@thunderid/nextjs 1.0.3 → 1.0.5

package/dist/server/actions/clearSession.js.map

@@ -1 +1 @@
-{"version":3,"file":"clearSession.js","names":["cookieStore: RequestCookies","SessionManager"],"sources":["../../../src/server/actions/clearSession.ts"],"sourcesContent":["// Copyright 2025 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\n'use server';\n\nimport {cookies} from 'next/headers';\nimport logger from '../../utils/logger';\nimport SessionManager from '../../utils/SessionManager';\n\ntype RequestCookies = Awaited<ReturnType<typeof cookies>>;\n\n/**\n * Deletes all ThunderID session cookies from the browser without contacting the\n * identity server.\n *\n * Use this for error-recovery scenarios where the local session must be wiped\n * immediately: refresh token failures, corrupt sessions, or forced local sign-out\n * when the identity server is unreachable.\n *\n * For a complete sign-out that also revokes the server-side session and obtains the\n * after-sign-out redirect URL, use `signOutAction` instead.\n *\n * @example\n * ```typescript\n * import { clearSession } from '@thunderid/nextjs/server';\n *\n * // Inside a Server Action or Route Handler:\n * await clearSession();\n * redirect('/sign-in');\n * ```\n */\nconst clearSession = async (): Promise<void> => {\n  const cookieStore: RequestCookies = await cookies();\n  cookieStore.delete(SessionManager.getSessionCookieName());\n  cookieStore.delete(SessionManager.getTempSessionCookieName());\n  logger.debug('[clearSession] Session cookies cleared.');\n};\n\nexport default clearSession;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;AA+BA,MAAM,eAAe,YAA2B;CAC9C,MAAMA,cAA8B,MAAM,SAAS;AACnD,aAAY,OAAOC,uBAAe,sBAAsB,CAAC;AACzD,aAAY,OAAOA,uBAAe,0BAA0B,CAAC;AAC7D,gBAAO,MAAM,0CAA0C;;AAGzD,2BAAe"}
+{"version":3,"file":"clearSession.js","names":["cookieStore: RequestCookies","SessionManager"],"sources":["../../../src/server/actions/clearSession.ts"],"sourcesContent":["// Copyright 2025 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\n'use server';\n\nimport {cookies} from 'next/headers';\nimport {deleteChunkedCookie} from '../../utils/chunkedCookie';\nimport logger from '../../utils/logger';\nimport SessionManager from '../../utils/SessionManager';\n\ntype RequestCookies = Awaited<ReturnType<typeof cookies>>;\n\n/**\n * Deletes all ThunderID session cookies from the browser without contacting the\n * identity server.\n *\n * Use this for error-recovery scenarios where the local session must be wiped\n * immediately: refresh token failures, corrupt sessions, or forced local sign-out\n * when the identity server is unreachable.\n *\n * For a complete sign-out that also revokes the server-side session and obtains the\n * after-sign-out redirect URL, use `signOutAction` instead.\n *\n * @example\n * ```typescript\n * import { clearSession } from '@thunderid/nextjs/server';\n *\n * // Inside a Server Action or Route Handler:\n * await clearSession();\n * redirect('/sign-in');\n * ```\n */\nconst clearSession = async (): Promise<void> => {\n  const cookieStore: RequestCookies = await cookies();\n  deleteChunkedCookie(cookieStore, SessionManager.getSessionCookieName());\n  cookieStore.delete(SessionManager.getTempSessionCookieName());\n  logger.debug('[clearSession] Session cookies cleared.');\n};\n\nexport default clearSession;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAgCA,MAAM,eAAe,YAA2B;CAC9C,MAAMA,cAA8B,MAAM,SAAS;AACnD,qBAAoB,aAAaC,uBAAe,sBAAsB,CAAC;AACvE,aAAY,OAAOA,uBAAe,0BAA0B,CAAC;AAC7D,gBAAO,MAAM,0CAA0C;;AAGzD,2BAAe"}

package/dist/server/actions/getAccessToken.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"getAccessToken.d.ts","sourceRoot":"","sources":["../../../src/server/actions/getAccessToken.ts"],"names":[],"mappings":"AAUA;;;;GAIG;AACH,QAAA,MAAM,cAAc,QAAa,OAAO,CAAC,MAAM,GAAG,SAAS,CAgB1D,CAAC;AAEF,eAAe,cAAc,CAAC"}
+{"version":3,"file":"getAccessToken.d.ts","sourceRoot":"","sources":["../../../src/server/actions/getAccessToken.ts"],"names":[],"mappings":"AAWA;;;;GAIG;AACH,QAAA,MAAM,cAAc,QAAa,OAAO,CAAC,MAAM,GAAG,SAAS,CAgB1D,CAAC;AAEF,eAAe,cAAc,CAAC"}

package/dist/server/actions/getAccessToken.js

@@ -1,6 +1,7 @@
 'use server';
 
 
+import { getChunkedCookie } from "../../utils/chunkedCookie.js";
 import SessionManager_default from "../../utils/SessionManager.js";
 import { cookies } from "next/headers";
 
@@ -11,7 +12,7 @@ import { cookies } from "next/headers";
 * @returns The access token if it exists, undefined otherwise
 */
 const getAccessToken = async () => {
-	const sessionToken = (await cookies()).get(SessionManager_default.getSessionCookieName())?.value;
+	const sessionToken = getChunkedCookie(await cookies(), SessionManager_default.getSessionCookieName());
 	if (sessionToken) try {
 		return (await SessionManager_default.verifySessionToken(sessionToken))["accessToken"];
 	} catch (error) {

package/dist/server/actions/getAccessToken.js.map

@@ -1 +1 @@
-{"version":3,"file":"getAccessToken.js","names":["sessionToken: string | undefined","SessionManager"],"sources":["../../../src/server/actions/getAccessToken.ts"],"sourcesContent":["// Copyright 2025 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\n'use server';\n\nimport {cookies} from 'next/headers';\nimport SessionManager, {SessionTokenPayload} from '../../utils/SessionManager';\n\ntype RequestCookies = Awaited<ReturnType<typeof cookies>>;\n\n/**\n * Get the access token from the session cookie.\n *\n * @returns The access token if it exists, undefined otherwise\n */\nconst getAccessToken = async (): Promise<string | undefined> => {\n  const cookieStore: RequestCookies = await cookies();\n\n  const sessionToken: string | undefined = cookieStore.get(SessionManager.getSessionCookieName())?.value;\n\n  if (sessionToken) {\n    try {\n      const sessionPayload: SessionTokenPayload = await SessionManager.verifySessionToken(sessionToken);\n\n      return sessionPayload['accessToken'] as string;\n    } catch (error) {\n      return undefined;\n    }\n  }\n\n  return undefined;\n};\n\nexport default getAccessToken;\n"],"mappings":";;;;;;;;;;;;AAeA,MAAM,iBAAiB,YAAyC;CAG9D,MAAMA,gBAF8B,MAAM,SAAS,EAEE,IAAIC,uBAAe,sBAAsB,CAAC,EAAE;AAEjG,KAAI,aACF,KAAI;AAGF,UAF4C,MAAMA,uBAAe,mBAAmB,aAAa,EAE3E;UACf,OAAO;AACd;;;AAON,6BAAe"}
+{"version":3,"file":"getAccessToken.js","names":["sessionToken: string | undefined","SessionManager"],"sources":["../../../src/server/actions/getAccessToken.ts"],"sourcesContent":["// Copyright 2025 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\n'use server';\n\nimport {cookies} from 'next/headers';\nimport {getChunkedCookie} from '../../utils/chunkedCookie';\nimport SessionManager, {SessionTokenPayload} from '../../utils/SessionManager';\n\ntype RequestCookies = Awaited<ReturnType<typeof cookies>>;\n\n/**\n * Get the access token from the session cookie.\n *\n * @returns The access token if it exists, undefined otherwise\n */\nconst getAccessToken = async (): Promise<string | undefined> => {\n  const cookieStore: RequestCookies = await cookies();\n\n  const sessionToken: string | undefined = getChunkedCookie(cookieStore, SessionManager.getSessionCookieName());\n\n  if (sessionToken) {\n    try {\n      const sessionPayload: SessionTokenPayload = await SessionManager.verifySessionToken(sessionToken);\n\n      return sessionPayload['accessToken'] as string;\n    } catch (error) {\n      return undefined;\n    }\n  }\n\n  return undefined;\n};\n\nexport default getAccessToken;\n"],"mappings":";;;;;;;;;;;;;AAgBA,MAAM,iBAAiB,YAAyC;CAG9D,MAAMA,eAAmC,iBAFL,MAAM,SAAS,EAEoBC,uBAAe,sBAAsB,CAAC;AAE7G,KAAI,aACF,KAAI;AAGF,UAF4C,MAAMA,uBAAe,mBAAmB,aAAa,EAE3E;UACf,OAAO;AACd;;;AAON,6BAAe"}

package/dist/server/actions/getFlowMetaAction.d.ts

@@ -0,0 +1,17 @@
+import { FlowMetadataResponse } from '@thunderid/node';
+/**
+ * Server Action that fetches `GET /flow/meta` server-side.
+ *
+ * `FlowMetaProvider` (from `@thunderid/react`) otherwise fetches this endpoint directly from the
+ * browser against `baseUrl`, which requires the ThunderID server to allow CORS for the app's
+ * origin. Routing it through this action instead means the browser never talks to `baseUrl`
+ * directly — the request happens server-to-server, same as `signInAction`/`signUpAction`.
+ *
+ * @param language - Optional language override, used by `FlowMetaProvider.switchLanguage()`.
+ */
+declare const getFlowMetaAction: (params?: {
+    applicationId?: string;
+    language?: string;
+}) => Promise<FlowMetadataResponse>;
+export default getFlowMetaAction;
+//# sourceMappingURL=getFlowMetaAction.d.ts.map

package/dist/server/actions/getFlowMetaAction.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"getFlowMetaAction.d.ts","sourceRoot":"","sources":["../../../src/server/actions/getFlowMetaAction.ts"],"names":[],"mappings":"AAKA,OAAO,EAAC,oBAAoB,EAAqD,MAAM,iBAAiB,CAAC;AAKzG;;;;;;;;;GASG;AACH,QAAA,MAAM,iBAAiB,GAAU,SAAS;IACxC,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,KAAG,OAAO,CAAC,oBAAoB,CAkB/B,CAAC;AAEF,eAAe,iBAAiB,CAAC"}

package/dist/server/actions/getFlowMetaAction.js

@@ -0,0 +1,42 @@
+'use server';
+
+
+import getClient_default from "../getClient.js";
+import logger_default from "../../utils/logger.js";
+import { FlowMetaType, getFlowMeta, resolveResourceEndpoint } from "@thunderid/node";
+
+//#region src/server/actions/getFlowMetaAction.ts
+/**
+* Server Action that fetches `GET /flow/meta` server-side.
+*
+* `FlowMetaProvider` (from `@thunderid/react`) otherwise fetches this endpoint directly from the
+* browser against `baseUrl`, which requires the ThunderID server to allow CORS for the app's
+* origin. Routing it through this action instead means the browser never talks to `baseUrl`
+* directly — the request happens server-to-server, same as `signInAction`/`signUpAction`.
+*
+* @param language - Optional language override, used by `FlowMetaProvider.switchLanguage()`.
+*/
+const getFlowMetaAction = async (params) => {
+	const config = await getClient_default().getConfiguration();
+	const applicationId = params?.applicationId ?? config?.applicationId;
+	try {
+		return await getFlowMeta({
+			baseUrl: config?.baseUrl,
+			url: resolveResourceEndpoint("flowMeta", config),
+			...applicationId ? {
+				id: applicationId,
+				type: FlowMetaType.App
+			} : {},
+			...params?.language ? { language: params.language } : {}
+		});
+	} catch (error) {
+		const message = error instanceof Error ? error.message : String(error);
+		logger_default.error(`[getFlowMetaAction] Error fetching flow metadata: ${message}`);
+		throw error;
+	}
+};
+var getFlowMetaAction_default = getFlowMetaAction;
+
+//#endregion
+export { getFlowMetaAction_default as default };
+//# sourceMappingURL=getFlowMetaAction.js.map

