@thunderid/nextjs 1.2.3 → 1.3.1

package/dist/client/contexts/ThunderID/ThunderIDProvider.js.map

@@ -1 +1 @@
-{"version":3,"file":"ThunderIDProvider.js","names":["ThunderIDClientProvider: FC<PropsWithChildren<ThunderIDClientProviderProps>>","reRenderCheckRef: RefObject<boolean>","router: AppRouterInstance","searchParams: ReadonlyURLSearchParams","code: string | null","state: string | null","result: {error?: string; redirectUrl?: string; success: boolean}","result: any","contextValue: ThunderIDContextProps","reactContextValue: ReactThunderIDContextProps","ThunderIDContext","ReactThunderIDContext"],"sources":["../../../../src/client/contexts/ThunderID/ThunderIDProvider.tsx"],"sourcesContent":["// Copyright 2025 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\n'use client';\n\nimport {\n  AttributeSchema,\n  EmbeddedFlowExecuteRequestConfig,\n  FlowMetadataResponse,\n  generateFlattenedUserProfile,\n  UpdateMeProfileConfig,\n  User,\n  UserProfile,\n  ThunderIDRuntimeError,\n  getVendorPrefix,\n} from '@thunderid/node';\nimport {\n  I18nProvider,\n  FlowMetaProvider,\n  FlowProvider,\n  UserProvider,\n  ThemeProvider,\n  ThunderIDContext as ReactThunderIDContext,\n  ThunderIDContextProps as ReactThunderIDContextProps,\n  ThunderIDProviderProps,\n} from '@thunderid/react';\nimport {ReadonlyURLSearchParams} from 'next/dist/client/components/navigation.react-server';\nimport {AppRouterInstance} from 'next/dist/shared/lib/app-router-context.shared-runtime';\nimport {useRouter, useSearchParams} from 'next/navigation';\nimport {FC, PropsWithChildren, RefObject, useEffect, useMemo, useRef, useState} from 'react';\nimport ThunderIDContext, {ThunderIDContextProps} from './ThunderIDContext';\nimport {RefreshResult} from '../../../server/actions/refreshToken';\nimport logger from '../../../utils/logger';\n\n/**\n * Props interface of {@link ThunderIDClientProvider}\n */\nexport type ThunderIDClientProviderProps = Partial<Omit<ThunderIDProviderProps, 'baseUrl' | 'clientId'>> &\n  Pick<ThunderIDProviderProps, 'baseUrl' | 'clientId'> & {\n    applicationId: ThunderIDContextProps['applicationId'];\n    clearSession: () => Promise<void>;\n    /**\n     * Server Action that fetches `GET /flow/meta` server-side, passed down to `FlowMetaProvider` so\n     * it never calls `baseUrl` directly from the browser — avoiding the CORS requirement that a\n     * direct client-side fetch to the ThunderID server would otherwise impose. Used for both the\n     * initial fetch (when `initialMeta` isn't seeded, e.g. it failed server-side) and subsequent\n     * `switchLanguage()` calls.\n     */\n    fetchMeta?: (params: {applicationId?: string; language?: string}) => Promise<FlowMetadataResponse>;\n    handleOAuthCallback: (\n      code: string,\n      state: string,\n    ) => Promise<{error?: string; redirectUrl?: string; success: boolean}>;\n    /**\n     * Flow metadata fetched server-side ahead of time, seeding `FlowMetaProvider` so it can skip\n     * its own initial client-side fetch (avoiding a flash of untranslated i18n keys).\n     */\n    initialMeta?: FlowMetadataResponse | null;\n    isSignedIn: boolean;\n    organizationHandle: ThunderIDContextProps['organizationHandle'];\n    refreshToken: () => Promise<RefreshResult>;\n    signIn: ThunderIDContextProps['signIn'];\n    signOut: ThunderIDContextProps['signOut'];\n    signUp: ThunderIDContextProps['signUp'];\n    updateProfile: (\n      requestConfig: UpdateMeProfileConfig,\n      sessionId?: string,\n    ) => Promise<{data: {user: User}; error: string; success: boolean}>;\n    user: User | null;\n    userProfile: UserProfile;\n    userSchema?: Record<string, AttributeSchema> | null;\n  };\n\nconst ThunderIDClientProvider: FC<PropsWithChildren<ThunderIDClientProviderProps>> = ({\n  baseUrl,\n  children,\n  signIn,\n  clearSession,\n  refreshToken,\n  signOut,\n  signUp,\n  handleOAuthCallback,\n  preferences,\n  isSignedIn,\n  signInUrl,\n  signUpUrl,\n  user: _user,\n  userProfile: _userProfile,\n  userSchema: _userSchema = null,\n  updateProfile,\n  applicationId,\n  organizationHandle,\n  scopes,\n  vendor,\n  initialMeta = null,\n  fetchMeta,\n}: PropsWithChildren<ThunderIDClientProviderProps>) => {\n  const reRenderCheckRef: RefObject<boolean> = useRef(false);\n  const router: AppRouterInstance = useRouter();\n  const searchParams: ReadonlyURLSearchParams = useSearchParams();\n  const [isLoading, setIsLoading] = useState<boolean>(true);\n  const [user, setUser] = useState<User | null>(_user);\n  const [userProfile, setUserProfile] = useState<UserProfile>(_userProfile);\n  const [userSchema, setUserSchema] = useState<Record<string, AttributeSchema> | null>(_userSchema);\n\n  useEffect(() => {\n    setUserProfile(_userProfile);\n  }, [_userProfile]);\n\n  useEffect(() => {\n    setUserSchema(_userSchema);\n  }, [_userSchema]);\n\n  useEffect(() => {\n    setUser(_user);\n  }, [_user]);\n\n  // Handle OAuth callback automatically\n  useEffect(() => {\n    // React 18.x Strict.Mode has a new check for `Ensuring reusable state` to facilitate an upcoming react feature.\n    // https://reactjs.org/docs/strict-mode.html#ensuring-reusable-state\n    // This will remount all the useEffects to ensure that there are no unexpected side effects.\n    // When react remounts the signIn hook of the AuthProvider, it will cause a race condition. Hence, we have to\n    // prevent the re-render of this hook as suggested in the following discussion.\n    // https://github.com/reactwg/react-18/discussions/18#discussioncomment-795623\n    if (reRenderCheckRef.current) {\n      return;\n    }\n\n    reRenderCheckRef.current = true;\n\n    // Don't handle callback if already signed in\n    if (isSignedIn) return;\n\n    (async (): Promise<void> => {\n      try {\n        const code: string | null = searchParams.get('code');\n        const state: string | null = searchParams.get('state');\n        const error: string | null = searchParams.get('error');\n\n        // Check for OAuth errors first\n        if (error) {\n          logger.error('[ThunderIDClientProvider] An error was received for the initiated sign-in request.');\n\n          return;\n        }\n\n        // Handle OAuth callback if code and state are present\n        if (code && state) {\n          setIsLoading(true);\n\n          const result: {error?: string; redirectUrl?: string; success: boolean} = await handleOAuthCallback(\n            code,\n            state,\n          );\n\n          if (result.success) {\n            // Redirect to the success URL\n            if (result.redirectUrl) {\n              router.push(result.redirectUrl);\n            } else {\n              // Refresh the page to update authentication state\n              window.location.reload();\n            }\n          } else {\n            logger.error(\n              `[ThunderIDClientProvider] An error occurred while signing in: ${result.error || 'Authentication failed'}`,\n            );\n          }\n        }\n      } catch (error) {\n        logger.error('[ThunderIDClientProvider] Failed to handle OAuth callback:', error);\n      }\n    })();\n  }, []);\n\n  useEffect(() => {\n    // Set loading to false when server has resolved authentication state\n    setIsLoading(false);\n  }, [isSignedIn, user]);\n\n  const handleSignIn = async (payload: any, request: EmbeddedFlowExecuteRequestConfig): Promise<any> => {\n    if (!signIn) {\n      throw new ThunderIDRuntimeError(\n        '`signIn` function is not available.',\n        'ThunderIDClientProvider-handleSignIn-RuntimeError-001',\n        'nextjs',\n      );\n    }\n\n    const result: any = await signIn(payload, request);\n\n    // Redirect based flow URL is sent as `signInUrl` in the response.