n *   );\n * }\n * ```\n */\nconst SignedIn: FC<PropsWithChildren<SignedInProps>> = ({\n  children,\n  fallback = null,\n}: PropsWithChildren<SignedInProps>) => {\n  const {isSignedIn} = useThunderID();\n\n  return <>{isSignedIn ? children : fallback}</>;\n};\n\nexport default SignedIn;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAiDA,MAAMA,YAAkD,EACtD,UACA,WAAW,WAC2B;CACtC,MAAM,EAAC,eAAcC,sBAAc;AAEnC,QAAO,0CAAG,aAAa,WAAW,WAAY;;AAGhD,uBAAe"}
+{"version":3,"file":"SignedIn.js","names":["SignedIn: FC<PropsWithChildren<SignedInProps>>","useThunderID"],"sources":["../../../../../src/client/components/control/SignedIn/SignedIn.tsx"],"sourcesContent":["// Copyright 2025 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\n'use client';\n\nimport {FC, PropsWithChildren, ReactNode} from 'react';\nimport useThunderID from '../../../contexts/ThunderID/useThunderID';\n\n/**\n * Props interface of {@link SignedIn}\n */\nexport interface SignedInProps {\n  /**\n   * Content to show when the user is not signed in.\n   */\n  fallback?: ReactNode;\n}\n\n/**\n * A component that only renders its children when the user is signed in.\n *\n * @example\n * ```tsx\n * import { SignedIn } from '@thunderid/auth-next';\n *\n * const App = () => {\n *   return (\n *     <SignedIn fallback={<p>Please sign in to continue</p>}>\n *       <p>Welcome! You are signed in.</p>\n *     </SignedIn>\n *   );\n * }\n * ```\n */\nconst SignedIn: FC<PropsWithChildren<SignedInProps>> = ({\n  children,\n  fallback = null,\n}: PropsWithChildren<SignedInProps>) => {\n  const {isSignedIn} = useThunderID();\n\n  return <>{isSignedIn ? children : fallback}</>;\n};\n\nexport default SignedIn;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAkCA,MAAMA,YAAkD,EACtD,UACA,WAAW,WAC2B;CACtC,MAAM,EAAC,eAAcC,sBAAc;AAEnC,QAAO,0CAAG,aAAa,WAAW,WAAY;;AAGhD,uBAAe"}

package/dist/client/components/control/SignedOut/SignedOut.d.ts

@@ -1,20 +1,3 @@
-/**
- * Copyright (c) 2025, WSO2 LLC. (https://www.wso2.com).
- *
- * WSO2 LLC. licenses this file to you under the Apache License,
- * Version 2.0 (the "License"); you may not use this file except
- * in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied. See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
 import { FC, PropsWithChildren, ReactNode } from 'react';
 /**
  * Props interface of {@link SignedOut}

package/dist/client/components/control/SignedOut/SignedOut.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"SignedOut.d.ts","sourceRoot":"","sources":["../../../../../src/client/components/control/SignedOut/SignedOut.tsx"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAIH,OAAO,EAAC,EAAE,EAAE,iBAAiB,EAAE,SAAS,EAAC,MAAM,OAAO,CAAC;AAGvD;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B;;OAEG;IACH,QAAQ,CAAC,EAAE,SAAS,CAAC;CACtB;AAED;;;;;;;;;;;;;;;GAeG;AACH,QAAA,MAAM,SAAS,EAAE,EAAE,CAAC,iBAAiB,CAAC,cAAc,CAAC,CAOpD,CAAC;AAEF,eAAe,SAAS,CAAC"}
+{"version":3,"file":"SignedOut.d.ts","sourceRoot":"","sources":["../../../../../src/client/components/control/SignedOut/SignedOut.tsx"],"names":[],"mappings":"AAKA,OAAO,EAAC,EAAE,EAAE,iBAAiB,EAAE,SAAS,EAAC,MAAM,OAAO,CAAC;AAGvD;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B;;OAEG;IACH,QAAQ,CAAC,EAAE,SAAS,CAAC;CACtB;AAED;;;;;;;;;;;;;;;GAeG;AACH,QAAA,MAAM,SAAS,EAAE,EAAE,CAAC,iBAAiB,CAAC,cAAc,CAAC,CAOpD,CAAC;AAEF,eAAe,SAAS,CAAC"}

package/dist/client/components/control/SignedOut/SignedOut.js.map

@@ -1 +1 @@