package/dist/server/actions/getFlowMetaAction.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"getFlowMetaAction.js","names":["config: ThunderIDNextConfig","getClient","applicationId: string | undefined"],"sources":["../../../src/server/actions/getFlowMetaAction.ts"],"sourcesContent":["// Copyright 2026 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\n'use server';\n\nimport {FlowMetadataResponse, FlowMetaType, getFlowMeta, resolveResourceEndpoint} from '@thunderid/node';\nimport {ThunderIDNextConfig} from '../../models/config';\nimport logger from '../../utils/logger';\nimport getClient from '../getClient';\n\n/**\n * Server Action that fetches `GET /flow/meta` server-side.\n *\n * `FlowMetaProvider` (from `@thunderid/react`) otherwise fetches this endpoint directly from the\n * browser against `baseUrl`, which requires the ThunderID server to allow CORS for the app's\n * origin. Routing it through this action instead means the browser never talks to `baseUrl`\n * directly — the request happens server-to-server, same as `signInAction`/`signUpAction`.\n *\n * @param language - Optional language override, used by `FlowMetaProvider.switchLanguage()`.\n */\nconst getFlowMetaAction = async (params?: {\n  applicationId?: string;\n  language?: string;\n}): Promise<FlowMetadataResponse> => {\n  const client = getClient();\n  const config: ThunderIDNextConfig = await client.getConfiguration();\n\n  const applicationId: string | undefined = params?.applicationId ?? config?.applicationId;\n\n  try {\n    return await getFlowMeta({\n      baseUrl: config?.baseUrl,\n      url: resolveResourceEndpoint('flowMeta', config),\n      ...(applicationId ? {id: applicationId, type: FlowMetaType.App} : {}),\n      ...(params?.language ? {language: params.language} : {}),\n    });\n  } catch (error) {\n    const message = error instanceof Error ? error.message : String(error);\n    logger.error(`[getFlowMetaAction] Error fetching flow metadata: ${message}`);\n    throw error;\n  }\n};\n\nexport default getFlowMetaAction;\n"],"mappings":";;;;;;;;;;;;;;;;;;AAoBA,MAAM,oBAAoB,OAAO,WAGI;CAEnC,MAAMA,SAA8B,MADrBC,mBAAW,CACuB,kBAAkB;CAEnE,MAAMC,gBAAoC,QAAQ,iBAAiB,QAAQ;AAE3E,KAAI;AACF,SAAO,MAAM,YAAY;GACvB,SAAS,QAAQ;GACjB,KAAK,wBAAwB,YAAY,OAAO;GAChD,GAAI,gBAAgB;IAAC,IAAI;IAAe,MAAM,aAAa;IAAI,GAAG,EAAE;GACpE,GAAI,QAAQ,WAAW,EAAC,UAAU,OAAO,UAAS,GAAG,EAAE;GACxD,CAAC;UACK,OAAO;EACd,MAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM;AACtE,iBAAO,MAAM,qDAAqD,UAAU;AAC5E,QAAM;;;AAIV,gCAAe"}

package/dist/server/actions/getSessionId.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"getSessionId.d.ts","sourceRoot":"","sources":["../../../src/server/actions/getSessionId.ts"],"names":[],"mappings":"AAUA;;;;;GAKG;AACH,QAAA,MAAM,YAAY,QAAa,OAAO,CAAC,MAAM,GAAG,SAAS,CAgBxD,CAAC;AAEF,eAAe,YAAY,CAAC"}
+{"version":3,"file":"getSessionId.d.ts","sourceRoot":"","sources":["../../../src/server/actions/getSessionId.ts"],"names":[],"mappings":"AAWA;;;;;GAKG;AACH,QAAA,MAAM,YAAY,QAAa,OAAO,CAAC,MAAM,GAAG,SAAS,CAgBxD,CAAC;AAEF,eAAe,YAAY,CAAC"}

package/dist/server/actions/getSessionId.js

@@ -1,6 +1,7 @@
 'use server';
 
 
+import { getChunkedCookie } from "../../utils/chunkedCookie.js";
 import SessionManager_default from "../../utils/SessionManager.js";
 import { cookies } from "next/headers";
 
@@ -12,7 +13,7 @@ import { cookies } from "next/headers";
 * @returns The session ID if it exists, undefined otherwise
 */
 const getSessionId = async () => {
-	const sessionToken = (await cookies()).get(SessionManager_default.getSessionCookieName())?.value;
+	const sessionToken = getChunkedCookie(await cookies(), SessionManager_default.getSessionCookieName());
 	if (sessionToken) try {
 		return (await SessionManager_default.verifySessionToken(sessionToken)).sessionId;
 	} catch (error) {

package/dist/server/actions/getSessionId.js.map

@@ -1 +1 @@
-{"version":3,"file":"getSessionId.js","names":["sessionToken: string | undefined","SessionManager"],"sources":["../../../src/server/actions/getSessionId.ts"],"sourcesContent":["// Copyright 2025 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\n'use server';\n\nimport {cookies} from 'next/headers';\nimport SessionManager, {SessionTokenPayload} from '../../utils/SessionManager';\n\ntype RequestCookies = Awaited<ReturnType<typeof cookies>>;\n\n/**\n * Get the session ID from cookies.\n * Tries JWT session first, then falls back to legacy session ID.\n *\n * @returns The session ID if it exists, undefined otherwise\n */\nconst getSessionId = async (): Promise<string | undefined> => {\n  const cookieStore: RequestCookies = await cookies();\n\n  const sessionToken: string | undefined = cookieStore.get(SessionManager.getSessionCookieName())?.value;\n\n  if (sessionToken) {\n    try {\n      const sessionPayload: SessionTokenPayload = await SessionManager.verifySessionToken(sessionToken);\n\n      return sessionPayload.sessionId;\n    } catch (error) {\n      return undefined;\n    }\n  }\n\n  return undefined;\n};\n\nexport default getSessionId;\n"],"mappings":";;;;;;;;;;;;;AAgBA,MAAM,eAAe,YAAyC;CAG5D,MAAMA,gBAF8B,MAAM,SAAS,EAEE,IAAIC,uBAAe,sBAAsB,CAAC,EAAE;AAEjG,KAAI,aACF,KAAI;AAGF,UAF4C,MAAMA,uBAAe,mBAAmB,aAAa,EAE3E;UACf,OAAO;AACd;;;AAON,2BAAe"}
+{"version":3,"file":"getSessionId.js","names":["sessionToken: string | undefined","SessionManager"],"sources":["../../../src/server/actions/getSessionId.ts"],"sourcesContent":["// Copyright 2025 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\n'use server';\n\nimport {cookies} from 'next/headers';\nimport {getChunkedCookie} from '../../utils/chunkedCookie';\nimport SessionManager, {SessionTokenPayload} from '../../utils/SessionManager';\n\ntype RequestCookies = Awaited<ReturnType<typeof cookies>>;\n\n/**\n * Get the session ID from cookies.\n * Tries JWT session first, then falls back to legacy session ID.\n *\n * @returns The session ID if it exists, undefined otherwise\n */\nconst getSessionId = async (): Promise<string | undefined> => {\n  const cookieStore: RequestCookies = await cookies();\n\n  const sessionToken: string | undefined = getChunkedCookie(cookieStore, SessionManager.getSessionCookieName());\n\n  if (sessionToken) {\n    try {\n      const sessionPayload: SessionTokenPayload = await SessionManager.verifySessionToken(sessionToken);\n\n      return sessionPayload.sessionId;\n    } catch (error) {\n      return undefined;\n    }\n  }\n\n  return undefined;\n};\n\nexport default getSessionId;\n"],"mappings":";;;;;;;;;;;;;;AAiBA,MAAM,eAAe,YAAyC;CAG5D,MAAMA,eAAmC,iBAFL,MAAM,SAAS,EAEoBC,uBAAe,sBAAsB,CAAC;AAE7G,KAAI,aACF,KAAI;AAGF,UAF4C,MAAMA,uBAAe,mBAAmB,aAAa,EAE3E;UACf,OAAO;AACd;;;AAON,2BAAe"}

package/dist/server/actions/getSessionPayload.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"getSessionPayload.d.ts","sourceRoot":"","sources":["../../../src/server/actions/getSessionPayload.ts"],"names":[],"mappings":"AAMA,OAAuB,EAAC,mBAAmB,EAAC,MAAM,4BAA4B,CAAC;AAI/E;;;;;GAKG;AACH,QAAA,MAAM,iBAAiB,QAAa,OAAO,CAAC,mBAAmB,GAAG,SAAS,CAa1E,CAAC;AAEF,eAAe,iBAAiB,CAAC"}
+{"version":3,"file":"getSessionPayload.d.ts","sourceRoot":"","sources":["../../../src/server/actions/getSessionPayload.ts"],"names":[],"mappings":"AAOA,OAAuB,EAAC,mBAAmB,EAAC,MAAM,4BAA4B,CAAC;AAI/E;;;;;GAKG;AACH,QAAA,MAAM,iBAAiB,QAAa,OAAO,CAAC,mBAAmB,GAAG,SAAS,CAa1E,CAAC;AAEF,eAAe,iBAAiB,CAAC"}

package/dist/server/actions/getSessionPayload.js

@@ -1,6 +1,7 @@
 'use server';
 
 
+import { getChunkedCookie } from "../../utils/chunkedCookie.js";
 import SessionManager_default from "../../utils/SessionManager.js";
 import { cookies } from "next/headers";
 
@@ -12,7 +13,7 @@ import { cookies } from "next/headers";
 * @returns The session payload if valid JWT session exists, undefined otherwise
 */
 const getSessionPayload = async () => {
-	const sessionToken = (await cookies()).get(SessionManager_default.getSessionCookieName())?.value;
+	const sessionToken = getChunkedCookie(await cookies(), SessionManager_default.getSessionCookieName());
 	if (!sessionToken) return;
 	try {
 		return await SessionManager_default.verifySessionToken(sessionToken);

package/dist/server/actions/getSessionPayload.js.map

@@ -1 +1 @@
-{"version":3,"file":"getSessionPayload.js","names":["sessionToken: string | undefined","SessionManager"],"sources":["../../../src/server/actions/getSessionPayload.ts"],"sourcesContent":["// Copyright 2025 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\n'use server';\n\nimport {cookies} from 'next/headers';\nimport SessionManager, {SessionTokenPayload} from '../../utils/SessionManager';\n\ntype RequestCookies = Awaited<ReturnType<typeof cookies>>;\n\n/**\n * Get the session payload from JWT session cookie.\n * This includes user ID, session ID, scopes, and organization ID.\n *\n * @returns The session payload if valid JWT session exists, undefined otherwise\n */\nconst getSessionPayload = async (): Promise<SessionTokenPayload | undefined> => {\n  const cookieStore: RequestCookies = await cookies();\n\n  const sessionToken: string | undefined = cookieStore.get(SessionManager.getSessionCookieName())?.value;\n  if (!sessionToken) {\n    return undefined;\n  }\n\n  try {\n    return await SessionManager.verifySessionToken(sessionToken);\n  } catch {\n    return undefined;\n  }\n};\n\nexport default getSessionPayload;\n"],"mappings":";;;;;;;;;;;;;AAgBA,MAAM,oBAAoB,YAAsD;CAG9E,MAAMA,gBAF8B,MAAM,SAAS,EAEE,IAAIC,uBAAe,sBAAsB,CAAC,EAAE;AACjG,KAAI,CAAC,aACH;AAGF,KAAI;AACF,SAAO,MAAMA,uBAAe,mBAAmB,aAAa;SACtD;AACN;;;AAIJ,gCAAe"}
+{"version":3,"file":"getSessionPayload.js","names":["sessionToken: string | undefined","SessionManager"],"sources":["../../../src/server/actions/getSessionPayload.ts"],"sourcesContent":["// Copyright 2025 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\n'use server';\n\nimport {cookies} from 'next/headers';\nimport {getChunkedCookie} from '../../utils/chunkedCookie';\nimport SessionManager, {SessionTokenPayload} from '../../utils/SessionManager';\n\ntype RequestCookies = Awaited<ReturnType<typeof cookies>>;\n\n/**\n * Get the session payload from JWT session cookie.\n * This includes user ID, session ID, scopes, and organization ID.\n *\n * @returns The session payload if valid JWT session exists, undefined otherwise\n */\nconst getSessionPayload = async (): Promise<SessionTokenPayload | undefined> => {\n  const cookieStore: RequestCookies = await cookies();\n\n  const sessionToken: string | undefined = getChunkedCookie(cookieStore, SessionManager.getSessionCookieName());\n  if (!sessionToken) {\n    return undefined;\n  }\n\n  try {\n    return await SessionManager.verifySessionToken(sessionToken);\n  } catch {\n    return undefined;\n  }\n};\n\nexport default getSessionPayload;\n"],"mappings":";;;;;;;;;;;;;;AAiBA,MAAM,oBAAoB,YAAsD;CAG9E,MAAMA,eAAmC,iBAFL,MAAM,SAAS,EAEoBC,uBAAe,sBAAsB,CAAC;AAC7G,KAAI,CAAC,aACH;AAGF,KAAI;AACF,SAAO,MAAMA,uBAAe,mBAAmB,aAAa;SACtD;AACN;;;AAIJ,gCAAe"}

package/dist/server/actions/getUserSchemaAction.d.ts

@@ -0,0 +1,15 @@
+import { AttributeSchema } from '@thunderid/node';
+/**
+ * Server action to get the user attribute schema from `/users/me/meta`.
+ * Used to render profile fields dynamically (labels, required/regex validation)
+ * instead of falling back to raw, unlabeled attribute keys.
+ */
+declare const getUserSchemaAction: (sessionId: string) => Promise<{
+    data: {
+        userSchema: Record<string, AttributeSchema> | null;
+    };
+    error: string | null;
+    success: boolean;
+}>;
+export default getUserSchemaAction;
+//# sourceMappingURL=getUserSchemaAction.d.ts.map

package/dist/server/actions/getUserSchemaAction.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"getUserSchemaAction.d.ts","sourceRoot":"","sources":["../../../src/server/actions/getUserSchemaAction.ts"],"names":[],"mappings":"AAKA,OAAO,EAAC,eAAe,EAAC,MAAM,iBAAiB,CAAC;AAGhD;;;;GAIG;AACH,QAAA,MAAM,mBAAmB,GACvB,WAAW,MAAM,KAChB,OAAO,CAAC;IAAC,IAAI,EAAE;QAAC,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,GAAG,IAAI,CAAA;KAAC,CAAC;IAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAC,CAY9G,CAAC;AAEF,eAAe,mBAAmB,CAAC"}