\n    // Use window.location.href instead of router.push() — the OAuth authorization\n    // endpoint is on an external server, and router.push() would send RSC fetch\n    // headers that the identity provider doesn't understand, causing a CORS error.\n    if (result?.data?.signInUrl) {\n      window.location.href = result.data.signInUrl;\n\n      return undefined;\n    }\n\n    // After the Embedded flow is successful, the URL to navigate next is sent as `afterSignInUrl` in the response.\n    if (result?.data?.afterSignInUrl) {\n      router.push(result.data.afterSignInUrl);\n\n      return undefined;\n    }\n\n    if (result?.error) {\n      throw new Error(result.error);\n    }\n\n    return result?.data ?? result;\n  };\n\n  const handleSignUp = async (payload: any, request: EmbeddedFlowExecuteRequestConfig): Promise<any> => {\n    if (!signUp) {\n      throw new ThunderIDRuntimeError(\n        '`signUp` function is not available.',\n        'ThunderIDClientProvider-handleSignUp-RuntimeError-001',\n        'nextjs',\n      );\n    }\n\n    const result: any = await signUp(payload, request);\n\n    // Redirect based flow URL is sent as `signUpUrl` in the response.\n    if (result?.data?.signUpUrl) {\n      router.push(result.data.signUpUrl);\n\n      return undefined;\n    }\n\n    // After the Embedded flow is successful, the URL to navigate next is sent as `afterSignUpUrl` in the response.\n    if (result?.data?.afterSignUpUrl) {\n      router.push(result.data.afterSignUpUrl);\n\n      return undefined;\n    }\n\n    if (result?.error) {\n      throw new Error(result.error);\n    }\n\n    return result?.data ?? result;\n  };\n\n  const handleSignOut = async (): Promise<any> => {\n    logger.debug('[ThunderIDClientProvider][handleSignOut] `handleSignOut` called.');\n\n    try {\n      const result: any = await signOut();\n\n      logger.debug('[ThunderIDClientProvider][handleSignOut] Sign out result:', result);\n\n      if (result?.data?.afterSignOutUrl) {\n        router.push(result.data.afterSignOutUrl);\n\n        return {location: result.data.afterSignOutUrl, redirected: true};\n      }\n\n      if (result?.error) {\n        logger.error(\n          '[ThunderIDClientProvider][handleSignOut] Error result was returned during signing the user out with a button click:',\n          result.error,\n        );\n      }\n\n      return result?.data ?? result;\n    } catch (error) {\n      logger.error(\n        '[ThunderIDClientProvider][handleSignOut] Error occurred during signing the user out with a button click:',\n        error,\n      );\n\n      return undefined;\n    }\n  };\n\n  const contextValue: ThunderIDContextProps = useMemo(\n    () => ({\n      applicationId,\n      baseUrl,\n      clearSession,\n      isLoading,\n      isSignedIn,\n      organizationHandle,\n      preferences,\n      refreshToken,\n      scopes,\n      signIn: handleSignIn,\n      signInUrl,\n      signOut: handleSignOut,\n      signUp: handleSignUp,\n      signUpUrl,\n      user,\n    }),\n    [\n      baseUrl,\n      user,\n      isSignedIn,\n      isLoading,\n      signInUrl,\n      signUpUrl,\n      applicationId,\n      organizationHandle,\n      scopes,\n      preferences,\n    ],\n  );\n\n  const handleProfileUpdate = (payload: User): void => {\n    setUser(payload);\n    setUserProfile((prev: UserProfile) => ({\n      ...prev,\n      flattenedProfile: generateFlattenedUserProfile(payload),\n      profile: payload,\n    }));\n  };\n\n  // Bridge into @thunderid/react's own ThunderIDContext. Internal react components rendered by\n  // BaseSignIn/BaseSignUp — most notably FlowMetaProvider, which fetches `/flow/meta` and injects\n  // its i18n bundle — call react's `useThunderID()` directly. Without this bridge they'd only see\n  // react's context default (applicationId/baseUrl undefined, isInitialized false), so the meta\n  // fetch would never fire and flow labels would render as untranslated i18n keys. Fields with no\n  // nextjs equivalent (token/http helpers meant for direct browser API calls) are stubbed out,\n  // since nextjs routes those operations through server actions instead.\n  const unsupported = (name: string): (() => Promise<never>) => {\n    return () =>\n      Promise.reject(\n        new ThunderIDRuntimeError(\n          `\\`${name}\\` is not supported in @thunderid/nextjs.`,\n          `ThunderIDClientProvider-${name}-NotSupportedError-001`,\n          'nextjs',\n        ),\n      );\n  };\n\n  const reactContextValue: ReactThunderIDContextProps = useMemo(\n    () => ({\n      afterSignInUrl: undefined,\n      applicationId,\n      baseUrl,\n      clearSession,\n      clientId: undefined,\n      discovery: {wellKnown: null},\n      exchangeToken: unsupported('exchangeToken'),\n      getAccessToken: unsupported('getAccessToken'),\n      getDecodedIdToken: unsupported('getDecodedIdToken'),\n      getIdToken: unsupported('getIdToken'),\n      getStorageManager: () => Promise.resolve(null),\n      http: {\n        request: unsupported('http.request'),\n        requestAll: unsupported('http.requestAll'),\n      },\n      instanceId: 0,\n      isInitialized: !isLoading,\n      isLoading,\n      isMetaLoading: false,\n      isSignedIn,\n      meta: initialMeta ?? null,\n      organizationHandle,\n      reInitialize: unsupported('reInitialize'),\n      recover: unsupported('recover'),\n      resolveFlowTemplateLiterals: (text: string | undefined): string => text ?? '',\n      scopes,\n      signIn: handleSignIn,\n      signInSilently: unsupported('signInSilently'),\n      signInUrl,\n      signOut: handleSignOut,\n      signUp: handleSignUp,\n      signUpUrl,\n      user,\n      userSchema,\n      vendor: getVendorPrefix(vendor),\n    }),\n    [\n      applicationId,\n      baseUrl,\n      clearSession,\n      isLoading,\n      isSignedIn,\n      organizationHandle,\n      scopes,\n      signInUrl,\n      signUpUrl,\n      user,\n      userSchema,\n      initialMeta,\n      vendor,\n    ],\n  );\n\n  return (\n    <ThunderIDContext.Provider value={contextValue}>\n      <ReactThunderIDContext.Provider value={reactContextValue}>\n        <I18nProvider preferences={preferences?.i18n}>\n          <FlowMetaProvider\n            enabled={preferences?.resolveFromMeta !