@thunderid/nextjs 1.2.3 → 1.3.0

package/dist/ThunderIDNextClient.d.ts

@@ -1,4 +1,4 @@
-import { ThunderIDNodeClient, AttributeSchema, ExtendedAuthorizeRequestUrlParams, IdToken, SignInOptions, SignUpOptions, Storage, TokenExchangeRequestConfig, TokenResponse, User, UserProfile } from '@thunderid/node';
+import { ThunderIDNodeClient, AttributeSchema, ExtendedAuthorizeRequestUrlParams, IdToken, SignInOptions, SignUpOptions, Storage, TokenExchangeRequestConfig, TokenResponse, User, ManagedFlowListResponse, ManagedUserListResponse, ManagedUserTypeListResponse, UserProfile } from '@thunderid/node';
 import { ThunderIDNextConfig } from './models/config';
 declare class ThunderIDNextClient<T extends ThunderIDNextConfig = ThunderIDNextConfig> extends ThunderIDNodeClient<T> {
     isInitialized: boolean;
@@ -26,6 +26,38 @@ declare class ThunderIDNextClient<T extends ThunderIDNextConfig = ThunderIDNextC
      * boundary back to the client.
      */
     updateUserCredentials(payload: Record<string, string>, userId?: string): Promise<void>;
+    /**
+     * Retrieves one page of the user directory for the session identified by `userId`.
+     *
+     * Ensures the client is initialized first, like `updateUserCredentials`. Errors are not caught so the calling server action can map the real `ThunderIDAPIError`.
+     */
+    getUsers(options?: {
+        filter?: string;
+        limit?: number;
+        offset?: number;
+        signal?: AbortSignal;
+    }, userId?: string): Promise<ManagedUserListResponse>;
+    /**
+     * Retrieves one page of flows for the session identified by `userId`.
+     *
+     * Ensures the client is initialized first, like `getUsers`. Errors are not caught so the calling server action can map the real `ThunderIDAPIError`.
+     */
+    getFlows(options?: {
+        flowType?: string;
+        limit?: number;
+        offset?: number;
+        signal?: AbortSignal;
+    }, userId?: string): Promise<ManagedFlowListResponse>;
+    /**
+     * Retrieves one page of user types for the session identified by `userId`.
+     *
+     * Ensures the client is initialized first, like `getUsers`. Errors are not caught so the calling server action can map the real `ThunderIDAPIError`.
+     */
+    getUserTypes(options?: {
+        limit?: number;
+        offset?: number;
+        signal?: AbortSignal;
+    }, userId?: string): Promise<ManagedUserTypeListResponse>;
     isLoading(): boolean;
     isSignedIn(sessionId?: string): Promise<boolean>;
     exchangeToken(config: TokenExchangeRequestConfig, sessionId?: string): Promise<TokenResponse | Response>;

package/dist/ThunderIDNextClient.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ThunderIDNextClient.d.ts","sourceRoot":"","sources":["../src/ThunderIDNextClient.ts"],"names":[],"mappings":"AAGA,OAAO,EACL,mBAAmB,EAEnB,eAAe,EAGf,iCAAiC,EACjC,OAAO,EACP,aAAa,EACb,aAAa,EACb,OAAO,EACP,0BAA0B,EAC1B,aAAa,EACb,IAAI,EACJ,WAAW,EASZ,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAC,mBAAmB,EAAC,MAAM,iBAAiB,CAAC;AAKpD,cAAM,mBAAmB,CAAC,CAAC,SAAS,mBAAmB,GAAG,mBAAmB,CAAE,SAAQ,mBAAmB,CAAC,CAAC,CAAC;IACpG,aAAa,UAAS;;YAMf,iBAAiB;IAehB,UAAU,CAAC,MAAM,EAAE,CAAC,EAAE,OAAO,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IA0C1D,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC;IAclD,OAAO,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAsBvC,cAAc,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC;IA2B9D,aAAa,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,GAAG,IAAI,CAAC;IAqBtE,iBAAiB,CAAC,OAAO,EAAE,GAAG,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAyB9E;;;;;;;;;;;;;;OAcG;IACY,qBAAqB,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAgB5F,SAAS,IAAI,OAAO;IAIpB,UAAU,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAIhD,aAAa,CAAC,MAAM,EAAE,0BAA0B,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,QAAQ,CAAC;IAKlG,cAAc,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAgBpD,iBAAiB,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAKzE,MAAM,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC;IA+BpC,OAAO,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC;IA4BxC,MAAM,CAAC,QAAQ,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC;IAUrD,cAAc,CAAC,QAAQ,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,GAAG,OAAO,CAAC;IAS7D,sBAAsB,CACjC,YAAY,EAAE,iCAAiC,EAC/C,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,MAAM,CAAC;IAKF,iBAAiB,IAAI,GAAG;IAIlB,YAAY,IAAI,OAAO,CAAC,IAAI,CAAC;IASpC,UAAU,CAAC,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIzF,cAAc,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC;CAGhF;AAED,eAAe,mBAAmB,CAAC"}
+{"version":3,"file":"ThunderIDNextClient.d.ts","sourceRoot":"","sources":["../src/ThunderIDNextClient.ts"],"names":[],"mappings":"AAGA,OAAO,EACL,mBAAmB,EAEnB,eAAe,EAGf,iCAAiC,EACjC,OAAO,EACP,aAAa,EACb,aAAa,EACb,OAAO,EACP,0BAA0B,EAC1B,aAAa,EACb,IAAI,EACJ,uBAAuB,EACvB,uBAAuB,EACvB,2BAA2B,EAC3B,WAAW,EASZ,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAC,mBAAmB,EAAC,MAAM,iBAAiB,CAAC;AAKpD,cAAM,mBAAmB,CAAC,CAAC,SAAS,mBAAmB,GAAG,mBAAmB,CAAE,SAAQ,mBAAmB,CAAC,CAAC,CAAC;IACpG,aAAa,UAAS;;YAMf,iBAAiB;IAehB,UAAU,CAAC,MAAM,EAAE,CAAC,EAAE,OAAO,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IA0C1D,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC;IAclD,OAAO,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAsBvC,cAAc,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC;IA2B9D,aAAa,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,GAAG,IAAI,CAAC;IAqBtE,iBAAiB,CAAC,OAAO,EAAE,GAAG,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAyB9E;;;;;;;;;;;;;;OAcG;IACY,qBAAqB,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAgBrG;;;;OAIG;IACY,QAAQ,CACrB,OAAO,GAAE;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,WAAW,CAAA;KAAM,EACtF,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,uBAAuB,CAAC;IAMnC;;;;OAIG;IACY,QAAQ,CACrB,OAAO,GAAE;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,WAAW,CAAA;KAAM,EACxF,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,uBAAuB,CAAC;IAMnC;;;;OAIG;IACY,YAAY,CACzB,OAAO,GAAE;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,WAAW,CAAA;KAAM,EACrE,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,2BAA2B,CAAC;IAM9B,SAAS,IAAI,OAAO;IAIpB,UAAU,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAIhD,aAAa,CAAC,MAAM,EAAE,0BAA0B,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,QAAQ,CAAC;IAKlG,cAAc,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAgBpD,iBAAiB,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAKzE,MAAM,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC;IA+BpC,OAAO,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC;IA4BxC,MAAM,CAAC,QAAQ,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC;IAUrD,cAAc,CAAC,QAAQ,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,GAAG,OAAO,CAAC;IAS7D,sBAAsB,CACjC,YAAY,EAAE,iCAAiC,EAC/C,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,MAAM,CAAC;IAKF,iBAAiB,IAAI,GAAG;IAIlB,YAAY,IAAI,OAAO,CAAC,IAAI,CAAC;IASpC,UAAU,CAAC,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIzF,cAAc,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC;CAGhF;AAED,eAAe,mBAAmB,CAAC"}

package/dist/ThunderIDNextClient.js

@@ -133,6 +133,33 @@ var ThunderIDNextClient = class extends ThunderIDNodeClient {
 			payload
 		});
 	}
+	/**
+	* Retrieves one page of the user directory for the session identified by `userId`.
+	*
+	* Ensures the client is initialized first, like `updateUserCredentials`. Errors are not caught so the calling server action can map the real `ThunderIDAPIError`.
+	*/
+	async getUsers(options = {}, userId) {
+		await this.ensureInitialized();
+		return super.getUsers(options, userId);
+	}
+	/**
+	* Retrieves one page of flows for the session identified by `userId`.
+	*
+	* Ensures the client is initialized first, like `getUsers`. Errors are not caught so the calling server action can map the real `ThunderIDAPIError`.
+	*/
+	async getFlows(options = {}, userId) {
+		await this.ensureInitialized();
+		return super.getFlows(options, userId);
+	}
+	/**
+	* Retrieves one page of user types for the session identified by `userId`.
+	*
+	* Ensures the client is initialized first, like `getUsers`. Errors are not caught so the calling server action can map the real `ThunderIDAPIError`.
+	*/
+	async getUserTypes(options = {}, userId) {
+		await this.ensureInitialized();
+		return super.getUserTypes(options, userId);
+	}
 	isLoading() {
 		return false;
 	}

