@thunderid/nextjs 1.2.3 → 1.3.1

package/dist/cjs/server/actions/runSelectPageAction.cjs

@@ -0,0 +1,47 @@
+const require_rolldown_runtime = require('../../_virtual/rolldown_runtime.cjs');
+const require_getSessionId = require('./getSessionId.cjs');
+const require_getClient = require('../getClient.cjs');
+let __thunderid_node = require("@thunderid/node");
+__thunderid_node = require_rolldown_runtime.__toESM(__thunderid_node);
+
+//#region src/server/actions/runSelectPageAction.ts
+/**
+* Runs one select page load with the signed-in user's server-held session. The session comes from the
+* request cookie, never from the caller. A server action is a public endpoint, so the paging values the caller
+* sends are checked here and not trusted from their TypeScript types. A missing session, a malformed request or any
+* failure becomes a plain result.
+*/
+const runSelectPageAction = async (resource, rawQuery, load, { allowFilter = false } = {}) => {
+	const sessionId = await require_getSessionId.default();
+	if (!sessionId) return {
+		message: `Failed to load ${resource} (HTTP 401).`,
+		statusCode: 401,
+		success: false
+	};
+	const checked = (0, __thunderid_node.parseSelectPageQuery)(rawQuery ?? {}, { allowFilter });
+	if (checked.invalid !== void 0) return {
+		message: `Failed to load ${resource} (HTTP 400).`,
+		statusCode: 400,
+		success: false
+	};
+	const { query } = checked;
+	try {
+		return {
+			page: await (0, __thunderid_node.loadPageWithRetryAndLog)(resource, {
+				limit: query.limit,
+				offset: query.offset
+			}, () => load(require_getClient.default(), sessionId, query)),
+			success: true
+		};
+	} catch (error) {
+		return {
+			...(0, __thunderid_node.mapSelectPageError)(error, resource),
+			success: false
+		};
+	}
+};
+var runSelectPageAction_default = runSelectPageAction;
+
+//#endregion
+exports.default = runSelectPageAction_default;
+//# sourceMappingURL=runSelectPageAction.cjs.map

package/dist/cjs/server/actions/runSelectPageAction.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"runSelectPageAction.cjs","names":["sessionId: string | undefined","getSessionId","checked: SelectPageQueryResult","getClient"],"sources":["../../../../src/server/actions/runSelectPageAction.ts"],"sourcesContent":["// Copyright 2026 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\nimport {loadPageWithRetryAndLog, mapSelectPageError, parseSelectPageQuery} from '@thunderid/node';\nimport type {SelectPageErrorResult, SelectPage, SelectPageQuery, SelectPageQueryResult} from '@thunderid/node';\nimport getSessionId from './getSessionId';\nimport type ThunderIDNextClient from '../../ThunderIDNextClient';\nimport getClient from '../getClient';\n\n/**\n * What a select page server action returns: the normalized page, or a plain failure. It never\n * throws, because a thrown class instance loses its prototype chain crossing the server action boundary. A failure\n * carries a message built on the server and the status, never the text of the upstream reply.\n */\nexport type SelectPageActionResult = {page: SelectPage; success: true} | ({success: false} & SelectPageErrorResult);\n\n/**\n * Runs one select page load with the signed-in user's server-held session. The session comes from the\n * request cookie, never from the caller. A server action is a public endpoint, so the paging values the caller\n * sends are checked here and not trusted from their TypeScript types. A missing session, a malformed request or any\n * failure becomes a plain result.\n */\nconst runSelectPageAction = async (\n  resource: string,\n  rawQuery: {filter?: unknown; limit?: unknown; offset?: unknown},\n  load: (client: ThunderIDNextClient, sessionId: string, query: SelectPageQuery) => Promise<SelectPage>,\n  {allowFilter = false}: {allowFilter?: boolean} = {},\n): Promise<SelectPageActionResult> => {\n  const sessionId: string | undefined = await getSessionId();\n\n  if (!sessionId) {\n    return {message: `Failed to load ${resource} (HTTP 401).`, statusCode: 401, success: false};\n  }\n\n  const checked: SelectPageQueryResult = parseSelectPageQuery(rawQuery ?? {}, {allowFilter});\n\n  if (checked.invalid !== undefined) {\n    return {message: `Failed to load ${resource} (HTTP 400).`, statusCode: 400, success: false};\n  }\n\n  const {query} = checked;\n\n  try {\n    // The retry and the failure log live here, where the real error and its status still exist. The plain result\n    // sent to the browser carries only a message built here and the status.\n    const page: SelectPage = await loadPageWithRetryAndLog(resource, {limit: query.limit, offset: query.offset}, () =>\n      load(getClient(), sessionId, query),\n    );\n\n    return {page, success: true};\n  } catch (error) {\n    return {...mapSelectPageError(error, resource), success: false};\n  }\n};\n\nexport default runSelectPageAction;\n"],"mappings":";;;;;;;;;;;;;AAsBA,MAAM,sBAAsB,OAC1B,UACA,UACA,MACA,EAAC,cAAc,UAAkC,EAAE,KACf;CACpC,MAAMA,YAAgC,MAAMC,8BAAc;AAE1D,KAAI,CAAC,UACH,QAAO;EAAC,SAAS,kBAAkB,SAAS;EAAe,YAAY;EAAK,SAAS;EAAM;CAG7F,MAAMC,qDAAsD,YAAY,EAAE,EAAE,EAAC,aAAY,CAAC;AAE1F,KAAI,QAAQ,YAAY,OACtB,QAAO;EAAC,SAAS,kBAAkB,SAAS;EAAe,YAAY;EAAK,SAAS;EAAM;CAG7F,MAAM,EAAC,UAAS;AAEhB,KAAI;AAOF,SAAO;GAAC,MAJiB,oDAA8B,UAAU;IAAC,OAAO,MAAM;IAAO,QAAQ,MAAM;IAAO,QACzG,KAAKC,2BAAW,EAAE,WAAW,MAAM,CACpC;GAEa,SAAS;GAAK;UACrB,OAAO;AACd,SAAO;GAAC,4CAAsB,OAAO,SAAS;GAAE,SAAS;GAAM;;;AAInE,kCAAe"}

