@thunderid/nextjs 0.2.3 → 0.3.0

package/dist/cjs/server/ThunderIDProvider.cjs

@@ -51,6 +51,18 @@ const ThunderIDServerProvider = async ({ children, afterSignInUrl, afterSignOutU
 		throw new __thunderid_node.ThunderIDRuntimeError(`Failed to initialize ThunderID client: ${error?.toString()}`, "next-ConfigurationError-001", "next", "An error occurred while initializing the ThunderID client. Please check your configuration.");
 	}
 	if (!thunderIDClient.isInitialized) return /* @__PURE__ */ (0, react_jsx_runtime.jsx)(react_jsx_runtime.Fragment, {});
+	let flowMeta = null;
+	try {
+		flowMeta = await (0, __thunderid_node.getFlowMeta)({
+			baseUrl: config?.baseUrl,
+			...config?.applicationId ? {
+				id: config.applicationId,
+				type: __thunderid_node.FlowMetaType.App
+			} : {}
+		});
+	} catch (error) {
+		require_logger.default.warn("[ThunderIDServerProvider] Failed to fetch flow metadata:", error?.toString());
+	}
 	const sessionPayload = await require_getSessionPayload.default();
 	const sessionId = sessionPayload?.sessionId || await require_getSessionId.default() || "";
 	const signedIn = await require_isSignedIn.default(sessionId);
@@ -90,6 +102,7 @@ const ThunderIDServerProvider = async ({ children, afterSignInUrl, afterSignOutU
 		organizationHandle: config?.organizationHandle,
 		applicationId: config?.applicationId,
 		baseUrl: config?.baseUrl,
+		initialMeta: flowMeta,
 		signIn: require_signInAction.default,
 		clearSession: require_clearSession.default,
 		refreshToken: require_refreshToken.default,