package/dist/ThunderIDNextClient.js.map

@@ -1 +1 @@
-{"version":3,"file":"ThunderIDNextClient.js","names":["decorateConfigWithNextEnv","origin: string","getClientOrigin","initialized: boolean","resolvedSessionId: string","getSessionId","configData: AuthClientConfig<T>","baseUrl: string | undefined","profile: User","token: string | undefined","arg1: any","arg2: any","arg3: any","arg4: any","configData: ThunderIDNextConfig","afterSignOutUrl: string","message: string"],"sources":["../src/ThunderIDNextClient.ts"],"sourcesContent":["// Copyright 2025 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\nimport {\n  ThunderIDNodeClient,\n  ThunderIDRuntimeError,\n  AttributeSchema,\n  AuthClientConfig,\n  EmbeddedSignInFlowResponse,\n  ExtendedAuthorizeRequestUrlParams,\n  IdToken,\n  SignInOptions,\n  SignUpOptions,\n  Storage,\n  TokenExchangeRequestConfig,\n  TokenResponse,\n  User,\n  UserProfile,\n  executeEmbeddedSignInFlow,\n  extractUserClaimsFromIdToken,\n  generateFlattenedUserProfile,\n  getUsersMe,\n  getUsersMeMeta,\n  updateMeCredentials,\n  updateMeProfile,\n  resolveResourceEndpoint,\n} from '@thunderid/node';\nimport {ThunderIDNextConfig} from './models/config';\nimport getClientOrigin from './server/actions/getClientOrigin';\nimport getSessionId from './server/actions/getSessionId';\nimport decorateConfigWithNextEnv from './utils/decorateConfigWithNextEnv';\n\nclass ThunderIDNextClient<T extends ThunderIDNextConfig = ThunderIDNextConfig> extends ThunderIDNodeClient<T> {\n  public isInitialized = false;\n\n  public constructor() {\n    super();\n  }\n\n  private async ensureInitialized(): Promise<void> {\n    if (!this.isInitialized) {\n      // Server actions may run in a module context that hasn't been through\n      // ThunderIDServerProvider (e.g. a different worker). Try to initialize\n      // from environment variables before giving up.\n      await this.initialize({} as T);\n    }\n\n    if (!this.isInitialized) {\n      throw new Error(\n        '[ThunderIDNextClient] Client is not initialized. Make sure you have wrapped your app with ThunderIDProvider and provided the required configuration (baseUrl, clientId, etc.).',\n      );\n    }\n  }\n\n  override async initialize(config: T, storage?: Storage): Promise<boolean> {\n    if (this.isInitialized) {\n      return Promise.resolve(true);\n    }\n\n    const {\n      baseUrl,\n      organizationHandle,\n      clientId,\n      clientSecret,\n      flowSecret,\n      signInUrl,\n      afterSignInUrl,\n      afterSignOutUrl,\n      signUpUrl,\n      ...rest\n    } = decorateConfigWithNextEnv(config);\n\n    const origin: string = await getClientOrigin();\n\n    const initialized: boolean = await super.initialize(\n      {\n        ...rest,\n        afterSignInUrl: afterSignInUrl ?? origin,\n        afterSignOutUrl: afterSignOutUrl ?? origin,\n        baseUrl,\n        clientId,\n        clientSecret,\n        enablePKCE: (rest as any).enablePKCE ?? true,\n        flowSecret,\n        organizationHandle,\n        signInUrl,\n        signUpUrl,\n      } as any,\n      storage,\n    );\n\n    this.isInitialized = initialized;\n\n    return initialized;\n  }\n\n  override async reInitialize(config: Partial<T>): Promise<boolean> {\n    try {\n      await super.reInitialize(config);\n      return true;\n    } catch (error) {\n      throw new ThunderIDRuntimeError(\n        `Failed to re-initialize the client: ${error instanceof Error ? error.message : String(error)}`,\n        'ThunderIDNextClient-reInitialize-RuntimeError-001',\n        'nextjs',\n        'An error occurred while re-initializing the client. Please check your configuration and network connection.',\n      );\n    }\n  }\n\n  override async getUser(userId?: string): Promise<User> {\n    await this.ensureInitialized();\n    const resolvedSessionId: string = userId || (await getSessionId())!;\n\n    try {\n      const configData: AuthClientConfig<T> = await this.getStorageManager().getConfigData();\n      const baseUrl: string | undefined = configData?.baseUrl;\n\n      const profile: User = await getUsersMe({\n        baseUrl,\n        url: resolveResourceEndpoint('usersMe', configData),\n        headers: {\n          Authorization: `Bearer ${await this.getAccessToken(userId)}`,\n        },\n      });\n\n      return profile;\n    } catch (error) {\n      return await super.getUser(resolvedSessionId);\n    }\n  }\n\n  override async getUserProfile(userId?: string): Promise<UserProfile> {\n    await this.ensureInitialized();\n\n    try {\n      const configData: AuthClientConfig<T> = await this.getStorageManager().getConfigData();\n      const baseUrl: string | undefined = configData?.baseUrl;\n\n      const profile: User = await getUsersMe({\n        baseUrl,\n        url: resolveResourceEndpoint('usersMe', configData),\n        headers: {\n          Authorization: `Bearer ${await this.getAccessToken(userId)}`,\n        },\n      });\n\n      return {\n        flattenedProfile: generateFlattenedUserProfile(profile),\n        profile,\n      };\n    } catch (error) {\n      return {\n        flattenedProfile: extractUserClaimsFromIdToken(await super.getDecodedIdToken(userId)),\n        profile: extractUserClaimsFromIdToken(await super.getDecodedIdToken(userId)),\n      };\n    }\n  }\n\n  async getUserSchema(userId?: string): Promise<Record<string, AttributeSchema> | null> {\n    await this.ensureInitialized();\n\n    try {\n      const configData: AuthClientConfig<T> = await this.getStorageManager().getConfigData();\n      const baseUrl: string | undefined = configData?.baseUrl;\n\n      const {schema} = await getUsersMeMeta({\n        baseUrl,\n        url: resolveResourceEndpoint('usersMeMeta', configData),\n        headers: {\n          Authorization: `Bearer ${await this.getAccessToken(userId)}`,\n        },\n      });\n\n      return schema ?? null;\n    } catch (error) {\n      return null;\n    }\n  }\n\n  override async updateUserProfile(payload: any, userId?: string): Promise<User> {\n    await this.ensureInitialized();\n\n    try {\n      const configData: AuthClientConfig<T> = await this.getStorageManager().getConfigData();\n      const baseUrl: string | undefined = configData?.baseUrl;\n\n      return updateMeProfile({\n        baseUrl,\n        url: resolveResourceEndpoint('usersMe', configData),\n        headers: {\n          Authorization: `Bearer ${await this.getAccessToken(userId)}`,\n        },\n        payload: payload?.payload ?? payload,\n      });\n    } catch (error) {\n      throw new ThunderIDRuntimeError(\n        `Failed to update user profile: ${error instanceof Error ? error.message : String(error)}`,\n        'ThunderIDNextClient-UpdateProfileError-001',\n        'react',\n        'An error occurred while updating the user profile. Please check your configuration and network connection.',\n      );\n    }\n  }\n\n  /**\n   * Updates one or more of the signed-in user's credentials (e.g. `password`, or any other\n   * attribute the user type schema declares `credential: true`).\n   *\n   * Not part of {@link ThunderIDJavaScriptClient}'s base surface — unlike `updateUserProfile`,\n   * no other SDK routes credential updates through a client method (React/Vue's\n   * `ChangeCredential` call the core `updateMeCredentials` function directly), so this is a\n   * Next.js-specific addition rather than an override. Kept here anyway so this SDK's own\n   * server actions have one consistent way to reach every `/users/me/*` operation.\n   *\n   * Deliberately does not catch and rewrap errors the way `updateUserProfile` does: the caller\n   * (`updateUserCredentialsAction`) needs the real `ThunderIDAPIError` instance, status code\n   * included, to map a failure onto the right form field before it crosses the server action\n   * boundary back to the client.\n   */\n  override async updateUserCredentials(payload: Record<string, string>, userId?: string): Promise<void> {\n    await this.ensureInitialized();\n\n    const configData: AuthClientConfig<T> = await this.getStorageManager().getConfigData();\n    const baseUrl: string | undefined = configData?.baseUrl;\n\n    await updateMeCredentials({\n      baseUrl,\n      url: resolveResourceEndpoint('usersMeCredentials', configData),\n      headers: {\n        Authorization: `Bearer ${await this.getAccessToken(userId)}`,\n      },\n      payload,\n    });\n  }\n\n  override isLoading(): boolean {\n    return false;\n  }\n\n  override isSignedIn(sessionId?: string): Promise<boolean> {\n    return super.isSignedIn(sessionId);\n  }\n\n  override exchangeToken(config: TokenExchangeRequestConfig, sessionId?: string): Promise<TokenResponse | Response> {\n    return super.exchangeToken(config, sessionId) as unknown as Promise<TokenResponse | Response>;\n  }\n\n  // eslint-disable-next-line @typescript-eslint/no-unused-vars\n  override async getAccessToken(_sessionId?: string): Promise<string> {\n    const {default: getAccessToken} = await import('./server/actions/getAccessToken');\n    const token: string | undefined = await getAccessToken();\n\n    if (typeof token !== 'string' || !token) {\n      throw new ThunderIDRuntimeError(\n        'Failed to get access token.',\n        'ThunderIDNextClient-getAccessToken-RuntimeError-003',\n        'nextjs',\n        'An error occurred while obtaining the access token. Please check your configuration and network connection.',\n      );\n    }\n\n    return token;\n  }\n\n  override async getDecodedIdToken(sessionId?: string, idToken?: string): Promise<IdToken> {\n    await this.ensureInitialized();\n    return await super.getDecodedIdToken(sessionId, idToken);\n  }\n\n  override async signIn(...args: any[]): Promise<any> {\n    const arg1: any = args[0];\n    const arg2: any = args[1];\n    const arg3: any = args[2];\n    const arg4: any = args[3];\n\n    // An embedded sign-in flow payload initiates or continues a `POST /flow/execute` step\n    // (identified by `applicationId` for a new flow or `executionId` to continue one). This is\n    // distinct from the OAuth authorization_code exchange handled by `super.signIn` below, which\n    // is used once the embedded flow completes and returns an authorization code.\n    const isEmbeddedFlowPayload: boolean =\n      typeof arg1 === 'object' && arg1 !== null && ('executionId' in arg1 || 'applicationId' in arg1);\n\n    if (isEmbeddedFlowPayload) {\n      await this.ensureInitialized();\n\n      // Typed as the Next config rather than `AuthClientConfig<T>` because the server-only\n      // `flowSecret` lives on `ThunderIDNodeConfig`, which the generic base config does not expose.\n      const configData: ThunderIDNextConfig = (await this.getStorageManager().getConfigData()) as ThunderIDNextConfig;\n\n      return executeEmbeddedSignInFlow({\n        baseUrl: configData?.baseUrl,\n        flowSecret: arg2?.flowSecret ?? configData?.flowSecret,\n        payload: arg1,\n        url: resolveResourceEndpoint('flowExecute', configData, arg2?.url),\n      }) as unknown as Promise<EmbeddedSignInFlowResponse>;\n    }\n\n    return super.signIn(arg4, arg3, arg1?.code, arg1?.state, arg1) as unknown as Promise<User>;\n  }\n\n  override async signOut(...args: any[]): Promise<string> {\n    if (args[1] && typeof args[1] !== 'string') {\n      throw new Error('The second argument must be a string.');\n    }\n\n    const config: T = this.getConfiguration();\n    const afterSignOutUrl: string = config?.afterSignOutUrl || '/';\n\n    const resolvedSessionId: string = args[1] || (await getSessionId())!;\n\n    try {\n      await (super.signOut as (...a: any[]) => Promise<string>)(resolvedSessionId);\n    } catch (error) {\n      const message: string = error instanceof Error ? error.message : String(error);\n\n      if (\n        !message.includes('end_session_endpoint') &&\n        !message.includes('sign-out endpoint') &&\n        !message.includes('Sign-out endpoint') &&\n        !message.includes('Sign-out redirect URL')\n      ) {\n        throw error;\n      }\n    }\n\n    return afterSignOutUrl;\n  }\n\n  override async signUp(_options?: SignUpOptions): Promise<void> {\n    throw new ThunderIDRuntimeError(\n      'Not implemented',\n      'ThunderIDNextClient-ValidationError-002',\n      'nextjs',\n      'The signUp method is not implemented in the Next.js client.',\n    );\n  }\n\n  // eslint-disable-next-line @typescript-eslint/no-unused-vars\n  override signInSilently(_options?: SignInOptions): Promise<User | boolean> {\n    throw new ThunderIDRuntimeError(\n      'Not implemented',\n      'ThunderIDNextClient-signInSilently-NotImplementedError-001',\n      'nextjs',\n      'The signInSilently method is not implemented in the Next.js client.',\n    );\n  }\n\n  public async getAuthorizeRequestUrl(\n    customParams: ExtendedAuthorizeRequestUrlParams,\n    userId?: string,\n  ): Promise<string> {\n    await this.ensureInitialized();\n    return this.getSignInUrl(customParams, userId);\n  }\n\n  public override getStorageManager(): any {\n    return super.getStorageManager();\n  }\n\n  public override async clearSession(): Promise<void> {\n    throw new ThunderIDRuntimeError(\n      'Not implemented',\n      'ThunderIDNextClient-clearSession-NotImplementedError-001',\n      'nextjs',\n      'The clearSession method is not implemented in the Next.js client.',\n    );\n  }\n\n  override async setSession(sessionData: Record<string, unknown>, sessionId?: string): Promise<void> {\n    return this.getStorageManager().setSessionData(sessionData, sessionId);\n  }\n\n  override decodeJwtToken<R = Record<string, unknown>>(token: string): Promise<R> {\n    return super.decodeJwtToken<R>(token);\n  }\n}\n\nexport default ThunderIDNextClient;\n"],"mappings":";;;;;;AAgCA,IAAM,sBAAN,cAAuF,oBAAuB;CAC5G,AAAO,gBAAgB;CAEvB,AAAO,cAAc;AACnB,SAAO;;CAGT,MAAc,oBAAmC;AAC/C,MAAI,CAAC,KAAK,cAIR,OAAM,KAAK,WAAW,EAAE,CAAM;AAGhC,MAAI,CAAC,KAAK,cACR,OAAM,IAAI,MACR,iLACD;;CAIL,MAAe,WAAW,QAAW,SAAqC;AACxE,MAAI,KAAK,cACP,QAAO,QAAQ,QAAQ,KAAK;EAG9B,MAAM,EACJ,SACA,oBACA,UACA,cACA,YACA,WACA,gBACA,iBACA,UACA,GAAG,SACDA,kCAA0B,OAAO;EAErC,MAAMC,SAAiB,MAAMC,yBAAiB;EAE9C,MAAMC,cAAuB,MAAM,MAAM,WACvC;GACE,GAAG;GACH,gBAAgB,kBAAkB;GAClC,iBAAiB,mBAAmB;GACpC;GACA;GACA;GACA,YAAa,KAAa,cAAc;GACxC;GACA;GACA;GACA;GACD,EACD,QACD;AAED,OAAK,gBAAgB;AAErB,SAAO;;CAGT,MAAe,aAAa,QAAsC;AAChE,MAAI;AACF,SAAM,MAAM,aAAa,OAAO;AAChC,UAAO;WACA,OAAO;AACd,SAAM,IAAI,sBACR,uCAAuC,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM,IAC7F,qDACA,UACA,8GACD;;;CAIL,MAAe,QAAQ,QAAgC;AACrD,QAAM,KAAK,mBAAmB;EAC9B,MAAMC,oBAA4B,UAAW,MAAMC,sBAAc;AAEjE,MAAI;GACF,MAAMC,aAAkC,MAAM,KAAK,mBAAmB,CAAC,eAAe;GACtF,MAAMC,UAA8B,YAAY;AAUhD,UARsB,MAAM,WAAW;IACrC;IACA,KAAK,wBAAwB,WAAW,WAAW;IACnD,SAAS,EACP,eAAe,UAAU,MAAM,KAAK,eAAe,OAAO,IAC3D;IACF,CAAC;WAGK,OAAO;AACd,UAAO,MAAM,MAAM,QAAQ,kBAAkB;;;CAIjD,MAAe,eAAe,QAAuC;AACnE,QAAM,KAAK,mBAAmB;AAE9B,MAAI;GACF,MAAMD,aAAkC,MAAM,KAAK,mBAAmB,CAAC,eAAe;GACtF,MAAMC,UAA8B,YAAY;GAEhD,MAAMC,UAAgB,MAAM,WAAW;IACrC;IACA,KAAK,wBAAwB,WAAW,WAAW;IACnD,SAAS,EACP,eAAe,UAAU,MAAM,KAAK,eAAe,OAAO,IAC3D;IACF,CAAC;AAEF,UAAO;IACL,kBAAkB,6BAA6B,QAAQ;IACvD;IACD;WACM,OAAO;AACd,UAAO;IACL,kBAAkB,6BAA6B,MAAM,MAAM,kBAAkB,OAAO,CAAC;IACrF,SAAS,6BAA6B,MAAM,MAAM,kBAAkB,OAAO,CAAC;IAC7E;;;CAIL,MAAM,cAAc,QAAkE;AACpF,QAAM,KAAK,mBAAmB;AAE9B,MAAI;GACF,MAAMF,aAAkC,MAAM,KAAK,mBAAmB,CAAC,eAAe;GACtF,MAAMC,UAA8B,YAAY;GAEhD,MAAM,EAAC,WAAU,MAAM,eAAe;IACpC;IACA,KAAK,wBAAwB,eAAe,WAAW;IACvD,SAAS,EACP,eAAe,UAAU,MAAM,KAAK,eAAe,OAAO,IAC3D;IACF,CAAC;AAEF,UAAO,UAAU;WACV,OAAO;AACd,UAAO;;;CAIX,MAAe,kBAAkB,SAAc,QAAgC;AAC7E,QAAM,KAAK,mBAAmB;AAE9B,MAAI;GACF,MAAMD,aAAkC,MAAM,KAAK,mBAAmB,CAAC,eAAe;GACtF,MAAMC,UAA8B,YAAY;AAEhD,UAAO,gBAAgB;IACrB;IACA,KAAK,wBAAwB,WAAW,WAAW;IACnD,SAAS,EACP,eAAe,UAAU,MAAM,KAAK,eAAe,OAAO,IAC3D;IACD,SAAS,SAAS,WAAW;IAC9B,CAAC;WACK,OAAO;AACd,SAAM,IAAI,sBACR,kCAAkC,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM,IACxF,8CACA,SACA,6GACD;;;;;;;;;;;;;;;;;;CAmBL,MAAe,sBAAsB,SAAiC,QAAgC;AACpG,QAAM,KAAK,mBAAmB;EAE9B,MAAMD,aAAkC,MAAM,KAAK,mBAAmB,CAAC,eAAe;EACtF,MAAMC,UAA8B,YAAY;AAEhD,QAAM,oBAAoB;GACxB;GACA,KAAK,wBAAwB,sBAAsB,WAAW;GAC9D,SAAS,EACP,eAAe,UAAU,MAAM,KAAK,eAAe,OAAO,IAC3D;GACD;GACD,CAAC;;CAGJ,AAAS,YAAqB;AAC5B,SAAO;;CAGT,AAAS,WAAW,WAAsC;AACxD,SAAO,MAAM,WAAW,UAAU;;CAGpC,AAAS,cAAc,QAAoC,WAAuD;AAChH,SAAO,MAAM,cAAc,QAAQ,UAAU;;CAI/C,MAAe,eAAe,YAAsC;EAClE,MAAM,EAAC,SAAS,mBAAkB,MAAM,OAAO;EAC/C,MAAME,QAA4B,MAAM,gBAAgB;AAExD,MAAI,OAAO,UAAU,YAAY,CAAC,MAChC,OAAM,IAAI,sBACR,+BACA,uDACA,UACA,8GACD;AAGH,SAAO;;CAGT,MAAe,kBAAkB,WAAoB,SAAoC;AACvF,QAAM,KAAK,mBAAmB;AAC9B,SAAO,MAAM,MAAM,kBAAkB,WAAW,QAAQ;;CAG1D,MAAe,OAAO,GAAG,MAA2B;EAClD,MAAMC,OAAY,KAAK;EACvB,MAAMC,OAAY,KAAK;EACvB,MAAMC,OAAY,KAAK;EACvB,MAAMC,OAAY,KAAK;AASvB,MAFE,OAAO,SAAS,YAAY,SAAS,SAAS,iBAAiB,QAAQ,mBAAmB,OAEjE;AACzB,SAAM,KAAK,mBAAmB;GAI9B,MAAMC,aAAmC,MAAM,KAAK,mBAAmB,CAAC,eAAe;AAEvF,UAAO,0BAA0B;IAC/B,SAAS,YAAY;IACrB,YAAY,MAAM,cAAc,YAAY;IAC5C,SAAS;IACT,KAAK,wBAAwB,eAAe,YAAY,MAAM,IAAI;IACnE,CAAC;;AAGJ,SAAO,MAAM,OAAO,MAAM,MAAM,MAAM,MAAM,MAAM,OAAO,KAAK;;CAGhE,MAAe,QAAQ,GAAG,MAA8B;AACtD,MAAI,KAAK,MAAM,OAAO,KAAK,OAAO,SAChC,OAAM,IAAI,MAAM,wCAAwC;EAI1D,MAAMC,kBADY,KAAK,kBAAkB,EACD,mBAAmB;EAE3D,MAAMX,oBAA4B,KAAK,MAAO,MAAMC,sBAAc;AAElE,MAAI;AACF,SAAO,MAAM,QAA6C,kBAAkB;WACrE,OAAO;GACd,MAAMW,UAAkB,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM;AAE9E,OACE,CAAC,QAAQ,SAAS,uBAAuB,IACzC,CAAC,QAAQ,SAAS,oBAAoB,IACtC,CAAC,QAAQ,SAAS,oBAAoB,IACtC,CAAC,QAAQ,SAAS,wBAAwB,CAE1C,OAAM;;AAIV,SAAO;;CAGT,MAAe,OAAO,UAAyC;AAC7D,QAAM,IAAI,sBACR,mBACA,2CACA,UACA,8DACD;;CAIH,AAAS,eAAe,UAAmD;AACzE,QAAM,IAAI,sBACR,mBACA,8DACA,UACA,sEACD;;CAGH,MAAa,uBACX,cACA,QACiB;AACjB,QAAM,KAAK,mBAAmB;AAC9B,SAAO,KAAK,aAAa,cAAc,OAAO;;CAGhD,AAAgB,oBAAyB;AACvC,SAAO,MAAM,mBAAmB;;CAGlC,MAAsB,eAA8B;AAClD,QAAM,IAAI,sBACR,mBACA,4DACA,UACA,oEACD;;CAGH,MAAe,WAAW,aAAsC,WAAmC;AACjG,SAAO,KAAK,mBAAmB,CAAC,eAAe,aAAa,UAAU;;CAGxE,AAAS,eAA4C,OAA2B;AAC9E,SAAO,MAAM,eAAkB,MAAM;;;AAIzC,kCAAe"}
