@thunderid/nextjs 1.0.4 → 1.0.5

package/dist/cjs/server/proxy/thunderIDProxy.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"thunderIDProxy.cjs","names":["eqIdx: number","parts: string[]","updated: string[]","resolvedConfig: ThunderIDNextConfig","decorateConfigWithNextEnv","url: URL","hasCallbackParams: boolean","tempSessionToken: string | undefined","SessionManager","verifiedSession: SessionTokenPayload | undefined","getSessionFromRequest","expiredSession: SessionTokenPayload | undefined","rawToken: string | undefined","decoded: SessionTokenPayload","now: number","candidateSession: SessionTokenPayload | undefined","needsRefresh: boolean","REFRESH_BUFFER_SECONDS","activeSession: SessionTokenPayload | undefined","refreshCookieUpdate: {expiry: number; token: string} | undefined","handleRefreshToken","rawSessionCookie: string | undefined","sessionId: string | undefined","getSessionIdFromRequest","handlerResponse: NextResponse | void","referer: string | null","refererUrl: URL","requestUrl: URL","redirectUrl: string","NextResponse","cookieName: string","cookieName","requestHeaders: Headers","cleanResponse: NextResponse","requestHeaders","cookieOptions: ReturnType<typeof SessionManager.getSessionCookieOptions>","updatedCookieHeader: string","response: NextResponse"],"sources":["../../../../src/server/proxy/thunderIDProxy.ts"],"sourcesContent":["// Copyright 2025 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\nimport {NextRequest, NextResponse} from 'next/server';\nimport {REFRESH_BUFFER_SECONDS} from '../../constants/sessionConstants';\nimport {ThunderIDNextConfig} from '../../models/config';\nimport decorateConfigWithNextEnv from '../../utils/decorateConfigWithNextEnv';\nimport handleRefreshToken from '../../utils/handleRefreshToken';\nimport SessionManager, {SessionTokenPayload} from '../../utils/SessionManager';\nimport {getSessionFromRequest, getSessionIdFromRequest} from '../../utils/sessionUtils';\n\nexport type ThunderIDProxyOptions = Partial<ThunderIDNextConfig>;\n\nexport interface ThunderIDProxyContext {\n  /** Get the session payload from JWT session if available */\n  getSession: () => Promise<SessionTokenPayload | undefined>;\n  /** Get the session ID from the current request */\n  getSessionId: () => string | undefined;\n  /** Check if the current request has a valid ThunderID session */\n  isSignedIn: () => boolean;\n  /**\n   * Protect a route by redirecting unauthenticated users.\n   * Redirect URL fallback order:\n   * 1. options.redirect\n   * 2. resolvedOptions.signInUrl\n   * 3. resolvedOptions.defaultRedirect\n   * 4. referer (if from same origin)\n   * If none are available, falls back to '/'.\n   */\n  protectRoute: (routeOptions?: {redirect?: string}) => Promise<NextResponse | void>;\n}\n\ntype ThunderIDProxyHandler = (\n  thunderid: ThunderIDProxyContext,\n  req: NextRequest,\n) => Promise<NextResponse | void> | NextResponse | void;\n\n/**\n * Removes a named cookie from a raw Cookie header string.\n */\nconst removeCookieFromHeader = (cookieHeader: string, name: string): string =>\n  cookieHeader\n    .split(';')\n    .map((p: string) => p.trim())\n    .filter((p: string) => {\n      const eqIdx: number = p.indexOf('=');\n      const partName: string = eqIdx === -1 ? p : p.slice(0, eqIdx).trim();\n      return partName !== name;\n    })\n    .join('; ');\n\n/**\n * Replaces the value of a named cookie inside a raw Cookie header string.\n * If the cookie does not already appear in the header it is appended.\n */\nconst replaceCookieInHeader = (cookieHeader: string, name: string, value: string): string => {\n  const parts: string[] = cookieHeader\n    .split(';')\n    .map((p: string) => p.trim())\n    .filter(Boolean);\n\n  let found = false;\n  const updated: string[] = parts.map((part: string) => {\n    const eqIdx: number = part.indexOf('=');\n    const partName: string = eqIdx === -1 ? part : part.slice(0, eqIdx).trim();\n    if (partName === name) {\n      found = true;\n      return `${name}=${value}`;\n    }\n    return part;\n  });\n\n  if (!found) {\n    updated.push(`${name}=${value}`);\n  }\n\n  return updated.join('; ');\n};\n\n/**\n * ThunderID proxy that integrates authentication into your Next.js application.\n * Similar to Clerk's clerkMiddleware pattern.\n *\n * Proactively refreshes the access token when it is within REFRESH_BUFFER_SECONDS of\n * expiry so that Server Components always receive a fresh session. The refresh also\n * recovers expired tokens as long as a refresh token is present.\n *\n * The updated session cookie is written to:\n *   - The response  → browser stores the new cookie for subsequent requests.\n *   - The forwarded request headers → the same-request Server Component render sees\n *     the fresh token immediately without waiting for the next navigation.\n *\n * Token refresh requires baseUrl, clientId, and clientSecret. These are resolved from\n * the options argument first, then from the standard ThunderID environment variables\n * (NEXT_PUBLIC_THUNDERID_BASE_URL, NEXT_PUBLIC_THUNDERID_CLIENT_ID,\n * THUNDERID_CLIENT_SECRET). If none are available the refresh step is skipped silently.\n *\n * @param handler - Optional handler function to customize proxy behavior\n * @param options - Configuration options for the proxy\n * @returns Next.js middleware function\n *\n * @example\n * ```typescript\n * // middleware.ts - Basic usage (config read from env vars automatically)\n * import { thunderIDProxy } from '@thunderid/nextjs/server';\n *\n * export default thunderIDProxy();\n *\n * export const config = {\n *   matcher: ['/((?!_next/static|_next/image|favicon.ico).*)'],\n * };\n * ```\n *\n * @example\n * ```typescript\n * // With route protection\n * import { thunderIDProxy, createRouteMatcher } from '@thunderid/nextjs/server';\n *\n * const isProtectedRoute = createRouteMatcher(['/dashboard(.*)']);\n *\n * export default thunderIDProxy(async (thunderid, req) => {\n *   if (isProtectedRoute(req)) {\n *     await thunderid.protectRoute();\n *   }\n * });\n * ```\n */\nconst thunderIDProxy =\n  (\n    handler?: ThunderIDProxyHandler,\n    options?: ThunderIDProxyOptions | ((req: NextRequest) => ThunderIDProxyOptions),\n  ): ((request: NextRequest) => Promise<NextResponse>) =>\n  async (request: NextRequest): Promise<NextResponse> => {\n    const resolvedOptions: ThunderIDProxyOptions = typeof options === 'function' ? options(request) : options || {};\n\n    // Resolve full config from passed options + environment variable fallbacks.\n    const resolvedConfig: ThunderIDNextConfig = decorateConfigWithNextEnv(resolvedOptions as ThunderIDNextConfig);\n\n    // ── OAuth callback detection ──────────────────────────────────────────────\n    const url: URL = new URL(request.url);\n    const hasCallbackParams: boolean = url.searchParams.has('code') && url.searchParams.has('state');\n\n    let isValidOAuthCallback = false;\n    if (hasCallbackParams && !url.searchParams.has('error')) {\n      const tempSessionToken: string | undefined = request.cookies.get(\n        SessionManager.getTempSessionCookieName(),\n      )?.value;\n      if (tempSessionToken) {\n        try {\n          await SessionManager.verifyTempSession(tempSessionToken);\n          isValidOAuthCallback = true;\n        } catch {\n          isValidOAuthCallback = false;\n        }\n      }\n    }\n\n    // ── Session resolution ────────────────────────────────────────────────────\n    // Step 1: Attempt to get a fully verified (signature + expiry) session.\n    const verifiedSession: SessionTokenPayload | undefined = await getSessionFromRequest(request);\n\n    // Step 2: If no verified session exists, verify the raw cookie's signature\n    // without enforcing expiry. This allows the proxy to recover from an\n    // expired access token as long as the JWT is authentic and a refresh token\n    // is present. Skipping the signature check here would let a tampered cookie\n    // drive identity-confusion attacks since handleRefreshToken reuses `sub`,\n    // `sessionId`, and `organizationId` from the input payload when minting the\n    // new session JWT.\n    let expiredSession: SessionTokenPayload | undefined;\n    if (!verifiedSession) {\n      const rawToken: string | undefined = request.cookies.get(SessionManager.getSessionCookieName())?.value;\n      if (rawToken) {\n        try {\n          const decoded: SessionTokenPayload = await SessionManager.verifySessionTokenForRefresh(rawToken);\n          if (decoded.refreshToken) {\n            expiredSession = decoded;\n          }\n        } catch {\n          // Forged, tampered, wrong type, or malformed — ignore.\n        }\n      }\n    }\n\n    // ── Token refresh ─────────────────────────────────────────────────────────\n    const now: number = Math.floor(Date.now() / 1000);\n    const candidateSession: SessionTokenPayload | undefined = verifiedSession ?? expiredSession;\n\n    // Config is required to call the token endpoint.\n    const hasRefreshConfig = !!(resolvedConfig.baseUrl && resolvedConfig.clientId && resolvedConfig.clientSecret);\n\n    // Refresh when:\n    //   a) Token is verified but within the proactive buffer window, OR\n    //   b) Token has already expired but a refresh token is available.\n    const needsRefresh: boolean =\n      !isValidOAuthCallback &&\n      hasRefreshConfig &&\n      !!candidateSession?.refreshToken &&\n      ((!!verifiedSession && verifiedSession.exp <= now + REFRESH_BUFFER_SECONDS) || !!expiredSession);\n\n    let activeSession: SessionTokenPayload | undefined = verifiedSession;\n    let refreshCookieUpdate: {expiry: number; token: string} | undefined;\n\n    if (needsRefresh && candidateSession) {\n      try {\n        const {newSessionToken, sessionCookieExpiryTime} = await handleRefreshToken(candidateSession, {\n          baseUrl: resolvedConfig.baseUrl!,\n          clientId: resolvedConfig.clientId!,\n          clientSecret: resolvedConfig.clientSecret!,\n          sessionCookie: resolvedConfig.sessionCookie,\n        });\n        // Verify the newly minted token so activeSession reflects fresh claims.\n        activeSession = await SessionManager.verifySessionToken(newSessionToken);\n        refreshCookieUpdate = {expiry: sessionCookieExpiryTime, token: newSessionToken};\n      } catch {\n        // Refresh failed — clear the irrecoverable session.\n        activeSession = undefined;\n      }\n    }\n\n    // ── Session cleanup detection ─────────────────────────────────────────────\n    // Mark stale cookies for deletion when the session is irrecoverable. Skipped\n    // during OAuth callbacks where a session cookie may not exist yet.\n    const rawSessionCookie: string | undefined = request.cookies.get(SessionManager.getSessionCookieName())?.value;\n\n    let shouldClearCookie = false;\n\n    if (!isValidOAuthCallback && rawSessionCookie && !activeSession && !refreshCookieUpdate) {\n      // A cookie was present but all resolution paths (verify, decode, refresh)\n      // failed — the session is dead and cannot be recovered.\n      shouldClearCookie = true;\n    }\n\n    const sessionId: string | undefined = activeSession?.sessionId ?? (await getSessionIdFromRequest(request));\n    const isAuthenticated = !!activeSession;\n\n    // ── Proxy context ─────────────────────────────────────────────────────────\n    const thunderid: ThunderIDProxyContext = {\n      getSession: async (): Promise<SessionTokenPayload | undefined> => activeSession,\n      getSessionId: (): string | undefined => sessionId,\n      isSignedIn: (): boolean => isAuthenticated,\n      protectRoute: async (routeOptions?: {redirect?: string}): Promise<NextResponse | void> => {\n        // Skip during a valid OAuth callback to avoid redirecting before the\n        // callback action has had a chance to complete.\n        if (isValidOAuthCallback) {\n          return undefined;\n        }\n\n        if (!isAuthenticated) {\n          const referer: string | null = request.headers.get('referer');\n          let fallbackRedirect = '/';\n\n          if (referer) {\n            try {\n              const refererUrl: URL = new URL(referer);\n              const requestUrl: URL = new URL(request.url);\n              if (refererUrl.origin === requestUrl.origin) {\n                fallbackRedirect = refererUrl.pathname + refererUrl.search;\n              }\n            } catch {\n              // Invalid referer — ignore.\n            }\n          }\n\n          const redirectUrl: string = routeOptions?.redirect ?? resolvedConfig.signInUrl! ?? fallbackRedirect;\n\n          return NextResponse.redirect(new URL(redirectUrl, request.url));\n        }\n\n        return undefined;\n      },\n    };\n\n    // ── Handler ───────────────────────────────────────────────────────────────\n    const handlerResponse: NextResponse | void = handler ? await handler(thunderid, request) : undefined;\n\n    // ── Build final response ──────────────────────────────────────────────────\n    if (shouldClearCookie) {\n      const cookieName: string = SessionManager.getSessionCookieName();\n\n      if (handlerResponse) {\n        // Handler returned a response (e.g. a redirect from protectRoute).\n        // Attach the deletion so the browser discards the stale cookie.\n        handlerResponse.cookies.delete(cookieName);\n        return handlerResponse;\n      }\n\n      // Pass-through: strip the dead cookie from the forwarded request headers\n      // so the same-request Server Component render sees no session at all.\n      const requestHeaders: Headers = new Headers(request.headers);\n      requestHeaders.set('cookie', removeCookieFromHeader(request.headers.get('cookie') ?? '', cookieName));\n      const cleanResponse: NextResponse = NextResponse.next({request: {headers: requestHeaders}});\n      cleanResponse.cookies.delete(cookieName);\n      return cleanResponse;\n    }\n\n    if (!refreshCookieUpdate) {\n      return handlerResponse ?? NextResponse.next();\n    }\n\n    // A token refresh occurred — the new session cookie must be applied to:\n    //   1. The HTTP response so the browser stores the updated cookie.\n    //   2. The forwarded request headers so the same-request Server Component\n    //      render reads the fresh session token instead of the expired one.\n    const cookieName: string = SessionManager.getSessionCookieName();\n    const cookieOptions: ReturnType<typeof SessionManager.getSessionCookieOptions> =\n      SessionManager.getSessionCookieOptions(refreshCookieUpdate.expiry);\n\n    if (handlerResponse) {\n      // Handler returned a response (e.g. a redirect from protectRoute).\n      // Attach the refresh cookie so the browser receives it even on redirects.\n      handlerResponse.cookies.set(cookieName, refreshCookieUpdate.token, cookieOptions);\n      return handlerResponse;\n    }\n\n    // Default pass-through: update both the response cookie and the request\n    // Cookie header so the downstream Server Component render is not stale.\n    const requestHeaders: Headers = new Headers(request.headers);\n    const updatedCookieHeader: string = replaceCookieInHeader(\n      request.headers.get('cookie') ?? '',\n      cookieName,\n      refreshCookieUpdate.token,\n    );\n    requestHeaders.set('cookie', updatedCookieHeader);\n\n    const response: NextResponse = NextResponse.next({request: {headers: requestHeaders}});\n    response.cookies.set(cookieName, refreshCookieUpdate.token, cookieOptions);\n    return response;\n  };\n\nexport default thunderIDProxy;\n"],"mappings":";;;;;;;;;;;;;AAwCA,MAAM,0BAA0B,cAAsB,SACpD,aACG,MAAM,IAAI,CACV,KAAK,MAAc,EAAE,MAAM,CAAC,CAC5B,QAAQ,MAAc;CACrB,MAAMA,QAAgB,EAAE,QAAQ,IAAI;AAEpC,SADyB,UAAU,KAAK,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,MAChD;EACpB,CACD,KAAK,KAAK;;;;;AAMf,MAAM,yBAAyB,cAAsB,MAAc,UAA0B;CAC3F,MAAMC,QAAkB,aACrB,MAAM,IAAI,CACV,KAAK,MAAc,EAAE,MAAM,CAAC,CAC5B,OAAO,QAAQ;CAElB,IAAI,QAAQ;CACZ,MAAMC,UAAoB,MAAM,KAAK,SAAiB;EACpD,MAAMF,QAAgB,KAAK,QAAQ,IAAI;AAEvC,OADyB,UAAU,KAAK,OAAO,KAAK,MAAM,GAAG,MAAM,CAAC,MAAM,MACzD,MAAM;AACrB,WAAQ;AACR,UAAO,GAAG,KAAK,GAAG;;AAEpB,SAAO;GACP;AAEF,KAAI,CAAC,MACH,SAAQ,KAAK,GAAG,KAAK,GAAG,QAAQ;AAGlC,QAAO,QAAQ,KAAK,KAAK;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAmD3B,MAAM,kBAEF,SACA,YAEF,OAAO,YAAgD;CAIrD,MAAMG,iBAAsCC,0CAHG,OAAO,YAAY,aAAa,QAAQ,QAAQ,GAAG,WAAW,EAAE,CAGF;CAG7G,MAAMC,MAAW,IAAI,IAAI,QAAQ,IAAI;CACrC,MAAMC,oBAA6B,IAAI,aAAa,IAAI,OAAO,IAAI,IAAI,aAAa,IAAI,QAAQ;CAEhG,IAAI,uBAAuB;AAC3B,KAAI,qBAAqB,CAAC,IAAI,aAAa,IAAI,QAAQ,EAAE;EACvD,MAAMC,mBAAuC,QAAQ,QAAQ,IAC3DC,+BAAe,0BAA0B,CAC1C,EAAE;AACH,MAAI,iBACF,KAAI;AACF,SAAMA,+BAAe,kBAAkB,iBAAiB;AACxD,0BAAuB;UACjB;AACN,0BAAuB;;;CAO7B,MAAMC,kBAAmD,MAAMC,2CAAsB,QAAQ;CAS7F,IAAIC;AACJ,KAAI,CAAC,iBAAiB;EACpB,MAAMC,WAA+B,QAAQ,QAAQ,IAAIJ,+BAAe,sBAAsB,CAAC,EAAE;AACjG,MAAI,SACF,KAAI;GACF,MAAMK,UAA+B,MAAML,+BAAe,6BAA6B,SAAS;AAChG,OAAI,QAAQ,aACV,kBAAiB;UAEb;;CAOZ,MAAMM,MAAc,KAAK,MAAM,KAAK,KAAK,GAAG,IAAK;CACjD,MAAMC,mBAAoD,mBAAmB;CAG7E,MAAM,mBAAmB,CAAC,EAAE,eAAe,WAAW,eAAe,YAAY,eAAe;CAKhG,MAAMC,eACJ,CAAC,wBACD,oBACA,CAAC,CAAC,kBAAkB,iBAClB,CAAC,CAAC,mBAAmB,gBAAgB,OAAO,MAAMC,mDAA2B,CAAC,CAAC;CAEnF,IAAIC,gBAAiD;CACrD,IAAIC;AAEJ,KAAI,gBAAgB,iBAClB,KAAI;EACF,MAAM,EAAC,iBAAiB,4BAA2B,MAAMC,mCAAmB,kBAAkB;GAC5F,SAAS,eAAe;GACxB,UAAU,eAAe;GACzB,cAAc,eAAe;GAC7B,eAAe,eAAe;GAC/B,CAAC;AAEF,kBAAgB,MAAMZ,+BAAe,mBAAmB,gBAAgB;AACxE,wBAAsB;GAAC,QAAQ;GAAyB,OAAO;GAAgB;SACzE;AAEN,kBAAgB;;CAOpB,MAAMa,mBAAuC,QAAQ,QAAQ,IAAIb,+BAAe,sBAAsB,CAAC,EAAE;CAEzG,IAAI,oBAAoB;AAExB,KAAI,CAAC,wBAAwB,oBAAoB,CAAC,iBAAiB,CAAC,oBAGlE,qBAAoB;CAGtB,MAAMc,YAAgC,eAAe,aAAc,MAAMC,6CAAwB,QAAQ;CACzG,MAAM,kBAAkB,CAAC,CAAC;CAwC1B,MAAMC,kBAAuC,UAAU,MAAM,QArCpB;EACvC,YAAY,YAAsD;EAClE,oBAAwC;EACxC,kBAA2B;EAC3B,cAAc,OAAO,iBAAqE;AAGxF,OAAI,qBACF;AAGF,OAAI,CAAC,iBAAiB;IACpB,MAAMC,UAAyB,QAAQ,QAAQ,IAAI,UAAU;IAC7D,IAAI,mBAAmB;AAEvB,QAAI,QACF,KAAI;KACF,MAAMC,aAAkB,IAAI,IAAI,QAAQ;KACxC,MAAMC,aAAkB,IAAI,IAAI,QAAQ,IAAI;AAC5C,SAAI,WAAW,WAAW,WAAW,OACnC,oBAAmB,WAAW,WAAW,WAAW;YAEhD;IAKV,MAAMC,cAAsB,cAAc,YAAY,eAAe,aAAc;AAEnF,WAAOC,yBAAa,SAAS,IAAI,IAAI,aAAa,QAAQ,IAAI,CAAC;;;EAKpE,EAG+E,QAAQ,GAAG;AAG3F,KAAI,mBAAmB;EACrB,MAAMC,eAAqBtB,+BAAe,sBAAsB;AAEhE,MAAI,iBAAiB;AAGnB,mBAAgB,QAAQ,OAAOuB,aAAW;AAC1C,UAAO;;EAKT,MAAMC,mBAA0B,IAAI,QAAQ,QAAQ,QAAQ;AAC5D,mBAAe,IAAI,UAAU,uBAAuB,QAAQ,QAAQ,IAAI,SAAS,IAAI,IAAID,aAAW,CAAC;EACrG,MAAME,gBAA8BJ,yBAAa,KAAK,EAAC,SAAS,EAAC,SAASK,kBAAe,EAAC,CAAC;AAC3F,gBAAc,QAAQ,OAAOH,aAAW;AACxC,SAAO;;AAGT,KAAI,CAAC,oBACH,QAAO,mBAAmBF,yBAAa,MAAM;CAO/C,MAAMC,aAAqBtB,+BAAe,sBAAsB;CAChE,MAAM2B,gBACJ3B,+BAAe,wBAAwB,oBAAoB,OAAO;AAEpE,KAAI,iBAAiB;AAGnB,kBAAgB,QAAQ,IAAI,YAAY,oBAAoB,OAAO,cAAc;AACjF,SAAO;;CAKT,MAAMwB,iBAA0B,IAAI,QAAQ,QAAQ,QAAQ;CAC5D,MAAMI,sBAA8B,sBAClC,QAAQ,QAAQ,IAAI,SAAS,IAAI,IACjC,YACA,oBAAoB,MACrB;AACD,gBAAe,IAAI,UAAU,oBAAoB;CAEjD,MAAMC,WAAyBR,yBAAa,KAAK,EAAC,SAAS,EAAC,SAAS,gBAAe,EAAC,CAAC;AACtF,UAAS,QAAQ,IAAI,YAAY,oBAAoB,OAAO,cAAc;AAC1E,QAAO;;AAGX,6BAAe"}