package/dist/cjs/server/ThunderIDProvider.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"ThunderIDProvider.cjs","names":["ThunderIDServerProvider: FC<PropsWithChildren<ThunderIDServerProviderProps>>","getClient","config: Partial<ThunderIDNextConfig>","ThunderIDRuntimeError","sessionPayload: SessionTokenPayload | undefined","getSessionPayload","sessionId: string","getSessionId","signedIn: boolean","isSignedIn","user: User","userProfile: UserProfile","updatedBaseUrl: string | undefined","userResponse: {\n          data: {user: User | null};\n          error: string | null;\n          success: boolean;\n        }","getUserAction","userProfileResponse: {\n          data: {userProfile: UserProfile};\n          error: string | null;\n          success: boolean;\n        }","getUserProfileAction","ThunderIDClientProvider","signInAction","clearSession","refreshToken","signOutAction","signUpAction","handleOAuthCallbackAction","updateUserProfileAction"],"sources":["../../../src/server/ThunderIDProvider.tsx"],"sourcesContent":["/**\n * Copyright (c) 2025, WSO2 LLC. (https://www.wso2.com).\n *\n * WSO2 LLC. licenses this file to you under the Apache License,\n * Version 2.0 (the \"License\"); you may not use this file except\n * in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing,\n * software distributed under the License is distributed on an\n * \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY\n * KIND, either express or implied. See the License for the\n * specific language governing permissions and limitations\n * under the License.\n */\n\n'use server';\n\nimport {ThunderIDRuntimeError, IdToken, User, UserProfile} from '@thunderid/node';\nimport {ThunderIDProviderProps} from '@thunderid/react';\nimport {FC, PropsWithChildren, ReactElement} from 'react';\nimport clearSession from './actions/clearSession';\nimport getSessionId from './actions/getSessionId';\nimport getSessionPayload from './actions/getSessionPayload';\nimport getUserAction from './actions/getUserAction';\nimport getUserProfileAction from './actions/getUserProfileAction';\nimport handleOAuthCallbackAction from './actions/handleOAuthCallbackAction';\nimport isSignedIn from './actions/isSignedIn';\nimport refreshToken from './actions/refreshToken';\nimport signInAction from './actions/signInAction';\nimport signOutAction from './actions/signOutAction';\nimport signUpAction from './actions/signUpAction';\nimport updateUserProfileAction from './actions/updateUserProfileAction';\nimport getClient from './getClient';\nimport ThunderIDClientProvider from '../client/contexts/ThunderID/ThunderIDProvider.js';\nimport {ThunderIDNextConfig} from '../models/config';\nimport logger from '../utils/logger';\nimport {SessionTokenPayload} from '../utils/SessionManager';\n\n/**\n * Props interface of {@link ThunderIDServerProvider}\n */\nexport type ThunderIDServerProviderProps = Partial<ThunderIDProviderProps> & {\n  clientSecret?: string;\n  /**\n   * Session cookie lifetime in seconds. Determines how long the session cookie\n   * remains valid in the browser after sign-in.\n   *\n   * Resolution order (first defined value wins):\n   *   1. This prop — set here when mounting the provider.\n   *   2. `THUNDERID_SESSION_COOKIE_EXPIRY_TIME` environment variable.\n   *   3. Built-in default of 86400 seconds (24 hours).\n   *\n   * @example\n   * // 8-hour session cookie\n   * <ThunderIDServerProvider sessionCookieExpiryTime={28800} ... />\n   */\n  sessionCookieExpiryTime?: number;\n};\n\n/**\n * Server-side provider component for ThunderID authentication.\n * Wraps the client-side provider and handles server-side authentication logic.\n * Uses the singleton ThunderIDNextClient instance for consistent authentication state.\n *\n * @param props - Props injected into the component.\n *\n * @example\n * ```tsx\n * <ThunderIDServerProvider config={thunderidConfig}>\n *   <YourApp />\n * </ThunderIDServerProvider>\n * ```\n *\n * @returns ThunderIDServerProvider component.\n */\nconst ThunderIDServerProvider: FC<PropsWithChildren<ThunderIDServerProviderProps>> = async ({\n  children,\n  afterSignInUrl,\n  afterSignOutUrl,\n  ..._config\n}: PropsWithChildren<ThunderIDServerProviderProps>): Promise<ReactElement> => {\n  const thunderIDClient = getClient();\n  let config: Partial<ThunderIDNextConfig> = {};\n\n  try {\n    await thunderIDClient.initialize(_config as ThunderIDNextConfig);\n\n    logger.debug('[ThunderIDServerProvider] ThunderID client initialized successfully.');\n\n    config = await thunderIDClient.getConfiguration();\n  } catch (error) {\n    logger.error('[ThunderIDServerProvider] Failed to initialize ThunderID client:', error?.toString());\n\n    throw new ThunderIDRuntimeError(\n      `Failed to initialize ThunderID client: ${error?.toString()}`,\n      'next-ConfigurationError-001',\n      'next',\n      'An error occurred while initializing the ThunderID client. Please check your configuration.',\n    );\n  }\n\n  if (!thunderIDClient.isInitialized) {\n    return <></>;\n  }\n\n  // Try to get session information from JWT first, then fall back to legacy\n  const sessionPayload: SessionTokenPayload | undefined = await getSessionPayload();\n  const sessionId: string = sessionPayload?.sessionId || (await getSessionId()) || '';\n  const signedIn: boolean = await isSignedIn(sessionId);\n\n  let user: User = {};\n  let userProfile: UserProfile = {\n    flattenedProfile: {},\n    profile: {},\n    schemas: [],\n  };\n  if (signedIn) {\n    let updatedBaseUrl: string | undefined = config?.baseUrl;\n\n    if (sessionPayload?.organizationId) {\n      updatedBaseUrl = `${config?.baseUrl}/o`;\n      config = {...config, baseUrl: updatedBaseUrl};\n    } else if (sessionId) {\n      try {\n        const idToken: IdToken = await thunderIDClient.getDecodedIdToken(sessionId);\n        if (idToken?.['user_org']) {\n          updatedBaseUrl = `${config?.baseUrl}/o`;\n          config = {...config, baseUrl: updatedBaseUrl};\n        }\n      } catch {\n        // Continue without organization info\n      }\n    }\n\n    // Check if user profile fetching is enabled (default: true)\n    const shouldFetchUserProfile: boolean = config?.preferences?.user?.fetchUserProfile !== false;\n\n    if (shouldFetchUserProfile) {\n      try {\n        const userResponse: {\n          data: {user: User | null};\n          error: string | null;\n          success: boolean;\n        } = await getUserAction(sessionId);\n        const userProfileResponse: {\n          data: {userProfile: UserProfile};\n          error: string | null;\n          success: boolean;\n        } = await getUserProfileAction(sessionId);\n\n        user = userResponse.data?.user || {};\n        userProfile = userProfileResponse.data?.userProfile ?? userProfile;\n      } catch (error) {\n        logger.warn('[ThunderIDServerProvider] Failed to fetch user profile from SCIM2:', error?.toString());\n      }\n    }\n  }\n\n  return (\n    <ThunderIDClientProvider\n      organizationHandle={config?.organizationHandle}\n      applicationId={config?.applicationId}\n      baseUrl={config?.baseUrl}\n      signIn={signInAction}\n      clearSession={clearSession}\n      refreshToken={refreshToken}\n      signOut={signOutAction}\n      signUp={signUpAction}\n      handleOAuthCallback={handleOAuthCallbackAction}\n      signInUrl={config?.signInUrl}\n      signUpUrl={config?.signUpUrl}\n      preferences={config?.preferences}\n      clientId={config?.clientId}\n      user={user}\n      userProfile={userProfile}\n      updateProfile={updateUserProfileAction}\n      isSignedIn={signedIn}\n    >\n      {children}\n    </ThunderIDClientProvider>\n  );\n};\n\nexport default ThunderIDServerProvider;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA8EA,MAAMA,0BAA+E,OAAO,EAC1F,UACA,gBACA,gBACA,GAAG,cACyE;CAC5E,MAAM,kBAAkBC,2BAAW;CACnC,IAAIC,SAAuC,EAAE;AAE7C,KAAI;AACF,QAAM,gBAAgB,WAAW,QAA+B;AAEhE,yBAAO,MAAM,uEAAuE;AAEpF,WAAS,MAAM,gBAAgB,kBAAkB;UAC1C,OAAO;AACd,yBAAO,MAAM,oEAAoE,OAAO,UAAU,CAAC;AAEnG,QAAM,IAAIC,uCACR,0CAA0C,OAAO,UAAU,IAC3D,+BACA,QACA,8FACD;;AAGH,KAAI,CAAC,gBAAgB,cACnB,QAAO,0EAAK;CAId,MAAMC,iBAAkD,MAAMC,mCAAmB;CACjF,MAAMC,YAAoB,gBAAgB,aAAc,MAAMC,8BAAc,IAAK;CACjF,MAAMC,WAAoB,MAAMC,2BAAW,UAAU;CAErD,IAAIC,OAAa,EAAE;CACnB,IAAIC,cAA2B;EAC7B,kBAAkB,EAAE;EACpB,SAAS,EAAE;EACX,SAAS,EAAE;EACZ;AACD,KAAI,UAAU;EACZ,IAAIC,iBAAqC,QAAQ;AAEjD,MAAI,gBAAgB,gBAAgB;AAClC,oBAAiB,GAAG,QAAQ,QAAQ;AACpC,YAAS;IAAC,GAAG;IAAQ,SAAS;IAAe;aACpC,UACT,KAAI;AAEF,QADyB,MAAM,gBAAgB,kBAAkB,UAAU,IAC7D,aAAa;AACzB,qBAAiB,GAAG,QAAQ,QAAQ;AACpC,aAAS;KAAC,GAAG;KAAQ,SAAS;KAAe;;UAEzC;AAQV,MAFwC,QAAQ,aAAa,MAAM,qBAAqB,MAGtF,KAAI;GACF,MAAMC,eAIF,MAAMC,8BAAc,UAAU;GAClC,MAAMC,sBAIF,MAAMC,qCAAqB,UAAU;AAEzC,UAAO,aAAa,MAAM,QAAQ,EAAE;AACpC,iBAAc,oBAAoB,MAAM,eAAe;WAChD,OAAO;AACd,0BAAO,KAAK,sEAAsE,OAAO,UAAU,CAAC;;;AAK1G,QACE,2CAACC;EACC,oBAAoB,QAAQ;EAC5B,eAAe,QAAQ;EACvB,SAAS,QAAQ;EACjB,QAAQC;EACR,cAAcC;EACd,cAAcC;EACd,SAASC;EACT,QAAQC;EACR,qBAAqBC;EACrB,WAAW,QAAQ;EACnB,WAAW,QAAQ;EACnB,aAAa,QAAQ;EACrB,UAAU,QAAQ;EACZ;EACO;EACb,eAAeC;EACf,YAAY;EAEX;GACuB;;AAI9B,kCAAe"}
+{"version":3,"file":"ThunderIDProvider.cjs","names":["ThunderIDServerProvider: FC<PropsWithChildren<ThunderIDServerProviderProps>>","getClient","config: Partial<ThunderIDNextConfig>","ThunderIDRuntimeError","flowMeta: FlowMetadataResponse | null","FlowMetaType","sessionPayload: SessionTokenPayload | undefined","getSessionPayload","sessionId: string","getSessionId","signedIn: boolean","isSignedIn","user: User","userProfile: UserProfile","updatedBaseUrl: string | undefined","userResponse: {\n          data: {user: User | null};\n          error: string | null;\n          success: boolean;\n        }","getUserAction","userProfileResponse: {\n          data: {userProfile: UserProfile};\n          error: string | null;\n          success: boolean;\n        }","getUserProfileAction","ThunderIDClientProvider","signInAction","clearSession","refreshToken","signOutAction","signUpAction","handleOAuthCallbackAction","updateUserProfileAction"],"sources":["../../../src/server/ThunderIDProvider.tsx"],"sourcesContent":["/**\n * Copyright (c) 2025, WSO2 LLC. (https://www.wso2.com).\n *\n * WSO2 LLC. licenses this file to you under the Apache License,\n * Version 2.0 (the \"License\"); you may not use this file except\n * in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing,\n * software distributed under the License is distributed on an\n * \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY\n * KIND, either express or implied. See the License for the\n * specific language governing permissions and limitations\n * under the License.\n */\n\n'use server';\n\nimport {\n  ThunderIDRuntimeError,\n  FlowMetadataResponse,\n  FlowMetaType,\n  IdToken,\n  User,\n  UserProfile,\n  getFlowMeta,\n} from '@thunderid/node';\nimport {ThunderIDProviderProps} from '@thunderid/react';\nimport {FC, PropsWithChildren, ReactElement} from 'react';\nimport clearSession from './actions/clearSession';\nimport getSessionId from './actions/getSessionId';\nimport getSessionPayload from './actions/getSessionPayload';\nimport getUserAction from './actions/getUserAction';\nimport getUserProfileAction from './actions/getUserProfileAction';\nimport handleOAuthCallbackAction from './actions/handleOAuthCallbackAction';\nimport isSignedIn from './actions/isSignedIn';\nimport refreshToken from './actions/refreshToken';\nimport signInAction from './actions/signInAction';\nimport signOutAction from './actions/signOutAction';\nimport signUpAction from './actions/signUpAction';\nimport updateUserProfileAction from './actions/updateUserProfileAction';\nimport getClient from './getClient';\nimport ThunderIDClientProvider from '../client/contexts/ThunderID/ThunderIDProvider.js';\nimport {ThunderIDNextConfig} from '../models/config';\nimport logger from '../utils/logger';\nimport {SessionTokenPayload} from '../utils/SessionManager';\n\n/**\n * Props interface of {@link ThunderIDServerProvider}\n */\nexport type ThunderIDServerProviderProps = Partial<ThunderIDProviderProps> & {\n  clientSecret?: string;\n  /**\n   * Session cookie lifetime in seconds. Determines how long the session cookie\n   * remains valid in the browser after sign-in.\n   *\n   * Resolution order (first defined value wins):\n   *   1. This prop — set here when mounting the provider.\n   *   2. `THUNDERID_SESSION_COOKIE_EXPIRY_TIME` environment variable.\n   *   3. Built-in default of 86400 seconds (24 hours).\n   *\n   * @example\n   * // 8-hour session cookie\n   * <ThunderIDServerProvider sessionCookieExpiryTime={28800} ... />\n   */\n  sessionCookieExpiryTime?: number;\n};\n\n/**\n * Server-side provider component for ThunderID authentication.\n * Wraps the client-side provider and handles server-side authentication logic.\n * Uses the singleton ThunderIDNextClient instance for consistent authentication state.\n *\n * @param props - Props injected into the component.\n *\n * @example\n * ```tsx\n * <ThunderIDServerProvider config={thunderidConfig}>\n *   <YourApp />\n * </ThunderIDServerProvider>\n * ```\n *\n * @returns ThunderIDServerProvider component.\n */\nconst ThunderIDServerProvider: FC<PropsWithChildren<ThunderIDServerProviderProps>> = async ({\n  children,\n  afterSignInUrl,\n  afterSignOutUrl,\n  ..._config\n}: PropsWithChildren<ThunderIDServerProviderProps>): Promise<ReactElement> => {\n  const thunderIDClient = getClient();\n  let config: Partial<ThunderIDNextConfig> = {};\n\n  try {\n    await thunderIDClient.initialize(_config as ThunderIDNextConfig);\n\n    logger.debug('[ThunderIDServerProvider] ThunderID client initialized successfully.');\n\n    config = await thunderIDClient.getConfiguration();\n  } catch (error) {\n    logger.error('[ThunderIDServerProvider] Failed to initialize ThunderID client:', error?.toString());\n\n    throw new ThunderIDRuntimeError(\n      `Failed to initialize ThunderID client: ${error?.toString()}`,\n      'next-ConfigurationError-001',\n      'next',\n      'An error occurred while initializing the ThunderID client. Please check your configuration.',\n    );\n  }\n\n  if (!thunderIDClient.isInitialized) {\n    return <></>;\n  }\n\n  // Fetch flow metadata (design config + i18n bundle) server-side so `FlowMetaProvider` can seed\n  // its state and skip a redundant client-side fetch — avoiding a flash of untranslated i18n keys\n  // (e.g. raw `signin.forms.credentials.title`) while embedded flow components first render.\n  let flowMeta: FlowMetadataResponse | null = null;\n  try {\n    flowMeta = await getFlowMeta({\n      baseUrl: config?.baseUrl,\n      ...(config?.applicationId ? {id: config.applicationId, type: FlowMetaType.App} : {}),\n    });\n  } catch (error) {\n    logger.warn('[ThunderIDServerProvider] Failed to fetch flow metadata:', error?.toString());\n  }\n\n  // Try to get session information from JWT first, then fall back to legacy\n  const sessionPayload: SessionTokenPayload | undefined = await getSessionPayload();\n  const sessionId: string = sessionPayload?.sessionId || (await getSessionId()) || '';\n  const signedIn: boolean = await isSignedIn(sessionId);\n\n  let user: User = {};\n  let userProfile: UserProfile = {\n    flattenedProfile: {},\n    profile: {},\n    schemas: [],\n  };\n  if (signedIn) {\n    let updatedBaseUrl: string | undefined = config?.baseUrl;\n\n    if (sessionPayload?.organizationId) {\n      updatedBaseUrl = `${config?.baseUrl}/o`;\n      config = {...config, baseUrl: updatedBaseUrl};\n    } else if (sessionId) {\n      try {\n        const idToken: IdToken = await thunderIDClient.getDecodedIdToken(sessionId);\n        if (idToken?.['user_org']) {\n          updatedBaseUrl = `${config?.baseUrl}/o`;\n          config = {...config, baseUrl: updatedBaseUrl};\n        }\n      } catch {\n        // Continue without organization info\n      }\n    }\n\n    // Check if user profile fetching is enabled (default: true)\n    const shouldFetchUserProfile: boolean = config?.preferences?.user?.fetchUserProfile !== false;\n\n    if (shouldFetchUserProfile) {\n      try {\n        const userResponse: {\n          data: {user: User | null};\n          error: string | null;\n          success: boolean;\n        } = await getUserAction(sessionId);\n        const userProfileResponse: {\n          data: {userProfile: UserProfile};\n          error: string | null;\n          success: boolean;\n        } = await getUserProfileAction(sessionId);\n\n        user = userResponse.data?.user || {};\n        userProfile = userProfileResponse.data?.userProfile ?? userProfile;\n      } catch (error) {\n        logger.warn('[ThunderIDServerProvider] Failed to fetch user profile from SCIM2:', error?.toString());\n      }\n    }\n  }\n\n  return (\n    <ThunderIDClientProvider\n      organizationHandle={config?.organizationHandle}\n      applicationId={config?.applicationId}\n      baseUrl={config?.baseUrl}\n      initialMeta={flowMeta}\n      signIn={signInAction}\n      clearSession={clearSession}\n      refreshToken={refreshToken}\n      signOut={signOutAction}\n      signUp={signUpAction}\n      handleOAuthCallback={handleOAuthCallbackAction}\n      signInUrl={config?.signInUrl}\n      signUpUrl={config?.signUpUrl}\n      preferences={config?.preferences}\n      clientId={config?.clientId}\n      user={user}\n      userProfile={userProfile}\n      updateProfile={updateUserProfileAction}\n      isSignedIn={signedIn}\n    >\n      {children}\n    </ThunderIDClientProvider>\n  );\n};\n\nexport default ThunderIDServerProvider;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAsFA,MAAMA,0BAA+E,OAAO,EAC1F,UACA,gBACA,gBACA,GAAG,cACyE;CAC5E,MAAM,kBAAkBC,2BAAW;CACnC,IAAIC,SAAuC,EAAE;AAE7C,KAAI;AACF,QAAM,gBAAgB,WAAW,QAA+B;AAEhE,yBAAO,MAAM,uEAAuE;AAEpF,WAAS,MAAM,gBAAgB,kBAAkB;UAC1C,OAAO;AACd,yBAAO,MAAM,oEAAoE,OAAO,UAAU,CAAC;AAEnG,QAAM,IAAIC,uCACR,0CAA0C,OAAO,UAAU,IAC3D,+BACA,QACA,8FACD;;AAGH,KAAI,CAAC,gBAAgB,cACnB,QAAO,0EAAK;CAMd,IAAIC,WAAwC;AAC5C,KAAI;AACF,aAAW,wCAAkB;GAC3B,SAAS,QAAQ;GACjB,GAAI,QAAQ,gBAAgB;IAAC,IAAI,OAAO;IAAe,MAAMC,8BAAa;IAAI,GAAG,EAAE;GACpF,CAAC;UACK,OAAO;AACd,yBAAO,KAAK,4DAA4D,OAAO,UAAU,CAAC;;CAI5F,MAAMC,iBAAkD,MAAMC,mCAAmB;CACjF,MAAMC,YAAoB,gBAAgB,aAAc,MAAMC,8BAAc,IAAK;CACjF,MAAMC,WAAoB,MAAMC,2BAAW,UAAU;CAErD,IAAIC,OAAa,EAAE;CACnB,IAAIC,cAA2B;EAC7B,kBAAkB,EAAE;EACpB,SAAS,EAAE;EACX,SAAS,EAAE;EACZ;AACD,KAAI,UAAU;EACZ,IAAIC,iBAAqC,QAAQ;AAEjD,MAAI,gBAAgB,gBAAgB;AAClC,oBAAiB,GAAG,QAAQ,QAAQ;AACpC,YAAS;IAAC,GAAG;IAAQ,SAAS;IAAe;aACpC,UACT,KAAI;AAEF,QADyB,MAAM,gBAAgB,kBAAkB,UAAU,IAC7D,aAAa;AACzB,qBAAiB,GAAG,QAAQ,QAAQ;AACpC,aAAS;KAAC,GAAG;KAAQ,SAAS;KAAe;;UAEzC;AAQV,MAFwC,QAAQ,aAAa,MAAM,qBAAqB,MAGtF,KAAI;GACF,MAAMC,eAIF,MAAMC,8BAAc,UAAU;GAClC,MAAMC,sBAIF,MAAMC,qCAAqB,UAAU;AAEzC,UAAO,aAAa,MAAM,QAAQ,EAAE;AACpC,iBAAc,oBAAoB,MAAM,eAAe;WAChD,OAAO;AACd,0BAAO,KAAK,sEAAsE,OAAO,UAAU,CAAC;;;AAK1G,QACE,2CAACC;EACC,oBAAoB,QAAQ;EAC5B,eAAe,QAAQ;EACvB,SAAS,QAAQ;EACjB,aAAa;EACb,QAAQC;EACR,cAAcC;EACd,cAAcC;EACd,SAASC;EACT,QAAQC;EACR,qBAAqBC;EACrB,WAAW,QAAQ;EACnB,WAAW,QAAQ;EACnB,aAAa,QAAQ;EACrB,UAAU,QAAQ;EACZ;EACO;EACb,eAAeC;EACf,YAAY;EAEX;GACuB;;AAI9B,kCAAe"}