package/dist/cjs/server/proxy/createRouteMatcher.cjs

@@ -19,11 +19,28 @@
 * }
 * ```
 */
+/**
+* Converts one route pattern to a regular expression source. A parenthesized group such as `(.*)` is kept as
+* regex, so `/dashboard(.*)` matches `/dashboard` and everything under it. Outside a group a `.` is a literal dot
+* and a `*` matches any run of characters.
+*/
+const toRegexSource = (pattern) => {
+	let source = "";
+	let depth = 0;
+	for (const char of pattern) if (char === "(") {
+		depth += 1;
+		source += char;
+	} else if (char === ")") {
+		depth = Math.max(depth - 1, 0);
+		source += char;
+	} else if (depth > 0) source += char;
+	else if (char === ".") source += "\\.";
+	else if (char === "*") source += ".*";
+	else source += char;
+	return source;
+};
 const createRouteMatcher = (patterns) => {
-	const regexPatterns = patterns.map((pattern) => {
-		const regexPattern = pattern.replace(/\./g, "\\.").replace(/\*/g, ".*").replace(/\(\.\*\)/g, "(.*)");
-		return /* @__PURE__ */ new RegExp(`^${regexPattern}$`);
-	});
+	const regexPatterns = patterns.map((pattern) => /* @__PURE__ */ new RegExp(`^${toRegexSource(pattern)}$`));
 	return (req) => {
 		const { pathname } = req.nextUrl;
 		return regexPatterns.some((regex) => regex.test(pathname));

package/dist/cjs/server/proxy/createRouteMatcher.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"createRouteMatcher.cjs","names":["regexPatterns: RegExp[]","regexPattern: string"],"sources":["../../../../src/server/proxy/createRouteMatcher.ts"],"sourcesContent":["// Copyright 2025 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\nimport {NextRequest} from 'next/server';\n\n/**\n * Creates a route matcher function that tests if a request matches any of the given patterns.\n *\n * @param patterns - Array of route patterns to match. Supports glob-like patterns.\n * @returns Function that tests if a request matches any of the patterns\n *\n * @example\n * ```typescript\n * const isProtectedRoute = createRouteMatcher([\n *   '/dashboard(.*)',\n *   '/admin(.*)',\n *   '/profile'\n * ]);\n *\n * if (isProtectedRoute(req)) {\n *   // Route is protected\n * }\n * ```\n */\nconst createRouteMatcher = (patterns: string[]): ((req: NextRequest) => boolean) => {\n  const regexPatterns: RegExp[] = patterns.map((pattern: string): RegExp => {\n    // Convert glob-like patterns to regex\n    const regexPattern: string = pattern\n      .replace(/\\./g, '\\\\.') // Escape dots\n      .replace(/\\*/g, '.*') // Convert * to .*\n      .replace(/\\(\\.\\*\\)/g, '(.*)'); // Handle explicit (.*) patterns\n\n    return new RegExp(`^${regexPattern}$`);\n  });\n\n  return (req: NextRequest): boolean => {\n    const {pathname} = req.nextUrl;\n    return regexPatterns.some((regex: RegExp): boolean => regex.test(pathname));\n  };\n};\n\nexport default createRouteMatcher;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;AAwBA,MAAM,sBAAsB,aAAwD;CAClF,MAAMA,gBAA0B,SAAS,KAAK,YAA4B;EAExE,MAAMC,eAAuB,QAC1B,QAAQ,OAAO,MAAM,CACrB,QAAQ,OAAO,KAAK,CACpB,QAAQ,aAAa,OAAO;AAE/B,yBAAO,IAAI,OAAO,IAAI,aAAa,GAAG;GACtC;AAEF,SAAQ,QAA8B;EACpC,MAAM,EAAC,aAAY,IAAI;AACvB,SAAO,cAAc,MAAM,UAA2B,MAAM,KAAK,SAAS,CAAC;;;AAI/E,iCAAe"}
+{"version":3,"file":"createRouteMatcher.cjs","names":["regexPatterns: RegExp[]"],"sources":["../../../../src/server/proxy/createRouteMatcher.ts"],"sourcesContent":["// Copyright 2025 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\nimport {NextRequest} from 'next/server';\n\n/**\n * Creates a route matcher function that tests if a request matches any of the given patterns.\n *\n * @param patterns - Array of route patterns to match. Supports glob-like patterns.\n * @returns Function that tests if a request matches any of the patterns\n *\n * @example\n * ```typescript\n * const isProtectedRoute = createRouteMatcher([\n *   '/dashboard(.*)',\n *   '/admin(.*)',\n *   '/profile'\n * ]);\n *\n * if (isProtectedRoute(req)) {\n *   // Route is protected\n * }\n * ```\n */\n/**\n * Converts one route pattern to a regular expression source. A parenthesized group such as `(.*)` is kept as\n * regex, so `/dashboard(.*)` matches `/dashboard` and everything under it. Outside a group a `.` is a literal dot\n * and a `*` matches any run of characters.\n */\nconst toRegexSource = (pattern: string): string => {\n  let source = '';\n  let depth = 0;\n\n  for (const char of pattern) {\n    if (char === '(') {\n      depth += 1;\n      source += char;\n    } else if (char === ')') {\n      depth = Math.max(depth - 1, 0);\n      source += char;\n    } else if (depth > 0) {\n      source += char;\n    } else if (char === '.') {\n      source += '\\\\.';\n    } else if (char === '*') {\n      source += '.*';\n    } else {\n      source += char;\n    }\n  }\n\n  return source;\n};\n\nconst createRouteMatcher = (patterns: string[]): ((req: NextRequest) => boolean) => {\n  const regexPatterns: RegExp[] = patterns.map((pattern: string): RegExp => new RegExp(`^${toRegexSource(pattern)}$`));\n\n  return (req: NextRequest): boolean => {\n    const {pathname} = req.nextUrl;\n    return regexPatterns.some((regex: RegExp): boolean => regex.test(pathname));\n  };\n};\n\nexport default createRouteMatcher;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AA6BA,MAAM,iBAAiB,YAA4B;CACjD,IAAI,SAAS;CACb,IAAI,QAAQ;AAEZ,MAAK,MAAM,QAAQ,QACjB,KAAI,SAAS,KAAK;AAChB,WAAS;AACT,YAAU;YACD,SAAS,KAAK;AACvB,UAAQ,KAAK,IAAI,QAAQ,GAAG,EAAE;AAC9B,YAAU;YACD,QAAQ,EACjB,WAAU;UACD,SAAS,IAClB,WAAU;UACD,SAAS,IAClB,WAAU;KAEV,WAAU;AAId,QAAO;;AAGT,MAAM,sBAAsB,aAAwD;CAClF,MAAMA,gBAA0B,SAAS,KAAK,4BAA4B,IAAI,OAAO,IAAI,cAAc,QAAQ,CAAC,GAAG,CAAC;AAEpH,SAAQ,QAA8B;EACpC,MAAM,EAAC,aAAY,IAAI;AACvB,SAAO,cAAc,MAAM,UAA2B,MAAM,KAAK,SAAS,CAAC;;;AAI/E,iCAAe"}

package/dist/cjs/utils/SessionManager.cjs

@@ -3,8 +3,12 @@ const require_loggedOutSessions = require('./loggedOutSessions.cjs');
 const require_sessionConstants = require('../constants/sessionConstants.cjs');
 let __thunderid_node = require("@thunderid/node");
 __thunderid_node = require_rolldown_runtime.__toESM(__thunderid_node);
-let jose = require("jose");
-jose = require_rolldown_runtime.__toESM(jose);
+let jose_jws_compact_verify = require("jose/jws/compact/verify");
+jose_jws_compact_verify = require_rolldown_runtime.__toESM(jose_jws_compact_verify);
+let jose_jwt_sign = require("jose/jwt/sign");
+jose_jwt_sign = require_rolldown_runtime.__toESM(jose_jwt_sign);
+let jose_jwt_verify = require("jose/jwt/verify");
+jose_jwt_verify = require_rolldown_runtime.__toESM(jose_jwt_verify);
 
 //#region src/utils/SessionManager.ts
 /**
@@ -29,7 +33,7 @@ var SessionManager = class {
 	*/
 	static async createTempSession(sessionId) {
 		const secret = this.getSecret();
-		return await new jose.SignJWT({
+		return await new jose_jwt_sign.SignJWT({
 			sessionId,
 			type: "temp"
 		}).setProtectedHeader({ alg: "HS256" }).setIssuedAt().setExpirationTime("15m").sign(secret);
@@ -53,7 +57,7 @@ var SessionManager = class {
 	}
 	static async createSessionToken(accessToken, userId, sessionId, scopes, accessTokenTtlSeconds, refreshToken, organizationId, serverSession) {
 		const secret = this.getSecret();
-		return await new jose.SignJWT({
+		return await new jose_jwt_sign.SignJWT({
 			accessToken,
 			organizationId,
 			refreshToken,
@@ -69,7 +73,7 @@ var SessionManager = class {
 	*/
 	static async verifySessionToken(token) {
 		try {
-			const { payload } = await (0, jose.jwtVerify)(token, this.getSecret());
+			const { payload } = await (0, jose_jwt_verify.jwtVerify)(token, this.getSecret());
 			if (payload["type"] !== "session") throw new Error("Invalid token type");
 			await this.refuseLoggedOutSession(payload);
 			return payload;
@@ -90,7 +94,7 @@ var SessionManager = class {
 	*/
 	static async verifySessionTokenForRefresh(token) {
 		try {
-			const { payload: rawPayload } = await (0, jose.compactVerify)(token, this.getSecret());
+			const { payload: rawPayload } = await (0, jose_jws_compact_verify.compactVerify)(token, this.getSecret());
 			const payload = JSON.parse(new TextDecoder().decode(rawPayload));
 			if (payload.type !== "session") throw new Error("Invalid token type");
 			await this.refuseLoggedOutSession(payload);
@@ -104,7 +108,7 @@ var SessionManager = class {
 	*/
 	static async verifyTempSession(token) {
 		try {
-			const { payload } = await (0, jose.jwtVerify)(token, this.getSecret());
+			const { payload } = await (0, jose_jwt_verify.jwtVerify)(token, this.getSecret());
 			if (payload["type"] !== "temp") throw new Error("Invalid token type");
 			return { sessionId: payload["sessionId"] };
 		} catch (error) {

package/dist/cjs/utils/SessionManager.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"SessionManager.cjs","names":["secret: string | undefined","ThunderIDRuntimeError","secret: Uint8Array","SignJWT","envValue: string | undefined","parsed: number","DEFAULT_SESSION_COOKIE_EXPIRY_TIME","payload: SessionTokenPayload","getLoggedOutSessions","CookieConfig"],"sources":["../../../src/utils/SessionManager.ts"],"sourcesContent":["// Copyright 2025 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\nimport {ThunderIDRuntimeError, CookieConfig} from '@thunderid/node';\nimport {SignJWT, jwtVerify, compactVerify, JWTPayload} from 'jose';\nimport {getLoggedOutSessions} from './loggedOutSessions';\nimport {DEFAULT_SESSION_COOKIE_EXPIRY_TIME} from '../constants/sessionConstants';\n\n/**\n * Session token payload interface\n */\nexport interface SessionTokenPayload extends JWTPayload {\n  /** Expiration timestamp — doubles as the access token expiry (JWT exp == access token exp) */\n  exp: number;\n  /** Issued at timestamp */\n  iat: number;\n  /** Organization ID if applicable */\n  organizationId?: string;\n  /** The refresh token; empty string if not provided by the auth server */\n  refreshToken: string;\n  /** OAuth scopes */\n  scopes: string[];\n  /** Session ID */\n  sessionId: string;\n  /** The server session this session joined, from the `sid` of the ID token. */\n  sid?: string;\n  /** When the user signed in, in seconds. Kept across token refresh, unlike `iat`. */\n  signedInAt?: number;\n  /** User ID */\n  sub: string;\n  /** Token type discriminant — must be 'session' for access-session JWTs */\n  type: 'session';\n}\n\n/**\n * Session management utility class for JWT-based session cookies\n */\nclass SessionManager {\n  /**\n   * Get the signing secret from environment variable\n   * Throws error in production if not set\n   */\n  private static getSecret(): Uint8Array {\n    const secret: string | undefined = process.env['THUNDERID_SECRET'];\n\n    if (!secret) {\n      if (process.env['NODE_ENV'] === 'production') {\n        throw new ThunderIDRuntimeError(\n          'THUNDERID_SECRET environment variable is required in production',\n          'session-secret-required',\n          'nextjs',\n          'Set the THUNDERID_SECRET environment variable with a secure random string',\n        );\n      }\n      // Use a default secret for development (not secure)\n      // eslint-disable-next-line no-console\n      console.warn('Using default secret for development. Set THUNDERID_SECRET for production!');\n      return new TextEncoder().encode('development-secret-not-for-production');\n    }\n\n    return new TextEncoder().encode(secret);\n  }\n\n  /**\n   * Create a temporary session cookie for login initiation\n   */\n  static async createTempSession(sessionId: string): Promise<string> {\n    const secret: Uint8Array = this.getSecret();\n\n    const jwt: string = await new SignJWT({\n      sessionId,\n      type: 'temp',\n    })\n      .setProtectedHeader({alg: 'HS256'})\n      .setIssuedAt()\n      .setExpirationTime('15m')\n      .sign(secret);\n\n    return jwt;\n  }\n\n  /**\n   * Resolve the session cookie expiry time in seconds.