package/dist/server/actions/getUserSchemaAction.js

@@ -0,0 +1,31 @@
+'use server';
+
+
+import getClient_default from "../getClient.js";
+
+//#region src/server/actions/getUserSchemaAction.ts
+/**
+* Server action to get the user attribute schema from `/users/me/meta`.
+* Used to render profile fields dynamically (labels, required/regex validation)
+* instead of falling back to raw, unlabeled attribute keys.
+*/
+const getUserSchemaAction = async (sessionId) => {
+	try {
+		return {
+			data: { userSchema: await getClient_default().getUserSchema(sessionId) },
+			error: null,
+			success: true
+		};
+	} catch (error) {
+		return {
+			data: { userSchema: null },
+			error: "Failed to get user schema",
+			success: false
+		};
+	}
+};
+var getUserSchemaAction_default = getUserSchemaAction;
+
+//#endregion
+export { getUserSchemaAction_default as default };
+//# sourceMappingURL=getUserSchemaAction.js.map

package/dist/server/actions/getUserSchemaAction.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"getUserSchemaAction.js","names":["getClient"],"sources":["../../../src/server/actions/getUserSchemaAction.ts"],"sourcesContent":["// Copyright 2025 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\n'use server';\n\nimport {AttributeSchema} from '@thunderid/node';\nimport getClient from '../getClient';\n\n/**\n * Server action to get the user attribute schema from `/users/me/meta`.\n * Used to render profile fields dynamically (labels, required/regex validation)\n * instead of falling back to raw, unlabeled attribute keys.\n */\nconst getUserSchemaAction = async (\n  sessionId: string,\n): Promise<{data: {userSchema: Record<string, AttributeSchema> | null}; error: string | null; success: boolean}> => {\n  try {\n    const client = getClient();\n    const userSchema: Record<string, AttributeSchema> | null = await client.getUserSchema(sessionId);\n    return {data: {userSchema}, error: null, success: true};\n  } catch (error) {\n    return {\n      data: {userSchema: null},\n      error: 'Failed to get user schema',\n      success: false,\n    };\n  }\n};\n\nexport default getUserSchemaAction;\n"],"mappings":";;;;;;;;;;;AAaA,MAAM,sBAAsB,OAC1B,cACkH;AAClH,KAAI;AAGF,SAAO;GAAC,MAAM,EAAC,YAD4C,MAD5CA,mBAAW,CAC8C,cAAc,UAAU,EACtE;GAAE,OAAO;GAAM,SAAS;GAAK;UAChD,OAAO;AACd,SAAO;GACL,MAAM,EAAC,YAAY,MAAK;GACxB,OAAO;GACP,SAAS;GACV;;;AAIL,kCAAe"}

package/dist/server/actions/handleOAuthCallbackAction.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"handleOAuthCallbackAction.d.ts","sourceRoot":"","sources":["../../../src/server/actions/handleOAuthCallbackAction.ts"],"names":[],"mappings":"AAcA;;;;;;;;;GASG;AACH,QAAA,MAAM,yBAAyB,GAC7B,MAAM,MAAM,EACZ,OAAO,MAAM,EACb,eAAe,MAAM,KACpB,OAAO,CAAC;IACT,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,OAAO,CAAC;CAClB,CAyHA,CAAC;AAEF,eAAe,yBAAyB,CAAC"}
+{"version":3,"file":"handleOAuthCallbackAction.d.ts","sourceRoot":"","sources":["../../../src/server/actions/handleOAuthCallbackAction.ts"],"names":[],"mappings":"AAeA;;;;;;;;;GASG;AACH,QAAA,MAAM,yBAAyB,GAC7B,MAAM,MAAM,EACZ,OAAO,MAAM,EACb,eAAe,MAAM,KACpB,OAAO,CAAC;IACT,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,OAAO,CAAC;CAClB,CA0HA,CAAC;AAEF,eAAe,yBAAyB,CAAC"}

package/dist/server/actions/handleOAuthCallbackAction.js

@@ -1,6 +1,7 @@
 'use server';
 
 
+import { setChunkedCookie } from "../../utils/chunkedCookie.js";
 import SessionManager_default from "../../utils/SessionManager.js";
 import getClient_default from "../getClient.js";
 import logger_default from "../../utils/logger.js";
@@ -59,7 +60,7 @@ const handleOAuthCallbackAction = async (code, state, sessionState) => {
 			const expiresIn = signInResult["expiresIn"];
 			const sessionCookieExpiryTime = SessionManager_default.resolveSessionCookieExpiry(config.sessionCookie?.expiryTime);
 			const sessionToken = await SessionManager_default.createSessionToken(accessToken, userIdFromToken, sessionId, scopes, expiresIn, refreshToken, organizationId);
-			cookieStore.set(SessionManager_default.getSessionCookieName(), sessionToken, SessionManager_default.getSessionCookieOptions(sessionCookieExpiryTime));
+			setChunkedCookie(cookieStore, SessionManager_default.getSessionCookieName(), sessionToken, SessionManager_default.getSessionCookieOptions(sessionCookieExpiryTime));
 			cookieStore.delete(SessionManager_default.getTempSessionCookieName());
 		} catch (error) {
 			logger_default.error(`[handleOAuthCallbackAction] Failed to create JWT session, continuing with legacy session:

package/dist/server/actions/handleOAuthCallbackAction.js.map

@@ -1 +1 @@
-{"version":3,"file":"handleOAuthCallbackAction.js","names":["getClient","cookieStore: RequestCookies","sessionId: string | undefined","tempSessionToken: string | undefined","SessionManager","signInResult: Record<string, unknown>","config: ThunderIDNextConfig","idToken: IdToken","accessToken: string","refreshToken: string","userIdFromToken: string","scopes: string","organizationId: string | undefined","expiresIn: number","sessionCookieExpiryTime: number","sessionToken: string"],"sources":["../../../src/server/actions/handleOAuthCallbackAction.ts"],"sourcesContent":["// Copyright 2025 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\n'use server';\n\nimport {IdToken} from '@thunderid/node';\nimport {cookies} from 'next/headers';\nimport {ThunderIDNextConfig} from '../../models/config';\nimport logger from '../../utils/logger';\nimport SessionManager from '../../utils/SessionManager';\nimport getClient from '../getClient';\n\ntype RequestCookies = Awaited<ReturnType<typeof cookies>>;\n\n/**\n * Server action to handle OAuth callback with authorization code.\n * This action processes the authorization code received from the OAuth provider\n * and exchanges it for tokens to complete the authentication flow.\n *\n * @param code - Authorization code from OAuth provider\n * @param state - State parameter from OAuth provider for CSRF protection\n * @param sessionState - Session state parameter from OAuth provider\n * @returns Promise that resolves with success status and optional error message\n */\nconst handleOAuthCallbackAction = async (\n  code: string,\n  state: string,\n  sessionState?: string,\n): Promise<{\n  error?: string;\n  redirectUrl?: string;\n  success: boolean;\n}> => {\n  try {\n    if (!code || !state) {\n      return {\n        error: 'Missing required OAuth parameters: code and state are required',\n        success: false,\n      };\n    }\n\n    const thunderIDClient = getClient();\n\n    if (!thunderIDClient.isInitialized) {\n      return {\n        error: 'ThunderID client is not initialized',\n        success: false,\n      };\n    }\n\n    const cookieStore: RequestCookies = await cookies();\n    let sessionId: string | undefined;\n\n    const tempSessionToken: string | undefined = cookieStore.get(SessionManager.getTempSessionCookieName())?.value;\n\n    if (tempSessionToken) {\n      try {\n        const tempSession: {sessionId: string} = await SessionManager.verifyTempSession(tempSessionToken);\n        sessionId = tempSession.sessionId;\n      } catch {\n        logger.error(\n          '[handleOAuthCallbackAction] Invalid temporary session token, falling back to session ID from cookies.',\n        );\n      }\n    }\n\n    if (!sessionId) {\n      logger.error('[handleOAuthCallbackAction] No session ID found in cookies or temporary session token.');\n\n      return {\n        error: 'No session found. Please start the authentication flow again.',\n        success: false,\n      };\n    }\n\n    // Exchange the authorization code for tokens\n    const signInResult: Record<string, unknown> = await thunderIDClient.signIn(\n      {\n        code,\n        session_state: sessionState,\n        state,\n      } as any,\n      {},\n      sessionId,\n    );\n\n    const config: ThunderIDNextConfig = await thunderIDClient.getConfiguration();\n\n    if (signInResult) {\n      try {\n        const idToken: IdToken = await thunderIDClient.getDecodedIdToken(\n          sessionId,\n          (signInResult['id_token'] || signInResult['idToken']) as string,\n        );\n        const accessToken: string = (signInResult['accessToken'] || signInResult['access_token']) as string;\n        const refreshToken: string = (signInResult['refreshToken'] as string | undefined) ?? '';\n        const userIdFromToken: string = (idToken.sub || signInResult['sub'] || sessionId) as string;\n        const scopes: string = signInResult['scope'] as string;\n        const organizationId: string | undefined = (idToken['user_org'] || idToken['organization_id']) as\n          | string\n          | undefined;\n        const expiresIn: number = signInResult['expiresIn'] as number;\n        const sessionCookieExpiryTime: number = SessionManager.resolveSessionCookieExpiry(\n          config.sessionCookie?.expiryTime,\n        );\n\n        const sessionToken: string = await SessionManager.createSessionToken(\n          accessToken,\n          userIdFromToken,\n          sessionId,\n          scopes,\n          expiresIn,\n          refreshToken,\n          organizationId,\n        );\n\n        cookieStore.set(\n          SessionManager.getSessionCookieName(),\n          sessionToken,\n          SessionManager.getSessionCookieOptions(sessionCookieExpiryTime),\n        );\n\n        cookieStore.delete(SessionManager.getTempSessionCookieName());\n      } catch (error) {\n        logger.error(\n          `[handleOAuthCallbackAction] Failed to create JWT session, continuing with legacy session:\n          ${typeof error === 'string' ? error : JSON.stringify(error)}`,\n        );\n      }\n    }\n\n    const afterSignInUrl: string = config.afterSignInUrl || '/';\n\n    return {\n      redirectUrl: afterSignInUrl,\n      success: true,\n    };\n  } catch (error) {\n    let errorMessage = 'Authentication failed';\n\n    if (error instanceof Error) {\n      errorMessage = error.message;\n    } else if (error && typeof error === 'object' && 'message' in error) {\n      errorMessage = String((error as {message: unknown}).message);\n    } else if (typeof error === 'string') {\n      errorMessage = error;\n    }\n\n    return {\n      error: errorMessage,\n      success: false,\n    };\n  }\n};\n\nexport default handleOAuthCallbackAction;\n"],"mappings":";;;;;;;;;;;;;;;;;;;AAwBA,MAAM,4BAA4B,OAChC,MACA,OACA,iBAKI;AACJ,KAAI;AACF,MAAI,CAAC,QAAQ,CAAC,MACZ,QAAO;GACL,OAAO;GACP,SAAS;GACV;EAGH,MAAM,kBAAkBA,mBAAW;AAEnC,MAAI,CAAC,gBAAgB,cACnB,QAAO;GACL,OAAO;GACP,SAAS;GACV;EAGH,MAAMC,cAA8B,MAAM,SAAS;EACnD,IAAIC;EAEJ,MAAMC,mBAAuC,YAAY,IAAIC,uBAAe,0BAA0B,CAAC,EAAE;AAEzG,MAAI,iBACF,KAAI;AAEF,gBADyC,MAAMA,uBAAe,kBAAkB,iBAAiB,EACzE;UAClB;AACN,kBAAO,MACL,wGACD;;AAIL,MAAI,CAAC,WAAW;AACd,kBAAO,MAAM,yFAAyF;AAEtG,UAAO;IACL,OAAO;IACP,SAAS;IACV;;EAIH,MAAMC,eAAwC,MAAM,gBAAgB,OAClE;GACE;GACA,eAAe;GACf;GACD,EACD,EAAE,EACF,UACD;EAED,MAAMC,SAA8B,MAAM,gBAAgB,kBAAkB;AAE5E,MAAI,aACF,KAAI;GACF,MAAMC,UAAmB,MAAM,gBAAgB,kBAC7C,WACC,aAAa,eAAe,aAAa,WAC3C;GACD,MAAMC,cAAuB,aAAa,kBAAkB,aAAa;GACzE,MAAMC,eAAwB,aAAa,mBAA0C;GACrF,MAAMC,kBAA2B,QAAQ,OAAO,aAAa,UAAU;GACvE,MAAMC,SAAiB,aAAa;GACpC,MAAMC,iBAAsC,QAAQ,eAAe,QAAQ;GAG3E,MAAMC,YAAoB,aAAa;GACvC,MAAMC,0BAAkCV,uBAAe,2BACrD,OAAO,eAAe,WACvB;GAED,MAAMW,eAAuB,MAAMX,uBAAe,mBAChD,aACA,iBACA,WACA,QACA,WACA,cACA,eACD;AAED,eAAY,IACVA,uBAAe,sBAAsB,EACrC,cACAA,uBAAe,wBAAwB,wBAAwB,CAChE;AAED,eAAY,OAAOA,uBAAe,0BAA0B,CAAC;WACtD,OAAO;AACd,kBAAO,MACL;YACE,OAAO,UAAU,WAAW,QAAQ,KAAK,UAAU,MAAM,GAC5D;;AAML,SAAO;GACL,aAH6B,OAAO,kBAAkB;GAItD,SAAS;GACV;UACM,OAAO;EACd,IAAI,eAAe;AAEnB,MAAI,iBAAiB,MACnB,gBAAe,MAAM;WACZ,SAAS,OAAO,UAAU,YAAY,aAAa,MAC5D,gBAAe,OAAQ,MAA6B,QAAQ;WACnD,OAAO,UAAU,SAC1B,gBAAe;AAGjB,SAAO;GACL,OAAO;GACP,SAAS;GACV;;;AAIL,wCAAe"}
+{"version":3,"file":"handleOAuthCallbackAction.js","names":["getClient","cookieStore: RequestCookies","sessionId: string | undefined","tempSessionToken: string | undefined","SessionManager","signInResult: Record<string, unknown>","config: ThunderIDNextConfig","idToken: IdToken","accessToken: string","refreshToken: string","userIdFromToken: string","scopes: string","organizationId: string | undefined","expiresIn: number","sessionCookieExpiryTime: number","sessionToken: string"],"sources":["../../../src/server/actions/handleOAuthCallbackAction.ts"],"sourcesContent":["// Copyright 2025 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\n'use server';\n\nimport {IdToken} from '@thunderid/node';\nimport {cookies} from 'next/headers';\nimport {ThunderIDNextConfig} from '../../models/config';\nimport {setChunkedCookie} from '../../utils/chunkedCookie';\nimport logger from '../../utils/logger';\nimport SessionManager from '../../utils/SessionManager';\nimport getClient from '../getClient';\n\ntype RequestCookies = Awaited<ReturnType<typeof cookies>>;\n\n/**\n * Server action to handle OAuth callback with authorization code.\n * This action processes the authorization code received from the OAuth provider\n * and exchanges it for tokens to complete the authentication flow.\n *\n * @param code - Authorization code from OAuth provider\n * @param state - State parameter from OAuth provider for CSRF protection\n * @param sessionState - Session state parameter from OAuth provider\n * @returns Promise that resolves with success status and optional error message\n */\nconst handleOAuthCallbackAction = async (\n  code: string,\n  state: string,\n  sessionState?: string,\n): Promise<{\n  error?: string;\n  redirectUrl?: string;\n  success: boolean;\n}> => {\n  try {\n    if (!code || !state) {\n      return {\n        error: 'Missing required OAuth parameters: code and state are required',\n        success: false,\n      };\n    }\n\n    const thunderIDClient = getClient();\n\n    if (!thunderIDClient.isInitialized) {\n      return {\n        error: 'ThunderID client is not initialized',\n        success: false,\n      };\n    }\n\n    const cookieStore: RequestCookies = await cookies();\n    let sessionId: string | undefined;\n\n    const tempSessionToken: string | undefined = cookieStore.get(SessionManager.getTempSessionCookieName())?.value;\n\n    if (tempSessionToken) {\n      try {\n        const tempSession: {sessionId: string} = await SessionManager.verifyTempSession(tempSessionToken);\n        sessionId = tempSession.sessionId;\n      } catch {\n        logger.error(\n          '[handleOAuthCallbackAction] Invalid temporary session token, falling back to session ID from cookies.',\n        );\n      }\n    }\n\n    if (!sessionId) {\n      logger.error('[handleOAuthCallbackAction] No session ID found in cookies or temporary session token.');\n\n      return {\n        error: 'No session found. Please start the authentication flow again.',\n        success: false,\n      };\n    }\n\n    // Exchange the authorization code for tokens\n    const signInResult: Record<string, unknown> = await thunderIDClient.signIn(\n      {\n        code,\n        session_state: sessionState,\n        state,\n      } as any,\n      {},\n      sessionId,\n    );\n\n    const config: ThunderIDNextConfig = await thunderIDClient.getConfiguration();\n\n    if (signInResult) {\n      try {\n        const idToken: IdToken = await thunderIDClient.getDecodedIdToken(\n          sessionId,\n          (signInResult['id_token'] || signInResult['idToken']) as string,\n        );\n        const accessToken: string = (signInResult['accessToken'] || signInResult['access_token']) as string;\n        const refreshToken: string = (signInResult['refreshToken'] as string | undefined) ?? '';\n        const userIdFromToken: string = (idToken.sub || signInResult['sub'] || sessionId) as string;\n        const scopes: string = signInResult['scope'] as string;\n        const organizationId: string | undefined = (idToken['user_org'] || idToken['organization_id']) as\n          | string\n          | undefined;\n        const expiresIn: number = signInResult['expiresIn'] as number;\n        const sessionCookieExpiryTime: number = SessionManager.resolveSessionCookieExpiry(\n          config.sessionCookie?.expiryTime,\n        );\n\n        const sessionToken: string = await SessionManager.createSessionToken(\n          accessToken,\n          userIdFromToken,\n          sessionId,\n          scopes,\n          expiresIn,\n          refreshToken,\n          organizationId,\n        );\n\n        setChunkedCookie(\n          cookieStore,\n          SessionManager.getSessionCookieName(),\n          sessionToken,\n          SessionManager.getSessionCookieOptions(sessionCookieExpiryTime),\n        );\n\n        cookieStore.delete(SessionManager.getTempSessionCookieName());\n      } catch (error) {\n        logger.error(\n          `[handleOAuthCallbackAction] Failed to create JWT session, continuing with legacy session:\n          ${typeof error === 'string' ? error : JSON.stringify(error)}`,\n        );\n      }\n    }\n\n    const afterSignInUrl: string = config.afterSignInUrl || '/';\n\n    return {\n      redirectUrl: afterSignInUrl,\n      success: true,\n    };\n  } catch (error) {\n    let errorMessage = 'Authentication failed';\n\n    if (error instanceof Error) {\n      errorMessage = error.message;\n    } else if (error && typeof error === 'object' && 'message' in error) {\n      errorMessage = String((error as {message: unknown}).message);\n    } else if (typeof error === 'string') {\n      errorMessage = error;\n    }\n\n    return {\n      error: errorMessage,\n      success: false,\n    };\n  }\n};\n\nexport default handleOAuthCallbackAction;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAyBA,MAAM,4BAA4B,OAChC,MACA,OACA,iBAKI;AACJ,KAAI;AACF,MAAI,CAAC,QAAQ,CAAC,MACZ,QAAO;GACL,OAAO;GACP,SAAS;GACV;EAGH,MAAM,kBAAkBA,mBAAW;AAEnC,MAAI,CAAC,gBAAgB,cACnB,QAAO;GACL,OAAO;GACP,SAAS;GACV;EAGH,MAAMC,cAA8B,MAAM,SAAS;EACnD,IAAIC;EAEJ,MAAMC,mBAAuC,YAAY,IAAIC,uBAAe,0BAA0B,CAAC,EAAE;AAEzG,MAAI,iBACF,KAAI;AAEF,gBADyC,MAAMA,uBAAe,kBAAkB,iBAAiB,EACzE;UAClB;AACN,kBAAO,MACL,wGACD;;AAIL,MAAI,CAAC,WAAW;AACd,kBAAO,MAAM,yFAAyF;AAEtG,UAAO;IACL,OAAO;IACP,SAAS;IACV;;EAIH,MAAMC,eAAwC,MAAM,gBAAgB,OAClE;GACE;GACA,eAAe;GACf;GACD,EACD,EAAE,EACF,UACD;EAED,MAAMC,SAA8B,MAAM,gBAAgB,kBAAkB;AAE5E,MAAI,aACF,KAAI;GACF,MAAMC,UAAmB,MAAM,gBAAgB,kBAC7C,WACC,aAAa,eAAe,aAAa,WAC3C;GACD,MAAMC,cAAuB,aAAa,kBAAkB,aAAa;GACzE,MAAMC,eAAwB,aAAa,mBAA0C;GACrF,MAAMC,kBAA2B,QAAQ,OAAO,aAAa,UAAU;GACvE,MAAMC,SAAiB,aAAa;GACpC,MAAMC,iBAAsC,QAAQ,eAAe,QAAQ;GAG3E,MAAMC,YAAoB,aAAa;GACvC,MAAMC,0BAAkCV,uBAAe,2BACrD,OAAO,eAAe,WACvB;GAED,MAAMW,eAAuB,MAAMX,uBAAe,mBAChD,aACA,iBACA,WACA,QACA,WACA,cACA,eACD;AAED,oBACE,aACAA,uBAAe,sBAAsB,EACrC,cACAA,uBAAe,wBAAwB,wBAAwB,CAChE;AAED,eAAY,OAAOA,uBAAe,0BAA0B,CAAC;WACtD,OAAO;AACd,kBAAO,MACL;YACE,OAAO,UAAU,WAAW,QAAQ,KAAK,UAAU,MAAM,GAC5D;;AAML,SAAO;GACL,aAH6B,OAAO,kBAAkB;GAItD,SAAS;GACV;UACM,OAAO;EACd,IAAI,eAAe;AAEnB,MAAI,iBAAiB,MACnB,gBAAe,MAAM;WACZ,SAAS,OAAO,UAAU,YAAY,aAAa,MAC5D,gBAAe,OAAQ,MAA6B,QAAQ;WACnD,OAAO,UAAU,SAC1B,gBAAe;AAGjB,SAAO;GACL,OAAO;GACP,SAAS;GACV;;;AAIL,wCAAe"}

package/dist/server/actions/refreshToken.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"refreshToken.d.ts","sourceRoot":"","sources":["../../../src/server/actions/refreshToken.ts"],"names":[],"mappings":"AAcA;;;;;;;;;;GAUG;AACH,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;;;;;GAUG;AACH,QAAA,MAAM,YAAY,QAAa,OAAO,CAAC,aAAa,CAmEnD,CAAC;AAEF,eAAe,YAAY,CAAC"}
+{"version":3,"file":"refreshToken.d.ts","sourceRoot":"","sources":["../../../src/server/actions/refreshToken.ts"],"names":[],"mappings":"AAeA;;;;;;;;;;GAUG;AACH,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;;;;;GAUG;AACH,QAAA,MAAM,YAAY,QAAa,OAAO,CAAC,aAAa,CAoEnD,CAAC;AAEF,eAAe,YAAY,CAAC"}

package/dist/server/actions/refreshToken.js

@@ -1,6 +1,7 @@
 'use server';
 
 
+import { deleteChunkedCookie, getChunkedCookie, setChunkedCookie } from "../../utils/chunkedCookie.js";
 import SessionManager_default from "../../utils/SessionManager.js";
 import getClient_default from "../getClient.js";
 import handleRefreshToken_default from "../../utils/handleRefreshToken.js";
@@ -22,7 +23,7 @@ import { cookies } from "next/headers";
 const refreshToken = async () => {
 	try {
 		const cookieStore = await cookies();
-		const sessionToken = cookieStore.get(SessionManager_default.getSessionCookieName())?.value;
+		const sessionToken = getChunkedCookie(cookieStore, SessionManager_default.getSessionCookieName());
 		if (!sessionToken) throw new ThunderIDAPIError("No active session found. User must be signed in to refresh the token.", "refreshToken-ServerActionError-002", "nextjs", 401);
 		const sessionPayload = await SessionManager_default.verifySessionTokenForRefresh(sessionToken);
 		const config = await getClient_default().getConfiguration();
@@ -33,7 +34,7 @@ const refreshToken = async () => {
 			sessionCookie: config.sessionCookie
 		});
 		try {
-			cookieStore.set(SessionManager_default.getSessionCookieName(), result.newSessionToken, SessionManager_default.getSessionCookieOptions(result.sessionCookieExpiryTime));
+			setChunkedCookie(cookieStore, SessionManager_default.getSessionCookieName(), result.newSessionToken, SessionManager_default.getSessionCookieOptions(result.sessionCookieExpiryTime));
 		} catch {
 			logger.warn("[refreshToken] Could not write session cookie — called from SSR rendering context.");
 		}
@@ -45,7 +46,7 @@ const refreshToken = async () => {
 		return { expiresAt };
 	} catch (error) {
 		try {
-			(await cookies()).delete(SessionManager_default.getSessionCookieName());
+			deleteChunkedCookie(await cookies(), SessionManager_default.getSessionCookieName());
 			logger.debug("[refreshToken] Cleared session cookie after refresh failure.");
 		} catch {}
 		throw new ThunderIDAPIError(`Failed to refresh the session: ${error instanceof Error ? error.message : JSON.stringify(error)}`, "refreshToken-ServerActionError-001", "nextjs", error instanceof ThunderIDAPIError ? error.statusCode : void 0);

