@thunderid/nextjs 0.11.0 → 1.0.0

package/dist/ThunderIDNextClient.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ThunderIDNextClient.d.ts","sourceRoot":"","sources":["../src/ThunderIDNextClient.ts"],"names":[],"mappings":"AAGA,OAAO,EACL,mBAAmB,EAInB,iCAAiC,EACjC,OAAO,EACP,aAAa,EACb,aAAa,EACb,OAAO,EACP,0BAA0B,EAC1B,aAAa,EACb,IAAI,EACJ,WAAW,EAOZ,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAC,mBAAmB,EAAC,MAAM,iBAAiB,CAAC;AAKpD,cAAM,mBAAmB,CAAC,CAAC,SAAS,mBAAmB,GAAG,mBAAmB,CAAE,SAAQ,mBAAmB,CAAC,CAAC,CAAC;IACpG,aAAa,UAAS;;YAMf,iBAAiB;IAehB,UAAU,CAAC,MAAM,EAAE,CAAC,EAAE,OAAO,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IAwC1D,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC;IAclD,OAAO,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAsBvC,cAAc,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC;IA2BrD,iBAAiB,CAAC,OAAO,EAAE,GAAG,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAyBrE,SAAS,IAAI,OAAO;IAIpB,UAAU,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAIhD,aAAa,CAAC,MAAM,EAAE,0BAA0B,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,QAAQ,CAAC;IAKlG,cAAc,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAgBpD,iBAAiB,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAKzE,MAAM,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC;IA6BpC,OAAO,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC;IA4BxC,MAAM,CAAC,QAAQ,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC;IAUrD,cAAc,CAAC,QAAQ,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,GAAG,OAAO,CAAC;IAS7D,sBAAsB,CACjC,YAAY,EAAE,iCAAiC,EAC/C,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,MAAM,CAAC;IAKF,iBAAiB,IAAI,GAAG;IAIlB,YAAY,IAAI,OAAO,CAAC,IAAI,CAAC;IASpC,UAAU,CAAC,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIzF,cAAc,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC;CAGhF;AAED,eAAe,mBAAmB,CAAC"}
+{"version":3,"file":"ThunderIDNextClient.d.ts","sourceRoot":"","sources":["../src/ThunderIDNextClient.ts"],"names":[],"mappings":"AAGA,OAAO,EACL,mBAAmB,EAInB,iCAAiC,EACjC,OAAO,EACP,aAAa,EACb,aAAa,EACb,OAAO,EACP,0BAA0B,EAC1B,aAAa,EACb,IAAI,EACJ,WAAW,EAOZ,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAC,mBAAmB,EAAC,MAAM,iBAAiB,CAAC;AAKpD,cAAM,mBAAmB,CAAC,CAAC,SAAS,mBAAmB,GAAG,mBAAmB,CAAE,SAAQ,mBAAmB,CAAC,CAAC,CAAC;IACpG,aAAa,UAAS;;YAMf,iBAAiB;IAehB,UAAU,CAAC,MAAM,EAAE,CAAC,EAAE,OAAO,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IA0C1D,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC;IAclD,OAAO,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAsBvC,cAAc,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC;IA2BrD,iBAAiB,CAAC,OAAO,EAAE,GAAG,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAyBrE,SAAS,IAAI,OAAO;IAIpB,UAAU,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAIhD,aAAa,CAAC,MAAM,EAAE,0BAA0B,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,QAAQ,CAAC;IAKlG,cAAc,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAgBpD,iBAAiB,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAKzE,MAAM,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC;IA+BpC,OAAO,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC;IA4BxC,MAAM,CAAC,QAAQ,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC;IAUrD,cAAc,CAAC,QAAQ,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,GAAG,OAAO,CAAC;IAS7D,sBAAsB,CACjC,YAAY,EAAE,iCAAiC,EAC/C,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,MAAM,CAAC;IAKF,iBAAiB,IAAI,GAAG;IAIlB,YAAY,IAAI,OAAO,CAAC,IAAI,CAAC;IASpC,UAAU,CAAC,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIzF,cAAc,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC;CAGhF;AAED,eAAe,mBAAmB,CAAC"}

package/dist/ThunderIDNextClient.js

@@ -15,7 +15,7 @@ var ThunderIDNextClient = class extends ThunderIDNodeClient {
 	}
 	async initialize(config, storage) {
 		if (this.isInitialized) return Promise.resolve(true);
-		const { baseUrl, organizationHandle, clientId, clientSecret, signInUrl, afterSignInUrl, afterSignOutUrl, signUpUrl,...rest } = decorateConfigWithNextEnv_default(config);
+		const { baseUrl, organizationHandle, clientId, clientSecret, flowSecret, signInUrl, afterSignInUrl, afterSignOutUrl, signUpUrl,...rest } = decorateConfigWithNextEnv_default(config);
 		const origin = await getClientOrigin_default();
 		const initialized = await super.initialize({
 			...rest,
@@ -25,6 +25,7 @@ var ThunderIDNextClient = class extends ThunderIDNodeClient {
 			clientId,
 			clientSecret,
 			enablePKCE: rest.enablePKCE ?? true,
+			flowSecret,
 			organizationHandle,
 			signInUrl,
 			signUpUrl
@@ -120,7 +121,7 @@ var ThunderIDNextClient = class extends ThunderIDNodeClient {
 			const configData = await this.getStorageManager().getConfigData();
 			return executeEmbeddedSignInFlow({
 				baseUrl: configData?.baseUrl,
-				flowSecret: arg2?.flowSecret,
+				flowSecret: arg2?.flowSecret ?? configData?.flowSecret,
 				payload: arg1,
 				url: resolveResourceEndpoint("flowExecute", configData, arg2?.url)
 			});