\n   *\n   * Resolution order (first defined value wins):\n   *   1. `configuredExpiry` — value from `ThunderIDNodeConfig.sessionCookie?.expiryTime`\n   *   2. `THUNDERID_SESSION_COOKIE_EXPIRY_TIME` environment variable\n   *   3. `DEFAULT_SESSION_COOKIE_EXPIRY_TIME` (24 hours)\n   */\n  static resolveSessionCookieExpiry(configuredExpiry?: number): number {\n    if (configuredExpiry != null && configuredExpiry > 0) {\n      return configuredExpiry;\n    }\n\n    const envValue: string | undefined = process.env['THUNDERID_SESSION_COOKIE_EXPIRY_TIME'];\n\n    if (envValue) {\n      const parsed: number = parseInt(envValue, 10);\n\n      if (!Number.isNaN(parsed) && parsed > 0) {\n        return parsed;\n      }\n    }\n\n    return DEFAULT_SESSION_COOKIE_EXPIRY_TIME;\n  }\n\n  static async createSessionToken(\n    accessToken: string,\n    userId: string,\n    sessionId: string,\n    scopes: string,\n    accessTokenTtlSeconds: number,\n    refreshToken: string,\n    organizationId?: string,\n    serverSession?: {sid?: string; signedInAt?: number},\n  ): Promise<string> {\n    const secret: Uint8Array = this.getSecret();\n\n    const jwt: string = await new SignJWT({\n      accessToken,\n      organizationId,\n      refreshToken,\n      scopes,\n      sessionId,\n      // What a back-channel logout matches this session by.\n      sid: serverSession?.sid,\n      signedInAt: serverSession?.signedInAt ?? Math.floor(Date.now() / 1000),\n      type: 'session',\n    } as Omit<SessionTokenPayload, 'sub' | 'iat' | 'exp'>)\n      .setProtectedHeader({alg: 'HS256'})\n      .setSubject(userId)\n      .setIssuedAt()\n      .setExpirationTime(Math.floor(Date.now() / 1000) + accessTokenTtlSeconds)\n      .sign(secret);\n\n    return jwt;\n  }\n\n  /**\n   * Verify and decode a session token\n   */\n  static async verifySessionToken(token: string): Promise<SessionTokenPayload> {\n    try {\n      const secret: Uint8Array = this.getSecret();\n      const {payload} = await jwtVerify(token, secret);\n\n      if (payload['type'] !== 'session') {\n        throw new Error('Invalid token type');\n      }\n\n      await this.refuseLoggedOutSession(payload as SessionTokenPayload);\n\n      return payload as SessionTokenPayload;\n    } catch (error) {\n      throw new ThunderIDRuntimeError(\n        `Invalid session token: ${error instanceof Error ? error.message : 'Unknown error'}`,\n        'invalid-session-token',\n        'nextjs',\n        'Session token verification failed',\n      );\n    }\n  }\n\n  /**\n   * Verify a session token for refresh. Validates the HMAC signature and the\n   * `type === 'session'` discriminant but intentionally skips the `exp` check\n   * so an expired access token can still be exchanged for a new one.\n   *\n   * Session lifetime is still bounded — the cookie's `maxAge` is set from\n   * `sessionCookieExpiryTime`, so the browser drops an over-age session regardless\n   * of the access-token exp embedded in the JWT.\n   *\n   * Never use the returned payload for authorization.\n   */\n  static async verifySessionTokenForRefresh(token: string): Promise<SessionTokenPayload> {\n    try {\n      const secret: Uint8Array = this.getSecret();\n      const {payload: rawPayload} = await compactVerify(token, secret);\n      const payload: SessionTokenPayload = JSON.parse(new TextDecoder().decode(rawPayload)) as SessionTokenPayload;\n\n      if (payload.type !== 'session') {\n        throw new Error('Invalid token type');\n      }\n\n      await this.refuseLoggedOutSession(payload);\n\n      return payload;\n    } catch (error) {\n      throw new ThunderIDRuntimeError(\n        `Invalid session token: ${error instanceof Error ? error.message : 'Unknown error'}`,\n        'invalid-session-token-for-refresh',\n        'nextjs',\n        'Session token signature or type check failed during refresh',\n      );\n    }\n  }\n\n  /**\n   * Verify and decode a temporary session token\n   */\n  static async verifyTempSession(token: string): Promise<{sessionId: string}> {\n    try {\n      const secret: Uint8Array = this.getSecret();\n      const {payload} = await jwtVerify(token, secret);\n\n      if (payload['type'] !== 'temp') {\n        throw new Error('Invalid token type');\n      }\n\n      return {sessionId: payload['sessionId'] as string};\n    } catch (error) {\n      throw new ThunderIDRuntimeError(\n        `Invalid temporary session token: ${error instanceof Error ? error.message : 'Unknown error'}`,\n        'invalid-temp-session-token',\n        'nextjs',\n        'Temporary session token verification failed',\n      );\n    }\n  }\n\n  /**\n   * Get session cookie options\n   */\n  /**\n   * Throws when a back-channel logout has ended the session this cookie carries. The cookie is\n   * still correctly signed, so this is the only thing that stops it from being used.\n   */\n  private static async refuseLoggedOutSession(payload: SessionTokenPayload): Promise<void> {\n    const loggedOut: boolean = await getLoggedOutSessions().isLoggedOut({\n      sid: payload.sid,\n      startedAt: payload.signedInAt ?? payload.iat,\n      sub: payload.sub,\n    });\n\n    if (loggedOut) {\n      throw new Error('The session was ended by a back-channel logout');\n    }\n  }\n\n  static getSessionCookieOptions(maxAge: number): {\n    httpOnly: boolean;\n    maxAge: number;\n    path: string;\n    sameSite: 'lax';\n    secure: boolean;\n  } {\n    return {\n      httpOnly: true,\n      maxAge,\n      path: '/',\n      sameSite: 'lax' as const,\n      secure: process.env['NODE_ENV'] === 'production',\n    };\n  }\n\n  /**\n   * Get temporary session cookie options\n   */\n  static getTempSessionCookieOptions(): {\n    httpOnly: boolean;\n    maxAge: number;\n    path: string;\n    sameSite: 'lax';\n    secure: boolean;\n  } {\n    return {\n      httpOnly: true,\n      maxAge: 15 * 60,\n      path: '/',\n      sameSite: 'lax' as const,\n      secure: process.env['NODE_ENV'] === 'production',\n    };\n  }\n\n  /**\n   * Get session cookie name\n   */\n  static getSessionCookieName(): string {\n    return CookieConfig.getSessionCookieName();\n  }\n\n  /**\n   * Get temporary session cookie name\n   */\n  static getTempSessionCookieName(): string {\n    return CookieConfig.getTempSessionCookieName();\n  }\n}\n\nexport default SessionManager;\n"],"mappings":";;;;;;;;;;;;AAqCA,IAAM,iBAAN,MAAqB;;;;;CAKnB,OAAe,YAAwB;EACrC,MAAMA,SAA6B,QAAQ,IAAI;AAE/C,MAAI,CAAC,QAAQ;AACX,OAAI,QAAQ,IAAI,gBAAgB,aAC9B,OAAM,IAAIC,uCACR,mEACA,2BACA,UACA,4EACD;AAIH,WAAQ,KAAK,6EAA6E;AAC1F,UAAO,IAAI,aAAa,CAAC,OAAO,wCAAwC;;AAG1E,SAAO,IAAI,aAAa,CAAC,OAAO,OAAO;;;;;CAMzC,aAAa,kBAAkB,WAAoC;EACjE,MAAMC,SAAqB,KAAK,WAAW;AAW3C,SAToB,MAAM,IAAIC,aAAQ;GACpC;GACA,MAAM;GACP,CAAC,CACC,mBAAmB,EAAC,KAAK,SAAQ,CAAC,CAClC,aAAa,CACb,kBAAkB,MAAM,CACxB,KAAK,OAAO;;;;;;;;;;CAajB,OAAO,2BAA2B,kBAAmC;AACnE,MAAI,oBAAoB,QAAQ,mBAAmB,EACjD,QAAO;EAGT,MAAMC,WAA+B,QAAQ,IAAI;AAEjD,MAAI,UAAU;GACZ,MAAMC,SAAiB,SAAS,UAAU,GAAG;AAE7C,OAAI,CAAC,OAAO,MAAM,OAAO,IAAI,SAAS,EACpC,QAAO;;AAIX,SAAOC;;CAGT,aAAa,mBACX,aACA,QACA,WACA,QACA,uBACA,cACA,gBACA,eACiB;EACjB,MAAMJ,SAAqB,KAAK,WAAW;AAmB3C,SAjBoB,MAAM,IAAIC,aAAQ;GACpC;GACA;GACA;GACA;GACA;GAEA,KAAK,eAAe;GACpB,YAAY,eAAe,cAAc,KAAK,MAAM,KAAK,KAAK,GAAG,IAAK;GACtE,MAAM;GACP,CAAqD,CACnD,mBAAmB,EAAC,KAAK,SAAQ,CAAC,CAClC,WAAW,OAAO,CAClB,aAAa,CACb,kBAAkB,KAAK,MAAM,KAAK,KAAK,GAAG,IAAK,GAAG,sBAAsB,CACxE,KAAK,OAAO;;;;;CAQjB,aAAa,mBAAmB,OAA6C;AAC3E,MAAI;GAEF,MAAM,EAAC,YAAW,0BAAgB,OADP,KAAK,WAAW,CACK;AAEhD,OAAI,QAAQ,YAAY,UACtB,OAAM,IAAI,MAAM,qBAAqB;AAGvC,SAAM,KAAK,uBAAuB,QAA+B;AAEjE,UAAO;WACA,OAAO;AACd,SAAM,IAAIF,uCACR,0BAA0B,iBAAiB,QAAQ,MAAM,UAAU,mBACnE,yBACA,UACA,oCACD;;;;;;;;;;;;;;CAeL,aAAa,6BAA6B,OAA6C;AACrF,MAAI;GAEF,MAAM,EAAC,SAAS,eAAc,8BAAoB,OADvB,KAAK,WAAW,CACqB;GAChE,MAAMM,UAA+B,KAAK,MAAM,IAAI,aAAa,CAAC,OAAO,WAAW,CAAC;AAErF,OAAI,QAAQ,SAAS,UACnB,OAAM,IAAI,MAAM,qBAAqB;AAGvC,SAAM,KAAK,uBAAuB,QAAQ;AAE1C,UAAO;WACA,OAAO;AACd,SAAM,IAAIN,uCACR,0BAA0B,iBAAiB,QAAQ,MAAM,UAAU,mBACnE,qCACA,UACA,8DACD;;;;;;CAOL,aAAa,kBAAkB,OAA6C;AAC1E,MAAI;GAEF,MAAM,EAAC,YAAW,0BAAgB,OADP,KAAK,WAAW,CACK;AAEhD,OAAI,QAAQ,YAAY,OACtB,OAAM,IAAI,MAAM,qBAAqB;AAGvC,UAAO,EAAC,WAAW,QAAQ,cAAuB;WAC3C,OAAO;AACd,SAAM,IAAIA,uCACR,oCAAoC,iBAAiB,QAAQ,MAAM,UAAU,mBAC7E,8BACA,UACA,8CACD;;;;;;;;;;CAWL,aAAqB,uBAAuB,SAA6C;AAOvF,MAN2B,MAAMO,gDAAsB,CAAC,YAAY;GAClE,KAAK,QAAQ;GACb,WAAW,QAAQ,cAAc,QAAQ;GACzC,KAAK,QAAQ;GACd,CAAC,CAGA,OAAM,IAAI,MAAM,iDAAiD;;CAIrE,OAAO,wBAAwB,QAM7B;AACA,SAAO;GACL,UAAU;GACV;GACA,MAAM;GACN,UAAU;GACV,QAAQ,QAAQ,IAAI,gBAAgB;GACrC;;;;;CAMH,OAAO,8BAML;AACA,SAAO;GACL,UAAU;GACV,QAAQ;GACR,MAAM;GACN,UAAU;GACV,QAAQ,QAAQ,IAAI,gBAAgB;GACrC;;;;;CAMH,OAAO,uBAA+B;AACpC,SAAOC,8BAAa,sBAAsB;;;;;CAM5C,OAAO,2BAAmC;AACxC,SAAOA,8BAAa,0BAA0B;;;AAIlD,6BAAe"}