+{"version":3,"file":"thunderIDProxy.cjs","names":["eqIdx: number","entries: {name: string; part: string}[]","CookieChunking","remaining: string[]","newParts: string[]","resolvedConfig: ThunderIDNextConfig","decorateConfigWithNextEnv","url: URL","hasCallbackParams: boolean","tempSessionToken: string | undefined","SessionManager","verifiedSession: SessionTokenPayload | undefined","getSessionFromRequest","expiredSession: SessionTokenPayload | undefined","rawToken: string | undefined","getChunkedCookie","decoded: SessionTokenPayload","now: number","candidateSession: SessionTokenPayload | undefined","needsRefresh: boolean","REFRESH_BUFFER_SECONDS","activeSession: SessionTokenPayload | undefined","refreshCookieUpdate: {expiry: number; token: string} | undefined","handleRefreshToken","rawSessionCookie: string | undefined","sessionId: string | undefined","getSessionIdFromRequest","handlerResponse: NextResponse | void","referer: string | null","refererUrl: URL","requestUrl: URL","redirectUrl: string","NextResponse","cookieName: string","cookieName","requestHeaders: Headers","cleanResponse: NextResponse","requestHeaders","cookieOptions: ReturnType<typeof SessionManager.getSessionCookieOptions>","updatedCookieHeader: string","response: NextResponse"],"sources":["../../../../src/server/proxy/thunderIDProxy.ts"],"sourcesContent":["// Copyright 2025 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\nimport {CookieChunking} from '@thunderid/node';\nimport {NextRequest, NextResponse} from 'next/server';\nimport {REFRESH_BUFFER_SECONDS} from '../../constants/sessionConstants';\nimport {ThunderIDNextConfig} from '../../models/config';\nimport {\n  ChunkedCookieOptions,\n  ChunkedCookieWriter,\n  deleteChunkedCookie,\n  getChunkedCookie,\n  setChunkedCookie,\n} from '../../utils/chunkedCookie';\nimport decorateConfigWithNextEnv from '../../utils/decorateConfigWithNextEnv';\nimport handleRefreshToken from '../../utils/handleRefreshToken';\nimport SessionManager, {SessionTokenPayload} from '../../utils/SessionManager';\nimport {getSessionFromRequest, getSessionIdFromRequest} from '../../utils/sessionUtils';\n\nexport type ThunderIDProxyOptions = Partial<ThunderIDNextConfig>;\n\nexport interface ThunderIDProxyContext {\n  /** Get the session payload from JWT session if available */\n  getSession: () => Promise<SessionTokenPayload | undefined>;\n  /** Get the session ID from the current request */\n  getSessionId: () => string | undefined;\n  /** Check if the current request has a valid ThunderID session */\n  isSignedIn: () => boolean;\n  /**\n   * Protect a route by redirecting unauthenticated users.\n   * Redirect URL fallback order:\n   * 1. options.redirect\n   * 2. resolvedOptions.signInUrl\n   * 3. resolvedOptions.defaultRedirect\n   * 4. referer (if from same origin)\n   * If none are available, falls back to '/'.\n   */\n  protectRoute: (routeOptions?: {redirect?: string}) => Promise<NextResponse | void>;\n}\n\ntype ThunderIDProxyHandler = (\n  thunderid: ThunderIDProxyContext,\n  req: NextRequest,\n) => Promise<NextResponse | void> | NextResponse | void;\n\n/**\n * Splits a raw Cookie header string into its `{name, part}` entries, where\n * `part` is the original `name=value` text (trimmed, never empty).\n */\nconst parseCookieHeaderParts = (cookieHeader: string): {name: string; part: string}[] =>\n  cookieHeader\n    .split(';')\n    .map((p: string) => p.trim())\n    .filter(Boolean)\n    .map((part: string) => {\n      const eqIdx: number = part.indexOf('=');\n      const name: string = eqIdx === -1 ? part : part.slice(0, eqIdx).trim();\n      return {name, part};\n    });\n\n/**\n * Removes a cookie from a raw Cookie header string — the unchunked `name`\n * entry and/or any numbered `${name}.0`, `${name}.1`, ... chunk entries.\n */\nexport const removeChunkedCookieFromHeader = (cookieHeader: string, name: string): string => {\n  const entries: {name: string; part: string}[] = parseCookieHeaderParts(cookieHeader);\n  const toRemove = new Set<string>(\n    CookieChunking.filterChunkNames(\n      name,\n      entries.map((e) => e.name),\n    ),\n  );\n\n  return entries\n    .filter((e) => !toRemove.has(e.name))\n    .map((e) => e.part)\n    .join('; ');\n};\n\n/**\n * Replaces a cookie's value inside a raw Cookie header string, splitting it\n * across numbered `${name}.0`, `${name}.1`, ... chunk entries once it would\n * exceed the ~4KB per-cookie limit browsers enforce. Any entry the cookie\n * doesn't appear in yet is appended; stale chunk entries a shrunk value no\n * longer needs are dropped.\n */\nexport const replaceChunkedCookieInHeader = (cookieHeader: string, name: string, value: string): string => {\n  const remaining: string[] = parseCookieHeaderParts(removeChunkedCookieFromHeader(cookieHeader, name)).map(\n    (e) => e.part,\n  );\n  const newParts: string[] = Object.entries(CookieChunking.split(name, value)).map(\n    ([chunkName, chunkValue]: [string, string]) => `${chunkName}=${chunkValue}`,\n  );\n\n  return [...remaining, ...newParts].join('; ');\n};\n\n/**\n * Adapts a request/response pair into a {@link ChunkedCookieWriter}: existing\n * chunk names are discovered from the incoming request's cookies (what the\n * browser currently holds), while writes/deletes apply to the response.\n */\nconst toChunkedCookieWriter = (\n  request: NextRequest,\n  responseCookies: NextResponse['cookies'],\n): ChunkedCookieWriter => ({\n  delete: (name: string): void => {\n    responseCookies.delete(name);\n  },\n  getAll: (): {name: string}[] => request.cookies.getAll(),\n  set: (name: string, value: string, options: ChunkedCookieOptions): void => {\n    responseCookies.set(name, value, options);\n  },\n});\n\n/**\n * ThunderID proxy that integrates authentication into your Next.js application.\n * Similar to Clerk's clerkMiddleware pattern.\n *\n * Proactively refreshes the access token when it is within REFRESH_BUFFER_SECONDS of\n * expiry so that Server Components always receive a fresh session. The refresh also\n * recovers expired tokens as long as a refresh token is present.\n *\n * The updated session cookie is written to:\n *   - The response  → browser stores the new cookie for subsequent requests.\n *   - The forwarded request headers → the same-request Server Component render sees\n *     the fresh token immediately without waiting for the next navigation.\n *\n * Token refresh requires baseUrl, clientId, and clientSecret. These are resolved from\n * the options argument first, then from the standard ThunderID environment variables\n * (NEXT_PUBLIC_THUNDERID_BASE_URL, NEXT_PUBLIC_THUNDERID_CLIENT_ID,\n * THUNDERID_CLIENT_SECRET). If none are available the refresh step is skipped silently.\n *\n * @param handler - Optional handler function to customize proxy behavior\n * @param options - Configuration options for the proxy\n * @returns Next.js middleware function\n *\n * @example\n * ```typescript\n * // middleware.ts - Basic usage (config read from env vars automatically)\n * import { thunderIDProxy } from '@thunderid/nextjs/server';\n *\n * export default thunderIDProxy();\n *\n * export const config = {\n *   matcher: ['/((?!_next/static|_next/image|favicon.ico).*)'],\n * };\n * ```\n *\n * @example\n * ```typescript\n * // With route protection\n * import { thunderIDProxy, createRouteMatcher } from '@thunderid/nextjs/server';\n *\n * const isProtectedRoute = createRouteMatcher(['/dashboard(.*)']);\n *\n * export default thunderIDProxy(async (thunderid, req) => {\n *   if (isProtectedRoute(req)) {\n *     await thunderid.protectRoute();\n *   }\n * });\n * ```\n */\nconst thunderIDProxy =\n  (\n    handler?: ThunderIDProxyHandler,\n    options?: ThunderIDProxyOptions | ((req: NextRequest) => ThunderIDProxyOptions),\n  ): ((request: NextRequest) => Promise<NextResponse>) =>\n  async (request: NextRequest): Promise<NextResponse> => {\n    const resolvedOptions: ThunderIDProxyOptions = typeof options === 'function' ? options(request) : options || {};\n\n    // Resolve full config from passed options + environment variable fallbacks.\n    const resolvedConfig: ThunderIDNextConfig = decorateConfigWithNextEnv(resolvedOptions as ThunderIDNextConfig);\n\n    // ── OAuth callback detection ──────────────────────────────────────────────\n    const url: URL = new URL(request.url);\n    const hasCallbackParams: boolean = url.searchParams.has('code') && url.searchParams.has('state');\n\n    let isValidOAuthCallback = false;\n    if (hasCallbackParams && !url.searchParams.has('error')) {\n      const tempSessionToken: string | undefined = request.cookies.get(\n        SessionManager.getTempSessionCookieName(),\n      )?.value;\n      if (tempSessionToken) {\n        try {\n          await SessionManager.verifyTempSession(tempSessionToken);\n          isValidOAuthCallback = true;\n        } catch {\n          isValidOAuthCallback = false;\n        }\n      }\n    }\n\n    // ── Session resolution ────────────────────────────────────────────────────\n    // Step 1: Attempt to get a fully verified (signature + expiry) session.\n    const verifiedSession: SessionTokenPayload | undefined = await getSessionFromRequest(request);\n\n    // Step 2: If no verified session exists, verify the raw cookie's signature\n    // without enforcing expiry. This allows the proxy to recover from an\n    // expired access token as long as the JWT is authentic and a refresh token\n    // is present. Skipping the signature check here would let a tampered cookie\n    // drive identity-confusion attacks since handleRefreshToken reuses `sub`,\n    // `sessionId`, and `organizationId` from the input payload when minting the\n    // new session JWT.\n    let expiredSession: SessionTokenPayload | undefined;\n    if (!verifiedSession) {\n      const rawToken: string | undefined = getChunkedCookie(request.cookies, SessionManager.getSessionCookieName());\n      if (rawToken) {\n        try {\n          const decoded: SessionTokenPayload = await SessionManager.verifySessionTokenForRefresh(rawToken);\n          if (decoded.refreshToken) {\n            expiredSession = decoded;\n          }\n        } catch {\n          // Forged, tampered, wrong type, or malformed — ignore.\n        }\n      }\n    }\n\n    // ── Token refresh ─────────────────────────────────────────────────────────\n    const now: number = Math.floor(Date.now() / 1000);\n    const candidateSession: SessionTokenPayload | undefined = verifiedSession ?? expiredSession;\n\n    // Config is required to call the token endpoint.\n    const hasRefreshConfig = !!(resolvedConfig.baseUrl && resolvedConfig.clientId && resolvedConfig.clientSecret);\n\n    // Refresh when:\n    //   a) Token is verified but within the proactive buffer window, OR\n    //   b) Token has already expired but a refresh token is available.\n    const needsRefresh: boolean =\n      !isValidOAuthCallback &&\n      hasRefreshConfig &&\n      !!candidateSession?.refreshToken &&\n      ((!!verifiedSession && verifiedSession.exp <= now + REFRESH_BUFFER_SECONDS) || !!expiredSession);\n\n    let activeSession: SessionTokenPayload | undefined = verifiedSession;\n    let refreshCookieUpdate: {expiry: number; token: string} | undefined;\n\n    if (needsRefresh && candidateSession) {\n      try {\n        const {newSessionToken, sessionCookieExpiryTime} = await handleRefreshToken(candidateSession, {\n          baseUrl: resolvedConfig.baseUrl!,\n          clientId: resolvedConfig.clientId!,\n          clientSecret: resolvedConfig.clientSecret!,\n          sessionCookie: resolvedConfig.sessionCookie,\n        });\n        // Verify the newly minted token so activeSession reflects fresh claims.\n        activeSession = await SessionManager.verifySessionToken(newSessionToken);\n        refreshCookieUpdate = {expiry: sessionCookieExpiryTime, token: newSessionToken};\n      } catch {\n        // Refresh failed — clear the irrecoverable session.\n        activeSession = undefined;\n      }\n    }\n\n    // ── Session cleanup detection ─────────────────────────────────────────────\n    // Mark stale cookies for deletion when the session is irrecoverable. Skipped\n    // during OAuth callbacks where a session cookie may not exist yet.\n    const rawSessionCookie: string | undefined = getChunkedCookie(\n      request.cookies,\n      SessionManager.getSessionCookieName(),\n    );\n\n    let shouldClearCookie = false;\n\n    if (!isValidOAuthCallback && rawSessionCookie && !activeSession && !refreshCookieUpdate) {\n      // A cookie was present but all resolution paths (verify, decode, refresh)\n      // failed — the session is dead and cannot be recovered.\n      shouldClearCookie = true;\n    }\n\n    const sessionId: string | undefined = activeSession?.sessionId ?? (await getSessionIdFromRequest(request));\n    const isAuthenticated = !!activeSession;\n\n    // ── Proxy context ─────────────────────────────────────────────────────────\n    const thunderid: ThunderIDProxyContext = {\n      getSession: async (): Promise<SessionTokenPayload | undefined> => activeSession,\n      getSessionId: (): string | undefined => sessionId,\n      isSignedIn: (): boolean => isAuthenticated,\n      protectRoute: async (routeOptions?: {redirect?: string}): Promise<NextResponse | void> => {\n        // Skip during a valid OAuth callback to avoid redirecting before the\n        // callback action has had a chance to complete.\n        if (isValidOAuthCallback) {\n          return undefined;\n        }\n\n        if (!isAuthenticated) {\n          const referer: string | null = request.headers.get('referer');\n          let fallbackRedirect = '/';\n\n          if (referer) {\n            try {\n              const refererUrl: URL = new URL(referer);\n              const requestUrl: URL = new URL(request.url);\n              if (refererUrl.origin === requestUrl.origin) {\n                fallbackRedirect = refererUrl.pathname + refererUrl.search;\n              }\n            } catch {\n              // Invalid referer — ignore.\n            }\n          }\n\n          const redirectUrl: string = routeOptions?.redirect ?? resolvedConfig.signInUrl! ?? fallbackRedirect;\n\n          return NextResponse.redirect(new URL(redirectUrl, request.url));\n        }\n\n        return undefined;\n      },\n    };\n\n    // ── Handler ───────────────────────────────────────────────────────────────\n    const handlerResponse: NextResponse | void = handler ? await handler(thunderid, request) : undefined;\n\n    // ── Build final response ──────────────────────────────────────────────────\n    if (shouldClearCookie) {\n      const cookieName: string = SessionManager.getSessionCookieName();\n\n      if (handlerResponse) {\n        // Handler returned a response (e.g. a redirect from protectRoute).\n        // Attach the deletion so the browser discards the stale cookie (and\n        // every chunk of it).\n        deleteChunkedCookie(toChunkedCookieWriter(request, handlerResponse.cookies), cookieName);\n        return handlerResponse;\n      }\n\n      // Pass-through: strip the dead cookie from the forwarded request headers\n      // so the same-request Server Component render sees no session at all.\n      const requestHeaders: Headers = new Headers(request.headers);\n      requestHeaders.set('cookie', removeChunkedCookieFromHeader(request.headers.get('cookie') ?? '', cookieName));\n      const cleanResponse: NextResponse = NextResponse.next({request: {headers: requestHeaders}});\n      deleteChunkedCookie(toChunkedCookieWriter(request, cleanResponse.cookies), cookieName);\n      return cleanResponse;\n    }\n\n    if (!refreshCookieUpdate) {\n      return handlerResponse ?? NextResponse.next();\n    }\n\n    // A token refresh occurred — the new session cookie must be applied to:\n    //   1. The HTTP response so the browser stores the updated cookie.\n    //   2. The forwarded request headers so the same-request Server Component\n    //      render reads the fresh session token instead of the expired one.\n    const cookieName: string = SessionManager.getSessionCookieName();\n    const cookieOptions: ReturnType<typeof SessionManager.getSessionCookieOptions> =\n      SessionManager.getSessionCookieOptions(refreshCookieUpdate.expiry);\n\n    if (handlerResponse) {\n      // Handler returned a response (e.g. a redirect from protectRoute).\n      // Attach the refresh cookie so the browser receives it even on redirects.\n      setChunkedCookie(\n        toChunkedCookieWriter(request, handlerResponse.cookies),\n        cookieName,\n        refreshCookieUpdate.token,\n        cookieOptions,\n      );\n      return handlerResponse;\n    }\n\n    // Default pass-through: update both the response cookie and the request\n    // Cookie header so the downstream Server Component render is not stale.\n    const requestHeaders: Headers = new Headers(request.headers);\n    const updatedCookieHeader: string = replaceChunkedCookieInHeader(\n      request.headers.get('cookie') ?? '',\n      cookieName,\n      refreshCookieUpdate.token,\n    );\n    requestHeaders.set('cookie', updatedCookieHeader);\n\n    const response: NextResponse = NextResponse.next({request: {headers: requestHeaders}});\n    setChunkedCookie(\n      toChunkedCookieWriter(request, response.cookies),\n      cookieName,\n      refreshCookieUpdate.token,\n      cookieOptions,\n    );\n    return response;\n  };\n\nexport default thunderIDProxy;\n"],"mappings":";;;;;;;;;;;;;;;;;AAiDA,MAAM,0BAA0B,iBAC9B,aACG,MAAM,IAAI,CACV,KAAK,MAAc,EAAE,MAAM,CAAC,CAC5B,OAAO,QAAQ,CACf,KAAK,SAAiB;CACrB,MAAMA,QAAgB,KAAK,QAAQ,IAAI;AAEvC,QAAO;EAAC,MADa,UAAU,KAAK,OAAO,KAAK,MAAM,GAAG,MAAM,CAAC,MAAM;EACxD;EAAK;EACnB;;;;;AAMN,MAAa,iCAAiC,cAAsB,SAAyB;CAC3F,MAAMC,UAA0C,uBAAuB,aAAa;CACpF,MAAM,WAAW,IAAI,IACnBC,gCAAe,iBACb,MACA,QAAQ,KAAK,MAAM,EAAE,KAAK,CAC3B,CACF;AAED,QAAO,QACJ,QAAQ,MAAM,CAAC,SAAS,IAAI,EAAE,KAAK,CAAC,CACpC,KAAK,MAAM,EAAE,KAAK,CAClB,KAAK,KAAK;;;;;;;;;AAUf,MAAa,gCAAgC,cAAsB,MAAc,UAA0B;CACzG,MAAMC,YAAsB,uBAAuB,8BAA8B,cAAc,KAAK,CAAC,CAAC,KACnG,MAAM,EAAE,KACV;CACD,MAAMC,WAAqB,OAAO,QAAQF,gCAAe,MAAM,MAAM,MAAM,CAAC,CAAC,KAC1E,CAAC,WAAW,gBAAkC,GAAG,UAAU,GAAG,aAChE;AAED,QAAO,CAAC,GAAG,WAAW,GAAG,SAAS,CAAC,KAAK,KAAK;;;;;;;AAQ/C,MAAM,yBACJ,SACA,qBACyB;CACzB,SAAS,SAAuB;AAC9B,kBAAgB,OAAO,KAAK;;CAE9B,cAAgC,QAAQ,QAAQ,QAAQ;CACxD,MAAM,MAAc,OAAe,YAAwC;AACzE,kBAAgB,IAAI,MAAM,OAAO,QAAQ;;CAE5C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAkDD,MAAM,kBAEF,SACA,YAEF,OAAO,YAAgD;CAIrD,MAAMG,iBAAsCC,0CAHG,OAAO,YAAY,aAAa,QAAQ,QAAQ,GAAG,WAAW,EAAE,CAGF;CAG7G,MAAMC,MAAW,IAAI,IAAI,QAAQ,IAAI;CACrC,MAAMC,oBAA6B,IAAI,aAAa,IAAI,OAAO,IAAI,IAAI,aAAa,IAAI,QAAQ;CAEhG,IAAI,uBAAuB;AAC3B,KAAI,qBAAqB,CAAC,IAAI,aAAa,IAAI,QAAQ,EAAE;EACvD,MAAMC,mBAAuC,QAAQ,QAAQ,IAC3DC,+BAAe,0BAA0B,CAC1C,EAAE;AACH,MAAI,iBACF,KAAI;AACF,SAAMA,+BAAe,kBAAkB,iBAAiB;AACxD,0BAAuB;UACjB;AACN,0BAAuB;;;CAO7B,MAAMC,kBAAmD,MAAMC,2CAAsB,QAAQ;CAS7F,IAAIC;AACJ,KAAI,CAAC,iBAAiB;EACpB,MAAMC,WAA+BC,uCAAiB,QAAQ,SAASL,+BAAe,sBAAsB,CAAC;AAC7G,MAAI,SACF,KAAI;GACF,MAAMM,UAA+B,MAAMN,+BAAe,6BAA6B,SAAS;AAChG,OAAI,QAAQ,aACV,kBAAiB;UAEb;;CAOZ,MAAMO,MAAc,KAAK,MAAM,KAAK,KAAK,GAAG,IAAK;CACjD,MAAMC,mBAAoD,mBAAmB;CAG7E,MAAM,mBAAmB,CAAC,EAAE,eAAe,WAAW,eAAe,YAAY,eAAe;CAKhG,MAAMC,eACJ,CAAC,wBACD,oBACA,CAAC,CAAC,kBAAkB,iBAClB,CAAC,CAAC,mBAAmB,gBAAgB,OAAO,MAAMC,mDAA2B,CAAC,CAAC;CAEnF,IAAIC,gBAAiD;CACrD,IAAIC;AAEJ,KAAI,gBAAgB,iBAClB,KAAI;EACF,MAAM,EAAC,iBAAiB,4BAA2B,MAAMC,mCAAmB,kBAAkB;GAC5F,SAAS,eAAe;GACxB,UAAU,eAAe;GACzB,cAAc,eAAe;GAC7B,eAAe,eAAe;GAC/B,CAAC;AAEF,kBAAgB,MAAMb,+BAAe,mBAAmB,gBAAgB;AACxE,wBAAsB;GAAC,QAAQ;GAAyB,OAAO;GAAgB;SACzE;AAEN,kBAAgB;;CAOpB,MAAMc,mBAAuCT,uCAC3C,QAAQ,SACRL,+BAAe,sBAAsB,CACtC;CAED,IAAI,oBAAoB;AAExB,KAAI,CAAC,wBAAwB,oBAAoB,CAAC,iBAAiB,CAAC,oBAGlE,qBAAoB;CAGtB,MAAMe,YAAgC,eAAe,aAAc,MAAMC,6CAAwB,QAAQ;CACzG,MAAM,kBAAkB,CAAC,CAAC;CAwC1B,MAAMC,kBAAuC,UAAU,MAAM,QArCpB;EACvC,YAAY,YAAsD;EAClE,oBAAwC;EACxC,kBAA2B;EAC3B,cAAc,OAAO,iBAAqE;AAGxF,OAAI,qBACF;AAGF,OAAI,CAAC,iBAAiB;IACpB,MAAMC,UAAyB,QAAQ,QAAQ,IAAI,UAAU;IAC7D,IAAI,mBAAmB;AAEvB,QAAI,QACF,KAAI;KACF,MAAMC,aAAkB,IAAI,IAAI,QAAQ;KACxC,MAAMC,aAAkB,IAAI,IAAI,QAAQ,IAAI;AAC5C,SAAI,WAAW,WAAW,WAAW,OACnC,oBAAmB,WAAW,WAAW,WAAW;YAEhD;IAKV,MAAMC,cAAsB,cAAc,YAAY,eAAe,aAAc;AAEnF,WAAOC,yBAAa,SAAS,IAAI,IAAI,aAAa,QAAQ,IAAI,CAAC;;;EAKpE,EAG+E,QAAQ,GAAG;AAG3F,KAAI,mBAAmB;EACrB,MAAMC,eAAqBvB,+BAAe,sBAAsB;AAEhE,MAAI,iBAAiB;AAInB,6CAAoB,sBAAsB,SAAS,gBAAgB,QAAQ,EAAEwB,aAAW;AACxF,UAAO;;EAKT,MAAMC,mBAA0B,IAAI,QAAQ,QAAQ,QAAQ;AAC5D,mBAAe,IAAI,UAAU,8BAA8B,QAAQ,QAAQ,IAAI,SAAS,IAAI,IAAID,aAAW,CAAC;EAC5G,MAAME,gBAA8BJ,yBAAa,KAAK,EAAC,SAAS,EAAC,SAASK,kBAAe,EAAC,CAAC;AAC3F,4CAAoB,sBAAsB,SAAS,cAAc,QAAQ,EAAEH,aAAW;AACtF,SAAO;;AAGT,KAAI,CAAC,oBACH,QAAO,mBAAmBF,yBAAa,MAAM;CAO/C,MAAMC,aAAqBvB,+BAAe,sBAAsB;CAChE,MAAM4B,gBACJ5B,+BAAe,wBAAwB,oBAAoB,OAAO;AAEpE,KAAI,iBAAiB;AAGnB,yCACE,sBAAsB,SAAS,gBAAgB,QAAQ,EACvD,YACA,oBAAoB,OACpB,cACD;AACD,SAAO;;CAKT,MAAMyB,iBAA0B,IAAI,QAAQ,QAAQ,QAAQ;CAC5D,MAAMI,sBAA8B,6BAClC,QAAQ,QAAQ,IAAI,SAAS,IAAI,IACjC,YACA,oBAAoB,MACrB;AACD,gBAAe,IAAI,UAAU,oBAAoB;CAEjD,MAAMC,WAAyBR,yBAAa,KAAK,EAAC,SAAS,EAAC,SAAS,gBAAe,EAAC,CAAC;AACtF,wCACE,sBAAsB,SAAS,SAAS,QAAQ,EAChD,YACA,oBAAoB,OACpB,cACD;AACD,QAAO;;AAGX,6BAAe"}