-{"version":3,"file":"SignedOut.js","names":["SignedOut: FC<PropsWithChildren<SignedOutProps>>","useThunderID"],"sources":["../../../../../src/client/components/control/SignedOut/SignedOut.tsx"],"sourcesContent":["/**\n * Copyright (c) 2025, WSO2 LLC. (https://www.wso2.com).\n *\n * WSO2 LLC. licenses this file to you under the Apache License,\n * Version 2.0 (the \"License\"); you may not use this file except\n * in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing,\n * software distributed under the License is distributed on an\n * \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY\n * KIND, either express or implied. See the License for the\n * specific language governing permissions and limitations\n * under the License.\n */\n\n'use client';\n\nimport {FC, PropsWithChildren, ReactNode} from 'react';\nimport useThunderID from '../../../contexts/ThunderID/useThunderID';\n\n/**\n * Props interface of {@link SignedOut}\n */\nexport interface SignedOutProps {\n  /**\n   * Content to show when the user is not signed-out.\n   */\n  fallback?: ReactNode;\n}\n\n/**\n * A component that only renders its children when the user is signed out.\n *\n * @example\n * ```tsx\n * import { SignedOut } from '@thunderid/auth-next';\n *\n * const App = () => {\n *   return (\n *     <SignedOut fallback={<p>Please sign out to continue</p>}>\n *       <p>Welcome! You are signed out.</p>\n *     </SignedOut>\n *   );\n * }\n * ```\n */\nconst SignedOut: FC<PropsWithChildren<SignedOutProps>> = ({\n  children,\n  fallback = null,\n}: PropsWithChildren<SignedOutProps>) => {\n  const {isSignedIn} = useThunderID();\n\n  return <>{!isSignedIn ? children : fallback}</>;\n};\n\nexport default SignedOut;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAiDA,MAAMA,aAAoD,EACxD,UACA,WAAW,WAC4B;CACvC,MAAM,EAAC,eAAcC,sBAAc;AAEnC,QAAO,0CAAG,CAAC,aAAa,WAAW,WAAY;;AAGjD,wBAAe"}
+{"version":3,"file":"SignedOut.js","names":["SignedOut: FC<PropsWithChildren<SignedOutProps>>","useThunderID"],"sources":["../../../../../src/client/components/control/SignedOut/SignedOut.tsx"],"sourcesContent":["// Copyright 2025 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\n'use client';\n\nimport {FC, PropsWithChildren, ReactNode} from 'react';\nimport useThunderID from '../../../contexts/ThunderID/useThunderID';\n\n/**\n * Props interface of {@link SignedOut}\n */\nexport interface SignedOutProps {\n  /**\n   * Content to show when the user is not signed-out.\n   */\n  fallback?: ReactNode;\n}\n\n/**\n * A component that only renders its children when the user is signed out.\n *\n * @example\n * ```tsx\n * import { SignedOut } from '@thunderid/auth-next';\n *\n * const App = () => {\n *   return (\n *     <SignedOut fallback={<p>Please sign out to continue</p>}>\n *       <p>Welcome! You are signed out.</p>\n *     </SignedOut>\n *   );\n * }\n * ```\n */\nconst SignedOut: FC<PropsWithChildren<SignedOutProps>> = ({\n  children,\n  fallback = null,\n}: PropsWithChildren<SignedOutProps>) => {\n  const {isSignedIn} = useThunderID();\n\n  return <>{!isSignedIn ? children : fallback}</>;\n};\n\nexport default SignedOut;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAkCA,MAAMA,aAAoD,EACxD,UACA,WAAW,WAC4B;CACvC,MAAM,EAAC,eAAcC,sBAAc;AAEnC,QAAO,0CAAG,CAAC,aAAa,WAAW,WAAY;;AAGjD,wBAAe"}

package/dist/client/components/presentation/SignIn/SignIn.d.ts

@@ -1,20 +1,3 @@
-/**
- * Copyright (c) 2025, WSO2 LLC. (https://www.wso2.com).