+{"version":3,"file":"SessionManager.cjs","names":["secret: string | undefined","ThunderIDRuntimeError","secret: Uint8Array","SignJWT","envValue: string | undefined","parsed: number","DEFAULT_SESSION_COOKIE_EXPIRY_TIME","payload: SessionTokenPayload","getLoggedOutSessions","CookieConfig"],"sources":["../../../src/utils/SessionManager.ts"],"sourcesContent":["// Copyright 2025 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\nimport {ThunderIDRuntimeError, CookieConfig} from '@thunderid/node';\nimport type {JWTPayload} from 'jose';\n// Subpath imports keep the proxy's bundle free of jose's JWE code, whose CompressionStream use the Edge runtime rejects.\nimport {compactVerify} from 'jose/jws/compact/verify';\nimport {SignJWT} from 'jose/jwt/sign';\nimport {jwtVerify} from 'jose/jwt/verify';\nimport {getLoggedOutSessions} from './loggedOutSessions';\nimport {DEFAULT_SESSION_COOKIE_EXPIRY_TIME} from '../constants/sessionConstants';\n\n/**\n * Session token payload interface\n */\nexport interface SessionTokenPayload extends JWTPayload {\n  /** Expiration timestamp — doubles as the access token expiry (JWT exp == access token exp) */\n  exp: number;\n  /** Issued at timestamp */\n  iat: number;\n  /** Organization ID if applicable */\n  organizationId?: string;\n  /** The refresh token; empty string if not provided by the auth server */\n  refreshToken: string;\n  /** OAuth scopes */\n  scopes: string[];\n  /** Session ID */\n  sessionId: string;\n  /** The server session this session joined, from the `sid` of the ID token. */\n  sid?: string;\n  /** When the user signed in, in seconds. Kept across token refresh, unlike `iat`. */\n  signedInAt?: number;\n  /** User ID */\n  sub: string;\n  /** Token type discriminant — must be 'session' for access-session JWTs */\n  type: 'session';\n}\n\n/**\n * Session management utility class for JWT-based session cookies\n */\nclass SessionManager {\n  /**\n   * Get the signing secret from environment variable\n   * Throws error in production if not set\n   */\n  private static getSecret(): Uint8Array {\n    const secret: string | undefined = process.env['THUNDERID_SECRET'];\n\n    if (!secret) {\n      if (process.env['NODE_ENV'] === 'production') {\n        throw new ThunderIDRuntimeError(\n          'THUNDERID_SECRET environment variable is required in production',\n          'session-secret-required',\n          'nextjs',\n          'Set the THUNDERID_SECRET environment variable with a secure random string',\n        );\n      }\n      // Use a default secret for development (not secure)\n      // eslint-disable-next-line no-console\n      console.warn('Using default secret for development. Set THUNDERID_SECRET for production!');\n      return new TextEncoder().encode('development-secret-not-for-production');\n    }\n\n    return new TextEncoder().encode(secret);\n  }\n\n  /**\n   * Create a temporary session cookie for login initiation\n   */\n  static async createTempSession(sessionId: string): Promise<string> {\n    const secret: Uint8Array = this.getSecret();\n\n    const jwt: string = await new SignJWT({\n      sessionId,\n      type: 'temp',\n    })\n      .setProtectedHeader({alg: 'HS256'})\n      .setIssuedAt()\n      .setExpirationTime('15m')\n      .sign(secret);\n\n    return jwt;\n  }\n\n  /**\n   * Resolve the session cookie expiry time in seconds.\n   *\n   * Resolution order (first defined value wins):\n   *   1. `configuredExpiry` — value from `ThunderIDNodeConfig.sessionCookie?.expiryTime`\n   *   2. `THUNDERID_SESSION_COOKIE_EXPIRY_TIME` environment variable\n   *   3. `DEFAULT_SESSION_COOKIE_EXPIRY_TIME` (24 hours)\n   */\n  static resolveSessionCookieExpiry(configuredExpiry?: number): number {\n    if (configuredExpiry != null && configuredExpiry > 0) {\n      return configuredExpiry;\n    }\n\n    const envValue: string | undefined = process.env['THUNDERID_SESSION_COOKIE_EXPIRY_TIME'];\n\n    if (envValue) {\n      const parsed: number = parseInt(envValue, 10);\n\n      if (!Number.isNaN(parsed) && parsed > 0) {\n        return parsed;\n      }\n    }\n\n    return DEFAULT_SESSION_COOKIE_EXPIRY_TIME;\n  }\n\n  static async createSessionToken(\n    accessToken: string,\n    userId: string,\n    sessionId: string,\n    scopes: string,\n    accessTokenTtlSeconds: number,\n    refreshToken: string,\n    organizationId?: string,\n    serverSession?: {sid?: string; signedInAt?: number},\n  ): Promise<string> {\n    const secret: Uint8Array = this.getSecret();\n\n    const jwt: string = await new SignJWT({\n      accessToken,\n      organizationId,\n      refreshToken,\n      scopes,\n      sessionId,\n      // What a back-channel logout matches this session by.\n      sid: serverSession?.sid,\n      signedInAt: serverSession?.signedInAt ?? Math.floor(Date.now() / 1000),\n      type: 'session',\n    } as Omit<SessionTokenPayload, 'sub' | 'iat' | 'exp'>)\n      .setProtectedHeader({alg: 'HS256'})\n      .setSubject(userId)\n      .setIssuedAt()\n      .setExpirationTime(Math.floor(Date.now() / 1000) + accessTokenTtlSeconds)\n      .sign(secret);\n\n    return jwt;\n  }\n\n  /**\n   * Verify and decode a session token\n   */\n  static async verifySessionToken(token: string): Promise<SessionTokenPayload> {\n    try {\n      const secret: Uint8Array = this.getSecret();\n      const {payload} = await jwtVerify(token, secret);\n\n      if (payload['type'] !== 'session') {\n        throw new Error('Invalid token type');\n      }\n\n      await this.refuseLoggedOutSession(payload as SessionTokenPayload);\n\n      return payload as SessionTokenPayload;\n    } catch (error) {\n      throw new ThunderIDRuntimeError(\n        `Invalid session token: ${error instanceof Error ? error.message : 'Unknown error'}`,\n        'invalid-session-token',\n        'nextjs',\n        'Session token verification failed',\n      );\n    }\n  }\n\n  /**\n   * Verify a session token for refresh. Validates the HMAC signature and the\n   * `type === 'session'` discriminant but intentionally skips the `exp` check\n   * so an expired access token can still be exchanged for a new one.\n   *\n   * Session lifetime is still bounded — the cookie's `maxAge` is set from\n   * `sessionCookieExpiryTime`, so the browser drops an over-age session regardless\n   * of the access-token exp embedded in the JWT.\n   *\n   * Never use the returned payload for authorization.\n   */\n  static async verifySessionTokenForRefresh(token: string): Promise<SessionTokenPayload> {\n    try {\n      const secret: Uint8Array = this.getSecret();\n      const {payload: rawPayload} = await compactVerify(token, secret);\n      const payload: SessionTokenPayload = JSON.parse(new TextDecoder().decode(rawPayload)) as SessionTokenPayload;\n\n      if (payload.type !== 'session') {\n        throw new Error('Invalid token type');\n      }\n\n      await this.refuseLoggedOutSession(payload);\n\n      return payload;\n    } catch (error) {\n      throw new ThunderIDRuntimeError(\n        `Invalid session token: ${error instanceof Error ? error.message : 'Unknown error'}`,\n        'invalid-session-token-for-refresh',\n        'nextjs',\n        'Session token signature or type check failed during refresh',\n      );\n    }\n  }\n\n  /**\n   * Verify and decode a temporary session token\n   */\n  static async verifyTempSession(token: string): Promise<{sessionId: string}> {\n    try {\n      const secret: Uint8Array = this.getSecret();\n      const {payload} = await jwtVerify(token, secret);\n\n      if (payload['type'] !== 'temp') {\n        throw new Error('Invalid token type');\n      }\n\n      return {sessionId: payload['sessionId'] as string};\n    } catch (error) {\n      throw new ThunderIDRuntimeError(\n        `Invalid temporary session token: ${error instanceof Error ? error.message : 'Unknown error'}`,\n        'invalid-temp-session-token',\n        'nextjs',\n        'Temporary session token verification failed',\n      );\n    }\n  }\n\n  /**\n   * Get session cookie options\n   */\n  /**\n   * Throws when a back-channel logout has ended the session this cookie carries. The cookie is\n   * still correctly signed, so this is the only thing that stops it from being used.\n   */\n  private static async refuseLoggedOutSession(payload: SessionTokenPayload): Promise<void> {\n    const loggedOut: boolean = await getLoggedOutSessions().isLoggedOut({\n      sid: payload.sid,\n      startedAt: payload.signedInAt ?? payload.iat,\n      sub: payload.sub,\n    });\n\n    if (loggedOut) {\n      throw new Error('The session was ended by a back-channel logout');\n    }\n  }\n\n  static getSessionCookieOptions(maxAge: number): {\n    httpOnly: boolean;\n    maxAge: number;\n    path: string;\n    sameSite: 'lax';\n    secure: boolean;\n  } {\n    return {\n      httpOnly: true,\n      maxAge,\n      path: '/',\n      sameSite: 'lax' as const,\n      secure: process.env['NODE_ENV'] === 'production',\n    };\n  }\n\n  /**\n   * Get temporary session cookie options\n   */\n  static getTempSessionCookieOptions(): {\n    httpOnly: boolean;\n    maxAge: number;\n    path: string;\n    sameSite: 'lax';\n    secure: boolean;\n  } {\n    return {\n      httpOnly: true,\n      maxAge: 15 * 60,\n      path: '/',\n      sameSite: 'lax' as const,\n      secure: process.env['NODE_ENV'] === 'production',\n    };\n  }\n\n  /**\n   * Get session cookie name\n   */\n  static getSessionCookieName(): string {\n    return CookieConfig.getSessionCookieName();\n  }\n\n  /**\n   * Get temporary session cookie name\n   */\n  static getTempSessionCookieName(): string {\n    return CookieConfig.getTempSessionCookieName();\n  }\n}\n\nexport default