package/dist/ThunderIDNextClient.js.map

@@ -1 +1 @@
-{"version":3,"file":"ThunderIDNextClient.js","names":["decorateConfigWithNextEnv","origin: string","getClientOrigin","initialized: boolean","resolvedSessionId: string","getSessionId","configData: AuthClientConfig<T>","baseUrl: string | undefined","profile: User","token: string | undefined","arg1: any","arg2: any","arg3: any","arg4: any","afterSignOutUrl: string","message: string"],"sources":["../src/ThunderIDNextClient.ts"],"sourcesContent":["// Copyright 2025 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\nimport {\n  ThunderIDNodeClient,\n  ThunderIDRuntimeError,\n  AuthClientConfig,\n  EmbeddedSignInFlowResponse,\n  ExtendedAuthorizeRequestUrlParams,\n  IdToken,\n  SignInOptions,\n  SignUpOptions,\n  Storage,\n  TokenExchangeRequestConfig,\n  TokenResponse,\n  User,\n  UserProfile,\n  executeEmbeddedSignInFlow,\n  extractUserClaimsFromIdToken,\n  generateFlattenedUserProfile,\n  getUsersMe,\n  updateMeProfile,\n  resolveResourceEndpoint,\n} from '@thunderid/node';\nimport {ThunderIDNextConfig} from './models/config';\nimport getClientOrigin from './server/actions/getClientOrigin';\nimport getSessionId from './server/actions/getSessionId';\nimport decorateConfigWithNextEnv from './utils/decorateConfigWithNextEnv';\n\nclass ThunderIDNextClient<T extends ThunderIDNextConfig = ThunderIDNextConfig> extends ThunderIDNodeClient<T> {\n  public isInitialized = false;\n\n  public constructor() {\n    super();\n  }\n\n  private async ensureInitialized(): Promise<void> {\n    if (!this.isInitialized) {\n      // Server actions may run in a module context that hasn't been through\n      // ThunderIDServerProvider (e.g. a different worker). Try to initialize\n      // from environment variables before giving up.\n      await this.initialize({} as T);\n    }\n\n    if (!this.isInitialized) {\n      throw new Error(\n        '[ThunderIDNextClient] Client is not initialized. Make sure you have wrapped your app with ThunderIDProvider and provided the required configuration (baseUrl, clientId, etc.).',\n      );\n    }\n  }\n\n  override async initialize(config: T, storage?: Storage): Promise<boolean> {\n    if (this.isInitialized) {\n      return Promise.resolve(true);\n    }\n\n    const {\n      baseUrl,\n      organizationHandle,\n      clientId,\n      clientSecret,\n      signInUrl,\n      afterSignInUrl,\n      afterSignOutUrl,\n      signUpUrl,\n      ...rest\n    } = decorateConfigWithNextEnv(config);\n\n    const origin: string = await getClientOrigin();\n\n    const initialized: boolean = await super.initialize(\n      {\n        ...rest,\n        afterSignInUrl: afterSignInUrl ?? origin,\n        afterSignOutUrl: afterSignOutUrl ?? origin,\n        baseUrl,\n        clientId,\n        clientSecret,\n        enablePKCE: (rest as any).enablePKCE ?? true,\n        organizationHandle,\n        signInUrl,\n        signUpUrl,\n      } as any,\n      storage,\n    );\n\n    this.isInitialized = initialized;\n\n    return initialized;\n  }\n\n  override async reInitialize(config: Partial<T>): Promise<boolean> {\n    try {\n      await super.reInitialize(config);\n      return true;\n    } catch (error) {\n      throw new ThunderIDRuntimeError(\n        `Failed to re-initialize the client: ${error instanceof Error ? error.message : String(error)}`,\n        'ThunderIDNextClient-reInitialize-RuntimeError-001',\n        'nextjs',\n        'An error occurred while re-initializing the client. Please check your configuration and network connection.',\n      );\n    }\n  }\n\n  override async getUser(userId?: string): Promise<User> {\n    await this.ensureInitialized();\n    const resolvedSessionId: string = userId || (await getSessionId())!;\n\n    try {\n      const configData: AuthClientConfig<T> = await this.getStorageManager().getConfigData();\n      const baseUrl: string | undefined = configData?.baseUrl;\n\n      const profile: User = await getUsersMe({\n        baseUrl,\n        url: resolveResourceEndpoint('usersMe', configData),\n        headers: {\n          Authorization: `Bearer ${await this.getAccessToken(userId)}`,\n        },\n      });\n\n      return profile;\n    } catch (error) {\n      return await super.getUser(resolvedSessionId);\n    }\n  }\n\n  override async getUserProfile(userId?: string): Promise<UserProfile> {\n    await this.ensureInitialized();\n\n    try {\n      const configData: AuthClientConfig<T> = await this.getStorageManager().getConfigData();\n      const baseUrl: string | undefined = configData?.baseUrl;\n\n      const profile: User = await getUsersMe({\n        baseUrl,\n        url: resolveResourceEndpoint('usersMe', configData),\n        headers: {\n          Authorization: `Bearer ${await this.getAccessToken(userId)}`,\n        },\n      });\n\n      return {\n        flattenedProfile: generateFlattenedUserProfile(profile),\n        profile,\n      };\n    } catch (error) {\n      return {\n        flattenedProfile: extractUserClaimsFromIdToken(await super.getDecodedIdToken(userId)),\n        profile: extractUserClaimsFromIdToken(await super.getDecodedIdToken(userId)),\n      };\n    }\n  }\n\n  override async updateUserProfile(payload: any, userId?: string): Promise<User> {\n    await this.ensureInitialized();\n\n    try {\n      const configData: AuthClientConfig<T> = await this.getStorageManager().getConfigData();\n      const baseUrl: string | undefined = configData?.baseUrl;\n\n      return updateMeProfile({\n        baseUrl,\n        url: resolveResourceEndpoint('usersMe', configData),\n        headers: {\n          Authorization: `Bearer ${await this.getAccessToken(userId)}`,\n        },\n        payload: payload?.payload ?? payload,\n      });\n    } catch (error) {\n      throw new ThunderIDRuntimeError(\n        `Failed to update user profile: ${error instanceof Error ? error.message : String(error)}`,\n        'ThunderIDNextClient-UpdateProfileError-001',\n        'react',\n        'An error occurred while updating the user profile. Please check your configuration and network connection.',\n      );\n    }\n  }\n\n  override isLoading(): boolean {\n    return false;\n  }\n\n  override isSignedIn(sessionId?: string): Promise<boolean> {\n    return super.isSignedIn(sessionId);\n  }\n\n  override exchangeToken(config: TokenExchangeRequestConfig, sessionId?: string): Promise<TokenResponse | Response> {\n    return super.exchangeToken(config, sessionId) as unknown as Promise<TokenResponse | Response>;\n  }\n\n  // eslint-disable-next-line @typescript-eslint/no-unused-vars\n  override async getAccessToken(_sessionId?: string): Promise<string> {\n    const {default: getAccessToken} = await import('./server/actions/getAccessToken');\n    const token: string | undefined = await getAccessToken();\n\n    if (typeof token !== 'string' || !token) {\n      throw new ThunderIDRuntimeError(\n        'Failed to get access token.',\n        'ThunderIDNextClient-getAccessToken-RuntimeError-003',\n        'nextjs',\n        'An error occurred while obtaining the access token. Please check your configuration and network connection.',\n      );\n    }\n\n    return token;\n  }\n\n  override async getDecodedIdToken(sessionId?: string, idToken?: string): Promise<IdToken> {\n    await this.ensureInitialized();\n    return await super.getDecodedIdToken(sessionId, idToken);\n  }\n\n  override async signIn(...args: any[]): Promise<any> {\n    const arg1: any = args[0];\n    const arg2: any = args[1];\n    const arg3: any = args[2];\n    const arg4: any = args[3];\n\n    // An embedded sign-in flow payload initiates or continues a `POST /flow/execute` step\n    // (identified by `applicationId` for a new flow or `executionId` to continue one). This is\n    // distinct from the OAuth authorization_code exchange handled by `super.signIn` below, which\n    // is used once the embedded flow completes and returns an authorization code.\n    const isEmbeddedFlowPayload: boolean =\n      typeof arg1 === 'object' && arg1 !== null && ('executionId' in arg1 || 'applicationId' in arg1);\n\n    if (isEmbeddedFlowPayload) {\n      await this.ensureInitialized();\n\n      const configData: AuthClientConfig<T> = await this.getStorageManager().getConfigData();\n\n      return executeEmbeddedSignInFlow({\n        baseUrl: configData?.baseUrl,\n        flowSecret: arg2?.flowSecret,\n        payload: arg1,\n        url: resolveResourceEndpoint('flowExecute', configData, arg2?.url),\n      }) as unknown as Promise<EmbeddedSignInFlowResponse>;\n    }\n\n    return super.signIn(arg4, arg3, arg1?.code, arg1?.session_state, arg1?.state, arg1) as unknown as Promise<User>;\n  }\n\n  override async signOut(...args: any[]): Promise<string> {\n    if (args[1] && typeof args[1] !== 'string') {\n      throw new Error('The second argument must be a string.');\n    }\n\n    const config: T = this.getConfiguration();\n    const afterSignOutUrl: string = config?.afterSignOutUrl || '/';\n\n    const resolvedSessionId: string = args[1] || (await getSessionId())!;\n\n    try {\n      await (super.signOut as (...a: any[]) => Promise<string>)(resolvedSessionId);\n    } catch (error) {\n      const message: string = error instanceof Error ? error.message : String(error);\n\n      if (\n        !message.includes('end_session_endpoint') &&\n        !message.includes('sign-out endpoint') &&\n        !message.includes('Sign-out endpoint') &&\n        !message.includes('Sign-out redirect URL')\n      ) {\n        throw error;\n      }\n    }\n\n    return afterSignOutUrl;\n  }\n\n  override async signUp(_options?: SignUpOptions): Promise<void> {\n    throw new ThunderIDRuntimeError(\n      'Not implemented',\n      'ThunderIDNextClient-ValidationError-002',\n      'nextjs',\n      'The signUp method is not implemented in the Next.js client.',\n    );\n  }\n\n  // eslint-disable-next-line @typescript-eslint/no-unused-vars\n  override signInSilently(_options?: SignInOptions): Promise<User | boolean> {\n    throw new ThunderIDRuntimeError(\n      'Not implemented',\n      'ThunderIDNextClient-signInSilently-NotImplementedError-001',\n      'nextjs',\n      'The signInSilently method is not implemented in the Next.js client.',\n    );\n  }\n\n  public async getAuthorizeRequestUrl(\n    customParams: ExtendedAuthorizeRequestUrlParams,\n    userId?: string,\n  ): Promise<string> {\n    await this.ensureInitialized();\n    return this.getSignInUrl(customParams, userId);\n  }\n\n  public override getStorageManager(): any {\n    return super.getStorageManager();\n  }\n\n  public override async clearSession(): Promise<void> {\n    throw new ThunderIDRuntimeError(\n      'Not implemented',\n      'ThunderIDNextClient-clearSession-NotImplementedError-001',\n      'nextjs',\n      'The clearSession method is not implemented in the Next.js client.',\n    );\n  }\n\n  override async setSession(sessionData: Record<string, unknown>, sessionId?: string): Promise<void> {\n    return this.getStorageManager().setSessionData(sessionData, sessionId);\n  }\n\n  override decodeJwtToken<R = Record<string, unknown>>(token: string): Promise<R> {\n    return super.decodeJwtToken<R>(token);\n  }\n}\n\nexport default ThunderIDNextClient;\n"],"mappings":";;;;;;AA6BA,IAAM,sBAAN,cAAuF,oBAAuB;CAC5G,AAAO,gBAAgB;CAEvB,AAAO,cAAc;AACnB,SAAO;;CAGT,MAAc,oBAAmC;AAC/C,MAAI,CAAC,KAAK,cAIR,OAAM,KAAK,WAAW,EAAE,CAAM;AAGhC,MAAI,CAAC,KAAK,cACR,OAAM,IAAI,MACR,iLACD;;CAIL,MAAe,WAAW,QAAW,SAAqC;AACxE,MAAI,KAAK,cACP,QAAO,QAAQ,QAAQ,KAAK;EAG9B,MAAM,EACJ,SACA,oBACA,UACA,cACA,WACA,gBACA,iBACA,UACA,GAAG,SACDA,kCAA0B,OAAO;EAErC,MAAMC,SAAiB,MAAMC,yBAAiB;EAE9C,MAAMC,cAAuB,MAAM,MAAM,WACvC;GACE,GAAG;GACH,gBAAgB,kBAAkB;GAClC,iBAAiB,mBAAmB;GACpC;GACA;GACA;GACA,YAAa,KAAa,cAAc;GACxC;GACA;GACA;GACD,EACD,QACD;AAED,OAAK,gBAAgB;AAErB,SAAO;;CAGT,MAAe,aAAa,QAAsC;AAChE,MAAI;AACF,SAAM,MAAM,aAAa,OAAO;AAChC,UAAO;WACA,OAAO;AACd,SAAM,IAAI,sBACR,uCAAuC,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM,IAC7F,qDACA,UACA,8GACD;;;CAIL,MAAe,QAAQ,QAAgC;AACrD,QAAM,KAAK,mBAAmB;EAC9B,MAAMC,oBAA4B,UAAW,MAAMC,sBAAc;AAEjE,MAAI;GACF,MAAMC,aAAkC,MAAM,KAAK,mBAAmB,CAAC,eAAe;GACtF,MAAMC,UAA8B,YAAY;AAUhD,UARsB,MAAM,WAAW;IACrC;IACA,KAAK,wBAAwB,WAAW,WAAW;IACnD,SAAS,EACP,eAAe,UAAU,MAAM,KAAK,eAAe,OAAO,IAC3D;IACF,CAAC;WAGK,OAAO;AACd,UAAO,MAAM,MAAM,QAAQ,kBAAkB;;;CAIjD,MAAe,eAAe,QAAuC;AACnE,QAAM,KAAK,mBAAmB;AAE9B,MAAI;GACF,MAAMD,aAAkC,MAAM,KAAK,mBAAmB,CAAC,eAAe;GACtF,MAAMC,UAA8B,YAAY;GAEhD,MAAMC,UAAgB,MAAM,WAAW;IACrC;IACA,KAAK,wBAAwB,WAAW,WAAW;IACnD,SAAS,EACP,eAAe,UAAU,MAAM,KAAK,eAAe,OAAO,IAC3D;IACF,CAAC;AAEF,UAAO;IACL,kBAAkB,6BAA6B,QAAQ;IACvD;IACD;WACM,OAAO;AACd,UAAO;IACL,kBAAkB,6BAA6B,MAAM,MAAM,kBAAkB,OAAO,CAAC;IACrF,SAAS,6BAA6B,MAAM,MAAM,kBAAkB,OAAO,CAAC;IAC7E;;;CAIL,MAAe,kBAAkB,SAAc,QAAgC;AAC7E,QAAM,KAAK,mBAAmB;AAE9B,MAAI;GACF,MAAMF,aAAkC,MAAM,KAAK,mBAAmB,CAAC,eAAe;GACtF,MAAMC,UAA8B,YAAY;AAEhD,UAAO,gBAAgB;IACrB;IACA,KAAK,wBAAwB,WAAW,WAAW;IACnD,SAAS,EACP,eAAe,UAAU,MAAM,KAAK,eAAe,OAAO,IAC3D;IACD,SAAS,SAAS,WAAW;IAC9B,CAAC;WACK,OAAO;AACd,SAAM,IAAI,sBACR,kCAAkC,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM,IACxF,8CACA,SACA,6GACD;;;CAIL,AAAS,YAAqB;AAC5B,SAAO;;CAGT,AAAS,WAAW,WAAsC;AACxD,SAAO,MAAM,WAAW,UAAU;;CAGpC,AAAS,cAAc,QAAoC,WAAuD;AAChH,SAAO,MAAM,cAAc,QAAQ,UAAU;;CAI/C,MAAe,eAAe,YAAsC;EAClE,MAAM,EAAC,SAAS,mBAAkB,MAAM,OAAO;EAC/C,MAAME,QAA4B,MAAM,gBAAgB;AAExD,MAAI,OAAO,UAAU,YAAY,CAAC,MAChC,OAAM,IAAI,sBACR,+BACA,uDACA,UACA,8GACD;AAGH,SAAO;;CAGT,MAAe,kBAAkB,WAAoB,SAAoC;AACvF,QAAM,KAAK,mBAAmB;AAC9B,SAAO,MAAM,MAAM,kBAAkB,WAAW,QAAQ;;CAG1D,MAAe,OAAO,GAAG,MAA2B;EAClD,MAAMC,OAAY,KAAK;EACvB,MAAMC,OAAY,KAAK;EACvB,MAAMC,OAAY,KAAK;EACvB,MAAMC,OAAY,KAAK;AASvB,MAFE,OAAO,SAAS,YAAY,SAAS,SAAS,iBAAiB,QAAQ,mBAAmB,OAEjE;AACzB,SAAM,KAAK,mBAAmB;GAE9B,MAAMP,aAAkC,MAAM,KAAK,mBAAmB,CAAC,eAAe;AAEtF,UAAO,0BAA0B;IAC/B,SAAS,YAAY;IACrB,YAAY,MAAM;IAClB,SAAS;IACT,KAAK,wBAAwB,eAAe,YAAY,MAAM,IAAI;IACnE,CAAC;;AAGJ,SAAO,MAAM,OAAO,MAAM,MAAM,MAAM,MAAM,MAAM,eAAe,MAAM,OAAO,KAAK;;CAGrF,MAAe,QAAQ,GAAG,MAA8B;AACtD,MAAI,KAAK,MAAM,OAAO,KAAK,OAAO,SAChC,OAAM,IAAI,MAAM,wCAAwC;EAI1D,MAAMQ,kBADY,KAAK,kBAAkB,EACD,mBAAmB;EAE3D,MAAMV,oBAA4B,KAAK,MAAO,MAAMC,sBAAc;AAElE,MAAI;AACF,SAAO,MAAM,QAA6C,kBAAkB;WACrE,OAAO;GACd,MAAMU,UAAkB,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM;AAE9E,OACE,CAAC,QAAQ,SAAS,uBAAuB,IACzC,CAAC,QAAQ,SAAS,oBAAoB,IACtC,CAAC,QAAQ,SAAS,oBAAoB,IACtC,CAAC,QAAQ,SAAS,wBAAwB,CAE1C,OAAM;;AAIV,SAAO;;CAGT,MAAe,OAAO,UAAyC;AAC7D,QAAM,IAAI,sBACR,mBACA,2CACA,UACA,8DACD;;CAIH,AAAS,eAAe,UAAmD;AACzE,QAAM,IAAI,sBACR,mBACA,8DACA,UACA,sEACD;;CAGH,MAAa,uBACX,cACA,QACiB;AACjB,QAAM,KAAK,mBAAmB;AAC9B,SAAO,KAAK,aAAa,cAAc,OAAO;;CAGhD,AAAgB,oBAAyB;AACvC,SAAO,MAAM,mBAAmB;;CAGlC,MAAsB,eAA8B;AAClD,QAAM,IAAI,sBACR,mBACA,4DACA,UACA,oEACD;;CAGH,MAAe,WAAW,aAAsC,WAAmC;AACjG,SAAO,KAAK,mBAAmB,CAAC,eAAe,aAAa,UAAU;;CAGxE,AAAS,eAA4C,OAA2B;AAC9E,SAAO,MAAM,eAAkB,MAAM;;;AAIzC,kCAAe"}
+{"version":3,"file":"ThunderIDNextClient.js","names":["decorateConfigWithNextEnv","origin: string","getClientOrigin","initialized: boolean","resolvedSessionId: string","getSessionId","configData: AuthClientConfig<T>","baseUrl: string | undefined","profile: User","token: string | undefined","arg1: any","arg2: any","arg3: any","arg4: any","configData: ThunderIDNextConfig","afterSignOutUrl: string","message: string"],"sources":["../src/ThunderIDNextClient.ts"],"sourcesContent":["// Copyright 2025 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\nimport {\n  ThunderIDNodeClient,\n  ThunderIDRuntimeError,\n  AuthClientConfig,\n  EmbeddedSignInFlowResponse,\n  ExtendedAuthorizeRequestUrlParams,\n  IdToken,\n  SignInOptions,\n  SignUpOptions,\n  Storage,\n  TokenExchangeRequestConfig,\n  TokenResponse,\n  User,\n  UserProfile,\n  executeEmbeddedSignInFlow,\n  extractUserClaimsFromIdToken,\n  generateFlattenedUserProfile,\n  getUsersMe,\n  updateMeProfile,\n  resolveResourceEndpoint,\n} from '@thunderid/node';\nimport {ThunderIDNextConfig} from './models/config';\nimport getClientOrigin from './server/actions/getClientOrigin';\nimport getSessionId from './server/actions/getSessionId';\nimport decorateConfigWithNextEnv from './utils/decorateConfigWithNextEnv';\n\nclass ThunderIDNextClient<T extends ThunderIDNextConfig = ThunderIDNextConfig> extends ThunderIDNodeClient<T> {\n  public isInitialized = false;\n\n  public constructor() {\n    super();\n  }\n\n  private async ensureInitialized(): Promise<void> {\n    if (!this.isInitialized) {\n      // Server actions may run in a module context that hasn't been through\n      // ThunderIDServerProvider (e.g. a different worker). Try to initialize\n      // from environment variables before giving up.\n      await this.initialize({} as T);\n    }\n\n    if (!this.isInitialized) {\n      throw new Error(\n        '[ThunderIDNextClient] Client is not initialized. Make sure you have wrapped your app with ThunderIDProvider and provided the required configuration (baseUrl, clientId, etc.).',\n      );\n    }\n  }\n\n  override async initialize(config: T, storage?: Storage): Promise<boolean> {\n    if (this.isInitialized) {\n      return Promise.resolve(true);\n    }\n\n    const {\n      baseUrl,\n      organizationHandle,\n      clientId,\n      clientSecret,\n      flowSecret,\n      signInUrl,\n      afterSignInUrl,\n      afterSignOutUrl,\n      signUpUrl,\n      ...rest\n    } = decorateConfigWithNextEnv(config);\n\n    const origin: string = await getClientOrigin();\n\n    const initialized: boolean = await super.initialize(\n      {\n        ...rest,\n        afterSignInUrl: afterSignInUrl ?? origin,\n        afterSignOutUrl: afterSignOutUrl ?? origin,\n        baseUrl,\n        clientId,\n        clientSecret,\n        enablePKCE: (rest as any).enablePKCE ?? true,\n        flowSecret,\n        organizationHandle,\n        signInUrl,\n        signUpUrl,\n      } as any,\n      storage,\n    );\n\n    this.isInitialized = initialized;\n\n    return initialized;\n  }\n\n  override async reInitialize(config: Partial<T>): Promise<boolean> {\n    try {\n      await super.reInitialize(config);\n      return true;\n    } catch (error) {\n      throw new ThunderIDRuntimeError(\n        `Failed to re-initialize the client: ${error instanceof Error ? error.message : String(error)}`,\n        'ThunderIDNextClient-reInitialize-RuntimeError-001',\n        'nextjs',\n        'An error occurred while re-initializing the client. Please check your configuration and network connection.',\n      );\n    }\n  }\n\n  override async getUser(userId?: string): Promise<User> {\n    await this.ensureInitialized();\n    const resolvedSessionId: string = userId || (await getSessionId())!;\n\n    try {\n      const configData: AuthClientConfig<T> = await this.getStorageManager().getConfigData();\n      const baseUrl: string | undefined = configData?.baseUrl;\n\n      const profile: User = await getUsersMe({\n        baseUrl,\n        url: resolveResourceEndpoint('usersMe', configData),\n        headers: {\n          Authorization: `Bearer ${await this.getAccessToken(userId)}`,\n        },\n      });\n\n      return profile;\n    } catch (error) {\n      return await super.getUser(resolvedSessionId);\n    }\n  }\n\n  override async getUserProfile(userId?: string): Promise<UserProfile> {\n    await this.ensureInitialized();\n\n    try {\n      const configData: AuthClientConfig<T> = await this.getStorageManager().getConfigData();\n      const baseUrl: string | undefined = configData?.baseUrl;\n\n      const profile: User = await getUsersMe({\n        baseUrl,\n        url: resolveResourceEndpoint('usersMe', configData),\n        headers: {\n          Authorization: `Bearer ${await this.getAccessToken(userId)}`,\n        },\n      });\n\n      return {\n        flattenedProfile: generateFlattenedUserProfile(profile),\n        profile,\n      };\n    } catch (error) {\n      return {\n        flattenedProfile: extractUserClaimsFromIdToken(await super.getDecodedIdToken(userId)),\n        profile: extractUserClaimsFromIdToken(await super.getDecodedIdToken(userId)),\n      };\n    }\n  }\n\n  override async updateUserProfile(payload: any, userId?: string): Promise<User> {\n    await this.ensureInitialized();\n\n    try {\n      const configData: AuthClientConfig<T> = await this.getStorageManager().getConfigData();\n      const baseUrl: string | undefined = configData?.baseUrl;\n\n      return updateMeProfile({\n        baseUrl,\n        url: resolveResourceEndpoint('usersMe', configData),\n        headers: {\n          Authorization: `Bearer ${await this.getAccessToken(userId)}`,\n        },\n        payload: payload?.payload ?? payload,\n      });\n    } catch (error) {\n      throw new ThunderIDRuntimeError(\n        `Failed to update user profile: ${error instanceof Error ? error.message : String(error)}`,\n        'ThunderIDNextClient-UpdateProfileError-001',\n        'react',\n        'An error occurred while updating the user profile. Please check your configuration and network connection.',\n      );\n    }\n  }\n\n  override isLoading(): boolean {\n    return false;\n  }\n\n  override isSignedIn(sessionId?: string): Promise<boolean> {\n    return super.isSignedIn(sessionId);\n  }\n\n  override exchangeToken(config: TokenExchangeRequestConfig, sessionId?: string): Promise<TokenResponse | Response> {\n    return super.exchangeToken(config, sessionId) as unknown as Promise<TokenResponse | Response>;\n  }\n\n  // eslint-disable-next-line @typescript-eslint/no-unused-vars\n  override async getAccessToken(_sessionId?: string): Promise<string> {\n    const {default: getAccessToken} = await import('./server/actions/getAccessToken');\n    const token: string | undefined = await getAccessToken();\n\n    if (typeof token !== 'string' || !token) {\n      throw new ThunderIDRuntimeError(\n        'Failed to get access token.',\n        'ThunderIDNextClient-getAccessToken-RuntimeError-003',\n        'nextjs',\n        'An error occurred while obtaining the access token. Please check your configuration and network connection.',\n      );\n    }\n\n    return token;\n  }\n\n  override async getDecodedIdToken(sessionId?: string, idToken?: string): Promise<IdToken> {\n    await this.ensureInitialized();\n    return await super.getDecodedIdToken(sessionId, idToken);\n  }\n\n  override async signIn(...args: any[]): Promise<any> {\n    const arg1: any = args[0];\n    const arg2: any = args[1];\n    const arg3: any = args[2];\n    const arg4: any = args[3];\n\n    // An embedded sign-in flow payload initiates or continues a `POST /flow/execute` step\n    // (identified by `applicationId` for a new flow or `executionId` to continue one). This is\n    // distinct from the OAuth authorization_code exchange handled by `super.signIn` below, which\n    // is used once the embedded flow completes and returns an authorization code.\n    const isEmbeddedFlowPayload: boolean =\n      typeof arg1 === 'object' && arg1 !== null && ('executionId' in arg1 || 'applicationId' in arg1);\n\n    if (isEmbeddedFlowPayload) {\n      await this.ensureInitialized();\n\n      // Typed as the Next config rather than `AuthClientConfig<T>` because the server-only\n      // `flowSecret` lives on `ThunderIDNodeConfig`, which the generic base config does not expose.\n      const configData: ThunderIDNextConfig = (await this.getStorageManager().getConfigData()) as ThunderIDNextConfig;\n\n      return executeEmbeddedSignInFlow({\n        baseUrl: configData?.baseUrl,\n        flowSecret: arg2?.flowSecret ?? configData?.flowSecret,\n        payload: arg1,\n        url: resolveResourceEndpoint('flowExecute', configData, arg2?.url),\n      }) as unknown as Promise<EmbeddedSignInFlowResponse>;\n    }\n\n    return super.signIn(arg4, arg3, arg1?.code, arg1?.session_state, arg1?.state, arg1) as unknown as Promise<User>;\n  }\n\n  override async signOut(...args: any[]): Promise<string> {\n    if (args[1] && typeof args[1] !== 'string') {\n      throw new Error('The second argument must be a string.');\n    }\n\n    const config: T = this.getConfiguration();\n    const afterSignOutUrl: string = config?.afterSignOutUrl || '/';\n\n    const resolvedSessionId: string = args[1] || (await getSessionId())!;\n\n    try {\n      await (super.signOut as (...a: any[]) => Promise<string>)(resolvedSessionId);\n    } catch (error) {\n      const message: string = error instanceof Error ? error.message : String(error);\n\n      if (\n        !message.includes('end_session_endpoint') &&\n        !message.includes('sign-out endpoint') &&\n        !message.includes('Sign-out endpoint') &&\n        !message.includes('Sign-out redirect URL')\n      ) {\n        throw error;\n      }\n    }\n\n    return afterSignOutUrl;\n  }\n\n  override async signUp(_options?: SignUpOptions): Promise<void> {\n    throw new ThunderIDRuntimeError(\n      'Not implemented',\n      'ThunderIDNextClient-ValidationError-002',\n      'nextjs',\n      'The signUp method is not implemented in the Next.js client.',\n    );\n  }\n\n  // eslint-disable-next-line @typescript-eslint/no-unused-vars\n  override signInSilently(_options?: SignInOptions): Promise<User | boolean> {\n    throw new ThunderIDRuntimeError(\n      'Not implemented',\n      'ThunderIDNextClient-signInSilently-NotImplementedError-001',\n      'nextjs',\n      'The signInSilently method is not implemented in the Next.js client.',\n    );\n  }\n\n  public async getAuthorizeRequestUrl(\n    customParams: ExtendedAuthorizeRequestUrlParams,\n    userId?: string,\n  ): Promise<string> {\n    await this.ensureInitialized();\n    return this.getSignInUrl(customParams, userId);\n  }\n\n  public override getStorageManager(): any {\n    return super.getStorageManager();\n  }\n\n  public override async clearSession(): Promise<void> {\n    throw new ThunderIDRuntimeError(\n      'Not implemented',\n      'ThunderIDNextClient-clearSession-NotImplementedError-001',\n      'nextjs',\n      'The clearSession method is not implemented in the Next.js client.',\n    );\n  }\n\n  override async setSession(sessionData: Record<string, unknown>, sessionId?: string): Promise<void> {\n    return this.getStorageManager().setSessionData(sessionData, sessionId);\n  }\n\n  override decodeJwtToken<R = Record<string, unknown>>(token: string): Promise<R> {\n    return super.decodeJwtToken<R>(token);\n  }\n}\n\nexport default ThunderIDNextClient;\n"],"mappings":";;;;;;AA6BA,IAAM,sBAAN,cAAuF,oBAAuB;CAC5G,AAAO,gBAAgB;CAEvB,AAAO,cAAc;AACnB,SAAO;;CAGT,MAAc,oBAAmC;AAC/C,MAAI,CAAC,KAAK,cAIR,OAAM,KAAK,WAAW,EAAE,CAAM;AAGhC,MAAI,CAAC,KAAK,cACR,OAAM,IAAI,MACR,iLACD;;CAIL,MAAe,WAAW,QAAW,SAAqC;AACxE,MAAI,KAAK,cACP,QAAO,QAAQ,QAAQ,KAAK;EAG9B,MAAM,EACJ,SACA,oBACA,UACA,cACA,YACA,WACA,gBACA,iBACA,UACA,GAAG,SACDA,kCAA0B,OAAO;EAErC,MAAMC,SAAiB,MAAMC,yBAAiB;EAE9C,MAAMC,cAAuB,MAAM,MAAM,WACvC;GACE,GAAG;GACH,gBAAgB,kBAAkB;GAClC,iBAAiB,mBAAmB;GACpC;GACA;GACA;GACA,YAAa,KAAa,cAAc;GACxC;GACA;GACA;GACA;GACD,EACD,QACD;AAED,OAAK,gBAAgB;AAErB,SAAO;;CAGT,MAAe,aAAa,QAAsC;AAChE,MAAI;AACF,SAAM,MAAM,aAAa,OAAO;AAChC,UAAO;WACA,OAAO;AACd,SAAM,IAAI,sBACR,uCAAuC,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM,IAC7F,qDACA,UACA,8GACD;;;CAIL,MAAe,QAAQ,QAAgC;AACrD,QAAM,KAAK,mBAAmB;EAC9B,MAAMC,oBAA4B,UAAW,MAAMC,sBAAc;AAEjE,MAAI;GACF,MAAMC,aAAkC,MAAM,KAAK,mBAAmB,CAAC,eAAe;GACtF,MAAMC,UAA8B,YAAY;AAUhD,UARsB,MAAM,WAAW;IACrC;IACA,KAAK,wBAAwB,WAAW,WAAW;IACnD,SAAS,EACP,eAAe,UAAU,MAAM,KAAK,eAAe,OAAO,IAC3D;IACF,CAAC;WAGK,OAAO;AACd,UAAO,MAAM,MAAM,QAAQ,kBAAkB;;;CAIjD,MAAe,eAAe,QAAuC;AACnE,QAAM,KAAK,mBAAmB;AAE9B,MAAI;GACF,MAAMD,aAAkC,MAAM,KAAK,mBAAmB,CAAC,eAAe;GACtF,MAAMC,UAA8B,YAAY;GAEhD,MAAMC,UAAgB,MAAM,WAAW;IACrC;IACA,KAAK,wBAAwB,WAAW,WAAW;IACnD,SAAS,EACP,eAAe,UAAU,MAAM,KAAK,eAAe,OAAO,IAC3D;IACF,CAAC;AAEF,UAAO;IACL,kBAAkB,6BAA6B,QAAQ;IACvD;IACD;WACM,OAAO;AACd,UAAO;IACL,kBAAkB,6BAA6B,MAAM,MAAM,kBAAkB,OAAO,CAAC;IACrF,SAAS,6BAA6B,MAAM,MAAM,kBAAkB,OAAO,CAAC;IAC7E;;;CAIL,MAAe,kBAAkB,SAAc,QAAgC;AAC7E,QAAM,KAAK,mBAAmB;AAE9B,MAAI;GACF,MAAMF,aAAkC,MAAM,KAAK,mBAAmB,CAAC,eAAe;GACtF,MAAMC,UAA8B,YAAY;AAEhD,UAAO,gBAAgB;IACrB;IACA,KAAK,wBAAwB,WAAW,WAAW;IACnD,SAAS,EACP,eAAe,UAAU,MAAM,KAAK,eAAe,OAAO,IAC3D;IACD,SAAS,SAAS,WAAW;IAC9B,CAAC;WACK,OAAO;AACd,SAAM,IAAI,sBACR,kCAAkC,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM,IACxF,8CACA,SACA,6GACD;;;CAIL,AAAS,YAAqB;AAC5B,SAAO;;CAGT,AAAS,WAAW,WAAsC;AACxD,SAAO,MAAM,WAAW,UAAU;;CAGpC,AAAS,cAAc,QAAoC,WAAuD;AAChH,SAAO,MAAM,cAAc,QAAQ,UAAU;;CAI/C,MAAe,eAAe,YAAsC;EAClE,MAAM,EAAC,SAAS,mBAAkB,MAAM,OAAO;EAC/C,MAAME,QAA4B,MAAM,gBAAgB;AAExD,MAAI,OAAO,UAAU,YAAY,CAAC,MAChC,OAAM,IAAI,sBACR,+BACA,uDACA,UACA,8GACD;AAGH,SAAO;;CAGT,MAAe,kBAAkB,WAAoB,SAAoC;AACvF,QAAM,KAAK,mBAAmB;AAC9B,SAAO,MAAM,MAAM,kBAAkB,WAAW,QAAQ;;CAG1D,MAAe,OAAO,GAAG,MAA2B;EAClD,MAAMC,OAAY,KAAK;EACvB,MAAMC,OAAY,KAAK;EACvB,MAAMC,OAAY,KAAK;EACvB,MAAMC,OAAY,KAAK;AASvB,MAFE,OAAO,SAAS,YAAY,SAAS,SAAS,iBAAiB,QAAQ,mBAAmB,OAEjE;AACzB,SAAM,KAAK,mBAAmB;GAI9B,MAAMC,aAAmC,MAAM,KAAK,mBAAmB,CAAC,eAAe;AAEvF,UAAO,0BAA0B;IAC/B,SAAS,YAAY;IACrB,YAAY,MAAM,cAAc,YAAY;IAC5C,SAAS;IACT,KAAK,wBAAwB,eAAe,YAAY,MAAM,IAAI;IACnE,CAAC;;AAGJ,SAAO,MAAM,OAAO,MAAM,MAAM,MAAM,MAAM,MAAM,eAAe,MAAM,OAAO,KAAK;;CAGrF,MAAe,QAAQ,GAAG,MAA8B;AACtD,MAAI,KAAK,MAAM,OAAO,KAAK,OAAO,SAChC,OAAM,IAAI,MAAM,wCAAwC;EAI1D,MAAMC,kBADY,KAAK,kBAAkB,EACD,mBAAmB;EAE3D,MAAMX,oBAA4B,KAAK,MAAO,MAAMC,sBAAc;AAElE,MAAI;AACF,SAAO,MAAM,QAA6C,kBAAkB;WACrE,OAAO;GACd,MAAMW,UAAkB,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM;AAE9E,OACE,CAAC,QAAQ,SAAS,uBAAuB,IACzC,CAAC,QAAQ,SAAS,oBAAoB,IACtC,CAAC,QAAQ,SAAS,oBAAoB,IACtC,CAAC,QAAQ,SAAS,wBAAwB,CAE1C,OAAM;;AAIV,SAAO;;CAGT,MAAe,OAAO,UAAyC;AAC7D,QAAM,IAAI,sBACR,mBACA,2CACA,UACA,8DACD;;CAIH,AAAS,eAAe,UAAmD;AACzE,QAAM,IAAI,sBACR,mBACA,8DACA,UACA,sEACD;;CAGH,MAAa,uBACX,cACA,QACiB;AACjB,QAAM,KAAK,mBAAmB;AAC9B,SAAO,KAAK,aAAa,cAAc,OAAO;;CAGhD,AAAgB,oBAAyB;AACvC,SAAO,MAAM,mBAAmB;;CAGlC,MAAsB,eAA8B;AAClD,QAAM,IAAI,sBACR,mBACA,4DACA,UACA,oEACD;;CAGH,MAAe,WAAW,aAAsC,WAAmC;AACjG,SAAO,KAAK,mBAAmB,CAAC,eAAe,aAAa,UAAU;;CAGxE,AAAS,eAA4C,OAA2B;AAC9E,SAAO,MAAM,eAAkB,MAAM;;;AAIzC,kCAAe"}

package/dist/cjs/ThunderIDNextClient.cjs

@@ -17,7 +17,7 @@ var ThunderIDNextClient = class extends __thunderid_node.ThunderIDNodeClient {
 	}
 	async initialize(config, storage) {
 		if (this.isInitialized) return Promise.resolve(true);
-		const { baseUrl, organizationHandle, clientId, clientSecret, signInUrl, afterSignInUrl, afterSignOutUrl, signUpUrl,...rest } = require_decorateConfigWithNextEnv.default(config);
+		const { baseUrl, organizationHandle, clientId, clientSecret, flowSecret, signInUrl, afterSignInUrl, afterSignOutUrl, signUpUrl,...rest } = require_decorateConfigWithNextEnv.default(config);
 		const origin = await require_getClientOrigin.default();
 		const initialized = await super.initialize({
 			...rest,
@@ -27,6 +27,7 @@ var ThunderIDNextClient = class extends __thunderid_node.ThunderIDNodeClient {
 			clientId,
 			clientSecret,
 			enablePKCE: rest.enablePKCE ?? true,
+			flowSecret,
 			organizationHandle,
 			signInUrl,
 			signUpUrl
@@ -122,7 +123,7 @@ var ThunderIDNextClient = class extends __thunderid_node.ThunderIDNodeClient {
 			const configData = await this.getStorageManager().getConfigData();
 			return (0, __thunderid_node.executeEmbeddedSignInFlow)({
 				baseUrl: configData?.baseUrl,
-				flowSecret: arg2?.flowSecret,
+				flowSecret: arg2?.flowSecret ?? configData?.flowSecret,
 				payload: arg1,
 				url: (0, __thunderid_node.resolveResourceEndpoint)("flowExecute", configData, arg2?.url)
 			});