== false}\n            initialMeta={initialMeta}\n            fetchMeta={fetchMeta}\n          >\n            <ThemeProvider theme={preferences?.theme?.overrides} mode={preferences?.theme?.mode}>\n              <FlowProvider>\n                <UserProvider\n                  profile={userProfile}\n                  userSchema={userSchema}\n                  onUpdateProfile={handleProfileUpdate}\n                  updateProfile={updateProfile}\n                >\n                  {children}\n                </UserProvider>\n              </FlowProvider>\n            </ThemeProvider>\n          </FlowMetaProvider>\n        </I18nProvider>\n      </ReactThunderIDContext.Provider>\n    </ThunderIDContext.Provider>\n  );\n};\n\nexport default ThunderIDClientProvider;\n"],"mappings":";;;;;;;;;;;;AAyEA,MAAMA,2BAAgF,EACpF,SACA,UACA,QACA,cACA,cACA,SACA,QACA,qBACA,aACA,YACA,WACA,WACA,MAAM,OACN,aAAa,cACb,YAAY,cAAc,MAC1B,eACA,eACA,oBACA,QACA,QACA,cAAc,MACd,gBACqD;CACrD,MAAMC,mBAAuC,OAAO,MAAM;CAC1D,MAAMC,SAA4B,WAAW;CAC7C,MAAMC,eAAwC,iBAAiB;CAC/D,MAAM,CAAC,WAAW,gBAAgB,SAAkB,KAAK;CACzD,MAAM,CAAC,MAAM,WAAW,SAAsB,MAAM;CACpD,MAAM,CAAC,aAAa,kBAAkB,SAAsB,aAAa;CACzE,MAAM,CAAC,YAAY,iBAAiB,SAAiD,YAAY;AAEjG,iBAAgB;AACd,iBAAe,aAAa;IAC3B,CAAC,aAAa,CAAC;AAElB,iBAAgB;AACd,gBAAc,YAAY;IACzB,CAAC,YAAY,CAAC;AAEjB,iBAAgB;AACd,UAAQ,MAAM;IACb,CAAC,MAAM,CAAC;AAGX,iBAAgB;AAOd,MAAI,iBAAiB,QACnB;AAGF,mBAAiB,UAAU;AAG3B,MAAI,WAAY;AAEhB,GAAC,YAA2B;AAC1B,OAAI;IACF,MAAMC,OAAsB,aAAa,IAAI,OAAO;IACpD,MAAMC,QAAuB,aAAa,IAAI,QAAQ;AAItD,QAH6B,aAAa,IAAI,QAAQ,EAG3C;AACT,oBAAO,MAAM,qFAAqF;AAElG;;AAIF,QAAI,QAAQ,OAAO;AACjB,kBAAa,KAAK;KAElB,MAAMC,SAAmE,MAAM,oBAC7E,MACA,MACD;AAED,SAAI,OAAO,QAET,KAAI,OAAO,YACT,QAAO,KAAK,OAAO,YAAY;SAG/B,QAAO,SAAS,QAAQ;SAG1B,gBAAO,MACL,iEAAiE,OAAO,SAAS,0BAClF;;YAGE,OAAO;AACd,mBAAO,MAAM,8DAA8D,MAAM;;MAEjF;IACH,EAAE,CAAC;AAEN,iBAAgB;AAEd,eAAa,MAAM;IAClB,CAAC,YAAY,KAAK,CAAC;CAEtB,MAAM,eAAe,OAAO,SAAc,YAA4D;AACpG,MAAI,CAAC,OACH,OAAM,IAAI,sBACR,uCACA,yDACA,SACD;EAGH,MAAMC,SAAc,MAAM,OAAO,SAAS,QAAQ;AAMlD,MAAI,QAAQ,MAAM,WAAW;AAC3B,UAAO,SAAS,OAAO,OAAO,KAAK;AAEnC;;AAIF,MAAI,QAAQ,MAAM,gBAAgB;AAChC,UAAO,KAAK,OAAO,KAAK,eAAe;AAEvC;;AAGF,MAAI,QAAQ,MACV,OAAM,IAAI,MAAM,OAAO,MAAM;AAG/B,SAAO,QAAQ,QAAQ;;CAGzB,MAAM,eAAe,OAAO,SAAc,YAA4D;AACpG,MAAI,CAAC,OACH,OAAM,IAAI,sBACR,uCACA,yDACA,SACD;EAGH,MAAMA,SAAc,MAAM,OAAO,SAAS,QAAQ;AAGlD,MAAI,QAAQ,MAAM,WAAW;AAC3B,UAAO,KAAK,OAAO,KAAK,UAAU;AAElC;;AAIF,MAAI,QAAQ,MAAM,gBAAgB;AAChC,UAAO,KAAK,OAAO,KAAK,eAAe;AAEvC;;AAGF,MAAI,QAAQ,MACV,OAAM,IAAI,MAAM,OAAO,MAAM;AAG/B,SAAO,QAAQ,QAAQ;;CAGzB,MAAM,gBAAgB,YAA0B;AAC9C,iBAAO,MAAM,mEAAmE;AAEhF,MAAI;GACF,MAAMA,SAAc,MAAM,SAAS;AAEnC,kBAAO,MAAM,6DAA6D,OAAO;AAEjF,OAAI,QAAQ,MAAM,iBAAiB;AACjC,WAAO,KAAK,OAAO,KAAK,gBAAgB;AAExC,WAAO;KAAC,UAAU,OAAO,KAAK;KAAiB,YAAY;KAAK;;AAGlE,OAAI,QAAQ,MACV,gBAAO,MACL,uHACA,OAAO,MACR;AAGH,UAAO,QAAQ,QAAQ;WAChB,OAAO;AACd,kBAAO,MACL,4GACA,MACD;AAED;;;CAIJ,MAAMC,eAAsC,eACnC;EACL;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA,QAAQ;EACR;EACA,SAAS;EACT,QAAQ;EACR;EACA;EACD,GACD;EACE;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACD,CACF;CAED,MAAM,uBAAuB,YAAwB;AACnD,UAAQ,QAAQ;AAChB,kBAAgB,UAAuB;GACrC,GAAG;GACH,kBAAkB,6BAA6B,QAAQ;GACvD,SAAS;GACV,EAAE;;CAUL,MAAM,eAAe,SAAyC;AAC5D,eACE,QAAQ,OACN,IAAI,sBACF,KAAK,KAAK,4CACV,2BAA2B,KAAK,yBAChC,SACD,CACF;;CAGL,MAAMC,oBAAgD,eAC7C;EACL,gBAAgB;EAChB;EACA;EACA;EACA,UAAU;EACV,WAAW,EAAC,WAAW,MAAK;EAC5B,eAAe,YAAY,gBAAgB;EAC3C,gBAAgB,YAAY,iBAAiB;EAC7C,mBAAmB,YAAY,oBAAoB;EACnD,YAAY,YAAY,aAAa;EACrC,yBAAyB,QAAQ,QAAQ,KAAK;EAC9C,MAAM;GACJ,SAAS,YAAY,eAAe;GACpC,YAAY,YAAY,kBAAkB;GAC3C;EACD,YAAY;EACZ,eAAe,CAAC;EAChB;EACA,eAAe;EACf;EACA,MAAM,eAAe;EACrB;EACA,cAAc,YAAY,eAAe;EACzC,SAAS,YAAY,UAAU;EAC/B,8BAA8B,SAAqC,QAAQ;EAC3E;EACA,QAAQ;EACR,gBAAgB,YAAY,iBAAiB;EAC7C;EACA,SAAS;EACT,QAAQ;EACR;EACA;EACA;EACA,QAAQ,gBAAgB,OAAO;EAChC,GACD;EACE;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACD,CACF;AAED,QACE,oBAACC,yBAAiB;EAAS,OAAO;YAChC,oBAACC,iBAAsB;GAAS,OAAO;aACrC,oBAAC;IAAa,aAAa,aAAa;cACtC,oBAAC;KACC,SAAS,aAAa,oBAAoB;KAC7B;KACF;eAEX,oBAAC;MAAc,OAAO,aAAa,OAAO;MAAW,MAAM,aAAa,OAAO;gBAC7E,oBAAC,0BACC,oBAAC;OACC,SAAS;OACG;OACZ,iBAAiB;OACF;OAEd;QACY,GACF;OACD;MACC;KACN;IACgB;GACP;;AAIhC,gCAAe"}
+{"version":3,"file":"ThunderIDProvider.js","names":["ThunderIDClientProvider: FC<PropsWithChildren<ThunderIDClientProviderProps>>","reRenderCheckRef: RefObject<boolean>","router: AppRouterInstance","searchParams: ReadonlyURLSearchParams","code: string | null","state: string | null","result: {error?: string; redirectUrl?: string; success: boolean}","result: any","contextValue: ThunderIDContextProps","reactContextValue: ReactThunderIDContextProps","ThunderIDContext","ReactThunderIDContext","fetchFlowMetaFromServer"],"sources":["../../../../src/client/contexts/ThunderID/ThunderIDProvider.tsx"],"sourcesContent":["// Copyright 2025 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\n'use client';\n\nimport {\n  AttributeSchema,\n  EmbeddedFlowExecuteRequestConfig,\n  FlowMetadataResponse,\n  generateFlattenedUserProfile,\n  UpdateMeProfileConfig,\n  User,\n  UserProfile,\n  ThunderIDRuntimeError,\n  getVendorPrefix,\n} from '@thunderid/node';\nimport {\n  I18nProvider,\n  FlowMetaProvider,\n  FlowProvider,\n  UserProvider,\n  ThemeProvider,\n  ThunderIDContext as ReactThunderIDContext,\n  ThunderIDContextProps as ReactThunderIDContextProps,\n  ThunderIDProviderProps,\n} from '@thunderid/react';\nimport {ReadonlyURLSearchParams} from 'next/dist/client/components/navigation.react-server';\nimport {AppRouterInstance} from 'next/dist/shared/lib/app-router-context.shared-runtime';\nimport {useRouter, useSearchParams} from 'next/navigation';\nimport {FC, PropsWithChildren, RefObject, useEffect, useMemo, useRef, useState} from 'react';\nimport ThunderIDContext, {ThunderIDContextProps} from './ThunderIDContext';\nimport {RefreshResult} from '../../../server/actions/refreshToken';\nimport logger from '../../../utils/logger';\nimport fetchFlowMetaFromServer from '../../fetchFlowMetaFromServer';\n\n/**\n * Props interface of {@link ThunderIDClientProvider}\n */\nexport type ThunderIDClientProviderProps = Partial<Omit<ThunderIDProviderProps, 'baseUrl' | 'clientId'>> &\n  Pick<ThunderIDProviderProps, 'baseUrl' | 'clientId'> & {\n    applicationId: ThunderIDContextProps['applicationId'];\n    clearSession: () => Promise<void>;\n    handleOAuthCallback: (\n      code: string,\n      state: string,\n    ) => Promise<{error?: string; redirectUrl?: string; success: boolean}>;\n    /**\n     * Flow metadata fetched server-side ahead of time, seeding `FlowMetaProvider` so it can skip\n     * its own initial client-side fetch (avoiding a flash of untranslated i18n keys).