SessionManager;\n"],"mappings":";;;;;;;;;;;;;;;;AAyCA,IAAM,iBAAN,MAAqB;;;;;CAKnB,OAAe,YAAwB;EACrC,MAAMA,SAA6B,QAAQ,IAAI;AAE/C,MAAI,CAAC,QAAQ;AACX,OAAI,QAAQ,IAAI,gBAAgB,aAC9B,OAAM,IAAIC,uCACR,mEACA,2BACA,UACA,4EACD;AAIH,WAAQ,KAAK,6EAA6E;AAC1F,UAAO,IAAI,aAAa,CAAC,OAAO,wCAAwC;;AAG1E,SAAO,IAAI,aAAa,CAAC,OAAO,OAAO;;;;;CAMzC,aAAa,kBAAkB,WAAoC;EACjE,MAAMC,SAAqB,KAAK,WAAW;AAW3C,SAToB,MAAM,IAAIC,sBAAQ;GACpC;GACA,MAAM;GACP,CAAC,CACC,mBAAmB,EAAC,KAAK,SAAQ,CAAC,CAClC,aAAa,CACb,kBAAkB,MAAM,CACxB,KAAK,OAAO;;;;;;;;;;CAajB,OAAO,2BAA2B,kBAAmC;AACnE,MAAI,oBAAoB,QAAQ,mBAAmB,EACjD,QAAO;EAGT,MAAMC,WAA+B,QAAQ,IAAI;AAEjD,MAAI,UAAU;GACZ,MAAMC,SAAiB,SAAS,UAAU,GAAG;AAE7C,OAAI,CAAC,OAAO,MAAM,OAAO,IAAI,SAAS,EACpC,QAAO;;AAIX,SAAOC;;CAGT,aAAa,mBACX,aACA,QACA,WACA,QACA,uBACA,cACA,gBACA,eACiB;EACjB,MAAMJ,SAAqB,KAAK,WAAW;AAmB3C,SAjBoB,MAAM,IAAIC,sBAAQ;GACpC;GACA;GACA;GACA;GACA;GAEA,KAAK,eAAe;GACpB,YAAY,eAAe,cAAc,KAAK,MAAM,KAAK,KAAK,GAAG,IAAK;GACtE,MAAM;GACP,CAAqD,CACnD,mBAAmB,EAAC,KAAK,SAAQ,CAAC,CAClC,WAAW,OAAO,CAClB,aAAa,CACb,kBAAkB,KAAK,MAAM,KAAK,KAAK,GAAG,IAAK,GAAG,sBAAsB,CACxE,KAAK,OAAO;;;;;CAQjB,aAAa,mBAAmB,OAA6C;AAC3E,MAAI;GAEF,MAAM,EAAC,YAAW,qCAAgB,OADP,KAAK,WAAW,CACK;AAEhD,OAAI,QAAQ,YAAY,UACtB,OAAM,IAAI,MAAM,qBAAqB;AAGvC,SAAM,KAAK,uBAAuB,QAA+B;AAEjE,UAAO;WACA,OAAO;AACd,SAAM,IAAIF,uCACR,0BAA0B,iBAAiB,QAAQ,MAAM,UAAU,mBACnE,yBACA,UACA,oCACD;;;;;;;;;;;;;;CAeL,aAAa,6BAA6B,OAA6C;AACrF,MAAI;GAEF,MAAM,EAAC,SAAS,eAAc,iDAAoB,OADvB,KAAK,WAAW,CACqB;GAChE,MAAMM,UAA+B,KAAK,MAAM,IAAI,aAAa,CAAC,OAAO,WAAW,CAAC;AAErF,OAAI,QAAQ,SAAS,UACnB,OAAM,IAAI,MAAM,qBAAqB;AAGvC,SAAM,KAAK,uBAAuB,QAAQ;AAE1C,UAAO;WACA,OAAO;AACd,SAAM,IAAIN,uCACR,0BAA0B,iBAAiB,QAAQ,MAAM,UAAU,mBACnE,qCACA,UACA,8DACD;;;;;;CAOL,aAAa,kBAAkB,OAA6C;AAC1E,MAAI;GAEF,MAAM,EAAC,YAAW,qCAAgB,OADP,KAAK,WAAW,CACK;AAEhD,OAAI,QAAQ,YAAY,OACtB,OAAM,IAAI,MAAM,qBAAqB;AAGvC,UAAO,EAAC,WAAW,QAAQ,cAAuB;WAC3C,OAAO;AACd,SAAM,IAAIA,uCACR,oCAAoC,iBAAiB,QAAQ,MAAM,UAAU,mBAC7E,8BACA,UACA,8CACD;;;;;;;;;;CAWL,aAAqB,uBAAuB,SAA6C;AAOvF,MAN2B,MAAMO,gDAAsB,CAAC,YAAY;GAClE,KAAK,QAAQ;GACb,WAAW,QAAQ,cAAc,QAAQ;GACzC,KAAK,QAAQ;GACd,CAAC,CAGA,OAAM,IAAI,MAAM,iDAAiD;;CAIrE,OAAO,wBAAwB,QAM7B;AACA,SAAO;GACL,UAAU;GACV;GACA,MAAM;GACN,UAAU;GACV,QAAQ,QAAQ,IAAI,gBAAgB;GACrC;;;;;CAMH,OAAO,8BAML;AACA,SAAO;GACL,UAAU;GACV,QAAQ;GACR,MAAM;GACN,UAAU;GACV,QAAQ,QAAQ,IAAI,gBAAgB;GACrC;;;;;CAMH,OAAO,uBAA+B;AACpC,SAAOC,8BAAa,sBAAsB;;;;;CAM5C,OAAO,2BAAmC;AACxC,SAAOA,8BAAa,0BAA0B;;;AAIlD,6BAAe"}

package/dist/client/components/presentation/AuthFlowSelect/AuthFlowSelect.d.ts

@@ -0,0 +1,11 @@
+import { BaseAuthFlowSelectProps } from '@thunderid/react';
+import { FC } from 'react';
+export type AuthFlowSelectProps = Omit<BaseAuthFlowSelectProps, 'fetchAuthFlows'>;
+/**
+ * Authentication-flow picker for signed-in screens. Flows load through a server action that uses the
+ * signed-in user's server-held session, so the access token never reaches the browser. It takes no
+ * data source; for a custom one use `Select` with `useInfiniteOptions`.
+ */
+declare const AuthFlowSelect: FC<AuthFlowSelectProps>;
+export default AuthFlowSelect;
+//# sourceMappingURL=AuthFlowSelect.d.ts.map

package/dist/client/components/presentation/AuthFlowSelect/AuthFlowSelect.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthFlowSelect.d.ts","sourceRoot":"","sources":["../../../../../src/client/components/presentation/AuthFlowSelect/AuthFlowSelect.tsx"],"names":[],"mappings":"AAKA,OAAO,EAAqB,uBAAuB,EAAC,MAAM,kBAAkB,CAAC;AAC7E,OAAO,EAAC,EAAE,EAAC,MAAM,OAAO,CAAC;AAGzB,MAAM,MAAM,mBAAmB,GAAG,IAAI,CAAC,uBAAuB,EAAE,gBAAgB,CAAC,CAAC;AAElF;;;;GAIG;AACH,QAAA,MAAM,cAAc,EAAE,EAAE,CAAC,mBAAmB,CAE3C,CAAC;AAEF,eAAe,cAAc,CAAC"}

package/dist/client/components/presentation/AuthFlowSelect/AuthFlowSelect.js

@@ -0,0 +1,22 @@
+'use client';
+
+
+import fetchAuthFlowsFromServer_default from "../../../fetchAuthFlowsFromServer.js";
+import { BaseAuthFlowSelect } from "@thunderid/react";
+import { jsx } from "react/jsx-runtime";
+
+//#region src/client/components/presentation/AuthFlowSelect/AuthFlowSelect.tsx
+/**
+* Authentication-flow picker for signed-in screens. Flows load through a server action that uses the
+* signed-in user's server-held session, so the access token never reaches the browser. It takes no
+* data source; for a custom one use `Select` with `useInfiniteOptions`.
+*/
+const AuthFlowSelect = (props) => /* @__PURE__ */ jsx(BaseAuthFlowSelect, {
+	...props,
+	fetchAuthFlows: fetchAuthFlowsFromServer_default
+});
+var AuthFlowSelect_default = AuthFlowSelect;
+
+//#endregion
+export { AuthFlowSelect_default as default };
+//# sourceMappingURL=AuthFlowSelect.js.map

package/dist/client/components/presentation/AuthFlowSelect/AuthFlowSelect.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthFlowSelect.js","names":["AuthFlowSelect: FC<AuthFlowSelectProps>","fetchAuthFlowsFromServer"],"sources":["../../../../../src/client/components/presentation/AuthFlowSelect/AuthFlowSelect.tsx"],"sourcesContent":["// Copyright 2026 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\n'use client';\n\nimport {BaseAuthFlowSelect, BaseAuthFlowSelectProps} from '@thunderid/react';\nimport {FC} from 'react';\nimport fetchAuthFlowsFromServer from '../../../fetchAuthFlowsFromServer';\n\nexport type AuthFlowSelectProps = Omit<BaseAuthFlowSelectProps, 'fetchAuthFlows'>;\n\n/**\n * Authentication-flow picker for signed-in screens. Flows load through a server action that uses the\n * signed-in user's server-held session, so the access token never reaches the browser. It takes no\n * data source; for a custom one use `Select` with `useInfiniteOptions`.\n */\nconst AuthFlowSelect: FC<AuthFlowSelectProps> = (props: AuthFlowSelectProps) => (\n  <BaseAuthFlowSelect {...props} fetchAuthFlows={fetchAuthFlowsFromServer} />\n);\n\nexport default AuthFlowSelect;\n"],"mappings":";;;;;;;;;;;;;AAgBA,MAAMA,kBAA2C,UAC/C,oBAAC;CAAmB,GAAI;CAAO,gBAAgBC;EAA4B;AAG7E,6BAAe"}

package/dist/client/components/presentation/SignIn/SignIn.d.ts

@@ -4,7 +4,7 @@ import { FC } from 'react';
  * Props for the SignIn component.
  * Extends BaseSignInProps for full compatibility with the React BaseSignIn component
  */
-export type SignInProps = Pick<BaseSignInProps, 'className' | 'id' | 'onSuccess' | 'onError' | 'variant' | 'size'>;
+export type SignInProps = Pick<BaseSignInProps, 'children' | 'className' | 'id' | 'onSuccess' | 'onError' | 'variant' | 'size'>;
 /**
  * A SignIn component for Next.js that provides native authentication flow.
  * This component delegates to the BaseSignIn from @thunderid/react. Unlike BaseSignUp,

package/dist/client/components/presentation/SignIn/SignIn.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"SignIn.d.ts","sourceRoot":"","sources":["../../../../../src/client/components/presentation/SignIn/SignIn.tsx"],"names":[],"mappings":"AAMA,OAAO,EAAa,eAAe,EAAwC,MAAM,kBAAkB,CAAC;AACpG,OAAO,EAAC,EAAE,EAA8B,MAAM,OAAO,CAAC;AAGtD;;;GAGG;AACH,MAAM,MAAM,WAAW,GAAG,IAAI,CAAC,eAAe,EAAE,WAAW,GAAG,IAAI,GAAG,WAAW,GAAG,SAAS,GAAG,SAAS,GAAG,MAAM,CAAC,CAAC;AAEnH;;;;;GAKG;AACH,QAAA,MAAM,MAAM,EAAE,EAAE,CAAC,WAAW,CAmG3B,CAAC;AAIF,eAAe,MAAM,CAAC"}
+{"version":3,"file":"SignIn.d.ts","sourceRoot":"","sources":["../../../../../src/client/components/presentation/SignIn/SignIn.tsx"],"names":[],"mappings":"AAMA,OAAO,EAAa,eAAe,EAAwC,MAAM,kBAAkB,CAAC;AACpG,OAAO,EAAC,EAAE,EAA8B,MAAM,OAAO,CAAC;AAGtD;;;GAGG;AACH,MAAM,MAAM,WAAW,GAAG,IAAI,CAC5B,eAAe,EACf,UAAU,GAAG,WAAW,GAAG,IAAI,GAAG,WAAW,GAAG,SAAS,GAAG,SAAS,GAAG,MAAM,CAC/E,CAAC;AAEF;;;;;GAKG;AACH,QAAA,MAAM,MAAM,EAAE,EAAE,CAAC,WAAW,CAmG3B,CAAC;AAIF,eAAe,MAAM,CAAC"}

package/dist/client/components/presentation/SignIn/SignIn.js.map

@@ -1 +1 @@
-{"version":3,"file":"SignIn.js","names":["SignIn: FC<SignInProps>","useThunderID","normalizedError: Error","response: any"],"sources":["../../../../../src/client/components/presentation/SignIn/SignIn.tsx"],"sourcesContent":["// Copyright 2025 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\n'use client';\n\nimport {EmbeddedFlowComponent, EmbeddedFlowType, ThunderIDRuntimeError} from '@thunderid/node';\nimport {BaseSignIn, BaseSignInProps, normalizeFlowResponse, useTranslation} from '@thunderid/react';\nimport {FC, useEffect, useRef, useState} from 'react';\nimport useThunderID from '../../../contexts/ThunderID/useThunderID';\n\n/**\n * Props for the SignIn component.\n * Extends BaseSignInProps for full compatibility with the React BaseSignIn component\n */\nexport type SignInProps = Pick<BaseSignInProps, 'className' | 'id' | 'onSuccess' | 'onError' | 'variant' | 'size'>;\n\n/**\n * A SignIn component for Next.js that provides native authentication flow.\n * This component delegates to the BaseSignIn from @thunderid/react. Unlike BaseSignUp,\n * BaseSignIn does not manage its own flow state, so this component initiates the flow\n * (using the server-action-backed `signIn`) and tracks `components`/`executionId` itself.\n */\nconst SignIn: FC<SignInProps> = ({size = 'medium', variant = 'outlined', onError, ...rest}: SignInProps) => {\n  const {signIn, applicationId, scopes} = useThunderID();\n  const {t} = useTranslation();\n\n  const [components, setComponents] = useState<EmbeddedFlowComponent[]>([]);\n  const [additionalData, setAdditionalData] = useState<Record<string, any>>({});\n  const [executionId, setExecutionId] = useState<string | undefined>(undefined);\n  const [isFlowInitialized, setIsFlowInitialized] = useState(false);\n  const [flowError, setFlowError] = useState<Error | null>(null);\n  const initializationAttemptedRef = useRef(false);\n  // A fresh challenge token is required on every step to prevent replay attacks; the server\n  // rotates it on each response, so it's tracked in a ref (not state) to avoid a stale value\n  // from a closure captured before the previous response's state update committed.\n  const challengeTokenRef = useRef<string | undefined>(undefined);\n\n  const applyFlowResponse = (response: any): void => {\n    const normalized = normalizeFlowResponse(response, t, {resolveTranslations: false});\n\n    challengeTokenRef.current = response?.challengeToken ?? undefined;\n    setExecutionId(normalized.executionId ?? undefined);\n    setComponents(normalized.components);\n    setAdditionalData(normalized.additionalData);\n  };\n\n  const handleFlowError = (error: unknown): void => {\n    const normalizedError: Error = error instanceof Error ? error : new Error(String(error));\n\n    setFlowError(normalizedError);\n    onError?.(normalizedError);\n  };\n\n  useEffect(() => {\n    if (initializationAttemptedRef.current || !signIn) {\n      return;\n    }\n\n    initializationAttemptedRef.current = true;\n\n    (async (): Promise<void> => {\n      try {\n        const response: any = await signIn(\n          {\n            applicationId,\n            flowType: EmbeddedFlowType.Authentication,\n            ...(scopes && {scopes}),\n          },\n          {},\n        );\n\n        // `response` is undefined when the provider already redirected\n        // (OAuth-redirect or completed flows are handled there directly).