package/dist/server/actions/refreshToken.js.map

@@ -1 +1 @@
-{"version":3,"file":"refreshToken.js","names":["cookieStore: RequestCookies","sessionToken: string | undefined","SessionManager","sessionPayload: SessionTokenPayload","config: ThunderIDNextConfig","getClient","result: HandleRefreshTokenResult","handleRefreshToken","rawExpiresIn: string | undefined","expiresInSeconds: number","expiresAt: number"],"sources":["../../../src/server/actions/refreshToken.ts"],"sourcesContent":["// Copyright 2025 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\n'use server';\n\nimport {ThunderIDAPIError, logger} from '@thunderid/node';\nimport {cookies} from 'next/headers';\nimport {ThunderIDNextConfig} from '../../models/config';\nimport handleRefreshToken, {HandleRefreshTokenResult} from '../../utils/handleRefreshToken';\nimport SessionManager, {SessionTokenPayload} from '../../utils/SessionManager';\nimport getClient from '../getClient';\n\ntype RequestCookies = Awaited<ReturnType<typeof cookies>>;\n\n/**\n * Client-safe result of a token refresh.\n *\n * Intentionally omits accessToken, refreshToken, idToken, and scopes — those stay\n * server-side in the HttpOnly session cookie. Returning tokens from a Server Action\n * serializes them into browser memory, defeating the HttpOnly boundary and exposing\n * them to XSS, browser extensions, and error-tracking SDKs.\n *\n * `expiresAt` is epoch seconds for the new access token; the client uses it to\n * schedule the next refresh.\n */\nexport interface RefreshResult {\n  expiresAt: number;\n}\n\n/**\n * Server action to refresh the access token using the stored refresh token.\n * Exchanges the refresh token for a new token set and updates the session cookie.\n *\n * Delegates the HTTP exchange to handleRefreshToken so the same logic is shared\n * with the middleware token refresh path.\n *\n * Called from the client side (e.g. ThunderIDClientProvider refreshOnMount) where\n * Next.js allows cookie mutation. When invoked during SSR rendering the cookie\n * write is silently skipped and a warning is logged.\n */\nconst refreshToken = async (): Promise<RefreshResult> => {\n  try {\n    const cookieStore: RequestCookies = await cookies();\n    const sessionToken: string | undefined = cookieStore.get(SessionManager.getSessionCookieName())?.value;\n\n    if (!sessionToken) {\n      throw new ThunderIDAPIError(\n        'No active session found. User must be signed in to refresh the token.',\n        'refreshToken-ServerActionError-002',\n        'nextjs',\n        401,\n      );\n    }\n\n    const sessionPayload: SessionTokenPayload = await SessionManager.verifySessionTokenForRefresh(sessionToken);\n    const client = getClient();\n    const config: ThunderIDNextConfig = await client.getConfiguration();\n\n    const result: HandleRefreshTokenResult = await handleRefreshToken(sessionPayload, {\n      baseUrl: config.baseUrl ?? '',\n      clientId: config.clientId ?? '',\n      clientSecret: config.clientSecret ?? '',\n      sessionCookie: config.sessionCookie,\n    });\n\n    try {\n      cookieStore.set(\n        SessionManager.getSessionCookieName(),\n        result.newSessionToken,\n        SessionManager.getSessionCookieOptions(result.sessionCookieExpiryTime),\n      );\n    } catch {\n      // cookies().set() is only permitted inside a Server Action invoked from the client\n      // or a Route Handler. When this action is called during SSR rendering the write\n      // is blocked by Next.js. The middleware refresh path handles that case instead.\n      logger.warn('[refreshToken] Could not write session cookie — called from SSR rendering context.');\n    }\n\n    const rawExpiresIn: string | undefined = result.tokenResponse.expiresIn;\n    const expiresInSeconds: number = parseInt(rawExpiresIn ?? '', 10);\n    if (Number.isNaN(expiresInSeconds)) {\n      throw new Error(`[refreshToken] Invalid expiresIn value received: ${rawExpiresIn}`);\n    }\n    const expiresAt: number = Math.floor(Date.now() / 1000) + expiresInSeconds;\n\n    logger.debug('[refreshToken] Token refresh succeeded.');\n    return {expiresAt};\n  } catch (error) {\n    // Clear the dead session cookie before throwing so the browser is not left\n    // holding a stale credential. This is best-effort — if called from an SSR\n    // rendering context Next.js blocks cookie mutation; the middleware cleanup\n    // path covers that case on the next request.\n    try {\n      const cookieStore: RequestCookies = await cookies();\n      cookieStore.delete(SessionManager.getSessionCookieName());\n      logger.debug('[refreshToken] Cleared session cookie after refresh failure.');\n    } catch {\n      // Intentionally swallowed — middleware handles cleanup when mutation is blocked.\n    }\n\n    throw new ThunderIDAPIError(\n      `Failed to refresh the session: ${error instanceof Error ? error.message : JSON.stringify(error)}`,\n      'refreshToken-ServerActionError-001',\n      'nextjs',\n      error instanceof ThunderIDAPIError ? error.statusCode : undefined,\n    );\n  }\n};\n\nexport default refreshToken;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;AAwCA,MAAM,eAAe,YAAoC;AACvD,KAAI;EACF,MAAMA,cAA8B,MAAM,SAAS;EACnD,MAAMC,eAAmC,YAAY,IAAIC,uBAAe,sBAAsB,CAAC,EAAE;AAEjG,MAAI,CAAC,aACH,OAAM,IAAI,kBACR,yEACA,sCACA,UACA,IACD;EAGH,MAAMC,iBAAsC,MAAMD,uBAAe,6BAA6B,aAAa;EAE3G,MAAME,SAA8B,MADrBC,mBAAW,CACuB,kBAAkB;EAEnE,MAAMC,SAAmC,MAAMC,2BAAmB,gBAAgB;GAChF,SAAS,OAAO,WAAW;GAC3B,UAAU,OAAO,YAAY;GAC7B,cAAc,OAAO,gBAAgB;GACrC,eAAe,OAAO;GACvB,CAAC;AAEF,MAAI;AACF,eAAY,IACVL,uBAAe,sBAAsB,EACrC,OAAO,iBACPA,uBAAe,wBAAwB,OAAO,wBAAwB,CACvE;UACK;AAIN,UAAO,KAAK,qFAAqF;;EAGnG,MAAMM,eAAmC,OAAO,cAAc;EAC9D,MAAMC,mBAA2B,SAAS,gBAAgB,IAAI,GAAG;AACjE,MAAI,OAAO,MAAM,iBAAiB,CAChC,OAAM,IAAI,MAAM,oDAAoD,eAAe;EAErF,MAAMC,YAAoB,KAAK,MAAM,KAAK,KAAK,GAAG,IAAK,GAAG;AAE1D,SAAO,MAAM,0CAA0C;AACvD,SAAO,EAAC,WAAU;UACX,OAAO;AAKd,MAAI;AAEF,IADoC,MAAM,SAAS,EACvC,OAAOR,uBAAe,sBAAsB,CAAC;AACzD,UAAO,MAAM,+DAA+D;UACtE;AAIR,QAAM,IAAI,kBACR,kCAAkC,iBAAiB,QAAQ,MAAM,UAAU,KAAK,UAAU,MAAM,IAChG,sCACA,UACA,iBAAiB,oBAAoB,MAAM,aAAa,OACzD;;;AAIL,2BAAe"}
+{"version":3,"file":"refreshToken.js","names":["cookieStore: RequestCookies","sessionToken: string | undefined","SessionManager","sessionPayload: SessionTokenPayload","config: ThunderIDNextConfig","getClient","result: HandleRefreshTokenResult","handleRefreshToken","rawExpiresIn: string | undefined","expiresInSeconds: number","expiresAt: number"],"sources":["../../../src/server/actions/refreshToken.ts"],"sourcesContent":["// Copyright 2025 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\n'use server';\n\nimport {ThunderIDAPIError, logger} from '@thunderid/node';\nimport {cookies} from 'next/headers';\nimport {ThunderIDNextConfig} from '../../models/config';\nimport {deleteChunkedCookie, getChunkedCookie, setChunkedCookie} from '../../utils/chunkedCookie';\nimport handleRefreshToken, {HandleRefreshTokenResult} from '../../utils/handleRefreshToken';\nimport SessionManager, {SessionTokenPayload} from '../../utils/SessionManager';\nimport getClient from '../getClient';\n\ntype RequestCookies = Awaited<ReturnType<typeof cookies>>;\n\n/**\n * Client-safe result of a token refresh.\n *\n * Intentionally omits accessToken, refreshToken, idToken, and scopes — those stay\n * server-side in the HttpOnly session cookie. Returning tokens from a Server Action\n * serializes them into browser memory, defeating the HttpOnly boundary and exposing\n * them to XSS, browser extensions, and error-tracking SDKs.\n *\n * `expiresAt` is epoch seconds for the new access token; the client uses it to\n * schedule the next refresh.\n */\nexport interface RefreshResult {\n  expiresAt: number;\n}\n\n/**\n * Server action to refresh the access token using the stored refresh token.\n * Exchanges the refresh token for a new token set and updates the session cookie.\n *\n * Delegates the HTTP exchange to handleRefreshToken so the same logic is shared\n * with the middleware token refresh path.\n *\n * Called from the client side (e.g. ThunderIDClientProvider refreshOnMount) where\n * Next.js allows cookie mutation. When invoked during SSR rendering the cookie\n * write is silently skipped and a warning is logged.\n */\nconst refreshToken = async (): Promise<RefreshResult> => {\n  try {\n    const cookieStore: RequestCookies = await cookies();\n    const sessionToken: string | undefined = getChunkedCookie(cookieStore, SessionManager.getSessionCookieName());\n\n    if (!sessionToken) {\n      throw new ThunderIDAPIError(\n        'No active session found. User must be signed in to refresh the token.',\n        'refreshToken-ServerActionError-002',\n        'nextjs',\n        401,\n      );\n    }\n\n    const sessionPayload: SessionTokenPayload = await SessionManager.verifySessionTokenForRefresh(sessionToken);\n    const client = getClient();\n    const config: ThunderIDNextConfig = await client.getConfiguration();\n\n    const result: HandleRefreshTokenResult = await handleRefreshToken(sessionPayload, {\n      baseUrl: config.baseUrl ?? '',\n      clientId: config.clientId ?? '',\n      clientSecret: config.clientSecret ?? '',\n      sessionCookie: config.sessionCookie,\n    });\n\n    try {\n      setChunkedCookie(\n        cookieStore,\n        SessionManager.getSessionCookieName(),\n        result.newSessionToken,\n        SessionManager.getSessionCookieOptions(result.sessionCookieExpiryTime),\n      );\n    } catch {\n      // cookies().set() is only permitted inside a Server Action invoked from the client\n      // or a Route Handler. When this action is called during SSR rendering the write\n      // is blocked by Next.js. The middleware refresh path handles that case instead.\n      logger.warn('[refreshToken] Could not write session cookie — called from SSR rendering context.');\n    }\n\n    const rawExpiresIn: string | undefined = result.tokenResponse.expiresIn;\n    const expiresInSeconds: number = parseInt(rawExpiresIn ?? '', 10);\n    if (Number.isNaN(expiresInSeconds)) {\n      throw new Error(`[refreshToken] Invalid expiresIn value received: ${rawExpiresIn}`);\n    }\n    const expiresAt: number = Math.floor(Date.now() / 1000) + expiresInSeconds;\n\n    logger.debug('[refreshToken] Token refresh succeeded.');\n    return {expiresAt};\n  } catch (error) {\n    // Clear the dead session cookie before throwing so the browser is not left\n    // holding a stale credential. This is best-effort — if called from an SSR\n    // rendering context Next.js blocks cookie mutation; the middleware cleanup\n    // path covers that case on the next request.\n    try {\n      const cookieStore: RequestCookies = await cookies();\n      deleteChunkedCookie(cookieStore, SessionManager.getSessionCookieName());\n      logger.debug('[refreshToken] Cleared session cookie after refresh failure.');\n    } catch {\n      // Intentionally swallowed — middleware handles cleanup when mutation is blocked.\n    }\n\n    throw new ThunderIDAPIError(\n      `Failed to refresh the session: ${error instanceof Error ? error.message : JSON.stringify(error)}`,\n      'refreshToken-ServerActionError-001',\n      'nextjs',\n      error instanceof ThunderIDAPIError ? error.statusCode : undefined,\n    );\n  }\n};\n\nexport default refreshToken;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAyCA,MAAM,eAAe,YAAoC;AACvD,KAAI;EACF,MAAMA,cAA8B,MAAM,SAAS;EACnD,MAAMC,eAAmC,iBAAiB,aAAaC,uBAAe,sBAAsB,CAAC;AAE7G,MAAI,CAAC,aACH,OAAM,IAAI,kBACR,yEACA,sCACA,UACA,IACD;EAGH,MAAMC,iBAAsC,MAAMD,uBAAe,6BAA6B,aAAa;EAE3G,MAAME,SAA8B,MADrBC,mBAAW,CACuB,kBAAkB;EAEnE,MAAMC,SAAmC,MAAMC,2BAAmB,gBAAgB;GAChF,SAAS,OAAO,WAAW;GAC3B,UAAU,OAAO,YAAY;GAC7B,cAAc,OAAO,gBAAgB;GACrC,eAAe,OAAO;GACvB,CAAC;AAEF,MAAI;AACF,oBACE,aACAL,uBAAe,sBAAsB,EACrC,OAAO,iBACPA,uBAAe,wBAAwB,OAAO,wBAAwB,CACvE;UACK;AAIN,UAAO,KAAK,qFAAqF;;EAGnG,MAAMM,eAAmC,OAAO,cAAc;EAC9D,MAAMC,mBAA2B,SAAS,gBAAgB,IAAI,GAAG;AACjE,MAAI,OAAO,MAAM,iBAAiB,CAChC,OAAM,IAAI,MAAM,oDAAoD,eAAe;EAErF,MAAMC,YAAoB,KAAK,MAAM,KAAK,KAAK,GAAG,IAAK,GAAG;AAE1D,SAAO,MAAM,0CAA0C;AACvD,SAAO,EAAC,WAAU;UACX,OAAO;AAKd,MAAI;AAEF,uBADoC,MAAM,SAAS,EAClBR,uBAAe,sBAAsB,CAAC;AACvE,UAAO,MAAM,+DAA+D;UACtE;AAIR,QAAM,IAAI,kBACR,kCAAkC,iBAAiB,QAAQ,MAAM,UAAU,KAAK,UAAU,MAAM,IAChG,sCACA,UACA,iBAAiB,oBAAoB,MAAM,aAAa,OACzD;;;AAIL,2BAAe"}

package/dist/server/actions/signInAction.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"signInAction.d.ts","sourceRoot":"","sources":["../../../src/server/actions/signInAction.ts"],"names":[],"mappings":"AAKA,OAAO,EAGL,gCAAgC,EAGjC,MAAM,iBAAiB,CAAC;AASzB;;;;;;;GAOG;AACH,QAAA,MAAM,YAAY,GAChB,UAAU,GAAG,EACb,UAAU,gCAAgC,KACzC,OAAO,CAAC;IACT,IAAI,CAAC,EACD;QACE,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,GACD,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC5B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,OAAO,CAAC;CAClB,CA6GA,CAAC;AAEF,eAAe,YAAY,CAAC"}
+{"version":3,"file":"signInAction.d.ts","sourceRoot":"","sources":["../../../src/server/actions/signInAction.ts"],"names":[],"mappings":"AAKA,OAAO,EAGL,gCAAgC,EAGjC,MAAM,iBAAiB,CAAC;AAUzB;;;;;;;GAOG;AACH,QAAA,MAAM,YAAY,GAChB,UAAU,GAAG,EACb,UAAU,gCAAgC,KACzC,OAAO,CAAC;IACT,IAAI,CAAC,EACD;QACE,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,GACD,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC5B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,OAAO,CAAC;CAClB,CAiHA,CAAC;AAEF,eAAe,YAAY,CAAC"}

package/dist/server/actions/signInAction.js

@@ -1,6 +1,7 @@
 'use server';
 