package/dist/cjs/utils/chunkedCookie.cjs

@@ -0,0 +1,50 @@
+const require_rolldown_runtime = require('../_virtual/rolldown_runtime.cjs');
+let __thunderid_node = require("@thunderid/node");
+__thunderid_node = require_rolldown_runtime.__toESM(__thunderid_node);
+
+//#region src/utils/chunkedCookie.ts
+/**
+* Read a cookie that may have been split across `${name}.0`, `${name}.1`,
+* ... chunks, reassembling it into the original value. Falls back to the
+* unchunked `name` cookie when the value fit in a single cookie.
+*/
+function getChunkedCookie(store, name) {
+	return __thunderid_node.CookieChunking.join(name, (cookieName) => store.get(cookieName)?.value);
+}
+/**
+* Write a cookie value, splitting it across numbered `${name}.0`,
+* `${name}.1`, ... chunks once it would exceed the ~4KB per-cookie limit
+* browsers enforce, and reassembling transparently via {@link getChunkedCookie}.
+*
+* Clears any cookie names the previous value needed but the new one doesn't
+* (e.g. a smaller re-issued session that now fits in fewer chunks, or in a
+* single unchunked cookie). `store.getAll()` is used to discover those stale
+* names, so pass the store that reflects the cookies already present (for
+* `cookies()` that's the same store being written to; for middleware it
+* should be an adapter backed by the incoming `NextRequest.cookies`).
+*/
+function setChunkedCookie(store, name, value, options) {
+	const existing = __thunderid_node.CookieChunking.filterChunkNames(name, store.getAll().map((cookie) => cookie.name));
+	const newChunks = __thunderid_node.CookieChunking.split(name, value);
+	const newNames = new Set(Object.keys(newChunks));
+	for (const existingName of existing) if (!newNames.has(existingName)) store.delete(existingName);
+	for (const [chunkName, chunkValue] of Object.entries(newChunks)) store.set(chunkName, chunkValue, options);
+}
+/**
+* Delete a cookie that may have been chunked — clears the base cookie name
+* and every numbered chunk present in `store`.
+*/
+function deleteChunkedCookie(store, name) {
+	const existing = __thunderid_node.CookieChunking.filterChunkNames(name, store.getAll().map((cookie) => cookie.name));
+	if (existing.length === 0) {
+		store.delete(name);
+		return;
+	}
+	for (const existingName of existing) store.delete(existingName);
+}
+
+//#endregion
+exports.deleteChunkedCookie = deleteChunkedCookie;
+exports.getChunkedCookie = getChunkedCookie;
+exports.setChunkedCookie = setChunkedCookie;
+//# sourceMappingURL=chunkedCookie.cjs.map

package/dist/cjs/utils/chunkedCookie.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"chunkedCookie.cjs","names":["CookieChunking","existing: string[]","newChunks: Record<string, string>"],"sources":["../../../src/utils/chunkedCookie.ts"],"sourcesContent":["// Copyright 2025 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\nimport {CookieChunking} from '@thunderid/node';\n\nexport interface ChunkedCookieOptions {\n  httpOnly: boolean;\n  maxAge: number;\n  path: string;\n  sameSite: 'lax';\n  secure: boolean;\n}\n\n/** Minimal shape shared by `cookies()` (next/headers) and `NextRequest.cookies`. */\nexport interface ChunkedCookieReader {\n  get(name: string): {value: string} | undefined;\n}\n\n/** Minimal shape shared by `cookies()` (next/headers) and `NextResponse.cookies`. */\nexport interface ChunkedCookieWriter {\n  delete(name: string): void;\n  getAll(): {name: string}[];\n  set(name: string, value: string, options: ChunkedCookieOptions): void;\n}\n\n/**\n * Read a cookie that may have been split across `${name}.0`, `${name}.1`,\n * ... chunks, reassembling it into the original value. Falls back to the\n * unchunked `name` cookie when the value fit in a single cookie.\n */\nexport function getChunkedCookie(store: ChunkedCookieReader, name: string): string | undefined {\n  return CookieChunking.join(name, (cookieName: string) => store.get(cookieName)?.value);\n}\n\n/**\n * Write a cookie value, splitting it across numbered `${name}.0`,\n * `${name}.1`, ... chunks once it would exceed the ~4KB per-cookie limit\n * browsers enforce, and reassembling transparently via {@link getChunkedCookie}.\n *\n * Clears any cookie names the previous value needed but the new one doesn't\n * (e.g. a smaller re-issued session that now fits in fewer chunks, or in a\n * single unchunked cookie). `store.getAll()` is used to discover those stale\n * names, so pass the store that reflects the cookies already present (for\n * `cookies()` that's the same store being written to; for middleware it\n * should be an adapter backed by the incoming `NextRequest.cookies`).\n */\nexport function setChunkedCookie(\n  store: ChunkedCookieWriter,\n  name: string,\n  value: string,\n  options: ChunkedCookieOptions,\n): void {\n  const existing: string[] = CookieChunking.filterChunkNames(\n    name,\n    store.getAll().map((cookie: {name: string}) => cookie.name),\n  );\n  const newChunks: Record<string, string> = CookieChunking.split(name, value);\n  const newNames = new Set<string>(Object.keys(newChunks));\n\n  for (const existingName of existing) {\n    if (!newNames.has(existingName)) {\n      store.delete(existingName);\n    }\n  }\n\n  for (const [chunkName, chunkValue] of Object.entries(newChunks)) {\n    store.set(chunkName, chunkValue, options);\n  }\n}\n\n/**\n * Delete a cookie that may have been chunked — clears the base cookie name\n * and every numbered chunk present in `store`.\n */\nexport function deleteChunkedCookie(store: ChunkedCookieWriter, name: string): void {\n  const existing: string[] = CookieChunking.filterChunkNames(\n    name,\n    store.getAll().map((cookie: {name: string}) => cookie.name),\n  );\n\n  if (existing.length === 0) {\n    store.delete(name);\n    return;\n  }\n\n  for (const existingName of existing) {\n    store.delete(existingName);\n  }\n}\n"],"mappings":";;;;;;;;;;AA8BA,SAAgB,iBAAiB,OAA4B,MAAkC;AAC7F,QAAOA,gCAAe,KAAK,OAAO,eAAuB,MAAM,IAAI,WAAW,EAAE,MAAM;;;;;;;;;;;;;;AAexF,SAAgB,iBACd,OACA,MACA,OACA,SACM;CACN,MAAMC,WAAqBD,gCAAe,iBACxC,MACA,MAAM,QAAQ,CAAC,KAAK,WAA2B,OAAO,KAAK,CAC5D;CACD,MAAME,YAAoCF,gCAAe,MAAM,MAAM,MAAM;CAC3E,MAAM,WAAW,IAAI,IAAY,OAAO,KAAK,UAAU,CAAC;AAExD,MAAK,MAAM,gBAAgB,SACzB,KAAI,CAAC,SAAS,IAAI,aAAa,CAC7B,OAAM,OAAO,aAAa;AAI9B,MAAK,MAAM,CAAC,WAAW,eAAe,OAAO,QAAQ,UAAU,CAC7D,OAAM,IAAI,WAAW,YAAY,QAAQ;;;;;;AAQ7C,SAAgB,oBAAoB,OAA4B,MAAoB;CAClF,MAAMC,WAAqBD,gCAAe,iBACxC,MACA,MAAM,QAAQ,CAAC,KAAK,WAA2B,OAAO,KAAK,CAC5D;AAED,KAAI,SAAS,WAAW,GAAG;AACzB,QAAM,OAAO,KAAK;AAClB;;AAGF,MAAK,MAAM,gBAAgB,SACzB,OAAM,OAAO,aAAa"}

package/dist/cjs/utils/sessionUtils.cjs

@@ -1,3 +1,4 @@
+const require_chunkedCookie = require('./chunkedCookie.cjs');
 const require_SessionManager = require('./SessionManager.cjs');
 
 //#region src/utils/sessionUtils.ts
@@ -10,7 +11,7 @@ const require_SessionManager = require('./SessionManager.cjs');
 */
 const getSessionFromRequest = async (request) => {
 	try {
-		const sessionToken = request.cookies.get(require_SessionManager.default.getSessionCookieName())?.value;
+		const sessionToken = require_chunkedCookie.getChunkedCookie(request.cookies, require_SessionManager.default.getSessionCookieName());
 		if (!sessionToken) return;
 		return await require_SessionManager.default.verifySessionToken(sessionToken);
 	} catch {

package/dist/cjs/utils/sessionUtils.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"sessionUtils.cjs","names":["sessionToken: string | undefined","SessionManager","sessionPayload: SessionTokenPayload | undefined"],"sources":["../../../src/utils/sessionUtils.ts"],"sourcesContent":["// Copyright 2025 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\nimport {NextRequest} from 'next/server';\nimport SessionManager, {SessionTokenPayload} from './SessionManager';\n\n/**\n * Checks if a request has a valid session cookie (JWT).\n * This verifies the JWT signature and expiration.\n *\n * @param request - The Next.js request object\n * @returns True if a valid session exists, false otherwise\n */\nexport const hasValidSession = async (request: NextRequest): Promise<boolean> => {\n  try {\n    const sessionToken: string | undefined = request.cookies.get(SessionManager.getSessionCookieName())?.value;\n    if (!sessionToken) {\n      return false;\n    }\n\n    await SessionManager.verifySessionToken(sessionToken);\n    return true;\n  } catch {\n    return false;\n  }\n};\n\n/**\n * Gets the session payload from the request cookies.\n * This includes user ID, session ID, and scopes.\n *\n * @param request - The Next.js request object\n * @returns The session payload if valid, undefined otherwise\n */\nexport const getSessionFromRequest = async (request: NextRequest): Promise<SessionTokenPayload | undefined> => {\n  try {\n    const sessionToken: string | undefined = request.cookies.get(SessionManager.getSessionCookieName())?.value;\n    if (!sessionToken) {\n      return undefined;\n    }\n\n    return await SessionManager.verifySessionToken(sessionToken);\n  } catch {\n    return undefined;\n  }\n};\n\n/**\n * Gets the session ID from the request cookies (legacy support).\n * First tries to get from JWT session, then falls back to legacy session ID cookie.\n *\n * @param request - The Next.js request object\n * @returns The session ID if it exists, undefined otherwise\n */\nexport const getSessionIdFromRequest = async (request: NextRequest): Promise<string | undefined> => {\n  try {\n    const sessionPayload: SessionTokenPayload | undefined = await getSessionFromRequest(request);\n\n    if (sessionPayload) {\n      return sessionPayload.sessionId;\n    }\n\n    return await Promise.resolve(undefined);\n  } catch {\n    return Promise.resolve(undefined);\n  }\n};\n\n/**\n * Gets the temporary session ID from request cookies.\n *\n * @param request - The Next.js request object\n * @returns The temporary session ID if valid, undefined otherwise\n */\nexport const getTempSessionFromRequest = async (request: NextRequest): Promise<string | undefined> => {\n  try {\n    const tempToken: string | undefined = request.cookies.get(SessionManager.getTempSessionCookieName())?.value;\n    if (!tempToken) {\n      return undefined;\n    }\n\n    const tempSession: {sessionId: string} = await SessionManager.verifyTempSession(tempToken);\n    return tempSession.sessionId;\n  } catch {\n    return undefined;\n  }\n};\n"],"mappings":";;;;;;;;;;AAkCA,MAAa,wBAAwB,OAAO,YAAmE;AAC7G,KAAI;EACF,MAAMA,eAAmC,QAAQ,QAAQ,IAAIC,+BAAe,sBAAsB,CAAC,EAAE;AACrG,MAAI,CAAC,aACH;AAGF,SAAO,MAAMA,+BAAe,mBAAmB,aAAa;SACtD;AACN;;;;;;;;;;AAWJ,MAAa,0BAA0B,OAAO,YAAsD;AAClG,KAAI;EACF,MAAMC,iBAAkD,MAAM,sBAAsB,QAAQ;AAE5F,MAAI,eACF,QAAO,eAAe;AAGxB,SAAO,MAAM,QAAQ,QAAQ,OAAU;SACjC;AACN,SAAO,QAAQ,QAAQ,OAAU"}
+{"version":3,"file":"sessionUtils.cjs","names":["sessionToken: string | undefined","getChunkedCookie","SessionManager","sessionPayload: SessionTokenPayload | undefined"],"sources":["../../../src/utils/sessionUtils.ts"],"sourcesContent":["// Copyright 2025 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\nimport {NextRequest} from 'next/server';\nimport {getChunkedCookie} from './chunkedCookie';\nimport SessionManager, {SessionTokenPayload} from './SessionManager';\n\n/**\n * Checks if a request has a valid session cookie (JWT).\n * This verifies the JWT signature and expiration.\n *\n * @param request - The Next.js request object\n * @returns True if a valid session exists, false otherwise\n */\nexport const hasValidSession = async (request: NextRequest): Promise<boolean> => {\n  try {\n    const sessionToken: string | undefined = getChunkedCookie(request.cookies, SessionManager.getSessionCookieName());\n    if (!sessionToken) {\n      return false;\n    }\n\n    await SessionManager.verifySessionToken(sessionToken);\n    return true;\n  } catch {\n    return false;\n  }\n};\n\n/**\n * Gets the session payload from the request cookies.\n * This includes user ID, session ID, and scopes.\n *\n * @param request - The Next.js request object\n * @returns The session payload if valid, undefined otherwise\n */\nexport const getSessionFromRequest = async (request: NextRequest): Promise<SessionTokenPayload | undefined> => {\n  try {\n    const sessionToken: string | undefined = getChunkedCookie(request.cookies, SessionManager.getSessionCookieName());\n    if (!sessionToken) {\n      return undefined;\n    }\n\n    return await SessionManager.verifySessionToken(sessionToken);\n  } catch {\n    return undefined;\n  }\n};\n\n/**\n * Gets the session ID from the request cookies (legacy support).\n * First tries to get from JWT session, then falls back to legacy session ID cookie.\n *\n * @param request - The Next.js request object\n * @returns The session ID if it exists, undefined otherwise\n */\nexport const getSessionIdFromRequest = async (request: NextRequest): Promise<string | undefined> => {\n  try {\n    const sessionPayload: SessionTokenPayload | undefined = await getSessionFromRequest(request);\n\n    if (sessionPayload) {\n      return sessionPayload.sessionId;\n    }\n\n    return await Promise.resolve(undefined);\n  } catch {\n    return Promise.resolve(undefined);\n  }\n};\n\n/**\n * Gets the temporary session ID from request cookies.\n *\n * @param request - The Next.js request object\n * @returns The temporary session ID if valid, undefined otherwise\n */\nexport const getTempSessionFromRequest = async (request: NextRequest): Promise<string | undefined> => {\n  try {\n    const tempToken: string | undefined = request.cookies.get(SessionManager.getTempSessionCookieName())?.value;\n    if (!tempToken) {\n      return undefined;\n    }\n\n    const tempSession: {sessionId: string} = await SessionManager.verifyTempSession(tempToken);\n    return tempSession.sessionId;\n  } catch {\n    return undefined;\n  }\n};\n"],"mappings":";;;;;;;;;;;AAmCA,MAAa,wBAAwB,OAAO,YAAmE;AAC7G,KAAI;EACF,MAAMA,eAAmCC,uCAAiB,QAAQ,SAASC,+BAAe,sBAAsB,CAAC;AACjH,MAAI,CAAC,aACH;AAGF,SAAO,MAAMA,+BAAe,mBAAmB,aAAa;SACtD;AACN;;;;;;;;;;AAWJ,MAAa,0BAA0B,OAAO,YAAsD;AAClG,KAAI;EACF,MAAMC,iBAAkD,MAAM,sBAAsB,QAAQ;AAE5F,MAAI,eACF,QAAO,eAAe;AAGxB,SAAO,MAAM,QAAQ,QAAQ,OAAU;SACjC;AACN,SAAO,QAAQ,QAAQ,OAAU"}