package/dist/cjs/ThunderIDNextClient.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"ThunderIDNextClient.cjs","names":["ThunderIDNodeClient","decorateConfigWithNextEnv","origin: string","getClientOrigin","initialized: boolean","ThunderIDRuntimeError","resolvedSessionId: string","getSessionId","configData: AuthClientConfig<T>","baseUrl: string | undefined","profile: User","token: string | undefined","arg1: any","arg2: any","arg3: any","arg4: any","afterSignOutUrl: string","message: string"],"sources":["../../src/ThunderIDNextClient.ts"],"sourcesContent":["// Copyright 2025 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\nimport {\n  ThunderIDNodeClient,\n  ThunderIDRuntimeError,\n  AuthClientConfig,\n  EmbeddedSignInFlowResponse,\n  ExtendedAuthorizeRequestUrlParams,\n  IdToken,\n  SignInOptions,\n  SignUpOptions,\n  Storage,\n  TokenExchangeRequestConfig,\n  TokenResponse,\n  User,\n  UserProfile,\n  executeEmbeddedSignInFlow,\n  extractUserClaimsFromIdToken,\n  generateFlattenedUserProfile,\n  getUsersMe,\n  updateMeProfile,\n  resolveResourceEndpoint,\n} from '@thunderid/node';\nimport {ThunderIDNextConfig} from './models/config';\nimport getClientOrigin from './server/actions/getClientOrigin';\nimport getSessionId from './server/actions/getSessionId';\nimport decorateConfigWithNextEnv from './utils/decorateConfigWithNextEnv';\n\nclass ThunderIDNextClient<T extends ThunderIDNextConfig = ThunderIDNextConfig> extends ThunderIDNodeClient<T> {\n  public isInitialized = false;\n\n  public constructor() {\n    super();\n  }\n\n  private async ensureInitialized(): Promise<void> {\n    if (!this.isInitialized) {\n      // Server actions may run in a module context that hasn't been through\n      // ThunderIDServerProvider (e.g. a different worker). Try to initialize\n      // from environment variables before giving up.\n      await this.initialize({} as T);\n    }\n\n    if (!this.isInitialized) {\n      throw new Error(\n        '[ThunderIDNextClient] Client is not initialized. Make sure you have wrapped your app with ThunderIDProvider and provided the required configuration (baseUrl, clientId, etc.).',\n      );\n    }\n  }\n\n  override async initialize(config: T, storage?: Storage): Promise<boolean> {\n    if (this.isInitialized) {\n      return Promise.resolve(true);\n    }\n\n    const {\n      baseUrl,\n      organizationHandle,\n      clientId,\n      clientSecret,\n      signInUrl,\n      afterSignInUrl,\n      afterSignOutUrl,\n      signUpUrl,\n      ...rest\n    } = decorateConfigWithNextEnv(config);\n\n    const origin: string = await getClientOrigin();\n\n    const initialized: boolean = await super.initialize(\n      {\n        ...rest,\n        afterSignInUrl: afterSignInUrl ?? origin,\n        afterSignOutUrl: afterSignOutUrl ?? origin,\n        baseUrl,\n        clientId,\n        clientSecret,\n        enablePKCE: (rest as any).enablePKCE ?? true,\n        organizationHandle,\n        signInUrl,\n        signUpUrl,\n      } as any,\n      storage,\n    );\n\n    this.isInitialized = initialized;\n\n    return initialized;\n  }\n\n  override async reInitialize(config: Partial<T>): Promise<boolean> {\n    try {\n      await super.reInitialize(config);\n      return true;\n    } catch (error) {\n      throw new ThunderIDRuntimeError(\n        `Failed to re-initialize the client: ${error instanceof Error ? error.message : String(error)}`,\n        'ThunderIDNextClient-reInitialize-RuntimeError-001',\n        'nextjs',\n        'An error occurred while re-initializing the client. Please check your configuration and network connection.',\n      );\n    }\n  }\n\n  override async getUser(userId?: string): Promise<User> {\n    await this.ensureInitialized();\n    const resolvedSessionId: string = userId || (await getSessionId())!;\n\n    try {\n      const configData: AuthClientConfig<T> = await this.getStorageManager().getConfigData();\n      const baseUrl: string | undefined = configData?.baseUrl;\n\n      const profile: User = await getUsersMe({\n        baseUrl,\n        url: resolveResourceEndpoint('usersMe', configData),\n        headers: {\n          Authorization: `Bearer ${await this.getAccessToken(userId)}`,\n        },\n      });\n\n      return profile;\n    } catch (error) {\n      return await super.getUser(resolvedSessionId);\n    }\n  }\n\n  override async getUserProfile(userId?: string): Promise<UserProfile> {\n    await this.ensureInitialized();\n\n    try {\n      const configData: AuthClientConfig<T> = await this.getStorageManager().getConfigData();\n      const baseUrl: string | undefined = configData?.baseUrl;\n\n      const profile: User = await getUsersMe({\n        baseUrl,\n        url: resolveResourceEndpoint('usersMe', configData),\n        headers: {\n          Authorization: `Bearer ${await this.getAccessToken(userId)}`,\n        },\n      });\n\n      return {\n        flattenedProfile: generateFlattenedUserProfile(profile),\n        profile,\n      };\n    } catch (error) {\n      return {\n        flattenedProfile: extractUserClaimsFromIdToken(await super.getDecodedIdToken(userId)),\n        profile: extractUserClaimsFromIdToken(await super.getDecodedIdToken(userId)),\n      };\n    }\n  }\n\n  override async updateUserProfile(payload: any, userId?: string): Promise<User> {\n    await this.ensureInitialized();\n\n    try {\n      const configData: AuthClientConfig<T> = await this.getStorageManager().getConfigData();\n      const baseUrl: string | undefined = configData?.baseUrl;\n\n      return updateMeProfile({\n        baseUrl,\n        url: resolveResourceEndpoint('usersMe', configData),\n        headers: {\n          Authorization: `Bearer ${await this.getAccessToken(userId)}`,\n        },\n        payload: payload?.payload ?? payload,\n      });\n    } catch (error) {\n      throw new ThunderIDRuntimeError(\n        `Failed to update user profile: ${error instanceof Error ? error.message : String(error)}`,\n        'ThunderIDNextClient-UpdateProfileError-001',\n        'react',\n        'An error occurred while updating the user profile. Please check your configuration and network connection.',\n      );\n    }\n  }\n\n  override isLoading(): boolean {\n    return false;\n  }\n\n  override isSignedIn(sessionId?: string): Promise<boolean> {\n    return super.isSignedIn(sessionId);\n  }\n\n  override exchangeToken(config: TokenExchangeRequestConfig, sessionId?: string): Promise<TokenResponse | Response> {\n    return super.exchangeToken(config, sessionId) as unknown as Promise<TokenResponse | Response>;\n  }\n\n  // eslint-disable-next-line @typescript-eslint/no-unused-vars\n  override async getAccessToken(_sessionId?: string): Promise<string> {\n    const {default: getAccessToken} = await import('./server/actions/getAccessToken');\n    const token: string | undefined = await getAccessToken();\n\n    if (typeof token !== 'string' || !token) {\n      throw new ThunderIDRuntimeError(\n        'Failed to get access token.',\n        'ThunderIDNextClient-getAccessToken-RuntimeError-003',\n        'nextjs',\n        'An error occurred while obtaining the access token. Please check your configuration and network connection.',\n      );\n    }\n\n    return token;\n  }\n\n  override async getDecodedIdToken(sessionId?: string, idToken?: string): Promise<IdToken> {\n    await this.ensureInitialized();\n    return await super.getDecodedIdToken(sessionId, idToken);\n  }\n\n  override async signIn(...args: any[]): Promise<any> {\n    const arg1: any = args[0];\n    const arg2: any = args[1];\n    const arg3: any = args[2];\n    const arg4: any = args[3];\n\n    // An embedded sign-in flow payload initiates or continues a `POST /flow/execute` step\n    // (identified by `applicationId` for a new flow or `executionId` to continue one). This is\n    // distinct from the OAuth authorization_code exchange handled by `super.signIn` below, which\n    // is used once the embedded flow completes and returns an authorization code.\n    const isEmbeddedFlowPayload: boolean =\n      typeof arg1 === 'object' && arg1 !== null && ('executionId' in arg1 || 'applicationId' in arg1);\n\n    if (isEmbeddedFlowPayload) {\n      await this.ensureInitialized();\n\n      const configData: AuthClientConfig<T> = await this.getStorageManager().getConfigData();\n\n      return executeEmbeddedSignInFlow({\n        baseUrl: configData?.baseUrl,\n        flowSecret: arg2?.flowSecret,\n        payload: arg1,\n        url: resolveResourceEndpoint('flowExecute', configData, arg2?.url),\n      }) as unknown as Promise<EmbeddedSignInFlowResponse>;\n    }\n\n    return super.signIn(arg4, arg3, arg1?.code, arg1?.session_state, arg1?.state, arg1) as unknown as Promise<User>;\n  }\n\n  override async signOut(...args: any[]): Promise<string> {\n    if (args[1] && typeof args[1] !== 'string') {\n      throw new Error('The second argument must be a string.');\n    }\n\n    const config: T = this.getConfiguration();\n    const afterSignOutUrl: string = config?.afterSignOutUrl || '/';\n\n    const resolvedSessionId: string = args[1] || (await getSessionId())!;\n\n    try {\n      await (super.signOut as (...a: any[]) => Promise<string>)(resolvedSessionId);\n    } catch (error) {\n      const message: string = error instanceof Error ? error.message : String(error);\n\n      if (\n        !message.includes('end_session_endpoint') &&\n        !message.includes('sign-out endpoint') &&\n        !message.includes('Sign-out endpoint') &&\n        !message.includes('Sign-out redirect URL')\n      ) {\n        throw error;\n      }\n    }\n\n    return afterSignOutUrl;\n  }\n\n  override async signUp(_options?: SignUpOptions): Promise<void> {\n    throw new ThunderIDRuntimeError(\n      'Not implemented',\n      'ThunderIDNextClient-ValidationError-002',\n      'nextjs',\n      'The signUp method is not implemented in the Next.js client.',\n    );\n  }\n\n  // eslint-disable-next-line @typescript-eslint/no-unused-vars\n  override signInSilently(_options?: SignInOptions): Promise<User | boolean> {\n    throw new ThunderIDRuntimeError(\n      'Not implemented',\n      'ThunderIDNextClient-signInSilently-NotImplementedError-001',\n      'nextjs',\n      'The signInSilently method is not implemented in the Next.js client.',\n    );\n  }\n\n  public async getAuthorizeRequestUrl(\n    customParams: ExtendedAuthorizeRequestUrlParams,\n    userId?: string,\n  ): Promise<string> {\n    await this.ensureInitialized();\n    return this.getSignInUrl(customParams, userId);\n  }\n\n  public override getStorageManager(): any {\n    return super.getStorageManager();\n  }\n\n  public override async clearSession(): Promise<void> {\n    throw new ThunderIDRuntimeError(\n      'Not implemented',\n      'ThunderIDNextClient-clearSession-NotImplementedError-001',\n      'nextjs',\n      'The clearSession method is not implemented in the Next.js client.',\n    );\n  }\n\n  override async setSession(sessionData: Record<string, unknown>, sessionId?: string): Promise<void> {\n    return this.getStorageManager().setSessionData(sessionData, sessionId);\n  }\n\n  override decodeJwtToken<R = Record<string, unknown>>(token: string): Promise<R> {\n    return super.decodeJwtToken<R>(token);\n  }\n}\n\nexport default ThunderIDNextClient;\n"],"mappings":";;;;;;;;AA6BA,IAAM,sBAAN,cAAuFA,qCAAuB;CAC5G,AAAO,gBAAgB;CAEvB,AAAO,cAAc;AACnB,SAAO;;CAGT,MAAc,oBAAmC;AAC/C,MAAI,CAAC,KAAK,cAIR,OAAM,KAAK,WAAW,EAAE,CAAM;AAGhC,MAAI,CAAC,KAAK,cACR,OAAM,IAAI,MACR,iLACD;;CAIL,MAAe,WAAW,QAAW,SAAqC;AACxE,MAAI,KAAK,cACP,QAAO,QAAQ,QAAQ,KAAK;EAG9B,MAAM,EACJ,SACA,oBACA,UACA,cACA,WACA,gBACA,iBACA,UACA,GAAG,SACDC,0CAA0B,OAAO;EAErC,MAAMC,SAAiB,MAAMC,iCAAiB;EAE9C,MAAMC,cAAuB,MAAM,MAAM,WACvC;GACE,GAAG;GACH,gBAAgB,kBAAkB;GAClC,iBAAiB,mBAAmB;GACpC;GACA;GACA;GACA,YAAa,KAAa,cAAc;GACxC;GACA;GACA;GACD,EACD,QACD;AAED,OAAK,gBAAgB;AAErB,SAAO;;CAGT,MAAe,aAAa,QAAsC;AAChE,MAAI;AACF,SAAM,MAAM,aAAa,OAAO;AAChC,UAAO;WACA,OAAO;AACd,SAAM,IAAIC,uCACR,uCAAuC,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM,IAC7F,qDACA,UACA,8GACD;;;CAIL,MAAe,QAAQ,QAAgC;AACrD,QAAM,KAAK,mBAAmB;EAC9B,MAAMC,oBAA4B,UAAW,MAAMC,8BAAc;AAEjE,MAAI;GACF,MAAMC,aAAkC,MAAM,KAAK,mBAAmB,CAAC,eAAe;GACtF,MAAMC,UAA8B,YAAY;AAUhD,UARsB,uCAAiB;IACrC;IACA,mDAA6B,WAAW,WAAW;IACnD,SAAS,EACP,eAAe,UAAU,MAAM,KAAK,eAAe,OAAO,IAC3D;IACF,CAAC;WAGK,OAAO;AACd,UAAO,MAAM,MAAM,QAAQ,kBAAkB;;;CAIjD,MAAe,eAAe,QAAuC;AACnE,QAAM,KAAK,mBAAmB;AAE9B,MAAI;GACF,MAAMD,aAAkC,MAAM,KAAK,mBAAmB,CAAC,eAAe;GACtF,MAAMC,UAA8B,YAAY;GAEhD,MAAMC,UAAgB,uCAAiB;IACrC;IACA,mDAA6B,WAAW,WAAW;IACnD,SAAS,EACP,eAAe,UAAU,MAAM,KAAK,eAAe,OAAO,IAC3D;IACF,CAAC;AAEF,UAAO;IACL,qEAA+C,QAAQ;IACvD;IACD;WACM,OAAO;AACd,UAAO;IACL,qEAA+C,MAAM,MAAM,kBAAkB,OAAO,CAAC;IACrF,4DAAsC,MAAM,MAAM,kBAAkB,OAAO,CAAC;IAC7E;;;CAIL,MAAe,kBAAkB,SAAc,QAAgC;AAC7E,QAAM,KAAK,mBAAmB;AAE9B,MAAI;GACF,MAAMF,aAAkC,MAAM,KAAK,mBAAmB,CAAC,eAAe;GACtF,MAAMC,UAA8B,YAAY;AAEhD,gDAAuB;IACrB;IACA,mDAA6B,WAAW,WAAW;IACnD,SAAS,EACP,eAAe,UAAU,MAAM,KAAK,eAAe,OAAO,IAC3D;IACD,SAAS,SAAS,WAAW;IAC9B,CAAC;WACK,OAAO;AACd,SAAM,IAAIJ,uCACR,kCAAkC,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM,IACxF,8CACA,SACA,6GACD;;;CAIL,AAAS,YAAqB;AAC5B,SAAO;;CAGT,AAAS,WAAW,WAAsC;AACxD,SAAO,MAAM,WAAW,UAAU;;CAGpC,AAAS,cAAc,QAAoC,WAAuD;AAChH,SAAO,MAAM,cAAc,QAAQ,UAAU;;CAI/C,MAAe,eAAe,YAAsC;EAClE,MAAM,EAAC,SAAS,mBAAkB,2CAAM;EACxC,MAAMM,QAA4B,MAAM,gBAAgB;AAExD,MAAI,OAAO,UAAU,YAAY,CAAC,MAChC,OAAM,IAAIN,uCACR,+BACA,uDACA,UACA,8GACD;AAGH,SAAO;;CAGT,MAAe,kBAAkB,WAAoB,SAAoC;AACvF,QAAM,KAAK,mBAAmB;AAC9B,SAAO,MAAM,MAAM,kBAAkB,WAAW,QAAQ;;CAG1D,MAAe,OAAO,GAAG,MAA2B;EAClD,MAAMO,OAAY,KAAK;EACvB,MAAMC,OAAY,KAAK;EACvB,MAAMC,OAAY,KAAK;EACvB,MAAMC,OAAY,KAAK;AASvB,MAFE,OAAO,SAAS,YAAY,SAAS,SAAS,iBAAiB,QAAQ,mBAAmB,OAEjE;AACzB,SAAM,KAAK,mBAAmB;GAE9B,MAAMP,aAAkC,MAAM,KAAK,mBAAmB,CAAC,eAAe;AAEtF,0DAAiC;IAC/B,SAAS,YAAY;IACrB,YAAY,MAAM;IAClB,SAAS;IACT,mDAA6B,eAAe,YAAY,MAAM,IAAI;IACnE,CAAC;;AAGJ,SAAO,MAAM,OAAO,MAAM,MAAM,MAAM,MAAM,MAAM,eAAe,MAAM,OAAO,KAAK;;CAGrF,MAAe,QAAQ,GAAG,MAA8B;AACtD,MAAI,KAAK,MAAM,OAAO,KAAK,OAAO,SAChC,OAAM,IAAI,MAAM,wCAAwC;EAI1D,MAAMQ,kBADY,KAAK,kBAAkB,EACD,mBAAmB;EAE3D,MAAMV,oBAA4B,KAAK,MAAO,MAAMC,8BAAc;AAElE,MAAI;AACF,SAAO,MAAM,QAA6C,kBAAkB;WACrE,OAAO;GACd,MAAMU,UAAkB,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM;AAE9E,OACE,CAAC,QAAQ,SAAS,uBAAuB,IACzC,CAAC,QAAQ,SAAS,oBAAoB,IACtC,CAAC,QAAQ,SAAS,oBAAoB,IACtC,CAAC,QAAQ,SAAS,wBAAwB,CAE1C,OAAM;;AAIV,SAAO;;CAGT,MAAe,OAAO,UAAyC;AAC7D,QAAM,IAAIZ,uCACR,mBACA,2CACA,UACA,8DACD;;CAIH,AAAS,eAAe,UAAmD;AACzE,QAAM,IAAIA,uCACR,mBACA,8DACA,UACA,sEACD;;CAGH,MAAa,uBACX,cACA,QACiB;AACjB,QAAM,KAAK,mBAAmB;AAC9B,SAAO,KAAK,aAAa,cAAc,OAAO;;CAGhD,AAAgB,oBAAyB;AACvC,SAAO,MAAM,mBAAmB;;CAGlC,MAAsB,eAA8B;AAClD,QAAM,IAAIA,uCACR,mBACA,4DACA,UACA,oEACD;;CAGH,MAAe,WAAW,aAAsC,WAAmC;AACjG,SAAO,KAAK,mBAAmB,CAAC,eAAe,aAAa,UAAU;;CAGxE,AAAS,eAA4C,OAA2B;AAC9E,SAAO,MAAM,eAAkB,MAAM;;;AAIzC,kCAAe"}
+{"version":3,"file":"ThunderIDNextClient.cjs","names":["ThunderIDNodeClient","decorateConfigWithNextEnv","origin: string","getClientOrigin","initialized: boolean","ThunderIDRuntimeError","resolvedSessionId: string","getSessionId","configData: AuthClientConfig<T>","baseUrl: string | undefined","profile: User","token: string | undefined","arg1: any","arg2: any","arg3: any","arg4: any","configData: ThunderIDNextConfig","afterSignOutUrl: string","message: string"],"sources":["../../src/ThunderIDNextClient.ts"],"sourcesContent":["// Copyright 2025 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\nimport {\n  ThunderIDNodeClient,\n  ThunderIDRuntimeError,\n  AuthClientConfig,\n  EmbeddedSignInFlowResponse,\n  ExtendedAuthorizeRequestUrlParams,\n  IdToken,\n  SignInOptions,\n  SignUpOptions,\n  Storage,\n  TokenExchangeRequestConfig,\n  TokenResponse,\n  User,\n  UserProfile,\n  executeEmbeddedSignInFlow,\n  extractUserClaimsFromIdToken,\n  generateFlattenedUserProfile,\n  getUsersMe,\n  updateMeProfile,\n  resolveResourceEndpoint,\n} from '@thunderid/node';\nimport {ThunderIDNextConfig} from './models/config';\nimport getClientOrigin from './server/actions/getClientOrigin';\nimport getSessionId from './server/actions/getSessionId';\nimport decorateConfigWithNextEnv from './utils/decorateConfigWithNextEnv';\n\nclass ThunderIDNextClient<T extends ThunderIDNextConfig = ThunderIDNextConfig> extends ThunderIDNodeClient<T> {\n  public isInitialized = false;\n\n  public constructor() {\n    super();\n  }\n\n  private async ensureInitialized(): Promise<void> {\n    if (!this.isInitialized) {\n      // Server actions may run in a module context that hasn't been through\n      // ThunderIDServerProvider (e.g. a different worker). Try to initialize\n      // from environment variables before giving up.\n      await this.initialize({} as T);\n    }\n\n    if (!this.isInitialized) {\n      throw new Error(\n        '[ThunderIDNextClient] Client is not initialized. Make sure you have wrapped your app with ThunderIDProvider and provided the required configuration (baseUrl, clientId, etc.).',\n      );\n    }\n  }\n\n  override async initialize(config: T, storage?: Storage): Promise<boolean> {\n    if (this.isInitialized) {\n      return Promise.resolve(true);\n    }\n\n    const {\n      baseUrl,\n      organizationHandle,\n      clientId,\n      clientSecret,\n      flowSecret,\n      signInUrl,\n      afterSignInUrl,\n      afterSignOutUrl,\n      signUpUrl,\n      ...rest\n    } = decorateConfigWithNextEnv(config);\n\n    const origin: string = await getClientOrigin();\n\n    const initialized: boolean = await super.initialize(\n      {\n        ...rest,\n        afterSignInUrl: afterSignInUrl ?? origin,\n        afterSignOutUrl: afterSignOutUrl ?? origin,\n        baseUrl,\n        clientId,\n        clientSecret,\n        enablePKCE: (rest as any).enablePKCE ?? true,\n        flowSecret,\n        organizationHandle,\n        signInUrl,\n        signUpUrl,\n      } as any,\n      storage,\n    );\n\n    this.isInitialized = initialized;\n\n    return initialized;\n  }\n\n  override async reInitialize(config: Partial<T>): Promise<boolean> {\n    try {\n      await super.reInitialize(config);\n      return true;\n    } catch (error) {\n      throw new ThunderIDRuntimeError(\n        `Failed to re-initialize the client: ${error instanceof Error ? error.message : String(error)}`,\n        'ThunderIDNextClient-reInitialize-RuntimeError-001',\n        'nextjs',\n        'An error occurred while re-initializing the client. Please check your configuration and network connection.',\n      );\n    }\n  }\n\n  override async getUser(userId?: string): Promise<User> {\n    await this.ensureInitialized();\n    const resolvedSessionId: string = userId || (await getSessionId())!;\n\n    try {\n      const configData: AuthClientConfig<T> = await this.getStorageManager().getConfigData();\n      const baseUrl: string | undefined = configData?.baseUrl;\n\n      const profile: User = await getUsersMe({\n        baseUrl,\n        url: resolveResourceEndpoint('usersMe', configData),\n        headers: {\n          Authorization: `Bearer ${await this.getAccessToken(userId)}`,\n        },\n      });\n\n      return profile;\n    } catch (error) {\n      return await super.getUser(resolvedSessionId);\n    }\n  }\n\n  override async getUserProfile(userId?: string): Promise<UserProfile> {\n    await this.ensureInitialized();\n\n    try {\n      const configData: AuthClientConfig<T> = await this.getStorageManager().getConfigData();\n      const baseUrl: string | undefined = configData?.baseUrl;\n\n      const profile: User = await getUsersMe({\n        baseUrl,\n        url: resolveResourceEndpoint('usersMe', configData),\n        headers: {\n          Authorization: `Bearer ${await this.getAccessToken(userId)}`,\n        },\n      });\n\n      return {\n        flattenedProfile: generateFlattenedUserProfile(profile),\n        profile,\n      };\n    } catch (error) {\n      return {\n        flattenedProfile: extractUserClaimsFromIdToken(await super.getDecodedIdToken(userId)),\n        profile: extractUserClaimsFromIdToken(await super.getDecodedIdToken(userId)),\n      };\n    }\n  }\n\n  override async updateUserProfile(payload: any, userId?: string): Promise<User> {\n    await this.ensureInitialized();\n\n    try {\n      const configData: AuthClientConfig<T> = await this.getStorageManager().getConfigData();\n      const baseUrl: string | undefined = configData?.baseUrl;\n\n      return updateMeProfile({\n        baseUrl,\n        url: resolveResourceEndpoint('usersMe', configData),\n        headers: {\n          Authorization: `Bearer ${await this.getAccessToken(userId)}`,\n        },\n        payload: payload?.payload ?? payload,\n      });\n    } catch (error) {\n      throw new ThunderIDRuntimeError(\n        `Failed to update user profile: ${error instanceof Error ? error.message : String(error)}`,\n        'ThunderIDNextClient-UpdateProfileError-001',\n        'react',\n        'An error occurred while updating the user profile. Please check your configuration and network connection.',\n      );\n    }\n  }\n\n  override isLoading(): boolean {\n    return false;\n  }\n\n  override isSignedIn(sessionId?: string): Promise<boolean> {\n    return super.isSignedIn(sessionId);\n  }\n\n  override exchangeToken(config: TokenExchangeRequestConfig, sessionId?: string): Promise<TokenResponse | Response> {\n    return super.exchangeToken(config, sessionId) as unknown as Promise<TokenResponse | Response>;\n  }\n\n  // eslint-disable-next-line @typescript-eslint/no-unused-vars\n  override async getAccessToken(_sessionId?: string): Promise<string> {\n    const {default: getAccessToken} = await import('./server/actions/getAccessToken');\n    const token: string | undefined = await getAccessToken();\n\n    if (typeof token !== 'string' || !token) {\n      throw new ThunderIDRuntimeError(\n        'Failed to get access token.',\n        'ThunderIDNextClient-getAccessToken-RuntimeError-003',\n        'nextjs',\n        'An error occurred while obtaining the access token. Please check your configuration and network connection.',\n      );\n    }\n\n    return token;\n  }\n\n  override async getDecodedIdToken(sessionId?: string, idToken?: string): Promise<IdToken> {\n    await this.ensureInitialized();\n    return await super.getDecodedIdToken(sessionId, idToken);\n  }\n\n  override async signIn(...args: any[]): Promise<any> {\n    const arg1: any = args[0];\n    const arg2: any = args[1];\n    const arg3: any = args[2];\n    const arg4: any = args[3];\n\n    // An embedded sign-in flow payload initiates or continues a `POST /flow/execute` step\n    // (identified by `applicationId` for a new flow or `executionId` to continue one). This is\n    // distinct from the OAuth authorization_code exchange handled by `super.signIn` below, which\n    // is used once the embedded flow completes and returns an authorization code.\n    const isEmbeddedFlowPayload: boolean =\n      typeof arg1 === 'object' && arg1 !== null && ('executionId' in arg1 || 'applicationId' in arg1);\n\n    if (isEmbeddedFlowPayload) {\n      await this.ensureInitialized();\n\n      // Typed as the Next config rather than `AuthClientConfig<T>` because the server-only\n      // `flowSecret` lives on `ThunderIDNodeConfig`, which the generic base config does not expose.\n      const configData: ThunderIDNextConfig = (await this.getStorageManager().getConfigData()) as ThunderIDNextConfig;\n\n      return executeEmbeddedSignInFlow({\n        baseUrl: configData?.baseUrl,\n        flowSecret: arg2?.flowSecret ?? configData?.flowSecret,\n        payload: arg1,\n        url: resolveResourceEndpoint('flowExecute', configData, arg2?.url),\n      }) as unknown as Promise<EmbeddedSignInFlowResponse>;\n    }\n\n    return super.signIn(arg4, arg3, arg1?.code, arg1?.session_state, arg1?.state, arg1) as unknown as Promise<User>;\n  }\n\n  override async signOut(...args: any[]): Promise<string> {\n    if (args[1] && typeof args[1] !== 'string') {\n      throw new Error('The second argument must be a string.');\n    }\n\n    const config: T = this.getConfiguration();\n    const afterSignOutUrl: string = config?.afterSignOutUrl || '/';\n\n    const resolvedSessionId: string = args[1] || (await getSessionId())!;\n\n    try {\n      await (super.signOut as (...a: any[]) => Promise<string>)(resolvedSessionId);\n    } catch (error) {\n      const message: string = error instanceof Error ? error.message : String(error);\n\n      if (\n        !message.includes('end_session_endpoint') &&\n        !message.includes('sign-out endpoint') &&\n        !message.includes('Sign-out endpoint') &&\n        !message.includes('Sign-out redirect URL')\n      ) {\n        throw error;\n      }\n    }\n\n    return afterSignOutUrl;\n  }\n\n  override async signUp(_options?: SignUpOptions): Promise<void> {\n    throw new ThunderIDRuntimeError(\n      'Not implemented',\n      'ThunderIDNextClient-ValidationError-002',\n      'nextjs',\n      'The signUp method is not implemented in the Next.js client.',\n    );\n  }\n\n  // eslint-disable-next-line @typescript-eslint/no-unused-vars\n  override signInSilently(_options?: SignInOptions): Promise<User | boolean> {\n    throw new ThunderIDRuntimeError(\n      'Not implemented',\n      'ThunderIDNextClient-signInSilently-NotImplementedError-001',\n      'nextjs',\n      'The signInSilently method is not implemented in the Next.js client.',\n    );\n  }\n\n  public async getAuthorizeRequestUrl(\n    customParams: ExtendedAuthorizeRequestUrlParams,\n    userId?: string,\n  ): Promise<string> {\n    await this.ensureInitialized();\n    return this.getSignInUrl(customParams, userId);\n  }\n\n  public override getStorageManager(): any {\n    return super.getStorageManager();\n  }\n\n  public override async clearSession(): Promise<void> {\n    throw new ThunderIDRuntimeError(\n      'Not implemented',\n      'ThunderIDNextClient-clearSession-NotImplementedError-001',\n      'nextjs',\n      'The clearSession method is not implemented in the Next.js client.',\n    );\n  }\n\n  override async setSession(sessionData: Record<string, unknown>, sessionId?: string): Promise<void> {\n    return this.getStorageManager().setSessionData(sessionData, sessionId);\n  }\n\n  override decodeJwtToken<R = Record<string, unknown>>(token: string): Promise<R> {\n    return super.decodeJwtToken<R>(token);\n  }\n}\n\nexport default ThunderIDNextClient;\n"],"mappings":";;;;;;;;AA6BA,IAAM,sBAAN,cAAuFA,qCAAuB;CAC5G,AAAO,gBAAgB;CAEvB,AAAO,cAAc;AACnB,SAAO;;CAGT,MAAc,oBAAmC;AAC/C,MAAI,CAAC,KAAK,cAIR,OAAM,KAAK,WAAW,EAAE,CAAM;AAGhC,MAAI,CAAC,KAAK,cACR,OAAM,IAAI,MACR,iLACD;;CAIL,MAAe,WAAW,QAAW,SAAqC;AACxE,MAAI,KAAK,cACP,QAAO,QAAQ,QAAQ,KAAK;EAG9B,MAAM,EACJ,SACA,oBACA,UACA,cACA,YACA,WACA,gBACA,iBACA,UACA,GAAG,SACDC,0CAA0B,OAAO;EAErC,MAAMC,SAAiB,MAAMC,iCAAiB;EAE9C,MAAMC,cAAuB,MAAM,MAAM,WACvC;GACE,GAAG;GACH,gBAAgB,kBAAkB;GAClC,iBAAiB,mBAAmB;GACpC;GACA;GACA;GACA,YAAa,KAAa,cAAc;GACxC;GACA;GACA;GACA;GACD,EACD,QACD;AAED,OAAK,gBAAgB;AAErB,SAAO;;CAGT,MAAe,aAAa,QAAsC;AAChE,MAAI;AACF,SAAM,MAAM,aAAa,OAAO;AAChC,UAAO;WACA,OAAO;AACd,SAAM,IAAIC,uCACR,uCAAuC,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM,IAC7F,qDACA,UACA,8GACD;;;CAIL,MAAe,QAAQ,QAAgC;AACrD,QAAM,KAAK,mBAAmB;EAC9B,MAAMC,oBAA4B,UAAW,MAAMC,8BAAc;AAEjE,MAAI;GACF,MAAMC,aAAkC,MAAM,KAAK,mBAAmB,CAAC,eAAe;GACtF,MAAMC,UAA8B,YAAY;AAUhD,UARsB,uCAAiB;IACrC;IACA,mDAA6B,WAAW,WAAW;IACnD,SAAS,EACP,eAAe,UAAU,MAAM,KAAK,eAAe,OAAO,IAC3D;IACF,CAAC;WAGK,OAAO;AACd,UAAO,MAAM,MAAM,QAAQ,kBAAkB;;;CAIjD,MAAe,eAAe,QAAuC;AACnE,QAAM,KAAK,mBAAmB;AAE9B,MAAI;GACF,MAAMD,aAAkC,MAAM,KAAK,mBAAmB,CAAC,eAAe;GACtF,MAAMC,UAA8B,YAAY;GAEhD,MAAMC,UAAgB,uCAAiB;IACrC;IACA,mDAA6B,WAAW,WAAW;IACnD,SAAS,EACP,eAAe,UAAU,MAAM,KAAK,eAAe,OAAO,IAC3D;IACF,CAAC;AAEF,UAAO;IACL,qEAA+C,QAAQ;IACvD;IACD;WACM,OAAO;AACd,UAAO;IACL,qEAA+C,MAAM,MAAM,kBAAkB,OAAO,CAAC;IACrF,4DAAsC,MAAM,MAAM,kBAAkB,OAAO,CAAC;IAC7E;;;CAIL,MAAe,kBAAkB,SAAc,QAAgC;AAC7E,QAAM,KAAK,mBAAmB;AAE9B,MAAI;GACF,MAAMF,aAAkC,MAAM,KAAK,mBAAmB,CAAC,eAAe;GACtF,MAAMC,UAA8B,YAAY;AAEhD,gDAAuB;IACrB;IACA,mDAA6B,WAAW,WAAW;IACnD,SAAS,EACP,eAAe,UAAU,MAAM,KAAK,eAAe,OAAO,IAC3D;IACD,SAAS,SAAS,WAAW;IAC9B,CAAC;WACK,OAAO;AACd,SAAM,IAAIJ,uCACR,kCAAkC,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM,IACxF,8CACA,SACA,6GACD;;;CAIL,AAAS,YAAqB;AAC5B,SAAO;;CAGT,AAAS,WAAW,WAAsC;AACxD,SAAO,MAAM,WAAW,UAAU;;CAGpC,AAAS,cAAc,QAAoC,WAAuD;AAChH,SAAO,MAAM,cAAc,QAAQ,UAAU;;CAI/C,MAAe,eAAe,YAAsC;EAClE,MAAM,EAAC,SAAS,mBAAkB,2CAAM;EACxC,MAAMM,QAA4B,MAAM,gBAAgB;AAExD,MAAI,OAAO,UAAU,YAAY,CAAC,MAChC,OAAM,IAAIN,uCACR,+BACA,uDACA,UACA,8GACD;AAGH,SAAO;;CAGT,MAAe,kBAAkB,WAAoB,SAAoC;AACvF,QAAM,KAAK,mBAAmB;AAC9B,SAAO,MAAM,MAAM,kBAAkB,WAAW,QAAQ;;CAG1D,MAAe,OAAO,GAAG,MAA2B;EAClD,MAAMO,OAAY,KAAK;EACvB,MAAMC,OAAY,KAAK;EACvB,MAAMC,OAAY,KAAK;EACvB,MAAMC,OAAY,KAAK;AASvB,MAFE,OAAO,SAAS,YAAY,SAAS,SAAS,iBAAiB,QAAQ,mBAAmB,OAEjE;AACzB,SAAM,KAAK,mBAAmB;GAI9B,MAAMC,aAAmC,MAAM,KAAK,mBAAmB,CAAC,eAAe;AAEvF,0DAAiC;IAC/B,SAAS,YAAY;IACrB,YAAY,MAAM,cAAc,YAAY;IAC5C,SAAS;IACT,mDAA6B,eAAe,YAAY,MAAM,IAAI;IACnE,CAAC;;AAGJ,SAAO,MAAM,OAAO,MAAM,MAAM,MAAM,MAAM,MAAM,eAAe,MAAM,OAAO,KAAK;;CAGrF,MAAe,QAAQ,GAAG,MAA8B;AACtD,MAAI,KAAK,MAAM,OAAO,KAAK,OAAO,SAChC,OAAM,IAAI,MAAM,wCAAwC;EAI1D,MAAMC,kBADY,KAAK,kBAAkB,EACD,mBAAmB;EAE3D,MAAMX,oBAA4B,KAAK,MAAO,MAAMC,8BAAc;AAElE,MAAI;AACF,SAAO,MAAM,QAA6C,kBAAkB;WACrE,OAAO;GACd,MAAMW,UAAkB,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM;AAE9E,OACE,CAAC,QAAQ,SAAS,uBAAuB,IACzC,CAAC,QAAQ,SAAS,oBAAoB,IACtC,CAAC,QAAQ,SAAS,oBAAoB,IACtC,CAAC,QAAQ,SAAS,wBAAwB,CAE1C,OAAM;;AAIV,SAAO;;CAGT,MAAe,OAAO,UAAyC;AAC7D,QAAM,IAAIb,uCACR,mBACA,2CACA,UACA,8DACD;;CAIH,AAAS,eAAe,UAAmD;AACzE,QAAM,IAAIA,uCACR,mBACA,8DACA,UACA,sEACD;;CAGH,MAAa,uBACX,cACA,QACiB;AACjB,QAAM,KAAK,mBAAmB;AAC9B,SAAO,KAAK,aAAa,cAAc,OAAO;;CAGhD,AAAgB,oBAAyB;AACvC,SAAO,MAAM,mBAAmB;;CAGlC,MAAsB,eAA8B;AAClD,QAAM,IAAIA,uCACR,mBACA,4DACA,UACA,oEACD;;CAGH,MAAe,WAAW,aAAsC,WAAmC;AACjG,SAAO,KAAK,mBAAmB,CAAC,eAAe,aAAa,UAAU;;CAGxE,AAAS,eAA4C,OAA2B;AAC9E,SAAO,MAAM,eAAkB,MAAM;;;AAIzC,kCAAe"}