+{"version":3,"file":"ThunderIDNextClient.js","names":["decorateConfigWithNextEnv","origin: string","getClientOrigin","initialized: boolean","resolvedSessionId: string","getSessionId","configData: AuthClientConfig<T>","baseUrl: string | undefined","profile: User","token: string | undefined","arg1: any","arg2: any","arg3: any","arg4: any","configData: ThunderIDNextConfig","afterSignOutUrl: string","message: string"],"sources":["../src/ThunderIDNextClient.ts"],"sourcesContent":["// Copyright 2025 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\nimport {\n  ThunderIDNodeClient,\n  ThunderIDRuntimeError,\n  AttributeSchema,\n  AuthClientConfig,\n  EmbeddedSignInFlowResponse,\n  ExtendedAuthorizeRequestUrlParams,\n  IdToken,\n  SignInOptions,\n  SignUpOptions,\n  Storage,\n  TokenExchangeRequestConfig,\n  TokenResponse,\n  User,\n  ManagedFlowListResponse,\n  ManagedUserListResponse,\n  ManagedUserTypeListResponse,\n  UserProfile,\n  executeEmbeddedSignInFlow,\n  extractUserClaimsFromIdToken,\n  generateFlattenedUserProfile,\n  getUsersMe,\n  getUsersMeMeta,\n  updateMeCredentials,\n  updateMeProfile,\n  resolveResourceEndpoint,\n} from '@thunderid/node';\nimport {ThunderIDNextConfig} from './models/config';\nimport getClientOrigin from './server/actions/getClientOrigin';\nimport getSessionId from './server/actions/getSessionId';\nimport decorateConfigWithNextEnv from './utils/decorateConfigWithNextEnv';\n\nclass ThunderIDNextClient<T extends ThunderIDNextConfig = ThunderIDNextConfig> extends ThunderIDNodeClient<T> {\n  public isInitialized = false;\n\n  public constructor() {\n    super();\n  }\n\n  private async ensureInitialized(): Promise<void> {\n    if (!this.isInitialized) {\n      // Server actions may run in a module context that hasn't been through\n      // ThunderIDServerProvider (e.g. a different worker). Try to initialize\n      // from environment variables before giving up.\n      await this.initialize({} as T);\n    }\n\n    if (!this.isInitialized) {\n      throw new Error(\n        '[ThunderIDNextClient] Client is not initialized. Make sure you have wrapped your app with ThunderIDProvider and provided the required configuration (baseUrl, clientId, etc.).',\n      );\n    }\n  }\n\n  override async initialize(config: T, storage?: Storage): Promise<boolean> {\n    if (this.isInitialized) {\n      return Promise.resolve(true);\n    }\n\n    const {\n      baseUrl,\n      organizationHandle,\n      clientId,\n      clientSecret,\n      flowSecret,\n      signInUrl,\n      afterSignInUrl,\n      afterSignOutUrl,\n      signUpUrl,\n      ...rest\n    } = decorateConfigWithNextEnv(config);\n\n    const origin: string = await getClientOrigin();\n\n    const initialized: boolean = await super.initialize(\n      {\n        ...rest,\n        afterSignInUrl: afterSignInUrl ?? origin,\n        afterSignOutUrl: afterSignOutUrl ?? origin,\n        baseUrl,\n        clientId,\n        clientSecret,\n        enablePKCE: (rest as any).enablePKCE ?? true,\n        flowSecret,\n        organizationHandle,\n        signInUrl,\n        signUpUrl,\n      } as any,\n      storage,\n    );\n\n    this.isInitialized = initialized;\n\n    return initialized;\n  }\n\n  override async reInitialize(config: Partial<T>): Promise<boolean> {\n    try {\n      await super.reInitialize(config);\n      return true;\n    } catch (error) {\n      throw new ThunderIDRuntimeError(\n        `Failed to re-initialize the client: ${error instanceof Error ? error.message : String(error)}`,\n        'ThunderIDNextClient-reInitialize-RuntimeError-001',\n        'nextjs',\n        'An error occurred while re-initializing the client. Please check your configuration and network connection.',\n      );\n    }\n  }\n\n  override async getUser(userId?: string): Promise<User> {\n    await this.ensureInitialized();\n    const resolvedSessionId: string = userId || (await getSessionId())!;\n\n    try {\n      const configData: AuthClientConfig<T> = await this.getStorageManager().getConfigData();\n      const baseUrl: string | undefined = configData?.baseUrl;\n\n      const profile: User = await getUsersMe({\n        baseUrl,\n        url: resolveResourceEndpoint('usersMe', configData),\n        headers: {\n          Authorization: `Bearer ${await this.getAccessToken(userId)}`,\n        },\n      });\n\n      return profile;\n    } catch (error) {\n      return await super.getUser(resolvedSessionId);\n    }\n  }\n\n  override async getUserProfile(userId?: string): Promise<UserProfile> {\n    await this.ensureInitialized();\n\n    try {\n      const configData: AuthClientConfig<T> = await this.getStorageManager().getConfigData();\n      const baseUrl: string | undefined = configData?.baseUrl;\n\n      const profile: User = await getUsersMe({\n        baseUrl,\n        url: resolveResourceEndpoint('usersMe', configData),\n        headers: {\n          Authorization: `Bearer ${await this.getAccessToken(userId)}`,\n        },\n      });\n\n      return {\n        flattenedProfile: generateFlattenedUserProfile(profile),\n        profile,\n      };\n    } catch (error) {\n      return {\n        flattenedProfile: extractUserClaimsFromIdToken(await super.getDecodedIdToken(userId)),\n        profile: extractUserClaimsFromIdToken(await super.getDecodedIdToken(userId)),\n      };\n    }\n  }\n\n  async getUserSchema(userId?: string): Promise<Record<string, AttributeSchema> | null> {\n    await this.ensureInitialized();\n\n    try {\n      const configData: AuthClientConfig<T> = await this.getStorageManager().getConfigData();\n      const baseUrl: string | undefined = configData?.baseUrl;\n\n      const {schema} = await getUsersMeMeta({\n        baseUrl,\n        url: resolveResourceEndpoint('usersMeMeta', configData),\n        headers: {\n          Authorization: `Bearer ${await this.getAccessToken(userId)}`,\n        },\n      });\n\n      return schema ?? null;\n    } catch (error) {\n      return null;\n    }\n  }\n\n  override async updateUserProfile(payload: any, userId?: string): Promise<User> {\n    await this.ensureInitialized();\n\n    try {\n      const configData: AuthClientConfig<T> = await this.getStorageManager().getConfigData();\n      const baseUrl: string | undefined = configData?.baseUrl;\n\n      return updateMeProfile({\n        baseUrl,\n        url: resolveResourceEndpoint('usersMe', configData),\n        headers: {\n          Authorization: `Bearer ${await this.getAccessToken(userId)}`,\n        },\n        payload: payload?.payload ?? payload,\n      });\n    } catch (error) {\n      throw new ThunderIDRuntimeError(\n        `Failed to update user profile: ${error instanceof Error ? error.message : String(error)}`,\n        'ThunderIDNextClient-UpdateProfileError-001',\n        'react',\n        'An error occurred while updating the user profile. Please check your configuration and network connection.',\n      );\n    }\n  }\n\n  /**\n   * Updates one or more of the signed-in user's credentials (e.g. `password`, or any other\n   * attribute the user type schema declares `credential: true`).\n   *\n   * Not part of {@link ThunderIDJavaScriptClient}'s base surface — unlike `updateUserProfile`,\n   * no other SDK routes credential updates through a client method (React/Vue's\n   * `ChangeCredential` call the core `updateMeCredentials` function directly), so this is a\n   * Next.js-specific addition rather than an override. Kept here anyway so this SDK's own\n   * server actions have one consistent way to reach every `/users/me/*` operation.\n   *\n   * Deliberately does not catch and rewrap errors the way `updateUserProfile` does: the caller\n   * (`updateUserCredentialsAction`) needs the real `ThunderIDAPIError` instance, status code\n   * included, to map a failure onto the right form field before it crosses the server action\n   * boundary back to the client.\n   */\n  override async updateUserCredentials(payload: Record<string, string>, userId?: string): Promise<void> {\n    await this.ensureInitialized();\n\n    const configData: AuthClientConfig<T> = await this.getStorageManager().getConfigData();\n    const baseUrl: string | undefined = configData?.baseUrl;\n\n    await updateMeCredentials({\n      baseUrl,\n      url: resolveResourceEndpoint('usersMeCredentials', configData),\n      headers: {\n        Authorization: `Bearer ${await this.getAccessToken(userId)}`,\n      },\n      payload,\n    });\n  }\n\n  /**\n   * Retrieves one page of the user directory for the session identified by `userId`.\n   *\n   * Ensures the client is initialized first, like `updateUserCredentials`. Errors are not caught so the calling server action can map the real `ThunderIDAPIError`.\n   */\n  override async getUsers(\n    options: {filter?: string; limit?: number; offset?: number; signal?: AbortSignal} = {},\n    userId?: string,\n  ): Promise<ManagedUserListResponse> {\n    await this.ensureInitialized();\n\n    return super.getUsers(options, userId);\n  }\n\n  /**\n   * Retrieves one page of flows for the session identified by `userId`.\n   *\n   * Ensures the client is initialized first, like `getUsers`. Errors are not caught so the calling server action can map the real `ThunderIDAPIError`.\n   */\n  override async getFlows(\n    options: {flowType?: string; limit?: number; offset?: number; signal?: AbortSignal} = {},\n    userId?: string,\n  ): Promise<ManagedFlowListResponse> {\n    await this.ensureInitialized();\n\n    return super.getFlows(options, userId);\n  }\n\n  /**\n   * Retrieves one page of user types for the session identified by `userId`.\n   *\n   * Ensures the client is initialized first, like `getUsers`. Errors are not caught so the calling server action can map the real `ThunderIDAPIError`.\n   */\n  override async getUserTypes(\n    options: {limit?: number; offset?: number; signal?: AbortSignal} = {},\n    userId?: string,\n  ): Promise<ManagedUserTypeListResponse> {\n    await this.ensureInitialized();\n\n    return super.getUserTypes(options, userId);\n  }\n\n  override isLoading(): boolean {\n    return false;\n  }\n\n  override isSignedIn(sessionId?: string): Promise<boolean> {\n    return super.isSignedIn(sessionId);\n  }\n\n  override exchangeToken(config: TokenExchangeRequestConfig, sessionId?: string): Promise<TokenResponse | Response> {\n    return super.exchangeToken(config, sessionId) as unknown as Promise<TokenResponse | Response>;\n  }\n\n  // eslint-disable-next-line @typescript-eslint/no-unused-vars\n  override async getAccessToken(_sessionId?: string): Promise<string> {\n    const {default: getAccessToken} = await import('./server/actions/getAccessToken');\n    const token: string | undefined = await getAccessToken();\n\n    if (typeof token !== 'string' || !token) {\n      throw new ThunderIDRuntimeError(\n        'Failed to get access token.',\n        'ThunderIDNextClient-getAccessToken-RuntimeError-003',\n        'nextjs',\n        'An error occurred while obtaining the access token. Please check your configuration and network connection.',\n      );\n    }\n\n    return token;\n  }\n\n  override async getDecodedIdToken(sessionId?: string, idToken?: string): Promise<IdToken> {\n    await this.ensureInitialized();\n    return await super.getDecodedIdToken(sessionId, idToken);\n  }\n\n  override async signIn(...args: any[]): Promise<any> {\n    const arg1: any = args[0];\n    const arg2: any = args[1];\n    const arg3: any = args[2];\n    const arg4: any = args[3];\n\n    // An embedded sign-in flow payload initiates or continues a `POST /flow/execute` step\n    // (identified by `applicationId` for a new flow or `executionId` to continue one). This is\n    // distinct from the OAuth authorization_code exchange handled by `super.signIn` below, which\n    // is used once the embedded flow completes and returns an authorization code.\n    const isEmbeddedFlowPayload: boolean =\n      typeof arg1 === 'object' && arg1 !== null && ('executionId' in arg1 || 'applicationId' in arg1);\n\n    if (isEmbeddedFlowPayload) {\n      await this.ensureInitialized();\n\n      // Typed as the Next config rather than `AuthClientConfig<T>` because the server-only\n      // `flowSecret` lives on `ThunderIDNodeConfig`, which the generic base config does not expose.\n      const configData: ThunderIDNextConfig = (await this.getStorageManager().getConfigData()) as ThunderIDNextConfig;\n\n      return executeEmbeddedSignInFlow({\n        baseUrl: configData?.baseUrl,\n        flowSecret: arg2?.flowSecret ?? configData?.flowSecret,\n        payload: arg1,\n        url: resolveResourceEndpoint('flowExecute', configData, arg2?.url),\n      }) as unknown as Promise<EmbeddedSignInFlowResponse>;\n    }\n\n    return super.signIn(arg4, arg3, arg1?.code, arg1?.state, arg1) as unknown as Promise<User>;\n  }\n\n  override async signOut(...args: any[]): Promise<string> {\n    if (args[1] && typeof args[1] !== 'string') {\n      throw new Error('The second argument must be a string.');\n    }\n\n    const config: T = this.getConfiguration();\n    const afterSignOutUrl: string = config?.afterSignOutUrl || '/';\n\n    const resolvedSessionId: string = args[1] || (await getSessionId())!;\n\n    try {\n      await (super.signOut as (...a: any[]) => Promise<string>)(resolvedSessionId);\n    } catch (error) {\n      const message: string = error instanceof Error ? error.message : String(error);\n\n      if (\n        !message.includes('end_session_endpoint') &&\n        !message.includes('sign-out endpoint') &&\n        !message.includes('Sign-out endpoint') &&\n        !message.includes('Sign-out redirect URL')\n      ) {\n        throw error;\n      }\n    }\n\n    return afterSignOutUrl;\n  }\n\n  override async signUp(_options?: SignUpOptions): Promise<void> {\n    throw new ThunderIDRuntimeError(\n      'Not implemented',\n      'ThunderIDNextClient-ValidationError-002',\n      'nextjs',\n      'The signUp method is not implemented in the Next.js client.',\n    );\n  }\n\n  // eslint-disable-next-line @typescript-eslint/no-unused-vars\n  override signInSilently(_options?: SignInOptions): Promise<User | boolean> {\n    throw new ThunderIDRuntimeError(\n      'Not implemented',\n      'ThunderIDNextClient-signInSilently-NotImplementedError-001',\n      'nextjs',\n      'The signInSilently method is not implemented in the Next.js client.',\n    );\n  }\n\n  public async getAuthorizeRequestUrl(\n    customParams: ExtendedAuthorizeRequestUrlParams,\n    userId?: string,\n  ): Promise<string> {\n    await this.ensureInitialized();\n    return this.getSignInUrl(customParams, userId);\n  }\n\n  public override getStorageManager(): any {\n    return super.getStorageManager();\n  }\n\n  public override async clearSession(): Promise<void> {\n    throw new ThunderIDRuntimeError(\n      'Not implemented',\n      'ThunderIDNextClient-clearSession-NotImplementedError-001',\n      'nextjs',\n      'The clearSession method is not implemented in the Next.js client.',\n    );\n  }\n\n  override async setSession(sessionData: Record<string, unknown>, sessionId?: string): Promise<void> {\n    return this.getStorageManager().setSessionData(sessionData, sessionId);\n  }\n\n  override decodeJwtToken<R = Record<string, unknown>>(token: string): Promise<R> {\n    return super.decodeJwtToken<R>(token);\n  }\n}\n\nexport default ThunderIDNextClient;\n"],"mappings":";;;;;;AAmCA,IAAM,sBAAN,cAAuF,oBAAuB;CAC5G,AAAO,gBAAgB;CAEvB,AAAO,cAAc;AACnB,SAAO;;CAGT,MAAc,oBAAmC;AAC/C,MAAI,CAAC,KAAK,cAIR,OAAM,KAAK,WAAW,EAAE,CAAM;AAGhC,MAAI,CAAC,KAAK,cACR,OAAM,IAAI,MACR,iLACD;;CAIL,MAAe,WAAW,QAAW,SAAqC;AACxE,MAAI,KAAK,cACP,QAAO,QAAQ,QAAQ,KAAK;EAG9B,MAAM,EACJ,SACA,oBACA,UACA,cACA,YACA,WACA,gBACA,iBACA,UACA,GAAG,SACDA,kCAA0B,OAAO;EAErC,MAAMC,SAAiB,MAAMC,yBAAiB;EAE9C,MAAMC,cAAuB,MAAM,MAAM,WACvC;GACE,GAAG;GACH,gBAAgB,kBAAkB;GAClC,iBAAiB,mBAAmB;GACpC;GACA;GACA;GACA,YAAa,KAAa,cAAc;GACxC;GACA;GACA;GACA;GACD,EACD,QACD;AAED,OAAK,gBAAgB;AAErB,SAAO;;CAGT,MAAe,aAAa,QAAsC;AAChE,MAAI;AACF,SAAM,MAAM,aAAa,OAAO;AAChC,UAAO;WACA,OAAO;AACd,SAAM,IAAI,sBACR,uCAAuC,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM,IAC7F,qDACA,UACA,8GACD;;;CAIL,MAAe,QAAQ,QAAgC;AACrD,QAAM,KAAK,mBAAmB;EAC9B,MAAMC,oBAA4B,UAAW,MAAMC,sBAAc;AAEjE,MAAI;GACF,MAAMC,aAAkC,MAAM,KAAK,mBAAmB,CAAC,eAAe;GACtF,MAAMC,UAA8B,YAAY;AAUhD,UARsB,MAAM,WAAW;IACrC;IACA,KAAK,wBAAwB,WAAW,WAAW;IACnD,SAAS,EACP,eAAe,UAAU,MAAM,KAAK,eAAe,OAAO,IAC3D;IACF,CAAC;WAGK,OAAO;AACd,UAAO,MAAM,MAAM,QAAQ,kBAAkB;;;CAIjD,MAAe,eAAe,QAAuC;AACnE,QAAM,KAAK,mBAAmB;AAE9B,MAAI;GACF,MAAMD,aAAkC,MAAM,KAAK,mBAAmB,CAAC,eAAe;GACtF,MAAMC,UAA8B,YAAY;GAEhD,MAAMC,UAAgB,MAAM,WAAW;IACrC;IACA,KAAK,wBAAwB,WAAW,WAAW;IACnD,SAAS,EACP,eAAe,UAAU,MAAM,KAAK,eAAe,OAAO,IAC3D;IACF,CAAC;AAEF,UAAO;IACL,kBAAkB,6BAA6B,QAAQ;IACvD;IACD;WACM,OAAO;AACd,UAAO;IACL,kBAAkB,6BAA6B,MAAM,MAAM,kBAAkB,OAAO,CAAC;IACrF,SAAS,6BAA6B,MAAM,MAAM,kBAAkB,OAAO,CAAC;IAC7E;;;CAIL,MAAM,cAAc,QAAkE;AACpF,QAAM,KAAK,mBAAmB;AAE9B,MAAI;GACF,MAAMF,aAAkC,MAAM,KAAK,mBAAmB,CAAC,eAAe;GACtF,MAAMC,UAA8B,YAAY;GAEhD,MAAM,EAAC,WAAU,MAAM,eAAe;IACpC;IACA,KAAK,wBAAwB,eAAe,WAAW;IACvD,SAAS,EACP,eAAe,UAAU,MAAM,KAAK,eAAe,OAAO,IAC3D;IACF,CAAC;AAEF,UAAO,UAAU;WACV,OAAO;AACd,UAAO;;;CAIX,MAAe,kBAAkB,SAAc,QAAgC;AAC7E,QAAM,KAAK,mBAAmB;AAE9B,MAAI;GACF,MAAMD,aAAkC,MAAM,KAAK,mBAAmB,CAAC,eAAe;GACtF,MAAMC,UAA8B,YAAY;AAEhD,UAAO,gBAAgB;IACrB;IACA,KAAK,wBAAwB,WAAW,WAAW;IACnD,SAAS,EACP,eAAe,UAAU,MAAM,KAAK,eAAe,OAAO,IAC3D;IACD,SAAS,SAAS,WAAW;IAC9B,CAAC;WACK,OAAO;AACd,SAAM,IAAI,sBACR,kCAAkC,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM,IACxF,8CACA,SACA,6GACD;;;;;;;;;;;;;;;;;;CAmBL,MAAe,sBAAsB,SAAiC,QAAgC;AACpG,QAAM,KAAK,mBAAmB;EAE9B,MAAMD,aAAkC,MAAM,KAAK,mBAAmB,CAAC,eAAe;EACtF,MAAMC,UAA8B,YAAY;AAEhD,QAAM,oBAAoB;GACxB;GACA,KAAK,wBAAwB,sBAAsB,WAAW;GAC9D,SAAS,EACP,eAAe,UAAU,MAAM,KAAK,eAAe,OAAO,IAC3D;GACD;GACD,CAAC;;;;;;;CAQJ,MAAe,SACb,UAAoF,EAAE,EACtF,QACkC;AAClC,QAAM,KAAK,mBAAmB;AAE9B,SAAO,MAAM,SAAS,SAAS,OAAO;;;;;;;CAQxC,MAAe,SACb,UAAsF,EAAE,EACxF,QACkC;AAClC,QAAM,KAAK,mBAAmB;AAE9B,SAAO,MAAM,SAAS,SAAS,OAAO;;;;;;;CAQxC,MAAe,aACb,UAAmE,EAAE,EACrE,QACsC;AACtC,QAAM,KAAK,mBAAmB;AAE9B,SAAO,MAAM,aAAa,SAAS,OAAO;;CAG5C,AAAS,YAAqB;AAC5B,SAAO;;CAGT,AAAS,WAAW,WAAsC;AACxD,SAAO,MAAM,WAAW,UAAU;;CAGpC,AAAS,cAAc,QAAoC,WAAuD;AAChH,SAAO,MAAM,cAAc,QAAQ,UAAU;;CAI/C,MAAe,eAAe,YAAsC;EAClE,MAAM,EAAC,SAAS,mBAAkB,MAAM,OAAO;EAC/C,MAAME,QAA4B,MAAM,gBAAgB;AAExD,MAAI,OAAO,UAAU,YAAY,CAAC,MAChC,OAAM,IAAI,sBACR,+BACA,uDACA,UACA,8GACD;AAGH,SAAO;;CAGT,MAAe,kBAAkB,WAAoB,SAAoC;AACvF,QAAM,KAAK,mBAAmB;AAC9B,SAAO,MAAM,MAAM,kBAAkB,WAAW,QAAQ;;CAG1D,MAAe,OAAO,GAAG,MAA2B;EAClD,MAAMC,OAAY,KAAK;EACvB,MAAMC,OAAY,KAAK;EACvB,MAAMC,OAAY,KAAK;EACvB,MAAMC,OAAY,KAAK;AASvB,MAFE,OAAO,SAAS,YAAY,SAAS,SAAS,iBAAiB,QAAQ,mBAAmB,OAEjE;AACzB,SAAM,KAAK,mBAAmB;GAI9B,MAAMC,aAAmC,MAAM,KAAK,mBAAmB,CAAC,eAAe;AAEvF,UAAO,0BAA0B;IAC/B,SAAS,YAAY;IACrB,YAAY,MAAM,cAAc,YAAY;IAC5C,SAAS;IACT,KAAK,wBAAwB,eAAe,YAAY,MAAM,IAAI;IACnE,CAAC;;AAGJ,SAAO,MAAM,OAAO,MAAM,MAAM,MAAM,MAAM,MAAM,OAAO,KAAK;;CAGhE,MAAe,QAAQ,GAAG,MAA8B;AACtD,MAAI,KAAK,MAAM,OAAO,KAAK,OAAO,SAChC,OAAM,IAAI,MAAM,wCAAwC;EAI1D,MAAMC,kBADY,KAAK,kBAAkB,EACD,mBAAmB;EAE3D,MAAMX,oBAA4B,KAAK,MAAO,MAAMC,sBAAc;AAElE,MAAI;AACF,SAAO,MAAM,QAA6C,kBAAkB;WACrE,OAAO;GACd,MAAMW,UAAkB,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM;AAE9E,OACE,CAAC,QAAQ,SAAS,uBAAuB,IACzC,CAAC,QAAQ,SAAS,oBAAoB,IACtC,CAAC,QAAQ,SAAS,oBAAoB,IACtC,CAAC,QAAQ,SAAS,wBAAwB,CAE1C,OAAM;;AAIV,SAAO;;CAGT,MAAe,OAAO,UAAyC;AAC7D,QAAM,IAAI,sBACR,mBACA,2CACA,UACA,8DACD;;CAIH,AAAS,eAAe,UAAmD;AACzE,QAAM,IAAI,sBACR,mBACA,8DACA,UACA,sEACD;;CAGH,MAAa,uBACX,cACA,QACiB;AACjB,QAAM,KAAK,mBAAmB;AAC9B,SAAO,KAAK,aAAa,cAAc,OAAO;;CAGhD,AAAgB,oBAAyB;AACvC,SAAO,MAAM,mBAAmB;;CAGlC,MAAsB,eAA8B;AAClD,QAAM,IAAI,sBACR,mBACA,4DACA,UACA,oEACD;;CAGH,MAAe,WAAW,aAAsC,WAAmC;AACjG,SAAO,KAAK,mBAAmB,CAAC,eAAe,aAAa,UAAU;;CAGxE,AAAS,eAA4C,OAA2B;AAC9E,SAAO,MAAM,eAAkB,MAAM;;;AAIzC,kCAAe"}