package/dist/client/components/presentation/UserProfile/UserProfile.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"UserProfile.d.ts","sourceRoot":"","sources":["../../../../../src/client/components/presentation/UserProfile/UserProfile.tsx"],"names":[],"mappings":"AAMA,OAAO,EAAkB,oBAAoB,EAA0B,MAAM,kBAAkB,CAAC;AAChG,OAAO,EAAC,EAAE,EAAyB,MAAM,OAAO,CAAC;AAIjD;;;GAGG;AACH,MAAM,MAAM,gBAAgB,GAAG,IAAI,CAAC,oBAAoB,EAAE,MAAM,GAAG,SAAS,GAAG,kBAAkB,CAAC,CAAC;AAEnG;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,QAAA,MAAM,WAAW,EAAE,EAAE,CAAC,gBAAgB,CAkDrC,CAAC;AAEF,eAAe,WAAW,CAAC"}
+{"version":3,"file":"UserProfile.d.ts","sourceRoot":"","sources":["../../../../../src/client/components/presentation/UserProfile/UserProfile.tsx"],"names":[],"mappings":"AAMA,OAAO,EAAkB,oBAAoB,EAA0B,MAAM,kBAAkB,CAAC;AAChG,OAAO,EAAC,EAAE,EAAyB,MAAM,OAAO,CAAC;AAIjD;;;GAGG;AACH,MAAM,MAAM,gBAAgB,GAAG,IAAI,CAAC,oBAAoB,EAAE,MAAM,GAAG,SAAS,GAAG,kBAAkB,CAAC,CAAC;AAEnG;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,QAAA,MAAM,WAAW,EAAE,EAAE,CAAC,gBAAgB,CAmDrC,CAAC;AAEF,eAAe,WAAW,CAAC"}

package/dist/client/components/presentation/UserProfile/UserProfile.js

@@ -34,7 +34,7 @@ import { jsx } from "react/jsx-runtime";
 */
 const UserProfile = ({ preferences, editable = true,...rest }) => {
 	const { preferences: contextPreferences } = useThunderID_default();
-	const { profile, flattenedProfile, onUpdateProfile, updateProfile } = useUser();
+	const { profile, flattenedProfile, onUpdateProfile, updateProfile, userSchema } = useUser();
 	const resolvedPreferences = {
 		...contextPreferences,
 		...preferences,
@@ -59,6 +59,7 @@ const UserProfile = ({ preferences, editable = true,...rest }) => {
 	return /* @__PURE__ */ jsx(BaseUserProfile, {
 		profile,
 		flattenedProfile,
+		userSchema,
 		editable: isEditableProfile,
 		onUpdate: isEditableProfile ? handleProfileUpdate : void 0,
 		error,

package/dist/client/components/presentation/UserProfile/UserProfile.js.map

@@ -1 +1 @@
-{"version":3,"file":"UserProfile.js","names":["UserProfile: FC<UserProfileProps>","useThunderID","isEditableProfile: boolean","result: {data: {user: User}; error: string; success: boolean}","getSessionId"],"sources":["../../../../../src/client/components/presentation/UserProfile/UserProfile.tsx"],"sourcesContent":["// Copyright 2025 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\n'use client';\n\nimport {deepMerge, User} from '@thunderid/node';\nimport {BaseUserProfile, BaseUserProfileProps, useUser, useTranslation} from '@thunderid/react';\nimport {FC, ReactElement, useState} from 'react';\nimport useThunderID from '../../../contexts/ThunderID/useThunderID';\nimport getSessionId from '../../../../server/actions/getSessionId';\n\n/**\n * Props for the UserProfile component.\n * Extends BaseUserProfileProps but makes the user prop optional since it will be obtained from useThunderID\n */\nexport type UserProfileProps = Omit<BaseUserProfileProps, 'user' | 'profile' | 'flattenedProfile'>;\n\n/**\n * UserProfile component displays the authenticated user's profile information in a\n * structured and styled format. It shows user details such as display name, email,\n * username, and other available profile information from ThunderID.\n *\n * This component is the React-specific implementation that uses the BaseUserProfile\n * and automatically retrieves the user data from ThunderID context if not provided.\n *\n * @example\n * ```tsx\n * // Basic usage - will use user from ThunderID context\n * <UserProfile />\n *\n * // With explicit user data\n * <UserProfile user={specificUser} />\n *\n * // With card layout and custom fallback\n * <UserProfile\n *   cardLayout={true}\n *   fallback={<div>Please sign in to view your profile</div>}\n * />\n * ```\n */\nconst UserProfile: FC<UserProfileProps> = ({preferences, editable = true, ...rest}: UserProfileProps): ReactElement => {\n  const {preferences: contextPreferences} = useThunderID();\n  const {profile, flattenedProfile, onUpdateProfile, updateProfile} = useUser();\n  const resolvedPreferences = {\n    ...contextPreferences,\n    ...preferences,\n    user: {\n      ...contextPreferences?.user,\n      ...preferences?.user,\n    },\n  };\n  const {t} = useTranslation(resolvedPreferences?.i18n);\n  const isEditableProfile: boolean = resolvedPreferences?.user?.fetchUserProfile === false ? false : editable;\n\n  const [error, setError] = useState<string | null>(null);\n\n  const handleProfileUpdate = async (payload: any): Promise<void> => {\n    setError(null);\n\n    const updatedAttributes = deepMerge((profile?.['attributes'] as Record<string, unknown>) ?? {}, payload);\n\n    Object.keys(updatedAttributes).forEach((key) => {\n      if (updatedAttributes[key] === undefined || updatedAttributes[key] === null) {\n        delete updatedAttributes[key];\n      }\n    });\n\n    const result: {data: {user: User}; error: string; success: boolean} = await updateProfile(\n      {payload: updatedAttributes},\n      await getSessionId(),\n    );\n\n    if (result.success) {\n      onUpdateProfile(result.data.user);\n    } else {\n      setError(result.error || t('user.profile.update.generic.error'));\n    }\n  };\n\n  return (\n    <BaseUserProfile\n      profile={profile!}\n      flattenedProfile={flattenedProfile!}\n      editable={isEditableProfile}\n      onUpdate={isEditableProfile ? handleProfileUpdate : undefined}\n      error={error}\n      preferences={resolvedPreferences}\n      {...rest}\n    />\n  );\n};\n\nexport default UserProfile;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAwCA,MAAMA,eAAqC,EAAC,aAAa,WAAW,KAAM,GAAG,WAA0C;CACrH,MAAM,EAAC,aAAa,uBAAsBC,sBAAc;CACxD,MAAM,EAAC,SAAS,kBAAkB,iBAAiB,kBAAiB,SAAS;CAC7E,MAAM,sBAAsB;EAC1B,GAAG;EACH,GAAG;EACH,MAAM;GACJ,GAAG,oBAAoB;GACvB,GAAG,aAAa;GACjB;EACF;CACD,MAAM,EAAC,MAAK,eAAe,qBAAqB,KAAK;CACrD,MAAMC,oBAA6B,qBAAqB,MAAM,qBAAqB,QAAQ,QAAQ;CAEnG,MAAM,CAAC,OAAO,YAAY,SAAwB,KAAK;CAEvD,MAAM,sBAAsB,OAAO,YAAgC;AACjE,WAAS,KAAK;EAEd,MAAM,oBAAoB,UAAW,UAAU,iBAA6C,EAAE,EAAE,QAAQ;AAExG,SAAO,KAAK,kBAAkB,CAAC,SAAS,QAAQ;AAC9C,OAAI,kBAAkB,SAAS,UAAa,kBAAkB,SAAS,KACrE,QAAO,kBAAkB;IAE3B;EAEF,MAAMC,SAAgE,MAAM,cAC1E,EAAC,SAAS,mBAAkB,EAC5B,MAAMC,sBAAc,CACrB;AAED,MAAI,OAAO,QACT,iBAAgB,OAAO,KAAK,KAAK;MAEjC,UAAS,OAAO,SAAS,EAAE,oCAAoC,CAAC;;AAIpE,QACE,oBAAC;EACU;EACS;EAClB,UAAU;EACV,UAAU,oBAAoB,sBAAsB;EAC7C;EACP,aAAa;EACb,GAAI;GACJ;;AAIN,0BAAe"}
+{"version":3,"file":"UserProfile.js","names":["UserProfile: FC<UserProfileProps>","useThunderID","isEditableProfile: boolean","result: {data: {user: User}; error: string; success: boolean}","getSessionId"],"sources":["../../../../../src/client/components/presentation/UserProfile/UserProfile.tsx"],"sourcesContent":["// Copyright 2025 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\n'use client';\n\nimport {deepMerge, User} from '@thunderid/node';\nimport {BaseUserProfile, BaseUserProfileProps, useUser, useTranslation} from '@thunderid/react';\nimport {FC, ReactElement, useState} from 'react';\nimport useThunderID from '../../../contexts/ThunderID/useThunderID';\nimport getSessionId from '../../../../server/actions/getSessionId';\n\n/**\n * Props for the UserProfile component.\n * Extends BaseUserProfileProps but makes the user prop optional since it will be obtained from useThunderID\n */\nexport type UserProfileProps = Omit<BaseUserProfileProps, 'user' | 'profile' | 'flattenedProfile'>;\n\n/**\n * UserProfile component displays the authenticated user's profile information in a\n * structured and styled format. It shows user details such as display name, email,\n * username, and other available profile information from ThunderID.\n *\n * This component is the React-specific implementation that uses the BaseUserProfile\n * and automatically retrieves the user data from ThunderID context if not provided.\n *\n * @example\n * ```tsx\n * // Basic usage - will use user from ThunderID context\n * <UserProfile />\n *\n * // With explicit user data\n * <UserProfile user={specificUser} />\n *\n * // With card layout and custom fallback\n * <UserProfile\n *   cardLayout={true}\n *   fallback={<div>Please sign in to view your profile</div>}\n * />\n * ```\n */\nconst UserProfile: FC<UserProfileProps> = ({preferences, editable = true, ...rest}: UserProfileProps): ReactElement => {\n  const {preferences: contextPreferences} = useThunderID();\n  const {profile, flattenedProfile, onUpdateProfile, updateProfile, userSchema} = useUser();\n  const resolvedPreferences = {\n    ...contextPreferences,\n    ...preferences,\n    user: {\n      ...contextPreferences?.user,\n      ...preferences?.user,\n    },\n  };\n  const {t} = useTranslation(resolvedPreferences?.i18n);\n  const isEditableProfile: boolean = resolvedPreferences?.user?.fetchUserProfile === false ? false : editable;\n\n  const [error, setError] = useState<string | null>(null);\n\n  const handleProfileUpdate = async (payload: any): Promise<void> => {\n    setError(null);\n\n    const updatedAttributes = deepMerge((profile?.['attributes'] as Record<string, unknown>) ?? {}, payload);\n\n    Object.keys(updatedAttributes).forEach((key) => {\n      if (updatedAttributes[key] === undefined || updatedAttributes[key] === null) {\n        delete updatedAttributes[key];\n      }\n    });\n\n    const result: {data: {user: User}; error: string; success: boolean} = await updateProfile(\n      {payload: updatedAttributes},\n      await getSessionId(),\n    );\n\n    if (result.success) {\n      onUpdateProfile(result.data.user);\n    } else {\n      setError(result.error || t('user.profile.update.generic.error'));\n    }\n  };\n\n  return (\n    <BaseUserProfile\n      profile={profile!}\n      flattenedProfile={flattenedProfile!}\n      userSchema={userSchema}\n      editable={isEditableProfile}\n      onUpdate={isEditableProfile ? handleProfileUpdate : undefined}\n      error={error}\n      preferences={resolvedPreferences}\n      {...rest}\n    />\n  );\n};\n\nexport default UserProfile;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAwCA,MAAMA,eAAqC,EAAC,aAAa,WAAW,KAAM,GAAG,WAA0C;CACrH,MAAM,EAAC,aAAa,uBAAsBC,sBAAc;CACxD,MAAM,EAAC,SAAS,kBAAkB,iBAAiB,eAAe,eAAc,SAAS;CACzF,MAAM,sBAAsB;EAC1B,GAAG;EACH,GAAG;EACH,MAAM;GACJ,GAAG,oBAAoB;GACvB,GAAG,aAAa;GACjB;EACF;CACD,MAAM,EAAC,MAAK,eAAe,qBAAqB,KAAK;CACrD,MAAMC,oBAA6B,qBAAqB,MAAM,qBAAqB,QAAQ,QAAQ;CAEnG,MAAM,CAAC,OAAO,YAAY,SAAwB,KAAK;CAEvD,MAAM,sBAAsB,OAAO,YAAgC;AACjE,WAAS,KAAK;EAEd,MAAM,oBAAoB,UAAW,UAAU,iBAA6C,EAAE,EAAE,QAAQ;AAExG,SAAO,KAAK,kBAAkB,CAAC,SAAS,QAAQ;AAC9C,OAAI,kBAAkB,SAAS,UAAa,kBAAkB,SAAS,KACrE,QAAO,kBAAkB;IAE3B;EAEF,MAAMC,SAAgE,MAAM,cAC1E,EAAC,SAAS,mBAAkB,EAC5B,MAAMC,sBAAc,CACrB;AAED,MAAI,OAAO,QACT,iBAAgB,OAAO,KAAK,KAAK;MAEjC,UAAS,OAAO,SAAS,EAAE,oCAAoC,CAAC;;AAIpE,QACE,oBAAC;EACU;EACS;EACN;EACZ,UAAU;EACV,UAAU,oBAAoB,sBAAsB;EAC7C;EACP,aAAa;EACb,GAAI;GACJ;;AAIN,0BAAe"}

package/dist/client/contexts/ThunderID/ThunderIDProvider.d.ts

@@ -1,4 +1,4 @@
-import { FlowMetadataResponse, UpdateMeProfileConfig, User, UserProfile } from '@thunderid/node';
+import { AttributeSchema, FlowMetadataResponse, UpdateMeProfileConfig, User, UserProfile } from '@thunderid/node';
 import { ThunderIDProviderProps } from '@thunderid/react';
 import { FC, PropsWithChildren } from 'react';
 import { ThunderIDContextProps } from './ThunderIDContext';
@@ -9,6 +9,17 @@ import { RefreshResult } from '../../../server/actions/refreshToken';
 export type ThunderIDClientProviderProps = Partial<Omit<ThunderIDProviderProps, 'baseUrl' | 'clientId'>> & Pick<ThunderIDProviderProps, 'baseUrl' | 'clientId'> & {
     applicationId: ThunderIDContextProps['applicationId'];
     clearSession: () => Promise<void>;
+    /**
+     * Server Action that fetches `GET /flow/meta` server-side, passed down to `FlowMetaProvider` so
+     * it never calls `baseUrl` directly from the browser — avoiding the CORS requirement that a
+     * direct client-side fetch to the ThunderID server would otherwise impose. Used for both the
+     * initial fetch (when `initialMeta` isn't seeded, e.g. it failed server-side) and subsequent
+     * `switchLanguage()` calls.
+     */
+    fetchMeta?: (params: {
+        applicationId?: string;
+        language?: string;
+    }) => Promise<FlowMetadataResponse>;
     handleOAuthCallback: (code: string, state: string, sessionState?: string) => Promise<{
         error?: string;
         redirectUrl?: string;
@@ -34,6 +45,7 @@ export type ThunderIDClientProviderProps = Partial<Omit<ThunderIDProviderProps,
     }>;
     user: User | null;
     userProfile: UserProfile;
+    userSchema?: Record<string, AttributeSchema> | null;
 };
 declare const ThunderIDClientProvider: FC<PropsWithChildren<ThunderIDClientProviderProps>>;
 export default ThunderIDClientProvider;

package/dist/client/contexts/ThunderID/ThunderIDProvider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ThunderIDProvider.d.ts","sourceRoot":"","sources":["../../../../src/client/contexts/ThunderID/ThunderIDProvider.tsx"],"names":[],"mappings":"AAKA,OAAO,EAEL,oBAAoB,EAEpB,qBAAqB,EACrB,IAAI,EACJ,WAAW,EAGZ,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAQL,sBAAsB,EAEvB,MAAM,kBAAkB,CAAC;AAI1B,OAAO,EAAC,EAAE,EAAE,iBAAiB,EAAkD,MAAM,OAAO,CAAC;AAC7F,OAAyB,EAAC,qBAAqB,EAAC,MAAM,oBAAoB,CAAC;AAC3E,OAAO,EAAC,aAAa,EAAC,MAAM,sCAAsC,CAAC;AAGnE;;GAEG;AACH,MAAM,MAAM,4BAA4B,GAAG,OAAO,CAAC,IAAI,CAAC,sBAAsB,EAAE,SAAS,GAAG,UAAU,CAAC,CAAC,GACtG,IAAI,CAAC,sBAAsB,EAAE,SAAS,GAAG,UAAU,CAAC,GAAG;IACrD,aAAa,EAAE,qBAAqB,CAAC,eAAe,CAAC,CAAC;IACtD,YAAY,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAClC,mBAAmB,EAAE,CACnB,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,EACb,YAAY,CAAC,EAAE,MAAM,KAClB,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAC,CAAC,CAAC;IACvE;;;OAGG;IACH,WAAW,CAAC,EAAE,oBAAoB,GAAG,IAAI,CAAC;IAC1C,UAAU,EAAE,OAAO,CAAC;IACpB,kBAAkB,EAAE,qBAAqB,CAAC,oBAAoB,CAAC,CAAC;IAChE,YAAY,EAAE,MAAM,OAAO,CAAC,aAAa,CAAC,CAAC;IAC3C,MAAM,EAAE,qBAAqB,CAAC,QAAQ,CAAC,CAAC;IACxC,OAAO,EAAE,qBAAqB,CAAC,SAAS,CAAC,CAAC;IAC1C,MAAM,EAAE,qBAAqB,CAAC,QAAQ,CAAC,CAAC;IACxC,aAAa,EAAE,CACb,aAAa,EAAE,qBAAqB,EACpC,SAAS,CAAC,EAAE,MAAM,KACf,OAAO,CAAC;QAAC,IAAI,EAAE;YAAC,IAAI,EAAE,IAAI,CAAA;SAAC,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAC,CAAC,CAAC;IACpE,IAAI,EAAE,IAAI,GAAG,IAAI,CAAC;IAClB,WAAW,EAAE,WAAW,CAAC;CAC1B,CAAC;AAEJ,QAAA,MAAM,uBAAuB,EAAE,EAAE,CAAC,iBAAiB,CAAC,4BAA4B,CAAC,CA4UhF,CAAC;AAEF,eAAe,uBAAuB,CAAC"}
+{"version":3,"file":"ThunderIDProvider.d.ts","sourceRoot":"","sources":["../../../../src/client/contexts/ThunderID/ThunderIDProvider.tsx"],"names":[],"mappings":"AAKA,OAAO,EACL,eAAe,EAEf,oBAAoB,EAEpB,qBAAqB,EACrB,IAAI,EACJ,WAAW,EAGZ,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAQL,sBAAsB,EAEvB,MAAM,kBAAkB,CAAC;AAI1B,OAAO,EAAC,EAAE,EAAE,iBAAiB,EAAkD,MAAM,OAAO,CAAC;AAC7F,OAAyB,EAAC,qBAAqB,EAAC,MAAM,oBAAoB,CAAC;AAC3E,OAAO,EAAC,aAAa,EAAC,MAAM,sCAAsC,CAAC;AAGnE;;GAEG;AACH,MAAM,MAAM,4BAA4B,GAAG,OAAO,CAAC,IAAI,CAAC,sBAAsB,EAAE,SAAS,GAAG,UAAU,CAAC,CAAC,GACtG,IAAI,CAAC,sBAAsB,EAAE,SAAS,GAAG,UAAU,CAAC,GAAG;IACrD,aAAa,EAAE,qBAAqB,CAAC,eAAe,CAAC,CAAC;IACtD,YAAY,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAClC;;;;;;OAMG;IACH,SAAS,CAAC,EAAE,CAAC,MAAM,EAAE;QAAC,aAAa,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAC,KAAK,OAAO,CAAC,oBAAoB,CAAC,CAAC;IACnG,mBAAmB,EAAE,CACnB,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,EACb,YAAY,CAAC,EAAE,MAAM,KAClB,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAC,CAAC,CAAC;IACvE;;;OAGG;IACH,WAAW,CAAC,EAAE,oBAAoB,GAAG,IAAI,CAAC;IAC1C,UAAU,EAAE,OAAO,CAAC;IACpB,kBAAkB,EAAE,qBAAqB,CAAC,oBAAoB,CAAC,CAAC;IAChE,YAAY,EAAE,MAAM,OAAO,CAAC,aAAa,CAAC,CAAC;IAC3C,MAAM,EAAE,qBAAqB,CAAC,QAAQ,CAAC,CAAC;IACxC,OAAO,EAAE,qBAAqB,CAAC,SAAS,CAAC,CAAC;IAC1C,MAAM,EAAE,qBAAqB,CAAC,QAAQ,CAAC,CAAC;IACxC,aAAa,EAAE,CACb,aAAa,EAAE,qBAAqB,EACpC,SAAS,CAAC,EAAE,MAAM,KACf,OAAO,CAAC;QAAC,IAAI,EAAE;YAAC,IAAI,EAAE,IAAI,CAAA;SAAC,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAC,CAAC,CAAC;IACpE,IAAI,EAAE,IAAI,GAAG,IAAI,CAAC;IAClB,WAAW,EAAE,WAAW,CAAC;IACzB,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,GAAG,IAAI,CAAC;CACrD,CAAC;AAEJ,QAAA,MAAM,uBAAuB,EAAE,EAAE,CAAC,iBAAiB,CAAC,4BAA4B,CAAC,CA6VhF,CAAC;AAEF,eAAe,uBAAuB,CAAC"}

package/dist/client/contexts/ThunderID/ThunderIDProvider.js

@@ -10,16 +10,20 @@ import { useEffect, useMemo, useRef, useState } from "react";
 import { jsx } from "react/jsx-runtime";
 