package/dist/cjs/client/contexts/ThunderID/ThunderIDProvider.cjs

@@ -177,6 +177,7 @@ const ThunderIDClientProvider = ({ baseUrl, children, signIn, clearSession, refr
 		signUp: handleSignUp,
 		signUpUrl,
 		user,
+		userSchema: null,
 		vendor: (0, __thunderid_node.getVendorPrefix)(vendor)
 	}), [
 		applicationId,

package/dist/cjs/client/contexts/ThunderID/ThunderIDProvider.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"ThunderIDProvider.cjs","names":["ThunderIDClientProvider: FC<PropsWithChildren<ThunderIDClientProviderProps>>","reRenderCheckRef: RefObject<boolean>","router: AppRouterInstance","searchParams: ReadonlyURLSearchParams","code: string | null","state: string | null","sessionState: string | null","result: {error?: string; redirectUrl?: string; success: boolean}","ThunderIDRuntimeError","result: any","contextValue: ThunderIDContextProps","reactContextValue: ReactThunderIDContextProps","ThunderIDContext","ReactThunderIDContext","I18nProvider","FlowMetaProvider","ThemeProvider","FlowProvider","UserProvider"],"sources":["../../../../../src/client/contexts/ThunderID/ThunderIDProvider.tsx"],"sourcesContent":["// Copyright 2025 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\n'use client';\n\nimport {\n  EmbeddedFlowExecuteRequestConfig,\n  FlowMetadataResponse,\n  generateFlattenedUserProfile,\n  UpdateMeProfileConfig,\n  User,\n  UserProfile,\n  ThunderIDRuntimeError,\n  getVendorPrefix,\n} from '@thunderid/node';\nimport {\n  I18nProvider,\n  FlowMetaProvider,\n  FlowProvider,\n  UserProvider,\n  ThemeProvider,\n  ThunderIDContext as ReactThunderIDContext,\n  ThunderIDContextProps as ReactThunderIDContextProps,\n  ThunderIDProviderProps,\n  getActiveTheme,\n} from '@thunderid/react';\nimport {ReadonlyURLSearchParams} from 'next/dist/client/components/navigation.react-server';\nimport {AppRouterInstance} from 'next/dist/shared/lib/app-router-context.shared-runtime';\nimport {useRouter, useSearchParams} from 'next/navigation';\nimport {FC, PropsWithChildren, RefObject, useEffect, useMemo, useRef, useState} from 'react';\nimport ThunderIDContext, {ThunderIDContextProps} from './ThunderIDContext';\nimport {RefreshResult} from '../../../server/actions/refreshToken';\nimport logger from '../../../utils/logger';\n\n/**\n * Props interface of {@link ThunderIDClientProvider}\n */\nexport type ThunderIDClientProviderProps = Partial<Omit<ThunderIDProviderProps, 'baseUrl' | 'clientId'>> &\n  Pick<ThunderIDProviderProps, 'baseUrl' | 'clientId'> & {\n    applicationId: ThunderIDContextProps['applicationId'];\n    clearSession: () => Promise<void>;\n    handleOAuthCallback: (\n      code: string,\n      state: string,\n      sessionState?: string,\n    ) => Promise<{error?: string; redirectUrl?: string; success: boolean}>;\n    /**\n     * Flow metadata fetched server-side ahead of time, seeding `FlowMetaProvider` so it can skip\n     * its own initial client-side fetch (avoiding a flash of untranslated i18n keys).\n     */\n    initialMeta?: FlowMetadataResponse | null;\n    isSignedIn: boolean;\n    organizationHandle: ThunderIDContextProps['organizationHandle'];\n    refreshToken: () => Promise<RefreshResult>;\n    signIn: ThunderIDContextProps['signIn'];\n    signOut: ThunderIDContextProps['signOut'];\n    signUp: ThunderIDContextProps['signUp'];\n    updateProfile: (\n      requestConfig: UpdateMeProfileConfig,\n      sessionId?: string,\n    ) => Promise<{data: {user: User}; error: string; success: boolean}>;\n    user: User | null;\n    userProfile: UserProfile;\n  };\n\nconst ThunderIDClientProvider: FC<PropsWithChildren<ThunderIDClientProviderProps>> = ({\n  baseUrl,\n  children,\n  signIn,\n  clearSession,\n  refreshToken,\n  signOut,\n  signUp,\n  handleOAuthCallback,\n  preferences,\n  isSignedIn,\n  signInUrl,\n  signUpUrl,\n  user: _user,\n  userProfile: _userProfile,\n  updateProfile,\n  applicationId,\n  organizationHandle,\n  scopes,\n  vendor,\n  initialMeta = null,\n}: PropsWithChildren<ThunderIDClientProviderProps>) => {\n  const reRenderCheckRef: RefObject<boolean> = useRef(false);\n  const router: AppRouterInstance = useRouter();\n  const searchParams: ReadonlyURLSearchParams = useSearchParams();\n  const [isLoading, setIsLoading] = useState<boolean>(true);\n  const [user, setUser] = useState<User | null>(_user);\n  const [userProfile, setUserProfile] = useState<UserProfile>(_userProfile);\n\n  useEffect(() => {\n    setUserProfile(_userProfile);\n  }, [_userProfile]);\n\n  useEffect(() => {\n    setUser(_user);\n  }, [_user]);\n\n  // Handle OAuth callback automatically\n  useEffect(() => {\n    // React 18.x Strict.Mode has a new check for `Ensuring reusable state` to facilitate an upcoming react feature.\n    // https://reactjs.org/docs/strict-mode.html#ensuring-reusable-state\n    // This will remount all the useEffects to ensure that there are no unexpected side effects.\n    // When react remounts the signIn hook of the AuthProvider, it will cause a race condition. Hence, we have to\n    // prevent the re-render of this hook as suggested in the following discussion.\n    // https://github.com/reactwg/react-18/discussions/18#discussioncomment-795623\n    if (reRenderCheckRef.current) {\n      return;\n    }\n\n    reRenderCheckRef.current = true;\n\n    // Don't handle callback if already signed in\n    if (isSignedIn) return;\n\n    (async (): Promise<void> => {\n      try {\n        const code: string | null = searchParams.get('code');\n        const state: string | null = searchParams.get('state');\n        const sessionState: string | null = searchParams.get('session_state');\n        const error: string | null = searchParams.get('error');\n\n        // Check for OAuth errors first\n        if (error) {\n          logger.error('[ThunderIDClientProvider] An error was received for the initiated sign-in request.');\n\n          return;\n        }\n\n        // Handle OAuth callback if code and state are present\n        if (code && state) {\n          setIsLoading(true);\n\n          const result: {error?: string; redirectUrl?: string; success: boolean} = await handleOAuthCallback(\n            code,\n            state,\n            sessionState || undefined,\n          );\n\n          if (result.success) {\n            // Redirect to the success URL\n            if (result.redirectUrl) {\n              router.push(result.redirectUrl);\n            } else {\n              // Refresh the page to update authentication state\n              window.location.reload();\n            }\n          } else {\n            logger.error(\n              `[ThunderIDClientProvider] An error occurred while signing in: ${result.error || 'Authentication failed'}`,\n            );\n          }\n        }\n      } catch (error) {\n        logger.error('[ThunderIDClientProvider] Failed to handle OAuth callback:', error);\n      }\n    })();\n  }, []);\n\n  useEffect(() => {\n    // Set loading to false when server has resolved authentication state\n    setIsLoading(false);\n  }, [isSignedIn, user]);\n\n  const handleSignIn = async (payload: any, request: EmbeddedFlowExecuteRequestConfig): Promise<any> => {\n    if (!signIn) {\n      throw new ThunderIDRuntimeError(\n        '`signIn` function is not available.',\n        'ThunderIDClientProvider-handleSignIn-RuntimeError-001',\n        'nextjs',\n      );\n    }\n\n    const result: any = await signIn(payload, request);\n\n    // Redirect based flow URL is sent as `signInUrl` in the response.\n    // Use window.location.href instead of router.push() — the OAuth authorization\n    // endpoint is on an external server, and router.push() would send RSC fetch\n    // headers that the identity provider doesn't understand, causing a CORS error.\n    if (result?.data?.signInUrl) {\n      window.location.href = result.data.signInUrl;\n\n      return undefined;\n    }\n\n    // After the Embedded flow is successful, the URL to navigate next is sent as `afterSignInUrl` in the response.\n    if (result?.data?.afterSignInUrl) {\n      router.push(result.data.afterSignInUrl);\n\n      return undefined;\n    }\n\n    if (result?.error) {\n      throw new Error(result.error);\n    }\n\n    return result?.data ?? result;\n  };\n\n  const handleSignUp = async (payload: any, request: EmbeddedFlowExecuteRequestConfig): Promise<any> => {\n    if (!signUp) {\n      throw new ThunderIDRuntimeError(\n        '`signUp` function is not available.',\n        'ThunderIDClientProvider-handleSignUp-RuntimeError-001',\n        'nextjs',\n      );\n    }\n\n    const result: any = await signUp(payload, request);\n\n    // Redirect based flow URL is sent as `signUpUrl` in the response.\n    if (result?.data?.signUpUrl) {\n      router.push(result.data.signUpUrl);\n\n      return undefined;\n    }\n\n    // After the Embedded flow is successful, the URL to navigate next is sent as `afterSignUpUrl` in the response.\n    if (result?.data?.afterSignUpUrl) {\n      router.push(result.data.afterSignUpUrl);\n\n      return undefined;\n    }\n\n    if (result?.error) {\n      throw new Error(result.error);\n    }\n\n    return result?.data ?? result;\n  };\n\n  const handleSignOut = async (): Promise<any> => {\n    logger.debug('[ThunderIDClientProvider][handleSignOut] `handleSignOut` called.');\n\n    try {\n      const result: any = await signOut();\n\n      logger.debug('[ThunderIDClientProvider][handleSignOut] Sign out result:', result);\n\n      if (result?.data?.afterSignOutUrl) {\n        router.push(result.data.afterSignOutUrl);\n\n        return {location: result.data.afterSignOutUrl, redirected: true};\n      }\n\n      if (result?.error) {\n        logger.error(\n          '[ThunderIDClientProvider][handleSignOut] Error result was returned during signing the user out with a button click:',\n          result.error,\n        );\n      }\n\n      return result?.data ?? result;\n    } catch (error) {\n      logger.error(\n        '[ThunderIDClientProvider][handleSignOut] Error occurred during signing the user out with a button click:',\n        error,\n      );\n\n      return undefined;\n    }\n  };\n\n  const contextValue: ThunderIDContextProps = useMemo(\n    () => ({\n      applicationId,\n      baseUrl,\n      clearSession,\n      isLoading,\n      isSignedIn,\n      organizationHandle,\n      preferences,\n      refreshToken,\n      scopes,\n      signIn: handleSignIn,\n      signInUrl,\n      signOut: handleSignOut,\n      signUp: handleSignUp,\n      signUpUrl,\n      user,\n    }),\n    [\n      baseUrl,\n      user,\n      isSignedIn,\n      isLoading,\n      signInUrl,\n      signUpUrl,\n      applicationId,\n      organizationHandle,\n      scopes,\n      preferences,\n    ],\n  );\n\n  const handleProfileUpdate = (payload: User): void => {\n    setUser(payload);\n    setUserProfile((prev: UserProfile) => ({\n      ...prev,\n      flattenedProfile: generateFlattenedUserProfile(payload),\n      profile: payload,\n    }));\n  };\n\n  // Bridge into @thunderid/react's own ThunderIDContext. Internal react components rendered by\n  // BaseSignIn/BaseSignUp — most notably FlowMetaProvider, which fetches `/flow/meta` and injects\n  // its i18n bundle — call react's `useThunderID()` directly. Without this bridge they'd only see\n  // react's context default (applicationId/baseUrl undefined, isInitialized false), so the meta\n  // fetch would never fire and flow labels would render as untranslated i18n keys. Fields with no\n  // nextjs equivalent (token/http helpers meant for direct browser API calls) are stubbed out,\n  // since nextjs routes those operations through server actions instead.\n  const unsupported = (name: string): (() => Promise<never>) => {\n    return () =>\n      Promise.reject(\n        new ThunderIDRuntimeError(\n          `\\`${name}\\` is not supported in @thunderid/nextjs.`,\n          `ThunderIDClientProvider-${name}-NotSupportedError-001`,\n          'nextjs',\n        ),\n      );\n  };\n\n  const reactContextValue: ReactThunderIDContextProps = useMemo(\n    () => ({\n      afterSignInUrl: undefined,\n      applicationId,\n      baseUrl,\n      clearSession,\n      clientId: undefined,\n      discovery: {wellKnown: null},\n      exchangeToken: unsupported('exchangeToken'),\n      getAccessToken: unsupported('getAccessToken'),\n      getDecodedIdToken: unsupported('getDecodedIdToken'),\n      getIdToken: unsupported('getIdToken'),\n      getStorageManager: () => Promise.resolve(null),\n      http: {\n        request: unsupported('http.request'),\n        requestAll: unsupported('http.requestAll'),\n      },\n      instanceId: 0,\n      isInitialized: !isLoading,\n      isLoading,\n      isMetaLoading: false,\n      isSignedIn,\n      meta: initialMeta ?? null,\n      organizationHandle,\n      reInitialize: unsupported('reInitialize'),\n      recover: unsupported('recover'),\n      resolveFlowTemplateLiterals: (text: string | undefined): string => text ?? '',\n      scopes,\n      signIn: handleSignIn,\n      signInSilently: unsupported('signInSilently'),\n      signInUrl,\n      signOut: handleSignOut,\n      signUp: handleSignUp,\n      signUpUrl,\n      user,\n      vendor: getVendorPrefix(vendor),\n    }),\n    [\n      applicationId,\n      baseUrl,\n      clearSession,\n      isLoading,\n      isSignedIn,\n      organizationHandle,\n      scopes,\n      signInUrl,\n      signUpUrl,\n      user,\n      initialMeta,\n      vendor,\n    ],\n  );\n\n  return (\n    <ThunderIDContext.Provider value={contextValue}>\n      <ReactThunderIDContext.Provider value={reactContextValue}>\n        <I18nProvider preferences={preferences?.i18n}>\n          <FlowMetaProvider enabled={preferences?.resolveFromMeta !== false} initialMeta={initialMeta}>\n            <ThemeProvider theme={preferences?.theme?.overrides} mode={getActiveTheme(preferences?.theme?.mode as any)}>\n              <FlowProvider>\n                <UserProvider profile={userProfile} onUpdateProfile={handleProfileUpdate} updateProfile={updateProfile}>\n                  {children}\n                </UserProvider>\n              </FlowProvider>\n            </ThemeProvider>\n          </FlowMetaProvider>\n        </I18nProvider>\n      </ReactThunderIDContext.Provider>\n    </ThunderIDContext.Provider>\n  );\n};\n\nexport default ThunderIDClientProvider;\n"],"mappings":";;;;;;;;;;;;;;;;;;AAiEA,MAAMA,2BAAgF,EACpF,SACA,UACA,QACA,cACA,cACA,SACA,QACA,qBACA,aACA,YACA,WACA,WACA,MAAM,OACN,aAAa,cACb,eACA,eACA,oBACA,QACA,QACA,cAAc,WACuC;CACrD,MAAMC,qCAA8C,MAAM;CAC1D,MAAMC,yCAAuC;CAC7C,MAAMC,qDAAyD;CAC/D,MAAM,CAAC,WAAW,oCAAkC,KAAK;CACzD,MAAM,CAAC,MAAM,+BAAiC,MAAM;CACpD,MAAM,CAAC,aAAa,sCAAwC,aAAa;AAEzE,4BAAgB;AACd,iBAAe,aAAa;IAC3B,CAAC,aAAa,CAAC;AAElB,4BAAgB;AACd,UAAQ,MAAM;IACb,CAAC,MAAM,CAAC;AAGX,4BAAgB;AAOd,MAAI,iBAAiB,QACnB;AAGF,mBAAiB,UAAU;AAG3B,MAAI,WAAY;AAEhB,GAAC,YAA2B;AAC1B,OAAI;IACF,MAAMC,OAAsB,aAAa,IAAI,OAAO;IACpD,MAAMC,QAAuB,aAAa,IAAI,QAAQ;IACtD,MAAMC,eAA8B,aAAa,IAAI,gBAAgB;AAIrE,QAH6B,aAAa,IAAI,QAAQ,EAG3C;AACT,4BAAO,MAAM,qFAAqF;AAElG;;AAIF,QAAI,QAAQ,OAAO;AACjB,kBAAa,KAAK;KAElB,MAAMC,SAAmE,MAAM,oBAC7E,MACA,OACA,gBAAgB,OACjB;AAED,SAAI,OAAO,QAET,KAAI,OAAO,YACT,QAAO,KAAK,OAAO,YAAY;SAG/B,QAAO,SAAS,QAAQ;SAG1B,wBAAO,MACL,iEAAiE,OAAO,SAAS,0BAClF;;YAGE,OAAO;AACd,2BAAO,MAAM,8DAA8D,MAAM;;MAEjF;IACH,EAAE,CAAC;AAEN,4BAAgB;AAEd,eAAa,MAAM;IAClB,CAAC,YAAY,KAAK,CAAC;CAEtB,MAAM,eAAe,OAAO,SAAc,YAA4D;AACpG,MAAI,CAAC,OACH,OAAM,IAAIC,uCACR,uCACA,yDACA,SACD;EAGH,MAAMC,SAAc,MAAM,OAAO,SAAS,QAAQ;AAMlD,MAAI,QAAQ,MAAM,WAAW;AAC3B,UAAO,SAAS,OAAO,OAAO,KAAK;AAEnC;;AAIF,MAAI,QAAQ,MAAM,gBAAgB;AAChC,UAAO,KAAK,OAAO,KAAK,eAAe;AAEvC;;AAGF,MAAI,QAAQ,MACV,OAAM,IAAI,MAAM,OAAO,MAAM;AAG/B,SAAO,QAAQ,QAAQ;;CAGzB,MAAM,eAAe,OAAO,SAAc,YAA4D;AACpG,MAAI,CAAC,OACH,OAAM,IAAID,uCACR,uCACA,yDACA,SACD;EAGH,MAAMC,SAAc,MAAM,OAAO,SAAS,QAAQ;AAGlD,MAAI,QAAQ,MAAM,WAAW;AAC3B,UAAO,KAAK,OAAO,KAAK,UAAU;AAElC;;AAIF,MAAI,QAAQ,MAAM,gBAAgB;AAChC,UAAO,KAAK,OAAO,KAAK,eAAe;AAEvC;;AAGF,MAAI,QAAQ,MACV,OAAM,IAAI,MAAM,OAAO,MAAM;AAG/B,SAAO,QAAQ,QAAQ;;CAGzB,MAAM,gBAAgB,YAA0B;AAC9C,yBAAO,MAAM,mEAAmE;AAEhF,MAAI;GACF,MAAMA,SAAc,MAAM,SAAS;AAEnC,0BAAO,MAAM,6DAA6D,OAAO;AAEjF,OAAI,QAAQ,MAAM,iBAAiB;AACjC,WAAO,KAAK,OAAO,KAAK,gBAAgB;AAExC,WAAO;KAAC,UAAU,OAAO,KAAK;KAAiB,YAAY;KAAK;;AAGlE,OAAI,QAAQ,MACV,wBAAO,MACL,uHACA,OAAO,MACR;AAGH,UAAO,QAAQ,QAAQ;WAChB,OAAO;AACd,0BAAO,MACL,4GACA,MACD;AAED;;;CAIJ,MAAMC,yCACG;EACL;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA,QAAQ;EACR;EACA,SAAS;EACT,QAAQ;EACR;EACA;EACD,GACD;EACE;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACD,CACF;CAED,MAAM,uBAAuB,YAAwB;AACnD,UAAQ,QAAQ;AAChB,kBAAgB,UAAuB;GACrC,GAAG;GACH,qEAA+C,QAAQ;GACvD,SAAS;GACV,EAAE;;CAUL,MAAM,eAAe,SAAyC;AAC5D,eACE,QAAQ,OACN,IAAIF,uCACF,KAAK,KAAK,4CACV,2BAA2B,KAAK,yBAChC,SACD,CACF;;CAGL,MAAMG,8CACG;EACL,gBAAgB;EAChB;EACA;EACA;EACA,UAAU;EACV,WAAW,EAAC,WAAW,MAAK;EAC5B,eAAe,YAAY,gBAAgB;EAC3C,gBAAgB,YAAY,iBAAiB;EAC7C,mBAAmB,YAAY,oBAAoB;EACnD,YAAY,YAAY,aAAa;EACrC,yBAAyB,QAAQ,QAAQ,KAAK;EAC9C,MAAM;GACJ,SAAS,YAAY,eAAe;GACpC,YAAY,YAAY,kBAAkB;GAC3C;EACD,YAAY;EACZ,eAAe,CAAC;EAChB;EACA,eAAe;EACf;EACA,MAAM,eAAe;EACrB;EACA,cAAc,YAAY,eAAe;EACzC,SAAS,YAAY,UAAU;EAC/B,8BAA8B,SAAqC,QAAQ;EAC3E;EACA,QAAQ;EACR,gBAAgB,YAAY,iBAAiB;EAC7C;EACA,SAAS;EACT,QAAQ;EACR;EACA;EACA,8CAAwB,OAAO;EAChC,GACD;EACE;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACD,CACF;AAED,QACE,2CAACC,iCAAiB;EAAS,OAAO;YAChC,2CAACC,mCAAsB;GAAS,OAAO;aACrC,2CAACC;IAAa,aAAa,aAAa;cACtC,2CAACC;KAAiB,SAAS,aAAa,oBAAoB;KAAoB;eAC9E,2CAACC;MAAc,OAAO,aAAa,OAAO;MAAW,4CAAqB,aAAa,OAAO,KAAY;gBACxG,2CAACC,4CACC,2CAACC;OAAa,SAAS;OAAa,iBAAiB;OAAoC;OACtF;QACY,GACF;OACD;MACC;KACN;IACgB;GACP;;AAIhC,gCAAe"}