- *
- * WSO2 LLC. licenses this file to you under the Apache License,
- * Version 2.0 (the "License"); you may not use this file except
- * in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied. See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
 import { BaseSignInProps } from '@thunderid/react';
 import { FC } from 'react';
 /**

package/dist/client/components/presentation/SignIn/SignIn.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"SignIn.d.ts","sourceRoot":"","sources":["../../../../../src/client/components/presentation/SignIn/SignIn.tsx"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAKH,OAAO,EAAa,eAAe,EAAwC,MAAM,kBAAkB,CAAC;AACpG,OAAO,EAAC,EAAE,EAA8B,MAAM,OAAO,CAAC;AAGtD;;;GAGG;AACH,MAAM,MAAM,WAAW,GAAG,IAAI,CAAC,eAAe,EAAE,WAAW,GAAG,IAAI,GAAG,WAAW,GAAG,SAAS,GAAG,SAAS,GAAG,MAAM,CAAC,CAAC;AAEnH;;;;;GAKG;AACH,QAAA,MAAM,MAAM,EAAE,EAAE,CAAC,WAAW,CAmG3B,CAAC;AAIF,eAAe,MAAM,CAAC"}
+{"version":3,"file":"SignIn.d.ts","sourceRoot":"","sources":["../../../../../src/client/components/presentation/SignIn/SignIn.tsx"],"names":[],"mappings":"AAMA,OAAO,EAAa,eAAe,EAAwC,MAAM,kBAAkB,CAAC;AACpG,OAAO,EAAC,EAAE,EAA8B,MAAM,OAAO,CAAC;AAGtD;;;GAGG;AACH,MAAM,MAAM,WAAW,GAAG,IAAI,CAAC,eAAe,EAAE,WAAW,GAAG,IAAI,GAAG,WAAW,GAAG,SAAS,GAAG,SAAS,GAAG,MAAM,CAAC,CAAC;AAEnH;;;;;GAKG;AACH,QAAA,MAAM,MAAM,EAAE,EAAE,CAAC,WAAW,CAmG3B,CAAC;AAIF,eAAe,MAAM,CAAC"}

package/dist/client/components/presentation/SignIn/SignIn.js.map

@@ -1 +1 @@
-{"version":3,"file":"SignIn.js","names":["SignIn: FC<SignInProps>","useThunderID","normalizedError: Error","response: any"],"sources":["../../../../../src/client/components/presentation/SignIn/SignIn.tsx"],"sourcesContent":["/**\n * Copyright (c) 2025, WSO2 LLC. (https://www.wso2.com).\n *\n * WSO2 LLC. licenses this file to you under the Apache License,\n * Version 2.0 (the \"License\"); you may not use this file except\n * in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing,\n * software distributed under the License is distributed on an\n * \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY\n * KIND, either express or implied. See the License for the\n * specific language governing permissions and limitations\n * under the License.\n */\n\n'use client';\n\nimport {EmbeddedFlowComponent, EmbeddedFlowType, ThunderIDRuntimeError} from '@thunderid/node';\nimport {BaseSignIn, BaseSignInProps, normalizeFlowResponse, useTranslation} from '@thunderid/react';\nimport {FC, useEffect, useRef, useState} from 'react';\nimport useThunderID from '../../../contexts/ThunderID/useThunderID';\n\n/**\n * Props for the SignIn component.\n * Extends BaseSignInProps for full compatibility with the React BaseSignIn component\n */\nexport type SignInProps = Pick<BaseSignInProps, 'className' | 'id' | 'onSuccess' | 'onError' | 'variant' | 'size'>;\n\n/**\n * A SignIn component for Next.js that provides native authentication flow.