 
+import { getChunkedCookie, setChunkedCookie } from "../../utils/chunkedCookie.js";
 import SessionManager_default from "../../utils/SessionManager.js";
 import getClient_default from "../getClient.js";
 import logger_default from "../../utils/logger.js";
@@ -21,7 +22,7 @@ const signInAction = async (payload, request) => {
 		const client = getClient_default();
 		const cookieStore = await cookies();
 		let sessionId;
-		const existingSessionToken = cookieStore.get(SessionManager_default.getSessionCookieName())?.value;
+		const existingSessionToken = getChunkedCookie(cookieStore, SessionManager_default.getSessionCookieName());
 		if (existingSessionToken) try {
 			sessionId = (await SessionManager_default.verifySessionToken(existingSessionToken)).sessionId;
 		} catch {}
@@ -56,7 +57,7 @@ const signInAction = async (payload, request) => {
 			const config = await client.getConfiguration();
 			const sessionCookieExpiryTime = SessionManager_default.resolveSessionCookieExpiry(config.sessionCookie?.expiryTime);
 			const sessionToken = await SessionManager_default.createSessionToken(response.assertion, userIdFromToken, sessionId, scopes, expiresIn, "", organizationId);
-			cookieStore.set(SessionManager_default.getSessionCookieName(), sessionToken, SessionManager_default.getSessionCookieOptions(sessionCookieExpiryTime));
+			setChunkedCookie(cookieStore, SessionManager_default.getSessionCookieName(), sessionToken, SessionManager_default.getSessionCookieOptions(sessionCookieExpiryTime));
 			cookieStore.delete(SessionManager_default.getTempSessionCookieName());
 			const afterSignInUrl = await (await client.getStorageManager()).getConfigDataParameter("afterSignInUrl");
 			return {