+{"version":3,"file":"ThunderIDProvider.cjs","names":["ThunderIDClientProvider: FC<PropsWithChildren<ThunderIDClientProviderProps>>","reRenderCheckRef: RefObject<boolean>","router: AppRouterInstance","searchParams: ReadonlyURLSearchParams","code: string | null","state: string | null","sessionState: string | null","result: {error?: string; redirectUrl?: string; success: boolean}","ThunderIDRuntimeError","result: any","contextValue: ThunderIDContextProps","reactContextValue: ReactThunderIDContextProps","ThunderIDContext","ReactThunderIDContext","I18nProvider","FlowMetaProvider","ThemeProvider","FlowProvider","UserProvider"],"sources":["../../../../../src/client/contexts/ThunderID/ThunderIDProvider.tsx"],"sourcesContent":["// Copyright 2025 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\n'use client';\n\nimport {\n  EmbeddedFlowExecuteRequestConfig,\n  FlowMetadataResponse,\n  generateFlattenedUserProfile,\n  UpdateMeProfileConfig,\n  User,\n  UserProfile,\n  ThunderIDRuntimeError,\n  getVendorPrefix,\n} from '@thunderid/node';\nimport {\n  I18nProvider,\n  FlowMetaProvider,\n  FlowProvider,\n  UserProvider,\n  ThemeProvider,\n  ThunderIDContext as ReactThunderIDContext,\n  ThunderIDContextProps as ReactThunderIDContextProps,\n  ThunderIDProviderProps,\n  getActiveTheme,\n} from '@thunderid/react';\nimport {ReadonlyURLSearchParams} from 'next/dist/client/components/navigation.react-server';\nimport {AppRouterInstance} from 'next/dist/shared/lib/app-router-context.shared-runtime';\nimport {useRouter, useSearchParams} from 'next/navigation';\nimport {FC, PropsWithChildren, RefObject, useEffect, useMemo, useRef, useState} from 'react';\nimport ThunderIDContext, {ThunderIDContextProps} from './ThunderIDContext';\nimport {RefreshResult} from '../../../server/actions/refreshToken';\nimport logger from '../../../utils/logger';\n\n/**\n * Props interface of {@link ThunderIDClientProvider}\n */\nexport type ThunderIDClientProviderProps = Partial<Omit<ThunderIDProviderProps, 'baseUrl' | 'clientId'>> &\n  Pick<ThunderIDProviderProps, 'baseUrl' | 'clientId'> & {\n    applicationId: ThunderIDContextProps['applicationId'];\n    clearSession: () => Promise<void>;\n    handleOAuthCallback: (\n      code: string,\n      state: string,\n      sessionState?: string,\n    ) => Promise<{error?: string; redirectUrl?: string; success: boolean}>;\n    /**\n     * Flow metadata fetched server-side ahead of time, seeding `FlowMetaProvider` so it can skip\n     * its own initial client-side fetch (avoiding a flash of untranslated i18n keys).\n     */\n    initialMeta?: FlowMetadataResponse | null;\n    isSignedIn: boolean;\n    organizationHandle: ThunderIDContextProps['organizationHandle'];\n    refreshToken: () => Promise<RefreshResult>;\n    signIn: ThunderIDContextProps['signIn'];\n    signOut: ThunderIDContextProps['signOut'];\n    signUp: ThunderIDContextProps['signUp'];\n    updateProfile: (\n      requestConfig: UpdateMeProfileConfig,\n      sessionId?: string,\n    ) => Promise<{data: {user: User}; error: string; success: boolean}>;\n    user: User | null;\n    userProfile: UserProfile;\n  };\n\nconst ThunderIDClientProvider: FC<PropsWithChildren<ThunderIDClientProviderProps>> = ({\n  baseUrl,\n  children,\n  signIn,\n  clearSession,\n  refreshToken,\n  signOut,\n  signUp,\n  handleOAuthCallback,\n  preferences,\n  isSignedIn,\n  signInUrl,\n  signUpUrl,\n  user: _user,\n  userProfile: _userProfile,\n  updateProfile,\n  applicationId,\n  organizationHandle,\n  scopes,\n  vendor,\n  initialMeta = null,\n}: PropsWithChildren<ThunderIDClientProviderProps>) => {\n  const reRenderCheckRef: RefObject<boolean> = useRef(false);\n  const router: AppRouterInstance = useRouter();\n  const searchParams: ReadonlyURLSearchParams = useSearchParams();\n  const [isLoading, setIsLoading] = useState<boolean>(true);\n  const [user, setUser] = useState<User | null>(_user);\n  const [userProfile, setUserProfile] = useState<UserProfile>(_userProfile);\n\n  useEffect(() => {\n    setUserProfile(_userProfile);\n  }, [_userProfile]);\n\n  useEffect(() => {\n    setUser(_user);\n  }, [_user]);\n\n  // Handle OAuth callback automatically\n  useEffect(() => {\n    // React 18.x Strict.Mode has a new check for `Ensuring reusable state` to facilitate an upcoming react feature.\n    // https://reactjs.org/docs/strict-mode.html#ensuring-reusable-state\n    // This will remount all the useEffects to ensure that there are no unexpected side effects.\n    // When react remounts the signIn hook of the AuthProvider, it will cause a race condition. Hence, we have to\n    // prevent the re-render of this hook as suggested in the following discussion.\n    // https://github.com/reactwg/react-18/discussions/18#discussioncomment-795623\n    if (reRenderCheckRef.current) {\n      return;\n    }\n\n    reRenderCheckRef.current = true;\n\n    // Don't handle callback if already signed in\n    if (isSignedIn) return;\n\n    (async (): Promise<void> => {\n      try {\n        const code: string | null = searchParams.get('code');\n        const state: string | null = searchParams.get('state');\n        const sessionState: string | null = searchParams.get('session_state');\n        const error: string | null = searchParams.get('error');\n\n        // Check for OAuth errors first\n        if (error) {\n          logger.error('[ThunderIDClientProvider] An error was received for the initiated sign-in request.');\n\n          return;\n        }\n\n        // Handle OAuth callback if code and state are present\n        if (code && state) {\n          setIsLoading(true);\n\n          const result: {error?: string; redirectUrl?: string; success: boolean} = await handleOAuthCallback(\n            code,\n            state,\n            sessionState || undefined,\n          );\n\n          if (result.success) {\n            // Redirect to the success URL\n            if (result.redirectUrl) {\n              router.push(result.redirectUrl);\n            } else {\n              // Refresh the page to update authentication state\n              window.location.reload();\n            }\n          } else {\n            logger.error(\n              `[ThunderIDClientProvider] An error occurred while signing in: ${result.error || 'Authentication failed'}`,\n            );\n          }\n        }\n      } catch (error) {\n        logger.error('[ThunderIDClientProvider] Failed to handle OAuth callback:', error);\n      }\n    })();\n  }, []);\n\n  useEffect(() => {\n    // Set loading to false when server has resolved authentication state\n    setIsLoading(false);\n  }, [isSignedIn, user]);\n\n  const handleSignIn = async (payload: any, request: EmbeddedFlowExecuteRequestConfig): Promise<any> => {\n    if (!signIn) {\n      throw new ThunderIDRuntimeError(\n        '`signIn` function is not available.',\n        'ThunderIDClientProvider-handleSignIn-RuntimeError-001',\n        'nextjs',\n      );\n    }\n\n    const result: any = await signIn(payload, request);\n\n    // Redirect based flow URL is sent as `signInUrl` in the response.\n    // Use window.location.href instead of router.push() — the OAuth authorization\n    // endpoint is on an external server, and router.push() would send RSC fetch\n    // headers that the identity provider doesn't understand, causing a CORS error.\n    if (result?.data?.signInUrl) {\n      window.location.href = result.data.signInUrl;\n\n      return undefined;\n    }\n\n    // After the Embedded flow is successful, the URL to navigate next is sent as `afterSignInUrl` in the response.\n    if (result?.data?.afterSignInUrl) {\n      router.push(result.data.afterSignInUrl);\n\n      return undefined;\n    }\n\n    if (result?.error) {\n      throw new Error(result.error);\n    }\n\n    return result?.data ?? result;\n  };\n\n  const handleSignUp = async (payload: any, request: EmbeddedFlowExecuteRequestConfig): Promise<any> => {\n    if (!signUp) {\n      throw new ThunderIDRuntimeError(\n        '`signUp` function is not available.',\n        'ThunderIDClientProvider-handleSignUp-RuntimeError-001',\n        'nextjs',\n      );\n    }\n\n    const result: any = await signUp(payload, request);\n\n    // Redirect based flow URL is sent as `signUpUrl` in the response.\n    if (result?.data?.signUpUrl) {\n      router.push(result.data.signUpUrl);\n\n      return undefined;\n    }\n\n    // After the Embedded flow is successful, the URL to navigate next is sent as `afterSignUpUrl` in the response.\n    if (result?.data?.afterSignUpUrl) {\n      router.push(result.data.afterSignUpUrl);\n\n      return undefined;\n    }\n\n    if (result?.error) {\n      throw new Error(result.error);\n    }\n\n    return result?.data ?? result;\n  };\n\n  const handleSignOut = async (): Promise<any> => {\n    logger.debug('[ThunderIDClientProvider][handleSignOut] `handleSignOut` called.');\n\n    try {\n      const result: any = await signOut();\n\n      logger.debug('[ThunderIDClientProvider][handleSignOut] Sign out result:', result);\n\n      if (result?.data?.afterSignOutUrl) {\n        router.push(result.data.afterSignOutUrl);\n\n        return {location: result.data.afterSignOutUrl, redirected: true};\n      }\n\n      if (result?.error) {\n        logger.error(\n          '[ThunderIDClientProvider][handleSignOut] Error result was returned during signing the user out with a button click:',\n          result.error,\n        );\n      }\n\n      return result?.data ?? result;\n    } catch (error) {\n      logger.error(\n        '[ThunderIDClientProvider][handleSignOut] Error occurred during signing the user out with a button click:',\n        error,\n      );\n\n      return undefined;\n    }\n  };\n\n  const contextValue: ThunderIDContextProps = useMemo(\n    () => ({\n      applicationId,\n      baseUrl,\n      clearSession,\n      isLoading,\n      isSignedIn,\n      organizationHandle,\n      preferences,\n      refreshToken,\n      scopes,\n      signIn: handleSignIn,\n      signInUrl,\n      signOut: handleSignOut,\n      signUp: handleSignUp,\n      signUpUrl,\n      user,\n    }),\n    [\n      baseUrl,\n      user,\n      isSignedIn,\n      isLoading,\n      signInUrl,\n      signUpUrl,\n      applicationId,\n      organizationHandle,\n      scopes,\n      preferences,\n    ],\n  );\n\n  const handleProfileUpdate = (payload: User): void => {\n    setUser(payload);\n    setUserProfile((prev: UserProfile) => ({\n      ...prev,\n      flattenedProfile: generateFlattenedUserProfile(payload),\n      profile: payload,\n    }));\n  };\n\n  // Bridge into @thunderid/react's own ThunderIDContext. Internal react components rendered by\n  // BaseSignIn/BaseSignUp — most notably FlowMetaProvider, which fetches `/flow/meta` and injects\n  // its i18n bundle — call react's `useThunderID()` directly. Without this bridge they'd only see\n  // react's context default (applicationId/baseUrl undefined, isInitialized false), so the meta\n  // fetch would never fire and flow labels would render as untranslated i18n keys. Fields with no\n  // nextjs equivalent (token/http helpers meant for direct browser API calls) are stubbed out,\n  // since nextjs routes those operations through server actions instead.\n  const unsupported = (name: string): (() => Promise<never>) => {\n    return () =>\n      Promise.reject(\n        new ThunderIDRuntimeError(\n          `\\`${name}\\` is not supported in @thunderid/nextjs.`,\n          `ThunderIDClientProvider-${name}-NotSupportedError-001`,\n          'nextjs',\n        ),\n      );\n  };\n\n  const reactContextValue: ReactThunderIDContextProps = useMemo(\n    () => ({\n      afterSignInUrl: undefined,\n      applicationId,\n      baseUrl,\n      clearSession,\n      clientId: undefined,\n      discovery: {wellKnown: null},\n      exchangeToken: unsupported('exchangeToken'),\n      getAccessToken: unsupported('getAccessToken'),\n      getDecodedIdToken: unsupported('getDecodedIdToken'),\n      getIdToken: unsupported('getIdToken'),\n      getStorageManager: () => Promise.resolve(null),\n      http: {\n        request: unsupported('http.request'),\n        requestAll: unsupported('http.requestAll'),\n      },\n      instanceId: 0,\n      isInitialized: !isLoading,\n      isLoading,\n      isMetaLoading: false,\n      isSignedIn,\n      meta: initialMeta ?? null,\n      organizationHandle,\n      reInitialize: unsupported('reInitialize'),\n      recover: unsupported('recover'),\n      resolveFlowTemplateLiterals: (text: string | undefined): string => text ?? '',\n      scopes,\n      signIn: handleSignIn,\n      signInSilently: unsupported('signInSilently'),\n      signInUrl,\n      signOut: handleSignOut,\n      signUp: handleSignUp,\n      signUpUrl,\n      user,\n      userSchema: null,\n      vendor: getVendorPrefix(vendor),\n    }),\n    [\n      applicationId,\n      baseUrl,\n      clearSession,\n      isLoading,\n      isSignedIn,\n      organizationHandle,\n      scopes,\n      signInUrl,\n      signUpUrl,\n      user,\n      initialMeta,\n      vendor,\n    ],\n  );\n\n  return (\n    <ThunderIDContext.Provider value={contextValue}>\n      <ReactThunderIDContext.Provider value={reactContextValue}>\n        <I18nProvider preferences={preferences?.i18n}>\n          <FlowMetaProvider enabled={preferences?.resolveFromMeta !== false} initialMeta={initialMeta}>\n            <ThemeProvider theme={preferences?.theme?.overrides} mode={getActiveTheme(preferences?.theme?.mode as any)}>\n              <FlowProvider>\n                <UserProvider profile={userProfile} onUpdateProfile={handleProfileUpdate} updateProfile={updateProfile}>\n                  {children}\n                </UserProvider>\n              </FlowProvider>\n            </ThemeProvider>\n          </FlowMetaProvider>\n        </I18nProvider>\n      </ReactThunderIDContext.Provider>\n    </ThunderIDContext.Provider>\n  );\n};\n\nexport default ThunderIDClientProvider;\n"],"mappings":";;;;;;;;;;;;;;;;;;AAiEA,MAAMA,2BAAgF,EACpF,SACA,UACA,QACA,cACA,cACA,SACA,QACA,qBACA,aACA,YACA,WACA,WACA,MAAM,OACN,aAAa,cACb,eACA,eACA,oBACA,QACA,QACA,cAAc,WACuC;CACrD,MAAMC,qCAA8C,MAAM;CAC1D,MAAMC,yCAAuC;CAC7C,MAAMC,qDAAyD;CAC/D,MAAM,CAAC,WAAW,oCAAkC,KAAK;CACzD,MAAM,CAAC,MAAM,+BAAiC,MAAM;CACpD,MAAM,CAAC,aAAa,sCAAwC,aAAa;AAEzE,4BAAgB;AACd,iBAAe,aAAa;IAC3B,CAAC,aAAa,CAAC;AAElB,4BAAgB;AACd,UAAQ,MAAM;IACb,CAAC,MAAM,CAAC;AAGX,4BAAgB;AAOd,MAAI,iBAAiB,QACnB;AAGF,mBAAiB,UAAU;AAG3B,MAAI,WAAY;AAEhB,GAAC,YAA2B;AAC1B,OAAI;IACF,MAAMC,OAAsB,aAAa,IAAI,OAAO;IACpD,MAAMC,QAAuB,aAAa,IAAI,QAAQ;IACtD,MAAMC,eAA8B,aAAa,IAAI,gBAAgB;AAIrE,QAH6B,aAAa,IAAI,QAAQ,EAG3C;AACT,4BAAO,MAAM,qFAAqF;AAElG;;AAIF,QAAI,QAAQ,OAAO;AACjB,kBAAa,KAAK;KAElB,MAAMC,SAAmE,MAAM,oBAC7E,MACA,OACA,gBAAgB,OACjB;AAED,SAAI,OAAO,QAET,KAAI,OAAO,YACT,QAAO,KAAK,OAAO,YAAY;SAG/B,QAAO,SAAS,QAAQ;SAG1B,wBAAO,MACL,iEAAiE,OAAO,SAAS,0BAClF;;YAGE,OAAO;AACd,2BAAO,MAAM,8DAA8D,MAAM;;MAEjF;IACH,EAAE,CAAC;AAEN,4BAAgB;AAEd,eAAa,MAAM;IAClB,CAAC,YAAY,KAAK,CAAC;CAEtB,MAAM,eAAe,OAAO,SAAc,YAA4D;AACpG,MAAI,CAAC,OACH,OAAM,IAAIC,uCACR,uCACA,yDACA,SACD;EAGH,MAAMC,SAAc,MAAM,OAAO,SAAS,QAAQ;AAMlD,MAAI,QAAQ,MAAM,WAAW;AAC3B,UAAO,SAAS,OAAO,OAAO,KAAK;AAEnC;;AAIF,MAAI,QAAQ,MAAM,gBAAgB;AAChC,UAAO,KAAK,OAAO,KAAK,eAAe;AAEvC;;AAGF,MAAI,QAAQ,MACV,OAAM,IAAI,MAAM,OAAO,MAAM;AAG/B,SAAO,QAAQ,QAAQ;;CAGzB,MAAM,eAAe,OAAO,SAAc,YAA4D;AACpG,MAAI,CAAC,OACH,OAAM,IAAID,uCACR,uCACA,yDACA,SACD;EAGH,MAAMC,SAAc,MAAM,OAAO,SAAS,QAAQ;AAGlD,MAAI,QAAQ,MAAM,WAAW;AAC3B,UAAO,KAAK,OAAO,KAAK,UAAU;AAElC;;AAIF,MAAI,QAAQ,MAAM,gBAAgB;AAChC,UAAO,KAAK,OAAO,KAAK,eAAe;AAEvC;;AAGF,MAAI,QAAQ,MACV,OAAM,IAAI,MAAM,OAAO,MAAM;AAG/B,SAAO,QAAQ,QAAQ;;CAGzB,MAAM,gBAAgB,YAA0B;AAC9C,yBAAO,MAAM,mEAAmE;AAEhF,MAAI;GACF,MAAMA,SAAc,MAAM,SAAS;AAEnC,0BAAO,MAAM,6DAA6D,OAAO;AAEjF,OAAI,QAAQ,MAAM,iBAAiB;AACjC,WAAO,KAAK,OAAO,KAAK,gBAAgB;AAExC,WAAO;KAAC,UAAU,OAAO,KAAK;KAAiB,YAAY;KAAK;;AAGlE,OAAI,QAAQ,MACV,wBAAO,MACL,uHACA,OAAO,MACR;AAGH,UAAO,QAAQ,QAAQ;WAChB,OAAO;AACd,0BAAO,MACL,4GACA,MACD;AAED;;;CAIJ,MAAMC,yCACG;EACL;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA,QAAQ;EACR;EACA,SAAS;EACT,QAAQ;EACR;EACA;EACD,GACD;EACE;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACD,CACF;CAED,MAAM,uBAAuB,YAAwB;AACnD,UAAQ,QAAQ;AAChB,kBAAgB,UAAuB;GACrC,GAAG;GACH,qEAA+C,QAAQ;GACvD,SAAS;GACV,EAAE;;CAUL,MAAM,eAAe,SAAyC;AAC5D,eACE,QAAQ,OACN,IAAIF,uCACF,KAAK,KAAK,4CACV,2BAA2B,KAAK,yBAChC,SACD,CACF;;CAGL,MAAMG,8CACG;EACL,gBAAgB;EAChB;EACA;EACA;EACA,UAAU;EACV,WAAW,EAAC,WAAW,MAAK;EAC5B,eAAe,YAAY,gBAAgB;EAC3C,gBAAgB,YAAY,iBAAiB;EAC7C,mBAAmB,YAAY,oBAAoB;EACnD,YAAY,YAAY,aAAa;EACrC,yBAAyB,QAAQ,QAAQ,KAAK;EAC9C,MAAM;GACJ,SAAS,YAAY,eAAe;GACpC,YAAY,YAAY,kBAAkB;GAC3C;EACD,YAAY;EACZ,eAAe,CAAC;EAChB;EACA,eAAe;EACf;EACA,MAAM,eAAe;EACrB;EACA,cAAc,YAAY,eAAe;EACzC,SAAS,YAAY,UAAU;EAC/B,8BAA8B,SAAqC,QAAQ;EAC3E;EACA,QAAQ;EACR,gBAAgB,YAAY,iBAAiB;EAC7C;EACA,SAAS;EACT,QAAQ;EACR;EACA;EACA,YAAY;EACZ,8CAAwB,OAAO;EAChC,GACD;EACE;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACD,CACF;AAED,QACE,2CAACC,iCAAiB;EAAS,OAAO;YAChC,2CAACC,mCAAsB;GAAS,OAAO;aACrC,2CAACC;IAAa,aAAa,aAAa;cACtC,2CAACC;KAAiB,SAAS,aAAa,oBAAoB;KAAoB;eAC9E,2CAACC;MAAc,OAAO,aAAa,OAAO;MAAW,4CAAqB,aAAa,OAAO,KAAY;gBACxG,2CAACC,4CACC,2CAACC;OAAa,SAAS;OAAa,iBAAiB;OAAoC;OACtF;QACY,GACF;OACD;MACC;KACN;IACgB;GACP;;AAIhC,gCAAe"}