\n * This component delegates to the BaseSignIn from @thunderid/react. Unlike BaseSignUp,\n * BaseSignIn does not manage its own flow state, so this component initiates the flow\n * (using the server-action-backed `signIn`) and tracks `components`/`executionId` itself.\n */\nconst SignIn: FC<SignInProps> = ({size = 'medium', variant = 'outlined', onError, ...rest}: SignInProps) => {\n  const {signIn, applicationId, scopes} = useThunderID();\n  const {t} = useTranslation();\n\n  const [components, setComponents] = useState<EmbeddedFlowComponent[]>([]);\n  const [additionalData, setAdditionalData] = useState<Record<string, any>>({});\n  const [executionId, setExecutionId] = useState<string | undefined>(undefined);\n  const [isFlowInitialized, setIsFlowInitialized] = useState(false);\n  const [flowError, setFlowError] = useState<Error | null>(null);\n  const initializationAttemptedRef = useRef(false);\n  // A fresh challenge token is required on every step to prevent replay attacks; the server\n  // rotates it on each response, so it's tracked in a ref (not state) to avoid a stale value\n  // from a closure captured before the previous response's state update committed.\n  const challengeTokenRef = useRef<string | undefined>(undefined);\n\n  const applyFlowResponse = (response: any): void => {\n    const normalized = normalizeFlowResponse(response, t, {resolveTranslations: false});\n\n    challengeTokenRef.current = response?.challengeToken ?? undefined;\n    setExecutionId(normalized.executionId ?? undefined);\n    setComponents(normalized.components);\n    setAdditionalData(normalized.additionalData);\n  };\n\n  const handleFlowError = (error: unknown): void => {\n    const normalizedError: Error = error instanceof Error ? error : new Error(String(error));\n\n    setFlowError(normalizedError);\n    onError?.(normalizedError);\n  };\n\n  useEffect(() => {\n    if (initializationAttemptedRef.current || !signIn) {\n      return;\n    }\n\n    initializationAttemptedRef.current = true;\n\n    (async (): Promise<void> => {\n      try {\n        const response: any = await signIn(\n          {\n            applicationId,\n            flowType: EmbeddedFlowType.Authentication,\n            ...(scopes && {scopes}),\n          },\n          {},\n        );\n\n        // `response` is undefined when the provider already redirected\n        // (OAuth-redirect or completed flows are handled there directly).