package/dist/cjs/server/actions/signInAction.cjs

@@ -48,27 +48,19 @@ const signInAction = async (payload, request) => {
 		}
 		const response = await client.signIn(payload, request, sessionId);
 		if (response.flowStatus === __thunderid_node.EmbeddedSignInFlowStatus.Complete) {
-			const signInResult = await client.signIn({
-				code: response?.authData?.code,
-				session_state: response?.authData?.session_state,
-				state: response?.authData?.state
-			}, {}, sessionId);
-			if (signInResult) {
-				const idToken = await client.getDecodedIdToken(sessionId, signInResult["idToken"] || signInResult["id_token"]);
-				const userIdFromToken = idToken.sub || signInResult["sub"] || sessionId;
-				const { accessToken } = signInResult;
-				const refreshToken = signInResult["refreshToken"] ?? "";
-				const scopes = signInResult["scope"];
-				const organizationId = idToken["user_org"] || idToken["organization_id"];
-				const rawExpiresIn = signInResult["expiresIn"] ?? signInResult["expires_in"];
-				const expiresIn = Number(rawExpiresIn);
-				if (Number.isNaN(expiresIn)) throw new Error(`[signInAction] Invalid expiresIn value received: ${rawExpiresIn}`);
-				const config = await client.getConfiguration();
-				const sessionCookieExpiryTime = require_SessionManager.default.resolveSessionCookieExpiry(config.sessionCookie?.expiryTime);
-				const sessionToken = await require_SessionManager.default.createSessionToken(accessToken, userIdFromToken, sessionId, scopes, expiresIn, refreshToken, organizationId);
-				cookieStore.set(require_SessionManager.default.getSessionCookieName(), sessionToken, require_SessionManager.default.getSessionCookieOptions(sessionCookieExpiryTime));
-				cookieStore.delete(require_SessionManager.default.getTempSessionCookieName());
-			}
+			if (!response.assertion) throw new Error("[signInAction] Flow completed without an assertion.");
+			const idToken = await client.getDecodedIdToken(sessionId, response.assertion);
+			const userIdFromToken = idToken.sub ?? sessionId;
+			const organizationId = idToken["user_org"] || idToken["organization_id"];
+			const scopes = idToken["scope"] ?? "";
+			const iat = idToken["iat"] ?? Math.floor(Date.now() / 1e3);
+			const exp = idToken["exp"] ?? iat + 3600;
+			const expiresIn = Math.max(exp - iat, 0);
+			const config = await client.getConfiguration();
+			const sessionCookieExpiryTime = require_SessionManager.default.resolveSessionCookieExpiry(config.sessionCookie?.expiryTime);
+			const sessionToken = await require_SessionManager.default.createSessionToken(response.assertion, userIdFromToken, sessionId, scopes, expiresIn, "", organizationId);
+			cookieStore.set(require_SessionManager.default.getSessionCookieName(), sessionToken, require_SessionManager.default.getSessionCookieOptions(sessionCookieExpiryTime));
+			cookieStore.delete(require_SessionManager.default.getTempSessionCookieName());
 			const afterSignInUrl = await (await client.getStorageManager()).getConfigDataParameter("afterSignInUrl");
 			return {
 				data: { afterSignInUrl: String(afterSignInUrl) },