package/dist/cjs/utils/decorateConfigWithNextEnv.cjs

@@ -1,7 +1,7 @@
 
 //#region src/utils/decorateConfigWithNextEnv.ts
 const decorateConfigWithNextEnv = (config) => {
-	const { organizationHandle, scopes, applicationId, baseUrl, clientId, clientSecret, signInUrl, signUpUrl, afterSignInUrl, afterSignOutUrl, vendor,...rest } = config;
+	const { organizationHandle, scopes, applicationId, baseUrl, clientId, clientSecret, flowSecret, signInUrl, signUpUrl, afterSignInUrl, afterSignOutUrl, vendor,...rest } = config;
 	const envExpiryTime = process.env["THUNDERID_SESSION_COOKIE_EXPIRY_TIME"] ? parseInt(process.env["THUNDERID_SESSION_COOKIE_EXPIRY_TIME"], 10) : void 0;
 	return {
 		...rest,
@@ -11,6 +11,7 @@ const decorateConfigWithNextEnv = (config) => {
 		baseUrl: baseUrl || process.env["NEXT_PUBLIC_THUNDERID_BASE_URL"],
 		clientId: clientId || process.env["NEXT_PUBLIC_THUNDERID_CLIENT_ID"],
 		clientSecret: clientSecret || process.env["THUNDERID_CLIENT_SECRET"],
+		flowSecret: flowSecret || process.env["THUNDERID_FLOW_SECRET"],
 		organizationHandle: organizationHandle || process.env["NEXT_PUBLIC_THUNDERID_ORGANIZATION_HANDLE"],
 		scopes: scopes || process.env["NEXT_PUBLIC_THUNDERID_SCOPES"],
 		sessionCookie: {

package/dist/cjs/utils/decorateConfigWithNextEnv.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"decorateConfigWithNextEnv.cjs","names":[],"sources":["../../../src/utils/decorateConfigWithNextEnv.ts"],"sourcesContent":["// Copyright 2025 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\nimport {ThunderIDNextConfig} from '../models/config';\n\nconst decorateConfigWithNextEnv = (config: ThunderIDNextConfig): ThunderIDNextConfig => {\n  const {\n    organizationHandle,\n    scopes,\n    applicationId,\n    baseUrl,\n    clientId,\n    clientSecret,\n    signInUrl,\n    signUpUrl,\n    afterSignInUrl,\n    afterSignOutUrl,\n    vendor,\n    ...rest\n  } = config;\n\n  const envExpiryTime = process.env['THUNDERID_SESSION_COOKIE_EXPIRY_TIME']\n    ? parseInt(process.env['THUNDERID_SESSION_COOKIE_EXPIRY_TIME'], 10)\n    : undefined;\n\n  return {\n    ...rest,\n    afterSignInUrl: afterSignInUrl || process.env['NEXT_PUBLIC_THUNDERID_AFTER_SIGN_IN_URL']!,\n    afterSignOutUrl: afterSignOutUrl || process.env['NEXT_PUBLIC_THUNDERID_AFTER_SIGN_OUT_URL']!,\n    applicationId: applicationId || process.env['NEXT_PUBLIC_THUNDERID_APPLICATION_ID']!,\n    baseUrl: baseUrl || process.env['NEXT_PUBLIC_THUNDERID_BASE_URL']!,\n    clientId: clientId || process.env['NEXT_PUBLIC_THUNDERID_CLIENT_ID']!,\n    clientSecret: clientSecret || process.env['THUNDERID_CLIENT_SECRET']!,\n    organizationHandle: organizationHandle || process.env['NEXT_PUBLIC_THUNDERID_ORGANIZATION_HANDLE']!,\n    scopes: scopes || process.env['NEXT_PUBLIC_THUNDERID_SCOPES']!,\n    sessionCookie: {\n      ...rest.sessionCookie,\n      expiryTime: rest.sessionCookie?.expiryTime || envExpiryTime,\n    },\n    signInUrl: signInUrl || process.env['NEXT_PUBLIC_THUNDERID_SIGN_IN_URL']!,\n    signUpUrl: signUpUrl || process.env['NEXT_PUBLIC_THUNDERID_SIGN_UP_URL']!,\n    vendor: vendor || process.env['NEXT_PUBLIC_THUNDERID_VENDOR'],\n  };\n};\n\nexport default decorateConfigWithNextEnv;\n"],"mappings":";;AAKA,MAAM,6BAA6B,WAAqD;CACtF,MAAM,EACJ,oBACA,QACA,eACA,SACA,UACA,cACA,WACA,WACA,gBACA,iBACA,OACA,GAAG,SACD;CAEJ,MAAM,gBAAgB,QAAQ,IAAI,0CAC9B,SAAS,QAAQ,IAAI,yCAAyC,GAAG,GACjE;AAEJ,QAAO;EACL,GAAG;EACH,gBAAgB,kBAAkB,QAAQ,IAAI;EAC9C,iBAAiB,mBAAmB,QAAQ,IAAI;EAChD,eAAe,iBAAiB,QAAQ,IAAI;EAC5C,SAAS,WAAW,QAAQ,IAAI;EAChC,UAAU,YAAY,QAAQ,IAAI;EAClC,cAAc,gBAAgB,QAAQ,IAAI;EAC1C,oBAAoB,sBAAsB,QAAQ,IAAI;EACtD,QAAQ,UAAU,QAAQ,IAAI;EAC9B,eAAe;GACb,GAAG,KAAK;GACR,YAAY,KAAK,eAAe,cAAc;GAC/C;EACD,WAAW,aAAa,QAAQ,IAAI;EACpC,WAAW,aAAa,QAAQ,IAAI;EACpC,QAAQ,UAAU,QAAQ,IAAI;EAC/B;;AAGH,wCAAe"}
+{"version":3,"file":"decorateConfigWithNextEnv.cjs","names":[],"sources":["../../../src/utils/decorateConfigWithNextEnv.ts"],"sourcesContent":["// Copyright 2025 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\nimport {ThunderIDNextConfig} from '../models/config';\n\nconst decorateConfigWithNextEnv = (config: ThunderIDNextConfig): ThunderIDNextConfig => {\n  const {\n    organizationHandle,\n    scopes,\n    applicationId,\n    baseUrl,\n    clientId,\n    clientSecret,\n    flowSecret,\n    signInUrl,\n    signUpUrl,\n    afterSignInUrl,\n    afterSignOutUrl,\n    vendor,\n    ...rest\n  } = config;\n\n  const envExpiryTime = process.env['THUNDERID_SESSION_COOKIE_EXPIRY_TIME']\n    ? parseInt(process.env['THUNDERID_SESSION_COOKIE_EXPIRY_TIME'], 10)\n    : undefined;\n\n  return {\n    ...rest,\n    afterSignInUrl: afterSignInUrl || process.env['NEXT_PUBLIC_THUNDERID_AFTER_SIGN_IN_URL']!,\n    afterSignOutUrl: afterSignOutUrl || process.env['NEXT_PUBLIC_THUNDERID_AFTER_SIGN_OUT_URL']!,\n    applicationId: applicationId || process.env['NEXT_PUBLIC_THUNDERID_APPLICATION_ID']!,\n    baseUrl: baseUrl || process.env['NEXT_PUBLIC_THUNDERID_BASE_URL']!,\n    clientId: clientId || process.env['NEXT_PUBLIC_THUNDERID_CLIENT_ID']!,\n    clientSecret: clientSecret || process.env['THUNDERID_CLIENT_SECRET']!,\n    flowSecret: flowSecret || process.env['THUNDERID_FLOW_SECRET'],\n    organizationHandle: organizationHandle || process.env['NEXT_PUBLIC_THUNDERID_ORGANIZATION_HANDLE']!,\n    scopes: scopes || process.env['NEXT_PUBLIC_THUNDERID_SCOPES']!,\n    sessionCookie: {\n      ...rest.sessionCookie,\n      expiryTime: rest.sessionCookie?.expiryTime || envExpiryTime,\n    },\n    signInUrl: signInUrl || process.env['NEXT_PUBLIC_THUNDERID_SIGN_IN_URL']!,\n    signUpUrl: signUpUrl || process.env['NEXT_PUBLIC_THUNDERID_SIGN_UP_URL']!,\n    vendor: vendor || process.env['NEXT_PUBLIC_THUNDERID_VENDOR'],\n  };\n};\n\nexport default decorateConfigWithNextEnv;\n"],"mappings":";;AAKA,MAAM,6BAA6B,WAAqD;CACtF,MAAM,EACJ,oBACA,QACA,eACA,SACA,UACA,cACA,YACA,WACA,WACA,gBACA,iBACA,OACA,GAAG,SACD;CAEJ,MAAM,gBAAgB,QAAQ,IAAI,0CAC9B,SAAS,QAAQ,IAAI,yCAAyC,GAAG,GACjE;AAEJ,QAAO;EACL,GAAG;EACH,gBAAgB,kBAAkB,QAAQ,IAAI;EAC9C,iBAAiB,mBAAmB,QAAQ,IAAI;EAChD,eAAe,iBAAiB,QAAQ,IAAI;EAC5C,SAAS,WAAW,QAAQ,IAAI;EAChC,UAAU,YAAY,QAAQ,IAAI;EAClC,cAAc,gBAAgB,QAAQ,IAAI;EAC1C,YAAY,cAAc,QAAQ,IAAI;EACtC,oBAAoB,sBAAsB,QAAQ,IAAI;EACtD,QAAQ,UAAU,QAAQ,IAAI;EAC9B,eAAe;GACb,GAAG,KAAK;GACR,YAAY,KAAK,eAAe,cAAc;GAC/C;EACD,WAAW,aAAa,QAAQ,IAAI;EACpC,WAAW,aAAa,QAAQ,IAAI;EACpC,QAAQ,UAAU,QAAQ,IAAI;EAC/B;;AAGH,wCAAe"}

package/dist/client/contexts/ThunderID/ThunderIDProvider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ThunderIDProvider.d.ts","sourceRoot":"","sources":["../../../../src/client/contexts/ThunderID/ThunderIDProvider.tsx"],"names":[],"mappings":"AAKA,OAAO,EAEL,oBAAoB,EAEpB,qBAAqB,EACrB,IAAI,EACJ,WAAW,EAGZ,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAQL,sBAAsB,EAEvB,MAAM,kBAAkB,CAAC;AAI1B,OAAO,EAAC,EAAE,EAAE,iBAAiB,EAAkD,MAAM,OAAO,CAAC;AAC7F,OAAyB,EAAC,qBAAqB,EAAC,MAAM,oBAAoB,CAAC;AAC3E,OAAO,EAAC,aAAa,EAAC,MAAM,sCAAsC,CAAC;AAGnE;;GAEG;AACH,MAAM,MAAM,4BAA4B,GAAG,OAAO,CAAC,IAAI,CAAC,sBAAsB,EAAE,SAAS,GAAG,UAAU,CAAC,CAAC,GACtG,IAAI,CAAC,sBAAsB,EAAE,SAAS,GAAG,UAAU,CAAC,GAAG;IACrD,aAAa,EAAE,qBAAqB,CAAC,eAAe,CAAC,CAAC;IACtD,YAAY,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAClC,mBAAmB,EAAE,CACnB,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,EACb,YAAY,CAAC,EAAE,MAAM,KAClB,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAC,CAAC,CAAC;IACvE;;;OAGG;IACH,WAAW,CAAC,EAAE,oBAAoB,GAAG,IAAI,CAAC;IAC1C,UAAU,EAAE,OAAO,CAAC;IACpB,kBAAkB,EAAE,qBAAqB,CAAC,oBAAoB,CAAC,CAAC;IAChE,YAAY,EAAE,MAAM,OAAO,CAAC,aAAa,CAAC,CAAC;IAC3C,MAAM,EAAE,qBAAqB,CAAC,QAAQ,CAAC,CAAC;IACxC,OAAO,EAAE,qBAAqB,CAAC,SAAS,CAAC,CAAC;IAC1C,MAAM,EAAE,qBAAqB,CAAC,QAAQ,CAAC,CAAC;IACxC,aAAa,EAAE,CACb,aAAa,EAAE,qBAAqB,EACpC,SAAS,CAAC,EAAE,MAAM,KACf,OAAO,CAAC;QAAC,IAAI,EAAE;YAAC,IAAI,EAAE,IAAI,CAAA;SAAC,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAC,CAAC,CAAC;IACpE,IAAI,EAAE,IAAI,GAAG,IAAI,CAAC;IAClB,WAAW,EAAE,WAAW,CAAC;CAC1B,CAAC;AAEJ,QAAA,MAAM,uBAAuB,EAAE,EAAE,CAAC,iBAAiB,CAAC,4BAA4B,CAAC,CA2UhF,CAAC;AAEF,eAAe,uBAAuB,CAAC"}
+{"version":3,"file":"ThunderIDProvider.d.ts","sourceRoot":"","sources":["../../../../src/client/contexts/ThunderID/ThunderIDProvider.tsx"],"names":[],"mappings":"AAKA,OAAO,EAEL,oBAAoB,EAEpB,qBAAqB,EACrB,IAAI,EACJ,WAAW,EAGZ,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAQL,sBAAsB,EAEvB,MAAM,kBAAkB,CAAC;AAI1B,OAAO,EAAC,EAAE,EAAE,iBAAiB,EAAkD,MAAM,OAAO,CAAC;AAC7F,OAAyB,EAAC,qBAAqB,EAAC,MAAM,oBAAoB,CAAC;AAC3E,OAAO,EAAC,aAAa,EAAC,MAAM,sCAAsC,CAAC;AAGnE;;GAEG;AACH,MAAM,MAAM,4BAA4B,GAAG,OAAO,CAAC,IAAI,CAAC,sBAAsB,EAAE,SAAS,GAAG,UAAU,CAAC,CAAC,GACtG,IAAI,CAAC,sBAAsB,EAAE,SAAS,GAAG,UAAU,CAAC,GAAG;IACrD,aAAa,EAAE,qBAAqB,CAAC,eAAe,CAAC,CAAC;IACtD,YAAY,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAClC,mBAAmB,EAAE,CACnB,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,EACb,YAAY,CAAC,EAAE,MAAM,KAClB,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAC,CAAC,CAAC;IACvE;;;OAGG;IACH,WAAW,CAAC,EAAE,oBAAoB,GAAG,IAAI,CAAC;IAC1C,UAAU,EAAE,OAAO,CAAC;IACpB,kBAAkB,EAAE,qBAAqB,CAAC,oBAAoB,CAAC,CAAC;IAChE,YAAY,EAAE,MAAM,OAAO,CAAC,aAAa,CAAC,CAAC;IAC3C,MAAM,EAAE,qBAAqB,CAAC,QAAQ,CAAC,CAAC;IACxC,OAAO,EAAE,qBAAqB,CAAC,SAAS,CAAC,CAAC;IAC1C,MAAM,EAAE,qBAAqB,CAAC,QAAQ,CAAC,CAAC;IACxC,aAAa,EAAE,CACb,aAAa,EAAE,qBAAqB,EACpC,SAAS,CAAC,EAAE,MAAM,KACf,OAAO,CAAC;QAAC,IAAI,EAAE;YAAC,IAAI,EAAE,IAAI,CAAA;SAAC,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAC,CAAC,CAAC;IACpE,IAAI,EAAE,IAAI,GAAG,IAAI,CAAC;IAClB,WAAW,EAAE,WAAW,CAAC;CAC1B,CAAC;AAEJ,QAAA,MAAM,uBAAuB,EAAE,EAAE,CAAC,iBAAiB,CAAC,4BAA4B,CAAC,CA4UhF,CAAC;AAEF,eAAe,uBAAuB,CAAC"}

package/dist/client/contexts/ThunderID/ThunderIDProvider.js

@@ -171,6 +171,7 @@ const ThunderIDClientProvider = ({ baseUrl, children, signIn, clearSession, refr
 		signUp: handleSignUp,
 		signUpUrl,
 		user,
+		userSchema: null,
 		vendor: getVendorPrefix(vendor)
 	}), [
 		applicationId,