 //#region src/client/contexts/ThunderID/ThunderIDProvider.tsx
-const ThunderIDClientProvider = ({ baseUrl, children, signIn, clearSession, refreshToken, signOut, signUp, handleOAuthCallback, preferences, isSignedIn, signInUrl, signUpUrl, user: _user, userProfile: _userProfile, updateProfile, applicationId, organizationHandle, scopes, vendor, initialMeta = null }) => {
+const ThunderIDClientProvider = ({ baseUrl, children, signIn, clearSession, refreshToken, signOut, signUp, handleOAuthCallback, preferences, isSignedIn, signInUrl, signUpUrl, user: _user, userProfile: _userProfile, userSchema: _userSchema = null, updateProfile, applicationId, organizationHandle, scopes, vendor, initialMeta = null, fetchMeta }) => {
 	const reRenderCheckRef = useRef(false);
 	const router = useRouter();
 	const searchParams = useSearchParams();
 	const [isLoading, setIsLoading] = useState(true);
 	const [user, setUser] = useState(_user);
 	const [userProfile, setUserProfile] = useState(_userProfile);
+	const [userSchema, setUserSchema] = useState(_userSchema);
 	useEffect(() => {
 		setUserProfile(_userProfile);
 	}, [_userProfile]);
+	useEffect(() => {
+		setUserSchema(_userSchema);
+	}, [_userSchema]);
 	useEffect(() => {
 		setUser(_user);
 	}, [_user]);
@@ -171,7 +175,7 @@ const ThunderIDClientProvider = ({ baseUrl, children, signIn, clearSession, refr
 		signUp: handleSignUp,
 		signUpUrl,
 		user,
-		userSchema: null,
+		userSchema,
 		vendor: getVendorPrefix(vendor)
 	}), [
 		applicationId,
@@ -184,6 +188,7 @@ const ThunderIDClientProvider = ({ baseUrl, children, signIn, clearSession, refr
 		signInUrl,
 		signUpUrl,
 		user,
+		userSchema,
 		initialMeta,
 		vendor
 	]);
@@ -196,11 +201,13 @@ const ThunderIDClientProvider = ({ baseUrl, children, signIn, clearSession, refr
 				children: /* @__PURE__ */ jsx(FlowMetaProvider, {
 					enabled: preferences?.resolveFromMeta !== false,
 					initialMeta,
+					fetchMeta,
 					children: /* @__PURE__ */ jsx(ThemeProvider, {
 						theme: preferences?.theme?.overrides,
 						mode: getActiveTheme(preferences?.theme?.mode),
 						children: /* @__PURE__ */ jsx(FlowProvider, { children: /* @__PURE__ */ jsx(UserProvider, {
 							profile: userProfile,
+							userSchema,
 							onUpdateProfile: handleProfileUpdate,
 							updateProfile,
 							children