package/dist/cjs/ThunderIDNextClient.cjs

@@ -135,6 +135,33 @@ var ThunderIDNextClient = class extends __thunderid_node.ThunderIDNodeClient {
 			payload
 		});
 	}
+	/**
+	* Retrieves one page of the user directory for the session identified by `userId`.
+	*
+	* Ensures the client is initialized first, like `updateUserCredentials`. Errors are not caught so the calling server action can map the real `ThunderIDAPIError`.
+	*/
+	async getUsers(options = {}, userId) {
+		await this.ensureInitialized();
+		return super.getUsers(options, userId);
+	}
+	/**
+	* Retrieves one page of flows for the session identified by `userId`.
+	*
+	* Ensures the client is initialized first, like `getUsers`. Errors are not caught so the calling server action can map the real `ThunderIDAPIError`.
+	*/
+	async getFlows(options = {}, userId) {
+		await this.ensureInitialized();
+		return super.getFlows(options, userId);
+	}
+	/**
+	* Retrieves one page of user types for the session identified by `userId`.
+	*
+	* Ensures the client is initialized first, like `getUsers`. Errors are not caught so the calling server action can map the real `ThunderIDAPIError`.
+	*/
+	async getUserTypes(options = {}, userId) {
+		await this.ensureInitialized();
+		return super.getUserTypes(options, userId);
+	}
 	isLoading() {
 		return false;
 	}