package/dist/server/actions/signInAction.js.map

@@ -1 +1 @@
-{"version":3,"file":"signInAction.js","names":["getClient","cookieStore: RequestCookies","sessionId: string | undefined","existingSessionToken: string | undefined","SessionManager","tempSessionToken: string | undefined","tempSessionToken: string","defaultSignInUrl: string","response: any","idToken: IdToken","userIdFromToken: string","organizationId: string | undefined","scopes: string","iat: number","exp: number","expiresIn: number","config: ThunderIDNextConfig","sessionCookieExpiryTime: number","sessionToken: string","afterSignInUrl: string"],"sources":["../../../src/server/actions/signInAction.ts"],"sourcesContent":["// Copyright 2025 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\n'use server';\n\nimport {\n  generateSessionId,\n  EmbeddedSignInFlowStatus,\n  EmbeddedFlowExecuteRequestConfig,\n  IdToken,\n  isEmpty,\n} from '@thunderid/node';\nimport {cookies} from 'next/headers';\nimport {ThunderIDNextConfig} from '../../models/config';\nimport logger from '../../utils/logger';\nimport SessionManager, {SessionTokenPayload} from '../../utils/SessionManager';\nimport getClient from '../getClient';\n\ntype RequestCookies = Awaited<ReturnType<typeof cookies>>;\n\n/**\n * Server action for signing in a user.\n * Handles the embedded sign-in flow and manages session cookies.\n *\n * @param payload - The embedded sign-in flow payload\n * @param request - The embedded flow execute request config\n * @returns Promise that resolves when sign-in is complete\n */\nconst signInAction = async (\n  payload?: any,\n  request?: EmbeddedFlowExecuteRequestConfig,\n): Promise<{\n  data?:\n    | {\n        afterSignInUrl?: string;\n        signInUrl?: string;\n      }\n    | Record<string, unknown>;\n  error?: string;\n  success: boolean;\n}> => {\n  try {\n    const client = getClient();\n    const cookieStore: RequestCookies = await cookies();\n\n    let sessionId: string | undefined;\n\n    const existingSessionToken: string | undefined = cookieStore.get(SessionManager.getSessionCookieName())?.value;\n\n    if (existingSessionToken) {\n      try {\n        const sessionPayload: SessionTokenPayload = await SessionManager.verifySessionToken(existingSessionToken);\n        sessionId = sessionPayload.sessionId;\n      } catch {\n        // Invalid session token, will create new temp session\n      }\n    }\n\n    if (!sessionId) {\n      const tempSessionToken: string | undefined = cookieStore.get(SessionManager.getTempSessionCookieName())?.value;\n\n      if (tempSessionToken) {\n        try {\n          const tempSession: {sessionId: string} = await SessionManager.verifyTempSession(tempSessionToken);\n          sessionId = tempSession.sessionId;\n        } catch {\n          // Invalid temp session, will create new one\n        }\n      }\n    }\n\n    if (!sessionId) {\n      sessionId = generateSessionId();\n\n      const tempSessionToken: string = await SessionManager.createTempSession(sessionId);\n\n      cookieStore.set(\n        SessionManager.getTempSessionCookieName(),\n        tempSessionToken,\n        SessionManager.getTempSessionCookieOptions(),\n      );\n    }\n\n    // If no payload provided, redirect to sign-in URL for redirect-based sign-in.\n    if (!payload || isEmpty(payload)) {\n      const defaultSignInUrl: string = await client.getAuthorizeRequestUrl({}, sessionId);\n      return {data: {signInUrl: String(defaultSignInUrl)}, success: true};\n    }\n\n    // Handle embedded sign-in flow\n    const response: any = await client.signIn(payload, request!, sessionId);\n\n    if (response.flowStatus === EmbeddedSignInFlowStatus.Complete) {\n      // On the V2 platform, a completed embedded flow (without a preceding `/authorize` redirect,\n      // i.e. no `authId`) returns a self-contained JWT `assertion` rather than an authorization\n      // code to exchange. This mirrors how @thunderid/react and @thunderid/vue treat it: the\n      // assertion is used directly as the bearer session token.\n      if (!response.assertion) {\n        throw new Error('[signInAction] Flow completed without an assertion.');\n      }\n\n      const idToken: IdToken = await client.getDecodedIdToken(sessionId, response.assertion);\n      const userIdFromToken: string = (idToken.sub as string | undefined) ?? sessionId;\n      const organizationId: string | undefined = (idToken['user_org'] || idToken['organization_id']) as\n        | string\n        | undefined;\n      const scopes: string = (idToken['scope'] as string | undefined) ?? '';\n      const iat: number = (idToken['iat'] as number | undefined) ?? Math.floor(Date.now() / 1000);\n      const exp: number = (idToken['exp'] as number | undefined) ?? iat + 3600;\n      const expiresIn: number = Math.max(exp - iat, 0);\n\n      const config: ThunderIDNextConfig = await client.getConfiguration();\n      const sessionCookieExpiryTime: number = SessionManager.resolveSessionCookieExpiry(\n        config.sessionCookie?.expiryTime,\n      );\n\n      const sessionToken: string = await SessionManager.createSessionToken(\n        response.assertion,\n        userIdFromToken,\n        sessionId,\n        scopes,\n        expiresIn,\n        '',\n        organizationId,\n      );\n\n      cookieStore.set(\n        SessionManager.getSessionCookieName(),\n        sessionToken,\n        SessionManager.getSessionCookieOptions(sessionCookieExpiryTime),\n      );\n\n      cookieStore.delete(SessionManager.getTempSessionCookieName());\n\n      const afterSignInUrl: string = await (await client.getStorageManager()).getConfigDataParameter('afterSignInUrl');\n      return {data: {afterSignInUrl: String(afterSignInUrl)}, success: true};\n    }\n\n    return {data: response as Record<string, unknown>, success: true};\n  } catch (error) {\n    const message =\n      error instanceof Error\n        ? error.message\n        : typeof (error as any)?.message === 'string'\n          ? (error as any).message\n          : String(error);\n    logger.error(`[signInAction] Error during sign-in: ${message}`);\n    return {error: message, success: false};\n  }\n};\n\nexport default signInAction;\n"],"mappings":";;;;;;;;;;;;;;;;;;AA4BA,MAAM,eAAe,OACnB,SACA,YAUI;AACJ,KAAI;EACF,MAAM,SAASA,mBAAW;EAC1B,MAAMC,cAA8B,MAAM,SAAS;EAEnD,IAAIC;EAEJ,MAAMC,uBAA2C,YAAY,IAAIC,uBAAe,sBAAsB,CAAC,EAAE;AAEzG,MAAI,qBACF,KAAI;AAEF,gBAD4C,MAAMA,uBAAe,mBAAmB,qBAAqB,EAC9E;UACrB;AAKV,MAAI,CAAC,WAAW;GACd,MAAMC,mBAAuC,YAAY,IAAID,uBAAe,0BAA0B,CAAC,EAAE;AAEzG,OAAI,iBACF,KAAI;AAEF,iBADyC,MAAMA,uBAAe,kBAAkB,iBAAiB,EACzE;WAClB;;AAMZ,MAAI,CAAC,WAAW;AACd,eAAY,mBAAmB;GAE/B,MAAME,mBAA2B,MAAMF,uBAAe,kBAAkB,UAAU;AAElF,eAAY,IACVA,uBAAe,0BAA0B,EACzC,kBACAA,uBAAe,6BAA6B,CAC7C;;AAIH,MAAI,CAAC,WAAW,QAAQ,QAAQ,EAAE;GAChC,MAAMG,mBAA2B,MAAM,OAAO,uBAAuB,EAAE,EAAE,UAAU;AACnF,UAAO;IAAC,MAAM,EAAC,WAAW,OAAO,iBAAiB,EAAC;IAAE,SAAS;IAAK;;EAIrE,MAAMC,WAAgB,MAAM,OAAO,OAAO,SAAS,SAAU,UAAU;AAEvE,MAAI,SAAS,eAAe,yBAAyB,UAAU;AAK7D,OAAI,CAAC,SAAS,UACZ,OAAM,IAAI,MAAM,sDAAsD;GAGxE,MAAMC,UAAmB,MAAM,OAAO,kBAAkB,WAAW,SAAS,UAAU;GACtF,MAAMC,kBAA2B,QAAQ,OAA8B;GACvE,MAAMC,iBAAsC,QAAQ,eAAe,QAAQ;GAG3E,MAAMC,SAAkB,QAAQ,YAAmC;GACnE,MAAMC,MAAe,QAAQ,UAAiC,KAAK,MAAM,KAAK,KAAK,GAAG,IAAK;GAC3F,MAAMC,MAAe,QAAQ,UAAiC,MAAM;GACpE,MAAMC,YAAoB,KAAK,IAAI,MAAM,KAAK,EAAE;GAEhD,MAAMC,SAA8B,MAAM,OAAO,kBAAkB;GACnE,MAAMC,0BAAkCb,uBAAe,2BACrD,OAAO,eAAe,WACvB;GAED,MAAMc,eAAuB,MAAMd,uBAAe,mBAChD,SAAS,WACT,iBACA,WACA,QACA,WACA,IACA,eACD;AAED,eAAY,IACVA,uBAAe,sBAAsB,EACrC,cACAA,uBAAe,wBAAwB,wBAAwB,CAChE;AAED,eAAY,OAAOA,uBAAe,0BAA0B,CAAC;GAE7D,MAAMe,iBAAyB,OAAO,MAAM,OAAO,mBAAmB,EAAE,uBAAuB,iBAAiB;AAChH,UAAO;IAAC,MAAM,EAAC,gBAAgB,OAAO,eAAe,EAAC;IAAE,SAAS;IAAK;;AAGxE,SAAO;GAAC,MAAM;GAAqC,SAAS;GAAK;UAC1D,OAAO;EACd,MAAM,UACJ,iBAAiB,QACb,MAAM,UACN,OAAQ,OAAe,YAAY,WAChC,MAAc,UACf,OAAO,MAAM;AACrB,iBAAO,MAAM,wCAAwC,UAAU;AAC/D,SAAO;GAAC,OAAO;GAAS,SAAS;GAAM;;;AAI3C,2BAAe"}
+{"version":3,"file":"signInAction.js","names":["getClient","cookieStore: RequestCookies","sessionId: string | undefined","existingSessionToken: string | undefined","SessionManager","tempSessionToken: string | undefined","tempSessionToken: string","defaultSignInUrl: string","response: any","idToken: IdToken","userIdFromToken: string","organizationId: string | undefined","scopes: string","iat: number","exp: number","expiresIn: number","config: ThunderIDNextConfig","sessionCookieExpiryTime: number","sessionToken: string","afterSignInUrl: string"],"sources":["../../../src/server/actions/signInAction.ts"],"sourcesContent":["// Copyright 2025 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\n'use server';\n\nimport {\n  generateSessionId,\n  EmbeddedSignInFlowStatus,\n  EmbeddedFlowExecuteRequestConfig,\n  IdToken,\n  isEmpty,\n} from '@thunderid/node';\nimport {cookies} from 'next/headers';\nimport {ThunderIDNextConfig} from '../../models/config';\nimport {getChunkedCookie, setChunkedCookie} from '../../utils/chunkedCookie';\nimport logger from '../../utils/logger';\nimport SessionManager, {SessionTokenPayload} from '../../utils/SessionManager';\nimport getClient from '../getClient';\n\ntype RequestCookies = Awaited<ReturnType<typeof cookies>>;\n\n/**\n * Server action for signing in a user.\n * Handles the embedded sign-in flow and manages session cookies.\n *\n * @param payload - The embedded sign-in flow payload\n * @param request - The embedded flow execute request config\n * @returns Promise that resolves when sign-in is complete\n */\nconst signInAction = async (\n  payload?: any,\n  request?: EmbeddedFlowExecuteRequestConfig,\n): Promise<{\n  data?:\n    | {\n        afterSignInUrl?: string;\n        signInUrl?: string;\n      }\n    | Record<string, unknown>;\n  error?: string;\n  success: boolean;\n}> => {\n  try {\n    const client = getClient();\n    const cookieStore: RequestCookies = await cookies();\n\n    let sessionId: string | undefined;\n\n    const existingSessionToken: string | undefined = getChunkedCookie(\n      cookieStore,\n      SessionManager.getSessionCookieName(),\n    );\n\n    if (existingSessionToken) {\n      try {\n        const sessionPayload: SessionTokenPayload = await SessionManager.verifySessionToken(existingSessionToken);\n        sessionId = sessionPayload.sessionId;\n      } catch {\n        // Invalid session token, will create new temp session\n      }\n    }\n\n    if (!sessionId) {\n      const tempSessionToken: string | undefined = cookieStore.get(SessionManager.getTempSessionCookieName())?.value;\n\n      if (tempSessionToken) {\n        try {\n          const tempSession: {sessionId: string} = await SessionManager.verifyTempSession(tempSessionToken);\n          sessionId = tempSession.sessionId;\n        } catch {\n          // Invalid temp session, will create new one\n        }\n      }\n    }\n\n    if (!sessionId) {\n      sessionId = generateSessionId();\n\n      const tempSessionToken: string = await SessionManager.createTempSession(sessionId);\n\n      cookieStore.set(\n        SessionManager.getTempSessionCookieName(),\n        tempSessionToken,\n        SessionManager.getTempSessionCookieOptions(),\n      );\n    }\n\n    // If no payload provided, redirect to sign-in URL for redirect-based sign-in.\n    if (!payload || isEmpty(payload)) {\n      const defaultSignInUrl: string = await client.getAuthorizeRequestUrl({}, sessionId);\n      return {data: {signInUrl: String(defaultSignInUrl)}, success: true};\n    }\n\n    // Handle embedded sign-in flow\n    const response: any = await client.signIn(payload, request!, sessionId);\n\n    if (response.flowStatus === EmbeddedSignInFlowStatus.Complete) {\n      // On the V2 platform, a completed embedded flow (without a preceding `/authorize` redirect,\n      // i.e. no `authId`) returns a self-contained JWT `assertion` rather than an authorization\n      // code to exchange. This mirrors how @thunderid/react and @thunderid/vue treat it: the\n      // assertion is used directly as the bearer session token.\n      if (!response.assertion) {\n        throw new Error('[signInAction] Flow completed without an assertion.');\n      }\n\n      const idToken: IdToken = await client.getDecodedIdToken(sessionId, response.assertion);\n      const userIdFromToken: string = (idToken.sub as string | undefined) ?? sessionId;\n      const organizationId: string | undefined = (idToken['user_org'] || idToken['organization_id']) as\n        | string\n        | undefined;\n      const scopes: string = (idToken['scope'] as string | undefined) ?? '';\n      const iat: number = (idToken['iat'] as number | undefined) ?? Math.floor(Date.now() / 1000);\n      const exp: number = (idToken['exp'] as number | undefined) ?? iat + 3600;\n      const expiresIn: number = Math.max(exp - iat, 0);\n\n      const config: ThunderIDNextConfig = await client.getConfiguration();\n      const sessionCookieExpiryTime: number = SessionManager.resolveSessionCookieExpiry(\n        config.sessionCookie?.expiryTime,\n      );\n\n      const sessionToken: string = await SessionManager.createSessionToken(\n        response.assertion,\n        userIdFromToken,\n        sessionId,\n        scopes,\n        expiresIn,\n        '',\n        organizationId,\n      );\n\n      setChunkedCookie(\n        cookieStore,\n        SessionManager.getSessionCookieName(),\n        sessionToken,\n        SessionManager.getSessionCookieOptions(sessionCookieExpiryTime),\n      );\n\n      cookieStore.delete(SessionManager.getTempSessionCookieName());\n\n      const afterSignInUrl: string = await (await client.getStorageManager()).getConfigDataParameter('afterSignInUrl');\n      return {data: {afterSignInUrl: String(afterSignInUrl)}, success: true};\n    }\n\n    return {data: response as Record<string, unknown>, success: true};\n  } catch (error) {\n    const message =\n      error instanceof Error\n        ? error.message\n        : typeof (error as any)?.message === 'string'\n          ? (error as any).message\n          : String(error);\n    logger.error(`[signInAction] Error during sign-in: ${message}`);\n    return {error: message, success: false};\n  }\n};\n\nexport default signInAction;\n"],"mappings":";;;;;;;;;;;;;;;;;;;AA6BA,MAAM,eAAe,OACnB,SACA,YAUI;AACJ,KAAI;EACF,MAAM,SAASA,mBAAW;EAC1B,MAAMC,cAA8B,MAAM,SAAS;EAEnD,IAAIC;EAEJ,MAAMC,uBAA2C,iBAC/C,aACAC,uBAAe,sBAAsB,CACtC;AAED,MAAI,qBACF,KAAI;AAEF,gBAD4C,MAAMA,uBAAe,mBAAmB,qBAAqB,EAC9E;UACrB;AAKV,MAAI,CAAC,WAAW;GACd,MAAMC,mBAAuC,YAAY,IAAID,uBAAe,0BAA0B,CAAC,EAAE;AAEzG,OAAI,iBACF,KAAI;AAEF,iBADyC,MAAMA,uBAAe,kBAAkB,iBAAiB,EACzE;WAClB;;AAMZ,MAAI,CAAC,WAAW;AACd,eAAY,mBAAmB;GAE/B,MAAME,mBAA2B,MAAMF,uBAAe,kBAAkB,UAAU;AAElF,eAAY,IACVA,uBAAe,0BAA0B,EACzC,kBACAA,uBAAe,6BAA6B,CAC7C;;AAIH,MAAI,CAAC,WAAW,QAAQ,QAAQ,EAAE;GAChC,MAAMG,mBAA2B,MAAM,OAAO,uBAAuB,EAAE,EAAE,UAAU;AACnF,UAAO;IAAC,MAAM,EAAC,WAAW,OAAO,iBAAiB,EAAC;IAAE,SAAS;IAAK;;EAIrE,MAAMC,WAAgB,MAAM,OAAO,OAAO,SAAS,SAAU,UAAU;AAEvE,MAAI,SAAS,eAAe,yBAAyB,UAAU;AAK7D,OAAI,CAAC,SAAS,UACZ,OAAM,IAAI,MAAM,sDAAsD;GAGxE,MAAMC,UAAmB,MAAM,OAAO,kBAAkB,WAAW,SAAS,UAAU;GACtF,MAAMC,kBAA2B,QAAQ,OAA8B;GACvE,MAAMC,iBAAsC,QAAQ,eAAe,QAAQ;GAG3E,MAAMC,SAAkB,QAAQ,YAAmC;GACnE,MAAMC,MAAe,QAAQ,UAAiC,KAAK,MAAM,KAAK,KAAK,GAAG,IAAK;GAC3F,MAAMC,MAAe,QAAQ,UAAiC,MAAM;GACpE,MAAMC,YAAoB,KAAK,IAAI,MAAM,KAAK,EAAE;GAEhD,MAAMC,SAA8B,MAAM,OAAO,kBAAkB;GACnE,MAAMC,0BAAkCb,uBAAe,2BACrD,OAAO,eAAe,WACvB;GAED,MAAMc,eAAuB,MAAMd,uBAAe,mBAChD,SAAS,WACT,iBACA,WACA,QACA,WACA,IACA,eACD;AAED,oBACE,aACAA,uBAAe,sBAAsB,EACrC,cACAA,uBAAe,wBAAwB,wBAAwB,CAChE;AAED,eAAY,OAAOA,uBAAe,0BAA0B,CAAC;GAE7D,MAAMe,iBAAyB,OAAO,MAAM,OAAO,mBAAmB,EAAE,uBAAuB,iBAAiB;AAChH,UAAO;IAAC,MAAM,EAAC,gBAAgB,OAAO,eAAe,EAAC;IAAE,SAAS;IAAK;;AAGxE,SAAO;GAAC,MAAM;GAAqC,SAAS;GAAK;UAC1D,OAAO;EACd,MAAM,UACJ,iBAAiB,QACb,MAAM,UACN,OAAQ,OAAe,YAAY,WAChC,MAAc,UACf,OAAO,MAAM;AACrB,iBAAO,MAAM,wCAAwC,UAAU;AAC/D,SAAO;GAAC,OAAO;GAAS,SAAS;GAAM;;;AAI3C,2BAAe"}

package/dist/server/actions/signOutAction.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"signOutAction.d.ts","sourceRoot":"","sources":["../../../src/server/actions/signOutAction.ts"],"names":[],"mappings":"AAaA;;;;;GAKG;AACH,QAAA,MAAM,aAAa,QAAa,OAAO,CAAC;IAAC,IAAI,CAAC,EAAE;QAAC,eAAe,CAAC,EAAE,MAAM,CAAA;KAAC,CAAC;IAAC,KAAK,CAAC,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAC,CA8C7G,CAAC;AAEF,eAAe,aAAa,CAAC"}
+{"version":3,"file":"signOutAction.d.ts","sourceRoot":"","sources":["../../../src/server/actions/signOutAction.ts"],"names":[],"mappings":"AAcA;;;;;GAKG;AACH,QAAA,MAAM,aAAa,QAAa,OAAO,CAAC;IAAC,IAAI,CAAC,EAAE;QAAC,eAAe,CAAC,EAAE,MAAM,CAAA;KAAC,CAAC;IAAC,KAAK,CAAC,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAC,CA8C7G,CAAC;AAEF,eAAe,aAAa,CAAC"}

package/dist/server/actions/signOutAction.js

@@ -1,6 +1,7 @@
 'use server';
 