\n     */\n    initialMeta?: FlowMetadataResponse | null;\n    isSignedIn: boolean;\n    organizationHandle: ThunderIDContextProps['organizationHandle'];\n    refreshToken: () => Promise<RefreshResult>;\n    signIn: ThunderIDContextProps['signIn'];\n    signOut: ThunderIDContextProps['signOut'];\n    signUp: ThunderIDContextProps['signUp'];\n    updateProfile: (\n      requestConfig: UpdateMeProfileConfig,\n      sessionId?: string,\n    ) => Promise<{data: {user: User}; error: string; success: boolean}>;\n    user: User | null;\n    userProfile: UserProfile;\n    userSchema?: Record<string, AttributeSchema> | null;\n  };\n\nconst ThunderIDClientProvider: FC<PropsWithChildren<ThunderIDClientProviderProps>> = ({\n  baseUrl,\n  children,\n  signIn,\n  clearSession,\n  refreshToken,\n  signOut,\n  signUp,\n  handleOAuthCallback,\n  preferences,\n  isSignedIn,\n  signInUrl,\n  signUpUrl,\n  user: _user,\n  userProfile: _userProfile,\n  userSchema: _userSchema = null,\n  updateProfile,\n  applicationId,\n  organizationHandle,\n  scopes,\n  vendor,\n  initialMeta = null,\n}: PropsWithChildren<ThunderIDClientProviderProps>) => {\n  const reRenderCheckRef: RefObject<boolean> = useRef(false);\n  const router: AppRouterInstance = useRouter();\n  const searchParams: ReadonlyURLSearchParams = useSearchParams();\n  const [isLoading, setIsLoading] = useState<boolean>(true);\n  const [user, setUser] = useState<User | null>(_user);\n  const [userProfile, setUserProfile] = useState<UserProfile>(_userProfile);\n  const [userSchema, setUserSchema] = useState<Record<string, AttributeSchema> | null>(_userSchema);\n\n  useEffect(() => {\n    setUserProfile(_userProfile);\n  }, [_userProfile]);\n\n  useEffect(() => {\n    setUserSchema(_userSchema);\n  }, [_userSchema]);\n\n  useEffect(() => {\n    setUser(_user);\n  }, [_user]);\n\n  // Handle OAuth callback automatically\n  useEffect(() => {\n    // React 18.x Strict.Mode has a new check for `Ensuring reusable state` to facilitate an upcoming react feature.\n    // https://reactjs.org/docs/strict-mode.html#ensuring-reusable-state\n    // This will remount all the useEffects to ensure that there are no unexpected side effects.\n    // When react remounts the signIn hook of the AuthProvider, it will cause a race condition. Hence, we have to\n    // prevent the re-render of this hook as suggested in the following discussion.\n    // https://github.com/reactwg/react-18/discussions/18#discussioncomment-795623\n    if (reRenderCheckRef.current) {\n      return;\n    }\n\n    reRenderCheckRef.current = true;\n\n    // Don't handle callback if already signed in\n    if (isSignedIn) return;\n\n    (async (): Promise<void> => {\n      try {\n        const code: string | null = searchParams.get('code');\n        const state: string | null = searchParams.get('state');\n        const error: string | null = searchParams.get('error');\n\n        // Check for OAuth errors first\n        if (error) {\n          logger.error('[ThunderIDClientProvider] An error was received for the initiated sign-in request.');\n\n          return;\n        }\n\n        // Handle OAuth callback if code and state are present\n        if (code && state) {\n          setIsLoading(true);\n\n          const result: {error?: string; redirectUrl?: string; success: boolean} = await handleOAuthCallback(\n            code,\n            state,\n          );\n\n          if (result.success) {\n            // Redirect to the success URL\n            if (result.redirectUrl) {\n              router.push(result.redirectUrl);\n            } else {\n              // Refresh the page to update authentication state\n              window.location.reload();\n            }\n          } else {\n            logger.error(\n              `[ThunderIDClientProvider] An error occurred while signing in: ${result.error || 'Authentication failed'}`,\n            );\n          }\n        }\n      } catch (error) {\n        logger.error('[ThunderIDClientProvider] Failed to handle OAuth callback:', error);\n      }\n    })();\n  }, []);\n\n  useEffect(() => {\n    // Set loading to false when server has resolved authentication state\n    setIsLoading(false);\n  }, [isSignedIn, user]);\n\n  const handleSignIn = async (payload: any, request: EmbeddedFlowExecuteRequestConfig): Promise<any> => {\n    if (!signIn) {\n      throw new ThunderIDRuntimeError(\n        '`signIn` function is not available.',\n        'ThunderIDClientProvider-handleSignIn-RuntimeError-001',\n        'nextjs',\n      );\n    }\n\n    const result: any = await signIn(payload, request);\n\n    // Redirect based flow URL is sent as `signInUrl` in the response.\n    // Use window.location.href instead of router.push() — the OAuth authorization\n    // endpoint is on an external server, and router.push() would send RSC fetch\n    // headers that the identity provider doesn't understand, causing a CORS error.\n    if (result?.data?.signInUrl) {\n      window.location.href = result.data.signInUrl;\n\n      return undefined;\n    }\n\n    // After the Embedded flow is successful, the URL to navigate next is sent as `afterSignInUrl` in the response.\n    if (result?.data?.afterSignInUrl) {\n      router.push(result.data.afterSignInUrl);\n\n      return undefined;\n    }\n\n    if (result?.error) {\n      throw new Error(result.error);\n    }\n\n    return result?.data ?? result;\n  };\n\n  const handleSignUp = async (payload: any, request: EmbeddedFlowExecuteRequestConfig): Promise<any> => {\n    if (!signUp) {\n      throw new ThunderIDRuntimeError(\n        '`signUp` function is not available.',\n        'ThunderIDClientProvider-handleSignUp-RuntimeError-001',\n        'nextjs',\n      );\n    }\n\n    const result: any = await signUp(payload, request);\n\n    // Redirect based flow URL is sent as `signUpUrl` in the response.\n    if (result?.data?.signUpUrl) {\n      router.push(result.data.signUpUrl);\n\n      return undefined;\n    }\n\n    // After the Embedded flow is successful, the URL to navigate next is sent as `afterSignUpUrl` in the response.\n    if (result?.data?.afterSignUpUrl) {\n      router.push(result.data.afterSignUpUrl);\n\n      return undefined;\n    }\n\n    if (result?.error) {\n      throw new Error(result.error);\n    }\n\n    return result?.data ?? result;\n  };\n\n  const handleSignOut = async (): Promise<any> => {\n    logger.debug('[ThunderIDClientProvider][handleSignOut] `handleSignOut` called.');\n\n    try {\n      const result: any = await signOut();\n\n      logger.debug('[ThunderIDClientProvider][handleSignOut] Sign out result:', result);\n\n      if (result?.data?.afterSignOutUrl) {\n        router.push(result.data.afterSignOutUrl);\n\n        return {location: result.data.afterSignOutUrl, redirected: true};\n      }\n\n      if (result?.error) {\n        logger.error(\n          '[ThunderIDClientProvider][handleSignOut] Error result was returned during signing the user out with a button click:',\n          result.error,\n        );\n      }\n\n      return result?.data ?? result;\n    } catch (error) {\n      logger.error(\n        '[ThunderIDClientProvider][handleSignOut] Error occurred during signing the user out with a button click:',\n        error,\n      );\n\n      return undefined;\n    }\n  };\n\n  const contextValue: ThunderIDContextProps = useMemo(\n    () => ({\n      applicationId,\n      baseUrl,\n      clearSession,\n      isLoading,\n      isSignedIn,\n      organizationHandle,\n      preferences,\n      refreshToken,\n      scopes,\n      signIn: handleSignIn,\n      signInUrl,\n      signOut: handleSignOut,\n      signUp: handleSignUp,\n      signUpUrl,\n      user,\n    }),\n    [\n      baseUrl,\n      user,\n      isSignedIn,\n      isLoading,\n      signInUrl,\n      signUpUrl,\n      applicationId,\n      organizationHandle,\n      scopes,\n      preferences,\n    ],\n  );\n\n  const handleProfileUpdate = (payload: User): void => {\n    setUser(payload);\n    setUserProfile((prev: UserProfile) => ({\n      ...prev,\n      flattenedProfile: generateFlattenedUserProfile(payload),\n      profile: payload,\n    }));\n  };\n\n  // Bridge into @thunderid/react's own ThunderIDContext. Internal react components rendered by\n  // BaseSignIn/BaseSignUp — most notably FlowMetaProvider, which fetches `/flow/meta` and injects\n  // its i18n bundle — call react's `useThunderID()` directly. Without this bridge they'd only see\n  // react's context default (applicationId/baseUrl undefined, isInitialized false), so the meta\n  // fetch would never fire and flow labels would render as untranslated i18n keys. Fields with no\n  // nextjs equivalent (token/http helpers meant for direct browser API calls) are stubbed out,\n  // since nextjs routes those operations through server actions instead.