package/dist/cjs/ThunderIDNextClient.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"ThunderIDNextClient.cjs","names":["ThunderIDNodeClient","decorateConfigWithNextEnv","origin: string","getClientOrigin","initialized: boolean","ThunderIDRuntimeError","resolvedSessionId: string","getSessionId","configData: AuthClientConfig<T>","baseUrl: string | undefined","profile: User","token: string | undefined","arg1: any","arg2: any","arg3: any","arg4: any","configData: ThunderIDNextConfig","afterSignOutUrl: string","message: string"],"sources":["../../src/ThunderIDNextClient.ts"],"sourcesContent":["// Copyright 2025 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\nimport {\n  ThunderIDNodeClient,\n  ThunderIDRuntimeError,\n  AttributeSchema,\n  AuthClientConfig,\n  EmbeddedSignInFlowResponse,\n  ExtendedAuthorizeRequestUrlParams,\n  IdToken,\n  SignInOptions,\n  SignUpOptions,\n  Storage,\n  TokenExchangeRequestConfig,\n  TokenResponse,\n  User,\n  UserProfile,\n  executeEmbeddedSignInFlow,\n  extractUserClaimsFromIdToken,\n  generateFlattenedUserProfile,\n  getUsersMe,\n  getUsersMeMeta,\n  updateMeCredentials,\n  updateMeProfile,\n  resolveResourceEndpoint,\n} from '@thunderid/node';\nimport {ThunderIDNextConfig} from './models/config';\nimport getClientOrigin from './server/actions/getClientOrigin';\nimport getSessionId from './server/actions/getSessionId';\nimport decorateConfigWithNextEnv from './utils/decorateConfigWithNextEnv';\n\nclass ThunderIDNextClient<T extends ThunderIDNextConfig = ThunderIDNextConfig> extends ThunderIDNodeClient<T> {\n  public isInitialized = false;\n\n  public constructor() {\n    super();\n  }\n\n  private async ensureInitialized(): Promise<void> {\n    if (!this.isInitialized) {\n      // Server actions may run in a module context that hasn't been through\n      // ThunderIDServerProvider (e.g. a different worker). Try to initialize\n      // from environment variables before giving up.\n      await this.initialize({} as T);\n    }\n\n    if (!this.isInitialized) {\n      throw new Error(\n        '[ThunderIDNextClient] Client is not initialized. Make sure you have wrapped your app with ThunderIDProvider and provided the required configuration (baseUrl, clientId, etc.).',\n      );\n    }\n  }\n\n  override async initialize(config: T, storage?: Storage): Promise<boolean> {\n    if (this.isInitialized) {\n      return Promise.resolve(true);\n    }\n\n    const {\n      baseUrl,\n      organizationHandle,\n      clientId,\n      clientSecret,\n      flowSecret,\n      signInUrl,\n      afterSignInUrl,\n      afterSignOutUrl,\n      signUpUrl,\n      ...rest\n    } = decorateConfigWithNextEnv(config);\n\n    const origin: string = await getClientOrigin();\n\n    const initialized: boolean = await super.initialize(\n      {\n        ...rest,\n        afterSignInUrl: afterSignInUrl ?? origin,\n        afterSignOutUrl: afterSignOutUrl ?? origin,\n        baseUrl,\n        clientId,\n        clientSecret,\n        enablePKCE: (rest as any).enablePKCE ?? true,\n        flowSecret,\n        organizationHandle,\n        signInUrl,\n        signUpUrl,\n      } as any,\n      storage,\n    );\n\n    this.isInitialized = initialized;\n\n    return initialized;\n  }\n\n  override async reInitialize(config: Partial<T>): Promise<boolean> {\n    try {\n      await super.reInitialize(config);\n      return true;\n    } catch (error) {\n      throw new ThunderIDRuntimeError(\n        `Failed to re-initialize the client: ${error instanceof Error ? error.message : String(error)}`,\n        'ThunderIDNextClient-reInitialize-RuntimeError-001',\n        'nextjs',\n        'An error occurred while re-initializing the client. Please check your configuration and network connection.',\n      );\n    }\n  }\n\n  override async getUser(userId?: string): Promise<User> {\n    await this.ensureInitialized();\n    const resolvedSessionId: string = userId || (await getSessionId())!;\n\n    try {\n      const configData: AuthClientConfig<T> = await this.getStorageManager().getConfigData();\n      const baseUrl: string | undefined = configData?.baseUrl;\n\n      const profile: User = await getUsersMe({\n        baseUrl,\n        url: resolveResourceEndpoint('usersMe', configData),\n        headers: {\n          Authorization: `Bearer ${await this.getAccessToken(userId)}`,\n        },\n      });\n\n      return profile;\n    } catch (error) {\n      return await super.getUser(resolvedSessionId);\n    }\n  }\n\n  override async getUserProfile(userId?: string): Promise<UserProfile> {\n    await this.ensureInitialized();\n\n    try {\n      const configData: AuthClientConfig<T> = await this.getStorageManager().getConfigData();\n      const baseUrl: string | undefined = configData?.baseUrl;\n\n      const profile: User = await getUsersMe({\n        baseUrl,\n        url: resolveResourceEndpoint('usersMe', configData),\n        headers: {\n          Authorization: `Bearer ${await this.getAccessToken(userId)}`,\n        },\n      });\n\n      return {\n        flattenedProfile: generateFlattenedUserProfile(profile),\n        profile,\n      };\n    } catch (error) {\n      return {\n        flattenedProfile: extractUserClaimsFromIdToken(await super.getDecodedIdToken(userId)),\n        profile: extractUserClaimsFromIdToken(await super.getDecodedIdToken(userId)),\n      };\n    }\n  }\n\n  async getUserSchema(userId?: string): Promise<Record<string, AttributeSchema> | null> {\n    await this.ensureInitialized();\n\n    try {\n      const configData: AuthClientConfig<T> = await this.getStorageManager().getConfigData();\n      const baseUrl: string | undefined = configData?.baseUrl;\n\n      const {schema} = await getUsersMeMeta({\n        baseUrl,\n        url: resolveResourceEndpoint('usersMeMeta', configData),\n        headers: {\n          Authorization: `Bearer ${await this.getAccessToken(userId)}`,\n        },\n      });\n\n      return schema ?? null;\n    } catch (error) {\n      return null;\n    }\n  }\n\n  override async updateUserProfile(payload: any, userId?: string): Promise<User> {\n    await this.ensureInitialized();\n\n    try {\n      const configData: AuthClientConfig<T> = await this.getStorageManager().getConfigData();\n      const baseUrl: string | undefined = configData?.baseUrl;\n\n      return updateMeProfile({\n        baseUrl,\n        url: resolveResourceEndpoint('usersMe', configData),\n        headers: {\n          Authorization: `Bearer ${await this.getAccessToken(userId)}`,\n        },\n        payload: payload?.payload ?? payload,\n      });\n    } catch (error) {\n      throw new ThunderIDRuntimeError(\n        `Failed to update user profile: ${error instanceof Error ? error.message : String(error)}`,\n        'ThunderIDNextClient-UpdateProfileError-001',\n        'react',\n        'An error occurred while updating the user profile. Please check your configuration and network connection.',\n      );\n    }\n  }\n\n  /**\n   * Updates one or more of the signed-in user's credentials (e.g. `password`, or any other\n   * attribute the user type schema declares `credential: true`).\n   *\n   * Not part of {@link ThunderIDJavaScriptClient}'s base surface — unlike `updateUserProfile`,\n   * no other SDK routes credential updates through a client method (React/Vue's\n   * `ChangeCredential` call the core `updateMeCredentials` function directly), so this is a\n   * Next.js-specific addition rather than an override. Kept here anyway so this SDK's own\n   * server actions have one consistent way to reach every `/users/me/*` operation.\n   *\n   * Deliberately does not catch and rewrap errors the way `updateUserProfile` does: the caller\n   * (`updateUserCredentialsAction`) needs the real `ThunderIDAPIError` instance, status code\n   * included, to map a failure onto the right form field before it crosses the server action\n   * boundary back to the client.\n   */\n  override async updateUserCredentials(payload: Record<string, string>, userId?: string): Promise<void> {\n    await this.ensureInitialized();\n\n    const configData: AuthClientConfig<T> = await this.getStorageManager().getConfigData();\n    const baseUrl: string | undefined = configData?.baseUrl;\n\n    await updateMeCredentials({\n      baseUrl,\n      url: resolveResourceEndpoint('usersMeCredentials', configData),\n      headers: {\n        Authorization: `Bearer ${await this.getAccessToken(userId)}`,\n      },\n      payload,\n    });\n  }\n\n  override isLoading(): boolean {\n    return false;\n  }\n\n  override isSignedIn(sessionId?: string): Promise<boolean> {\n    return super.isSignedIn(sessionId);\n  }\n\n  override exchangeToken(config: TokenExchangeRequestConfig, sessionId?: string): Promise<TokenResponse | Response> {\n    return super.exchangeToken(config, sessionId) as unknown as Promise<TokenResponse | Response>;\n  }\n\n  // eslint-disable-next-line @typescript-eslint/no-unused-vars\n  override async getAccessToken(_sessionId?: string): Promise<string> {\n    const {default: getAccessToken} = await import('./server/actions/getAccessToken');\n    const token: string | undefined = await getAccessToken();\n\n    if (typeof token !== 'string' || !token) {\n      throw new ThunderIDRuntimeError(\n        'Failed to get access token.',\n        'ThunderIDNextClient-getAccessToken-RuntimeError-003',\n        'nextjs',\n        'An error occurred while obtaining the access token. Please check your configuration and network connection.',\n      );\n    }\n\n    return token;\n  }\n\n  override async getDecodedIdToken(sessionId?: string, idToken?: string): Promise<IdToken> {\n    await this.ensureInitialized();\n    return await super.getDecodedIdToken(sessionId, idToken);\n  }\n\n  override async signIn(...args: any[]): Promise<any> {\n    const arg1: any = args[0];\n    const arg2: any = args[1];\n    const arg3: any = args[2];\n    const arg4: any = args[3];\n\n    // An embedded sign-in flow payload initiates or continues a `POST /flow/execute` step\n    // (identified by `applicationId` for a new flow or `executionId` to continue one). This is\n    // distinct from the OAuth authorization_code exchange handled by `super.signIn` below, which\n    // is used once the embedded flow completes and returns an authorization code.\n    const isEmbeddedFlowPayload: boolean =\n      typeof arg1 === 'object' && arg1 !== null && ('executionId' in arg1 || 'applicationId' in arg1);\n\n    if (isEmbeddedFlowPayload) {\n      await this.ensureInitialized();\n\n      // Typed as the Next config rather than `AuthClientConfig<T>` because the server-only\n      // `flowSecret` lives on `ThunderIDNodeConfig`, which the generic base config does not expose.\n      const configData: ThunderIDNextConfig = (await this.getStorageManager().getConfigData()) as ThunderIDNextConfig;\n\n      return executeEmbeddedSignInFlow({\n        baseUrl: configData?.baseUrl,\n        flowSecret: arg2?.flowSecret ?? configData?.flowSecret,\n        payload: arg1,\n        url: resolveResourceEndpoint('flowExecute', configData, arg2?.url),\n      }) as unknown as Promise<EmbeddedSignInFlowResponse>;\n    }\n\n    return super.signIn(arg4, arg3, arg1?.code, arg1?.state, arg1) as unknown as Promise<User>;\n  }\n\n  override async signOut(...args: any[]): Promise<string> {\n    if (args[1] && typeof args[1] !== 'string') {\n      throw new Error('The second argument must be a string.');\n    }\n\n    const config: T = this.getConfiguration();\n    const afterSignOutUrl: string = config?.afterSignOutUrl || '/';\n\n    const resolvedSessionId: string = args[1] || (await getSessionId())!;\n\n    try {\n      await (super.signOut as (...a: any[]) => Promise<string>)(resolvedSessionId);\n    } catch (error) {\n      const message: string = error instanceof Error ? error.message : String(error);\n\n      if (\n        !message.includes('end_session_endpoint') &&\n        !message.includes('sign-out endpoint') &&\n        !message.includes('Sign-out endpoint') &&\n        !message.includes('Sign-out redirect URL')\n      ) {\n        throw error;\n      }\n    }\n\n    return afterSignOutUrl;\n  }\n\n  override async signUp(_options?: SignUpOptions): Promise<void> {\n    throw new ThunderIDRuntimeError(\n      'Not implemented',\n      'ThunderIDNextClient-ValidationError-002',\n      'nextjs',\n      'The signUp method is not implemented in the Next.js client.',\n    );\n  }\n\n  // eslint-disable-next-line @typescript-eslint/no-unused-vars\n  override signInSilently(_options?: SignInOptions): Promise<User | boolean> {\n    throw new ThunderIDRuntimeError(\n      'Not implemented',\n      'ThunderIDNextClient-signInSilently-NotImplementedError-001',\n      'nextjs',\n      'The signInSilently method is not implemented in the Next.js client.',\n    );\n  }\n\n  public async getAuthorizeRequestUrl(\n    customParams: ExtendedAuthorizeRequestUrlParams,\n    userId?: string,\n  ): Promise<string> {\n    await this.ensureInitialized();\n    return this.getSignInUrl(customParams, userId);\n  }\n\n  public override getStorageManager(): any {\n    return super.getStorageManager();\n  }\n\n  public override async clearSession(): Promise<void> {\n    throw new ThunderIDRuntimeError(\n      'Not implemented',\n      'ThunderIDNextClient-clearSession-NotImplementedError-001',\n      'nextjs',\n      'The clearSession method is not implemented in the Next.js client.',\n    );\n  }\n\n  override async setSession(sessionData: Record<string, unknown>, sessionId?: string): Promise<void> {\n    return this.getStorageManager().setSessionData(sessionData, sessionId);\n  }\n\n  override decodeJwtToken<R = Record<string, unknown>>(token: string): Promise<R> {\n    return super.decodeJwtToken<R>(token);\n  }\n}\n\nexport default ThunderIDNextClient;\n"],"mappings":";;;;;;;;AAgCA,IAAM,sBAAN,cAAuFA,qCAAuB;CAC5G,AAAO,gBAAgB;CAEvB,AAAO,cAAc;AACnB,SAAO;;CAGT,MAAc,oBAAmC;AAC/C,MAAI,CAAC,KAAK,cAIR,OAAM,KAAK,WAAW,EAAE,CAAM;AAGhC,MAAI,CAAC,KAAK,cACR,OAAM,IAAI,MACR,iLACD;;CAIL,MAAe,WAAW,QAAW,SAAqC;AACxE,MAAI,KAAK,cACP,QAAO,QAAQ,QAAQ,KAAK;EAG9B,MAAM,EACJ,SACA,oBACA,UACA,cACA,YACA,WACA,gBACA,iBACA,UACA,GAAG,SACDC,0CAA0B,OAAO;EAErC,MAAMC,SAAiB,MAAMC,iCAAiB;EAE9C,MAAMC,cAAuB,MAAM,MAAM,WACvC;GACE,GAAG;GACH,gBAAgB,kBAAkB;GAClC,iBAAiB,mBAAmB;GACpC;GACA;GACA;GACA,YAAa,KAAa,cAAc;GACxC;GACA;GACA;GACA;GACD,EACD,QACD;AAED,OAAK,gBAAgB;AAErB,SAAO;;CAGT,MAAe,aAAa,QAAsC;AAChE,MAAI;AACF,SAAM,MAAM,aAAa,OAAO;AAChC,UAAO;WACA,OAAO;AACd,SAAM,IAAIC,uCACR,uCAAuC,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM,IAC7F,qDACA,UACA,8GACD;;;CAIL,MAAe,QAAQ,QAAgC;AACrD,QAAM,KAAK,mBAAmB;EAC9B,MAAMC,oBAA4B,UAAW,MAAMC,8BAAc;AAEjE,MAAI;GACF,MAAMC,aAAkC,MAAM,KAAK,mBAAmB,CAAC,eAAe;GACtF,MAAMC,UAA8B,YAAY;AAUhD,UARsB,uCAAiB;IACrC;IACA,mDAA6B,WAAW,WAAW;IACnD,SAAS,EACP,eAAe,UAAU,MAAM,KAAK,eAAe,OAAO,IAC3D;IACF,CAAC;WAGK,OAAO;AACd,UAAO,MAAM,MAAM,QAAQ,kBAAkB;;;CAIjD,MAAe,eAAe,QAAuC;AACnE,QAAM,KAAK,mBAAmB;AAE9B,MAAI;GACF,MAAMD,aAAkC,MAAM,KAAK,mBAAmB,CAAC,eAAe;GACtF,MAAMC,UAA8B,YAAY;GAEhD,MAAMC,UAAgB,uCAAiB;IACrC;IACA,mDAA6B,WAAW,WAAW;IACnD,SAAS,EACP,eAAe,UAAU,MAAM,KAAK,eAAe,OAAO,IAC3D;IACF,CAAC;AAEF,UAAO;IACL,qEAA+C,QAAQ;IACvD;IACD;WACM,OAAO;AACd,UAAO;IACL,qEAA+C,MAAM,MAAM,kBAAkB,OAAO,CAAC;IACrF,4DAAsC,MAAM,MAAM,kBAAkB,OAAO,CAAC;IAC7E;;;CAIL,MAAM,cAAc,QAAkE;AACpF,QAAM,KAAK,mBAAmB;AAE9B,MAAI;GACF,MAAMF,aAAkC,MAAM,KAAK,mBAAmB,CAAC,eAAe;GACtF,MAAMC,UAA8B,YAAY;GAEhD,MAAM,EAAC,WAAU,2CAAqB;IACpC;IACA,mDAA6B,eAAe,WAAW;IACvD,SAAS,EACP,eAAe,UAAU,MAAM,KAAK,eAAe,OAAO,IAC3D;IACF,CAAC;AAEF,UAAO,UAAU;WACV,OAAO;AACd,UAAO;;;CAIX,MAAe,kBAAkB,SAAc,QAAgC;AAC7E,QAAM,KAAK,mBAAmB;AAE9B,MAAI;GACF,MAAMD,aAAkC,MAAM,KAAK,mBAAmB,CAAC,eAAe;GACtF,MAAMC,UAA8B,YAAY;AAEhD,gDAAuB;IACrB;IACA,mDAA6B,WAAW,WAAW;IACnD,SAAS,EACP,eAAe,UAAU,MAAM,KAAK,eAAe,OAAO,IAC3D;IACD,SAAS,SAAS,WAAW;IAC9B,CAAC;WACK,OAAO;AACd,SAAM,IAAIJ,uCACR,kCAAkC,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM,IACxF,8CACA,SACA,6GACD;;;;;;;;;;;;;;;;;;CAmBL,MAAe,sBAAsB,SAAiC,QAAgC;AACpG,QAAM,KAAK,mBAAmB;EAE9B,MAAMG,aAAkC,MAAM,KAAK,mBAAmB,CAAC,eAAe;EACtF,MAAMC,UAA8B,YAAY;AAEhD,kDAA0B;GACxB;GACA,mDAA6B,sBAAsB,WAAW;GAC9D,SAAS,EACP,eAAe,UAAU,MAAM,KAAK,eAAe,OAAO,IAC3D;GACD;GACD,CAAC;;CAGJ,AAAS,YAAqB;AAC5B,SAAO;;CAGT,AAAS,WAAW,WAAsC;AACxD,SAAO,MAAM,WAAW,UAAU;;CAGpC,AAAS,cAAc,QAAoC,WAAuD;AAChH,SAAO,MAAM,cAAc,QAAQ,UAAU;;CAI/C,MAAe,eAAe,YAAsC;EAClE,MAAM,EAAC,SAAS,mBAAkB,2CAAM;EACxC,MAAME,QAA4B,MAAM,gBAAgB;AAExD,MAAI,OAAO,UAAU,YAAY,CAAC,MAChC,OAAM,IAAIN,uCACR,+BACA,uDACA,UACA,8GACD;AAGH,SAAO;;CAGT,MAAe,kBAAkB,WAAoB,SAAoC;AACvF,QAAM,KAAK,mBAAmB;AAC9B,SAAO,MAAM,MAAM,kBAAkB,WAAW,QAAQ;;CAG1D,MAAe,OAAO,GAAG,MAA2B;EAClD,MAAMO,OAAY,KAAK;EACvB,MAAMC,OAAY,KAAK;EACvB,MAAMC,OAAY,KAAK;EACvB,MAAMC,OAAY,KAAK;AASvB,MAFE,OAAO,SAAS,YAAY,SAAS,SAAS,iBAAiB,QAAQ,mBAAmB,OAEjE;AACzB,SAAM,KAAK,mBAAmB;GAI9B,MAAMC,aAAmC,MAAM,KAAK,mBAAmB,CAAC,eAAe;AAEvF,0DAAiC;IAC/B,SAAS,YAAY;IACrB,YAAY,MAAM,cAAc,YAAY;IAC5C,SAAS;IACT,mDAA6B,eAAe,YAAY,MAAM,IAAI;IACnE,CAAC;;AAGJ,SAAO,MAAM,OAAO,MAAM,MAAM,MAAM,MAAM,MAAM,OAAO,KAAK;;CAGhE,MAAe,QAAQ,GAAG,MAA8B;AACtD,MAAI,KAAK,MAAM,OAAO,KAAK,OAAO,SAChC,OAAM,IAAI,MAAM,wCAAwC;EAI1D,MAAMC,kBADY,KAAK,kBAAkB,EACD,mBAAmB;EAE3D,MAAMX,oBAA4B,KAAK,MAAO,MAAMC,8BAAc;AAElE,MAAI;AACF,SAAO,MAAM,QAA6C,kBAAkB;WACrE,OAAO;GACd,MAAMW,UAAkB,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM;AAE9E,OACE,CAAC,QAAQ,SAAS,uBAAuB,IACzC,CAAC,QAAQ,SAAS,oBAAoB,IACtC,CAAC,QAAQ,SAAS,oBAAoB,IACtC,CAAC,QAAQ,SAAS,wBAAwB,CAE1C,OAAM;;AAIV,SAAO;;CAGT,MAAe,OAAO,UAAyC;AAC7D,QAAM,IAAIb,uCACR,mBACA,2CACA,UACA,8DACD;;CAIH,AAAS,eAAe,UAAmD;AACzE,QAAM,IAAIA,uCACR,mBACA,8DACA,UACA,sEACD;;CAGH,MAAa,uBACX,cACA,QACiB;AACjB,QAAM,KAAK,mBAAmB;AAC9B,SAAO,KAAK,aAAa,cAAc,OAAO;;CAGhD,AAAgB,oBAAyB;AACvC,SAAO,MAAM,mBAAmB;;CAGlC,MAAsB,eAA8B;AAClD,QAAM,IAAIA,uCACR,mBACA,4DACA,UACA,oEACD;;CAGH,MAAe,WAAW,aAAsC,WAAmC;AACjG,SAAO,KAAK,mBAAmB,CAAC,eAAe,aAAa,UAAU;;CAGxE,AAAS,eAA4C,OAA2B;AAC9E,SAAO,MAAM,eAAkB,MAAM;;;AAIzC,kCAAe"}