package/dist/cjs/server/actions/signInAction.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"signInAction.cjs","names":["getClient","cookieStore: RequestCookies","sessionId: string | undefined","existingSessionToken: string | undefined","SessionManager","tempSessionToken: string | undefined","tempSessionToken: string","defaultSignInUrl: string","response: any","EmbeddedSignInFlowStatus","signInResult: Record<string, unknown>","idToken: IdToken","userIdFromToken: string","refreshToken: string","scopes: string","organizationId: string | undefined","rawExpiresIn: unknown","config: ThunderIDNextConfig","sessionCookieExpiryTime: number","sessionToken: string","afterSignInUrl: string"],"sources":["../../../../src/server/actions/signInAction.ts"],"sourcesContent":["/**\n * Copyright (c) 2025, WSO2 LLC. (https://www.wso2.com).\n *\n * WSO2 LLC. licenses this file to you under the Apache License,\n * Version 2.0 (the \"License\"); you may not use this file except\n * in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing,\n * software distributed under the License is distributed on an\n * \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY\n * KIND, either express or implied. See the License for the\n * specific language governing permissions and limitations\n * under the License.\n */\n\n'use server';\n\nimport {\n  generateSessionId,\n  EmbeddedSignInFlowStatus,\n  EmbeddedFlowExecuteRequestConfig,\n  IdToken,\n  isEmpty,\n} from '@thunderid/node';\nimport {cookies} from 'next/headers';\nimport {ThunderIDNextConfig} from '../../models/config';\nimport logger from '../../utils/logger';\nimport SessionManager, {SessionTokenPayload} from '../../utils/SessionManager';\nimport getClient from '../getClient';\n\ntype RequestCookies = Awaited<ReturnType<typeof cookies>>;\n\n/**\n * Server action for signing in a user.\n * Handles the embedded sign-in flow and manages session cookies.\n *\n * @param payload - The embedded sign-in flow payload\n * @param request - The embedded flow execute request config\n * @returns Promise that resolves when sign-in is complete\n */\nconst signInAction = async (\n  payload?: any,\n  request?: EmbeddedFlowExecuteRequestConfig,\n): Promise<{\n  data?:\n    | {\n        afterSignInUrl?: string;\n        signInUrl?: string;\n      }\n    | Record<string, unknown>;\n  error?: string;\n  success: boolean;\n}> => {\n  try {\n    const client = getClient();\n    const cookieStore: RequestCookies = await cookies();\n\n    let sessionId: string | undefined;\n\n    const existingSessionToken: string | undefined = cookieStore.get(SessionManager.getSessionCookieName())?.value;\n\n    if (existingSessionToken) {\n      try {\n        const sessionPayload: SessionTokenPayload = await SessionManager.verifySessionToken(existingSessionToken);\n        sessionId = sessionPayload.sessionId;\n      } catch {\n        // Invalid session token, will create new temp session\n      }\n    }\n\n    if (!sessionId) {\n      const tempSessionToken: string | undefined = cookieStore.get(SessionManager.getTempSessionCookieName())?.value;\n\n      if (tempSessionToken) {\n        try {\n          const tempSession: {sessionId: string} = await SessionManager.verifyTempSession(tempSessionToken);\n          sessionId = tempSession.sessionId;\n        } catch {\n          // Invalid temp session, will create new one\n        }\n      }\n    }\n\n    if (!sessionId) {\n      sessionId = generateSessionId();\n\n      const tempSessionToken: string = await SessionManager.createTempSession(sessionId);\n\n      cookieStore.set(\n        SessionManager.getTempSessionCookieName(),\n        tempSessionToken,\n        SessionManager.getTempSessionCookieOptions(),\n      );\n    }\n\n    // If no payload provided, redirect to sign-in URL for redirect-based sign-in.\n    if (!payload || isEmpty(payload)) {\n      const defaultSignInUrl: string = await client.getAuthorizeRequestUrl({}, sessionId);\n      return {data: {signInUrl: String(defaultSignInUrl)}, success: true};\n    }\n\n    // Handle embedded sign-in flow\n    const response: any = await client.signIn(payload, request!, sessionId);\n\n    if (response.flowStatus === EmbeddedSignInFlowStatus.Complete) {\n      const signInResult: Record<string, unknown> = await client.signIn(\n        {\n          code: response?.authData?.code,\n          session_state: response?.authData?.session_state,\n          state: response?.authData?.state,\n        } as any,\n        {},\n        sessionId,\n      );\n\n      if (signInResult) {\n        const idToken: IdToken = await client.getDecodedIdToken(\n          sessionId,\n          (signInResult['idToken'] || signInResult['id_token']) as string,\n        );\n        const userIdFromToken: string = (idToken.sub || signInResult['sub'] || sessionId) as string;\n        const {accessToken}: {accessToken: string} = signInResult as {accessToken: string};\n        const refreshToken: string = (signInResult['refreshToken'] as string | undefined) ?? '';\n        const scopes: string = signInResult['scope'] as string;\n        const organizationId: string | undefined = (idToken['user_org'] || idToken['organization_id']) as\n          | string\n          | undefined;\n        const rawExpiresIn: unknown = signInResult['expiresIn'] ?? signInResult['expires_in'];\n        const expiresIn = Number(rawExpiresIn);\n        if (Number.isNaN(expiresIn)) {\n          throw new Error(`[signInAction] Invalid expiresIn value received: ${rawExpiresIn}`);\n        }\n        const config: ThunderIDNextConfig = await client.getConfiguration();\n        const sessionCookieExpiryTime: number = SessionManager.resolveSessionCookieExpiry(\n          config.sessionCookie?.expiryTime,\n        );\n\n        const sessionToken: string = await SessionManager.createSessionToken(\n          accessToken,\n          userIdFromToken,\n          sessionId,\n          scopes,\n          expiresIn,\n          refreshToken,\n          organizationId,\n        );\n\n        cookieStore.set(\n          SessionManager.getSessionCookieName(),\n          sessionToken,\n          SessionManager.getSessionCookieOptions(sessionCookieExpiryTime),\n        );\n\n        cookieStore.delete(SessionManager.getTempSessionCookieName());\n      }\n\n      const afterSignInUrl: string = await (await client.getStorageManager()).getConfigDataParameter('afterSignInUrl');\n      return {data: {afterSignInUrl: String(afterSignInUrl)}, success: true};\n    }\n\n    return {data: response as Record<string, unknown>, success: true};\n  } catch (error) {\n    const message =\n      error instanceof Error\n        ? error.message\n        : typeof (error as any)?.message === 'string'\n          ? (error as any).message\n          : String(error);\n    logger.error(`[signInAction] Error during sign-in: ${message}`);\n    return {error: message, success: false};\n  }\n};\n\nexport default signInAction;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;AA2CA,MAAM,eAAe,OACnB,SACA,YAUI;AACJ,KAAI;EACF,MAAM,SAASA,2BAAW;EAC1B,MAAMC,cAA8B,iCAAe;EAEnD,IAAIC;EAEJ,MAAMC,uBAA2C,YAAY,IAAIC,+BAAe,sBAAsB,CAAC,EAAE;AAEzG,MAAI,qBACF,KAAI;AAEF,gBAD4C,MAAMA,+BAAe,mBAAmB,qBAAqB,EAC9E;UACrB;AAKV,MAAI,CAAC,WAAW;GACd,MAAMC,mBAAuC,YAAY,IAAID,+BAAe,0BAA0B,CAAC,EAAE;AAEzG,OAAI,iBACF,KAAI;AAEF,iBADyC,MAAMA,+BAAe,kBAAkB,iBAAiB,EACzE;WAClB;;AAMZ,MAAI,CAAC,WAAW;AACd,wDAA+B;GAE/B,MAAME,mBAA2B,MAAMF,+BAAe,kBAAkB,UAAU;AAElF,eAAY,IACVA,+BAAe,0BAA0B,EACzC,kBACAA,+BAAe,6BAA6B,CAC7C;;AAIH,MAAI,CAAC,yCAAmB,QAAQ,EAAE;GAChC,MAAMG,mBAA2B,MAAM,OAAO,uBAAuB,EAAE,EAAE,UAAU;AACnF,UAAO;IAAC,MAAM,EAAC,WAAW,OAAO,iBAAiB,EAAC;IAAE,SAAS;IAAK;;EAIrE,MAAMC,WAAgB,MAAM,OAAO,OAAO,SAAS,SAAU,UAAU;AAEvE,MAAI,SAAS,eAAeC,0CAAyB,UAAU;GAC7D,MAAMC,eAAwC,MAAM,OAAO,OACzD;IACE,MAAM,UAAU,UAAU;IAC1B,eAAe,UAAU,UAAU;IACnC,OAAO,UAAU,UAAU;IAC5B,EACD,EAAE,EACF,UACD;AAED,OAAI,cAAc;IAChB,MAAMC,UAAmB,MAAM,OAAO,kBACpC,WACC,aAAa,cAAc,aAAa,YAC1C;IACD,MAAMC,kBAA2B,QAAQ,OAAO,aAAa,UAAU;IACvE,MAAM,EAAC,gBAAsC;IAC7C,MAAMC,eAAwB,aAAa,mBAA0C;IACrF,MAAMC,SAAiB,aAAa;IACpC,MAAMC,iBAAsC,QAAQ,eAAe,QAAQ;IAG3E,MAAMC,eAAwB,aAAa,gBAAgB,aAAa;IACxE,MAAM,YAAY,OAAO,aAAa;AACtC,QAAI,OAAO,MAAM,UAAU,CACzB,OAAM,IAAI,MAAM,oDAAoD,eAAe;IAErF,MAAMC,SAA8B,MAAM,OAAO,kBAAkB;IACnE,MAAMC,0BAAkCd,+BAAe,2BACrD,OAAO,eAAe,WACvB;IAED,MAAMe,eAAuB,MAAMf,+BAAe,mBAChD,aACA,iBACA,WACA,QACA,WACA,cACA,eACD;AAED,gBAAY,IACVA,+BAAe,sBAAsB,EACrC,cACAA,+BAAe,wBAAwB,wBAAwB,CAChE;AAED,gBAAY,OAAOA,+BAAe,0BAA0B,CAAC;;GAG/D,MAAMgB,iBAAyB,OAAO,MAAM,OAAO,mBAAmB,EAAE,uBAAuB,iBAAiB;AAChH,UAAO;IAAC,MAAM,EAAC,gBAAgB,OAAO,eAAe,EAAC;IAAE,SAAS;IAAK;;AAGxE,SAAO;GAAC,MAAM;GAAqC,SAAS;GAAK;UAC1D,OAAO;EACd,MAAM,UACJ,iBAAiB,QACb,MAAM,UACN,OAAQ,OAAe,YAAY,WAChC,MAAc,UACf,OAAO,MAAM;AACrB,yBAAO,MAAM,wCAAwC,UAAU;AAC/D,SAAO;GAAC,OAAO;GAAS,SAAS;GAAM;;;AAI3C,2BAAe"}
+{"version":3,"file":"signInAction.cjs","names":["getClient","cookieStore: RequestCookies","sessionId: string | undefined","existingSessionToken: string | undefined","SessionManager","tempSessionToken: string | undefined","tempSessionToken: string","defaultSignInUrl: string","response: any","EmbeddedSignInFlowStatus","idToken: IdToken","userIdFromToken: string","organizationId: string | undefined","scopes: string","iat: number","exp: number","expiresIn: number","config: ThunderIDNextConfig","sessionCookieExpiryTime: number","sessionToken: string","afterSignInUrl: string"],"sources":["../../../../src/server/actions/signInAction.ts"],"sourcesContent":["/**\n * Copyright (c) 2025, WSO2 LLC. (https://www.wso2.com).\n *\n * WSO2 LLC. licenses this file to you under the Apache License,\n * Version 2.0 (the \"License\"); you may not use this file except\n * in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing,\n * software distributed under the License is distributed on an\n * \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY\n * KIND, either express or implied. See the License for the\n * specific language governing permissions and limitations\n * under the License.\n */\n\n'use server';\n\nimport {\n  generateSessionId,\n  EmbeddedSignInFlowStatus,\n  EmbeddedFlowExecuteRequestConfig,\n  IdToken,\n  isEmpty,\n} from '@thunderid/node';\nimport {cookies} from 'next/headers';\nimport {ThunderIDNextConfig} from '../../models/config';\nimport logger from '../../utils/logger';\nimport SessionManager, {SessionTokenPayload} from '../../utils/SessionManager';\nimport getClient from '../getClient';\n\ntype RequestCookies = Awaited<ReturnType<typeof cookies>>;\n\n/**\n * Server action for signing in a user.\n * Handles the embedded sign-in flow and manages session cookies.\n *\n * @param payload - The embedded sign-in flow payload\n * @param request - The embedded flow execute request config\n * @returns Promise that resolves when sign-in is complete\n */\nconst signInAction = async (\n  payload?: any,\n  request?: EmbeddedFlowExecuteRequestConfig,\n): Promise<{\n  data?:\n    | {\n        afterSignInUrl?: string;\n        signInUrl?: string;\n      }\n    | Record<string, unknown>;\n  error?: string;\n  success: boolean;\n}> => {\n  try {\n    const client = getClient();\n    const cookieStore: RequestCookies = await cookies();\n\n    let sessionId: string | undefined;\n\n    const existingSessionToken: string | undefined = cookieStore.get(SessionManager.getSessionCookieName())?.value;\n\n    if (existingSessionToken) {\n      try {\n        const sessionPayload: SessionTokenPayload = await SessionManager.verifySessionToken(existingSessionToken);\n        sessionId = sessionPayload.sessionId;\n      } catch {\n        // Invalid session token, will create new temp session\n      }\n    }\n\n    if (!sessionId) {\n      const tempSessionToken: string | undefined = cookieStore.get(SessionManager.getTempSessionCookieName())?.value;\n\n      if (tempSessionToken) {\n        try {\n          const tempSession: {sessionId: string} = await SessionManager.verifyTempSession(tempSessionToken);\n          sessionId = tempSession.sessionId;\n        } catch {\n          // Invalid temp session, will create new one\n        }\n      }\n    }\n\n    if (!sessionId) {\n      sessionId = generateSessionId();\n\n      const tempSessionToken: string = await SessionManager.createTempSession(sessionId);\n\n      cookieStore.set(\n        SessionManager.getTempSessionCookieName(),\n        tempSessionToken,\n        SessionManager.getTempSessionCookieOptions(),\n      );\n    }\n\n    // If no payload provided, redirect to sign-in URL for redirect-based sign-in.\n    if (!payload || isEmpty(payload)) {\n      const defaultSignInUrl: string = await client.getAuthorizeRequestUrl({}, sessionId);\n      return {data: {signInUrl: String(defaultSignInUrl)}, success: true};\n    }\n\n    // Handle embedded sign-in flow\n    const response: any = await client.signIn(payload, request!, sessionId);\n\n    if (response.flowStatus === EmbeddedSignInFlowStatus.Complete) {\n      // On the V2 platform, a completed embedded flow (without a preceding `/authorize` redirect,\n      // i.e. no `authId`) returns a self-contained JWT `assertion` rather than an authorization\n      // code to exchange. This mirrors how @thunderid/react and @thunderid/vue treat it: the\n      // assertion is used directly as the bearer session token.\n      if (!response.assertion) {\n        throw new Error('[signInAction] Flow completed without an assertion.');\n      }\n\n      const idToken: IdToken = await client.getDecodedIdToken(sessionId, response.assertion);\n      const userIdFromToken: string = (idToken.sub as string | undefined) ?? sessionId;\n      const organizationId: string | undefined = (idToken['user_org'] || idToken['organization_id']) as\n        | string\n        | undefined;\n      const scopes: string = (idToken['scope'] as string | undefined) ?? '';\n      const iat: number = (idToken['iat'] as number | undefined) ?? Math.floor(Date.now() / 1000);\n      const exp: number = (idToken['exp'] as number | undefined) ?? iat + 3600;\n      const expiresIn: number = Math.max(exp - iat, 0);\n\n      const config: ThunderIDNextConfig = await client.getConfiguration();\n      const sessionCookieExpiryTime: number = SessionManager.resolveSessionCookieExpiry(\n        config.sessionCookie?.expiryTime,\n      );\n\n      const sessionToken: string = await SessionManager.createSessionToken(\n        response.assertion,\n        userIdFromToken,\n        sessionId,\n        scopes,\n        expiresIn,\n        '',\n        organizationId,\n      );\n\n      cookieStore.set(\n        SessionManager.getSessionCookieName(),\n        sessionToken,\n        SessionManager.getSessionCookieOptions(sessionCookieExpiryTime),\n      );\n\n      cookieStore.delete(SessionManager.getTempSessionCookieName());\n\n      const afterSignInUrl: string = await (await client.getStorageManager()).getConfigDataParameter('afterSignInUrl');\n      return {data: {afterSignInUrl: String(afterSignInUrl)}, success: true};\n    }\n\n    return {data: response as Record<string, unknown>, success: true};\n  } catch (error) {\n    const message =\n      error instanceof Error\n        ? error.message\n        : typeof (error as any)?.message === 'string'\n          ? (error as any).message\n          : String(error);\n    logger.error(`[signInAction] Error during sign-in: ${message}`);\n    return {error: message, success: false};\n  }\n};\n\nexport default signInAction;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;AA2CA,MAAM,eAAe,OACnB,SACA,YAUI;AACJ,KAAI;EACF,MAAM,SAASA,2BAAW;EAC1B,MAAMC,cAA8B,iCAAe;EAEnD,IAAIC;EAEJ,MAAMC,uBAA2C,YAAY,IAAIC,+BAAe,sBAAsB,CAAC,EAAE;AAEzG,MAAI,qBACF,KAAI;AAEF,gBAD4C,MAAMA,+BAAe,mBAAmB,qBAAqB,EAC9E;UACrB;AAKV,MAAI,CAAC,WAAW;GACd,MAAMC,mBAAuC,YAAY,IAAID,+BAAe,0BAA0B,CAAC,EAAE;AAEzG,OAAI,iBACF,KAAI;AAEF,iBADyC,MAAMA,+BAAe,kBAAkB,iBAAiB,EACzE;WAClB;;AAMZ,MAAI,CAAC,WAAW;AACd,wDAA+B;GAE/B,MAAME,mBAA2B,MAAMF,+BAAe,kBAAkB,UAAU;AAElF,eAAY,IACVA,+BAAe,0BAA0B,EACzC,kBACAA,+BAAe,6BAA6B,CAC7C;;AAIH,MAAI,CAAC,yCAAmB,QAAQ,EAAE;GAChC,MAAMG,mBAA2B,MAAM,OAAO,uBAAuB,EAAE,EAAE,UAAU;AACnF,UAAO;IAAC,MAAM,EAAC,WAAW,OAAO,iBAAiB,EAAC;IAAE,SAAS;IAAK;;EAIrE,MAAMC,WAAgB,MAAM,OAAO,OAAO,SAAS,SAAU,UAAU;AAEvE,MAAI,SAAS,eAAeC,0CAAyB,UAAU;AAK7D,OAAI,CAAC,SAAS,UACZ,OAAM,IAAI,MAAM,sDAAsD;GAGxE,MAAMC,UAAmB,MAAM,OAAO,kBAAkB,WAAW,SAAS,UAAU;GACtF,MAAMC,kBAA2B,QAAQ,OAA8B;GACvE,MAAMC,iBAAsC,QAAQ,eAAe,QAAQ;GAG3E,MAAMC,SAAkB,QAAQ,YAAmC;GACnE,MAAMC,MAAe,QAAQ,UAAiC,KAAK,MAAM,KAAK,KAAK,GAAG,IAAK;GAC3F,MAAMC,MAAe,QAAQ,UAAiC,MAAM;GACpE,MAAMC,YAAoB,KAAK,IAAI,MAAM,KAAK,EAAE;GAEhD,MAAMC,SAA8B,MAAM,OAAO,kBAAkB;GACnE,MAAMC,0BAAkCd,+BAAe,2BACrD,OAAO,eAAe,WACvB;GAED,MAAMe,eAAuB,MAAMf,+BAAe,mBAChD,SAAS,WACT,iBACA,WACA,QACA,WACA,IACA,eACD;AAED,eAAY,IACVA,+BAAe,sBAAsB,EACrC,cACAA,+BAAe,wBAAwB,wBAAwB,CAChE;AAED,eAAY,OAAOA,+BAAe,0BAA0B,CAAC;GAE7D,MAAMgB,iBAAyB,OAAO,MAAM,OAAO,mBAAmB,EAAE,uBAAuB,iBAAiB;AAChH,UAAO;IAAC,MAAM,EAAC,gBAAgB,OAAO,eAAe,EAAC;IAAE,SAAS;IAAK;;AAGxE,SAAO;GAAC,MAAM;GAAqC,SAAS;GAAK;UAC1D,OAAO;EACd,MAAM,UACJ,iBAAiB,QACb,MAAM,UACN,OAAQ,OAAe,YAAY,WAChC,MAAc,UACf,OAAO,MAAM;AACrB,yBAAO,MAAM,wCAAwC,UAAU;AAC/D,SAAO;GAAC,OAAO;GAAS,SAAS;GAAM;;;AAI3C,2BAAe"}