\n        if (response) {\n          applyFlowResponse(response);\n        }\n      } catch (error) {\n        handleFlowError(error);\n      } finally {\n        setIsFlowInitialized(true);\n      }\n    })();\n    // eslint-disable-next-line react-hooks/exhaustive-deps\n  }, [signIn]);\n\n  const handleOnSubmit = async (payload: any): Promise<void> => {\n    if (!signIn) {\n      throw new ThunderIDRuntimeError(\n        '`signIn` function is not available.',\n        'SignIn-handleOnSubmit-RuntimeError-001',\n        'nextjs',\n      );\n    }\n\n    const response: any = await signIn(\n      {\n        ...payload,\n        executionId,\n        ...(challengeTokenRef.current ? {challengeToken: challengeTokenRef.current} : {}),\n      },\n      {},\n    );\n\n    if (response) {\n      applyFlowResponse(response);\n    }\n  };\n\n  return (\n    <BaseSignIn\n      additionalData={additionalData}\n      components={components}\n      error={flowError}\n      isLoading={!isFlowInitialized}\n      onError={onError}\n      onSubmit={handleOnSubmit}\n      size={size}\n      variant={variant}\n      {...rest}\n    />\n  );\n};\n\nSignIn.displayName = 'SignIn';\n\nexport default SignIn;\n"],"mappings":";;;;;;;;;;;;;;;;AAsBA,MAAMA,UAA2B,EAAC,OAAO,UAAU,UAAU,YAAY,QAAS,GAAG,WAAuB;CAC1G,MAAM,EAAC,QAAQ,eAAe,WAAUC,sBAAc;CACtD,MAAM,EAAC,MAAK,gBAAgB;CAE5B,MAAM,CAAC,YAAY,iBAAiB,SAAkC,EAAE,CAAC;CACzE,MAAM,CAAC,gBAAgB,qBAAqB,SAA8B,EAAE,CAAC;CAC7E,MAAM,CAAC,aAAa,kBAAkB,SAA6B,OAAU;CAC7E,MAAM,CAAC,mBAAmB,wBAAwB,SAAS,MAAM;CACjE,MAAM,CAAC,WAAW,gBAAgB,SAAuB,KAAK;CAC9D,MAAM,6BAA6B,OAAO,MAAM;CAIhD,MAAM,oBAAoB,OAA2B,OAAU;CAE/D,MAAM,qBAAqB,aAAwB;EACjD,MAAM,aAAa,sBAAsB,UAAU,GAAG,EAAC,qBAAqB,OAAM,CAAC;AAEnF,oBAAkB,UAAU,UAAU,kBAAkB;AACxD,iBAAe,WAAW,eAAe,OAAU;AACnD,gBAAc,WAAW,WAAW;AACpC,oBAAkB,WAAW,eAAe;;CAG9C,MAAM,mBAAmB,UAAyB;EAChD,MAAMC,kBAAyB,iBAAiB,QAAQ,QAAQ,IAAI,MAAM,OAAO,MAAM,CAAC;AAExF,eAAa,gBAAgB;AAC7B,YAAU,gBAAgB;;AAG5B,iBAAgB;AACd,MAAI,2BAA2B,WAAW,CAAC,OACzC;AAGF,6BAA2B,UAAU;AAErC,GAAC,YAA2B;AAC1B,OAAI;IACF,MAAMC,WAAgB,MAAM,OAC1B;KACE;KACA,UAAU,iBAAiB;KAC3B,GAAI,UAAU,EAAC,QAAO;KACvB,EACD,EAAE,CACH;AAID,QAAI,SACF,mBAAkB,SAAS;YAEtB,OAAO;AACd,oBAAgB,MAAM;aACd;AACR,yBAAqB,KAAK;;MAE1B;IAEH,CAAC,OAAO,CAAC;CAEZ,MAAM,iBAAiB,OAAO,YAAgC;AAC5D,MAAI,CAAC,OACH,OAAM,IAAI,sBACR,uCACA,0CACA,SACD;EAGH,MAAMA,WAAgB,MAAM,OAC1B;GACE,GAAG;GACH;GACA,GAAI,kBAAkB,UAAU,EAAC,gBAAgB,kBAAkB,SAAQ,GAAG,EAAE;GACjF,EACD,EAAE,CACH;AAED,MAAI,SACF,mBAAkB,SAAS;;AAI/B,QACE,oBAAC;EACiB;EACJ;EACZ,OAAO;EACP,WAAW,CAAC;EACH;EACT,UAAU;EACJ;EACG;EACT,GAAI;GACJ;;AAIN,OAAO,cAAc;AAErB,qBAAe"}
+{"version":3,"file":"SignIn.js","names":["SignIn: FC<SignInProps>","useThunderID","normalizedError: Error","response: any"],"sources":["../../../../../src/client/components/presentation/SignIn/SignIn.tsx"],"sourcesContent":["// Copyright 2025 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\n'use client';\n\nimport {EmbeddedFlowComponent, EmbeddedFlowType, ThunderIDRuntimeError} from '@thunderid/node';\nimport {BaseSignIn, BaseSignInProps, normalizeFlowResponse, useTranslation} from '@thunderid/react';\nimport {FC, useEffect, useRef, useState} from 'react';\nimport useThunderID from '../../../contexts/ThunderID/useThunderID';\n\n/**\n * Props for the SignIn component.\n * Extends BaseSignInProps for full compatibility with the React BaseSignIn component\n */\nexport type SignInProps = Pick<\n  BaseSignInProps,\n  'children' | 'className' | 'id' | 'onSuccess' | 'onError' | 'variant' | 'size'\n>;\n\n/**\n * A SignIn component for Next.js that provides native authentication flow.\n * This component delegates to the BaseSignIn from @thunderid/react. Unlike BaseSignUp,\n * BaseSignIn does not manage its own flow state, so this component initiates the flow\n * (using the server-action-backed `signIn`) and tracks `components`/`executionId` itself.\n */\nconst SignIn: FC<SignInProps> = ({size = 'medium', variant = 'outlined', onError, ...rest}: SignInProps) => {\n  const {signIn, applicationId, scopes} = useThunderID();\n  const {t} = useTranslation();\n\n  const [components, setComponents] = useState<EmbeddedFlowComponent[]>([]);\n  const [additionalData, setAdditionalData] = useState<Record<string, any>>({});\n  const [executionId, setExecutionId] = useState<string | undefined>(undefined);\n  const [isFlowInitialized, setIsFlowInitialized] = useState(false);\n  const [flowError, setFlowError] = useState<Error | null>(null);\n  const initializationAttemptedRef = useRef(false);\n  // A fresh challenge token is required on every step to prevent replay attacks; the server\n  // rotates it on each response, so it's tracked in a ref (not state) to avoid a stale value\n  // from a closure captured before the previous response's state update committed.\n  const challengeTokenRef = useRef<string | undefined>(undefined);\n\n  const applyFlowResponse = (response: any): void => {\n    const normalized = normalizeFlowResponse(response, t, {resolveTranslations: false});\n\n    challengeTokenRef.current = response?.challengeToken ?? undefined;\n    setExecutionId(normalized.executionId ?? undefined);\n    setComponents(normalized.components);\n    setAdditionalData(normalized.additionalData);\n  };\n\n  const handleFlowError = (error: unknown): void => {\n    const normalizedError: Error = error instanceof Error ? error : new Error(String(error));\n\n    setFlowError(normalizedError);\n    onError?.(normalizedError);\n  };\n\n  useEffect(() => {\n    if (initializationAttemptedRef.current || !signIn) {\n      return;\n    }\n\n    initializationAttemptedRef.current = true;\n\n    (async (): Promise<void> => {\n      try {\n        const response: any = await signIn(\n          {\n            applicationId,\n            flowType: EmbeddedFlowType.Authentication,\n            ...(scopes && {scopes}),\n          },\n          {},\n        );\n\n        // `response` is undefined when the provider already redirected\n        // (OAuth-redirect or completed flows are handled there directly).\n        if (response) {\n          applyFlowResponse(response);\n        }\n      } catch (error) {\n        handleFlowError(error);\n      } finally {\n        setIsFlowInitialized(true);\n      }\n    })();\n    // eslint-disable-next-line react-hooks/exhaustive-deps\n  }, [signIn]);\n\n  const handleOnSubmit = async (payload: any): Promise<void> => {\n    if (!signIn) {\n      throw new ThunderIDRuntimeError(\n        '`signIn` function is not available.',\n        'SignIn-handleOnSubmit-RuntimeError-001',\n        'nextjs',\n      );\n    }\n\n    const response: any = await signIn(\n      {\n        ...payload,\n        executionId,\n        ...(challengeTokenRef.current ? {challengeToken: challengeTokenRef.current} : {}),\n      },\n      {},\n    );\n\n    if (response) {\n      applyFlowResponse(response);\n    }\n  };\n\n  return (\n    <BaseSignIn\n      additionalData={additionalData}\n      components={components}\n      error={flowError}\n      isLoading={!isFlowInitialized}\n      onError={onError}\n      onSubmit={handleOnSubmit}\n      size={size}\n      variant={variant}\n      {...rest}\n    />\n  );\n};\n\nSignIn.displayName = 'SignIn';\n\nexport default SignIn;\n"],"mappings":";;;;;;;;;;;;;;;;AAyBA,MAAMA,UAA2B,EAAC,OAAO,UAAU,UAAU,YAAY,QAAS,GAAG,WAAuB;CAC1G,MAAM,EAAC,QAAQ,eAAe,WAAUC,sBAAc;CACtD,MAAM,EAAC,MAAK,gBAAgB;CAE5B,MAAM,CAAC,YAAY,iBAAiB,SAAkC,EAAE,CAAC;CACzE,MAAM,CAAC,gBAAgB,qBAAqB,SAA8B,EAAE,CAAC;CAC7E,MAAM,CAAC,aAAa,kBAAkB,SAA6B,OAAU;CAC7E,MAAM,CAAC,mBAAmB,wBAAwB,SAAS,MAAM;CACjE,MAAM,CAAC,WAAW,gBAAgB,SAAuB,KAAK;CAC9D,MAAM,6BAA6B,OAAO,MAAM;CAIhD,MAAM,oBAAoB,OAA2B,OAAU;CAE/D,MAAM,qBAAqB,aAAwB;EACjD,MAAM,aAAa,sBAAsB,UAAU,GAAG,EAAC,qBAAqB,OAAM,CAAC;AAEnF,oBAAkB,UAAU,UAAU,kBAAkB;AACxD,iBAAe,WAAW,eAAe,OAAU;AACnD,gBAAc,WAAW,WAAW;AACpC,oBAAkB,WAAW,eAAe;;CAG9C,MAAM,mBAAmB,UAAyB;EAChD,MAAMC,kBAAyB,iBAAiB,QAAQ,QAAQ,IAAI,MAAM,OAAO,MAAM,CAAC;AAExF,eAAa,gBAAgB;AAC7B,YAAU,gBAAgB;;AAG5B,iBAAgB;AACd,MAAI,2BAA2B,WAAW,CAAC,OACzC;AAGF,6BAA2B,UAAU;AAErC,GAAC,YAA2B;AAC1B,OAAI;IACF,MAAMC,WAAgB,MAAM,OAC1B;KACE;KACA,UAAU,iBAAiB;KAC3B,GAAI,UAAU,EAAC,QAAO;KACvB,EACD,EAAE,CACH;AAID,QAAI,SACF,mBAAkB,SAAS;YAEtB,OAAO;AACd,oBAAgB,MAAM;aACd;AACR,yBAAqB,KAAK;;MAE1B;IAEH,CAAC,OAAO,CAAC;CAEZ,MAAM,iBAAiB,OAAO,YAAgC;AAC5D,MAAI,CAAC,OACH,OAAM,IAAI,sBACR,uCACA,0CACA,SACD;EAGH,MAAMA,WAAgB,MAAM,OAC1B;GACE,GAAG;GACH;GACA,GAAI,kBAAkB,UAAU,EAAC,gBAAgB,kBAAkB,SAAQ,GAAG,EAAE;GACjF,EACD,EAAE,CACH;AAED,MAAI,SACF,mBAAkB,SAAS;;AAI/B,QACE,oBAAC;EACiB;EACJ;EACZ,OAAO;EACP,WAAW,CAAC;EACH;EACT,UAAU;EACJ;EACG;EACT,GAAI;GACJ;;AAIN,OAAO,cAAc;AAErB,qBAAe"}

package/dist/client/components/presentation/SignUp/SignUp.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"SignUp.d.ts","sourceRoot":"","sources":["../../../../../src/client/components/presentation/SignUp/SignUp.tsx"],"names":[],"mappings":"AAMA,OAAO,EAAa,eAAe,EAAC,MAAM,kBAAkB,CAAC;AAC7D,OAAO,EAAC,EAAE,EAAC,MAAM,OAAO,CAAC;AAGzB;;GAEG;AACH,MAAM,MAAM,WAAW,GAAG,eAAe,CAAC;AAE1C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,QAAA,MAAM,MAAM,EAAE,EAAE,CAAC,WAAW,CAwD3B,CAAC;AAEF,eAAe,MAAM,CAAC"}
+{"version":3,"file":"SignUp.d.ts","sourceRoot":"","sources":["../../../../../src/client/components/presentation/SignUp/SignUp.tsx"],"names":[],"mappings":"AAMA,OAAO,EAAa,eAAe,EAAC,MAAM,kBAAkB,CAAC;AAC7D,OAAO,EAAC,EAAE,EAAC,MAAM,OAAO,CAAC;AAGzB;;GAEG;AACH,MAAM,MAAM,WAAW,GAAG,eAAe,CAAC;AAE1C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,QAAA,MAAM,MAAM,EAAE,EAAE,CAAC,WAAW,CA2D3B,CAAC;AAEF,eAAe,MAAM,CAAC"}

package/dist/client/components/presentation/SignUp/SignUp.js

@@ -37,7 +37,7 @@ import { jsx } from "react/jsx-runtime";
 * };
 * ```
 */
-const SignUp = ({ className, size = "medium", variant = "outlined", afterSignUpUrl, onError }) => {
+const SignUp = ({ className, size = "medium", variant = "outlined", afterSignUpUrl, onError, children }) => {
 	const { signUp, applicationId: contextApplicationId, scopes } = useThunderID_default();
 	/**
 	* Initialize the sign-up flow.
@@ -66,7 +66,8 @@ const SignUp = ({ className, size = "medium", variant = "outlined", afterSignUpU
 		className,
 		size,
 		variant,
-		isInitialized: true
+		isInitialized: true,
+		children
 	});
 };
 var SignUp_default = SignUp;