package/dist/client/contexts/ThunderID/ThunderIDProvider.js.map

@@ -1 +1 @@
-{"version":3,"file":"ThunderIDProvider.js","names":["ThunderIDClientProvider: FC<PropsWithChildren<ThunderIDClientProviderProps>>","reRenderCheckRef: RefObject<boolean>","router: AppRouterInstance","searchParams: ReadonlyURLSearchParams","code: string | null","state: string | null","sessionState: string | null","result: {error?: string; redirectUrl?: string; success: boolean}","result: any","contextValue: ThunderIDContextProps","reactContextValue: ReactThunderIDContextProps","ThunderIDContext","ReactThunderIDContext"],"sources":["../../../../src/client/contexts/ThunderID/ThunderIDProvider.tsx"],"sourcesContent":["// Copyright 2025 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\n'use client';\n\nimport {\n  EmbeddedFlowExecuteRequestConfig,\n  FlowMetadataResponse,\n  generateFlattenedUserProfile,\n  UpdateMeProfileConfig,\n  User,\n  UserProfile,\n  ThunderIDRuntimeError,\n  getVendorPrefix,\n} from '@thunderid/node';\nimport {\n  I18nProvider,\n  FlowMetaProvider,\n  FlowProvider,\n  UserProvider,\n  ThemeProvider,\n  ThunderIDContext as ReactThunderIDContext,\n  ThunderIDContextProps as ReactThunderIDContextProps,\n  ThunderIDProviderProps,\n  getActiveTheme,\n} from '@thunderid/react';\nimport {ReadonlyURLSearchParams} from 'next/dist/client/components/navigation.react-server';\nimport {AppRouterInstance} from 'next/dist/shared/lib/app-router-context.shared-runtime';\nimport {useRouter, useSearchParams} from 'next/navigation';\nimport {FC, PropsWithChildren, RefObject, useEffect, useMemo, useRef, useState} from 'react';\nimport ThunderIDContext, {ThunderIDContextProps} from './ThunderIDContext';\nimport {RefreshResult} from '../../../server/actions/refreshToken';\nimport logger from '../../../utils/logger';\n\n/**\n * Props interface of {@link ThunderIDClientProvider}\n */\nexport type ThunderIDClientProviderProps = Partial<Omit<ThunderIDProviderProps, 'baseUrl' | 'clientId'>> &\n  Pick<ThunderIDProviderProps, 'baseUrl' | 'clientId'> & {\n    applicationId: ThunderIDContextProps['applicationId'];\n    clearSession: () => Promise<void>;\n    handleOAuthCallback: (\n      code: string,\n      state: string,\n      sessionState?: string,\n    ) => Promise<{error?: string; redirectUrl?: string; success: boolean}>;\n    /**\n     * Flow metadata fetched server-side ahead of time, seeding `FlowMetaProvider` so it can skip\n     * its own initial client-side fetch (avoiding a flash of untranslated i18n keys).\n     */\n    initialMeta?: FlowMetadataResponse | null;\n    isSignedIn: boolean;\n    organizationHandle: ThunderIDContextProps['organizationHandle'];\n    refreshToken: () => Promise<RefreshResult>;\n    signIn: ThunderIDContextProps['signIn'];\n    signOut: ThunderIDContextProps['signOut'];\n    signUp: ThunderIDContextProps['signUp'];\n    updateProfile: (\n      requestConfig: UpdateMeProfileConfig,\n      sessionId?: string,\n    ) => Promise<{data: {user: User}; error: string; success: boolean}>;\n    user: User | null;\n    userProfile: UserProfile;\n  };\n\nconst ThunderIDClientProvider: FC<PropsWithChildren<ThunderIDClientProviderProps>> = ({\n  baseUrl,\n  children,\n  signIn,\n  clearSession,\n  refreshToken,\n  signOut,\n  signUp,\n  handleOAuthCallback,\n  preferences,\n  isSignedIn,\n  signInUrl,\n  signUpUrl,\n  user: _user,\n  userProfile: _userProfile,\n  updateProfile,\n  applicationId,\n  organizationHandle,\n  scopes,\n  vendor,\n  initialMeta = null,\n}: PropsWithChildren<ThunderIDClientProviderProps>) => {\n  const reRenderCheckRef: RefObject<boolean> = useRef(false);\n  const router: AppRouterInstance = useRouter();\n  const searchParams: ReadonlyURLSearchParams = useSearchParams();\n  const [isLoading, setIsLoading] = useState<boolean>(true);\n  const [user, setUser] = useState<User | null>(_user);\n  const [userProfile, setUserProfile] = useState<UserProfile>(_userProfile);\n\n  useEffect(() => {\n    setUserProfile(_userProfile);\n  }, [_userProfile]);\n\n  useEffect(() => {\n    setUser(_user);\n  }, [_user]);\n\n  // Handle OAuth callback automatically\n  useEffect(() => {\n    // React 18.x Strict.Mode has a new check for `Ensuring reusable state` to facilitate an upcoming react feature.\n    // https://reactjs.org/docs/strict-mode.html#ensuring-reusable-state\n    // This will remount all the useEffects to ensure that there are no unexpected side effects.\n    // When react remounts the signIn hook of the AuthProvider, it will cause a race condition. Hence, we have to\n    // prevent the re-render of this hook as suggested in the following discussion.\n    // https://github.com/reactwg/react-18/discussions/18#discussioncomment-795623\n    if (reRenderCheckRef.current) {\n      return;\n    }\n\n    reRenderCheckRef.current = true;\n\n    // Don't handle callback if already signed in\n    if (isSignedIn) return;\n\n    (async (): Promise<void> => {\n      try {\n        const code: string | null = searchParams.get('code');\n        const state: string | null = searchParams.get('state');\n        const sessionState: string | null = searchParams.get('session_state');\n        const error: string | null = searchParams.get('error');\n\n        // Check for OAuth errors first\n        if (error) {\n          logger.error('[ThunderIDClientProvider] An error was received for the initiated sign-in request.');\n\n          return;\n        }\n\n        // Handle OAuth callback if code and state are present\n        if (code && state) {\n          setIsLoading(true);\n\n          const result: {error?: string; redirectUrl?: string; success: boolean} = await handleOAuthCallback(\n            code,\n            state,\n            sessionState || undefined,\n          );\n\n          if (result.success) {\n            // Redirect to the success URL\n            if (result.redirectUrl) {\n              router.push(result.redirectUrl);\n            } else {\n              // Refresh the page to update authentication state\n              window.location.reload();\n            }\n          } else {\n            logger.error(\n              `[ThunderIDClientProvider] An error occurred while signing in: ${result.error || 'Authentication failed'}`,\n            );\n          }\n        }\n      } catch (error) {\n        logger.error('[ThunderIDClientProvider] Failed to handle OAuth callback:', error);\n      }\n    })();\n  }, []);\n\n  useEffect(() => {\n    // Set loading to false when server has resolved authentication state\n    setIsLoading(false);\n  }, [isSignedIn, user]);\n\n  const handleSignIn = async (payload: any, request: EmbeddedFlowExecuteRequestConfig): Promise<any> => {\n    if (!signIn) {\n      throw new ThunderIDRuntimeError(\n        '`signIn` function is not available.',\n        'ThunderIDClientProvider-handleSignIn-RuntimeError-001',\n        'nextjs',\n      );\n    }\n\n    const result: any = await signIn(payload, request);\n\n    // Redirect based flow URL is sent as `signInUrl` in the response.\n    // Use window.location.href instead of router.push() — the OAuth authorization\n    // endpoint is on an external server, and router.push() would send RSC fetch\n    // headers that the identity provider doesn't understand, causing a CORS error.\n    if (result?.data?.signInUrl) {\n      window.location.href = result.data.signInUrl;\n\n      return undefined;\n    }\n\n    // After the Embedded flow is successful, the URL to navigate next is sent as `afterSignInUrl` in the response.\n    if (result?.data?.afterSignInUrl) {\n      router.push(result.data.afterSignInUrl);\n\n      return undefined;\n    }\n\n    if (result?.error) {\n      throw new Error(result.error);\n    }\n\n    return result?.data ?? result;\n  };\n\n  const handleSignUp = async (payload: any, request: EmbeddedFlowExecuteRequestConfig): Promise<any> => {\n    if (!signUp) {\n      throw new ThunderIDRuntimeError(\n        '`signUp` function is not available.',\n        'ThunderIDClientProvider-handleSignUp-RuntimeError-001',\n        'nextjs',\n      );\n    }\n\n    const result: any = await signUp(payload, request);\n\n    // Redirect based flow URL is sent as `signUpUrl` in the response.\n    if (result?.data?.signUpUrl) {\n      router.push(result.data.signUpUrl);\n\n      return undefined;\n    }\n\n    // After the Embedded flow is successful, the URL to navigate next is sent as `afterSignUpUrl` in the response.\n    if (result?.data?.afterSignUpUrl) {\n      router.push(result.data.afterSignUpUrl);\n\n      return undefined;\n    }\n\n    if (result?.error) {\n      throw new Error(result.error);\n    }\n\n    return result?.data ?? result;\n  };\n\n  const handleSignOut = async (): Promise<any> => {\n    logger.debug('[ThunderIDClientProvider][handleSignOut] `handleSignOut` called.');\n\n    try {\n      const result: any = await signOut();\n\n      logger.debug('[ThunderIDClientProvider][handleSignOut] Sign out result:', result);\n\n      if (result?.data?.afterSignOutUrl) {\n        router.push(result.data.afterSignOutUrl);\n\n        return {location: result.data.afterSignOutUrl, redirected: true};\n      }\n\n      if (result?.error) {\n        logger.error(\n          '[ThunderIDClientProvider][handleSignOut] Error result was returned during signing the user out with a button click:',\n          result.error,\n        );\n      }\n\n      return result?.data ?? result;\n    } catch (error) {\n      logger.error(\n        '[ThunderIDClientProvider][handleSignOut] Error occurred during signing the user out with a button click:',\n        error,\n      );\n\n      return undefined;\n    }\n  };\n\n  const contextValue: ThunderIDContextProps = useMemo(\n    () => ({\n      applicationId,\n      baseUrl,\n      clearSession,\n      isLoading,\n      isSignedIn,\n      organizationHandle,\n      preferences,\n      refreshToken,\n      scopes,\n      signIn: handleSignIn,\n      signInUrl,\n      signOut: handleSignOut,\n      signUp: handleSignUp,\n      signUpUrl,\n      user,\n    }),\n    [\n      baseUrl,\n      user,\n      isSignedIn,\n      isLoading,\n      signInUrl,\n      signUpUrl,\n      applicationId,\n      organizationHandle,\n      scopes,\n      preferences,\n    ],\n  );\n\n  const handleProfileUpdate = (payload: User): void => {\n    setUser(payload);\n    setUserProfile((prev: UserProfile) => ({\n      ...prev,\n      flattenedProfile: generateFlattenedUserProfile(payload),\n      profile: payload,\n    }));\n  };\n\n  // Bridge into @thunderid/react's own ThunderIDContext. Internal react components rendered by\n  // BaseSignIn/BaseSignUp — most notably FlowMetaProvider, which fetches `/flow/meta` and injects\n  // its i18n bundle — call react's `useThunderID()` directly. Without this bridge they'd only see\n  // react's context default (applicationId/baseUrl undefined, isInitialized false), so the meta\n  // fetch would never fire and flow labels would render as untranslated i18n keys. Fields with no\n  // nextjs equivalent (token/http helpers meant for direct browser API calls) are stubbed out,\n  // since nextjs routes those operations through server actions instead.\n  const unsupported = (name: string): (() => Promise<never>) => {\n    return () =>\n      Promise.reject(\n        new ThunderIDRuntimeError(\n          `\\`${name}\\` is not supported in @thunderid/nextjs.`,\n          `ThunderIDClientProvider-${name}-NotSupportedError-001`,\n          'nextjs',\n        ),\n      );\n  };\n\n  const reactContextValue: ReactThunderIDContextProps = useMemo(\n    () => ({\n      afterSignInUrl: undefined,\n      applicationId,\n      baseUrl,\n      clearSession,\n      clientId: undefined,\n      discovery: {wellKnown: null},\n      exchangeToken: unsupported('exchangeToken'),\n      getAccessToken: unsupported('getAccessToken'),\n      getDecodedIdToken: unsupported('getDecodedIdToken'),\n      getIdToken: unsupported('getIdToken'),\n      getStorageManager: () => Promise.resolve(null),\n      http: {\n        request: unsupported('http.request'),\n        requestAll: unsupported('http.requestAll'),\n      },\n      instanceId: 0,\n      isInitialized: !isLoading,\n      isLoading,\n      isMetaLoading: false,\n      isSignedIn,\n      meta: initialMeta ?? null,\n      organizationHandle,\n      reInitialize: unsupported('reInitialize'),\n      recover: unsupported('recover'),\n      resolveFlowTemplateLiterals: (text: string | undefined): string => text ?? '',\n      scopes,\n      signIn: handleSignIn,\n      signInSilently: unsupported('signInSilently'),\n      signInUrl,\n      signOut: handleSignOut,\n      signUp: handleSignUp,\n      signUpUrl,\n      user,\n      userSchema: null,\n      vendor: getVendorPrefix(vendor),\n    }),\n    [\n      applicationId,\n      baseUrl,\n      clearSession,\n      isLoading,\n      isSignedIn,\n      organizationHandle,\n      scopes,\n      signInUrl,\n      signUpUrl,\n      user,\n      initialMeta,\n      vendor,\n    ],\n  );\n\n  return (\n    <ThunderIDContext.Provider value={contextValue}>\n      <ReactThunderIDContext.Provider value={reactContextValue}>\n        <I18nProvider preferences={preferences?.i18n}>\n          <FlowMetaProvider enabled={preferences?.resolveFromMeta !== false} initialMeta={initialMeta}>\n            <ThemeProvider theme={preferences?.theme?.overrides} mode={getActiveTheme(preferences?.theme?.mode as any)}>\n              <FlowProvider>\n                <UserProvider profile={userProfile} onUpdateProfile={handleProfileUpdate} updateProfile={updateProfile}>\n                  {children}\n                </UserProvider>\n              </FlowProvider>\n            </ThemeProvider>\n          </FlowMetaProvider>\n        </I18nProvider>\n      </ReactThunderIDContext.Provider>\n    </ThunderIDContext.Provider>\n  );\n};\n\nexport default ThunderIDClientProvider;\n"],"mappings":";;;;;;;;;;;;AAiEA,MAAMA,2BAAgF,EACpF,SACA,UACA,QACA,cACA,cACA,SACA,QACA,qBACA,aACA,YACA,WACA,WACA,MAAM,OACN,aAAa,cACb,eACA,eACA,oBACA,QACA,QACA,cAAc,WACuC;CACrD,MAAMC,mBAAuC,OAAO,MAAM;CAC1D,MAAMC,SAA4B,WAAW;CAC7C,MAAMC,eAAwC,iBAAiB;CAC/D,MAAM,CAAC,WAAW,gBAAgB,SAAkB,KAAK;CACzD,MAAM,CAAC,MAAM,WAAW,SAAsB,MAAM;CACpD,MAAM,CAAC,aAAa,kBAAkB,SAAsB,aAAa;AAEzE,iBAAgB;AACd,iBAAe,aAAa;IAC3B,CAAC,aAAa,CAAC;AAElB,iBAAgB;AACd,UAAQ,MAAM;IACb,CAAC,MAAM,CAAC;AAGX,iBAAgB;AAOd,MAAI,iBAAiB,QACnB;AAGF,mBAAiB,UAAU;AAG3B,MAAI,WAAY;AAEhB,GAAC,YAA2B;AAC1B,OAAI;IACF,MAAMC,OAAsB,aAAa,IAAI,OAAO;IACpD,MAAMC,QAAuB,aAAa,IAAI,QAAQ;IACtD,MAAMC,eAA8B,aAAa,IAAI,gBAAgB;AAIrE,QAH6B,aAAa,IAAI,QAAQ,EAG3C;AACT,oBAAO,MAAM,qFAAqF;AAElG;;AAIF,QAAI,QAAQ,OAAO;AACjB,kBAAa,KAAK;KAElB,MAAMC,SAAmE,MAAM,oBAC7E,MACA,OACA,gBAAgB,OACjB;AAED,SAAI,OAAO,QAET,KAAI,OAAO,YACT,QAAO,KAAK,OAAO,YAAY;SAG/B,QAAO,SAAS,QAAQ;SAG1B,gBAAO,MACL,iEAAiE,OAAO,SAAS,0BAClF;;YAGE,OAAO;AACd,mBAAO,MAAM,8DAA8D,MAAM;;MAEjF;IACH,EAAE,CAAC;AAEN,iBAAgB;AAEd,eAAa,MAAM;IAClB,CAAC,YAAY,KAAK,CAAC;CAEtB,MAAM,eAAe,OAAO,SAAc,YAA4D;AACpG,MAAI,CAAC,OACH,OAAM,IAAI,sBACR,uCACA,yDACA,SACD;EAGH,MAAMC,SAAc,MAAM,OAAO,SAAS,QAAQ;AAMlD,MAAI,QAAQ,MAAM,WAAW;AAC3B,UAAO,SAAS,OAAO,OAAO,KAAK;AAEnC;;AAIF,MAAI,QAAQ,MAAM,gBAAgB;AAChC,UAAO,KAAK,OAAO,KAAK,eAAe;AAEvC;;AAGF,MAAI,QAAQ,MACV,OAAM,IAAI,MAAM,OAAO,MAAM;AAG/B,SAAO,QAAQ,QAAQ;;CAGzB,MAAM,eAAe,OAAO,SAAc,YAA4D;AACpG,MAAI,CAAC,OACH,OAAM,IAAI,sBACR,uCACA,yDACA,SACD;EAGH,MAAMA,SAAc,MAAM,OAAO,SAAS,QAAQ;AAGlD,MAAI,QAAQ,MAAM,WAAW;AAC3B,UAAO,KAAK,OAAO,KAAK,UAAU;AAElC;;AAIF,MAAI,QAAQ,MAAM,gBAAgB;AAChC,UAAO,KAAK,OAAO,KAAK,eAAe;AAEvC;;AAGF,MAAI,QAAQ,MACV,OAAM,IAAI,MAAM,OAAO,MAAM;AAG/B,SAAO,QAAQ,QAAQ;;CAGzB,MAAM,gBAAgB,YAA0B;AAC9C,iBAAO,MAAM,mEAAmE;AAEhF,MAAI;GACF,MAAMA,SAAc,MAAM,SAAS;AAEnC,kBAAO,MAAM,6DAA6D,OAAO;AAEjF,OAAI,QAAQ,MAAM,iBAAiB;AACjC,WAAO,KAAK,OAAO,KAAK,gBAAgB;AAExC,WAAO;KAAC,UAAU,OAAO,KAAK;KAAiB,YAAY;KAAK;;AAGlE,OAAI,QAAQ,MACV,gBAAO,MACL,uHACA,OAAO,MACR;AAGH,UAAO,QAAQ,QAAQ;WAChB,OAAO;AACd,kBAAO,MACL,4GACA,MACD;AAED;;;CAIJ,MAAMC,eAAsC,eACnC;EACL;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA,QAAQ;EACR;EACA,SAAS;EACT,QAAQ;EACR;EACA;EACD,GACD;EACE;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACD,CACF;CAED,MAAM,uBAAuB,YAAwB;AACnD,UAAQ,QAAQ;AAChB,kBAAgB,UAAuB;GACrC,GAAG;GACH,kBAAkB,6BAA6B,QAAQ;GACvD,SAAS;GACV,EAAE;;CAUL,MAAM,eAAe,SAAyC;AAC5D,eACE,QAAQ,OACN,IAAI,sBACF,KAAK,KAAK,4CACV,2BAA2B,KAAK,yBAChC,SACD,CACF;;CAGL,MAAMC,oBAAgD,eAC7C;EACL,gBAAgB;EAChB;EACA;EACA;EACA,UAAU;EACV,WAAW,EAAC,WAAW,MAAK;EAC5B,eAAe,YAAY,gBAAgB;EAC3C,gBAAgB,YAAY,iBAAiB;EAC7C,mBAAmB,YAAY,oBAAoB;EACnD,YAAY,YAAY,aAAa;EACrC,yBAAyB,QAAQ,QAAQ,KAAK;EAC9C,MAAM;GACJ,SAAS,YAAY,eAAe;GACpC,YAAY,YAAY,kBAAkB;GAC3C;EACD,YAAY;EACZ,eAAe,CAAC;EAChB;EACA,eAAe;EACf;EACA,MAAM,eAAe;EACrB;EACA,cAAc,YAAY,eAAe;EACzC,SAAS,YAAY,UAAU;EAC/B,8BAA8B,SAAqC,QAAQ;EAC3E;EACA,QAAQ;EACR,gBAAgB,YAAY,iBAAiB;EAC7C;EACA,SAAS;EACT,QAAQ;EACR;EACA;EACA,YAAY;EACZ,QAAQ,gBAAgB,OAAO;EAChC,GACD;EACE;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACD,CACF;AAED,QACE,oBAACC,yBAAiB;EAAS,OAAO;YAChC,oBAACC,iBAAsB;GAAS,OAAO;aACrC,oBAAC;IAAa,aAAa,aAAa;cACtC,oBAAC;KAAiB,SAAS,aAAa,oBAAoB;KAAoB;eAC9E,oBAAC;MAAc,OAAO,aAAa,OAAO;MAAW,MAAM,eAAe,aAAa,OAAO,KAAY;gBACxG,oBAAC,0BACC,oBAAC;OAAa,SAAS;OAAa,iBAAiB;OAAoC;OACtF;QACY,GACF;OACD;MACC;KACN;IACgB;GACP;;AAIhC,gCAAe"}
+{"version":3,"file":"ThunderIDProvider.js","names":["ThunderIDClientProvider: FC<PropsWithChildren<ThunderIDClientProviderProps>>","reRenderCheckRef: RefObject<boolean>","router: AppRouterInstance","searchParams: ReadonlyURLSearchParams","code: string | null","state: string | null","sessionState: string | null","result: {error?: string; redirectUrl?: string; success: boolean}","result: any","contextValue: ThunderIDContextProps","reactContextValue: ReactThunderIDContextProps","ThunderIDContext","ReactThunderIDContext"],"sources":["../../../../src/client/contexts/ThunderID/ThunderIDProvider.tsx"],"sourcesContent":["// Copyright 2025 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\n'use client';\n\nimport {\n  AttributeSchema,\n  EmbeddedFlowExecuteRequestConfig,\n  FlowMetadataResponse,\n  generateFlattenedUserProfile,\n  UpdateMeProfileConfig,\n  User,\n  UserProfile,\n  ThunderIDRuntimeError,\n  getVendorPrefix,\n} from '@thunderid/node';\nimport {\n  I18nProvider,\n  FlowMetaProvider,\n  FlowProvider,\n  UserProvider,\n  ThemeProvider,\n  ThunderIDContext as ReactThunderIDContext,\n  ThunderIDContextProps as ReactThunderIDContextProps,\n  ThunderIDProviderProps,\n  getActiveTheme,\n} from '@thunderid/react';\nimport {ReadonlyURLSearchParams} from 'next/dist/client/components/navigation.react-server';\nimport {AppRouterInstance} from 'next/dist/shared/lib/app-router-context.shared-runtime';\nimport {useRouter, useSearchParams} from 'next/navigation';\nimport {FC, PropsWithChildren, RefObject, useEffect, useMemo, useRef, useState} from 'react';\nimport ThunderIDContext, {ThunderIDContextProps} from './ThunderIDContext';\nimport {RefreshResult} from '../../../server/actions/refreshToken';\nimport logger from '../../../utils/logger';\n\n/**\n * Props interface of {@link ThunderIDClientProvider}\n */\nexport type ThunderIDClientProviderProps = Partial<Omit<ThunderIDProviderProps, 'baseUrl' | 'clientId'>> &\n  Pick<ThunderIDProviderProps, 'baseUrl' | 'clientId'> & {\n    applicationId: ThunderIDContextProps['applicationId'];\n    clearSession: () => Promise<void>;\n    /**\n     * Server Action that fetches `GET /flow/meta` server-side, passed down to `FlowMetaProvider` so\n     * it never calls `baseUrl` directly from the browser — avoiding the CORS requirement that a\n     * direct client-side fetch to the ThunderID server would otherwise impose. Used for both the\n     * initial fetch (when `initialMeta` isn't seeded, e.g. it failed server-side) and subsequent\n     * `switchLanguage()` calls.\n     */\n    fetchMeta?: (params: {applicationId?: string; language?: string}) => Promise<FlowMetadataResponse>;\n    handleOAuthCallback: (\n      code: string,\n      state: string,\n      sessionState?: string,\n    ) => Promise<{error?: string; redirectUrl?: string; success: boolean}>;\n    /**\n     * Flow metadata fetched server-side ahead of time, seeding `FlowMetaProvider` so it can skip\n     * its own initial client-side fetch (avoiding a flash of untranslated i18n keys).\n     */\n    initialMeta?: FlowMetadataResponse | null;\n    isSignedIn: boolean;\n    organizationHandle: ThunderIDContextProps['organizationHandle'];\n    refreshToken: () => Promise<RefreshResult>;\n    signIn: ThunderIDContextProps['signIn'];\n    signOut: ThunderIDContextProps['signOut'];\n    signUp: ThunderIDContextProps['signUp'];\n    updateProfile: (\n      requestConfig: UpdateMeProfileConfig,\n      sessionId?: string,\n    ) => Promise<{data: {user: User}; error: string; success: boolean}>;\n    user: User | null;\n    userProfile: UserProfile;\n    userSchema?: Record<string, AttributeSchema> | null;\n  };\n\nconst ThunderIDClientProvider: FC<PropsWithChildren<ThunderIDClientProviderProps>> = ({\n  baseUrl,\n  children,\n  signIn,\n  clearSession,\n  refreshToken,\n  signOut,\n  signUp,\n  handleOAuthCallback,\n  preferences,\n  isSignedIn,\n  signInUrl,\n  signUpUrl,\n  user: _user,\n  userProfile: _userProfile,\n  userSchema: _userSchema = null,\n  updateProfile,\n  applicationId,\n  organizationHandle,\n  scopes,\n  vendor,\n  initialMeta = null,\n  fetchMeta,\n}: PropsWithChildren<ThunderIDClientProviderProps>) => {\n  const reRenderCheckRef: RefObject<boolean> = useRef(false);\n  const router: AppRouterInstance = useRouter();\n  const searchParams: ReadonlyURLSearchParams = useSearchParams();\n  const [isLoading, setIsLoading] = useState<boolean>(true);\n  const [user, setUser] = useState<User | null>(_user);\n  const [userProfile, setUserProfile] = useState<UserProfile>(_userProfile);\n  const [userSchema, setUserSchema] = useState<Record<string, AttributeSchema> | null>(_userSchema);\n\n  useEffect(() => {\n    setUserProfile(_userProfile);\n  }, [_userProfile]);\n\n  useEffect(() => {\n    setUserSchema(_userSchema);\n  }, [_userSchema]);\n\n  useEffect(() => {\n    setUser(_user);\n  }, [_user]);\n\n  // Handle OAuth callback automatically\n  useEffect(() => {\n    // React 18.x Strict.Mode has a new check for `Ensuring reusable state` to facilitate an upcoming react feature.\n    // https://reactjs.org/docs/strict-mode.html#ensuring-reusable-state\n    // This will remount all the useEffects to ensure that there are no unexpected side effects.\n    // When react remounts the signIn hook of the AuthProvider, it will cause a race condition. Hence, we have to\n    // prevent the re-render of this hook as suggested in the following discussion.\n    // https://github.com/reactwg/react-18/discussions/18#discussioncomment-795623\n    if (reRenderCheckRef.current) {\n      return;\n    }\n\n    reRenderCheckRef.current = true;\n\n    // Don't handle callback if already signed in\n    if (isSignedIn) return;\n\n    (async (): Promise<void> => {\n      try {\n        const code: string | null = searchParams.get('code');\n        const state: string | null = searchParams.get('state');\n        const sessionState: string | null = searchParams.get('session_state');\n        const error: string | null = searchParams.get('error');\n\n        // Check for OAuth errors first\n        if (error) {\n          logger.error('[ThunderIDClientProvider] An error was received for the initiated sign-in request.');\n\n          return;\n        }\n\n        // Handle OAuth callback if code and state are present\n        if (code && state) {\n          setIsLoading(true);\n\n          const result: {error?: string; redirectUrl?: string; success: boolean} = await handleOAuthCallback(\n            code,\n            state,\n            sessionState || undefined,\n          );\n\n          if (result.success) {\n            // Redirect to the success URL\n            if (result.redirectUrl) {\n              router.push(result.redirectUrl);\n            } else {\n              // Refresh the page to update authentication state\n              window.location.reload();\n            }\n          } else {\n            logger.error(\n              `[ThunderIDClientProvider] An error occurred while signing in: ${result.error || 'Authentication failed'}`,\n            );\n          }\n        }\n      } catch (error) {\n        logger.error('[ThunderIDClientProvider] Failed to handle OAuth callback:', error);\n      }\n    })();\n  }, []);\n\n  useEffect(() => {\n    // Set loading to false when server has resolved authentication state\n    setIsLoading(false);\n  }, [isSignedIn, user]);\n\n  const handleSignIn = async (payload: any, request: EmbeddedFlowExecuteRequestConfig): Promise<any> => {\n    if (!signIn) {\n      throw new ThunderIDRuntimeError(\n        '`signIn` function is not available.',\n        'ThunderIDClientProvider-handleSignIn-RuntimeError-001',\n        'nextjs',\n      );\n    }\n\n    const result: any = await signIn(payload, request);\n\n    // Redirect based flow URL is sent as `signInUrl` in the response.\n    // Use window.location.href instead of router.push() — the OAuth authorization\n    // endpoint is on an external server, and router.push() would send RSC fetch\n    // headers that the identity provider doesn't understand, causing a CORS error.\n    if (result?.data?.signInUrl) {\n      window.location.href = result.data.signInUrl;\n\n      return undefined;\n    }\n\n    // After the Embedded flow is successful, the URL to navigate next is sent as `afterSignInUrl` in the response.\n    if (result?.data?.afterSignInUrl) {\n      router.push(result.data.afterSignInUrl);\n\n      return undefined;\n    }\n\n    if (result?.error) {\n      throw new Error(result.error);\n    }\n\n    return result?.data ?? result;\n  };\n\n  const handleSignUp = async (payload: any, request: EmbeddedFlowExecuteRequestConfig): Promise<any> => {\n    if (!signUp) {\n      throw new ThunderIDRuntimeError(\n        '`signUp` function is not available.',\n        'ThunderIDClientProvider-handleSignUp-RuntimeError-001',\n        'nextjs',\n      );\n    }\n\n    const result: any = await signUp(payload, request);\n\n    // Redirect based flow URL is sent as `signUpUrl` in the response.\n    if (result?.data?.signUpUrl) {\n      router.push(result.data.signUpUrl);\n\n      return undefined;\n    }\n\n    // After the Embedded flow is successful, the URL to navigate next is sent as `afterSignUpUrl` in the response.\n    if (result?.data?.afterSignUpUrl) {\n      router.push(result.data.afterSignUpUrl);\n\n      return undefined;\n    }\n\n    if (result?.error) {\n      throw new Error(result.error);\n    }\n\n    return result?.data ?? result;\n  };\n\n  const handleSignOut = async (): Promise<any> => {\n    logger.debug('[ThunderIDClientProvider][handleSignOut] `handleSignOut` called.');\n\n    try {\n      const result: any = await signOut();\n\n      logger.debug('[ThunderIDClientProvider][handleSignOut] Sign out result:', result);\n\n      if (result?.data?.afterSignOutUrl) {\n        router.push(result.data.afterSignOutUrl);\n\n        return {location: result.data.afterSignOutUrl, redirected: true};\n      }\n\n      if (result?.error) {\n        logger.error(\n          '[ThunderIDClientProvider][handleSignOut] Error result was returned during signing the user out with a button click:',\n          result.error,\n        );\n      }\n\n      return result?.data ?? result;\n    } catch (error) {\n      logger.error(\n        '[ThunderIDClientProvider][handleSignOut] Error occurred during signing the user out with a button click:',\n        error,\n      );\n\n      return undefined;\n    }\n  };\n\n  const contextValue: ThunderIDContextProps = useMemo(\n    () => ({\n      applicationId,\n      baseUrl,\n      clearSession,\n      isLoading,\n      isSignedIn,\n      organizationHandle,\n      preferences,\n      refreshToken,\n      scopes,\n      signIn: handleSignIn,\n      signInUrl,\n      signOut: handleSignOut,\n      signUp: handleSignUp,\n      signUpUrl,\n      user,\n    }),\n    [\n      baseUrl,\n      user,\n      isSignedIn,\n      isLoading,\n      signInUrl,\n      signUpUrl,\n      applicationId,\n      organizationHandle,\n      scopes,\n      preferences,\n    ],\n  );\n\n  const handleProfileUpdate = (payload: User): void => {\n    setUser(payload);\n    setUserProfile((prev: UserProfile) => ({\n      ...prev,\n      flattenedProfile: generateFlattenedUserProfile(payload),\n      profile: payload,\n    }));\n  };\n\n  // Bridge into @thunderid/react's own ThunderIDContext. Internal react components rendered by\n  // BaseSignIn/BaseSignUp — most notably FlowMetaProvider, which fetches `/flow/meta` and injects\n  // its i18n bundle — call react's `useThunderID()` directly. Without this bridge they'd only see\n  // react's context default (applicationId/baseUrl undefined, isInitialized false), so the meta\n  // fetch would never fire and flow labels would render as untranslated i18n keys. Fields with no\n  // nextjs equivalent (token/http helpers meant for direct browser API calls) are stubbed out,\n  // since nextjs routes those operations through server actions instead.\n  const unsupported = (name: string): (() => Promise<never>) => {\n    return () =>\n      Promise.reject(\n        new ThunderIDRuntimeError(\n          `\\`${name}\\` is not supported in @thunderid/nextjs.`,\n          `ThunderIDClientProvider-${name}-NotSupportedError-001`,\n          'nextjs',\n        ),\n      );\n  };\n\n  const reactContextValue: ReactThunderIDContextProps = useMemo(\n    () => ({\n      afterSignInUrl: undefined,\n      applicationId,\n      baseUrl,\n      clearSession,\n      clientId: undefined,\n      discovery: {wellKnown: null},\n      exchangeToken: unsupported('exchangeToken'),\n      getAccessToken: unsupported('getAccessToken'),\n      getDecodedIdToken: unsupported('getDecodedIdToken'),\n      getIdToken: unsupported('getIdToken'),\n      getStorageManager: () => Promise.resolve(null),\n      http: {\n        request: unsupported('http.request'),\n        requestAll: unsupported('http.requestAll'),\n      },\n      instanceId: 0,\n      isInitialized: !isLoading,\n      isLoading,\n      isMetaLoading: false,\n      isSignedIn,\n      meta: initialMeta ?? null,\n      organizationHandle,\n      reInitialize: unsupported('reInitialize'),\n      recover: unsupported('recover'),\n      resolveFlowTemplateLiterals: (text: string | undefined): string => text ?? '',\n      scopes,\n      signIn: handleSignIn,\n      signInSilently: unsupported('signInSilently'),\n      signInUrl,\n      signOut: handleSignOut,\n      signUp: handleSignUp,\n      signUpUrl,\n      user,\n      userSchema,\n      vendor: getVendorPrefix(vendor),\n    }),\n    [\n      applicationId,\n      baseUrl,\n      clearSession,\n      isLoading,\n      isSignedIn,\n      organizationHandle,\n      scopes,\n      signInUrl,\n      signUpUrl,\n      user,\n      userSchema,\n      initialMeta,\n      vendor,\n    ],\n  );\n\n  return (\n    <ThunderIDContext.Provider value={contextValue}>\n      <ReactThunderIDContext.Provider value={reactContextValue}>\n        <I18nProvider preferences={preferences?.i18n}>\n          <FlowMetaProvider\n            enabled={preferences?.resolveFromMeta !== false}\n            initialMeta={initialMeta}\n            fetchMeta={fetchMeta}\n          >\n            <ThemeProvider theme={preferences?.theme?.overrides} mode={getActiveTheme(preferences?.theme?.mode as any)}>\n              <FlowProvider>\n                <UserProvider\n                  profile={userProfile}\n                  userSchema={userSchema}\n                  onUpdateProfile={handleProfileUpdate}\n                  updateProfile={updateProfile}\n                >\n                  {children}\n                </UserProvider>\n              </FlowProvider>\n            </ThemeProvider>\n          </FlowMetaProvider>\n        </I18nProvider>\n      </ReactThunderIDContext.Provider>\n    </ThunderIDContext.Provider>\n  );\n};\n\nexport default ThunderIDClientProvider;\n"],"mappings":";;;;;;;;;;;;AA2EA,MAAMA,2BAAgF,EACpF,SACA,UACA,QACA,cACA,cACA,SACA,QACA,qBACA,aACA,YACA,WACA,WACA,MAAM,OACN,aAAa,cACb,YAAY,cAAc,MAC1B,eACA,eACA,oBACA,QACA,QACA,cAAc,MACd,gBACqD;CACrD,MAAMC,mBAAuC,OAAO,MAAM;CAC1D,MAAMC,SAA4B,WAAW;CAC7C,MAAMC,eAAwC,iBAAiB;CAC/D,MAAM,CAAC,WAAW,gBAAgB,SAAkB,KAAK;CACzD,MAAM,CAAC,MAAM,WAAW,SAAsB,MAAM;CACpD,MAAM,CAAC,aAAa,kBAAkB,SAAsB,aAAa;CACzE,MAAM,CAAC,YAAY,iBAAiB,SAAiD,YAAY;AAEjG,iBAAgB;AACd,iBAAe,aAAa;IAC3B,CAAC,aAAa,CAAC;AAElB,iBAAgB;AACd,gBAAc,YAAY;IACzB,CAAC,YAAY,CAAC;AAEjB,iBAAgB;AACd,UAAQ,MAAM;IACb,CAAC,MAAM,CAAC;AAGX,iBAAgB;AAOd,MAAI,iBAAiB,QACnB;AAGF,mBAAiB,UAAU;AAG3B,MAAI,WAAY;AAEhB,GAAC,YAA2B;AAC1B,OAAI;IACF,MAAMC,OAAsB,aAAa,IAAI,OAAO;IACpD,MAAMC,QAAuB,aAAa,IAAI,QAAQ;IACtD,MAAMC,eAA8B,aAAa,IAAI,gBAAgB;AAIrE,QAH6B,aAAa,IAAI,QAAQ,EAG3C;AACT,oBAAO,MAAM,qFAAqF;AAElG;;AAIF,QAAI,QAAQ,OAAO;AACjB,kBAAa,KAAK;KAElB,MAAMC,SAAmE,MAAM,oBAC7E,MACA,OACA,gBAAgB,OACjB;AAED,SAAI,OAAO,QAET,KAAI,OAAO,YACT,QAAO,KAAK,OAAO,YAAY;SAG/B,QAAO,SAAS,QAAQ;SAG1B,gBAAO,MACL,iEAAiE,OAAO,SAAS,0BAClF;;YAGE,OAAO;AACd,mBAAO,MAAM,8DAA8D,MAAM;;MAEjF;IACH,EAAE,CAAC;AAEN,iBAAgB;AAEd,eAAa,MAAM;IAClB,CAAC,YAAY,KAAK,CAAC;CAEtB,MAAM,eAAe,OAAO,SAAc,YAA4D;AACpG,MAAI,CAAC,OACH,OAAM,IAAI,sBACR,uCACA,yDACA,SACD;EAGH,MAAMC,SAAc,MAAM,OAAO,SAAS,QAAQ;AAMlD,MAAI,QAAQ,MAAM,WAAW;AAC3B,UAAO,SAAS,OAAO,OAAO,KAAK;AAEnC;;AAIF,MAAI,QAAQ,MAAM,gBAAgB;AAChC,UAAO,KAAK,OAAO,KAAK,eAAe;AAEvC;;AAGF,MAAI,QAAQ,MACV,OAAM,IAAI,MAAM,OAAO,MAAM;AAG/B,SAAO,QAAQ,QAAQ;;CAGzB,MAAM,eAAe,OAAO,SAAc,YAA4D;AACpG,MAAI,CAAC,OACH,OAAM,IAAI,sBACR,uCACA,yDACA,SACD;EAGH,MAAMA,SAAc,MAAM,OAAO,SAAS,QAAQ;AAGlD,MAAI,QAAQ,MAAM,WAAW;AAC3B,UAAO,KAAK,OAAO,KAAK,UAAU;AAElC;;AAIF,MAAI,QAAQ,MAAM,gBAAgB;AAChC,UAAO,KAAK,OAAO,KAAK,eAAe;AAEvC;;AAGF,MAAI,QAAQ,MACV,OAAM,IAAI,MAAM,OAAO,MAAM;AAG/B,SAAO,QAAQ,QAAQ;;CAGzB,MAAM,gBAAgB,YAA0B;AAC9C,iBAAO,MAAM,mEAAmE;AAEhF,MAAI;GACF,MAAMA,SAAc,MAAM,SAAS;AAEnC,kBAAO,MAAM,6DAA6D,OAAO;AAEjF,OAAI,QAAQ,MAAM,iBAAiB;AACjC,WAAO,KAAK,OAAO,KAAK,gBAAgB;AAExC,WAAO;KAAC,UAAU,OAAO,KAAK;KAAiB,YAAY;KAAK;;AAGlE,OAAI,QAAQ,MACV,gBAAO,MACL,uHACA,OAAO,MACR;AAGH,UAAO,QAAQ,QAAQ;WAChB,OAAO;AACd,kBAAO,MACL,4GACA,MACD;AAED;;;CAIJ,MAAMC,eAAsC,eACnC;EACL;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA,QAAQ;EACR;EACA,SAAS;EACT,QAAQ;EACR;EACA;EACD,GACD;EACE;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACD,CACF;CAED,MAAM,uBAAuB,YAAwB;AACnD,UAAQ,QAAQ;AAChB,kBAAgB,UAAuB;GACrC,GAAG;GACH,kBAAkB,6BAA6B,QAAQ;GACvD,SAAS;GACV,EAAE;;CAUL,MAAM,eAAe,SAAyC;AAC5D,eACE,QAAQ,OACN,IAAI,sBACF,KAAK,KAAK,4CACV,2BAA2B,KAAK,yBAChC,SACD,CACF;;CAGL,MAAMC,oBAAgD,eAC7C;EACL,gBAAgB;EAChB;EACA;EACA;EACA,UAAU;EACV,WAAW,EAAC,WAAW,MAAK;EAC5B,eAAe,YAAY,gBAAgB;EAC3C,gBAAgB,YAAY,iBAAiB;EAC7C,mBAAmB,YAAY,oBAAoB;EACnD,YAAY,YAAY,aAAa;EACrC,yBAAyB,QAAQ,QAAQ,KAAK;EAC9C,MAAM;GACJ,SAAS,YAAY,eAAe;GACpC,YAAY,YAAY,kBAAkB;GAC3C;EACD,YAAY;EACZ,eAAe,CAAC;EAChB;EACA,eAAe;EACf;EACA,MAAM,eAAe;EACrB;EACA,cAAc,YAAY,eAAe;EACzC,SAAS,YAAY,UAAU;EAC/B,8BAA8B,SAAqC,QAAQ;EAC3E;EACA,QAAQ;EACR,gBAAgB,YAAY,iBAAiB;EAC7C;EACA,SAAS;EACT,QAAQ;EACR;EACA;EACA;EACA,QAAQ,gBAAgB,OAAO;EAChC,GACD;EACE;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACD,CACF;AAED,QACE,oBAACC,yBAAiB;EAAS,OAAO;YAChC,oBAACC,iBAAsB;GAAS,OAAO;aACrC,oBAAC;IAAa,aAAa,aAAa;cACtC,oBAAC;KACC,SAAS,aAAa,oBAAoB;KAC7B;KACF;eAEX,oBAAC;MAAc,OAAO,aAAa,OAAO;MAAW,MAAM,eAAe,aAAa,OAAO,KAAY;gBACxG,oBAAC,0BACC,oBAAC;OACC,SAAS;OACG;OACZ,iBAAiB;OACF;OAEd;QACY,GACF;OACD;MACC;KACN;IACgB;GACP;;AAIhC,gCAAe"}