package/dist/client/contexts/ThunderID/ThunderIDProvider.js.map

@@ -1 +1 @@
-{"version":3,"file":"ThunderIDProvider.js","names":["ThunderIDClientProvider: FC<PropsWithChildren<ThunderIDClientProviderProps>>","reRenderCheckRef: RefObject<boolean>","router: AppRouterInstance","searchParams: ReadonlyURLSearchParams","code: string | null","state: string | null","sessionState: string | null","result: {error?: string; redirectUrl?: string; success: boolean}","result: any","contextValue: ThunderIDContextProps","reactContextValue: ReactThunderIDContextProps","ThunderIDContext","ReactThunderIDContext"],"sources":["../../../../src/client/contexts/ThunderID/ThunderIDProvider.tsx"],"sourcesContent":["// Copyright 2025 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\n'use client';\n\nimport {\n  EmbeddedFlowExecuteRequestConfig,\n  FlowMetadataResponse,\n  generateFlattenedUserProfile,\n  UpdateMeProfileConfig,\n  User,\n  UserProfile,\n  ThunderIDRuntimeError,\n  getVendorPrefix,\n} from '@thunderid/node';\nimport {\n  I18nProvider,\n  FlowMetaProvider,\n  FlowProvider,\n  UserProvider,\n  ThemeProvider,\n  ThunderIDContext as ReactThunderIDContext,\n  ThunderIDContextProps as ReactThunderIDContextProps,\n  ThunderIDProviderProps,\n  getActiveTheme,\n} from '@thunderid/react';\nimport {ReadonlyURLSearchParams} from 'next/dist/client/components/navigation.react-server';\nimport {AppRouterInstance} from 'next/dist/shared/lib/app-router-context.shared-runtime';\nimport {useRouter, useSearchParams} from 'next/navigation';\nimport {FC, PropsWithChildren, RefObject, useEffect, useMemo, useRef, useState} from 'react';\nimport ThunderIDContext, {ThunderIDContextProps} from './ThunderIDContext';\nimport {RefreshResult} from '../../../server/actions/refreshToken';\nimport logger from '../../../utils/logger';\n\n/**\n * Props interface of {@link ThunderIDClientProvider}\n */\nexport type ThunderIDClientProviderProps = Partial<Omit<ThunderIDProviderProps, 'baseUrl' | 'clientId'>> &\n  Pick<ThunderIDProviderProps, 'baseUrl' | 'clientId'> & {\n    applicationId: ThunderIDContextProps['applicationId'];\n    clearSession: () => Promise<void>;\n    handleOAuthCallback: (\n      code: string,\n      state: string,\n      sessionState?: string,\n    ) => Promise<{error?: string; redirectUrl?: string; success: boolean}>;\n    /**\n     * Flow metadata fetched server-side ahead of time, seeding `FlowMetaProvider` so it can skip\n     * its own initial client-side fetch (avoiding a flash of untranslated i18n keys).\n     */\n    initialMeta?: FlowMetadataResponse | null;\n    isSignedIn: boolean;\n    organizationHandle: ThunderIDContextProps['organizationHandle'];\n    refreshToken: () => Promise<RefreshResult>;\n    signIn: ThunderIDContextProps['signIn'];\n    signOut: ThunderIDContextProps['signOut'];\n    signUp: ThunderIDContextProps['signUp'];\n    updateProfile: (\n      requestConfig: UpdateMeProfileConfig,\n      sessionId?: string,\n    ) => Promise<{data: {user: User}; error: string; success: boolean}>;\n    user: User | null;\n    userProfile: UserProfile;\n  };\n\nconst ThunderIDClientProvider: FC<PropsWithChildren<ThunderIDClientProviderProps>> = ({\n  baseUrl,\n  children,\n  signIn,\n  clearSession,\n  refreshToken,\n  signOut,\n  signUp,\n  handleOAuthCallback,\n  preferences,\n  isSignedIn,\n  signInUrl,\n  signUpUrl,\n  user: _user,\n  userProfile: _userProfile,\n  updateProfile,\n  applicationId,\n  organizationHandle,\n  scopes,\n  vendor,\n  initialMeta = null,\n}: PropsWithChildren<ThunderIDClientProviderProps>) => {\n  const reRenderCheckRef: RefObject<boolean> = useRef(false);\n  const router: AppRouterInstance = useRouter();\n  const searchParams: ReadonlyURLSearchParams = useSearchParams();\n  const [isLoading, setIsLoading] = useState<boolean>(true);\n  const [user, setUser] = useState<User | null>(_user);\n  const [userProfile, setUserProfile] = useState<UserProfile>(_userProfile);\n\n  useEffect(() => {\n    setUserProfile(_userProfile);\n  }, [_userProfile]);\n\n  useEffect(() => {\n    setUser(_user);\n  }, [_user]);\n\n  // Handle OAuth callback automatically\n  useEffect(() => {\n    // React 18.x Strict.Mode has a new check for `Ensuring reusable state` to facilitate an upcoming react feature.\n    // https://reactjs.org/docs/strict-mode.html#ensuring-reusable-state\n    // This will remount all the useEffects to ensure that there are no unexpected side effects.\n    // When react remounts the signIn hook of the AuthProvider, it will cause a race condition. Hence, we have to\n    // prevent the re-render of this hook as suggested in the following discussion.\n    // https://github.com/reactwg/react-18/discussions/18#discussioncomment-795623\n    if (reRenderCheckRef.current) {\n      return;\n    }\n\n    reRenderCheckRef.current = true;\n\n    // Don't handle callback if already signed in\n    if (isSignedIn) return;\n\n    (async (): Promise<void> => {\n      try {\n        const code: string | null = searchParams.get('code');\n        const state: string | null = searchParams.get('state');\n        const sessionState: string | null = searchParams.get('session_state');\n        const error: string | null = searchParams.get('error');\n\n        // Check for OAuth errors first\n        if (error) {\n          logger.error('[ThunderIDClientProvider] An error was received for the initiated sign-in request.');\n\n          return;\n        }\n\n        // Handle OAuth callback if code and state are present\n        if (code && state) {\n          setIsLoading(true);\n\n          const result: {error?: string; redirectUrl?: string; success: boolean} = await handleOAuthCallback(\n            code,\n            state,\n            sessionState || undefined,\n          );\n\n          if (result.success) {\n            // Redirect to the success URL\n            if (result.redirectUrl) {\n              router.push(result.redirectUrl);\n            } else {\n              // Refresh the page to update authentication state\n              window.location.reload();\n            }\n          } else {\n            logger.error(\n              `[ThunderIDClientProvider] An error occurred while signing in: ${result.error || 'Authentication failed'}`,\n            );\n          }\n        }\n      } catch (error) {\n        logger.error('[ThunderIDClientProvider] Failed to handle OAuth callback:', error);\n      }\n    })();\n  }, []);\n\n  useEffect(() => {\n    // Set loading to false when server has resolved authentication state\n    setIsLoading(false);\n  }, [isSignedIn, user]);\n\n  const handleSignIn = async (payload: any, request: EmbeddedFlowExecuteRequestConfig): Promise<any> => {\n    if (!signIn) {\n      throw new ThunderIDRuntimeError(\n        '`signIn` function is not available.',\n        'ThunderIDClientProvider-handleSignIn-RuntimeError-001',\n        'nextjs',\n      );\n    }\n\n    const result: any = await signIn(payload, request);\n\n    // Redirect based flow URL is sent as `signInUrl` in the response.\n    // Use window.location.href instead of router.push() — the OAuth authorization\n    // endpoint is on an external server, and router.push() would send RSC fetch\n    // headers that the identity provider doesn't understand, causing a CORS error.\n    if (result?.data?.signInUrl) {\n      window.location.href = result.data.signInUrl;\n\n      return undefined;\n    }\n\n    // After the Embedded flow is successful, the URL to navigate next is sent as `afterSignInUrl` in the response.\n    if (result?.data?.afterSignInUrl) {\n      router.push(result.data.afterSignInUrl);\n\n      return undefined;\n    }\n\n    if (result?.error) {\n      throw new Error(result.error);\n    }\n\n    return result?.data ?? result;\n  };\n\n  const handleSignUp = async (payload: any, request: EmbeddedFlowExecuteRequestConfig): Promise<any> => {\n    if (!signUp) {\n      throw new ThunderIDRuntimeError(\n        '`signUp` function is not available.',\n        'ThunderIDClientProvider-handleSignUp-RuntimeError-001',\n        'nextjs',\n      );\n    }\n\n    const result: any = await signUp(payload, request);\n\n    // Redirect based flow URL is sent as `signUpUrl` in the response.\n    if (result?.data?.signUpUrl) {\n      router.push(result.data.signUpUrl);\n\n      return undefined;\n    }\n\n    // After the Embedded flow is successful, the URL to navigate next is sent as `afterSignUpUrl` in the response.\n    if (result?.data?.afterSignUpUrl) {\n      router.push(result.data.afterSignUpUrl);\n\n      return undefined;\n    }\n\n    if (result?.error) {\n      throw new Error(result.error);\n    }\n\n    return result?.data ?? result;\n  };\n\n  const handleSignOut = async (): Promise<any> => {\n    logger.debug('[ThunderIDClientProvider][handleSignOut] `handleSignOut` called.');\n\n    try {\n      const result: any = await signOut();\n\n      logger.debug('[ThunderIDClientProvider][handleSignOut] Sign out result:', result);\n\n      if (result?.data?.afterSignOutUrl) {\n        router.push(result.data.afterSignOutUrl);\n\n        return {location: result.data.afterSignOutUrl, redirected: true};\n      }\n\n      if (result?.error) {\n        logger.error(\n          '[ThunderIDClientProvider][handleSignOut] Error result was returned during signing the user out with a button click:',\n          result.error,\n        );\n      }\n\n      return result?.data ?? result;\n    } catch (error) {\n      logger.error(\n        '[ThunderIDClientProvider][handleSignOut] Error occurred during signing the user out with a button click:',\n        error,\n      );\n\n      return undefined;\n    }\n  };\n\n  const contextValue: ThunderIDContextProps = useMemo(\n    () => ({\n      applicationId,\n      baseUrl,\n      clearSession,\n      isLoading,\n      isSignedIn,\n      organizationHandle,\n      preferences,\n      refreshToken,\n      scopes,\n      signIn: handleSignIn,\n      signInUrl,\n      signOut: handleSignOut,\n      signUp: handleSignUp,\n      signUpUrl,\n      user,\n    }),\n    [\n      baseUrl,\n      user,\n      isSignedIn,\n      isLoading,\n      signInUrl,\n      signUpUrl,\n      applicationId,\n      organizationHandle,\n      scopes,\n      preferences,\n    ],\n  );\n\n  const handleProfileUpdate = (payload: User): void => {\n    setUser(payload);\n    setUserProfile((prev: UserProfile) => ({\n      ...prev,\n      flattenedProfile: generateFlattenedUserProfile(payload),\n      profile: payload,\n    }));\n  };\n\n  // Bridge into @thunderid/react's own ThunderIDContext. Internal react components rendered by\n  // BaseSignIn/BaseSignUp — most notably FlowMetaProvider, which fetches `/flow/meta` and injects\n  // its i18n bundle — call react's `useThunderID()` directly. Without this bridge they'd only see\n  // react's context default (applicationId/baseUrl undefined, isInitialized false), so the meta\n  // fetch would never fire and flow labels would render as untranslated i18n keys. Fields with no\n  // nextjs equivalent (token/http helpers meant for direct browser API calls) are stubbed out,\n  // since nextjs routes those operations through server actions instead.\n  const unsupported = (name: string): (() => Promise<never>) => {\n    return () =>\n      Promise.reject(\n        new ThunderIDRuntimeError(\n          `\\`${name}\\` is not supported in @thunderid/nextjs.`,\n          `ThunderIDClientProvider-${name}-NotSupportedError-001`,\n          'nextjs',\n        ),\n      );\n  };\n\n  const reactContextValue: ReactThunderIDContextProps = useMemo(\n    () => ({\n      afterSignInUrl: undefined,\n      applicationId,\n      baseUrl,\n      clearSession,\n      clientId: undefined,\n      discovery: {wellKnown: null},\n      exchangeToken: unsupported('exchangeToken'),\n      getAccessToken: unsupported('getAccessToken'),\n      getDecodedIdToken: unsupported('getDecodedIdToken'),\n      getIdToken: unsupported('getIdToken'),\n      getStorageManager: () => Promise.resolve(null),\n      http: {\n        request: unsupported('http.request'),\n        requestAll: unsupported('http.requestAll'),\n      },\n      instanceId: 0,\n      isInitialized: !isLoading,\n      isLoading,\n      isMetaLoading: false,\n      isSignedIn,\n      meta: initialMeta ?? null,\n      organizationHandle,\n      reInitialize: unsupported('reInitialize'),\n      recover: unsupported('recover'),\n      resolveFlowTemplateLiterals: (text: string | undefined): string => text ?? '',\n      scopes,\n      signIn: handleSignIn,\n      signInSilently: unsupported('signInSilently'),\n      signInUrl,\n      signOut: handleSignOut,\n      signUp: handleSignUp,\n      signUpUrl,\n      user,\n      vendor: getVendorPrefix(vendor),\n    }),\n    [\n      applicationId,\n      baseUrl,\n      clearSession,\n      isLoading,\n      isSignedIn,\n      organizationHandle,\n      scopes,\n      signInUrl,\n      signUpUrl,\n      user,\n      initialMeta,\n      vendor,\n    ],\n  );\n\n  return (\n    <ThunderIDContext.Provider value={contextValue}>\n      <ReactThunderIDContext.Provider value={reactContextValue}>\n        <I18nProvider preferences={preferences?.i18n}>\n          <FlowMetaProvider enabled={preferences?.resolveFromMeta !== false} initialMeta={initialMeta}>\n            <ThemeProvider theme={preferences?.theme?.overrides} mode={getActiveTheme(preferences?.theme?.mode as any)}>\n              <FlowProvider>\n                <UserProvider profile={userProfile} onUpdateProfile={handleProfileUpdate} updateProfile={updateProfile}>\n                  {children}\n                </UserProvider>\n              </FlowProvider>\n            </ThemeProvider>\n          </FlowMetaProvider>\n        </I18nProvider>\n      </ReactThunderIDContext.Provider>\n    </ThunderIDContext.Provider>\n  );\n};\n\nexport default ThunderIDClientProvider;\n"],"mappings":";;;;;;;;;;;;AAiEA,MAAMA,2BAAgF,EACpF,SACA,UACA,QACA,cACA,cACA,SACA,QACA,qBACA,aACA,YACA,WACA,WACA,MAAM,OACN,aAAa,cACb,eACA,eACA,oBACA,QACA,QACA,cAAc,WACuC;CACrD,MAAMC,mBAAuC,OAAO,MAAM;CAC1D,MAAMC,SAA4B,WAAW;CAC7C,MAAMC,eAAwC,iBAAiB;CAC/D,MAAM,CAAC,WAAW,gBAAgB,SAAkB,KAAK;CACzD,MAAM,CAAC,MAAM,WAAW,SAAsB,MAAM;CACpD,MAAM,CAAC,aAAa,kBAAkB,SAAsB,aAAa;AAEzE,iBAAgB;AACd,iBAAe,aAAa;IAC3B,CAAC,aAAa,CAAC;AAElB,iBAAgB;AACd,UAAQ,MAAM;IACb,CAAC,MAAM,CAAC;AAGX,iBAAgB;AAOd,MAAI,iBAAiB,QACnB;AAGF,mBAAiB,UAAU;AAG3B,MAAI,WAAY;AAEhB,GAAC,YAA2B;AAC1B,OAAI;IACF,MAAMC,OAAsB,aAAa,IAAI,OAAO;IACpD,MAAMC,QAAuB,aAAa,IAAI,QAAQ;IACtD,MAAMC,eAA8B,aAAa,IAAI,gBAAgB;AAIrE,QAH6B,aAAa,IAAI,QAAQ,EAG3C;AACT,oBAAO,MAAM,qFAAqF;AAElG;;AAIF,QAAI,QAAQ,OAAO;AACjB,kBAAa,KAAK;KAElB,MAAMC,SAAmE,MAAM,oBAC7E,MACA,OACA,gBAAgB,OACjB;AAED,SAAI,OAAO,QAET,KAAI,OAAO,YACT,QAAO,KAAK,OAAO,YAAY;SAG/B,QAAO,SAAS,QAAQ;SAG1B,gBAAO,MACL,iEAAiE,OAAO,SAAS,0BAClF;;YAGE,OAAO;AACd,mBAAO,MAAM,8DAA8D,MAAM;;MAEjF;IACH,EAAE,CAAC;AAEN,iBAAgB;AAEd,eAAa,MAAM;IAClB,CAAC,YAAY,KAAK,CAAC;CAEtB,MAAM,eAAe,OAAO,SAAc,YAA4D;AACpG,MAAI,CAAC,OACH,OAAM,IAAI,sBACR,uCACA,yDACA,SACD;EAGH,MAAMC,SAAc,MAAM,OAAO,SAAS,QAAQ;AAMlD,MAAI,QAAQ,MAAM,WAAW;AAC3B,UAAO,SAAS,OAAO,OAAO,KAAK;AAEnC;;AAIF,MAAI,QAAQ,MAAM,gBAAgB;AAChC,UAAO,KAAK,OAAO,KAAK,eAAe;AAEvC;;AAGF,MAAI,QAAQ,MACV,OAAM,IAAI,MAAM,OAAO,MAAM;AAG/B,SAAO,QAAQ,QAAQ;;CAGzB,MAAM,eAAe,OAAO,SAAc,YAA4D;AACpG,MAAI,CAAC,OACH,OAAM,IAAI,sBACR,uCACA,yDACA,SACD;EAGH,MAAMA,SAAc,MAAM,OAAO,SAAS,QAAQ;AAGlD,MAAI,QAAQ,MAAM,WAAW;AAC3B,UAAO,KAAK,OAAO,KAAK,UAAU;AAElC;;AAIF,MAAI,QAAQ,MAAM,gBAAgB;AAChC,UAAO,KAAK,OAAO,KAAK,eAAe;AAEvC;;AAGF,MAAI,QAAQ,MACV,OAAM,IAAI,MAAM,OAAO,MAAM;AAG/B,SAAO,QAAQ,QAAQ;;CAGzB,MAAM,gBAAgB,YAA0B;AAC9C,iBAAO,MAAM,mEAAmE;AAEhF,MAAI;GACF,MAAMA,SAAc,MAAM,SAAS;AAEnC,kBAAO,MAAM,6DAA6D,OAAO;AAEjF,OAAI,QAAQ,MAAM,iBAAiB;AACjC,WAAO,KAAK,OAAO,KAAK,gBAAgB;AAExC,WAAO;KAAC,UAAU,OAAO,KAAK;KAAiB,YAAY;KAAK;;AAGlE,OAAI,QAAQ,MACV,gBAAO,MACL,uHACA,OAAO,MACR;AAGH,UAAO,QAAQ,QAAQ;WAChB,OAAO;AACd,kBAAO,MACL,4GACA,MACD;AAED;;;CAIJ,MAAMC,eAAsC,eACnC;EACL;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA,QAAQ;EACR;EACA,SAAS;EACT,QAAQ;EACR;EACA;EACD,GACD;EACE;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACD,CACF;CAED,MAAM,uBAAuB,YAAwB;AACnD,UAAQ,QAAQ;AAChB,kBAAgB,UAAuB;GACrC,GAAG;GACH,kBAAkB,6BAA6B,QAAQ;GACvD,SAAS;GACV,EAAE;;CAUL,MAAM,eAAe,SAAyC;AAC5D,eACE,QAAQ,OACN,IAAI,sBACF,KAAK,KAAK,4CACV,2BAA2B,KAAK,yBAChC,SACD,CACF;;CAGL,MAAMC,oBAAgD,eAC7C;EACL,gBAAgB;EAChB;EACA;EACA;EACA,UAAU;EACV,WAAW,EAAC,WAAW,MAAK;EAC5B,eAAe,YAAY,gBAAgB;EAC3C,gBAAgB,YAAY,iBAAiB;EAC7C,mBAAmB,YAAY,oBAAoB;EACnD,YAAY,YAAY,aAAa;EACrC,yBAAyB,QAAQ,QAAQ,KAAK;EAC9C,MAAM;GACJ,SAAS,YAAY,eAAe;GACpC,YAAY,YAAY,kBAAkB;GAC3C;EACD,YAAY;EACZ,eAAe,CAAC;EAChB;EACA,eAAe;EACf;EACA,MAAM,eAAe;EACrB;EACA,cAAc,YAAY,eAAe;EACzC,SAAS,YAAY,UAAU;EAC/B,8BAA8B,SAAqC,QAAQ;EAC3E;EACA,QAAQ;EACR,gBAAgB,YAAY,iBAAiB;EAC7C;EACA,SAAS;EACT,QAAQ;EACR;EACA;EACA,QAAQ,gBAAgB,OAAO;EAChC,GACD;EACE;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACD,CACF;AAED,QACE,oBAACC,yBAAiB;EAAS,OAAO;YAChC,oBAACC,iBAAsB;GAAS,OAAO;aACrC,oBAAC;IAAa,aAAa,aAAa;cACtC,oBAAC;KAAiB,SAAS,aAAa,oBAAoB;KAAoB;eAC9E,oBAAC;MAAc,OAAO,aAAa,OAAO;MAAW,MAAM,eAAe,aAAa,OAAO,KAAY;gBACxG,oBAAC,0BACC,oBAAC;OAAa,SAAS;OAAa,iBAAiB;OAAoC;OACtF;QACY,GACF;OACD;MACC;KACN;IACgB;GACP;;AAIhC,gCAAe"}
+{"version":3,"file":"ThunderIDProvider.js","names":["ThunderIDClientProvider: FC<PropsWithChildren<ThunderIDClientProviderProps>>","reRenderCheckRef: RefObject<boolean>","router: AppRouterInstance","searchParams: ReadonlyURLSearchParams","code: string | null","state: string | null","sessionState: string | null","result: {error?: string; redirectUrl?: string; success: boolean}","result: any","contextValue: ThunderIDContextProps","reactContextValue: ReactThunderIDContextProps","ThunderIDContext","ReactThunderIDContext"],"sources":["../../../../src/client/contexts/ThunderID/ThunderIDProvider.tsx"],"sourcesContent":["// Copyright 2025 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\n'use client';\n\nimport {\n  EmbeddedFlowExecuteRequestConfig,\n  FlowMetadataResponse,\n  generateFlattenedUserProfile,\n  UpdateMeProfileConfig,\n  User,\n  UserProfile,\n  ThunderIDRuntimeError,\n  getVendorPrefix,\n} from '@thunderid/node';\nimport {\n  I18nProvider,\n  FlowMetaProvider,\n  FlowProvider,\n  UserProvider,\n  ThemeProvider,\n  ThunderIDContext as ReactThunderIDContext,\n  ThunderIDContextProps as ReactThunderIDContextProps,\n  ThunderIDProviderProps,\n  getActiveTheme,\n} from '@thunderid/react';\nimport {ReadonlyURLSearchParams} from 'next/dist/client/components/navigation.react-server';\nimport {AppRouterInstance} from 'next/dist/shared/lib/app-router-context.shared-runtime';\nimport {useRouter, useSearchParams} from 'next/navigation';\nimport {FC, PropsWithChildren, RefObject, useEffect, useMemo, useRef, useState} from 'react';\nimport ThunderIDContext, {ThunderIDContextProps} from './ThunderIDContext';\nimport {RefreshResult} from '../../../server/actions/refreshToken';\nimport logger from '../../../utils/logger';\n\n/**\n * Props interface of {@link ThunderIDClientProvider}\n */\nexport type ThunderIDClientProviderProps = Partial<Omit<ThunderIDProviderProps, 'baseUrl' | 'clientId'>> &\n  Pick<ThunderIDProviderProps, 'baseUrl' | 'clientId'> & {\n    applicationId: ThunderIDContextProps['applicationId'];\n    clearSession: () => Promise<void>;\n    handleOAuthCallback: (\n      code: string,\n      state: string,\n      sessionState?: string,\n    ) => Promise<{error?: string; redirectUrl?: string; success: boolean}>;\n    /**\n     * Flow metadata fetched server-side ahead of time, seeding `FlowMetaProvider` so it can skip\n     * its own initial client-side fetch (avoiding a flash of untranslated i18n keys).\n     */\n    initialMeta?: FlowMetadataResponse | null;\n    isSignedIn: boolean;\n    organizationHandle: ThunderIDContextProps['organizationHandle'];\n    refreshToken: () => Promise<RefreshResult>;\n    signIn: ThunderIDContextProps['signIn'];\n    signOut: ThunderIDContextProps['signOut'];\n    signUp: ThunderIDContextProps['signUp'];\n    updateProfile: (\n      requestConfig: UpdateMeProfileConfig,\n      sessionId?: string,\n    ) => Promise<{data: {user: User}; error: string; success: boolean}>;\n    user: User | null;\n    userProfile: UserProfile;\n  };\n\nconst ThunderIDClientProvider: FC<PropsWithChildren<ThunderIDClientProviderProps>> = ({\n  baseUrl,\n  children,\n  signIn,\n  clearSession,\n  refreshToken,\n  signOut,\n  signUp,\n  handleOAuthCallback,\n  preferences,\n  isSignedIn,\n  signInUrl,\n  signUpUrl,\n  user: _user,\n  userProfile: _userProfile,\n  updateProfile,\n  applicationId,\n  organizationHandle,\n  scopes,\n  vendor,\n  initialMeta = null,\n}: PropsWithChildren<ThunderIDClientProviderProps>) => {\n  const reRenderCheckRef: RefObject<boolean> = useRef(false);\n  const router: AppRouterInstance = useRouter();\n  const searchParams: ReadonlyURLSearchParams = useSearchParams();\n  const [isLoading, setIsLoading] = useState<boolean>(true);\n  const [user, setUser] = useState<User | null>(_user);\n  const [userProfile, setUserProfile] = useState<UserProfile>(_userProfile);\n\n  useEffect(() => {\n    setUserProfile(_userProfile);\n  }, [_userProfile]);\n\n  useEffect(() => {\n    setUser(_user);\n  }, [_user]);\n\n  // Handle OAuth callback automatically\n  useEffect(() => {\n    // React 18.x Strict.Mode has a new check for `Ensuring reusable state` to facilitate an upcoming react feature.\n    // https://reactjs.org/docs/strict-mode.html#ensuring-reusable-state\n    // This will remount all the useEffects to ensure that there are no unexpected side effects.\n    // When react remounts the signIn hook of the AuthProvider, it will cause a race condition. Hence, we have to\n    // prevent the re-render of this hook as suggested in the following discussion.\n    // https://github.com/reactwg/react-18/discussions/18#discussioncomment-795623\n    if (reRenderCheckRef.current) {\n      return;\n    }\n\n    reRenderCheckRef.current = true;\n\n    // Don't handle callback if already signed in\n    if (isSignedIn) return;\n\n    (async (): Promise<void> => {\n      try {\n        const code: string | null = searchParams.get('code');\n        const state: string | null = searchParams.get('state');\n        const sessionState: string | null = searchParams.get('session_state');\n        const error: string | null = searchParams.get('error');\n\n        // Check for OAuth errors first\n        if (error) {\n          logger.error('[ThunderIDClientProvider] An error was received for the initiated sign-in request.');\n\n          return;\n        }\n\n        // Handle OAuth callback if code and state are present\n        if (code && state) {\n          setIsLoading(true);\n\n          const result: {error?: string; redirectUrl?: string; success: boolean} = await handleOAuthCallback(\n            code,\n            state,\n            sessionState || undefined,\n          );\n\n          if (result.success) {\n            // Redirect to the success URL\n            if (result.redirectUrl) {\n              router.push(result.redirectUrl);\n            } else {\n              // Refresh the page to update authentication state\n              window.location.reload();\n            }\n          } else {\n            logger.error(\n              `[ThunderIDClientProvider] An error occurred while signing in: ${result.error || 'Authentication failed'}`,\n            );\n          }\n        }\n      } catch (error) {\n        logger.error('[ThunderIDClientProvider] Failed to handle OAuth callback:', error);\n      }\n    })();\n  }, []);\n\n  useEffect(() => {\n    // Set loading to false when server has resolved authentication state\n    setIsLoading(false);\n  }, [isSignedIn, user]);\n\n  const handleSignIn = async (payload: any, request: EmbeddedFlowExecuteRequestConfig): Promise<any> => {\n    if (!signIn) {\n      throw new ThunderIDRuntimeError(\n        '`signIn` function is not available.',\n        'ThunderIDClientProvider-handleSignIn-RuntimeError-001',\n        'nextjs',\n      );\n    }\n\n    const result: any = await signIn(payload, request);\n\n    // Redirect based flow URL is sent as `signInUrl` in the response.\n    // Use window.location.href instead of router.push() — the OAuth authorization\n    // endpoint is on an external server, and router.push() would send RSC fetch\n    // headers that the identity provider doesn't understand, causing a CORS error.\n    if (result?.data?.signInUrl) {\n      window.location.href = result.data.signInUrl;\n\n      return undefined;\n    }\n\n    // After the Embedded flow is successful, the URL to navigate next is sent as `afterSignInUrl` in the response.\n    if (result?.data?.afterSignInUrl) {\n      router.push(result.data.afterSignInUrl);\n\n      return undefined;\n    }\n\n    if (result?.error) {\n      throw new Error(result.error);\n    }\n\n    return result?.data ?? result;\n  };\n\n  const handleSignUp = async (payload: any, request: EmbeddedFlowExecuteRequestConfig): Promise<any> => {\n    if (!signUp) {\n      throw new ThunderIDRuntimeError(\n        '`signUp` function is not available.',\n        'ThunderIDClientProvider-handleSignUp-RuntimeError-001',\n        'nextjs',\n      );\n    }\n\n    const result: any = await signUp(payload, request);\n\n    // Redirect based flow URL is sent as `signUpUrl` in the response.\n    if (result?.data?.signUpUrl) {\n      router.push(result.data.signUpUrl);\n\n      return undefined;\n    }\n\n    // After the Embedded flow is successful, the URL to navigate next is sent as `afterSignUpUrl` in the response.\n    if (result?.data?.afterSignUpUrl) {\n      router.push(result.data.afterSignUpUrl);\n\n      return undefined;\n    }\n\n    if (result?.error) {\n      throw new Error(result.error);\n    }\n\n    return result?.data ?? result;\n  };\n\n  const handleSignOut = async (): Promise<any> => {\n    logger.debug('[ThunderIDClientProvider][handleSignOut] `handleSignOut` called.');\n\n    try {\n      const result: any = await signOut();\n\n      logger.debug('[ThunderIDClientProvider][handleSignOut] Sign out result:', result);\n\n      if (result?.data?.afterSignOutUrl) {\n        router.push(result.data.afterSignOutUrl);\n\n        return {location: result.data.afterSignOutUrl, redirected: true};\n      }\n\n      if (result?.error) {\n        logger.error(\n          '[ThunderIDClientProvider][handleSignOut] Error result was returned during signing the user out with a button click:',\n          result.error,\n        );\n      }\n\n      return result?.data ?? result;\n    } catch (error) {\n      logger.error(\n        '[ThunderIDClientProvider][handleSignOut] Error occurred during signing the user out with a button click:',\n        error,\n      );\n\n      return undefined;\n    }\n  };\n\n  const contextValue: ThunderIDContextProps = useMemo(\n    () => ({\n      applicationId,\n      baseUrl,\n      clearSession,\n      isLoading,\n      isSignedIn,\n      organizationHandle,\n      preferences,\n      refreshToken,\n      scopes,\n      signIn: handleSignIn,\n      signInUrl,\n      signOut: handleSignOut,\n      signUp: handleSignUp,\n      signUpUrl,\n      user,\n    }),\n    [\n      baseUrl,\n      user,\n      isSignedIn,\n      isLoading,\n      signInUrl,\n      signUpUrl,\n      applicationId,\n      organizationHandle,\n      scopes,\n      preferences,\n    ],\n  );\n\n  const handleProfileUpdate = (payload: User): void => {\n    setUser(payload);\n    setUserProfile((prev: UserProfile) => ({\n      ...prev,\n      flattenedProfile: generateFlattenedUserProfile(payload),\n      profile: payload,\n    }));\n  };\n\n  // Bridge into @thunderid/react's own ThunderIDContext. Internal react components rendered by\n  // BaseSignIn/BaseSignUp — most notably FlowMetaProvider, which fetches `/flow/meta` and injects\n  // its i18n bundle — call react's `useThunderID()` directly. Without this bridge they'd only see\n  // react's context default (applicationId/baseUrl undefined, isInitialized false), so the meta\n  // fetch would never fire and flow labels would render as untranslated i18n keys. Fields with no\n  // nextjs equivalent (token/http helpers meant for direct browser API calls) are stubbed out,\n  // since nextjs routes those operations through server actions instead.\n  const unsupported = (name: string): (() => Promise<never>) => {\n    return () =>\n      Promise.reject(\n        new ThunderIDRuntimeError(\n          `\\`${name}\\` is not supported in @thunderid/nextjs.`,\n          `ThunderIDClientProvider-${name}-NotSupportedError-001`,\n          'nextjs',\n        ),\n      );\n  };\n\n  const reactContextValue: ReactThunderIDContextProps = useMemo(\n    () => ({\n      afterSignInUrl: undefined,\n      applicationId,\n      baseUrl,\n      clearSession,\n      clientId: undefined,\n      discovery: {wellKnown: null},\n      exchangeToken: unsupported('exchangeToken'),\n      getAccessToken: unsupported('getAccessToken'),\n      getDecodedIdToken: unsupported('getDecodedIdToken'),\n      getIdToken: unsupported('getIdToken'),\n      getStorageManager: () => Promise.resolve(null),\n      http: {\n        request: unsupported('http.request'),\n        requestAll: unsupported('http.requestAll'),\n      },\n      instanceId: 0,\n      isInitialized: !isLoading,\n      isLoading,\n      isMetaLoading: false,\n      isSignedIn,\n      meta: initialMeta ?? null,\n      organizationHandle,\n      reInitialize: unsupported('reInitialize'),\n      recover: unsupported('recover'),\n      resolveFlowTemplateLiterals: (text: string | undefined): string => text ?? '',\n      scopes,\n      signIn: handleSignIn,\n      signInSilently: unsupported('signInSilently'),\n      signInUrl,\n      signOut: handleSignOut,\n      signUp: handleSignUp,\n      signUpUrl,\n      user,\n      userSchema: null,\n      vendor: getVendorPrefix(vendor),\n    }),\n    [\n      applicationId,\n      baseUrl,\n      clearSession,\n      isLoading,\n      isSignedIn,\n      organizationHandle,\n      scopes,\n      signInUrl,\n      signUpUrl,\n      user,\n      initialMeta,\n      vendor,\n    ],\n  );\n\n  return (\n    <ThunderIDContext.Provider value={contextValue}>\n      <ReactThunderIDContext.Provider value={reactContextValue}>\n        <I18nProvider preferences={preferences?.i18n}>\n          <FlowMetaProvider enabled={preferences?.resolveFromMeta !== false} initialMeta={initialMeta}>\n            <ThemeProvider theme={preferences?.theme?.overrides} mode={getActiveTheme(preferences?.theme?.mode as any)}>\n              <FlowProvider>\n                <UserProvider profile={userProfile} onUpdateProfile={handleProfileUpdate} updateProfile={updateProfile}>\n                  {children}\n                </UserProvider>\n              </FlowProvider>\n            </ThemeProvider>\n          </FlowMetaProvider>\n        </I18nProvider>\n      </ReactThunderIDContext.Provider>\n    </ThunderIDContext.Provider>\n  );\n};\n\nexport default ThunderIDClientProvider;\n"],"mappings":";;;;;;;;;;;;AAiEA,MAAMA,2BAAgF,EACpF,SACA,UACA,QACA,cACA,cACA,SACA,QACA,qBACA,aACA,YACA,WACA,WACA,MAAM,OACN,aAAa,cACb,eACA,eACA,oBACA,QACA,QACA,cAAc,WACuC;CACrD,MAAMC,mBAAuC,OAAO,MAAM;CAC1D,MAAMC,SAA4B,WAAW;CAC7C,MAAMC,eAAwC,iBAAiB;CAC/D,MAAM,CAAC,WAAW,gBAAgB,SAAkB,KAAK;CACzD,MAAM,CAAC,MAAM,WAAW,SAAsB,MAAM;CACpD,MAAM,CAAC,aAAa,kBAAkB,SAAsB,aAAa;AAEzE,iBAAgB;AACd,iBAAe,aAAa;IAC3B,CAAC,aAAa,CAAC;AAElB,iBAAgB;AACd,UAAQ,MAAM;IACb,CAAC,MAAM,CAAC;AAGX,iBAAgB;AAOd,MAAI,iBAAiB,QACnB;AAGF,mBAAiB,UAAU;AAG3B,MAAI,WAAY;AAEhB,GAAC,YAA2B;AAC1B,OAAI;IACF,MAAMC,OAAsB,aAAa,IAAI,OAAO;IACpD,MAAMC,QAAuB,aAAa,IAAI,QAAQ;IACtD,MAAMC,eAA8B,aAAa,IAAI,gBAAgB;AAIrE,QAH6B,aAAa,IAAI,QAAQ,EAG3C;AACT,oBAAO,MAAM,qFAAqF;AAElG;;AAIF,QAAI,QAAQ,OAAO;AACjB,kBAAa,KAAK;KAElB,MAAMC,SAAmE,MAAM,oBAC7E,MACA,OACA,gBAAgB,OACjB;AAED,SAAI,OAAO,QAET,KAAI,OAAO,YACT,QAAO,KAAK,OAAO,YAAY;SAG/B,QAAO,SAAS,QAAQ;SAG1B,gBAAO,MACL,iEAAiE,OAAO,SAAS,0BAClF;;YAGE,OAAO;AACd,mBAAO,MAAM,8DAA8D,MAAM;;MAEjF;IACH,EAAE,CAAC;AAEN,iBAAgB;AAEd,eAAa,MAAM;IAClB,CAAC,YAAY,KAAK,CAAC;CAEtB,MAAM,eAAe,OAAO,SAAc,YAA4D;AACpG,MAAI,CAAC,OACH,OAAM,IAAI,sBACR,uCACA,yDACA,SACD;EAGH,MAAMC,SAAc,MAAM,OAAO,SAAS,QAAQ;AAMlD,MAAI,QAAQ,MAAM,WAAW;AAC3B,UAAO,SAAS,OAAO,OAAO,KAAK;AAEnC;;AAIF,MAAI,QAAQ,MAAM,gBAAgB;AAChC,UAAO,KAAK,OAAO,KAAK,eAAe;AAEvC;;AAGF,MAAI,QAAQ,MACV,OAAM,IAAI,MAAM,OAAO,MAAM;AAG/B,SAAO,QAAQ,QAAQ;;CAGzB,MAAM,eAAe,OAAO,SAAc,YAA4D;AACpG,MAAI,CAAC,OACH,OAAM,IAAI,sBACR,uCACA,yDACA,SACD;EAGH,MAAMA,SAAc,MAAM,OAAO,SAAS,QAAQ;AAGlD,MAAI,QAAQ,MAAM,WAAW;AAC3B,UAAO,KAAK,OAAO,KAAK,UAAU;AAElC;;AAIF,MAAI,QAAQ,MAAM,gBAAgB;AAChC,UAAO,KAAK,OAAO,KAAK,eAAe;AAEvC;;AAGF,MAAI,QAAQ,MACV,OAAM,IAAI,MAAM,OAAO,MAAM;AAG/B,SAAO,QAAQ,QAAQ;;CAGzB,MAAM,gBAAgB,YAA0B;AAC9C,iBAAO,MAAM,mEAAmE;AAEhF,MAAI;GACF,MAAMA,SAAc,MAAM,SAAS;AAEnC,kBAAO,MAAM,6DAA6D,OAAO;AAEjF,OAAI,QAAQ,MAAM,iBAAiB;AACjC,WAAO,KAAK,OAAO,KAAK,gBAAgB;AAExC,WAAO;KAAC,UAAU,OAAO,KAAK;KAAiB,YAAY;KAAK;;AAGlE,OAAI,QAAQ,MACV,gBAAO,MACL,uHACA,OAAO,MACR;AAGH,UAAO,QAAQ,QAAQ;WAChB,OAAO;AACd,kBAAO,MACL,4GACA,MACD;AAED;;;CAIJ,MAAMC,eAAsC,eACnC;EACL;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA,QAAQ;EACR;EACA,SAAS;EACT,QAAQ;EACR;EACA;EACD,GACD;EACE;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACD,CACF;CAED,MAAM,uBAAuB,YAAwB;AACnD,UAAQ,QAAQ;AAChB,kBAAgB,UAAuB;GACrC,GAAG;GACH,kBAAkB,6BAA6B,QAAQ;GACvD,SAAS;GACV,EAAE;;CAUL,MAAM,eAAe,SAAyC;AAC5D,eACE,QAAQ,OACN,IAAI,sBACF,KAAK,KAAK,4CACV,2BAA2B,KAAK,yBAChC,SACD,CACF;;CAGL,MAAMC,oBAAgD,eAC7C;EACL,gBAAgB;EAChB;EACA;EACA;EACA,UAAU;EACV,WAAW,EAAC,WAAW,MAAK;EAC5B,eAAe,YAAY,gBAAgB;EAC3C,gBAAgB,YAAY,iBAAiB;EAC7C,mBAAmB,YAAY,oBAAoB;EACnD,YAAY,YAAY,aAAa;EACrC,yBAAyB,QAAQ,QAAQ,KAAK;EAC9C,MAAM;GACJ,SAAS,YAAY,eAAe;GACpC,YAAY,YAAY,kBAAkB;GAC3C;EACD,YAAY;EACZ,eAAe,CAAC;EAChB;EACA,eAAe;EACf;EACA,MAAM,eAAe;EACrB;EACA,cAAc,YAAY,eAAe;EACzC,SAAS,YAAY,UAAU;EAC/B,8BAA8B,SAAqC,QAAQ;EAC3E;EACA,QAAQ;EACR,gBAAgB,YAAY,iBAAiB;EAC7C;EACA,SAAS;EACT,QAAQ;EACR;EACA;EACA,YAAY;EACZ,QAAQ,gBAAgB,OAAO;EAChC,GACD;EACE;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACD,CACF;AAED,QACE,oBAACC,yBAAiB;EAAS,OAAO;YAChC,oBAACC,iBAAsB;GAAS,OAAO;aACrC,oBAAC;IAAa,aAAa,aAAa;cACtC,oBAAC;KAAiB,SAAS,aAAa,oBAAoB;KAAoB;eAC9E,oBAAC;MAAc,OAAO,aAAa,OAAO;MAAW,MAAM,eAAe,aAAa,OAAO,KAAY;gBACxG,oBAAC,0BACC,oBAAC;OAAa,SAAS;OAAa,iBAAiB;OAAoC;OACtF;QACY,GACF;OACD;MACC;KACN;IACgB;GACP;;AAIhC,gCAAe"}