package/dist/client/components/presentation/SignUp/SignUp.js.map

@@ -1 +1 @@
-{"version":3,"file":"SignUp.js","names":["SignUp: FC<SignUpProps>","useThunderID"],"sources":["../../../../../src/client/components/presentation/SignUp/SignUp.tsx"],"sourcesContent":["// Copyright 2025 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\n'use client';\n\nimport {ThunderIDRuntimeError, EmbeddedFlowType} from '@thunderid/node';\nimport {BaseSignUp, BaseSignUpProps} from '@thunderid/react';\nimport {FC} from 'react';\nimport useThunderID from '../../../contexts/ThunderID/useThunderID';\n\n/**\n * Props for the SignUp component.\n */\nexport type SignUpProps = BaseSignUpProps;\n\n/**\n * A styled SignUp component that provides embedded sign-up flow with pre-built styling.\n * This component handles the API calls for sign-up and delegates UI logic to BaseSignUp.\n *\n * @example\n * ```tsx\n * import { SignUp } from '@thunderid/react';\n *\n * const App = () => {\n *   return (\n *     <SignUp\n *       onSuccess={(response) => {\n *         console.log('Sign-up successful:', response);\n *         // Handle successful sign-up (e.g., redirect, show confirmation)\n *       }}\n *       onError={(error) => {\n *         console.error('Sign-up failed:', error);\n *       }}\n *       onComplete={(redirectUrl) => {\n *         // Platform-specific redirect handling (e.g., Next.js router.push)\n *         router.push(redirectUrl); // or window.location.href = redirectUrl\n *       }}\n *       size=\"medium\"\n *       variant=\"outlined\"\n *       afterSignUpUrl=\"/welcome\"\n *     />\n *   );\n * };\n * ```\n */\nconst SignUp: FC<SignUpProps> = ({\n  className,\n  size = 'medium',\n  variant = 'outlined',\n  afterSignUpUrl,\n  onError,\n}: SignUpProps) => {\n  const {signUp, applicationId: contextApplicationId, scopes} = useThunderID();\n\n  /**\n   * Initialize the sign-up flow.\n   */\n  const handleInitialize = async (payload?: any): Promise<any> => {\n    if (!signUp) {\n      throw new ThunderIDRuntimeError(\n        '`signUp` function is not available.',\n        'SignUp-handleInitialize-RuntimeError-001',\n        'nextjs',\n      );\n    }\n\n    return (await signUp({\n      flowType: EmbeddedFlowType.Registration,\n      ...(contextApplicationId && {applicationId: contextApplicationId}),\n      ...(scopes && {scopes}),\n      ...payload,\n    })) as unknown as Promise<any>;\n  };\n\n  /**\n   * Handle sign-up steps.\n   */\n  const handleOnSubmit = async (payload: any): Promise<any> => {\n    if (!signUp) {\n      throw new ThunderIDRuntimeError(\n        '`signUp` function is not available.',\n        'SignUp-handleOnSubmit-RuntimeError-001',\n        'nextjs',\n      );\n    }\n\n    return (await signUp(payload)) as unknown as Promise<any>;\n  };\n\n  return (\n    <BaseSignUp\n      afterSignUpUrl={afterSignUpUrl}\n      onInitialize={handleInitialize}\n      onSubmit={handleOnSubmit}\n      onError={onError}\n      className={className}\n      size={size}\n      variant={variant}\n      isInitialized={true}\n    />\n  );\n};\n\nexport default SignUp;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA6CA,MAAMA,UAA2B,EAC/B,WACA,OAAO,UACP,UAAU,YACV,gBACA,cACiB;CACjB,MAAM,EAAC,QAAQ,eAAe,sBAAsB,WAAUC,sBAAc;;;;CAK5E,MAAM,mBAAmB,OAAO,YAAgC;AAC9D,MAAI,CAAC,OACH,OAAM,IAAI,sBACR,uCACA,4CACA,SACD;AAGH,SAAQ,MAAM,OAAO;GACnB,UAAU,iBAAiB;GAC3B,GAAI,wBAAwB,EAAC,eAAe,sBAAqB;GACjE,GAAI,UAAU,EAAC,QAAO;GACtB,GAAG;GACJ,CAAC;;;;;CAMJ,MAAM,iBAAiB,OAAO,YAA+B;AAC3D,MAAI,CAAC,OACH,OAAM,IAAI,sBACR,uCACA,0CACA,SACD;AAGH,SAAQ,MAAM,OAAO,QAAQ;;AAG/B,QACE,oBAAC;EACiB;EAChB,cAAc;EACd,UAAU;EACD;EACE;EACL;EACG;EACT,eAAe;GACf;;AAIN,qBAAe"}
+{"version":3,"file":"SignUp.js","names":["SignUp: FC<SignUpProps>","useThunderID"],"sources":["../../../../../src/client/components/presentation/SignUp/SignUp.tsx"],"sourcesContent":["// Copyright 2025 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\n'use client';\n\nimport {ThunderIDRuntimeError, EmbeddedFlowType} from '@thunderid/node';\nimport {BaseSignUp, BaseSignUpProps} from '@thunderid/react';\nimport {FC} from 'react';\nimport useThunderID from '../../../contexts/ThunderID/useThunderID';\n\n/**\n * Props for the SignUp component.\n */\nexport type SignUpProps = BaseSignUpProps;\n\n/**\n * A styled SignUp component that provides embedded sign-up flow with pre-built styling.\n * This component handles the API calls for sign-up and delegates UI logic to BaseSignUp.\n *\n * @example\n * ```tsx\n * import { SignUp } from '@thunderid/react';\n *\n * const App = () => {\n *   return (\n *     <SignUp\n *       onSuccess={(response) => {\n *         console.log('Sign-up successful:', response);\n *         // Handle successful sign-up (e.g., redirect, show confirmation)\n *       }}\n *       onError={(error) => {\n *         console.error('Sign-up failed:', error);\n *       }}\n *       onComplete={(redirectUrl) => {\n *         // Platform-specific redirect handling (e.g., Next.js router.push)\n *         router.push(redirectUrl); // or window.location.href = redirectUrl\n *       }}\n *       size=\"medium\"\n *       variant=\"outlined\"\n *       afterSignUpUrl=\"/welcome\"\n *     />\n *   );\n * };\n * ```\n */\nconst SignUp: FC<SignUpProps> = ({\n  className,\n  size = 'medium',\n  variant = 'outlined',\n  afterSignUpUrl,\n  onError,\n  children,\n}: SignUpProps) => {\n  const {signUp, applicationId: contextApplicationId, scopes} = useThunderID();\n\n  /**\n   * Initialize the sign-up flow.\n   */\n  const handleInitialize = async (payload?: any): Promise<any> => {\n    if (!signUp) {\n      throw new ThunderIDRuntimeError(\n        '`signUp` function is not available.',\n        'SignUp-handleInitialize-RuntimeError-001',\n        'nextjs',\n      );\n    }\n\n    return (await signUp({\n      flowType: EmbeddedFlowType.Registration,\n      ...(contextApplicationId && {applicationId: contextApplicationId}),\n      ...(scopes && {scopes}),\n      ...payload,\n    })) as unknown as Promise<any>;\n  };\n\n  /**\n   * Handle sign-up steps.\n   */\n  const handleOnSubmit = async (payload: any): Promise<any> => {\n    if (!signUp) {\n      throw new ThunderIDRuntimeError(\n        '`signUp` function is not available.',\n        'SignUp-handleOnSubmit-RuntimeError-001',\n        'nextjs',\n      );\n    }\n\n    return (await signUp(payload)) as unknown as Promise<any>;\n  };\n\n  return (\n    <BaseSignUp\n      afterSignUpUrl={afterSignUpUrl}\n      onInitialize={handleInitialize}\n      onSubmit={handleOnSubmit}\n      onError={onError}\n      className={className}\n      size={size}\n      variant={variant}\n      isInitialized={true}\n    >\n      {children}\n    </BaseSignUp>\n  );\n};\n\nexport default SignUp;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA6CA,MAAMA,UAA2B,EAC/B,WACA,OAAO,UACP,UAAU,YACV,gBACA,SACA,eACiB;CACjB,MAAM,EAAC,QAAQ,eAAe,sBAAsB,WAAUC,sBAAc;;;;CAK5E,MAAM,mBAAmB,OAAO,YAAgC;AAC9D,MAAI,CAAC,OACH,OAAM,IAAI,sBACR,uCACA,4CACA,SACD;AAGH,SAAQ,MAAM,OAAO;GACnB,UAAU,iBAAiB;GAC3B,GAAI,wBAAwB,EAAC,eAAe,sBAAqB;GACjE,GAAI,UAAU,EAAC,QAAO;GACtB,GAAG;GACJ,CAAC;;;;;CAMJ,MAAM,iBAAiB,OAAO,YAA+B;AAC3D,MAAI,CAAC,OACH,OAAM,IAAI,sBACR,uCACA,0CACA,SACD;AAGH,SAAQ,MAAM,OAAO,QAAQ;;AAG/B,QACE,oBAAC;EACiB;EAChB,cAAc;EACd,UAAU;EACD;EACE;EACL;EACG;EACT,eAAe;EAEd;GACU;;AAIjB,qBAAe"}

package/dist/client/components/presentation/UserSelect/UserSelect.d.ts

@@ -0,0 +1,11 @@
+import { BaseUserSelectProps } from '@thunderid/react';
+import { FC } from 'react';
+export type UserSelectProps = Omit<BaseUserSelectProps, 'fetchUsers'>;
+/**
+ * Single-user picker for signed-in screens. Users load through a server action that uses the
+ * signed-in user's server-held session, so the access token never reaches the browser. It takes no
+ * data source; for a custom one use `Select` with `useInfiniteOptions`.
+ */
+declare const UserSelect: FC<UserSelectProps>;
+export default UserSelect;
+//# sourceMappingURL=UserSelect.d.ts.map

package/dist/client/components/presentation/UserSelect/UserSelect.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"UserSelect.d.ts","sourceRoot":"","sources":["../../../../../src/client/components/presentation/UserSelect/UserSelect.tsx"],"names":[],"mappings":"AAKA,OAAO,EAAiB,mBAAmB,EAAC,MAAM,kBAAkB,CAAC;AACrE,OAAO,EAAC,EAAE,EAAC,MAAM,OAAO,CAAC;AAGzB,MAAM,MAAM,eAAe,GAAG,IAAI,CAAC,mBAAmB,EAAE,YAAY,CAAC,CAAC;AAEtE;;;;GAIG;AACH,QAAA,MAAM,UAAU,EAAE,EAAE,CAAC,eAAe,CAEnC,CAAC;AAEF,eAAe,UAAU,CAAC"}

package/dist/client/components/presentation/UserSelect/UserSelect.js

@@ -0,0 +1,22 @@
+'use client';
+
+
+import fetchUsersFromServer_default from "../../../fetchUsersFromServer.js";
+import { BaseUserSelect } from "@thunderid/react";
+import { jsx } from "react/jsx-runtime";
+
+//#region src/client/components/presentation/UserSelect/UserSelect.tsx
+/**
+* Single-user picker for signed-in screens. Users load through a server action that uses the
+* signed-in user's server-held session, so the access token never reaches the browser. It takes no
+* data source; for a custom one use `Select` with `useInfiniteOptions`.
+*/
+const UserSelect = (props) => /* @__PURE__ */ jsx(BaseUserSelect, {
+	...props,
+	fetchUsers: fetchUsersFromServer_default
+});
+var UserSelect_default = UserSelect;
+
+//#endregion
+export { UserSelect_default as default };
+//# sourceMappingURL=UserSelect.js.map

package/dist/client/components/presentation/UserSelect/UserSelect.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"UserSelect.js","names":["UserSelect: FC<UserSelectProps>","fetchUsersFromServer"],"sources":["../../../../../src/client/components/presentation/UserSelect/UserSelect.tsx"],"sourcesContent":["// Copyright 2026 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\n'use client';\n\nimport {BaseUserSelect, BaseUserSelectProps} from '@thunderid/react';\nimport {FC} from 'react';\nimport fetchUsersFromServer from '../../../fetchUsersFromServer';\n\nexport type UserSelectProps = Omit<BaseUserSelectProps, 'fetchUsers'>;\n\n/**\n * Single-user picker for signed-in screens. Users load through a server action that uses the\n * signed-in user's server-held session, so the access token never reaches the browser. It takes no\n * data source; for a custom one use `Select` with `useInfiniteOptions`.\n */\nconst UserSelect: FC<UserSelectProps> = (props: UserSelectProps) => (\n  <BaseUserSelect {...props} fetchUsers={fetchUsersFromServer} />\n);\n\nexport default UserSelect;\n"],"mappings":";;;;;;;;;;;;;AAgBA,MAAMA,cAAmC,UACvC,oBAAC;CAAe,GAAI;CAAO,YAAYC;EAAwB;AAGjE,yBAAe"}

package/dist/client/components/presentation/UserTypeSelect/UserTypeSelect.d.ts

@@ -0,0 +1,11 @@
+import { BaseUserTypeSelectProps } from '@thunderid/react';
+import { FC } from 'react';
+export type UserTypeSelectProps = Omit<BaseUserTypeSelectProps, 'fetchUserTypes'>;
+/**
+ * User-type picker for signed-in screens. User types load through a server action that uses the
+ * signed-in user's server-held session, so the access token never reaches the browser. It takes no
+ * data source; for a custom one use `Select` with `useInfiniteOptions`.
+ */
+declare const UserTypeSelect: FC<UserTypeSelectProps>;
+export default UserTypeSelect;
+//# sourceMappingURL=UserTypeSelect.d.ts.map

package/dist/client/components/presentation/UserTypeSelect/UserTypeSelect.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"UserTypeSelect.d.ts","sourceRoot":"","sources":["../../../../../src/client/components/presentation/UserTypeSelect/UserTypeSelect.tsx"],"names":[],"mappings":"AAKA,OAAO,EAAqB,uBAAuB,EAAC,MAAM,kBAAkB,CAAC;AAC7E,OAAO,EAAC,EAAE,EAAC,MAAM,OAAO,CAAC;AAGzB,MAAM,MAAM,mBAAmB,GAAG,IAAI,CAAC,uBAAuB,EAAE,gBAAgB,CAAC,CAAC;AAElF;;;;GAIG;AACH,QAAA,MAAM,cAAc,EAAE,EAAE,CAAC,mBAAmB,CAE3C,CAAC;AAEF,eAAe,cAAc,CAAC"}