\n  const unsupported = (name: string): (() => Promise<never>) => {\n    return () =>\n      Promise.reject(\n        new ThunderIDRuntimeError(\n          `\\`${name}\\` is not supported in @thunderid/nextjs.`,\n          `ThunderIDClientProvider-${name}-NotSupportedError-001`,\n          'nextjs',\n        ),\n      );\n  };\n\n  const reactContextValue: ReactThunderIDContextProps = useMemo(\n    () => ({\n      afterSignInUrl: undefined,\n      applicationId,\n      baseUrl,\n      clearSession,\n      clientId: undefined,\n      discovery: {wellKnown: null},\n      exchangeToken: unsupported('exchangeToken'),\n      getAccessToken: unsupported('getAccessToken'),\n      getDecodedIdToken: unsupported('getDecodedIdToken'),\n      getIdToken: unsupported('getIdToken'),\n      getStorageManager: () => Promise.resolve(null),\n      http: {\n        request: unsupported('http.request'),\n        requestAll: unsupported('http.requestAll'),\n      },\n      instanceId: 0,\n      isInitialized: !isLoading,\n      isLoading,\n      isMetaLoading: false,\n      isSignedIn,\n      meta: initialMeta ?? null,\n      organizationHandle,\n      reInitialize: unsupported('reInitialize'),\n      recover: unsupported('recover'),\n      resolveFlowTemplateLiterals: (text: string | undefined): string => text ?? '',\n      scopes,\n      signIn: handleSignIn,\n      signInSilently: unsupported('signInSilently'),\n      signInUrl,\n      signOut: handleSignOut,\n      signUp: handleSignUp,\n      signUpUrl,\n      user,\n      userSchema,\n      vendor: getVendorPrefix(vendor),\n    }),\n    [\n      applicationId,\n      baseUrl,\n      clearSession,\n      isLoading,\n      isSignedIn,\n      organizationHandle,\n      scopes,\n      signInUrl,\n      signUpUrl,\n      user,\n      userSchema,\n      initialMeta,\n      vendor,\n    ],\n  );\n\n  return (\n    <ThunderIDContext.Provider value={contextValue}>\n      <ReactThunderIDContext.Provider value={reactContextValue}>\n        <I18nProvider preferences={preferences?.i18n}>\n          <FlowMetaProvider\n            enabled={preferences?.resolveFromMeta !== false}\n            initialMeta={initialMeta}\n            fetchMeta={fetchFlowMetaFromServer}\n          >\n            <ThemeProvider theme={preferences?.theme?.overrides} mode={preferences?.theme?.mode}>\n              <FlowProvider>\n                <UserProvider\n                  profile={userProfile}\n                  userSchema={userSchema}\n                  onUpdateProfile={handleProfileUpdate}\n                  updateProfile={updateProfile}\n                >\n                  {children}\n                </UserProvider>\n              </FlowProvider>\n            </ThemeProvider>\n          </FlowMetaProvider>\n        </I18nProvider>\n      </ReactThunderIDContext.Provider>\n    </ThunderIDContext.Provider>\n  );\n};\n\nexport default ThunderIDClientProvider;\n"],"mappings":";;;;;;;;;;;;;AAkEA,MAAMA,2BAAgF,EACpF,SACA,UACA,QACA,cACA,cACA,SACA,QACA,qBACA,aACA,YACA,WACA,WACA,MAAM,OACN,aAAa,cACb,YAAY,cAAc,MAC1B,eACA,eACA,oBACA,QACA,QACA,cAAc,WACuC;CACrD,MAAMC,mBAAuC,OAAO,MAAM;CAC1D,MAAMC,SAA4B,WAAW;CAC7C,MAAMC,eAAwC,iBAAiB;CAC/D,MAAM,CAAC,WAAW,gBAAgB,SAAkB,KAAK;CACzD,MAAM,CAAC,MAAM,WAAW,SAAsB,MAAM;CACpD,MAAM,CAAC,aAAa,kBAAkB,SAAsB,aAAa;CACzE,MAAM,CAAC,YAAY,iBAAiB,SAAiD,YAAY;AAEjG,iBAAgB;AACd,iBAAe,aAAa;IAC3B,CAAC,aAAa,CAAC;AAElB,iBAAgB;AACd,gBAAc,YAAY;IACzB,CAAC,YAAY,CAAC;AAEjB,iBAAgB;AACd,UAAQ,MAAM;IACb,CAAC,MAAM,CAAC;AAGX,iBAAgB;AAOd,MAAI,iBAAiB,QACnB;AAGF,mBAAiB,UAAU;AAG3B,MAAI,WAAY;AAEhB,GAAC,YAA2B;AAC1B,OAAI;IACF,MAAMC,OAAsB,aAAa,IAAI,OAAO;IACpD,MAAMC,QAAuB,aAAa,IAAI,QAAQ;AAItD,QAH6B,aAAa,IAAI,QAAQ,EAG3C;AACT,oBAAO,MAAM,qFAAqF;AAElG;;AAIF,QAAI,QAAQ,OAAO;AACjB,kBAAa,KAAK;KAElB,MAAMC,SAAmE,MAAM,oBAC7E,MACA,MACD;AAED,SAAI,OAAO,QAET,KAAI,OAAO,YACT,QAAO,KAAK,OAAO,YAAY;SAG/B,QAAO,SAAS,QAAQ;SAG1B,gBAAO,MACL,iEAAiE,OAAO,SAAS,0BAClF;;YAGE,OAAO;AACd,mBAAO,MAAM,8DAA8D,MAAM;;MAEjF;IACH,EAAE,CAAC;AAEN,iBAAgB;AAEd,eAAa,MAAM;IAClB,CAAC,YAAY,KAAK,CAAC;CAEtB,MAAM,eAAe,OAAO,SAAc,YAA4D;AACpG,MAAI,CAAC,OACH,OAAM,IAAI,sBACR,uCACA,yDACA,SACD;EAGH,MAAMC,SAAc,MAAM,OAAO,SAAS,QAAQ;AAMlD,MAAI,QAAQ,MAAM,WAAW;AAC3B,UAAO,SAAS,OAAO,OAAO,KAAK;AAEnC;;AAIF,MAAI,QAAQ,MAAM,gBAAgB;AAChC,UAAO,KAAK,OAAO,KAAK,eAAe;AAEvC;;AAGF,MAAI,QAAQ,MACV,OAAM,IAAI,MAAM,OAAO,MAAM;AAG/B,SAAO,QAAQ,QAAQ;;CAGzB,MAAM,eAAe,OAAO,SAAc,YAA4D;AACpG,MAAI,CAAC,OACH,OAAM,IAAI,sBACR,uCACA,yDACA,SACD;EAGH,MAAMA,SAAc,MAAM,OAAO,SAAS,QAAQ;AAGlD,MAAI,QAAQ,MAAM,WAAW;AAC3B,UAAO,KAAK,OAAO,KAAK,UAAU;AAElC;;AAIF,MAAI,QAAQ,MAAM,gBAAgB;AAChC,UAAO,KAAK,OAAO,KAAK,eAAe;AAEvC;;AAGF,MAAI,QAAQ,MACV,OAAM,IAAI,MAAM,OAAO,MAAM;AAG/B,SAAO,QAAQ,QAAQ;;CAGzB,MAAM,gBAAgB,YAA0B;AAC9C,iBAAO,MAAM,mEAAmE;AAEhF,MAAI;GACF,MAAMA,SAAc,MAAM,SAAS;AAEnC,kBAAO,MAAM,6DAA6D,OAAO;AAEjF,OAAI,QAAQ,MAAM,iBAAiB;AACjC,WAAO,KAAK,OAAO,KAAK,gBAAgB;AAExC,WAAO;KAAC,UAAU,OAAO,KAAK;KAAiB,YAAY;KAAK;;AAGlE,OAAI,QAAQ,MACV,gBAAO,MACL,uHACA,OAAO,MACR;AAGH,UAAO,QAAQ,QAAQ;WAChB,OAAO;AACd,kBAAO,MACL,4GACA,MACD;AAED;;;CAIJ,MAAMC,eAAsC,eACnC;EACL;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA,QAAQ;EACR;EACA,SAAS;EACT,QAAQ;EACR;EACA;EACD,GACD;EACE;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACD,CACF;CAED,MAAM,uBAAuB,YAAwB;AACnD,UAAQ,QAAQ;AAChB,kBAAgB,UAAuB;GACrC,GAAG;GACH,kBAAkB,6BAA6B,QAAQ;GACvD,SAAS;GACV,EAAE;;CAUL,MAAM,eAAe,SAAyC;AAC5D,eACE,QAAQ,OACN,IAAI,sBACF,KAAK,KAAK,4CACV,2BAA2B,KAAK,yBAChC,SACD,CACF;;CAGL,MAAMC,oBAAgD,eAC7C;EACL,gBAAgB;EAChB;EACA;EACA;EACA,UAAU;EACV,WAAW,EAAC,WAAW,MAAK;EAC5B,eAAe,YAAY,gBAAgB;EAC3C,gBAAgB,YAAY,iBAAiB;EAC7C,mBAAmB,YAAY,oBAAoB;EACnD,YAAY,YAAY,aAAa;EACrC,yBAAyB,QAAQ,QAAQ,KAAK;EAC9C,MAAM;GACJ,SAAS,YAAY,eAAe;GACpC,YAAY,YAAY,kBAAkB;GAC3C;EACD,YAAY;EACZ,eAAe,CAAC;EAChB;EACA,eAAe;EACf;EACA,MAAM,eAAe;EACrB;EACA,cAAc,YAAY,eAAe;EACzC,SAAS,YAAY,UAAU;EAC/B,8BAA8B,SAAqC,QAAQ;EAC3E;EACA,QAAQ;EACR,gBAAgB,YAAY,iBAAiB;EAC7C;EACA,SAAS;EACT,QAAQ;EACR;EACA;EACA;EACA,QAAQ,gBAAgB,OAAO;EAChC,GACD;EACE;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACD,CACF;AAED,QACE,oBAACC,yBAAiB;EAAS,OAAO;YAChC,oBAACC,iBAAsB;GAAS,OAAO;aACrC,oBAAC;IAAa,aAAa,aAAa;cACtC,oBAAC;KACC,SAAS,aAAa,oBAAoB;KAC7B;KACb,WAAWC;eAEX,oBAAC;MAAc,OAAO,aAAa,OAAO;MAAW,MAAM,aAAa,OAAO;gBAC7E,oBAAC,0BACC,oBAAC;OACC,SAAS;OACG;OACZ,iBAAiB;OACF;OAEd;QACY,GACF;OACD;MACC;KACN;IACgB;GACP;;AAIhC,gCAAe"}