package/dist/index.js

@@ -1,7 +1,7 @@
 import ThunderIDNextClient_default from "./ThunderIDNextClient.js";
 import thunderid_default from "./server/thunderid.js";
 import ThunderIDProvider_default from "./server/ThunderIDProvider.js";
-import thunderIDProxy_default from "./server/proxy/thunderIDProxy.js";
+import thunderIDProxy_default, { removeChunkedCookieFromHeader, replaceChunkedCookieInHeader } from "./server/proxy/thunderIDProxy.js";
 import createRouteMatcher_default from "./server/proxy/createRouteMatcher.js";
 import "./server/index.js";
 import useThunderID_default from "./client/contexts/ThunderID/useThunderID.js";
@@ -18,4 +18,4 @@ import UserDropdown_default from "./client/components/presentation/UserDropdown/
 import UserAvatar_default from "./client/components/presentation/UserAvatar/UserAvatar.js";
 import "./client/index.js";
 
-export { SignIn_default as SignIn, SignInButton_default as SignInButton, SignOutButton_default as SignOutButton, SignUp_default as SignUp, SignUpButton_default as SignUpButton, SignedIn_default as SignedIn, SignedOut_default as SignedOut, ThunderIDNextClient_default as ThunderIDNext, ThunderIDProvider_default as ThunderIDProvider, User_default as User, UserAvatar_default as UserAvatar, UserDropdown_default as UserDropdown, UserProfile_default as UserProfile, createRouteMatcher_default as createRouteMatcher, thunderIDProxy_default as thunderIDProxy, thunderid_default as thunderid, useThunderID_default as useThunderID };
+export { SignIn_default as SignIn, SignInButton_default as SignInButton, SignOutButton_default as SignOutButton, SignUp_default as SignUp, SignUpButton_default as SignUpButton, SignedIn_default as SignedIn, SignedOut_default as SignedOut, ThunderIDNextClient_default as ThunderIDNext, ThunderIDProvider_default as ThunderIDProvider, User_default as User, UserAvatar_default as UserAvatar, UserDropdown_default as UserDropdown, UserProfile_default as UserProfile, createRouteMatcher_default as createRouteMatcher, removeChunkedCookieFromHeader, replaceChunkedCookieInHeader, thunderIDProxy_default as thunderIDProxy, thunderid_default as thunderid, useThunderID_default as useThunderID };

package/dist/server/ThunderIDProvider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ThunderIDProvider.d.ts","sourceRoot":"","sources":["../../src/server/ThunderIDProvider.tsx"],"names":[],"mappings":"AAgBA,OAAO,EAAC,sBAAsB,EAAC,MAAM,kBAAkB,CAAC;AACxD,OAAO,EAAC,EAAE,EAAE,iBAAiB,EAAe,MAAM,OAAO,CAAC;AAmB1D;;GAEG;AACH,MAAM,MAAM,4BAA4B,GAAG,OAAO,CAAC,sBAAsB,CAAC,GAAG;IAC3E,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;;;;;;;;;OAYG;IACH,uBAAuB,CAAC,EAAE,MAAM,CAAC;CAClC,CAAC;AAEF;;;;;;;;;;;;;;;GAeG;AACH,QAAA,MAAM,uBAAuB,EAAE,EAAE,CAAC,iBAAiB,CAAC,4BAA4B,CAAC,CA8IhF,CAAC;AAEF,eAAe,uBAAuB,CAAC"}
+{"version":3,"file":"ThunderIDProvider.d.ts","sourceRoot":"","sources":["../../src/server/ThunderIDProvider.tsx"],"names":[],"mappings":"AAiBA,OAAO,EAAC,sBAAsB,EAAC,MAAM,kBAAkB,CAAC;AACxD,OAAO,EAAC,EAAE,EAAE,iBAAiB,EAAe,MAAM,OAAO,CAAC;AAqB1D;;GAEG;AACH,MAAM,MAAM,4BAA4B,GAAG,OAAO,CAAC,sBAAsB,CAAC,GAAG;IAC3E,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;;;;;;;;;OAYG;IACH,uBAAuB,CAAC,EAAE,MAAM,CAAC;CAClC,CAAC;AAEF;;;;;;;;;;;;;;;GAeG;AACH,QAAA,MAAM,uBAAuB,EAAE,EAAE,CAAC,iBAAiB,CAAC,4BAA4B,CAAC,CAuJhF,CAAC;AAEF,eAAe,uBAAuB,CAAC"}

package/dist/server/ThunderIDProvider.js

@@ -8,6 +8,7 @@ import clearSession_default from "./actions/clearSession.js";
 import getSessionPayload_default from "./actions/getSessionPayload.js";
 import getUserAction_default from "./actions/getUserAction.js";
 import getUserProfileAction_default from "./actions/getUserProfileAction.js";
+import getUserSchemaAction_default from "./actions/getUserSchemaAction.js";
 import handleOAuthCallbackAction_default from "./actions/handleOAuthCallbackAction.js";
 import isSignedIn_default from "./actions/isSignedIn.js";
 import refreshToken_default from "./actions/refreshToken.js";
@@ -15,6 +16,7 @@ import signInAction_default from "./actions/signInAction.js";
 import signOutAction_default from "./actions/signOutAction.js";
 import signUpAction_default from "./actions/signUpAction.js";
 import updateUserProfileAction_default from "./actions/updateUserProfileAction.js";
+import getFlowMetaAction_default from "./actions/getFlowMetaAction.js";
 import ThunderIDProvider_default from "../client/contexts/ThunderID/ThunderIDProvider.js";
 import { FlowMetaType, ThunderIDRuntimeError, extractUserClaimsFromIdToken, getFlowMeta, resolveResourceEndpoint } from "@thunderid/node";
 import { Fragment, jsx } from "react/jsx-runtime";
@@ -69,6 +71,7 @@ const ThunderIDServerProvider = async ({ children, afterSignInUrl, afterSignOutU
 		flattenedProfile: {},
 		profile: {}
 	};
+	let userSchema = null;
 	const resolvedPreferences = {
 		...config?.preferences,
 		..._config.preferences,
@@ -97,8 +100,10 @@ const ThunderIDServerProvider = async ({ children, afterSignInUrl, afterSignOutU
 		if (resolvedPreferences?.user?.fetchUserProfile !== false) try {
 			const userResponse = await getUserAction_default(sessionId);
 			const userProfileResponse = await getUserProfileAction_default(sessionId);
+			const userSchemaResponse = await getUserSchemaAction_default(sessionId);
 			user = userResponse.data?.user || {};
 			userProfile = userProfileResponse.data?.userProfile ?? userProfile;
+			userSchema = userSchemaResponse.data?.userSchema ?? null;
 		} catch (error) {
 			logger_default.warn("[ThunderIDServerProvider] Failed to fetch user profile from /users/me:", error?.toString());
 		}
@@ -118,6 +123,7 @@ const ThunderIDServerProvider = async ({ children, afterSignInUrl, afterSignOutU
 		applicationId: config?.applicationId,
 		baseUrl: config?.baseUrl,
 		initialMeta: flowMeta,
+		fetchMeta: getFlowMetaAction_default,
 		signIn: signInAction_default,
 		clearSession: clearSession_default,
 		refreshToken: refreshToken_default,
@@ -130,6 +136,7 @@ const ThunderIDServerProvider = async ({ children, afterSignInUrl, afterSignOutU
 		clientId: config?.clientId,
 		user,
 		userProfile,
+		userSchema,
 		updateProfile: updateUserProfileAction_default,
 		isSignedIn: signedIn,
 		children