\n        if (response) {\n          applyFlowResponse(response);\n        }\n      } catch (error) {\n        handleFlowError(error);\n      } finally {\n        setIsFlowInitialized(true);\n      }\n    })();\n    // eslint-disable-next-line react-hooks/exhaustive-deps\n  }, [signIn]);\n\n  const handleOnSubmit = async (payload: any): Promise<void> => {\n    if (!signIn) {\n      throw new ThunderIDRuntimeError(\n        '`signIn` function is not available.',\n        'SignIn-handleOnSubmit-RuntimeError-001',\n        'nextjs',\n      );\n    }\n\n    const response: any = await signIn(\n      {\n        ...payload,\n        executionId,\n        ...(challengeTokenRef.current ? {challengeToken: challengeTokenRef.current} : {}),\n      },\n      {},\n    );\n\n    if (response) {\n      applyFlowResponse(response);\n    }\n  };\n\n  return (\n    <BaseSignIn\n      additionalData={additionalData}\n      components={components}\n      error={flowError}\n      isLoading={!isFlowInitialized}\n      onError={onError}\n      onSubmit={handleOnSubmit}\n      size={size}\n      variant={variant}\n      {...rest}\n    />\n  );\n};\n\nSignIn.displayName = 'SignIn';\n\nexport default SignIn;\n"],"mappings":";;;;;;;;;;;;;;;;AAqCA,MAAMA,UAA2B,EAAC,OAAO,UAAU,UAAU,YAAY,QAAS,GAAG,WAAuB;CAC1G,MAAM,EAAC,QAAQ,eAAe,WAAUC,sBAAc;CACtD,MAAM,EAAC,MAAK,gBAAgB;CAE5B,MAAM,CAAC,YAAY,iBAAiB,SAAkC,EAAE,CAAC;CACzE,MAAM,CAAC,gBAAgB,qBAAqB,SAA8B,EAAE,CAAC;CAC7E,MAAM,CAAC,aAAa,kBAAkB,SAA6B,OAAU;CAC7E,MAAM,CAAC,mBAAmB,wBAAwB,SAAS,MAAM;CACjE,MAAM,CAAC,WAAW,gBAAgB,SAAuB,KAAK;CAC9D,MAAM,6BAA6B,OAAO,MAAM;CAIhD,MAAM,oBAAoB,OAA2B,OAAU;CAE/D,MAAM,qBAAqB,aAAwB;EACjD,MAAM,aAAa,sBAAsB,UAAU,GAAG,EAAC,qBAAqB,OAAM,CAAC;AAEnF,oBAAkB,UAAU,UAAU,kBAAkB;AACxD,iBAAe,WAAW,eAAe,OAAU;AACnD,gBAAc,WAAW,WAAW;AACpC,oBAAkB,WAAW,eAAe;;CAG9C,MAAM,mBAAmB,UAAyB;EAChD,MAAMC,kBAAyB,iBAAiB,QAAQ,QAAQ,IAAI,MAAM,OAAO,MAAM,CAAC;AAExF,eAAa,gBAAgB;AAC7B,YAAU,gBAAgB;;AAG5B,iBAAgB;AACd,MAAI,2BAA2B,WAAW,CAAC,OACzC;AAGF,6BAA2B,UAAU;AAErC,GAAC,YAA2B;AAC1B,OAAI;IACF,MAAMC,WAAgB,MAAM,OAC1B;KACE;KACA,UAAU,iBAAiB;KAC3B,GAAI,UAAU,EAAC,QAAO;KACvB,EACD,EAAE,CACH;AAID,QAAI,SACF,mBAAkB,SAAS;YAEtB,OAAO;AACd,oBAAgB,MAAM;aACd;AACR,yBAAqB,KAAK;;MAE1B;IAEH,CAAC,OAAO,CAAC;CAEZ,MAAM,iBAAiB,OAAO,YAAgC;AAC5D,MAAI,CAAC,OACH,OAAM,IAAI,sBACR,uCACA,0CACA,SACD;EAGH,MAAMA,WAAgB,MAAM,OAC1B;GACE,GAAG;GACH;GACA,GAAI,kBAAkB,UAAU,EAAC,gBAAgB,kBAAkB,SAAQ,GAAG,EAAE;GACjF,EACD,EAAE,CACH;AAED,MAAI,SACF,mBAAkB,SAAS;;AAI/B,QACE,oBAAC;EACiB;EACJ;EACZ,OAAO;EACP,WAAW,CAAC;EACH;EACT,UAAU;EACJ;EACG;EACT,GAAI;GACJ;;AAIN,OAAO,cAAc;AAErB,qBAAe"}
+{"version":3,"file":"SignIn.js","names":["SignIn: FC<SignInProps>","useThunderID","normalizedError: Error","response: any"],"sources":["../../../../../src/client/components/presentation/SignIn/SignIn.tsx"],"sourcesContent":["// Copyright 2025 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\n'use client';\n\nimport {EmbeddedFlowComponent, EmbeddedFlowType, ThunderIDRuntimeError} from '@thunderid/node';\nimport {BaseSignIn, BaseSignInProps, normalizeFlowResponse, useTranslation} from '@thunderid/react';\nimport {FC, useEffect, useRef, useState} from 'react';\nimport useThunderID from '../../../contexts/ThunderID/useThunderID';\n\n/**\n * Props for the SignIn component.