+{"version":3,"file":"ThunderIDNextClient.cjs","names":["ThunderIDNodeClient","decorateConfigWithNextEnv","origin: string","getClientOrigin","initialized: boolean","ThunderIDRuntimeError","resolvedSessionId: string","getSessionId","configData: AuthClientConfig<T>","baseUrl: string | undefined","profile: User","token: string | undefined","arg1: any","arg2: any","arg3: any","arg4: any","configData: ThunderIDNextConfig","afterSignOutUrl: string","message: string"],"sources":["../../src/ThunderIDNextClient.ts"],"sourcesContent":["// Copyright 2025 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\nimport {\n  ThunderIDNodeClient,\n  ThunderIDRuntimeError,\n  AttributeSchema,\n  AuthClientConfig,\n  EmbeddedSignInFlowResponse,\n  ExtendedAuthorizeRequestUrlParams,\n  IdToken,\n  SignInOptions,\n  SignUpOptions,\n  Storage,\n  TokenExchangeRequestConfig,\n  TokenResponse,\n  User,\n  ManagedFlowListResponse,\n  ManagedUserListResponse,\n  ManagedUserTypeListResponse,\n  UserProfile,\n  executeEmbeddedSignInFlow,\n  extractUserClaimsFromIdToken,\n  generateFlattenedUserProfile,\n  getUsersMe,\n  getUsersMeMeta,\n  updateMeCredentials,\n  updateMeProfile,\n  resolveResourceEndpoint,\n} from '@thunderid/node';\nimport {ThunderIDNextConfig} from './models/config';\nimport getClientOrigin from './server/actions/getClientOrigin';\nimport getSessionId from './server/actions/getSessionId';\nimport decorateConfigWithNextEnv from './utils/decorateConfigWithNextEnv';\n\nclass ThunderIDNextClient<T extends ThunderIDNextConfig = ThunderIDNextConfig> extends ThunderIDNodeClient<T> {\n  public isInitialized = false;\n\n  public constructor() {\n    super();\n  }\n\n  private async ensureInitialized(): Promise<void> {\n    if (!this.isInitialized) {\n      // Server actions may run in a module context that hasn't been through\n      // ThunderIDServerProvider (e.g. a different worker). Try to initialize\n      // from environment variables before giving up.\n      await this.initialize({} as T);\n    }\n\n    if (!this.isInitialized) {\n      throw new Error(\n        '[ThunderIDNextClient] Client is not initialized. Make sure you have wrapped your app with ThunderIDProvider and provided the required configuration (baseUrl, clientId, etc.).',\n      );\n    }\n  }\n\n  override async initialize(config: T, storage?: Storage): Promise<boolean> {\n    if (this.isInitialized) {\n      return Promise.resolve(true);\n    }\n\n    const {\n      baseUrl,\n      organizationHandle,\n      clientId,\n      clientSecret,\n      flowSecret,\n      signInUrl,\n      afterSignInUrl,\n      afterSignOutUrl,\n      signUpUrl,\n      ...rest\n    } = decorateConfigWithNextEnv(config);\n\n    const origin: string = await getClientOrigin();\n\n    const initialized: boolean = await super.initialize(\n      {\n        ...rest,\n        afterSignInUrl: afterSignInUrl ?? origin,\n        afterSignOutUrl: afterSignOutUrl ?? origin,\n        baseUrl,\n        clientId,\n        clientSecret,\n        enablePKCE: (rest as any).enablePKCE ?? true,\n        flowSecret,\n        organizationHandle,\n        signInUrl,\n        signUpUrl,\n      } as any,\n      storage,\n    );\n\n    this.isInitialized = initialized;\n\n    return initialized;\n  }\n\n  override async reInitialize(config: Partial<T>): Promise<boolean> {\n    try {\n      await super.reInitialize(config);\n      return true;\n    } catch (error) {\n      throw new ThunderIDRuntimeError(\n        `Failed to re-initialize the client: ${error instanceof Error ? error.message : String(error)}`,\n        'ThunderIDNextClient-reInitialize-RuntimeError-001',\n        'nextjs',\n        'An error occurred while re-initializing the client. Please check your configuration and network connection.',\n      );\n    }\n  }\n\n  override async getUser(userId?: string): Promise<User> {\n    await this.ensureInitialized();\n    const resolvedSessionId: string = userId || (await getSessionId())!;\n\n    try {\n      const configData: AuthClientConfig<T> = await this.getStorageManager().getConfigData();\n      const baseUrl: string | undefined = configData?.baseUrl;\n\n      const profile: User = await getUsersMe({\n        baseUrl,\n        url: resolveResourceEndpoint('usersMe', configData),\n        headers: {\n          Authorization: `Bearer ${await this.getAccessToken(userId)}`,\n        },\n      });\n\n      return profile;\n    } catch (error) {\n      return await super.getUser(resolvedSessionId);\n    }\n  }\n\n  override async getUserProfile(userId?: string): Promise<UserProfile> {\n    await this.ensureInitialized();\n\n    try {\n      const configData: AuthClientConfig<T> = await this.getStorageManager().getConfigData();\n      const baseUrl: string | undefined = configData?.baseUrl;\n\n      const profile: User = await getUsersMe({\n        baseUrl,\n        url: resolveResourceEndpoint('usersMe', configData),\n        headers: {\n          Authorization: `Bearer ${await this.getAccessToken(userId)}`,\n        },\n      });\n\n      return {\n        flattenedProfile: generateFlattenedUserProfile(profile),\n        profile,\n      };\n    } catch (error) {\n      return {\n        flattenedProfile: extractUserClaimsFromIdToken(await super.getDecodedIdToken(userId)),\n        profile: extractUserClaimsFromIdToken(await super.getDecodedIdToken(userId)),\n      };\n    }\n  }\n\n  async getUserSchema(userId?: string): Promise<Record<string, AttributeSchema> | null> {\n    await this.ensureInitialized();\n\n    try {\n      const configData: AuthClientConfig<T> = await this.getStorageManager().getConfigData();\n      const baseUrl: string | undefined = configData?.baseUrl;\n\n      const {schema} = await getUsersMeMeta({\n        baseUrl,\n        url: resolveResourceEndpoint('usersMeMeta', configData),\n        headers: {\n          Authorization: `Bearer ${await this.getAccessToken(userId)}`,\n        },\n      });\n\n      return schema ?? null;\n    } catch (error) {\n      return null;\n    }\n  }\n\n  override async updateUserProfile(payload: any, userId?: string): Promise<User> {\n    await this.ensureInitialized();\n\n    try {\n      const configData: AuthClientConfig<T> = await this.getStorageManager().getConfigData();\n      const baseUrl: string | undefined = configData?.baseUrl;\n\n      return updateMeProfile({\n        baseUrl,\n        url: resolveResourceEndpoint('usersMe', configData),\n        headers: {\n          Authorization: `Bearer ${await this.getAccessToken(userId)}`,\n        },\n        payload: payload?.payload ?? payload,\n      });\n    } catch (error) {\n      throw new ThunderIDRuntimeError(\n        `Failed to update user profile: ${error instanceof Error ? error.message : String(error)}`,\n        'ThunderIDNextClient-UpdateProfileError-001',\n        'react',\n        'An error occurred while updating the user profile. Please check your configuration and network connection.',\n      );\n    }\n  }\n\n  /**\n   * Updates one or more of the signed-in user's credentials (e.g. `password`, or any other\n   * attribute the user type schema declares `credential: true`).\n   *\n   * Not part of {@link ThunderIDJavaScriptClient}'s base surface — unlike `updateUserProfile`,\n   * no other SDK routes credential updates through a client method (React/Vue's\n   * `ChangeCredential` call the core `updateMeCredentials` function directly), so this is a\n   * Next.js-specific addition rather than an override. Kept here anyway so this SDK's own\n   * server actions have one consistent way to reach every `/users/me/*` operation.\n   *\n   * Deliberately does not catch and rewrap errors the way `updateUserProfile` does: the caller\n   * (`updateUserCredentialsAction`) needs the real `ThunderIDAPIError` instance, status code\n   * included, to map a failure onto the right form field before it crosses the server action\n   * boundary back to the client.\n   */\n  override async updateUserCredentials(payload: Record<string, string>, userId?: string): Promise<void> {\n    await this.ensureInitialized();\n\n    const configData: AuthClientConfig<T> = await this.getStorageManager().getConfigData();\n    const baseUrl: string | undefined = configData?.baseUrl;\n\n    await updateMeCredentials({\n      baseUrl,\n      url: resolveResourceEndpoint('usersMeCredentials', configData),\n      headers: {\n        Authorization: `Bearer ${await this.getAccessToken(userId)}`,\n      },\n      payload,\n    });\n  }\n\n  /**\n   * Retrieves one page of the user directory for the session identified by `userId`.\n   *\n   * Ensures the client is initialized first, like `updateUserCredentials`. Errors are not caught so the calling server action can map the real `ThunderIDAPIError`.\n   */\n  override async getUsers(\n    options: {filter?: string; limit?: number; offset?: number; signal?: AbortSignal} = {},\n    userId?: string,\n  ): Promise<ManagedUserListResponse> {\n    await this.ensureInitialized();\n\n    return super.getUsers(options, userId);\n  }\n\n  /**\n   * Retrieves one page of flows for the session identified by `userId`.\n   *\n   * Ensures the client is initialized first, like `getUsers`. Errors are not caught so the calling server action can map the real `ThunderIDAPIError`.\n   */\n  override async getFlows(\n    options: {flowType?: string; limit?: number; offset?: number; signal?: AbortSignal} = {},\n    userId?: string,\n  ): Promise<ManagedFlowListResponse> {\n    await this.ensureInitialized();\n\n    return super.getFlows(options, userId);\n  }\n\n  /**\n   * Retrieves one page of user types for the session identified by `userId`.\n   *\n   * Ensures the client is initialized first, like `getUsers`. Errors are not caught so the calling server action can map the real `ThunderIDAPIError`.\n   */\n  override async getUserTypes(\n    options: {limit?: number; offset?: number; signal?: AbortSignal} = {},\n    userId?: string,\n  ): Promise<ManagedUserTypeListResponse> {\n    await this.ensureInitialized();\n\n    return super.getUserTypes(options, userId);\n  }\n\n  override isLoading(): boolean {\n    return false;\n  }\n\n  override isSignedIn(sessionId?: string): Promise<boolean> {\n    return super.isSignedIn(sessionId);\n  }\n\n  override exchangeToken(config: TokenExchangeRequestConfig, sessionId?: string): Promise<TokenResponse | Response> {\n    return super.exchangeToken(config, sessionId) as unknown as Promise<TokenResponse | Response>;\n  }\n\n  // eslint-disable-next-line @typescript-eslint/no-unused-vars\n  override async getAccessToken(_sessionId?: string): Promise<string> {\n    const {default: getAccessToken} = await import('./server/actions/getAccessToken');\n    const token: string | undefined = await getAccessToken();\n\n    if (typeof token !== 'string' || !token) {\n      throw new ThunderIDRuntimeError(\n        'Failed to get access token.',\n        'ThunderIDNextClient-getAccessToken-RuntimeError-003',\n        'nextjs',\n        'An error occurred while obtaining the access token. Please check your configuration and network connection.',\n      );\n    }\n\n    return token;\n  }\n\n  override async getDecodedIdToken(sessionId?: string, idToken?: string): Promise<IdToken> {\n    await this.ensureInitialized();\n    return await super.getDecodedIdToken(sessionId, idToken);\n  }\n\n  override async signIn(...args: any[]): Promise<any> {\n    const arg1: any = args[0];\n    const arg2: any = args[1];\n    const arg3: any = args[2];\n    const arg4: any = args[3];\n\n    // An embedded sign-in flow payload initiates or continues a `POST /flow/execute` step\n    // (identified by `applicationId` for a new flow or `executionId` to continue one). This is\n    // distinct from the OAuth authorization_code exchange handled by `super.signIn` below, which\n    // is used once the embedded flow completes and returns an authorization code.\n    const isEmbeddedFlowPayload: boolean =\n      typeof arg1 === 'object' && arg1 !== null && ('executionId' in arg1 || 'applicationId' in arg1);\n\n    if (isEmbeddedFlowPayload) {\n      await this.ensureInitialized();\n\n      // Typed as the Next config rather than `AuthClientConfig<T>` because the server-only\n      // `flowSecret` lives on `ThunderIDNodeConfig`, which the generic base config does not expose.\n      const configData: ThunderIDNextConfig = (await this.getStorageManager().getConfigData()) as ThunderIDNextConfig;\n\n      return executeEmbeddedSignInFlow({\n        baseUrl: configData?.baseUrl,\n        flowSecret: arg2?.flowSecret ?? configData?.flowSecret,\n        payload: arg1,\n        url: resolveResourceEndpoint('flowExecute', configData, arg2?.url),\n      }) as unknown as Promise<EmbeddedSignInFlowResponse>;\n    }\n\n    return super.signIn(arg4, arg3, arg1?.code, arg1?.state, arg1) as unknown as Promise<User>;\n  }\n\n  override async signOut(...args: any[]): Promise<string> {\n    if (args[1] && typeof args[1] !== 'string') {\n      throw new Error('The second argument must be a string.');\n    }\n\n    const config: T = this.getConfiguration();\n    const afterSignOutUrl: string = config?.afterSignOutUrl || '/';\n\n    const resolvedSessionId: string = args[1] || (await getSessionId())!;\n\n    try {\n      await (super.signOut as (...a: any[]) => Promise<string>)(resolvedSessionId);\n    } catch (error) {\n      const message: string = error instanceof Error ? error.message : String(error);\n\n      if (\n        !message.includes('end_session_endpoint') &&\n        !message.includes('sign-out endpoint') &&\n        !message.includes('Sign-out endpoint') &&\n        !message.includes('Sign-out redirect URL')\n      ) {\n        throw error;\n      }\n    }\n\n    return afterSignOutUrl;\n  }\n\n  override async signUp(_options?: SignUpOptions): Promise<void> {\n    throw new ThunderIDRuntimeError(\n      'Not implemented',\n      'ThunderIDNextClient-ValidationError-002',\n      'nextjs',\n      'The signUp method is not implemented in the Next.js client.',\n    );\n  }\n\n  // eslint-disable-next-line @typescript-eslint/no-unused-vars\n  override signInSilently(_options?: SignInOptions): Promise<User | boolean> {\n    throw new ThunderIDRuntimeError(\n      'Not implemented',\n      'ThunderIDNextClient-signInSilently-NotImplementedError-001',\n      'nextjs',\n      'The signInSilently method is not implemented in the Next.js client.',\n    );\n  }\n\n  public async getAuthorizeRequestUrl(\n    customParams: ExtendedAuthorizeRequestUrlParams,\n    userId?: string,\n  ): Promise<string> {\n    await this.ensureInitialized();\n    return this.getSignInUrl(customParams, userId);\n  }\n\n  public override getStorageManager(): any {\n    return super.getStorageManager();\n  }\n\n  public override async clearSession(): Promise<void> {\n    throw new ThunderIDRuntimeError(\n      'Not implemented',\n      'ThunderIDNextClient-clearSession-NotImplementedError-001',\n      'nextjs',\n      'The clearSession method is not implemented in the Next.js client.',\n    );\n  }\n\n  override async setSession(sessionData: Record<string, unknown>, sessionId?: string): Promise<void> {\n    return this.getStorageManager().setSessionData(sessionData, sessionId);\n  }\n\n  override decodeJwtToken<R = Record<string, unknown>>(token: string): Promise<R> {\n    return super.decodeJwtToken<R>(token);\n  }\n}\n\nexport default ThunderIDNextClient;\n"],"mappings":";;;;;;;;AAmCA,IAAM,sBAAN,cAAuFA,qCAAuB;CAC5G,AAAO,gBAAgB;CAEvB,AAAO,cAAc;AACnB,SAAO;;CAGT,MAAc,oBAAmC;AAC/C,MAAI,CAAC,KAAK,cAIR,OAAM,KAAK,WAAW,EAAE,CAAM;AAGhC,MAAI,CAAC,KAAK,cACR,OAAM,IAAI,MACR,iLACD;;CAIL,MAAe,WAAW,QAAW,SAAqC;AACxE,MAAI,KAAK,cACP,QAAO,QAAQ,QAAQ,KAAK;EAG9B,MAAM,EACJ,SACA,oBACA,UACA,cACA,YACA,WACA,gBACA,iBACA,UACA,GAAG,SACDC,0CAA0B,OAAO;EAErC,MAAMC,SAAiB,MAAMC,iCAAiB;EAE9C,MAAMC,cAAuB,MAAM,MAAM,WACvC;GACE,GAAG;GACH,gBAAgB,kBAAkB;GAClC,iBAAiB,mBAAmB;GACpC;GACA;GACA;GACA,YAAa,KAAa,cAAc;GACxC;GACA;GACA;GACA;GACD,EACD,QACD;AAED,OAAK,gBAAgB;AAErB,SAAO;;CAGT,MAAe,aAAa,QAAsC;AAChE,MAAI;AACF,SAAM,MAAM,aAAa,OAAO;AAChC,UAAO;WACA,OAAO;AACd,SAAM,IAAIC,uCACR,uCAAuC,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM,IAC7F,qDACA,UACA,8GACD;;;CAIL,MAAe,QAAQ,QAAgC;AACrD,QAAM,KAAK,mBAAmB;EAC9B,MAAMC,oBAA4B,UAAW,MAAMC,8BAAc;AAEjE,MAAI;GACF,MAAMC,aAAkC,MAAM,KAAK,mBAAmB,CAAC,eAAe;GACtF,MAAMC,UAA8B,YAAY;AAUhD,UARsB,uCAAiB;IACrC;IACA,mDAA6B,WAAW,WAAW;IACnD,SAAS,EACP,eAAe,UAAU,MAAM,KAAK,eAAe,OAAO,IAC3D;IACF,CAAC;WAGK,OAAO;AACd,UAAO,MAAM,MAAM,QAAQ,kBAAkB;;;CAIjD,MAAe,eAAe,QAAuC;AACnE,QAAM,KAAK,mBAAmB;AAE9B,MAAI;GACF,MAAMD,aAAkC,MAAM,KAAK,mBAAmB,CAAC,eAAe;GACtF,MAAMC,UAA8B,YAAY;GAEhD,MAAMC,UAAgB,uCAAiB;IACrC;IACA,mDAA6B,WAAW,WAAW;IACnD,SAAS,EACP,eAAe,UAAU,MAAM,KAAK,eAAe,OAAO,IAC3D;IACF,CAAC;AAEF,UAAO;IACL,qEAA+C,QAAQ;IACvD;IACD;WACM,OAAO;AACd,UAAO;IACL,qEAA+C,MAAM,MAAM,kBAAkB,OAAO,CAAC;IACrF,4DAAsC,MAAM,MAAM,kBAAkB,OAAO,CAAC;IAC7E;;;CAIL,MAAM,cAAc,QAAkE;AACpF,QAAM,KAAK,mBAAmB;AAE9B,MAAI;GACF,MAAMF,aAAkC,MAAM,KAAK,mBAAmB,CAAC,eAAe;GACtF,MAAMC,UAA8B,YAAY;GAEhD,MAAM,EAAC,WAAU,2CAAqB;IACpC;IACA,mDAA6B,eAAe,WAAW;IACvD,SAAS,EACP,eAAe,UAAU,MAAM,KAAK,eAAe,OAAO,IAC3D;IACF,CAAC;AAEF,UAAO,UAAU;WACV,OAAO;AACd,UAAO;;;CAIX,MAAe,kBAAkB,SAAc,QAAgC;AAC7E,QAAM,KAAK,mBAAmB;AAE9B,MAAI;GACF,MAAMD,aAAkC,MAAM,KAAK,mBAAmB,CAAC,eAAe;GACtF,MAAMC,UAA8B,YAAY;AAEhD,gDAAuB;IACrB;IACA,mDAA6B,WAAW,WAAW;IACnD,SAAS,EACP,eAAe,UAAU,MAAM,KAAK,eAAe,OAAO,IAC3D;IACD,SAAS,SAAS,WAAW;IAC9B,CAAC;WACK,OAAO;AACd,SAAM,IAAIJ,uCACR,kCAAkC,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM,IACxF,8CACA,SACA,6GACD;;;;;;;;;;;;;;;;;;CAmBL,MAAe,sBAAsB,SAAiC,QAAgC;AACpG,QAAM,KAAK,mBAAmB;EAE9B,MAAMG,aAAkC,MAAM,KAAK,mBAAmB,CAAC,eAAe;EACtF,MAAMC,UAA8B,YAAY;AAEhD,kDAA0B;GACxB;GACA,mDAA6B,sBAAsB,WAAW;GAC9D,SAAS,EACP,eAAe,UAAU,MAAM,KAAK,eAAe,OAAO,IAC3D;GACD;GACD,CAAC;;;;;;;CAQJ,MAAe,SACb,UAAoF,EAAE,EACtF,QACkC;AAClC,QAAM,KAAK,mBAAmB;AAE9B,SAAO,MAAM,SAAS,SAAS,OAAO;;;;;;;CAQxC,MAAe,SACb,UAAsF,EAAE,EACxF,QACkC;AAClC,QAAM,KAAK,mBAAmB;AAE9B,SAAO,MAAM,SAAS,SAAS,OAAO;;;;;;;CAQxC,MAAe,aACb,UAAmE,EAAE,EACrE,QACsC;AACtC,QAAM,KAAK,mBAAmB;AAE9B,SAAO,MAAM,aAAa,SAAS,OAAO;;CAG5C,AAAS,YAAqB;AAC5B,SAAO;;CAGT,AAAS,WAAW,WAAsC;AACxD,SAAO,MAAM,WAAW,UAAU;;CAGpC,AAAS,cAAc,QAAoC,WAAuD;AAChH,SAAO,MAAM,cAAc,QAAQ,UAAU;;CAI/C,MAAe,eAAe,YAAsC;EAClE,MAAM,EAAC,SAAS,mBAAkB,2CAAM;EACxC,MAAME,QAA4B,MAAM,gBAAgB;AAExD,MAAI,OAAO,UAAU,YAAY,CAAC,MAChC,OAAM,IAAIN,uCACR,+BACA,uDACA,UACA,8GACD;AAGH,SAAO;;CAGT,MAAe,kBAAkB,WAAoB,SAAoC;AACvF,QAAM,KAAK,mBAAmB;AAC9B,SAAO,MAAM,MAAM,kBAAkB,WAAW,QAAQ;;CAG1D,MAAe,OAAO,GAAG,MAA2B;EAClD,MAAMO,OAAY,KAAK;EACvB,MAAMC,OAAY,KAAK;EACvB,MAAMC,OAAY,KAAK;EACvB,MAAMC,OAAY,KAAK;AASvB,MAFE,OAAO,SAAS,YAAY,SAAS,SAAS,iBAAiB,QAAQ,mBAAmB,OAEjE;AACzB,SAAM,KAAK,mBAAmB;GAI9B,MAAMC,aAAmC,MAAM,KAAK,mBAAmB,CAAC,eAAe;AAEvF,0DAAiC;IAC/B,SAAS,YAAY;IACrB,YAAY,MAAM,cAAc,YAAY;IAC5C,SAAS;IACT,mDAA6B,eAAe,YAAY,MAAM,IAAI;IACnE,CAAC;;AAGJ,SAAO,MAAM,OAAO,MAAM,MAAM,MAAM,MAAM,MAAM,OAAO,KAAK;;CAGhE,MAAe,QAAQ,GAAG,MAA8B;AACtD,MAAI,KAAK,MAAM,OAAO,KAAK,OAAO,SAChC,OAAM,IAAI,MAAM,wCAAwC;EAI1D,MAAMC,kBADY,KAAK,kBAAkB,EACD,mBAAmB;EAE3D,MAAMX,oBAA4B,KAAK,MAAO,MAAMC,8BAAc;AAElE,MAAI;AACF,SAAO,MAAM,QAA6C,kBAAkB;WACrE,OAAO;GACd,MAAMW,UAAkB,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM;AAE9E,OACE,CAAC,QAAQ,SAAS,uBAAuB,IACzC,CAAC,QAAQ,SAAS,oBAAoB,IACtC,CAAC,QAAQ,SAAS,oBAAoB,IACtC,CAAC,QAAQ,SAAS,wBAAwB,CAE1C,OAAM;;AAIV,SAAO;;CAGT,MAAe,OAAO,UAAyC;AAC7D,QAAM,IAAIb,uCACR,mBACA,2CACA,UACA,8DACD;;CAIH,AAAS,eAAe,UAAmD;AACzE,QAAM,IAAIA,uCACR,mBACA,8DACA,UACA,sEACD;;CAGH,MAAa,uBACX,cACA,QACiB;AACjB,QAAM,KAAK,mBAAmB;AAC9B,SAAO,KAAK,aAAa,cAAc,OAAO;;CAGhD,AAAgB,oBAAyB;AACvC,SAAO,MAAM,mBAAmB;;CAGlC,MAAsB,eAA8B;AAClD,QAAM,IAAIA,uCACR,mBACA,4DACA,UACA,oEACD;;CAGH,MAAe,WAAW,aAAsC,WAAmC;AACjG,SAAO,KAAK,mBAAmB,CAAC,eAAe,aAAa,UAAU;;CAGxE,AAAS,eAA4C,OAA2B;AAC9E,SAAO,MAAM,eAAkB,MAAM;;;AAIzC,kCAAe"}