 
+import { deleteChunkedCookie } from "../../utils/chunkedCookie.js";
 import SessionManager_default from "../../utils/SessionManager.js";
 import getSessionId_default from "./getSessionId.js";
 import getClient_default from "../getClient.js";
@@ -18,7 +19,7 @@ const signOutAction = async () => {
 	logger_default.debug("[signOutAction] Initiating sign out process from the server action.");
 	const clearSessionCookies = async () => {
 		const cookieStore = await cookies();
-		cookieStore.delete(SessionManager_default.getSessionCookieName());
+		deleteChunkedCookie(cookieStore, SessionManager_default.getSessionCookieName());
 		cookieStore.delete(SessionManager_default.getTempSessionCookieName());
 	};
 	try {

package/dist/server/actions/signOutAction.js.map

@@ -1 +1 @@
-{"version":3,"file":"signOutAction.js","names":["cookieStore: RequestCookies","SessionManager","getClient","sessionId: string | undefined","getSessionId","errorMessage: unknown"],"sources":["../../../src/server/actions/signOutAction.ts"],"sourcesContent":["// Copyright 2025 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\n'use server';\n\nimport {cookies} from 'next/headers';\nimport getSessionId from './getSessionId';\nimport logger from '../../utils/logger';\nimport SessionManager from '../../utils/SessionManager';\nimport getClient from '../getClient';\n\ntype RequestCookies = Awaited<ReturnType<typeof cookies>>;\n\n/**\n * Server action for signing out a user.\n * Clears both JWT and legacy session cookies.\n *\n * @returns Promise that resolves with success status and optional after sign-out URL\n */\nconst signOutAction = async (): Promise<{data?: {afterSignOutUrl?: string}; error?: unknown; success: boolean}> => {\n  logger.debug('[signOutAction] Initiating sign out process from the server action.');\n\n  const clearSessionCookies = async (): Promise<void> => {\n    const cookieStore: RequestCookies = await cookies();\n\n    cookieStore.delete(SessionManager.getSessionCookieName());\n    cookieStore.delete(SessionManager.getTempSessionCookieName());\n  };\n\n  try {\n    const client = getClient();\n    const sessionId: string | undefined = await getSessionId();\n\n    let afterSignOutUrl = '/';\n\n    if (sessionId) {\n      logger.debug('[signOutAction] Session ID found, invoking the `signOut` to obtain the `afterSignOutUrl`.');\n\n      afterSignOutUrl = await client.signOut({}, sessionId);\n    }\n\n    await clearSessionCookies();\n\n    return {data: {afterSignOutUrl}, success: true};\n  } catch (error) {\n    logger.error('[signOutAction] Error during sign out from the server action:', error);\n\n    logger.debug('[signOutAction] Clearing session cookies due to error as a fallback.');\n\n    await clearSessionCookies();\n\n    let errorMessage: unknown;\n    if (typeof error === 'string') {\n      errorMessage = error;\n    } else if (error instanceof Error) {\n      errorMessage = error.message;\n    } else {\n      errorMessage = JSON.stringify(error);\n    }\n\n    return {\n      error: errorMessage,\n      success: false,\n    };\n  }\n};\n\nexport default signOutAction;\n"],"mappings":";;;;;;;;;;;;;;;;AAmBA,MAAM,gBAAgB,YAA6F;AACjH,gBAAO,MAAM,sEAAsE;CAEnF,MAAM,sBAAsB,YAA2B;EACrD,MAAMA,cAA8B,MAAM,SAAS;AAEnD,cAAY,OAAOC,uBAAe,sBAAsB,CAAC;AACzD,cAAY,OAAOA,uBAAe,0BAA0B,CAAC;;AAG/D,KAAI;EACF,MAAM,SAASC,mBAAW;EAC1B,MAAMC,YAAgC,MAAMC,sBAAc;EAE1D,IAAI,kBAAkB;AAEtB,MAAI,WAAW;AACb,kBAAO,MAAM,4FAA4F;AAEzG,qBAAkB,MAAM,OAAO,QAAQ,EAAE,EAAE,UAAU;;AAGvD,QAAM,qBAAqB;AAE3B,SAAO;GAAC,MAAM,EAAC,iBAAgB;GAAE,SAAS;GAAK;UACxC,OAAO;AACd,iBAAO,MAAM,iEAAiE,MAAM;AAEpF,iBAAO,MAAM,uEAAuE;AAEpF,QAAM,qBAAqB;EAE3B,IAAIC;AACJ,MAAI,OAAO,UAAU,SACnB,gBAAe;WACN,iBAAiB,MAC1B,gBAAe,MAAM;MAErB,gBAAe,KAAK,UAAU,MAAM;AAGtC,SAAO;GACL,OAAO;GACP,SAAS;GACV;;;AAIL,4BAAe"}
+{"version":3,"file":"signOutAction.js","names":["cookieStore: RequestCookies","SessionManager","getClient","sessionId: string | undefined","getSessionId","errorMessage: unknown"],"sources":["../../../src/server/actions/signOutAction.ts"],"sourcesContent":["// Copyright 2025 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\n'use server';\n\nimport {cookies} from 'next/headers';\nimport getSessionId from './getSessionId';\nimport {deleteChunkedCookie} from '../../utils/chunkedCookie';\nimport logger from '../../utils/logger';\nimport SessionManager from '../../utils/SessionManager';\nimport getClient from '../getClient';\n\ntype RequestCookies = Awaited<ReturnType<typeof cookies>>;\n\n/**\n * Server action for signing out a user.\n * Clears both JWT and legacy session cookies.\n *\n * @returns Promise that resolves with success status and optional after sign-out URL\n */\nconst signOutAction = async (): Promise<{data?: {afterSignOutUrl?: string}; error?: unknown; success: boolean}> => {\n  logger.debug('[signOutAction] Initiating sign out process from the server action.');\n\n  const clearSessionCookies = async (): Promise<void> => {\n    const cookieStore: RequestCookies = await cookies();\n\n    deleteChunkedCookie(cookieStore, SessionManager.getSessionCookieName());\n    cookieStore.delete(SessionManager.getTempSessionCookieName());\n  };\n\n  try {\n    const client = getClient();\n    const sessionId: string | undefined = await getSessionId();\n\n    let afterSignOutUrl = '/';\n\n    if (sessionId) {\n      logger.debug('[signOutAction] Session ID found, invoking the `signOut` to obtain the `afterSignOutUrl`.');\n\n      afterSignOutUrl = await client.signOut({}, sessionId);\n    }\n\n    await clearSessionCookies();\n\n    return {data: {afterSignOutUrl}, success: true};\n  } catch (error) {\n    logger.error('[signOutAction] Error during sign out from the server action:', error);\n\n    logger.debug('[signOutAction] Clearing session cookies due to error as a fallback.');\n\n    await clearSessionCookies();\n\n    let errorMessage: unknown;\n    if (typeof error === 'string') {\n      errorMessage = error;\n    } else if (error instanceof Error) {\n      errorMessage = error.message;\n    } else {\n      errorMessage = JSON.stringify(error);\n    }\n\n    return {\n      error: errorMessage,\n      success: false,\n    };\n  }\n};\n\nexport default signOutAction;\n"],"mappings":";;;;;;;;;;;;;;;;;AAoBA,MAAM,gBAAgB,YAA6F;AACjH,gBAAO,MAAM,sEAAsE;CAEnF,MAAM,sBAAsB,YAA2B;EACrD,MAAMA,cAA8B,MAAM,SAAS;AAEnD,sBAAoB,aAAaC,uBAAe,sBAAsB,CAAC;AACvE,cAAY,OAAOA,uBAAe,0BAA0B,CAAC;;AAG/D,KAAI;EACF,MAAM,SAASC,mBAAW;EAC1B,MAAMC,YAAgC,MAAMC,sBAAc;EAE1D,IAAI,kBAAkB;AAEtB,MAAI,WAAW;AACb,kBAAO,MAAM,4FAA4F;AAEzG,qBAAkB,MAAM,OAAO,QAAQ,EAAE,EAAE,UAAU;;AAGvD,QAAM,qBAAqB;AAE3B,SAAO;GAAC,MAAM,EAAC,iBAAgB;GAAE,SAAS;GAAK;UACxC,OAAO;AACd,iBAAO,MAAM,iEAAiE,MAAM;AAEpF,iBAAO,MAAM,uEAAuE;AAEpF,QAAM,qBAAqB;EAE3B,IAAIC;AACJ,MAAI,OAAO,UAAU,SACnB,gBAAe;WACN,iBAAiB,MAC1B,gBAAe,MAAM;MAErB,gBAAe,KAAK,UAAU,MAAM;AAGtC,SAAO;GACL,OAAO;GACP,SAAS;GACV;;;AAIL,4BAAe"}

package/dist/server/index.js

@@ -1,6 +1,6 @@
 import thunderid_default from "./thunderid.js";
 import ThunderIDProvider_default from "./ThunderIDProvider.js";
-import thunderIDProxy_default from "./proxy/thunderIDProxy.js";
+import thunderIDProxy_default, { removeChunkedCookieFromHeader, replaceChunkedCookieInHeader } from "./proxy/thunderIDProxy.js";
 import createRouteMatcher_default from "./proxy/createRouteMatcher.js";
 
-export { ThunderIDProvider_default as ThunderIDProvider, createRouteMatcher_default as createRouteMatcher, thunderIDProxy_default as thunderIDProxy, thunderid_default as thunderid };
+export { ThunderIDProvider_default as ThunderIDProvider, createRouteMatcher_default as createRouteMatcher, removeChunkedCookieFromHeader, replaceChunkedCookieInHeader, thunderIDProxy_default as thunderIDProxy, thunderid_default as thunderid };

package/dist/server/proxy/thunderIDProxy.d.ts

@@ -23,6 +23,19 @@ export interface ThunderIDProxyContext {
     }) => Promise<NextResponse | void>;
 }
 type ThunderIDProxyHandler = (thunderid: ThunderIDProxyContext, req: NextRequest) => Promise<NextResponse | void> | NextResponse | void;
+/**
+ * Removes a cookie from a raw Cookie header string — the unchunked `name`
+ * entry and/or any numbered `${name}.0`, `${name}.1`, ... chunk entries.
+ */
+export declare const removeChunkedCookieFromHeader: (cookieHeader: string, name: string) => string;
+/**
+ * Replaces a cookie's value inside a raw Cookie header string, splitting it
+ * across numbered `${name}.0`, `${name}.1`, ... chunk entries once it would
+ * exceed the ~4KB per-cookie limit browsers enforce. Any entry the cookie
+ * doesn't appear in yet is appended; stale chunk entries a shrunk value no
+ * longer needs are dropped.
+ */
+export declare const replaceChunkedCookieInHeader: (cookieHeader: string, name: string, value: string) => string;
 /**
  * ThunderID proxy that integrates authentication into your Next.js application.
  * Similar to Clerk's clerkMiddleware pattern.

package/dist/server/proxy/thunderIDProxy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"thunderIDProxy.d.ts","sourceRoot":"","sources":["../../../src/server/proxy/thunderIDProxy.ts"],"names":[],"mappings":"AAGA,OAAO,EAAC,WAAW,EAAE,YAAY,EAAC,MAAM,aAAa,CAAC;AAEtD,OAAO,EAAC,mBAAmB,EAAC,MAAM,qBAAqB,CAAC;AAGxD,OAAuB,EAAC,mBAAmB,EAAC,MAAM,4BAA4B,CAAC;AAG/E,MAAM,MAAM,qBAAqB,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAC;AAEjE,MAAM,WAAW,qBAAqB;IACpC,4DAA4D;IAC5D,UAAU,EAAE,MAAM,OAAO,CAAC,mBAAmB,GAAG,SAAS,CAAC,CAAC;IAC3D,kDAAkD;IAClD,YAAY,EAAE,MAAM,MAAM,GAAG,SAAS,CAAC;IACvC,iEAAiE;IACjE,UAAU,EAAE,MAAM,OAAO,CAAC;IAC1B;;;;;;;;OAQG;IACH,YAAY,EAAE,CAAC,YAAY,CAAC,EAAE;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAC,KAAK,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC;CACpF;AAED,KAAK,qBAAqB,GAAG,CAC3B,SAAS,EAAE,qBAAqB,EAChC,GAAG,EAAE,WAAW,KACb,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,GAAG,YAAY,GAAG,IAAI,CAAC;AA4CxD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AACH,QAAA,MAAM,cAAc,GAEhB,UAAU,qBAAqB,EAC/B,UAAU,qBAAqB,GAAG,CAAC,CAAC,GAAG,EAAE,WAAW,KAAK,qBAAqB,CAAC,KAC9E,CAAC,CAAC,OAAO,EAAE,WAAW,KAAK,OAAO,CAAC,YAAY,CAAC,CAoMlD,CAAC;AAEJ,eAAe,cAAc,CAAC"}
+{"version":3,"file":"thunderIDProxy.d.ts","sourceRoot":"","sources":["../../../src/server/proxy/thunderIDProxy.ts"],"names":[],"mappings":"AAIA,OAAO,EAAC,WAAW,EAAE,YAAY,EAAC,MAAM,aAAa,CAAC;AAEtD,OAAO,EAAC,mBAAmB,EAAC,MAAM,qBAAqB,CAAC;AAUxD,OAAuB,EAAC,mBAAmB,EAAC,MAAM,4BAA4B,CAAC;AAG/E,MAAM,MAAM,qBAAqB,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAC;AAEjE,MAAM,WAAW,qBAAqB;IACpC,4DAA4D;IAC5D,UAAU,EAAE,MAAM,OAAO,CAAC,mBAAmB,GAAG,SAAS,CAAC,CAAC;IAC3D,kDAAkD;IAClD,YAAY,EAAE,MAAM,MAAM,GAAG,SAAS,CAAC;IACvC,iEAAiE;IACjE,UAAU,EAAE,MAAM,OAAO,CAAC;IAC1B;;;;;;;;OAQG;IACH,YAAY,EAAE,CAAC,YAAY,CAAC,EAAE;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAC,KAAK,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC;CACpF;AAED,KAAK,qBAAqB,GAAG,CAC3B,SAAS,EAAE,qBAAqB,EAChC,GAAG,EAAE,WAAW,KACb,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,GAAG,YAAY,GAAG,IAAI,CAAC;AAiBxD;;;GAGG;AACH,eAAO,MAAM,6BAA6B,GAAI,cAAc,MAAM,EAAE,MAAM,MAAM,KAAG,MAalF,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,4BAA4B,GAAI,cAAc,MAAM,EAAE,MAAM,MAAM,EAAE,OAAO,MAAM,KAAG,MAShG,CAAC;AAoBF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AACH,QAAA,MAAM,cAAc,GAEhB,UAAU,qBAAqB,EAC/B,UAAU,qBAAqB,GAAG,CAAC,CAAC,GAAG,EAAE,WAAW,KAAK,qBAAqB,CAAC,KAC9E,CAAC,CAAC,OAAO,EAAE,WAAW,KAAK,OAAO,CAAC,YAAY,CAAC,CAkNlD,CAAC;AAEJ,eAAe,cAAc,CAAC"}