package/dist/server/ThunderIDProvider.js.map

@@ -1 +1 @@
-{"version":3,"file":"ThunderIDProvider.js","names":["ThunderIDServerProvider: FC<PropsWithChildren<ThunderIDServerProviderProps>>","getClient","config: Partial<ThunderIDNextConfig>","flowMeta: FlowMetadataResponse | null","sessionPayload: SessionTokenPayload | undefined","getSessionPayload","sessionId: string","getSessionId","signedIn: boolean","isSignedIn","user: User","userProfile: UserProfile","updatedBaseUrl: string | undefined","userResponse: {\n          data: {user: User | null};\n          error: string | null;\n          success: boolean;\n        }","getUserAction","userProfileResponse: {\n          data: {userProfile: UserProfile};\n          error: string | null;\n          success: boolean;\n        }","getUserProfileAction","ThunderIDClientProvider","signInAction","clearSession","refreshToken","signOutAction","signUpAction","handleOAuthCallbackAction","updateUserProfileAction"],"sources":["../../src/server/ThunderIDProvider.tsx"],"sourcesContent":["// Copyright 2025 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\n'use server';\n\nimport {\n  ThunderIDRuntimeError,\n  FlowMetadataResponse,\n  FlowMetaType,\n  IdToken,\n  User,\n  UserProfile,\n  getFlowMeta,\n  extractUserClaimsFromIdToken,\n  resolveResourceEndpoint,\n} from '@thunderid/node';\nimport {ThunderIDProviderProps} from '@thunderid/react';\nimport {FC, PropsWithChildren, ReactElement} from 'react';\nimport clearSession from './actions/clearSession';\nimport getSessionId from './actions/getSessionId';\nimport getSessionPayload from './actions/getSessionPayload';\nimport getUserAction from './actions/getUserAction';\nimport getUserProfileAction from './actions/getUserProfileAction';\nimport handleOAuthCallbackAction from './actions/handleOAuthCallbackAction';\nimport isSignedIn from './actions/isSignedIn';\nimport refreshToken from './actions/refreshToken';\nimport signInAction from './actions/signInAction';\nimport signOutAction from './actions/signOutAction';\nimport signUpAction from './actions/signUpAction';\nimport updateUserProfileAction from './actions/updateUserProfileAction';\nimport getClient from './getClient';\nimport ThunderIDClientProvider from '../client/contexts/ThunderID/ThunderIDProvider.js';\nimport {ThunderIDNextConfig} from '../models/config';\nimport logger from '../utils/logger';\nimport {SessionTokenPayload} from '../utils/SessionManager';\n\n/**\n * Props interface of {@link ThunderIDServerProvider}\n */\nexport type ThunderIDServerProviderProps = Partial<ThunderIDProviderProps> & {\n  clientSecret?: string;\n  /**\n   * Session cookie lifetime in seconds. Determines how long the session cookie\n   * remains valid in the browser after sign-in.\n   *\n   * Resolution order (first defined value wins):\n   *   1. This prop — set here when mounting the provider.\n   *   2. `THUNDERID_SESSION_COOKIE_EXPIRY_TIME` environment variable.\n   *   3. Built-in default of 86400 seconds (24 hours).\n   *\n   * @example\n   * // 8-hour session cookie\n   * <ThunderIDServerProvider sessionCookieExpiryTime={28800} ... />\n   */\n  sessionCookieExpiryTime?: number;\n};\n\n/**\n * Server-side provider component for ThunderID authentication.\n * Wraps the client-side provider and handles server-side authentication logic.\n * Uses the singleton ThunderIDNextClient instance for consistent authentication state.\n *\n * @param props - Props injected into the component.\n *\n * @example\n * ```tsx\n * <ThunderIDServerProvider config={thunderidConfig}>\n *   <YourApp />\n * </ThunderIDServerProvider>\n * ```\n *\n * @returns ThunderIDServerProvider component.\n */\nconst ThunderIDServerProvider: FC<PropsWithChildren<ThunderIDServerProviderProps>> = async ({\n  children,\n  afterSignInUrl,\n  afterSignOutUrl,\n  ..._config\n}: PropsWithChildren<ThunderIDServerProviderProps>): Promise<ReactElement> => {\n  const thunderIDClient = getClient();\n  let config: Partial<ThunderIDNextConfig> = {};\n\n  try {\n    await thunderIDClient.initialize(_config as ThunderIDNextConfig);\n\n    logger.debug('[ThunderIDServerProvider] ThunderID client initialized successfully.');\n\n    config = await thunderIDClient.getConfiguration();\n  } catch (error) {\n    logger.error('[ThunderIDServerProvider] Failed to initialize ThunderID client:', error?.toString());\n\n    throw new ThunderIDRuntimeError(\n      `Failed to initialize ThunderID client: ${error?.toString()}`,\n      'next-ConfigurationError-001',\n      'next',\n      'An error occurred while initializing the ThunderID client. Please check your configuration.',\n    );\n  }\n\n  if (!thunderIDClient.isInitialized) {\n    return <></>;\n  }\n\n  // Fetch flow metadata (design config + i18n bundle) server-side so `FlowMetaProvider` can seed\n  // its state and skip a redundant client-side fetch — avoiding a flash of untranslated i18n keys\n  // (e.g. raw `signin.forms.credentials.title`) while embedded flow components first render.\n  let flowMeta: FlowMetadataResponse | null = null;\n  try {\n    flowMeta = await getFlowMeta({\n      baseUrl: config?.baseUrl,\n      url: resolveResourceEndpoint('flowMeta', config),\n      ...(config?.applicationId ? {id: config.applicationId, type: FlowMetaType.App} : {}),\n    });\n  } catch (error) {\n    logger.warn('[ThunderIDServerProvider] Failed to fetch flow metadata:', error?.toString());\n  }\n\n  // Try to get session information from JWT first, then fall back to legacy\n  const sessionPayload: SessionTokenPayload | undefined = await getSessionPayload();\n  const sessionId: string = sessionPayload?.sessionId || (await getSessionId()) || '';\n  const signedIn: boolean = await isSignedIn(sessionId);\n\n  let user: User = {};\n  let userProfile: UserProfile = {\n    flattenedProfile: {},\n    profile: {},\n  };\n\n  const resolvedPreferences = {\n    ...config?.preferences,\n    ..._config.preferences,\n    user: {\n      ...config?.preferences?.user,\n      ..._config.preferences?.user,\n    },\n  };\n\n  if (signedIn) {\n    let updatedBaseUrl: string | undefined = config?.baseUrl;\n\n    if (sessionPayload?.organizationId) {\n      updatedBaseUrl = `${config?.baseUrl}/o`;\n      config = {...config, baseUrl: updatedBaseUrl};\n    } else if (sessionId) {\n      try {\n        const idToken: IdToken = await thunderIDClient.getDecodedIdToken(sessionId);\n        if (idToken?.['user_org']) {\n          updatedBaseUrl = `${config?.baseUrl}/o`;\n          config = {...config, baseUrl: updatedBaseUrl};\n        }\n      } catch {\n        // Continue without organization info\n      }\n    }\n\n    // Check if user profile fetching is enabled (default: true)\n    const shouldFetchUserProfile: boolean = resolvedPreferences?.user?.fetchUserProfile !== false;\n\n    if (shouldFetchUserProfile) {\n      try {\n        const userResponse: {\n          data: {user: User | null};\n          error: string | null;\n          success: boolean;\n        } = await getUserAction(sessionId);\n        const userProfileResponse: {\n          data: {userProfile: UserProfile};\n          error: string | null;\n          success: boolean;\n        } = await getUserProfileAction(sessionId);\n\n        user = userResponse.data?.user || {};\n        userProfile = userProfileResponse.data?.userProfile ?? userProfile;\n      } catch (error) {\n        logger.warn('[ThunderIDServerProvider] Failed to fetch user profile from /users/me:', error?.toString());\n      }\n    } else {\n      try {\n        const decodedIdToken: IdToken = await thunderIDClient.getDecodedIdToken(sessionId);\n        const claims = extractUserClaimsFromIdToken(decodedIdToken);\n        user = claims;\n        userProfile = {\n          flattenedProfile: claims,\n          profile: claims,\n        };\n      } catch (error) {\n        logger.warn('[ThunderIDServerProvider] Failed to extract user claims from ID token:', error?.toString());\n      }\n    }\n  }\n\n  return (\n    <ThunderIDClientProvider\n      organizationHandle={config?.organizationHandle}\n      applicationId={config?.applicationId}\n      baseUrl={config?.baseUrl}\n      initialMeta={flowMeta}\n      signIn={signInAction}\n      clearSession={clearSession}\n      refreshToken={refreshToken}\n      signOut={signOutAction}\n      signUp={signUpAction}\n      handleOAuthCallback={handleOAuthCallbackAction}\n      signInUrl={config?.signInUrl}\n      signUpUrl={config?.signUpUrl}\n      preferences={resolvedPreferences}\n      clientId={config?.clientId}\n      user={user}\n      userProfile={userProfile}\n      updateProfile={updateUserProfileAction}\n      isSignedIn={signedIn}\n    >\n      {children}\n    </ThunderIDClientProvider>\n  );\n};\n\nexport default ThunderIDServerProvider;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAyEA,MAAMA,0BAA+E,OAAO,EAC1F,UACA,gBACA,gBACA,GAAG,cACyE;CAC5E,MAAM,kBAAkBC,mBAAW;CACnC,IAAIC,SAAuC,EAAE;AAE7C,KAAI;AACF,QAAM,gBAAgB,WAAW,QAA+B;AAEhE,iBAAO,MAAM,uEAAuE;AAEpF,WAAS,MAAM,gBAAgB,kBAAkB;UAC1C,OAAO;AACd,iBAAO,MAAM,oEAAoE,OAAO,UAAU,CAAC;AAEnG,QAAM,IAAI,sBACR,0CAA0C,OAAO,UAAU,IAC3D,+BACA,QACA,8FACD;;AAGH,KAAI,CAAC,gBAAgB,cACnB,QAAO,iCAAK;CAMd,IAAIC,WAAwC;AAC5C,KAAI;AACF,aAAW,MAAM,YAAY;GAC3B,SAAS,QAAQ;GACjB,KAAK,wBAAwB,YAAY,OAAO;GAChD,GAAI,QAAQ,gBAAgB;IAAC,IAAI,OAAO;IAAe,MAAM,aAAa;IAAI,GAAG,EAAE;GACpF,CAAC;UACK,OAAO;AACd,iBAAO,KAAK,4DAA4D,OAAO,UAAU,CAAC;;CAI5F,MAAMC,iBAAkD,MAAMC,2BAAmB;CACjF,MAAMC,YAAoB,gBAAgB,aAAc,MAAMC,sBAAc,IAAK;CACjF,MAAMC,WAAoB,MAAMC,mBAAW,UAAU;CAErD,IAAIC,OAAa,EAAE;CACnB,IAAIC,cAA2B;EAC7B,kBAAkB,EAAE;EACpB,SAAS,EAAE;EACZ;CAED,MAAM,sBAAsB;EAC1B,GAAG,QAAQ;EACX,GAAG,QAAQ;EACX,MAAM;GACJ,GAAG,QAAQ,aAAa;GACxB,GAAG,QAAQ,aAAa;GACzB;EACF;AAED,KAAI,UAAU;EACZ,IAAIC,iBAAqC,QAAQ;AAEjD,MAAI,gBAAgB,gBAAgB;AAClC,oBAAiB,GAAG,QAAQ,QAAQ;AACpC,YAAS;IAAC,GAAG;IAAQ,SAAS;IAAe;aACpC,UACT,KAAI;AAEF,QADyB,MAAM,gBAAgB,kBAAkB,UAAU,IAC7D,aAAa;AACzB,qBAAiB,GAAG,QAAQ,QAAQ;AACpC,aAAS;KAAC,GAAG;KAAQ,SAAS;KAAe;;UAEzC;AAQV,MAFwC,qBAAqB,MAAM,qBAAqB,MAGtF,KAAI;GACF,MAAMC,eAIF,MAAMC,sBAAc,UAAU;GAClC,MAAMC,sBAIF,MAAMC,6BAAqB,UAAU;AAEzC,UAAO,aAAa,MAAM,QAAQ,EAAE;AACpC,iBAAc,oBAAoB,MAAM,eAAe;WAChD,OAAO;AACd,kBAAO,KAAK,0EAA0E,OAAO,UAAU,CAAC;;MAG1G,KAAI;GAEF,MAAM,SAAS,6BADiB,MAAM,gBAAgB,kBAAkB,UAAU,CACvB;AAC3D,UAAO;AACP,iBAAc;IACZ,kBAAkB;IAClB,SAAS;IACV;WACM,OAAO;AACd,kBAAO,KAAK,0EAA0E,OAAO,UAAU,CAAC;;;AAK9G,QACE,oBAACC;EACC,oBAAoB,QAAQ;EAC5B,eAAe,QAAQ;EACvB,SAAS,QAAQ;EACjB,aAAa;EACb,QAAQC;EACR,cAAcC;EACd,cAAcC;EACd,SAASC;EACT,QAAQC;EACR,qBAAqBC;EACrB,WAAW,QAAQ;EACnB,WAAW,QAAQ;EACnB,aAAa;EACb,UAAU,QAAQ;EACZ;EACO;EACb,eAAeC;EACf,YAAY;EAEX;GACuB;;AAI9B,kCAAe"}
+{"version":3,"file":"ThunderIDProvider.js","names":["ThunderIDServerProvider: FC<PropsWithChildren<ThunderIDServerProviderProps>>","getClient","config: Partial<ThunderIDNextConfig>","flowMeta: FlowMetadataResponse | null","sessionPayload: SessionTokenPayload | undefined","getSessionPayload","sessionId: string","getSessionId","signedIn: boolean","isSignedIn","user: User","userProfile: UserProfile","userSchema: Record<string, AttributeSchema> | null","updatedBaseUrl: string | undefined","userResponse: {\n          data: {user: User | null};\n          error: string | null;\n          success: boolean;\n        }","getUserAction","userProfileResponse: {\n          data: {userProfile: UserProfile};\n          error: string | null;\n          success: boolean;\n        }","getUserProfileAction","userSchemaResponse: {\n          data: {userSchema: Record<string, AttributeSchema> | null};\n          error: string | null;\n          success: boolean;\n        }","getUserSchemaAction","ThunderIDClientProvider","getFlowMetaAction","signInAction","clearSession","refreshToken","signOutAction","signUpAction","handleOAuthCallbackAction","updateUserProfileAction"],"sources":["../../src/server/ThunderIDProvider.tsx"],"sourcesContent":["// Copyright 2025 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\n'use server';\n\nimport {\n  ThunderIDRuntimeError,\n  AttributeSchema,\n  FlowMetadataResponse,\n  FlowMetaType,\n  IdToken,\n  User,\n  UserProfile,\n  getFlowMeta,\n  extractUserClaimsFromIdToken,\n  resolveResourceEndpoint,\n} from '@thunderid/node';\nimport {ThunderIDProviderProps} from '@thunderid/react';\nimport {FC, PropsWithChildren, ReactElement} from 'react';\nimport clearSession from './actions/clearSession';\nimport getSessionId from './actions/getSessionId';\nimport getSessionPayload from './actions/getSessionPayload';\nimport getUserAction from './actions/getUserAction';\nimport getUserProfileAction from './actions/getUserProfileAction';\nimport getUserSchemaAction from './actions/getUserSchemaAction';\nimport handleOAuthCallbackAction from './actions/handleOAuthCallbackAction';\nimport isSignedIn from './actions/isSignedIn';\nimport refreshToken from './actions/refreshToken';\nimport signInAction from './actions/signInAction';\nimport signOutAction from './actions/signOutAction';\nimport signUpAction from './actions/signUpAction';\nimport updateUserProfileAction from './actions/updateUserProfileAction';\nimport getFlowMetaAction from './actions/getFlowMetaAction';\nimport getClient from './getClient';\nimport ThunderIDClientProvider from '../client/contexts/ThunderID/ThunderIDProvider.js';\nimport {ThunderIDNextConfig} from '../models/config';\nimport logger from '../utils/logger';\nimport {SessionTokenPayload} from '../utils/SessionManager';\n\n/**\n * Props interface of {@link ThunderIDServerProvider}\n */\nexport type ThunderIDServerProviderProps = Partial<ThunderIDProviderProps> & {\n  clientSecret?: string;\n  /**\n   * Session cookie lifetime in seconds. Determines how long the session cookie\n   * remains valid in the browser after sign-in.\n   *\n   * Resolution order (first defined value wins):\n   *   1. This prop — set here when mounting the provider.\n   *   2. `THUNDERID_SESSION_COOKIE_EXPIRY_TIME` environment variable.\n   *   3. Built-in default of 86400 seconds (24 hours).\n   *\n   * @example\n   * // 8-hour session cookie\n   * <ThunderIDServerProvider sessionCookieExpiryTime={28800} ... />\n   */\n  sessionCookieExpiryTime?: number;\n};\n\n/**\n * Server-side provider component for ThunderID authentication.\n * Wraps the client-side provider and handles server-side authentication logic.\n * Uses the singleton ThunderIDNextClient instance for consistent authentication state.\n *\n * @param props - Props injected into the component.\n *\n * @example\n * ```tsx\n * <ThunderIDServerProvider config={thunderidConfig}>\n *   <YourApp />\n * </ThunderIDServerProvider>\n * ```\n *\n * @returns ThunderIDServerProvider component.\n */\nconst ThunderIDServerProvider: FC<PropsWithChildren<ThunderIDServerProviderProps>> = async ({\n  children,\n  afterSignInUrl,\n  afterSignOutUrl,\n  ..._config\n}: PropsWithChildren<ThunderIDServerProviderProps>): Promise<ReactElement> => {\n  const thunderIDClient = getClient();\n  let config: Partial<ThunderIDNextConfig> = {};\n\n  try {\n    await thunderIDClient.initialize(_config as ThunderIDNextConfig);\n\n    logger.debug('[ThunderIDServerProvider] ThunderID client initialized successfully.');\n\n    config = await thunderIDClient.getConfiguration();\n  } catch (error) {\n    logger.error('[ThunderIDServerProvider] Failed to initialize ThunderID client:', error?.toString());\n\n    throw new ThunderIDRuntimeError(\n      `Failed to initialize ThunderID client: ${error?.toString()}`,\n      'next-ConfigurationError-001',\n      'next',\n      'An error occurred while initializing the ThunderID client. Please check your configuration.',\n    );\n  }\n\n  if (!thunderIDClient.isInitialized) {\n    return <></>;\n  }\n\n  // Fetch flow metadata (design config + i18n bundle) server-side so `FlowMetaProvider` can seed\n  // its state and skip a redundant client-side fetch — avoiding a flash of untranslated i18n keys\n  // (e.g. raw `signin.forms.credentials.title`) while embedded flow components first render.\n  let flowMeta: FlowMetadataResponse | null = null;\n  try {\n    flowMeta = await getFlowMeta({\n      baseUrl: config?.baseUrl,\n      url: resolveResourceEndpoint('flowMeta', config),\n      ...(config?.applicationId ? {id: config.applicationId, type: FlowMetaType.App} : {}),\n    });\n  } catch (error) {\n    logger.warn('[ThunderIDServerProvider] Failed to fetch flow metadata:', error?.toString());\n  }\n\n  // Try to get session information from JWT first, then fall back to legacy\n  const sessionPayload: SessionTokenPayload | undefined = await getSessionPayload();\n  const sessionId: string = sessionPayload?.sessionId || (await getSessionId()) || '';\n  const signedIn: boolean = await isSignedIn(sessionId);\n\n  let user: User = {};\n  let userProfile: UserProfile = {\n    flattenedProfile: {},\n    profile: {},\n  };\n  let userSchema: Record<string, AttributeSchema> | null = null;\n\n  const resolvedPreferences = {\n    ...config?.preferences,\n    ..._config.preferences,\n    user: {\n      ...config?.preferences?.user,\n      ..._config.preferences?.user,\n    },\n  };\n\n  if (signedIn) {\n    let updatedBaseUrl: string | undefined = config?.baseUrl;\n\n    if (sessionPayload?.organizationId) {\n      updatedBaseUrl = `${config?.baseUrl}/o`;\n      config = {...config, baseUrl: updatedBaseUrl};\n    } else if (sessionId) {\n      try {\n        const idToken: IdToken = await thunderIDClient.getDecodedIdToken(sessionId);\n        if (idToken?.['user_org']) {\n          updatedBaseUrl = `${config?.baseUrl}/o`;\n          config = {...config, baseUrl: updatedBaseUrl};\n        }\n      } catch {\n        // Continue without organization info\n      }\n    }\n\n    // Check if user profile fetching is enabled (default: true)\n    const shouldFetchUserProfile: boolean = resolvedPreferences?.user?.fetchUserProfile !== false;\n\n    if (shouldFetchUserProfile) {\n      try {\n        const userResponse: {\n          data: {user: User | null};\n          error: string | null;\n          success: boolean;\n        } = await getUserAction(sessionId);\n        const userProfileResponse: {\n          data: {userProfile: UserProfile};\n          error: string | null;\n          success: boolean;\n        } = await getUserProfileAction(sessionId);\n        const userSchemaResponse: {\n          data: {userSchema: Record<string, AttributeSchema> | null};\n          error: string | null;\n          success: boolean;\n        } = await getUserSchemaAction(sessionId);\n\n        user = userResponse.data?.user || {};\n        userProfile = userProfileResponse.data?.userProfile ?? userProfile;\n        userSchema = userSchemaResponse.data?.userSchema ?? null;\n      } catch (error) {\n        logger.warn('[ThunderIDServerProvider] Failed to fetch user profile from /users/me:', error?.toString());\n      }\n    } else {\n      try {\n        const decodedIdToken: IdToken = await thunderIDClient.getDecodedIdToken(sessionId);\n        const claims = extractUserClaimsFromIdToken(decodedIdToken);\n        user = claims;\n        userProfile = {\n          flattenedProfile: claims,\n          profile: claims,\n        };\n      } catch (error) {\n        logger.warn('[ThunderIDServerProvider] Failed to extract user claims from ID token:', error?.toString());\n      }\n    }\n  }\n\n  return (\n    <ThunderIDClientProvider\n      organizationHandle={config?.organizationHandle}\n      applicationId={config?.applicationId}\n      baseUrl={config?.baseUrl}\n      initialMeta={flowMeta}\n      fetchMeta={getFlowMetaAction}\n      signIn={signInAction}\n      clearSession={clearSession}\n      refreshToken={refreshToken}\n      signOut={signOutAction}\n      signUp={signUpAction}\n      handleOAuthCallback={handleOAuthCallbackAction}\n      signInUrl={config?.signInUrl}\n      signUpUrl={config?.signUpUrl}\n      preferences={resolvedPreferences}\n      clientId={config?.clientId}\n      user={user}\n      userProfile={userProfile}\n      userSchema={userSchema}\n      updateProfile={updateUserProfileAction}\n      isSignedIn={signedIn}\n    >\n      {children}\n    </ThunderIDClientProvider>\n  );\n};\n\nexport default ThunderIDServerProvider;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA4EA,MAAMA,0BAA+E,OAAO,EAC1F,UACA,gBACA,gBACA,GAAG,cACyE;CAC5E,MAAM,kBAAkBC,mBAAW;CACnC,IAAIC,SAAuC,EAAE;AAE7C,KAAI;AACF,QAAM,gBAAgB,WAAW,QAA+B;AAEhE,iBAAO,MAAM,uEAAuE;AAEpF,WAAS,MAAM,gBAAgB,kBAAkB;UAC1C,OAAO;AACd,iBAAO,MAAM,oEAAoE,OAAO,UAAU,CAAC;AAEnG,QAAM,IAAI,sBACR,0CAA0C,OAAO,UAAU,IAC3D,+BACA,QACA,8FACD;;AAGH,KAAI,CAAC,gBAAgB,cACnB,QAAO,iCAAK;CAMd,IAAIC,WAAwC;AAC5C,KAAI;AACF,aAAW,MAAM,YAAY;GAC3B,SAAS,QAAQ;GACjB,KAAK,wBAAwB,YAAY,OAAO;GAChD,GAAI,QAAQ,gBAAgB;IAAC,IAAI,OAAO;IAAe,MAAM,aAAa;IAAI,GAAG,EAAE;GACpF,CAAC;UACK,OAAO;AACd,iBAAO,KAAK,4DAA4D,OAAO,UAAU,CAAC;;CAI5F,MAAMC,iBAAkD,MAAMC,2BAAmB;CACjF,MAAMC,YAAoB,gBAAgB,aAAc,MAAMC,sBAAc,IAAK;CACjF,MAAMC,WAAoB,MAAMC,mBAAW,UAAU;CAErD,IAAIC,OAAa,EAAE;CACnB,IAAIC,cAA2B;EAC7B,kBAAkB,EAAE;EACpB,SAAS,EAAE;EACZ;CACD,IAAIC,aAAqD;CAEzD,MAAM,sBAAsB;EAC1B,GAAG,QAAQ;EACX,GAAG,QAAQ;EACX,MAAM;GACJ,GAAG,QAAQ,aAAa;GACxB,GAAG,QAAQ,aAAa;GACzB;EACF;AAED,KAAI,UAAU;EACZ,IAAIC,iBAAqC,QAAQ;AAEjD,MAAI,gBAAgB,gBAAgB;AAClC,oBAAiB,GAAG,QAAQ,QAAQ;AACpC,YAAS;IAAC,GAAG;IAAQ,SAAS;IAAe;aACpC,UACT,KAAI;AAEF,QADyB,MAAM,gBAAgB,kBAAkB,UAAU,IAC7D,aAAa;AACzB,qBAAiB,GAAG,QAAQ,QAAQ;AACpC,aAAS;KAAC,GAAG;KAAQ,SAAS;KAAe;;UAEzC;AAQV,MAFwC,qBAAqB,MAAM,qBAAqB,MAGtF,KAAI;GACF,MAAMC,eAIF,MAAMC,sBAAc,UAAU;GAClC,MAAMC,sBAIF,MAAMC,6BAAqB,UAAU;GACzC,MAAMC,qBAIF,MAAMC,4BAAoB,UAAU;AAExC,UAAO,aAAa,MAAM,QAAQ,EAAE;AACpC,iBAAc,oBAAoB,MAAM,eAAe;AACvD,gBAAa,mBAAmB,MAAM,cAAc;WAC7C,OAAO;AACd,kBAAO,KAAK,0EAA0E,OAAO,UAAU,CAAC;;MAG1G,KAAI;GAEF,MAAM,SAAS,6BADiB,MAAM,gBAAgB,kBAAkB,UAAU,CACvB;AAC3D,UAAO;AACP,iBAAc;IACZ,kBAAkB;IAClB,SAAS;IACV;WACM,OAAO;AACd,kBAAO,KAAK,0EAA0E,OAAO,UAAU,CAAC;;;AAK9G,QACE,oBAACC;EACC,oBAAoB,QAAQ;EAC5B,eAAe,QAAQ;EACvB,SAAS,QAAQ;EACjB,aAAa;EACb,WAAWC;EACX,QAAQC;EACR,cAAcC;EACd,cAAcC;EACd,SAASC;EACT,QAAQC;EACR,qBAAqBC;EACrB,WAAW,QAAQ;EACnB,WAAW,QAAQ;EACnB,aAAa;EACb,UAAU,QAAQ;EACZ;EACO;EACD;EACZ,eAAeC;EACf,YAAY;EAEX;GACuB;;AAI9B,kCAAe"}

package/dist/server/actions/clearSession.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"clearSession.d.ts","sourceRoot":"","sources":["../../../src/server/actions/clearSession.ts"],"names":[],"mappings":"AAWA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,QAAA,MAAM,YAAY,QAAa,OAAO,CAAC,IAAI,CAK1C,CAAC;AAEF,eAAe,YAAY,CAAC"}
+{"version":3,"file":"clearSession.d.ts","sourceRoot":"","sources":["../../../src/server/actions/clearSession.ts"],"names":[],"mappings":"AAYA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,QAAA,MAAM,YAAY,QAAa,OAAO,CAAC,IAAI,CAK1C,CAAC;AAEF,eAAe,YAAY,CAAC"}

package/dist/server/actions/clearSession.js

@@ -1,6 +1,7 @@
 'use server';
 
 
+import { deleteChunkedCookie } from "../../utils/chunkedCookie.js";
 import SessionManager_default from "../../utils/SessionManager.js";
 import logger_default from "../../utils/logger.js";
 import { cookies } from "next/headers";
@@ -28,7 +29,7 @@ import { cookies } from "next/headers";
 */
 const clearSession = async () => {
 	const cookieStore = await cookies();
-	cookieStore.delete(SessionManager_default.getSessionCookieName());
+	deleteChunkedCookie(cookieStore, SessionManager_default.getSessionCookieName());
 	cookieStore.delete(SessionManager_default.getTempSessionCookieName());
 	logger_default.debug("[clearSession] Session cookies cleared.");
 };