package/dist/cjs/client/components/presentation/AuthFlowSelect/AuthFlowSelect.cjs

@@ -0,0 +1,25 @@
+'use client';
+
+
+const require_rolldown_runtime = require('../../../../_virtual/rolldown_runtime.cjs');
+const require_fetchAuthFlowsFromServer = require('../../../fetchAuthFlowsFromServer.cjs');
+let __thunderid_react = require("@thunderid/react");
+__thunderid_react = require_rolldown_runtime.__toESM(__thunderid_react);
+let react_jsx_runtime = require("react/jsx-runtime");
+react_jsx_runtime = require_rolldown_runtime.__toESM(react_jsx_runtime);
+
+//#region src/client/components/presentation/AuthFlowSelect/AuthFlowSelect.tsx
+/**
+* Authentication-flow picker for signed-in screens. Flows load through a server action that uses the
+* signed-in user's server-held session, so the access token never reaches the browser. It takes no
+* data source; for a custom one use `Select` with `useInfiniteOptions`.
+*/
+const AuthFlowSelect = (props) => /* @__PURE__ */ (0, react_jsx_runtime.jsx)(__thunderid_react.BaseAuthFlowSelect, {
+	...props,
+	fetchAuthFlows: require_fetchAuthFlowsFromServer.default
+});
+var AuthFlowSelect_default = AuthFlowSelect;
+
+//#endregion
+exports.default = AuthFlowSelect_default;
+//# sourceMappingURL=AuthFlowSelect.cjs.map

package/dist/cjs/client/components/presentation/AuthFlowSelect/AuthFlowSelect.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthFlowSelect.cjs","names":["AuthFlowSelect: FC<AuthFlowSelectProps>","BaseAuthFlowSelect","fetchAuthFlowsFromServer"],"sources":["../../../../../../src/client/components/presentation/AuthFlowSelect/AuthFlowSelect.tsx"],"sourcesContent":["// Copyright 2026 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\n'use client';\n\nimport {BaseAuthFlowSelect, BaseAuthFlowSelectProps} from '@thunderid/react';\nimport {FC} from 'react';\nimport fetchAuthFlowsFromServer from '../../../fetchAuthFlowsFromServer';\n\nexport type AuthFlowSelectProps = Omit<BaseAuthFlowSelectProps, 'fetchAuthFlows'>;\n\n/**\n * Authentication-flow picker for signed-in screens. Flows load through a server action that uses the\n * signed-in user's server-held session, so the access token never reaches the browser. It takes no\n * data source; for a custom one use `Select` with `useInfiniteOptions`.\n */\nconst AuthFlowSelect: FC<AuthFlowSelectProps> = (props: AuthFlowSelectProps) => (\n  <BaseAuthFlowSelect {...props} fetchAuthFlows={fetchAuthFlowsFromServer} />\n);\n\nexport default AuthFlowSelect;\n"],"mappings":";;;;;;;;;;;;;;;;AAgBA,MAAMA,kBAA2C,UAC/C,2CAACC;CAAmB,GAAI;CAAO,gBAAgBC;EAA4B;AAG7E,6BAAe"}

package/dist/cjs/client/components/presentation/UserSelect/UserSelect.cjs

@@ -0,0 +1,25 @@
+'use client';
+
+
+const require_rolldown_runtime = require('../../../../_virtual/rolldown_runtime.cjs');
+const require_fetchUsersFromServer = require('../../../fetchUsersFromServer.cjs');
+let __thunderid_react = require("@thunderid/react");
+__thunderid_react = require_rolldown_runtime.__toESM(__thunderid_react);
+let react_jsx_runtime = require("react/jsx-runtime");
+react_jsx_runtime = require_rolldown_runtime.__toESM(react_jsx_runtime);
+
+//#region src/client/components/presentation/UserSelect/UserSelect.tsx
+/**
+* Single-user picker for signed-in screens. Users load through a server action that uses the
+* signed-in user's server-held session, so the access token never reaches the browser. It takes no
+* data source; for a custom one use `Select` with `useInfiniteOptions`.
+*/
+const UserSelect = (props) => /* @__PURE__ */ (0, react_jsx_runtime.jsx)(__thunderid_react.BaseUserSelect, {
+	...props,
+	fetchUsers: require_fetchUsersFromServer.default
+});
+var UserSelect_default = UserSelect;
+
+//#endregion
+exports.default = UserSelect_default;
+//# sourceMappingURL=UserSelect.cjs.map

package/dist/cjs/client/components/presentation/UserSelect/UserSelect.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"UserSelect.cjs","names":["UserSelect: FC<UserSelectProps>","BaseUserSelect","fetchUsersFromServer"],"sources":["../../../../../../src/client/components/presentation/UserSelect/UserSelect.tsx"],"sourcesContent":["// Copyright 2026 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\n'use client';\n\nimport {BaseUserSelect, BaseUserSelectProps} from '@thunderid/react';\nimport {FC} from 'react';\nimport fetchUsersFromServer from '../../../fetchUsersFromServer';\n\nexport type UserSelectProps = Omit<BaseUserSelectProps, 'fetchUsers'>;\n\n/**\n * Single-user picker for signed-in screens. Users load through a server action that uses the\n * signed-in user's server-held session, so the access token never reaches the browser. It takes no\n * data source; for a custom one use `Select` with `useInfiniteOptions`.\n */\nconst UserSelect: FC<UserSelectProps> = (props: UserSelectProps) => (\n  <BaseUserSelect {...props} fetchUsers={fetchUsersFromServer} />\n);\n\nexport default UserSelect;\n"],"mappings":";;;;;;;;;;;;;;;;AAgBA,MAAMA,cAAmC,UACvC,2CAACC;CAAe,GAAI;CAAO,YAAYC;EAAwB;AAGjE,yBAAe"}

package/dist/cjs/client/components/presentation/UserTypeSelect/UserTypeSelect.cjs

@@ -0,0 +1,25 @@
+'use client';
+
+
+const require_rolldown_runtime = require('../../../../_virtual/rolldown_runtime.cjs');
+const require_fetchUserTypesFromServer = require('../../../fetchUserTypesFromServer.cjs');
+let __thunderid_react = require("@thunderid/react");
+__thunderid_react = require_rolldown_runtime.__toESM(__thunderid_react);
+let react_jsx_runtime = require("react/jsx-runtime");
+react_jsx_runtime = require_rolldown_runtime.__toESM(react_jsx_runtime);
+
+//#region src/client/components/presentation/UserTypeSelect/UserTypeSelect.tsx
+/**
+* User-type picker for signed-in screens. User types load through a server action that uses the
+* signed-in user's server-held session, so the access token never reaches the browser. It takes no
+* data source; for a custom one use `Select` with `useInfiniteOptions`.
+*/
+const UserTypeSelect = (props) => /* @__PURE__ */ (0, react_jsx_runtime.jsx)(__thunderid_react.BaseUserTypeSelect, {
+	...props,
+	fetchUserTypes: require_fetchUserTypesFromServer.default
+});
+var UserTypeSelect_default = UserTypeSelect;
+
+//#endregion
+exports.default = UserTypeSelect_default;
+//# sourceMappingURL=UserTypeSelect.cjs.map

package/dist/cjs/client/components/presentation/UserTypeSelect/UserTypeSelect.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"UserTypeSelect.cjs","names":["UserTypeSelect: FC<UserTypeSelectProps>","BaseUserTypeSelect","fetchUserTypesFromServer"],"sources":["../../../../../../src/client/components/presentation/UserTypeSelect/UserTypeSelect.tsx"],"sourcesContent":["// Copyright 2026 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\n'use client';\n\nimport {BaseUserTypeSelect, BaseUserTypeSelectProps} from '@thunderid/react';\nimport {FC} from 'react';\nimport fetchUserTypesFromServer from '../../../fetchUserTypesFromServer';\n\nexport type UserTypeSelectProps = Omit<BaseUserTypeSelectProps, 'fetchUserTypes'>;\n\n/**\n * User-type picker for signed-in screens. User types load through a server action that uses the\n * signed-in user's server-held session, so the access token never reaches the browser. It takes no\n * data source; for a custom one use `Select` with `useInfiniteOptions`.\n */\nconst UserTypeSelect: FC<UserTypeSelectProps> = (props: UserTypeSelectProps) => (\n  <BaseUserTypeSelect {...props} fetchUserTypes={fetchUserTypesFromServer} />\n);\n\nexport default UserTypeSelect;\n"],"mappings":";;;;;;;;;;;;;;;;AAgBA,MAAMA,kBAA2C,UAC/C,2CAACC;CAAmB,GAAI;CAAO,gBAAgBC;EAA4B;AAG7E,6BAAe"}

package/dist/cjs/client/fetchAuthFlowsFromServer.cjs

@@ -0,0 +1,18 @@
+const require_loadPageFromAction = require('./loadPageFromAction.cjs');
+const require_getAuthFlowsAction = require('../server/actions/getAuthFlowsAction.cjs');
+
+//#region src/client/fetchAuthFlowsFromServer.ts
+/**
+* The loader behind `AuthFlowSelect`: loads authentication flows through {@link getAuthFlowsAction} with the
+* signed-in user's server-held session. Requires an existing session. `request.signal` is not forwarded because
+* an `AbortSignal` cannot cross the server action boundary.
+*/
+const fetchAuthFlowsFromServer = async ({ limit, offset }) => require_loadPageFromAction.default(await require_getAuthFlowsAction.default({
+	limit,
+	offset
+}), "getAuthFlowsAction-Error-001");
+var fetchAuthFlowsFromServer_default = fetchAuthFlowsFromServer;
+
+//#endregion
+exports.default = fetchAuthFlowsFromServer_default;
+//# sourceMappingURL=fetchAuthFlowsFromServer.cjs.map