package/dist/client/fetchAuthFlowsFromServer.d.ts

@@ -0,0 +1,9 @@
+import type { FetchAuthFlows } from '@thunderid/node';
+/**
+ * The loader behind `AuthFlowSelect`: loads authentication flows through {@link getAuthFlowsAction} with the
+ * signed-in user's server-held session. Requires an existing session. `request.signal` is not forwarded because
+ * an `AbortSignal` cannot cross the server action boundary.
+ */
+declare const fetchAuthFlowsFromServer: FetchAuthFlows;
+export default fetchAuthFlowsFromServer;
+//# sourceMappingURL=fetchAuthFlowsFromServer.d.ts.map

package/dist/client/fetchAuthFlowsFromServer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fetchAuthFlowsFromServer.d.ts","sourceRoot":"","sources":["../../src/client/fetchAuthFlowsFromServer.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAC,cAAc,EAAgC,MAAM,iBAAiB,CAAC;AAInF;;;;GAIG;AACH,QAAA,MAAM,wBAAwB,EAAE,cAC+D,CAAC;AAEhG,eAAe,wBAAwB,CAAC"}

package/dist/client/fetchAuthFlowsFromServer.js

@@ -0,0 +1,18 @@
+import loadPageFromAction_default from "./loadPageFromAction.js";
+import getAuthFlowsAction_default from "../server/actions/getAuthFlowsAction.js";
+
+//#region src/client/fetchAuthFlowsFromServer.ts
+/**
+* The loader behind `AuthFlowSelect`: loads authentication flows through {@link getAuthFlowsAction} with the
+* signed-in user's server-held session. Requires an existing session. `request.signal` is not forwarded because
+* an `AbortSignal` cannot cross the server action boundary.
+*/
+const fetchAuthFlowsFromServer = async ({ limit, offset }) => loadPageFromAction_default(await getAuthFlowsAction_default({
+	limit,
+	offset
+}), "getAuthFlowsAction-Error-001");
+var fetchAuthFlowsFromServer_default = fetchAuthFlowsFromServer;
+
+//#endregion
+export { fetchAuthFlowsFromServer_default as default };
+//# sourceMappingURL=fetchAuthFlowsFromServer.js.map

package/dist/client/fetchAuthFlowsFromServer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fetchAuthFlowsFromServer.js","names":["fetchAuthFlowsFromServer: FetchAuthFlows","loadPageFromAction","getAuthFlowsAction"],"sources":["../../src/client/fetchAuthFlowsFromServer.ts"],"sourcesContent":["// Copyright 2026 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\nimport type {FetchAuthFlows, SelectPage, SelectPageRequest} from '@thunderid/node';\nimport loadPageFromAction from './loadPageFromAction';\nimport getAuthFlowsAction from '../server/actions/getAuthFlowsAction';\n\n/**\n * The loader behind `AuthFlowSelect`: loads authentication flows through {@link getAuthFlowsAction} with the\n * signed-in user's server-held session. Requires an existing session. `request.signal` is not forwarded because\n * an `AbortSignal` cannot cross the server action boundary.\n */\nconst fetchAuthFlowsFromServer: FetchAuthFlows = async ({limit, offset}: SelectPageRequest): Promise<SelectPage> =>\n  loadPageFromAction(await getAuthFlowsAction({limit, offset}), 'getAuthFlowsAction-Error-001');\n\nexport default fetchAuthFlowsFromServer;\n"],"mappings":";;;;;;;;;AAYA,MAAMA,2BAA2C,OAAO,EAAC,OAAO,aAC9DC,2BAAmB,MAAMC,2BAAmB;CAAC;CAAO;CAAO,CAAC,EAAE,+BAA+B;AAE/F,uCAAe"}

package/dist/client/fetchFlowMetaFromServer.d.ts

@@ -0,0 +1,12 @@
+import { FlowMetadataResponse } from '@thunderid/node';
+/**
+ * The `fetchMeta` behind `FlowMetaProvider`: loads flow metadata through {@link getFlowMetaAction} so the browser
+ * never calls `baseUrl` directly, and throws the failure the action returned as an SDK error, which
+ * `FlowMetaProvider` reports through its `error` state.
+ */
+declare const fetchFlowMetaFromServer: (params: {
+    applicationId?: string;
+    language?: string;
+}) => Promise<FlowMetadataResponse>;
+export default fetchFlowMetaFromServer;
+//# sourceMappingURL=fetchFlowMetaFromServer.d.ts.map

package/dist/client/fetchFlowMetaFromServer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fetchFlowMetaFromServer.d.ts","sourceRoot":"","sources":["../../src/client/fetchFlowMetaFromServer.ts"],"names":[],"mappings":"AAGA,OAAO,EAAC,oBAAoB,EAA2C,MAAM,iBAAiB,CAAC;AAG/F;;;;GAIG;AACH,QAAA,MAAM,uBAAuB,GAAU,QAAQ;IAC7C,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,KAAG,OAAO,CAAC,oBAAoB,CAY/B,CAAC;AAEF,eAAe,uBAAuB,CAAC"}

package/dist/client/fetchFlowMetaFromServer.js

@@ -0,0 +1,20 @@
+import getFlowMetaAction_default from "../server/actions/getFlowMetaAction.js";
+import { ThunderIDAPIError, ThunderIDRuntimeError } from "@thunderid/node";
+
+//#region src/client/fetchFlowMetaFromServer.ts
+/**
+* The `fetchMeta` behind `FlowMetaProvider`: loads flow metadata through {@link getFlowMetaAction} so the browser
+* never calls `baseUrl` directly, and throws the failure the action returned as an SDK error, which
+* `FlowMetaProvider` reports through its `error` state.
+*/
+const fetchFlowMetaFromServer = async (params) => {
+	const result = await getFlowMetaAction_default(params);
+	if (result.success) return result.meta;
+	if (result.statusCode !== void 0) throw new ThunderIDAPIError(result.message, "getFlowMetaAction-Error-001", "nextjs", result.statusCode);
+	throw new ThunderIDRuntimeError(result.message, "getFlowMetaAction-Error-001", "nextjs");
+};
+var fetchFlowMetaFromServer_default = fetchFlowMetaFromServer;
+
+//#endregion
+export { fetchFlowMetaFromServer_default as default };
+//# sourceMappingURL=fetchFlowMetaFromServer.js.map

package/dist/client/fetchFlowMetaFromServer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fetchFlowMetaFromServer.js","names":["result: GetFlowMetaActionResult","getFlowMetaAction"],"sources":["../../src/client/fetchFlowMetaFromServer.ts"],"sourcesContent":["// Copyright 2026 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\nimport {FlowMetadataResponse, ThunderIDAPIError, ThunderIDRuntimeError} from '@thunderid/node';\nimport getFlowMetaAction, {GetFlowMetaActionResult} from '../server/actions/getFlowMetaAction';\n\n/**\n * The `fetchMeta` behind `FlowMetaProvider`: loads flow metadata through {@link getFlowMetaAction} so the browser\n * never calls `baseUrl` directly, and throws the failure the action returned as an SDK error, which\n * `FlowMetaProvider` reports through its `error` state.\n */\nconst fetchFlowMetaFromServer = async (params: {\n  applicationId?: string;\n  language?: string;\n}): Promise<FlowMetadataResponse> => {\n  const result: GetFlowMetaActionResult = await getFlowMetaAction(params);\n\n  if (result.success) {\n    return result.meta;\n  }\n\n  if (result.statusCode !== undefined) {\n    throw new ThunderIDAPIError(result.message, 'getFlowMetaAction-Error-001', 'nextjs', result.statusCode);\n  }\n\n  throw new ThunderIDRuntimeError(result.message, 'getFlowMetaAction-Error-001', 'nextjs');\n};\n\nexport default fetchFlowMetaFromServer;\n"],"mappings":";;;;;;;;;AAWA,MAAM,0BAA0B,OAAO,WAGF;CACnC,MAAMA,SAAkC,MAAMC,0BAAkB,OAAO;AAEvE,KAAI,OAAO,QACT,QAAO,OAAO;AAGhB,KAAI,OAAO,eAAe,OACxB,OAAM,IAAI,kBAAkB,OAAO,SAAS,+BAA+B,UAAU,OAAO,WAAW;AAGzG,OAAM,IAAI,sBAAsB,OAAO,SAAS,+BAA+B,SAAS;;AAG1F,sCAAe"}

package/dist/client/fetchUserTypesFromServer.d.ts

@@ -0,0 +1,9 @@
+import type { FetchUserTypes } from '@thunderid/node';
+/**
+ * The loader behind `UserTypeSelect`: loads user types through {@link getUserTypesAction} with the signed-in
+ * user's server-held session. Requires an existing session. `request.signal` is not forwarded because an
+ * `AbortSignal` cannot cross the server action boundary.
+ */
+declare const fetchUserTypesFromServer: FetchUserTypes;
+export default fetchUserTypesFromServer;
+//# sourceMappingURL=fetchUserTypesFromServer.d.ts.map

package/dist/client/fetchUserTypesFromServer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fetchUserTypesFromServer.d.ts","sourceRoot":"","sources":["../../src/client/fetchUserTypesFromServer.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAC,cAAc,EAAgC,MAAM,iBAAiB,CAAC;AAInF;;;;GAIG;AACH,QAAA,MAAM,wBAAwB,EAAE,cAC+D,CAAC;AAEhG,eAAe,wBAAwB,CAAC"}