package/dist/client/components/presentation/SignIn/SignIn.d.ts

@@ -21,11 +21,12 @@ import { FC } from 'react';
  * Props for the SignIn component.
  * Extends BaseSignInProps for full compatibility with the React BaseSignIn component
  */
-export type SignInProps = Pick<BaseSignInProps, 'className' | 'onSuccess' | 'onError' | 'variant' | 'size'>;
+export type SignInProps = Pick<BaseSignInProps, 'className' | 'id' | 'onSuccess' | 'onError' | 'variant' | 'size'>;
 /**
  * A SignIn component for Next.js that provides native authentication flow.
- * This component delegates to the BaseSignIn from @thunderid/react and requires
- * the API functions to be provided as props.
+ * This component delegates to the BaseSignIn from @thunderid/react. Unlike BaseSignUp,
+ * BaseSignIn does not manage its own flow state, so this component initiates the flow
+ * (using the server-action-backed `signIn`) and tracks `components`/`executionId` itself.
  */
 declare const SignIn: FC<SignInProps>;
 export default SignIn;

package/dist/client/components/presentation/SignIn/SignIn.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"SignIn.d.ts","sourceRoot":"","sources":["../../../../../src/client/components/presentation/SignIn/SignIn.tsx"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAKH,OAAO,EAAa,eAAe,EAAC,MAAM,kBAAkB,CAAC;AAC7D,OAAO,EAAC,EAAE,EAAC,MAAM,OAAO,CAAC;AAGzB;;;GAGG;AACH,MAAM,MAAM,WAAW,GAAG,IAAI,CAAC,eAAe,EAAE,WAAW,GAAG,WAAW,GAAG,SAAS,GAAG,SAAS,GAAG,MAAM,CAAC,CAAC;AAE5G;;;;GAIG;AACH,QAAA,MAAM,MAAM,EAAE,EAAE,CAAC,WAAW,CAwB3B,CAAC;AAIF,eAAe,MAAM,CAAC"}
+{"version":3,"file":"SignIn.d.ts","sourceRoot":"","sources":["../../../../../src/client/components/presentation/SignIn/SignIn.tsx"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAKH,OAAO,EAAa,eAAe,EAAwC,MAAM,kBAAkB,CAAC;AACpG,OAAO,EAAC,EAAE,EAA8B,MAAM,OAAO,CAAC;AAGtD;;;GAGG;AACH,MAAM,MAAM,WAAW,GAAG,IAAI,CAAC,eAAe,EAAE,WAAW,GAAG,IAAI,GAAG,WAAW,GAAG,SAAS,GAAG,SAAS,GAAG,MAAM,CAAC,CAAC;AAEnH;;;;;GAKG;AACH,QAAA,MAAM,MAAM,EAAE,EAAE,CAAC,WAAW,CAmG3B,CAAC;AAIF,eAAe,MAAM,CAAC"}

package/dist/client/components/presentation/SignIn/SignIn.js

@@ -2,23 +2,73 @@
 
 
 import useThunderID_default from "../../../contexts/ThunderID/useThunderID.js";
-import { ThunderIDRuntimeError } from "@thunderid/node";
-import { BaseSignIn } from "@thunderid/react";
+import { EmbeddedFlowType, ThunderIDRuntimeError } from "@thunderid/node";
+import { BaseSignIn, normalizeFlowResponse, useTranslation } from "@thunderid/react";
+import { useEffect, useRef, useState } from "react";
 import { jsx } from "react/jsx-runtime";
 
 //#region src/client/components/presentation/SignIn/SignIn.tsx
 /**
 * A SignIn component for Next.js that provides native authentication flow.
-* This component delegates to the BaseSignIn from @thunderid/react and requires
-* the API functions to be provided as props.
+* This component delegates to the BaseSignIn from @thunderid/react. Unlike BaseSignUp,
+* BaseSignIn does not manage its own flow state, so this component initiates the flow
+* (using the server-action-backed `signIn`) and tracks `components`/`executionId` itself.
 */
-const SignIn = ({ size = "medium", variant = "outlined",...rest }) => {
-	const { signIn } = useThunderID_default();
-	const handleOnSubmit = async (payload, request) => {
+const SignIn = ({ size = "medium", variant = "outlined", onError,...rest }) => {
+	const { signIn, applicationId, scopes } = useThunderID_default();
+	const { t } = useTranslation();
+	const [components, setComponents] = useState([]);
+	const [additionalData, setAdditionalData] = useState({});
+	const [executionId, setExecutionId] = useState(void 0);
+	const [isFlowInitialized, setIsFlowInitialized] = useState(false);
+	const [flowError, setFlowError] = useState(null);
+	const initializationAttemptedRef = useRef(false);
+	const challengeTokenRef = useRef(void 0);
+	const applyFlowResponse = (response) => {
+		const normalized = normalizeFlowResponse(response, t, { resolveTranslations: false });
+		challengeTokenRef.current = response?.challengeToken ?? void 0;
+		setExecutionId(normalized.executionId ?? void 0);
+		setComponents(normalized.components);
+		setAdditionalData(normalized.additionalData);
+	};
+	const handleFlowError = (error) => {
+		const normalizedError = error instanceof Error ? error : new Error(String(error));
+		setFlowError(normalizedError);
+		onError?.(normalizedError);
+	};
+	useEffect(() => {
+		if (initializationAttemptedRef.current || !signIn) return;
+		initializationAttemptedRef.current = true;
+		(async () => {
+			try {
+				const response = await signIn({
+					applicationId,
+					flowType: EmbeddedFlowType.Authentication,
+					...scopes && { scopes }
+				}, {});
+				if (response) applyFlowResponse(response);
+			} catch (error) {
+				handleFlowError(error);
+			} finally {
+				setIsFlowInitialized(true);
+			}
+		})();
+	}, [signIn]);
+	const handleOnSubmit = async (payload) => {
 		if (!signIn) throw new ThunderIDRuntimeError("`signIn` function is not available.", "SignIn-handleOnSubmit-RuntimeError-001", "nextjs");
-		await signIn(payload, request);
+		const response = await signIn({
+			...payload,
+			executionId,
+			...challengeTokenRef.current ? { challengeToken: challengeTokenRef.current } : {}
+		}, {});
+		if (response) applyFlowResponse(response);
 	};
 	return /* @__PURE__ */ jsx(BaseSignIn, {
+		additionalData,
+		components,
+		error: flowError,
+		isLoading: !isFlowInitialized,
+		onError,
 		onSubmit: handleOnSubmit,
 		size,
 		variant,