package/dist/cjs/client/fetchAuthFlowsFromServer.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"fetchAuthFlowsFromServer.cjs","names":["fetchAuthFlowsFromServer: FetchAuthFlows","loadPageFromAction","getAuthFlowsAction"],"sources":["../../../src/client/fetchAuthFlowsFromServer.ts"],"sourcesContent":["// Copyright 2026 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\nimport type {FetchAuthFlows, SelectPage, SelectPageRequest} from '@thunderid/node';\nimport loadPageFromAction from './loadPageFromAction';\nimport getAuthFlowsAction from '../server/actions/getAuthFlowsAction';\n\n/**\n * The loader behind `AuthFlowSelect`: loads authentication flows through {@link getAuthFlowsAction} with the\n * signed-in user's server-held session. Requires an existing session. `request.signal` is not forwarded because\n * an `AbortSignal` cannot cross the server action boundary.\n */\nconst fetchAuthFlowsFromServer: FetchAuthFlows = async ({limit, offset}: SelectPageRequest): Promise<SelectPage> =>\n  loadPageFromAction(await getAuthFlowsAction({limit, offset}), 'getAuthFlowsAction-Error-001');\n\nexport default fetchAuthFlowsFromServer;\n"],"mappings":";;;;;;;;;AAYA,MAAMA,2BAA2C,OAAO,EAAC,OAAO,aAC9DC,mCAAmB,MAAMC,mCAAmB;CAAC;CAAO;CAAO,CAAC,EAAE,+BAA+B;AAE/F,uCAAe"}

package/dist/cjs/client/fetchUserTypesFromServer.cjs

@@ -0,0 +1,18 @@
+const require_loadPageFromAction = require('./loadPageFromAction.cjs');
+const require_getUserTypesAction = require('../server/actions/getUserTypesAction.cjs');
+
+//#region src/client/fetchUserTypesFromServer.ts
+/**
+* The loader behind `UserTypeSelect`: loads user types through {@link getUserTypesAction} with the signed-in
+* user's server-held session. Requires an existing session. `request.signal` is not forwarded because an
+* `AbortSignal` cannot cross the server action boundary.
+*/
+const fetchUserTypesFromServer = async ({ limit, offset }) => require_loadPageFromAction.default(await require_getUserTypesAction.default({
+	limit,
+	offset
+}), "getUserTypesAction-Error-001");
+var fetchUserTypesFromServer_default = fetchUserTypesFromServer;
+
+//#endregion
+exports.default = fetchUserTypesFromServer_default;
+//# sourceMappingURL=fetchUserTypesFromServer.cjs.map

package/dist/cjs/client/fetchUserTypesFromServer.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"fetchUserTypesFromServer.cjs","names":["fetchUserTypesFromServer: FetchUserTypes","loadPageFromAction","getUserTypesAction"],"sources":["../../../src/client/fetchUserTypesFromServer.ts"],"sourcesContent":["// Copyright 2026 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\nimport type {FetchUserTypes, SelectPage, SelectPageRequest} from '@thunderid/node';\nimport loadPageFromAction from './loadPageFromAction';\nimport getUserTypesAction from '../server/actions/getUserTypesAction';\n\n/**\n * The loader behind `UserTypeSelect`: loads user types through {@link getUserTypesAction} with the signed-in\n * user's server-held session. Requires an existing session. `request.signal` is not forwarded because an\n * `AbortSignal` cannot cross the server action boundary.\n */\nconst fetchUserTypesFromServer: FetchUserTypes = async ({limit, offset}: SelectPageRequest): Promise<SelectPage> =>\n  loadPageFromAction(await getUserTypesAction({limit, offset}), 'getUserTypesAction-Error-001');\n\nexport default fetchUserTypesFromServer;\n"],"mappings":";;;;;;;;;AAYA,MAAMA,2BAA2C,OAAO,EAAC,OAAO,aAC9DC,mCAAmB,MAAMC,mCAAmB;CAAC;CAAO;CAAO,CAAC,EAAE,+BAA+B;AAE/F,uCAAe"}

package/dist/cjs/client/fetchUsersFromServer.cjs

@@ -0,0 +1,18 @@
+const require_loadPageFromAction = require('./loadPageFromAction.cjs');
+const require_getUsersAction = require('../server/actions/getUsersAction.cjs');
+
+//#region src/client/fetchUsersFromServer.ts
+/**
+* The loader behind `UserSelect`: loads users through {@link getUsersAction} with the signed-in user's server-held session.
+* Requires an existing session. `request.signal` is not forwarded because an `AbortSignal` cannot cross the server action boundary.
+*/
+const fetchUsersFromServer = async ({ filter, limit, offset }) => require_loadPageFromAction.default(await require_getUsersAction.default({
+	filter,
+	limit,
+	offset
+}), "getUsersAction-Error-001");
+var fetchUsersFromServer_default = fetchUsersFromServer;
+
+//#endregion
+exports.default = fetchUsersFromServer_default;
+//# sourceMappingURL=fetchUsersFromServer.cjs.map

package/dist/cjs/client/fetchUsersFromServer.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"fetchUsersFromServer.cjs","names":["fetchUsersFromServer: FetchUsers","loadPageFromAction","getUsersAction"],"sources":["../../../src/client/fetchUsersFromServer.ts"],"sourcesContent":["// Copyright 2026 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\nimport type {FetchUsers, SelectPage, SelectPageRequest} from '@thunderid/node';\nimport loadPageFromAction from './loadPageFromAction';\nimport getUsersAction from '../server/actions/getUsersAction';\n\n/**\n * The loader behind `UserSelect`: loads users through {@link getUsersAction} with the signed-in user's server-held session.\n * Requires an existing session. `request.signal` is not forwarded because an `AbortSignal` cannot cross the server action boundary.\n */\nconst fetchUsersFromServer: FetchUsers = async ({filter, limit, offset}: SelectPageRequest): Promise<SelectPage> =>\n  loadPageFromAction(await getUsersAction({filter, limit, offset}), 'getUsersAction-Error-001');\n\nexport default fetchUsersFromServer;\n"],"mappings":";;;;;;;;AAWA,MAAMA,uBAAmC,OAAO,EAAC,QAAQ,OAAO,aAC9DC,mCAAmB,MAAMC,+BAAe;CAAC;CAAQ;CAAO;CAAO,CAAC,EAAE,2BAA2B;AAE/F,mCAAe"}

package/dist/cjs/client/index.cjs

@@ -11,3 +11,6 @@ const require_UserProfile = require('./components/presentation/UserProfile/UserP
 const require_UserDropdown = require('./components/presentation/UserDropdown/UserDropdown.cjs');
 const require_UserAvatar = require('./components/presentation/UserAvatar/UserAvatar.cjs');
 const require_ChangeCredential = require('./components/presentation/ChangeCredential/ChangeCredential.cjs');
+const require_UserSelect = require('./components/presentation/UserSelect/UserSelect.cjs');
+const require_AuthFlowSelect = require('./components/presentation/AuthFlowSelect/AuthFlowSelect.cjs');
+const require_UserTypeSelect = require('./components/presentation/UserTypeSelect/UserTypeSelect.cjs');

package/dist/cjs/client/loadPageFromAction.cjs

@@ -0,0 +1,19 @@
+const require_rolldown_runtime = require('../_virtual/rolldown_runtime.cjs');
+let __thunderid_node = require("@thunderid/node");
+__thunderid_node = require_rolldown_runtime.__toESM(__thunderid_node);
+
+//#region src/client/loadPageFromAction.ts
+/**
+* Turns a select page server action result into a loader page, or throws the failure it carries. The message was built
+* on the server from fixed words and the status, so it is safe to show to a developer.
+*/
+const loadPageFromAction = (result, errorCode) => {
+	if (result.success) return result.page;
+	if (result.statusCode !== void 0) throw new __thunderid_node.ThunderIDAPIError(result.message, errorCode, "nextjs", result.statusCode);
+	throw new __thunderid_node.ThunderIDRuntimeError(result.message, errorCode, "nextjs");
+};
+var loadPageFromAction_default = loadPageFromAction;
+
+//#endregion
+exports.default = loadPageFromAction_default;
+//# sourceMappingURL=loadPageFromAction.cjs.map

package/dist/cjs/client/loadPageFromAction.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"loadPageFromAction.cjs","names":["ThunderIDAPIError","ThunderIDRuntimeError"],"sources":["../../../src/client/loadPageFromAction.ts"],"sourcesContent":["// Copyright 2026 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\nimport {ThunderIDAPIError, ThunderIDRuntimeError} from '@thunderid/node';\nimport type {SelectPage} from '@thunderid/node';\nimport type {SelectPageActionResult} from '../server/actions/runSelectPageAction';\n\n/**\n * Turns a select page server action result into a loader page, or throws the failure it carries. The message was built\n * on the server from fixed words and the status, so it is safe to show to a developer.\n */\nconst loadPageFromAction = (result: SelectPageActionResult, errorCode: string): SelectPage => {\n  if (result.success) {\n    return result.page;\n  }\n\n  if (result.statusCode !== undefined) {\n    throw new ThunderIDAPIError(result.message, errorCode, 'nextjs', result.statusCode);\n  }\n\n  throw new ThunderIDRuntimeError(result.message, errorCode, 'nextjs');\n};\n\nexport default loadPageFromAction;\n"],"mappings":";;;;;;;;;AAWA,MAAM,sBAAsB,QAAgC,cAAkC;AAC5F,KAAI,OAAO,QACT,QAAO,OAAO;AAGhB,KAAI,OAAO,eAAe,OACxB,OAAM,IAAIA,mCAAkB,OAAO,SAAS,WAAW,UAAU,OAAO,WAAW;AAGrF,OAAM,IAAIC,uCAAsB,OAAO,SAAS,WAAW,SAAS;;AAGtE,iCAAe"}

package/dist/cjs/index.cjs

@@ -18,8 +18,12 @@ const require_UserProfile = require('./client/components/presentation/UserProfil
 const require_UserDropdown = require('./client/components/presentation/UserDropdown/UserDropdown.cjs');
 const require_UserAvatar = require('./client/components/presentation/UserAvatar/UserAvatar.cjs');
 const require_ChangeCredential = require('./client/components/presentation/ChangeCredential/ChangeCredential.cjs');
+const require_UserSelect = require('./client/components/presentation/UserSelect/UserSelect.cjs');
+const require_AuthFlowSelect = require('./client/components/presentation/AuthFlowSelect/AuthFlowSelect.cjs');
+const require_UserTypeSelect = require('./client/components/presentation/UserTypeSelect/UserTypeSelect.cjs');
 require('./client/index.cjs');
 
+exports.AuthFlowSelect = require_AuthFlowSelect.default;
 exports.ChangeCredential = require_ChangeCredential.default;
 exports.SignIn = require_SignIn.default;
 exports.SignInButton = require_SignInButton.default;
@@ -34,6 +38,8 @@ exports.User = require_User.default;
 exports.UserAvatar = require_UserAvatar.default;
 exports.UserDropdown = require_UserDropdown.default;
 exports.UserProfile = require_UserProfile.default;
+exports.UserSelect = require_UserSelect.default;
+exports.UserTypeSelect = require_UserTypeSelect.default;
 exports.backchannelLogout = require_backchannelLogout.default;
 exports.createRouteMatcher = require_createRouteMatcher.default;
 exports.removeChunkedCookieFromHeader = require_thunderIDProxy.removeChunkedCookieFromHeader;

package/dist/cjs/server/actions/getAuthFlowsAction.cjs

@@ -0,0 +1,28 @@
+'use server';
+
+
+const require_rolldown_runtime = require('../../_virtual/rolldown_runtime.cjs');
+const require_runSelectPageAction = require('./runSelectPageAction.cjs');
+let __thunderid_node = require("@thunderid/node");
+__thunderid_node = require_rolldown_runtime.__toESM(__thunderid_node);
+
+//#region src/server/actions/getAuthFlowsAction.ts
+/**
+* Loads one page of authentication flows for an `AUTH_FLOW_SELECT` picker using the signed-in user's
+* server-held session.
+*
+* Never throws across the server action boundary; failures are mapped to a plain result.
+*/
+const getAuthFlowsAction = async ({ limit, offset } = {}) => require_runSelectPageAction.default("auth flows", {
+	limit,
+	offset
+}, async (client, sessionId, query) => (0, __thunderid_node.toAuthFlowSelectPage)(await client.getFlows({
+	flowType: __thunderid_node.AuthFlowSelectConstants.FLOW_TYPE,
+	limit: (0, __thunderid_node.capPageSize)(query.limit),
+	offset: query.offset
+}, sessionId), query.offset ?? 0));
+var getAuthFlowsAction_default = getAuthFlowsAction;
+
+//#endregion
+exports.default = getAuthFlowsAction_default;
+//# sourceMappingURL=getAuthFlowsAction.cjs.map

package/dist/cjs/server/actions/getAuthFlowsAction.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"getAuthFlowsAction.cjs","names":["runSelectPageAction","AuthFlowSelectConstants"],"sources":["../../../../src/server/actions/getAuthFlowsAction.ts"],"sourcesContent":["// Copyright 2026 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\n'use server';\n\nimport {AuthFlowSelectConstants, capPageSize, toAuthFlowSelectPage} from '@thunderid/node';\nimport runSelectPageAction, {SelectPageActionResult} from './runSelectPageAction';\n\n/**\n * Request from the browser. Carries only paging; the session comes from the request cookie and the flow\n * type is fixed to authentication on the server.\n */\nexport interface GetAuthFlowsActionRequest {\n  limit?: number;\n  offset?: number;\n}\n\nexport type GetAuthFlowsActionResult = SelectPageActionResult;\n\n/**\n * Loads one page of authentication flows for an `AUTH_FLOW_SELECT` picker using the signed-in user's\n * server-held session.\n *\n * Never throws across the server action boundary; failures are mapped to a plain result.\n */\nconst getAuthFlowsAction = async ({limit, offset}: GetAuthFlowsActionRequest = {}): Promise<GetAuthFlowsActionResult> =>\n  runSelectPageAction('auth flows', {limit, offset}, async (client, sessionId, query) =>\n    toAuthFlowSelectPage(\n      await client.getFlows(\n        {flowType: AuthFlowSelectConstants.FLOW_TYPE, limit: capPageSize(query.limit), offset: query.offset},\n        sessionId,\n      ),\n      query.offset ?? 0,\n    ),\n  );\n\nexport default getAuthFlowsAction;\n"],"mappings":";;;;;;;;;;;;;;;AAyBA,MAAM,qBAAqB,OAAO,EAAC,OAAO,WAAqC,EAAE,KAC/EA,oCAAoB,cAAc;CAAC;CAAO;CAAO,EAAE,OAAO,QAAQ,WAAW,qDAEzE,MAAM,OAAO,SACX;CAAC,UAAUC,yCAAwB;CAAW,yCAAmB,MAAM,MAAM;CAAE,QAAQ,MAAM;CAAO,EACpG,UACD,EACD,MAAM,UAAU,EACjB,CACF;AAEH,iCAAe"}

package/dist/cjs/server/actions/getUserTypesAction.cjs

@@ -0,0 +1,27 @@
+'use server';
+
+
+const require_rolldown_runtime = require('../../_virtual/rolldown_runtime.cjs');
+const require_runSelectPageAction = require('./runSelectPageAction.cjs');
+let __thunderid_node = require("@thunderid/node");
+__thunderid_node = require_rolldown_runtime.__toESM(__thunderid_node);
+
+//#region src/server/actions/getUserTypesAction.ts
+/**
+* Loads one page of user types for a `USER_TYPE_SELECT` picker using the signed-in user's server-held
+* session.
+*
+* Never throws across the server action boundary; failures are mapped to a plain result.
+*/
+const getUserTypesAction = async ({ limit, offset } = {}) => require_runSelectPageAction.default("user types", {
+	limit,
+	offset
+}, async (client, sessionId, query) => (0, __thunderid_node.toUserTypeSelectPage)(await client.getUserTypes({
+	limit: (0, __thunderid_node.capPageSize)(query.limit),
+	offset: query.offset
+}, sessionId), query.offset ?? 0));
+var getUserTypesAction_default = getUserTypesAction;
+
+//#endregion
+exports.default = getUserTypesAction_default;
+//# sourceMappingURL=getUserTypesAction.cjs.map