package/dist/client/components/presentation/UserTypeSelect/UserTypeSelect.js

@@ -0,0 +1,22 @@
+'use client';
+
+
+import fetchUserTypesFromServer_default from "../../../fetchUserTypesFromServer.js";
+import { BaseUserTypeSelect } from "@thunderid/react";
+import { jsx } from "react/jsx-runtime";
+
+//#region src/client/components/presentation/UserTypeSelect/UserTypeSelect.tsx
+/**
+* User-type picker for signed-in screens. User types load through a server action that uses the
+* signed-in user's server-held session, so the access token never reaches the browser. It takes no
+* data source; for a custom one use `Select` with `useInfiniteOptions`.
+*/
+const UserTypeSelect = (props) => /* @__PURE__ */ jsx(BaseUserTypeSelect, {
+	...props,
+	fetchUserTypes: fetchUserTypesFromServer_default
+});
+var UserTypeSelect_default = UserTypeSelect;
+
+//#endregion
+export { UserTypeSelect_default as default };
+//# sourceMappingURL=UserTypeSelect.js.map

package/dist/client/components/presentation/UserTypeSelect/UserTypeSelect.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"UserTypeSelect.js","names":["UserTypeSelect: FC<UserTypeSelectProps>","fetchUserTypesFromServer"],"sources":["../../../../../src/client/components/presentation/UserTypeSelect/UserTypeSelect.tsx"],"sourcesContent":["// Copyright 2026 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\n'use client';\n\nimport {BaseUserTypeSelect, BaseUserTypeSelectProps} from '@thunderid/react';\nimport {FC} from 'react';\nimport fetchUserTypesFromServer from '../../../fetchUserTypesFromServer';\n\nexport type UserTypeSelectProps = Omit<BaseUserTypeSelectProps, 'fetchUserTypes'>;\n\n/**\n * User-type picker for signed-in screens. User types load through a server action that uses the\n * signed-in user's server-held session, so the access token never reaches the browser. It takes no\n * data source; for a custom one use `Select` with `useInfiniteOptions`.\n */\nconst UserTypeSelect: FC<UserTypeSelectProps> = (props: UserTypeSelectProps) => (\n  <BaseUserTypeSelect {...props} fetchUserTypes={fetchUserTypesFromServer} />\n);\n\nexport default UserTypeSelect;\n"],"mappings":";;;;;;;;;;;;;AAgBA,MAAMA,kBAA2C,UAC/C,oBAAC;CAAmB,GAAI;CAAO,gBAAgBC;EAA4B;AAG7E,6BAAe"}

package/dist/client/contexts/ThunderID/ThunderIDProvider.d.ts

@@ -9,17 +9,6 @@ import { RefreshResult } from '../../../server/actions/refreshToken';
 export type ThunderIDClientProviderProps = Partial<Omit<ThunderIDProviderProps, 'baseUrl' | 'clientId'>> & Pick<ThunderIDProviderProps, 'baseUrl' | 'clientId'> & {
     applicationId: ThunderIDContextProps['applicationId'];
     clearSession: () => Promise<void>;
-    /**
-     * Server Action that fetches `GET /flow/meta` server-side, passed down to `FlowMetaProvider` so
-     * it never calls `baseUrl` directly from the browser — avoiding the CORS requirement that a
-     * direct client-side fetch to the ThunderID server would otherwise impose. Used for both the
-     * initial fetch (when `initialMeta` isn't seeded, e.g. it failed server-side) and subsequent
-     * `switchLanguage()` calls.
-     */
-    fetchMeta?: (params: {
-        applicationId?: string;
-        language?: string;
-    }) => Promise<FlowMetadataResponse>;
     handleOAuthCallback: (code: string, state: string) => Promise<{
         error?: string;
         redirectUrl?: string;

package/dist/client/contexts/ThunderID/ThunderIDProvider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ThunderIDProvider.d.ts","sourceRoot":"","sources":["../../../../src/client/contexts/ThunderID/ThunderIDProvider.tsx"],"names":[],"mappings":"AAKA,OAAO,EACL,eAAe,EAEf,oBAAoB,EAEpB,qBAAqB,EACrB,IAAI,EACJ,WAAW,EAGZ,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAQL,sBAAsB,EACvB,MAAM,kBAAkB,CAAC;AAI1B,OAAO,EAAC,EAAE,EAAE,iBAAiB,EAAkD,MAAM,OAAO,CAAC;AAC7F,OAAyB,EAAC,qBAAqB,EAAC,MAAM,oBAAoB,CAAC;AAC3E,OAAO,EAAC,aAAa,EAAC,MAAM,sCAAsC,CAAC;AAGnE;;GAEG;AACH,MAAM,MAAM,4BAA4B,GAAG,OAAO,CAAC,IAAI,CAAC,sBAAsB,EAAE,SAAS,GAAG,UAAU,CAAC,CAAC,GACtG,IAAI,CAAC,sBAAsB,EAAE,SAAS,GAAG,UAAU,CAAC,GAAG;IACrD,aAAa,EAAE,qBAAqB,CAAC,eAAe,CAAC,CAAC;IACtD,YAAY,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAClC;;;;;;OAMG;IACH,SAAS,CAAC,EAAE,CAAC,MAAM,EAAE;QAAC,aAAa,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAC,KAAK,OAAO,CAAC,oBAAoB,CAAC,CAAC;IACnG,mBAAmB,EAAE,CACnB,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,KACV,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAC,CAAC,CAAC;IACvE;;;OAGG;IACH,WAAW,CAAC,EAAE,oBAAoB,GAAG,IAAI,CAAC;IAC1C,UAAU,EAAE,OAAO,CAAC;IACpB,kBAAkB,EAAE,qBAAqB,CAAC,oBAAoB,CAAC,CAAC;IAChE,YAAY,EAAE,MAAM,OAAO,CAAC,aAAa,CAAC,CAAC;IAC3C,MAAM,EAAE,qBAAqB,CAAC,QAAQ,CAAC,CAAC;IACxC,OAAO,EAAE,qBAAqB,CAAC,SAAS,CAAC,CAAC;IAC1C,MAAM,EAAE,qBAAqB,CAAC,QAAQ,CAAC,CAAC;IACxC,aAAa,EAAE,CACb,aAAa,EAAE,qBAAqB,EACpC,SAAS,CAAC,EAAE,MAAM,KACf,OAAO,CAAC;QAAC,IAAI,EAAE;YAAC,IAAI,EAAE,IAAI,CAAA;SAAC,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAC,CAAC,CAAC;IACpE,IAAI,EAAE,IAAI,GAAG,IAAI,CAAC;IAClB,WAAW,EAAE,WAAW,CAAC;IACzB,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,GAAG,IAAI,CAAC;CACrD,CAAC;AAEJ,QAAA,MAAM,uBAAuB,EAAE,EAAE,CAAC,iBAAiB,CAAC,4BAA4B,CAAC,CA2VhF,CAAC;AAEF,eAAe,uBAAuB,CAAC"}
+{"version":3,"file":"ThunderIDProvider.d.ts","sourceRoot":"","sources":["../../../../src/client/contexts/ThunderID/ThunderIDProvider.tsx"],"names":[],"mappings":"AAKA,OAAO,EACL,eAAe,EAEf,oBAAoB,EAEpB,qBAAqB,EACrB,IAAI,EACJ,WAAW,EAGZ,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAQL,sBAAsB,EACvB,MAAM,kBAAkB,CAAC;AAI1B,OAAO,EAAC,EAAE,EAAE,iBAAiB,EAAkD,MAAM,OAAO,CAAC;AAC7F,OAAyB,EAAC,qBAAqB,EAAC,MAAM,oBAAoB,CAAC;AAC3E,OAAO,EAAC,aAAa,EAAC,MAAM,sCAAsC,CAAC;AAInE;;GAEG;AACH,MAAM,MAAM,4BAA4B,GAAG,OAAO,CAAC,IAAI,CAAC,sBAAsB,EAAE,SAAS,GAAG,UAAU,CAAC,CAAC,GACtG,IAAI,CAAC,sBAAsB,EAAE,SAAS,GAAG,UAAU,CAAC,GAAG;IACrD,aAAa,EAAE,qBAAqB,CAAC,eAAe,CAAC,CAAC;IACtD,YAAY,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAClC,mBAAmB,EAAE,CACnB,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,KACV,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAC,CAAC,CAAC;IACvE;;;OAGG;IACH,WAAW,CAAC,EAAE,oBAAoB,GAAG,IAAI,CAAC;IAC1C,UAAU,EAAE,OAAO,CAAC;IACpB,kBAAkB,EAAE,qBAAqB,CAAC,oBAAoB,CAAC,CAAC;IAChE,YAAY,EAAE,MAAM,OAAO,CAAC,aAAa,CAAC,CAAC;IAC3C,MAAM,EAAE,qBAAqB,CAAC,QAAQ,CAAC,CAAC;IACxC,OAAO,EAAE,qBAAqB,CAAC,SAAS,CAAC,CAAC;IAC1C,MAAM,EAAE,qBAAqB,CAAC,QAAQ,CAAC,CAAC;IACxC,aAAa,EAAE,CACb,aAAa,EAAE,qBAAqB,EACpC,SAAS,CAAC,EAAE,MAAM,KACf,OAAO,CAAC;QAAC,IAAI,EAAE;YAAC,IAAI,EAAE,IAAI,CAAA;SAAC,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAC,CAAC,CAAC;IACpE,IAAI,EAAE,IAAI,GAAG,IAAI,CAAC;IAClB,WAAW,EAAE,WAAW,CAAC;IACzB,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,GAAG,IAAI,CAAC;CACrD,CAAC;AAEJ,QAAA,MAAM,uBAAuB,EAAE,EAAE,CAAC,iBAAiB,CAAC,4BAA4B,CAAC,CA0VhF,CAAC;AAEF,eAAe,uBAAuB,CAAC"}

package/dist/client/contexts/ThunderID/ThunderIDProvider.js

@@ -3,6 +3,7 @@
 
 import logger_default from "../../../utils/logger.js";
 import ThunderIDContext_default from "./ThunderIDContext.js";
+import fetchFlowMetaFromServer_default from "../../fetchFlowMetaFromServer.js";
 import { ThunderIDRuntimeError, generateFlattenedUserProfile, getVendorPrefix } from "@thunderid/node";
 import { FlowMetaProvider, FlowProvider, I18nProvider, ThemeProvider, ThunderIDContext, UserProvider } from "@thunderid/react";
 import { useRouter, useSearchParams } from "next/navigation";
@@ -10,7 +11,7 @@ import { useEffect, useMemo, useRef, useState } from "react";
 import { jsx } from "react/jsx-runtime";
 
 //#region src/client/contexts/ThunderID/ThunderIDProvider.tsx
-const ThunderIDClientProvider = ({ baseUrl, children, signIn, clearSession, refreshToken, signOut, signUp, handleOAuthCallback, preferences, isSignedIn, signInUrl, signUpUrl, user: _user, userProfile: _userProfile, userSchema: _userSchema = null, updateProfile, applicationId, organizationHandle, scopes, vendor, initialMeta = null, fetchMeta }) => {
+const ThunderIDClientProvider = ({ baseUrl, children, signIn, clearSession, refreshToken, signOut, signUp, handleOAuthCallback, preferences, isSignedIn, signInUrl, signUpUrl, user: _user, userProfile: _userProfile, userSchema: _userSchema = null, updateProfile, applicationId, organizationHandle, scopes, vendor, initialMeta = null }) => {
 	const reRenderCheckRef = useRef(false);
 	const router = useRouter();
 	const searchParams = useSearchParams();
@@ -200,7 +201,7 @@ const ThunderIDClientProvider = ({ baseUrl, children, signIn, clearSession, refr
 				children: /* @__PURE__ */ jsx(FlowMetaProvider, {
 					enabled: preferences?.resolveFromMeta !== false,
 					initialMeta,
-					fetchMeta,
+					fetchMeta: fetchFlowMetaFromServer_default,
 					children: /* @__PURE__ */ jsx(ThemeProvider, {
 						theme: preferences?.theme?.overrides,
 						mode: preferences?.theme?.mode,