package/dist/client/components/presentation/SignIn/SignIn.js.map

@@ -1 +1 @@
-{"version":3,"file":"SignIn.js","names":["SignIn: FC<SignInProps>","useThunderID"],"sources":["../../../../../src/client/components/presentation/SignIn/SignIn.tsx"],"sourcesContent":["/**\n * Copyright (c) 2025, WSO2 LLC. (https://www.wso2.com).\n *\n * WSO2 LLC. licenses this file to you under the Apache License,\n * Version 2.0 (the \"License\"); you may not use this file except\n * in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing,\n * software distributed under the License is distributed on an\n * \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY\n * KIND, either express or implied. See the License for the\n * specific language governing permissions and limitations\n * under the License.\n */\n\n'use client';\n\nimport {ThunderIDRuntimeError} from '@thunderid/node';\nimport {BaseSignIn, BaseSignInProps} from '@thunderid/react';\nimport {FC} from 'react';\nimport useThunderID from '../../../contexts/ThunderID/useThunderID';\n\n/**\n * Props for the SignIn component.\n * Extends BaseSignInProps for full compatibility with the React BaseSignIn component\n */\nexport type SignInProps = Pick<BaseSignInProps, 'className' | 'onSuccess' | 'onError' | 'variant' | 'size'>;\n\n/**\n * A SignIn component for Next.js that provides native authentication flow.\n * This component delegates to the BaseSignIn from @thunderid/react and requires\n * the API functions to be provided as props.\n */\nconst SignIn: FC<SignInProps> = ({size = 'medium', variant = 'outlined', ...rest}: SignInProps) => {\n  const {signIn} = useThunderID();\n\n  const handleOnSubmit = async (payload: any, request: any): Promise<void> => {\n    if (!signIn) {\n      throw new ThunderIDRuntimeError(\n        '`signIn` function is not available.',\n        'SignIn-handleOnSubmit-RuntimeError-001',\n        'nextjs',\n      );\n    }\n\n    await signIn(payload, request);\n  };\n\n  return (\n    <BaseSignIn\n      // isLoading={isLoading || !isInitialized}\n      onSubmit={handleOnSubmit}\n      size={size}\n      variant={variant}\n      {...rest}\n    />\n  );\n};\n\nSignIn.displayName = 'SignIn';\n\nexport default SignIn;\n"],"mappings":";;;;;;;;;;;;;;AAoCA,MAAMA,UAA2B,EAAC,OAAO,UAAU,UAAU,WAAY,GAAG,WAAuB;CACjG,MAAM,EAAC,WAAUC,sBAAc;CAE/B,MAAM,iBAAiB,OAAO,SAAc,YAAgC;AAC1E,MAAI,CAAC,OACH,OAAM,IAAI,sBACR,uCACA,0CACA,SACD;AAGH,QAAM,OAAO,SAAS,QAAQ;;AAGhC,QACE,oBAAC;EAEC,UAAU;EACJ;EACG;EACT,GAAI;GACJ;;AAIN,OAAO,cAAc;AAErB,qBAAe"}
+{"version":3,"file":"SignIn.js","names":["SignIn: FC<SignInProps>","useThunderID","normalizedError: Error","response: any"],"sources":["../../../../../src/client/components/presentation/SignIn/SignIn.tsx"],"sourcesContent":["/**\n * Copyright (c) 2025, WSO2 LLC. (https://www.wso2.com).\n *\n * WSO2 LLC. licenses this file to you under the Apache License,\n * Version 2.0 (the \"License\"); you may not use this file except\n * in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing,\n * software distributed under the License is distributed on an\n * \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY\n * KIND, either express or implied. See the License for the\n * specific language governing permissions and limitations\n * under the License.\n */\n\n'use client';\n\nimport {EmbeddedFlowComponent, EmbeddedFlowType, ThunderIDRuntimeError} from '@thunderid/node';\nimport {BaseSignIn, BaseSignInProps, normalizeFlowResponse, useTranslation} from '@thunderid/react';\nimport {FC, useEffect, useRef, useState} from 'react';\nimport useThunderID from '../../../contexts/ThunderID/useThunderID';\n\n/**\n * Props for the SignIn component.\n * Extends BaseSignInProps for full compatibility with the React BaseSignIn component\n */\nexport type SignInProps = Pick<BaseSignInProps, 'className' | 'id' | 'onSuccess' | 'onError' | 'variant' | 'size'>;\n\n/**\n * A SignIn component for Next.js that provides native authentication flow.\n * This component delegates to the BaseSignIn from @thunderid/react. Unlike BaseSignUp,\n * BaseSignIn does not manage its own flow state, so this component initiates the flow\n * (using the server-action-backed `signIn`) and tracks `components`/`executionId` itself.\n */\nconst SignIn: FC<SignInProps> = ({size = 'medium', variant = 'outlined', onError, ...rest}: SignInProps) => {\n  const {signIn, applicationId, scopes} = useThunderID();\n  const {t} = useTranslation();\n\n  const [components, setComponents] = useState<EmbeddedFlowComponent[]>([]);\n  const [additionalData, setAdditionalData] = useState<Record<string, any>>({});\n  const [executionId, setExecutionId] = useState<string | undefined>(undefined);\n  const [isFlowInitialized, setIsFlowInitialized] = useState(false);\n  const [flowError, setFlowError] = useState<Error | null>(null);\n  const initializationAttemptedRef = useRef(false);\n  // A fresh challenge token is required on every step to prevent replay attacks; the server\n  // rotates it on each response, so it's tracked in a ref (not state) to avoid a stale value\n  // from a closure captured before the previous response's state update committed.\n  const challengeTokenRef = useRef<string | undefined>(undefined);\n\n  const applyFlowResponse = (response: any): void => {\n    const normalized = normalizeFlowResponse(response, t, {resolveTranslations: false});\n\n    challengeTokenRef.current = response?.challengeToken ?? undefined;\n    setExecutionId(normalized.executionId ?? undefined);\n    setComponents(normalized.components);\n    setAdditionalData(normalized.additionalData);\n  };\n\n  const handleFlowError = (error: unknown): void => {\n    const normalizedError: Error = error instanceof Error ? error : new Error(String(error));\n\n    setFlowError(normalizedError);\n    onError?.(normalizedError);\n  };\n\n  useEffect(() => {\n    if (initializationAttemptedRef.current || !signIn) {\n      return;\n    }\n\n    initializationAttemptedRef.current = true;\n\n    (async (): Promise<void> => {\n      try {\n        const response: any = await signIn(\n          {\n            applicationId,\n            flowType: EmbeddedFlowType.Authentication,\n            ...(scopes && {scopes}),\n          },\n          {},\n        );\n\n        // `response` is undefined when the provider already redirected\n        // (OAuth-redirect or completed flows are handled there directly).\n        if (response) {\n          applyFlowResponse(response);\n        }\n      } catch (error) {\n        handleFlowError(error);\n      } finally {\n        setIsFlowInitialized(true);\n      }\n    })();\n    // eslint-disable-next-line react-hooks/exhaustive-deps\n  }, [signIn]);\n\n  const handleOnSubmit = async (payload: any): Promise<void> => {\n    if (!signIn) {\n      throw new ThunderIDRuntimeError(\n        '`signIn` function is not available.',\n        'SignIn-handleOnSubmit-RuntimeError-001',\n        'nextjs',\n      );\n    }\n\n    const response: any = await signIn(\n      {\n        ...payload,\n        executionId,\n        ...(challengeTokenRef.current ? {challengeToken: challengeTokenRef.current} : {}),\n      },\n      {},\n    );\n\n    if (response) {\n      applyFlowResponse(response);\n    }\n  };\n\n  return (\n    <BaseSignIn\n      additionalData={additionalData}\n      components={components}\n      error={flowError}\n      isLoading={!isFlowInitialized}\n      onError={onError}\n      onSubmit={handleOnSubmit}\n      size={size}\n      variant={variant}\n      {...rest}\n    />\n  );\n};\n\nSignIn.displayName = 'SignIn';\n\nexport default SignIn;\n"],"mappings":";;;;;;;;;;;;;;;;AAqCA,MAAMA,UAA2B,EAAC,OAAO,UAAU,UAAU,YAAY,QAAS,GAAG,WAAuB;CAC1G,MAAM,EAAC,QAAQ,eAAe,WAAUC,sBAAc;CACtD,MAAM,EAAC,MAAK,gBAAgB;CAE5B,MAAM,CAAC,YAAY,iBAAiB,SAAkC,EAAE,CAAC;CACzE,MAAM,CAAC,gBAAgB,qBAAqB,SAA8B,EAAE,CAAC;CAC7E,MAAM,CAAC,aAAa,kBAAkB,SAA6B,OAAU;CAC7E,MAAM,CAAC,mBAAmB,wBAAwB,SAAS,MAAM;CACjE,MAAM,CAAC,WAAW,gBAAgB,SAAuB,KAAK;CAC9D,MAAM,6BAA6B,OAAO,MAAM;CAIhD,MAAM,oBAAoB,OAA2B,OAAU;CAE/D,MAAM,qBAAqB,aAAwB;EACjD,MAAM,aAAa,sBAAsB,UAAU,GAAG,EAAC,qBAAqB,OAAM,CAAC;AAEnF,oBAAkB,UAAU,UAAU,kBAAkB;AACxD,iBAAe,WAAW,eAAe,OAAU;AACnD,gBAAc,WAAW,WAAW;AACpC,oBAAkB,WAAW,eAAe;;CAG9C,MAAM,mBAAmB,UAAyB;EAChD,MAAMC,kBAAyB,iBAAiB,QAAQ,QAAQ,IAAI,MAAM,OAAO,MAAM,CAAC;AAExF,eAAa,gBAAgB;AAC7B,YAAU,gBAAgB;;AAG5B,iBAAgB;AACd,MAAI,2BAA2B,WAAW,CAAC,OACzC;AAGF,6BAA2B,UAAU;AAErC,GAAC,YAA2B;AAC1B,OAAI;IACF,MAAMC,WAAgB,MAAM,OAC1B;KACE;KACA,UAAU,iBAAiB;KAC3B,GAAI,UAAU,EAAC,QAAO;KACvB,EACD,EAAE,CACH;AAID,QAAI,SACF,mBAAkB,SAAS;YAEtB,OAAO;AACd,oBAAgB,MAAM;aACd;AACR,yBAAqB,KAAK;;MAE1B;IAEH,CAAC,OAAO,CAAC;CAEZ,MAAM,iBAAiB,OAAO,YAAgC;AAC5D,MAAI,CAAC,OACH,OAAM,IAAI,sBACR,uCACA,0CACA,SACD;EAGH,MAAMA,WAAgB,MAAM,OAC1B;GACE,GAAG;GACH;GACA,GAAI,kBAAkB,UAAU,EAAC,gBAAgB,kBAAkB,SAAQ,GAAG,EAAE;GACjF,EACD,EAAE,CACH;AAED,MAAI,SACF,mBAAkB,SAAS;;AAI/B,QACE,oBAAC;EACiB;EACJ;EACZ,OAAO;EACP,WAAW,CAAC;EACH;EACT,UAAU;EACJ;EACG;EACT,GAAI;GACJ;;AAIN,OAAO,cAAc;AAErB,qBAAe"}

package/dist/client/components/presentation/SignUp/SignUp.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"SignUp.d.ts","sourceRoot":"","sources":["../../../../../src/client/components/presentation/SignUp/SignUp.tsx"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAKH,OAAO,EAAa,eAAe,EAAC,MAAM,kBAAkB,CAAC;AAC7D,OAAO,EAAC,EAAE,EAAC,MAAM,OAAO,CAAC;AAGzB;;GAEG;AACH,MAAM,MAAM,WAAW,GAAG,eAAe,CAAC;AAE1C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,QAAA,MAAM,MAAM,EAAE,EAAE,CAAC,WAAW,CAyD3B,CAAC;AAEF,eAAe,MAAM,CAAC"}
+{"version":3,"file":"SignUp.d.ts","sourceRoot":"","sources":["../../../../../src/client/components/presentation/SignUp/SignUp.tsx"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAKH,OAAO,EAAa,eAAe,EAAC,MAAM,kBAAkB,CAAC;AAC7D,OAAO,EAAC,EAAE,EAAC,MAAM,OAAO,CAAC;AAGzB;;GAEG;AACH,MAAM,MAAM,WAAW,GAAG,eAAe,CAAC;AAE1C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,QAAA,MAAM,MAAM,EAAE,EAAE,CAAC,WAAW,CAwD3B,CAAC;AAEF,eAAe,MAAM,CAAC"}

package/dist/client/components/presentation/SignUp/SignUp.js

@@ -44,10 +44,11 @@ const SignUp = ({ className, size = "medium", variant = "outlined", afterSignUpU
 	*/
 	const handleInitialize = async (payload) => {
 		if (!signUp) throw new ThunderIDRuntimeError("`signUp` function is not available.", "SignUp-handleInitialize-RuntimeError-001", "nextjs");
-		return await signUp(payload || {
+		return await signUp({
 			flowType: EmbeddedFlowType.Registration,
 			...contextApplicationId && { applicationId: contextApplicationId },
-			...scopes && { scopes }
+			...scopes && { scopes },
+			...payload
 		});
 	};
 	/**