package/dist/client/fetchUserTypesFromServer.js

@@ -0,0 +1,18 @@
+import loadPageFromAction_default from "./loadPageFromAction.js";
+import getUserTypesAction_default from "../server/actions/getUserTypesAction.js";
+
+//#region src/client/fetchUserTypesFromServer.ts
+/**
+* The loader behind `UserTypeSelect`: loads user types through {@link getUserTypesAction} with the signed-in
+* user's server-held session. Requires an existing session. `request.signal` is not forwarded because an
+* `AbortSignal` cannot cross the server action boundary.
+*/
+const fetchUserTypesFromServer = async ({ limit, offset }) => loadPageFromAction_default(await getUserTypesAction_default({
+	limit,
+	offset
+}), "getUserTypesAction-Error-001");
+var fetchUserTypesFromServer_default = fetchUserTypesFromServer;
+
+//#endregion
+export { fetchUserTypesFromServer_default as default };
+//# sourceMappingURL=fetchUserTypesFromServer.js.map

package/dist/client/fetchUserTypesFromServer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fetchUserTypesFromServer.js","names":["fetchUserTypesFromServer: FetchUserTypes","loadPageFromAction","getUserTypesAction"],"sources":["../../src/client/fetchUserTypesFromServer.ts"],"sourcesContent":["// Copyright 2026 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\nimport type {FetchUserTypes, SelectPage, SelectPageRequest} from '@thunderid/node';\nimport loadPageFromAction from './loadPageFromAction';\nimport getUserTypesAction from '../server/actions/getUserTypesAction';\n\n/**\n * The loader behind `UserTypeSelect`: loads user types through {@link getUserTypesAction} with the signed-in\n * user's server-held session. Requires an existing session. `request.signal` is not forwarded because an\n * `AbortSignal` cannot cross the server action boundary.\n */\nconst fetchUserTypesFromServer: FetchUserTypes = async ({limit, offset}: SelectPageRequest): Promise<SelectPage> =>\n  loadPageFromAction(await getUserTypesAction({limit, offset}), 'getUserTypesAction-Error-001');\n\nexport default fetchUserTypesFromServer;\n"],"mappings":";;;;;;;;;AAYA,MAAMA,2BAA2C,OAAO,EAAC,OAAO,aAC9DC,2BAAmB,MAAMC,2BAAmB;CAAC;CAAO;CAAO,CAAC,EAAE,+BAA+B;AAE/F,uCAAe"}

package/dist/client/fetchUsersFromServer.d.ts

@@ -0,0 +1,8 @@
+import type { FetchUsers } from '@thunderid/node';
+/**
+ * The loader behind `UserSelect`: loads users through {@link getUsersAction} with the signed-in user's server-held session.
+ * Requires an existing session. `request.signal` is not forwarded because an `AbortSignal` cannot cross the server action boundary.
+ */
+declare const fetchUsersFromServer: FetchUsers;
+export default fetchUsersFromServer;
+//# sourceMappingURL=fetchUsersFromServer.d.ts.map

package/dist/client/fetchUsersFromServer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fetchUsersFromServer.d.ts","sourceRoot":"","sources":["../../src/client/fetchUsersFromServer.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAC,UAAU,EAAgC,MAAM,iBAAiB,CAAC;AAI/E;;;GAGG;AACH,QAAA,MAAM,oBAAoB,EAAE,UACmE,CAAC;AAEhG,eAAe,oBAAoB,CAAC"}

package/dist/client/fetchUsersFromServer.js

@@ -0,0 +1,18 @@
+import loadPageFromAction_default from "./loadPageFromAction.js";
+import getUsersAction_default from "../server/actions/getUsersAction.js";
+
+//#region src/client/fetchUsersFromServer.ts
+/**
+* The loader behind `UserSelect`: loads users through {@link getUsersAction} with the signed-in user's server-held session.
+* Requires an existing session. `request.signal` is not forwarded because an `AbortSignal` cannot cross the server action boundary.
+*/
+const fetchUsersFromServer = async ({ filter, limit, offset }) => loadPageFromAction_default(await getUsersAction_default({
+	filter,
+	limit,
+	offset
+}), "getUsersAction-Error-001");
+var fetchUsersFromServer_default = fetchUsersFromServer;
+
+//#endregion
+export { fetchUsersFromServer_default as default };
+//# sourceMappingURL=fetchUsersFromServer.js.map

package/dist/client/fetchUsersFromServer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fetchUsersFromServer.js","names":["fetchUsersFromServer: FetchUsers","loadPageFromAction","getUsersAction"],"sources":["../../src/client/fetchUsersFromServer.ts"],"sourcesContent":["// Copyright 2026 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\nimport type {FetchUsers, SelectPage, SelectPageRequest} from '@thunderid/node';\nimport loadPageFromAction from './loadPageFromAction';\nimport getUsersAction from '../server/actions/getUsersAction';\n\n/**\n * The loader behind `UserSelect`: loads users through {@link getUsersAction} with the signed-in user's server-held session.\n * Requires an existing session. `request.signal` is not forwarded because an `AbortSignal` cannot cross the server action boundary.\n */\nconst fetchUsersFromServer: FetchUsers = async ({filter, limit, offset}: SelectPageRequest): Promise<SelectPage> =>\n  loadPageFromAction(await getUsersAction({filter, limit, offset}), 'getUsersAction-Error-001');\n\nexport default fetchUsersFromServer;\n"],"mappings":";;;;;;;;AAWA,MAAMA,uBAAmC,OAAO,EAAC,QAAQ,OAAO,aAC9DC,2BAAmB,MAAMC,uBAAe;CAAC;CAAQ;CAAO;CAAO,CAAC,EAAE,2BAA2B;AAE/F,mCAAe"}

package/dist/client/index.d.ts

@@ -23,4 +23,10 @@ export { default as UserProfile } from './components/presentation/UserProfile/Us
 export type { UserProfileProps } from './components/presentation/UserProfile/UserProfile';
 export { default as ChangeCredential } from './components/presentation/ChangeCredential/ChangeCredential';
 export type { ChangeCredentialProps } from './components/presentation/ChangeCredential/ChangeCredential';
+export { default as UserSelect } from './components/presentation/UserSelect/UserSelect';
+export type { UserSelectProps } from './components/presentation/UserSelect/UserSelect';
+export { default as AuthFlowSelect } from './components/presentation/AuthFlowSelect/AuthFlowSelect';
+export type { AuthFlowSelectProps } from './components/presentation/AuthFlowSelect/AuthFlowSelect';
+export { default as UserTypeSelect } from './components/presentation/UserTypeSelect/UserTypeSelect';
+export type { UserTypeSelectProps } from './components/presentation/UserTypeSelect/UserTypeSelect';
 //# sourceMappingURL=index.d.ts.map