package/dist/utils/decorateConfigWithNextEnv.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"decorateConfigWithNextEnv.d.ts","sourceRoot":"","sources":["../../src/utils/decorateConfigWithNextEnv.ts"],"names":[],"mappings":"AAGA,OAAO,EAAC,mBAAmB,EAAC,MAAM,kBAAkB,CAAC;AAErD,QAAA,MAAM,yBAAyB,GAAI,QAAQ,mBAAmB,KAAG,mBAsChE,CAAC;AAEF,eAAe,yBAAyB,CAAC"}
+{"version":3,"file":"decorateConfigWithNextEnv.d.ts","sourceRoot":"","sources":["../../src/utils/decorateConfigWithNextEnv.ts"],"names":[],"mappings":"AAGA,OAAO,EAAC,mBAAmB,EAAC,MAAM,kBAAkB,CAAC;AAErD,QAAA,MAAM,yBAAyB,GAAI,QAAQ,mBAAmB,KAAG,mBAwChE,CAAC;AAEF,eAAe,yBAAyB,CAAC"}

package/dist/utils/decorateConfigWithNextEnv.js

@@ -1,6 +1,6 @@
 //#region src/utils/decorateConfigWithNextEnv.ts
 const decorateConfigWithNextEnv = (config) => {
-	const { organizationHandle, scopes, applicationId, baseUrl, clientId, clientSecret, signInUrl, signUpUrl, afterSignInUrl, afterSignOutUrl, vendor,...rest } = config;
+	const { organizationHandle, scopes, applicationId, baseUrl, clientId, clientSecret, flowSecret, signInUrl, signUpUrl, afterSignInUrl, afterSignOutUrl, vendor,...rest } = config;
 	const envExpiryTime = process.env["THUNDERID_SESSION_COOKIE_EXPIRY_TIME"] ? parseInt(process.env["THUNDERID_SESSION_COOKIE_EXPIRY_TIME"], 10) : void 0;
 	return {
 		...rest,
@@ -10,6 +10,7 @@ const decorateConfigWithNextEnv = (config) => {
 		baseUrl: baseUrl || process.env["NEXT_PUBLIC_THUNDERID_BASE_URL"],
 		clientId: clientId || process.env["NEXT_PUBLIC_THUNDERID_CLIENT_ID"],
 		clientSecret: clientSecret || process.env["THUNDERID_CLIENT_SECRET"],
+		flowSecret: flowSecret || process.env["THUNDERID_FLOW_SECRET"],
 		organizationHandle: organizationHandle || process.env["NEXT_PUBLIC_THUNDERID_ORGANIZATION_HANDLE"],
 		scopes: scopes || process.env["NEXT_PUBLIC_THUNDERID_SCOPES"],
 		sessionCookie: {

package/dist/utils/decorateConfigWithNextEnv.js.map

@@ -1 +1 @@
-{"version":3,"file":"decorateConfigWithNextEnv.js","names":[],"sources":["../../src/utils/decorateConfigWithNextEnv.ts"],"sourcesContent":["// Copyright 2025 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\nimport {ThunderIDNextConfig} from '../models/config';\n\nconst decorateConfigWithNextEnv = (config: ThunderIDNextConfig): ThunderIDNextConfig => {\n  const {\n    organizationHandle,\n    scopes,\n    applicationId,\n    baseUrl,\n    clientId,\n    clientSecret,\n    signInUrl,\n    signUpUrl,\n    afterSignInUrl,\n    afterSignOutUrl,\n    vendor,\n    ...rest\n  } = config;\n\n  const envExpiryTime = process.env['THUNDERID_SESSION_COOKIE_EXPIRY_TIME']\n    ? parseInt(process.env['THUNDERID_SESSION_COOKIE_EXPIRY_TIME'], 10)\n    : undefined;\n\n  return {\n    ...rest,\n    afterSignInUrl: afterSignInUrl || process.env['NEXT_PUBLIC_THUNDERID_AFTER_SIGN_IN_URL']!,\n    afterSignOutUrl: afterSignOutUrl || process.env['NEXT_PUBLIC_THUNDERID_AFTER_SIGN_OUT_URL']!,\n    applicationId: applicationId || process.env['NEXT_PUBLIC_THUNDERID_APPLICATION_ID']!,\n    baseUrl: baseUrl || process.env['NEXT_PUBLIC_THUNDERID_BASE_URL']!,\n    clientId: clientId || process.env['NEXT_PUBLIC_THUNDERID_CLIENT_ID']!,\n    clientSecret: clientSecret || process.env['THUNDERID_CLIENT_SECRET']!,\n    organizationHandle: organizationHandle || process.env['NEXT_PUBLIC_THUNDERID_ORGANIZATION_HANDLE']!,\n    scopes: scopes || process.env['NEXT_PUBLIC_THUNDERID_SCOPES']!,\n    sessionCookie: {\n      ...rest.sessionCookie,\n      expiryTime: rest.sessionCookie?.expiryTime || envExpiryTime,\n    },\n    signInUrl: signInUrl || process.env['NEXT_PUBLIC_THUNDERID_SIGN_IN_URL']!,\n    signUpUrl: signUpUrl || process.env['NEXT_PUBLIC_THUNDERID_SIGN_UP_URL']!,\n    vendor: vendor || process.env['NEXT_PUBLIC_THUNDERID_VENDOR'],\n  };\n};\n\nexport default decorateConfigWithNextEnv;\n"],"mappings":";AAKA,MAAM,6BAA6B,WAAqD;CACtF,MAAM,EACJ,oBACA,QACA,eACA,SACA,UACA,cACA,WACA,WACA,gBACA,iBACA,OACA,GAAG,SACD;CAEJ,MAAM,gBAAgB,QAAQ,IAAI,0CAC9B,SAAS,QAAQ,IAAI,yCAAyC,GAAG,GACjE;AAEJ,QAAO;EACL,GAAG;EACH,gBAAgB,kBAAkB,QAAQ,IAAI;EAC9C,iBAAiB,mBAAmB,QAAQ,IAAI;EAChD,eAAe,iBAAiB,QAAQ,IAAI;EAC5C,SAAS,WAAW,QAAQ,IAAI;EAChC,UAAU,YAAY,QAAQ,IAAI;EAClC,cAAc,gBAAgB,QAAQ,IAAI;EAC1C,oBAAoB,sBAAsB,QAAQ,IAAI;EACtD,QAAQ,UAAU,QAAQ,IAAI;EAC9B,eAAe;GACb,GAAG,KAAK;GACR,YAAY,KAAK,eAAe,cAAc;GAC/C;EACD,WAAW,aAAa,QAAQ,IAAI;EACpC,WAAW,aAAa,QAAQ,IAAI;EACpC,QAAQ,UAAU,QAAQ,IAAI;EAC/B;;AAGH,wCAAe"}
+{"version":3,"file":"decorateConfigWithNextEnv.js","names":[],"sources":["../../src/utils/decorateConfigWithNextEnv.ts"],"sourcesContent":["// Copyright 2025 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\nimport {ThunderIDNextConfig} from '../models/config';\n\nconst decorateConfigWithNextEnv = (config: ThunderIDNextConfig): ThunderIDNextConfig => {\n  const {\n    organizationHandle,\n    scopes,\n    applicationId,\n    baseUrl,\n    clientId,\n    clientSecret,\n    flowSecret,\n    signInUrl,\n    signUpUrl,\n    afterSignInUrl,\n    afterSignOutUrl,\n    vendor,\n    ...rest\n  } = config;\n\n  const envExpiryTime = process.env['THUNDERID_SESSION_COOKIE_EXPIRY_TIME']\n    ? parseInt(process.env['THUNDERID_SESSION_COOKIE_EXPIRY_TIME'], 10)\n    : undefined;\n\n  return {\n    ...rest,\n    afterSignInUrl: afterSignInUrl || process.env['NEXT_PUBLIC_THUNDERID_AFTER_SIGN_IN_URL']!,\n    afterSignOutUrl: afterSignOutUrl || process.env['NEXT_PUBLIC_THUNDERID_AFTER_SIGN_OUT_URL']!,\n    applicationId: applicationId || process.env['NEXT_PUBLIC_THUNDERID_APPLICATION_ID']!,\n    baseUrl: baseUrl || process.env['NEXT_PUBLIC_THUNDERID_BASE_URL']!,\n    clientId: clientId || process.env['NEXT_PUBLIC_THUNDERID_CLIENT_ID']!,\n    clientSecret: clientSecret || process.env['THUNDERID_CLIENT_SECRET']!,\n    flowSecret: flowSecret || process.env['THUNDERID_FLOW_SECRET'],\n    organizationHandle: organizationHandle || process.env['NEXT_PUBLIC_THUNDERID_ORGANIZATION_HANDLE']!,\n    scopes: scopes || process.env['NEXT_PUBLIC_THUNDERID_SCOPES']!,\n    sessionCookie: {\n      ...rest.sessionCookie,\n      expiryTime: rest.sessionCookie?.expiryTime || envExpiryTime,\n    },\n    signInUrl: signInUrl || process.env['NEXT_PUBLIC_THUNDERID_SIGN_IN_URL']!,\n    signUpUrl: signUpUrl || process.env['NEXT_PUBLIC_THUNDERID_SIGN_UP_URL']!,\n    vendor: vendor || process.env['NEXT_PUBLIC_THUNDERID_VENDOR'],\n  };\n};\n\nexport default decorateConfigWithNextEnv;\n"],"mappings":";AAKA,MAAM,6BAA6B,WAAqD;CACtF,MAAM,EACJ,oBACA,QACA,eACA,SACA,UACA,cACA,YACA,WACA,WACA,gBACA,iBACA,OACA,GAAG,SACD;CAEJ,MAAM,gBAAgB,QAAQ,IAAI,0CAC9B,SAAS,QAAQ,IAAI,yCAAyC,GAAG,GACjE;AAEJ,QAAO;EACL,GAAG;EACH,gBAAgB,kBAAkB,QAAQ,IAAI;EAC9C,iBAAiB,mBAAmB,QAAQ,IAAI;EAChD,eAAe,iBAAiB,QAAQ,IAAI;EAC5C,SAAS,WAAW,QAAQ,IAAI;EAChC,UAAU,YAAY,QAAQ,IAAI;EAClC,cAAc,gBAAgB,QAAQ,IAAI;EAC1C,YAAY,cAAc,QAAQ,IAAI;EACtC,oBAAoB,sBAAsB,QAAQ,IAAI;EACtD,QAAQ,UAAU,QAAQ,IAAI;EAC9B,eAAe;GACb,GAAG,KAAK;GACR,YAAY,KAAK,eAAe,cAAc;GAC/C;EACD,WAAW,aAAa,QAAQ,IAAI;EACpC,WAAW,aAAa,QAAQ,IAAI;EACpC,QAAQ,UAAU,QAAQ,IAAI;EAC/B;;AAGH,wCAAe"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@thunderid/nextjs",
-  "version": "0.11.0",
+  "version": "1.0.0",
   "description": "Next.js SDK for ThunderID",
   "keywords": [
     "thunderid",
@@ -40,8 +40,8 @@
     "@types/react": "19.2.14",
     "jose": "6.2.3",
     "tslib": "2.8.1",
-    "@thunderid/react": "^0.13.0",
-    "@thunderid/node": "^0.13.0"
+    "@thunderid/node": "^1.0.0",
+    "@thunderid/react": "^1.0.0"
   },
   "devDependencies": {
     "@thunderid/eslint-plugin": "0.0.2",