package/dist/client/components/presentation/SignUp/SignUp.js.map

@@ -1 +1 @@
-{"version":3,"file":"SignUp.js","names":["SignUp: FC<SignUpProps>","useThunderID"],"sources":["../../../../../src/client/components/presentation/SignUp/SignUp.tsx"],"sourcesContent":["/**\n * Copyright (c) 2025, WSO2 LLC. (https://www.wso2.com).\n *\n * WSO2 LLC. licenses this file to you under the Apache License,\n * Version 2.0 (the \"License\"); you may not use this file except\n * in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing,\n * software distributed under the License is distributed on an\n * \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY\n * KIND, either express or implied. See the License for the\n * specific language governing permissions and limitations\n * under the License.\n */\n\n'use client';\n\nimport {ThunderIDRuntimeError, EmbeddedFlowType} from '@thunderid/node';\nimport {BaseSignUp, BaseSignUpProps} from '@thunderid/react';\nimport {FC} from 'react';\nimport useThunderID from '../../../contexts/ThunderID/useThunderID';\n\n/**\n * Props for the SignUp component.\n */\nexport type SignUpProps = BaseSignUpProps;\n\n/**\n * A styled SignUp component that provides embedded sign-up flow with pre-built styling.\n * This component handles the API calls for sign-up and delegates UI logic to BaseSignUp.\n *\n * @example\n * ```tsx\n * import { SignUp } from '@thunderid/react';\n *\n * const App = () => {\n *   return (\n *     <SignUp\n *       onSuccess={(response) => {\n *         console.log('Sign-up successful:', response);\n *         // Handle successful sign-up (e.g., redirect, show confirmation)\n *       }}\n *       onError={(error) => {\n *         console.error('Sign-up failed:', error);\n *       }}\n *       onComplete={(redirectUrl) => {\n *         // Platform-specific redirect handling (e.g., Next.js router.push)\n *         router.push(redirectUrl); // or window.location.href = redirectUrl\n *       }}\n *       size=\"medium\"\n *       variant=\"outlined\"\n *       afterSignUpUrl=\"/welcome\"\n *     />\n *   );\n * };\n * ```\n */\nconst SignUp: FC<SignUpProps> = ({\n  className,\n  size = 'medium',\n  variant = 'outlined',\n  afterSignUpUrl,\n  onError,\n}: SignUpProps) => {\n  const {signUp, applicationId: contextApplicationId, scopes} = useThunderID();\n\n  /**\n   * Initialize the sign-up flow.\n   */\n  const handleInitialize = async (payload?: any): Promise<any> => {\n    if (!signUp) {\n      throw new ThunderIDRuntimeError(\n        '`signUp` function is not available.',\n        'SignUp-handleInitialize-RuntimeError-001',\n        'nextjs',\n      );\n    }\n\n    return (await signUp(\n      payload || {\n        flowType: EmbeddedFlowType.Registration,\n        ...(contextApplicationId && {applicationId: contextApplicationId}),\n        ...(scopes && {scopes}),\n      },\n    )) as unknown as Promise<any>;\n  };\n\n  /**\n   * Handle sign-up steps.\n   */\n  const handleOnSubmit = async (payload: any): Promise<any> => {\n    if (!signUp) {\n      throw new ThunderIDRuntimeError(\n        '`signUp` function is not available.',\n        'SignUp-handleOnSubmit-RuntimeError-001',\n        'nextjs',\n      );\n    }\n\n    return (await signUp(payload)) as unknown as Promise<any>;\n  };\n\n  return (\n    <BaseSignUp\n      afterSignUpUrl={afterSignUpUrl}\n      onInitialize={handleInitialize}\n      onSubmit={handleOnSubmit}\n      onError={onError}\n      className={className}\n      size={size}\n      variant={variant}\n      isInitialized={true}\n    />\n  );\n};\n\nexport default SignUp;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA4DA,MAAMA,UAA2B,EAC/B,WACA,OAAO,UACP,UAAU,YACV,gBACA,cACiB;CACjB,MAAM,EAAC,QAAQ,eAAe,sBAAsB,WAAUC,sBAAc;;;;CAK5E,MAAM,mBAAmB,OAAO,YAAgC;AAC9D,MAAI,CAAC,OACH,OAAM,IAAI,sBACR,uCACA,4CACA,SACD;AAGH,SAAQ,MAAM,OACZ,WAAW;GACT,UAAU,iBAAiB;GAC3B,GAAI,wBAAwB,EAAC,eAAe,sBAAqB;GACjE,GAAI,UAAU,EAAC,QAAO;GACvB,CACF;;;;;CAMH,MAAM,iBAAiB,OAAO,YAA+B;AAC3D,MAAI,CAAC,OACH,OAAM,IAAI,sBACR,uCACA,0CACA,SACD;AAGH,SAAQ,MAAM,OAAO,QAAQ;;AAG/B,QACE,oBAAC;EACiB;EAChB,cAAc;EACd,UAAU;EACD;EACE;EACL;EACG;EACT,eAAe;GACf;;AAIN,qBAAe"}
+{"version":3,"file":"SignUp.js","names":["SignUp: FC<SignUpProps>","useThunderID"],"sources":["../../../../../src/client/components/presentation/SignUp/SignUp.tsx"],"sourcesContent":["/**\n * Copyright (c) 2025, WSO2 LLC. (https://www.wso2.com).\n *\n * WSO2 LLC. licenses this file to you under the Apache License,\n * Version 2.0 (the \"License\"); you may not use this file except\n * in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing,\n * software distributed under the License is distributed on an\n * \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY\n * KIND, either express or implied. See the License for the\n * specific language governing permissions and limitations\n * under the License.\n */\n\n'use client';\n\nimport {ThunderIDRuntimeError, EmbeddedFlowType} from '@thunderid/node';\nimport {BaseSignUp, BaseSignUpProps} from '@thunderid/react';\nimport {FC} from 'react';\nimport useThunderID from '../../../contexts/ThunderID/useThunderID';\n\n/**\n * Props for the SignUp component.\n */\nexport type SignUpProps = BaseSignUpProps;\n\n/**\n * A styled SignUp component that provides embedded sign-up flow with pre-built styling.\n * This component handles the API calls for sign-up and delegates UI logic to BaseSignUp.\n *\n * @example\n * ```tsx\n * import { SignUp } from '@thunderid/react';\n *\n * const App = () => {\n *   return (\n *     <SignUp\n *       onSuccess={(response) => {\n *         console.log('Sign-up successful:', response);\n *         // Handle successful sign-up (e.g., redirect, show confirmation)\n *       }}\n *       onError={(error) => {\n *         console.error('Sign-up failed:', error);\n *       }}\n *       onComplete={(redirectUrl) => {\n *         // Platform-specific redirect handling (e.g., Next.js router.push)\n *         router.push(redirectUrl); // or window.location.href = redirectUrl\n *       }}\n *       size=\"medium\"\n *       variant=\"outlined\"\n *       afterSignUpUrl=\"/welcome\"\n *     />\n *   );\n * };\n * ```\n */\nconst SignUp: FC<SignUpProps> = ({\n  className,\n  size = 'medium',\n  variant = 'outlined',\n  afterSignUpUrl,\n  onError,\n}: SignUpProps) => {\n  const {signUp, applicationId: contextApplicationId, scopes} = useThunderID();\n\n  /**\n   * Initialize the sign-up flow.\n   */\n  const handleInitialize = async (payload?: any): Promise<any> => {\n    if (!signUp) {\n      throw new ThunderIDRuntimeError(\n        '`signUp` function is not available.',\n        'SignUp-handleInitialize-RuntimeError-001',\n        'nextjs',\n      );\n    }\n\n    return (await signUp({\n      flowType: EmbeddedFlowType.Registration,\n      ...(contextApplicationId && {applicationId: contextApplicationId}),\n      ...(scopes && {scopes}),\n      ...payload,\n    })) as unknown as Promise<any>;\n  };\n\n  /**\n   * Handle sign-up steps.\n   */\n  const handleOnSubmit = async (payload: any): Promise<any> => {\n    if (!signUp) {\n      throw new ThunderIDRuntimeError(\n        '`signUp` function is not available.',\n        'SignUp-handleOnSubmit-RuntimeError-001',\n        'nextjs',\n      );\n    }\n\n    return (await signUp(payload)) as unknown as Promise<any>;\n  };\n\n  return (\n    <BaseSignUp\n      afterSignUpUrl={afterSignUpUrl}\n      onInitialize={handleInitialize}\n      onSubmit={handleOnSubmit}\n      onError={onError}\n      className={className}\n      size={size}\n      variant={variant}\n      isInitialized={true}\n    />\n  );\n};\n\nexport default SignUp;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA4DA,MAAMA,UAA2B,EAC/B,WACA,OAAO,UACP,UAAU,YACV,gBACA,cACiB;CACjB,MAAM,EAAC,QAAQ,eAAe,sBAAsB,WAAUC,sBAAc;;;;CAK5E,MAAM,mBAAmB,OAAO,YAAgC;AAC9D,MAAI,CAAC,OACH,OAAM,IAAI,sBACR,uCACA,4CACA,SACD;AAGH,SAAQ,MAAM,OAAO;GACnB,UAAU,iBAAiB;GAC3B,GAAI,wBAAwB,EAAC,eAAe,sBAAqB;GACjE,GAAI,UAAU,EAAC,QAAO;GACtB,GAAG;GACJ,CAAC;;;;;CAMJ,MAAM,iBAAiB,OAAO,YAA+B;AAC3D,MAAI,CAAC,OACH,OAAM,IAAI,sBACR,uCACA,0CACA,SACD;AAGH,SAAQ,MAAM,OAAO,QAAQ;;AAG/B,QACE,oBAAC;EACiB;EAChB,cAAc;EACd,UAAU;EACD;EACE;EACL;EACG;EACT,eAAe;GACf;;AAIN,qBAAe"}

package/dist/client/components/presentation/UserAvatar/UserAvatar.d.ts

@@ -0,0 +1,33 @@
+/**
+ * Copyright (c) 2026, WSO2 LLC. (https://www.wso2.com).
+ *
+ * WSO2 LLC. licenses this file to you under the Apache License,
+ * Version 2.0 (the "License"); you may not use this file except
+ * in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+import { BaseUserAvatarProps } from '@thunderid/react';
+import { FC } from 'react';
+export type UserAvatarProps = Omit<BaseUserAvatarProps, 'user'>;
+/**
+ * UserAvatar component renders an avatar for the currently signed-in user.
+ * This component is the Next.js-specific implementation that uses BaseUserAvatar
+ * and automatically retrieves the user data from ThunderID context.
+ *
+ * @example
+ * ```tsx
+ * <UserAvatar size={48} />
+ * ```
+ */
+declare const UserAvatar: FC<UserAvatarProps>;
+export default UserAvatar;
+//# sourceMappingURL=UserAvatar.d.ts.map

package/dist/client/components/presentation/UserAvatar/UserAvatar.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"UserAvatar.d.ts","sourceRoot":"","sources":["../../../../../src/client/components/presentation/UserAvatar/UserAvatar.tsx"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAIH,OAAO,EAAiB,mBAAmB,EAAC,MAAM,kBAAkB,CAAC;AACrE,OAAO,EAAC,EAAE,EAAe,MAAM,OAAO,CAAC;AAGvC,MAAM,MAAM,eAAe,GAAG,IAAI,CAAC,mBAAmB,EAAE,MAAM,CAAC,CAAC;AAEhE;;;;;;;;;GASG;AACH,QAAA,MAAM,UAAU,EAAE,EAAE,CAAC,eAAe,CAInC,CAAC;AAEF,eAAe,UAAU,CAAC"}

package/dist/client/components/presentation/UserAvatar/UserAvatar.js

@@ -0,0 +1,30 @@
+'use client';
+
+
+import useThunderID_default from "../../../contexts/ThunderID/useThunderID.js";
+import { BaseUserAvatar } from "@thunderid/react";
+import { jsx } from "react/jsx-runtime";
+
+//#region src/client/components/presentation/UserAvatar/UserAvatar.tsx
+/**
+* UserAvatar component renders an avatar for the currently signed-in user.
+* This component is the Next.js-specific implementation that uses BaseUserAvatar
+* and automatically retrieves the user data from ThunderID context.
+*
+* @example
+* ```tsx
+* <UserAvatar size={48} />
+* ```
+*/
+const UserAvatar = (props) => {
+	const { user } = useThunderID_default();
+	return /* @__PURE__ */ jsx(BaseUserAvatar, {
+		user,
+		...props
+	});
+};
+var UserAvatar_default = UserAvatar;
+
+//#endregion
+export { UserAvatar_default as default };
+//# sourceMappingURL=UserAvatar.js.map

package/dist/client/components/presentation/UserAvatar/UserAvatar.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"UserAvatar.js","names":["UserAvatar: FC<UserAvatarProps>","useThunderID"],"sources":["../../../../../src/client/components/presentation/UserAvatar/UserAvatar.tsx"],"sourcesContent":["/**\n * Copyright (c) 2026, WSO2 LLC. (https://www.wso2.com).\n *\n * WSO2 LLC. licenses this file to you under the Apache License,\n * Version 2.0 (the \"License\"); you may not use this file except\n * in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing,\n * software distributed under the License is distributed on an\n * \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY\n * KIND, either express or implied. See the License for the\n * specific language governing permissions and limitations\n * under the License.\n */\n\n'use client';\n\nimport {BaseUserAvatar, BaseUserAvatarProps} from '@thunderid/react';\nimport {FC, ReactElement} from 'react';\nimport useThunderID from '../../../contexts/ThunderID/useThunderID';\n\nexport type UserAvatarProps = Omit<BaseUserAvatarProps, 'user'>;\n\n/**\n * UserAvatar component renders an avatar for the currently signed-in user.\n * This component is the Next.js-specific implementation that uses BaseUserAvatar\n * and automatically retrieves the user data from ThunderID context.\n *\n * @example\n * ```tsx\n * <UserAvatar size={48} />\n * ```\n */\nconst UserAvatar: FC<UserAvatarProps> = (props: UserAvatarProps): ReactElement => {\n  const {user} = useThunderID();\n\n  return <BaseUserAvatar user={user} {...props} />;\n};\n\nexport default UserAvatar;\n"],"mappings":";;;;;;;;;;;;;;;;;;AAoCA,MAAMA,cAAmC,UAAyC;CAChF,MAAM,EAAC,SAAQC,sBAAc;AAE7B,QAAO,oBAAC;EAAqB;EAAM,GAAI;GAAS;;AAGlD,yBAAe"}