\n * Extends BaseSignInProps for full compatibility with the React BaseSignIn component\n */\nexport type SignInProps = Pick<BaseSignInProps, 'className' | 'id' | 'onSuccess' | 'onError' | 'variant' | 'size'>;\n\n/**\n * A SignIn component for Next.js that provides native authentication flow.\n * This component delegates to the BaseSignIn from @thunderid/react. Unlike BaseSignUp,\n * BaseSignIn does not manage its own flow state, so this component initiates the flow\n * (using the server-action-backed `signIn`) and tracks `components`/`executionId` itself.\n */\nconst SignIn: FC<SignInProps> = ({size = 'medium', variant = 'outlined', onError, ...rest}: SignInProps) => {\n  const {signIn, applicationId, scopes} = useThunderID();\n  const {t} = useTranslation();\n\n  const [components, setComponents] = useState<EmbeddedFlowComponent[]>([]);\n  const [additionalData, setAdditionalData] = useState<Record<string, any>>({});\n  const [executionId, setExecutionId] = useState<string | undefined>(undefined);\n  const [isFlowInitialized, setIsFlowInitialized] = useState(false);\n  const [flowError, setFlowError] = useState<Error | null>(null);\n  const initializationAttemptedRef = useRef(false);\n  // A fresh challenge token is required on every step to prevent replay attacks; the server\n  // rotates it on each response, so it's tracked in a ref (not state) to avoid a stale value\n  // from a closure captured before the previous response's state update committed.\n  const challengeTokenRef = useRef<string | undefined>(undefined);\n\n  const applyFlowResponse = (response: any): void => {\n    const normalized = normalizeFlowResponse(response, t, {resolveTranslations: false});\n\n    challengeTokenRef.current = response?.challengeToken ?? undefined;\n    setExecutionId(normalized.executionId ?? undefined);\n    setComponents(normalized.components);\n    setAdditionalData(normalized.additionalData);\n  };\n\n  const handleFlowError = (error: unknown): void => {\n    const normalizedError: Error = error instanceof Error ? error : new Error(String(error));\n\n    setFlowError(normalizedError);\n    onError?.(normalizedError);\n  };\n\n  useEffect(() => {\n    if (initializationAttemptedRef.current || !signIn) {\n      return;\n    }\n\n    initializationAttemptedRef.current = true;\n\n    (async (): Promise<void> => {\n      try {\n        const response: any = await signIn(\n          {\n            applicationId,\n            flowType: EmbeddedFlowType.Authentication,\n            ...