package/dist/client/contexts/ThunderID/ThunderIDProvider.d.ts

@@ -15,7 +15,7 @@
  * specific language governing permissions and limitations
  * under the License.
  */
-import { UpdateMeProfileConfig, User, UserProfile } from '@thunderid/node';
+import { FlowMetadataResponse, UpdateMeProfileConfig, User, UserProfile } from '@thunderid/node';
 import { ThunderIDProviderProps } from '@thunderid/react';
 import { FC, PropsWithChildren } from 'react';
 import { ThunderIDContextProps } from './ThunderIDContext';
@@ -31,6 +31,11 @@ export type ThunderIDClientProviderProps = Partial<Omit<ThunderIDProviderProps,
         redirectUrl?: string;
         success: boolean;
     }>;
+    /**
+     * Flow metadata fetched server-side ahead of time, seeding `FlowMetaProvider` so it can skip
+     * its own initial client-side fetch (avoiding a flash of untranslated i18n keys).
+     */
+    initialMeta?: FlowMetadataResponse | null;
     isSignedIn: boolean;
     organizationHandle: ThunderIDContextProps['organizationHandle'];
     refreshToken: () => Promise<RefreshResult>;

package/dist/client/contexts/ThunderID/ThunderIDProvider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ThunderIDProvider.d.ts","sourceRoot":"","sources":["../../../../src/client/contexts/ThunderID/ThunderIDProvider.tsx"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAIH,OAAO,EAGL,qBAAqB,EACrB,IAAI,EACJ,WAAW,EAEZ,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAML,sBAAsB,EAEvB,MAAM,kBAAkB,CAAC;AAI1B,OAAO,EAAC,EAAE,EAAE,iBAAiB,EAAkD,MAAM,OAAO,CAAC;AAC7F,OAAyB,EAAC,qBAAqB,EAAC,MAAM,oBAAoB,CAAC;AAC3E,OAAO,EAAC,aAAa,EAAC,MAAM,sCAAsC,CAAC;AAGnE;;GAEG;AACH,MAAM,MAAM,4BAA4B,GAAG,OAAO,CAAC,IAAI,CAAC,sBAAsB,EAAE,SAAS,GAAG,UAAU,CAAC,CAAC,GACtG,IAAI,CAAC,sBAAsB,EAAE,SAAS,GAAG,UAAU,CAAC,GAAG;IACrD,aAAa,EAAE,qBAAqB,CAAC,eAAe,CAAC,CAAC;IACtD,YAAY,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAClC,mBAAmB,EAAE,CACnB,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,EACb,YAAY,CAAC,EAAE,MAAM,KAClB,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAC,CAAC,CAAC;IACvE,UAAU,EAAE,OAAO,CAAC;IACpB,kBAAkB,EAAE,qBAAqB,CAAC,oBAAoB,CAAC,CAAC;IAChE,YAAY,EAAE,MAAM,OAAO,CAAC,aAAa,CAAC,CAAC;IAC3C,MAAM,EAAE,qBAAqB,CAAC,QAAQ,CAAC,CAAC;IACxC,OAAO,EAAE,qBAAqB,CAAC,SAAS,CAAC,CAAC;IAC1C,MAAM,EAAE,qBAAqB,CAAC,QAAQ,CAAC,CAAC;IACxC,aAAa,EAAE,CACb,aAAa,EAAE,qBAAqB,EACpC,SAAS,CAAC,EAAE,MAAM,KACf,OAAO,CAAC;QAAC,IAAI,EAAE;YAAC,IAAI,EAAE,IAAI,CAAA;SAAC,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAC,CAAC,CAAC;IACpE,IAAI,EAAE,IAAI,GAAG,IAAI,CAAC;IAClB,WAAW,EAAE,WAAW,CAAC;CAC1B,CAAC;AAEJ,QAAA,MAAM,uBAAuB,EAAE,EAAE,CAAC,iBAAiB,CAAC,4BAA4B,CAAC,CAoPhF,CAAC;AAEF,eAAe,uBAAuB,CAAC"}
+{"version":3,"file":"ThunderIDProvider.d.ts","sourceRoot":"","sources":["../../../../src/client/contexts/ThunderID/ThunderIDProvider.tsx"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAIH,OAAO,EAEL,oBAAoB,EAEpB,qBAAqB,EACrB,IAAI,EACJ,WAAW,EAEZ,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAQL,sBAAsB,EAEvB,MAAM,kBAAkB,CAAC;AAI1B,OAAO,EAAC,EAAE,EAAE,iBAAiB,EAAkD,MAAM,OAAO,CAAC;AAC7F,OAAyB,EAAC,qBAAqB,EAAC,MAAM,oBAAoB,CAAC;AAC3E,OAAO,EAAC,aAAa,EAAC,MAAM,sCAAsC,CAAC;AAGnE;;GAEG;AACH,MAAM,MAAM,4BAA4B,GAAG,OAAO,CAAC,IAAI,CAAC,sBAAsB,EAAE,SAAS,GAAG,UAAU,CAAC,CAAC,GACtG,IAAI,CAAC,sBAAsB,EAAE,SAAS,GAAG,UAAU,CAAC,GAAG;IACrD,aAAa,EAAE,qBAAqB,CAAC,eAAe,CAAC,CAAC;IACtD,YAAY,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAClC,mBAAmB,EAAE,CACnB,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,EACb,YAAY,CAAC,EAAE,MAAM,KAClB,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAC,CAAC,CAAC;IACvE;;;OAGG;IACH,WAAW,CAAC,EAAE,oBAAoB,GAAG,IAAI,CAAC;IAC1C,UAAU,EAAE,OAAO,CAAC;IACpB,kBAAkB,EAAE,qBAAqB,CAAC,oBAAoB,CAAC,CAAC;IAChE,YAAY,EAAE,MAAM,OAAO,CAAC,aAAa,CAAC,CAAC;IAC3C,MAAM,EAAE,qBAAqB,CAAC,QAAQ,CAAC,CAAC;IACxC,OAAO,EAAE,qBAAqB,CAAC,SAAS,CAAC,CAAC;IAC1C,MAAM,EAAE,qBAAqB,CAAC,QAAQ,CAAC,CAAC;IACxC,aAAa,EAAE,CACb,aAAa,EAAE,qBAAqB,EACpC,SAAS,CAAC,EAAE,MAAM,KACf,OAAO,CAAC;QAAC,IAAI,EAAE;YAAC,IAAI,EAAE,IAAI,CAAA;SAAC,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAC,CAAC,CAAC;IACpE,IAAI,EAAE,IAAI,GAAG,IAAI,CAAC;IAClB,WAAW,EAAE,WAAW,CAAC;CAC1B,CAAC;AAEJ,QAAA,MAAM,uBAAuB,EAAE,EAAE,CAAC,iBAAiB,CAAC,4BAA4B,CAAC,CA4ThF,CAAC;AAEF,eAAe,uBAAuB,CAAC"}

package/dist/client/contexts/ThunderID/ThunderIDProvider.js

@@ -4,13 +4,13 @@
 import logger_default from "../../../utils/logger.js";
 import ThunderIDContext_default from "./ThunderIDContext.js";
 import { ThunderIDRuntimeError, generateFlattenedUserProfile } from "@thunderid/node";
-import { FlowMetaProvider, FlowProvider, I18nProvider, ThemeProvider, UserProvider, getActiveTheme } from "@thunderid/react";
+import { FlowMetaProvider, FlowProvider, I18nProvider, ThemeProvider, ThunderIDContext, UserProvider, getActiveTheme } from "@thunderid/react";
 import { useRouter, useSearchParams } from "next/navigation";
 import { useEffect, useMemo, useRef, useState } from "react";
 import { jsx } from "react/jsx-runtime";
 
 //#region src/client/contexts/ThunderID/ThunderIDProvider.tsx
-const ThunderIDClientProvider = ({ baseUrl, children, signIn, clearSession, refreshToken, signOut, signUp, handleOAuthCallback, preferences, isSignedIn, signInUrl, signUpUrl, user: _user, userProfile: _userProfile, updateProfile, applicationId, organizationHandle, scopes }) => {
+const ThunderIDClientProvider = ({ baseUrl, children, signIn, clearSession, refreshToken, signOut, signUp, handleOAuthCallback, preferences, isSignedIn, signInUrl, signUpUrl, user: _user, userProfile: _userProfile, updateProfile, applicationId, organizationHandle, scopes, initialMeta = null }) => {
 	const reRenderCheckRef = useRef(false);
 	const router = useRouter();
 	const searchParams = useSearchParams();
@@ -132,21 +132,75 @@ const ThunderIDClientProvider = ({ baseUrl, children, signIn, clearSession, refr
 			profile: payload
 		}));
 	};
+	const unsupported = (name) => {
+		return () => Promise.reject(new ThunderIDRuntimeError(`\`${name}\` is not supported in @thunderid/nextjs.`, `ThunderIDClientProvider-${name}-NotSupportedError-001`, "nextjs"));
+	};
+	const reactContextValue = useMemo(() => ({
+		afterSignInUrl: void 0,
+		applicationId,
+		baseUrl,
+		clearSession,
+		clientId: void 0,
+		discovery: { wellKnown: null },
+		exchangeToken: unsupported("exchangeToken"),
+		getAccessToken: unsupported("getAccessToken"),
+		getDecodedIdToken: unsupported("getDecodedIdToken"),
+		getIdToken: unsupported("getIdToken"),
+		getStorageManager: () => Promise.resolve(null),
+		http: {
+			request: unsupported("http.request"),
+			requestAll: unsupported("http.requestAll")
+		},
+		instanceId: 0,
+		isInitialized: !isLoading,
+		isLoading,
+		isMetaLoading: false,
+		isSignedIn,
+		meta: initialMeta ?? null,
+		organizationHandle,
+		reInitialize: unsupported("reInitialize"),
+		recover: unsupported("recover"),
+		resolveFlowTemplateLiterals: (text) => text ?? "",
+		scopes,
+		signIn: handleSignIn,
+		signInSilently: unsupported("signInSilently"),
+		signInUrl,
+		signOut: handleSignOut,
+		signUp: handleSignUp,
+		signUpUrl,
+		user
+	}), [
+		applicationId,
+		baseUrl,
+		clearSession,
+		isLoading,
+		isSignedIn,
+		organizationHandle,
+		scopes,
+		signInUrl,
+		signUpUrl,
+		user,
+		initialMeta
+	]);
 	return /* @__PURE__ */ jsx(ThunderIDContext_default.Provider, {
 		value: contextValue,
-		children: /* @__PURE__ */ jsx(I18nProvider, {
-			preferences: preferences?.i18n,
-			children: /* @__PURE__ */ jsx(FlowMetaProvider, {
-				enabled: preferences?.resolveFromMeta !== false,
-				children: /* @__PURE__ */ jsx(ThemeProvider, {
-					theme: preferences?.theme?.overrides,
-					mode: getActiveTheme(preferences?.theme?.mode),
-					children: /* @__PURE__ */ jsx(FlowProvider, { children: /* @__PURE__ */ jsx(UserProvider, {
-						profile: userProfile,
-						onUpdateProfile: handleProfileUpdate,
-						updateProfile,
-						children
-					}) })
+		children: /* @__PURE__ */ jsx(ThunderIDContext.Provider, {
+			value: reactContextValue,
+			children: /* @__PURE__ */ jsx(I18nProvider, {
+				preferences: preferences?.i18n,
+				children: /* @__PURE__ */ jsx(FlowMetaProvider, {
+					enabled: preferences?.resolveFromMeta !== false,
+					initialMeta,
+					children: /* @__PURE__ */ jsx(ThemeProvider, {
+						theme: preferences?.theme?.overrides,
+						mode: getActiveTheme(preferences?.theme?.mode),
+						children: /* @__PURE__ */ jsx(FlowProvider, { children: /* @__PURE__ */ jsx(UserProvider, {
+							profile: userProfile,
+							onUpdateProfile: handleProfileUpdate,
+							updateProfile,
+							children
+						}) })
+					})
 				})
 			})
 		})