(scopes && {scopes}),\n          },\n          {},\n        );\n\n        // `response` is undefined when the provider already redirected\n        // (OAuth-redirect or completed flows are handled there directly).\n        if (response) {\n          applyFlowResponse(response);\n        }\n      } catch (error) {\n        handleFlowError(error);\n      } finally {\n        setIsFlowInitialized(true);\n      }\n    })();\n    // eslint-disable-next-line react-hooks/exhaustive-deps\n  }, [signIn]);\n\n  const handleOnSubmit = async (payload: any): Promise<void> => {\n    if (!signIn) {\n      throw new ThunderIDRuntimeError(\n        '`signIn` function is not available.',\n        'SignIn-handleOnSubmit-RuntimeError-001',\n        'nextjs',\n      );\n    }\n\n    const response: any = await signIn(\n      {\n        ...payload,\n        executionId,\n        ...(challengeTokenRef.current ? {challengeToken: challengeTokenRef.current} : {}),\n      },\n      {},\n    );\n\n    if (response) {\n      applyFlowResponse(response);\n    }\n  };\n\n  return (\n    <BaseSignIn\n      additionalData={additionalData}\n      components={components}\n      error={flowError}\n      isLoading={!isFlowInitialized}\n      onError={onError}\n      onSubmit={handleOnSubmit}\n      size={size}\n      variant={variant}\n      {...rest}\n    />\n  );\n};\n\nSignIn.displayName = 'SignIn';\n\nexport default SignIn;\n"],"mappings":";;;;;;;;;;;;;;;;AAsBA,MAAMA,UAA2B,EAAC,OAAO,UAAU,UAAU,YAAY,QAAS,GAAG,WAAuB;CAC1G,MAAM,EAAC,QAAQ,eAAe,WAAUC,sBAAc;CACtD,MAAM,EAAC,MAAK,gBAAgB;CAE5B,MAAM,CAAC,YAAY,iBAAiB,SAAkC,EAAE,CAAC;CACzE,MAAM,CAAC,gBAAgB,qBAAqB,SAA8B,EAAE,CAAC;CAC7E,MAAM,CAAC,aAAa,kBAAkB,SAA6B,OAAU;CAC7E,MAAM,CAAC,mBAAmB,wBAAwB,SAAS,MAAM;CACjE,MAAM,CAAC,WAAW,gBAAgB,SAAuB,KAAK;CAC9D,MAAM,6BAA6B,OAAO,MAAM;CAIhD,MAAM,oBAAoB,OAA2B,OAAU;CAE/D,MAAM,qBAAqB,aAAwB;EACjD,MAAM,aAAa,sBAAsB,UAAU,GAAG,EAAC,qBAAqB,OAAM,CAAC;AAEnF,oBAAkB,UAAU,UAAU,kBAAkB;AACxD,iBAAe,WAAW,eAAe,OAAU;AACnD,gBAAc,WAAW,WAAW;AACpC,oBAAkB,WAAW,eAAe;;CAG9C,MAAM,mBAAmB,UAAyB;EAChD,MAAMC,kBAAyB,iBAAiB,QAAQ,QAAQ,IAAI,MAAM,OAAO,MAAM,CAAC;AAExF,eAAa,gBAAgB;AAC7B,YAAU,gBAAgB;;AAG5B,iBAAgB;AACd,MAAI,2BAA2B,WAAW,CAAC,OACzC;AAGF,6BAA2B,UAAU;AAErC,GAAC,YAA2B;AAC1B,OAAI;IACF,MAAMC,WAAgB,MAAM,OAC1B;KACE;KACA,UAAU,iBAAiB;KAC3B,GAAI,UAAU,EAAC,QAAO;KACvB,EACD,EAAE,CACH;AAID,QAAI,SACF,mBAAkB,SAAS;YAEtB,OAAO;AACd,oBAAgB,MAAM;aACd;AACR,yBAAqB,KAAK;;MAE1B;IAEH,CAAC,OAAO,CAAC;CAEZ,MAAM,iBAAiB,OAAO,YAAgC;AAC5D,MAAI,CAAC,OACH,OAAM,IAAI,sBACR,uCACA,0CACA,SACD;EAGH,MAAMA,WAAgB,MAAM,OAC1B;GACE,GAAG;GACH;GACA,GAAI,kBAAkB,UAAU,EAAC,gBAAgB,kBAAkB,SAAQ,GAAG,EAAE;GACjF,EACD,EAAE,CACH;AAED,MAAI,SACF,mBAAkB,SAAS;;AAI/B,QACE,oBAAC;EACiB;EACJ;EACZ,OAAO;EACP,WAAW,CAAC;EACH;EACT,UAAU;EACJ;EACG;EACT,GAAI;GACJ;;AAIN,OAAO,cAAc;AAErB,qBAAe"}