package/dist/client/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/client/index.ts"],"names":[],"mappings":"AAGA,OAAO,EAAC,OAAO,IAAI,YAAY,EAAC,MAAM,mCAAmC,CAAC;AAE1E,OAAO,EAAC,OAAO,IAAI,QAAQ,EAAC,MAAM,wCAAwC,CAAC;AAC3E,YAAY,EAAC,aAAa,EAAC,MAAM,wCAAwC,CAAC;AAE1E,OAAO,EAAC,OAAO,IAAI,SAAS,EAAC,MAAM,0CAA0C,CAAC;AAC9E,YAAY,EAAC,cAAc,EAAC,MAAM,0CAA0C,CAAC;AAE7E,OAAO,EAAC,OAAO,IAAI,YAAY,EAAC,MAAM,gDAAgD,CAAC;AACvF,YAAY,EAAC,iBAAiB,EAAC,MAAM,gDAAgD,CAAC;AAEtF,OAAO,EAAC,OAAO,IAAI,YAAY,EAAC,MAAM,gDAAgD,CAAC;AACvF,YAAY,EAAC,iBAAiB,EAAC,MAAM,gDAAgD,CAAC;AAEtF,OAAO,EAAC,OAAO,IAAI,MAAM,EAAC,MAAM,yCAAyC,CAAC;AAC1E,YAAY,EAAC,WAAW,EAAC,MAAM,yCAAyC,CAAC;AAEzE,OAAO,EAAC,OAAO,IAAI,aAAa,EAAC,MAAM,kDAAkD,CAAC;AAC1F,YAAY,EAAC,kBAAkB,EAAC,MAAM,kDAAkD,CAAC;AAEzF,OAAO,EAAC,OAAO,IAAI,IAAI,EAAC,MAAM,qCAAqC,CAAC;AACpE,YAAY,EAAC,SAAS,EAAC,MAAM,qCAAqC,CAAC;AAEnE,OAAO,EAAC,OAAO,IAAI,MAAM,EAAC,MAAM,yCAAyC,CAAC;AAC1E,YAAY,EAAC,WAAW,EAAC,MAAM,yCAAyC,CAAC;AAEzE,OAAO,EAAC,OAAO,IAAI,YAAY,EAAC,MAAM,qDAAqD,CAAC;AAC5F,YAAY,EAAC,iBAAiB,EAAC,MAAM,qDAAqD,CAAC;AAE3F,OAAO,EAAC,OAAO,IAAI,UAAU,EAAC,MAAM,iDAAiD,CAAC;AACtF,YAAY,EAAC,eAAe,EAAC,MAAM,iDAAiD,CAAC;AAErF,OAAO,EAAC,OAAO,IAAI,WAAW,EAAC,MAAM,mDAAmD,CAAC;AACzF,YAAY,EAAC,gBAAgB,EAAC,MAAM,mDAAmD,CAAC;AAExF,OAAO,EAAC,OAAO,IAAI,gBAAgB,EAAC,MAAM,6DAA6D,CAAC;AACxG,YAAY,EAAC,qBAAqB,EAAC,MAAM,6DAA6D,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/client/index.ts"],"names":[],"mappings":"AAGA,OAAO,EAAC,OAAO,IAAI,YAAY,EAAC,MAAM,mCAAmC,CAAC;AAE1E,OAAO,EAAC,OAAO,IAAI,QAAQ,EAAC,MAAM,wCAAwC,CAAC;AAC3E,YAAY,EAAC,aAAa,EAAC,MAAM,wCAAwC,CAAC;AAE1E,OAAO,EAAC,OAAO,IAAI,SAAS,EAAC,MAAM,0CAA0C,CAAC;AAC9E,YAAY,EAAC,cAAc,EAAC,MAAM,0CAA0C,CAAC;AAE7E,OAAO,EAAC,OAAO,IAAI,YAAY,EAAC,MAAM,gDAAgD,CAAC;AACvF,YAAY,EAAC,iBAAiB,EAAC,MAAM,gDAAgD,CAAC;AAEtF,OAAO,EAAC,OAAO,IAAI,YAAY,EAAC,MAAM,gDAAgD,CAAC;AACvF,YAAY,EAAC,iBAAiB,EAAC,MAAM,gDAAgD,CAAC;AAEtF,OAAO,EAAC,OAAO,IAAI,MAAM,EAAC,MAAM,yCAAyC,CAAC;AAC1E,YAAY,EAAC,WAAW,EAAC,MAAM,yCAAyC,CAAC;AAEzE,OAAO,EAAC,OAAO,IAAI,aAAa,EAAC,MAAM,kDAAkD,CAAC;AAC1F,YAAY,EAAC,kBAAkB,EAAC,MAAM,kDAAkD,CAAC;AAEzF,OAAO,EAAC,OAAO,IAAI,IAAI,EAAC,MAAM,qCAAqC,CAAC;AACpE,YAAY,EAAC,SAAS,EAAC,MAAM,qCAAqC,CAAC;AAEnE,OAAO,EAAC,OAAO,IAAI,MAAM,EAAC,MAAM,yCAAyC,CAAC;AAC1E,YAAY,EAAC,WAAW,EAAC,MAAM,yCAAyC,CAAC;AAEzE,OAAO,EAAC,OAAO,IAAI,YAAY,EAAC,MAAM,qDAAqD,CAAC;AAC5F,YAAY,EAAC,iBAAiB,EAAC,MAAM,qDAAqD,CAAC;AAE3F,OAAO,EAAC,OAAO,IAAI,UAAU,EAAC,MAAM,iDAAiD,CAAC;AACtF,YAAY,EAAC,eAAe,EAAC,MAAM,iDAAiD,CAAC;AAErF,OAAO,EAAC,OAAO,IAAI,WAAW,EAAC,MAAM,mDAAmD,CAAC;AACzF,YAAY,EAAC,gBAAgB,EAAC,MAAM,mDAAmD,CAAC;AAExF,OAAO,EAAC,OAAO,IAAI,gBAAgB,EAAC,MAAM,6DAA6D,CAAC;AACxG,YAAY,EAAC,qBAAqB,EAAC,MAAM,6DAA6D,CAAC;AAEvG,OAAO,EAAC,OAAO,IAAI,UAAU,EAAC,MAAM,iDAAiD,CAAC;AACtF,YAAY,EAAC,eAAe,EAAC,MAAM,iDAAiD,CAAC;AAErF,OAAO,EAAC,OAAO,IAAI,cAAc,EAAC,MAAM,yDAAyD,CAAC;AAClG,YAAY,EAAC,mBAAmB,EAAC,MAAM,yDAAyD,CAAC;AAEjG,OAAO,EAAC,OAAO,IAAI,cAAc,EAAC,MAAM,yDAAyD,CAAC;AAClG,YAAY,EAAC,mBAAmB,EAAC,MAAM,yDAAyD,CAAC"}

package/dist/client/index.js

@@ -11,5 +11,8 @@ import UserProfile_default from "./components/presentation/UserProfile/UserProfi
 import UserDropdown_default from "./components/presentation/UserDropdown/UserDropdown.js";
 import UserAvatar_default from "./components/presentation/UserAvatar/UserAvatar.js";
 import ChangeCredential_default from "./components/presentation/ChangeCredential/ChangeCredential.js";
+import UserSelect_default from "./components/presentation/UserSelect/UserSelect.js";
+import AuthFlowSelect_default from "./components/presentation/AuthFlowSelect/AuthFlowSelect.js";
+import UserTypeSelect_default from "./components/presentation/UserTypeSelect/UserTypeSelect.js";
 
 export {  };

package/dist/client/loadPageFromAction.d.ts

@@ -0,0 +1,9 @@
+import type { SelectPage } from '@thunderid/node';
+import type { SelectPageActionResult } from '../server/actions/runSelectPageAction';
+/**
+ * Turns a select page server action result into a loader page, or throws the failure it carries. The message was built
+ * on the server from fixed words and the status, so it is safe to show to a developer.
+ */
+declare const loadPageFromAction: (result: SelectPageActionResult, errorCode: string) => SelectPage;
+export default loadPageFromAction;
+//# sourceMappingURL=loadPageFromAction.d.ts.map

package/dist/client/loadPageFromAction.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"loadPageFromAction.d.ts","sourceRoot":"","sources":["../../src/client/loadPageFromAction.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAC,UAAU,EAAC,MAAM,iBAAiB,CAAC;AAChD,OAAO,KAAK,EAAC,sBAAsB,EAAC,MAAM,uCAAuC,CAAC;AAElF;;;GAGG;AACH,QAAA,MAAM,kBAAkB,GAAI,QAAQ,sBAAsB,EAAE,WAAW,MAAM,KAAG,UAU/E,CAAC;AAEF,eAAe,kBAAkB,CAAC"}

package/dist/client/loadPageFromAction.js

@@ -0,0 +1,17 @@
+import { ThunderIDAPIError, ThunderIDRuntimeError } from "@thunderid/node";
+
+//#region src/client/loadPageFromAction.ts
+/**
+* Turns a select page server action result into a loader page, or throws the failure it carries. The message was built
+* on the server from fixed words and the status, so it is safe to show to a developer.
+*/
+const loadPageFromAction = (result, errorCode) => {
+	if (result.success) return result.page;
+	if (result.statusCode !== void 0) throw new ThunderIDAPIError(result.message, errorCode, "nextjs", result.statusCode);
+	throw new ThunderIDRuntimeError(result.message, errorCode, "nextjs");
+};
+var loadPageFromAction_default = loadPageFromAction;
+
+//#endregion
+export { loadPageFromAction_default as default };
+//# sourceMappingURL=loadPageFromAction.js.map

package/dist/client/loadPageFromAction.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"loadPageFromAction.js","names":[],"sources":["../../src/client/loadPageFromAction.ts"],"sourcesContent":["// Copyright 2026 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\nimport {ThunderIDAPIError, ThunderIDRuntimeError} from '@thunderid/node';\nimport type {SelectPage} from '@thunderid/node';\nimport type {SelectPageActionResult} from '../server/actions/runSelectPageAction';\n\n/**\n * Turns a select page server action result into a loader page, or throws the failure it carries. The message was built\n * on the server from fixed words and the status, so it is safe to show to a developer.\n */\nconst loadPageFromAction = (result: SelectPageActionResult, errorCode: string): SelectPage => {\n  if (result.success) {\n    return result.page;\n  }\n\n  if (result.statusCode !== undefined) {\n    throw new ThunderIDAPIError(result.message, errorCode, 'nextjs', result.statusCode);\n  }\n\n  throw new ThunderIDRuntimeError(result.message, errorCode, 'nextjs');\n};\n\nexport default loadPageFromAction;\n"],"mappings":";;;;;;;AAWA,MAAM,sBAAsB,QAAgC,cAAkC;AAC5F,KAAI,OAAO,QACT,QAAO,OAAO;AAGhB,KAAI,OAAO,eAAe,OACxB,OAAM,IAAI,kBAAkB,OAAO,SAAS,WAAW,UAAU,OAAO,WAAW;AAGrF,OAAM,IAAI,sBAAsB,OAAO,SAAS,WAAW,SAAS;;AAGtE,iCAAe"}

package/dist/index.js

@@ -18,6 +18,9 @@ import UserProfile_default from "./client/components/presentation/UserProfile/Us
 import UserDropdown_default from "./client/components/presentation/UserDropdown/UserDropdown.js";
 import UserAvatar_default from "./client/components/presentation/UserAvatar/UserAvatar.js";
 import ChangeCredential_default from "./client/components/presentation/ChangeCredential/ChangeCredential.js";
+import UserSelect_default from "./client/components/presentation/UserSelect/UserSelect.js";
+import AuthFlowSelect_default from "./client/components/presentation/AuthFlowSelect/AuthFlowSelect.js";
+import UserTypeSelect_default from "./client/components/presentation/UserTypeSelect/UserTypeSelect.js";
 import "./client/index.js";
 
-export { ChangeCredential_default as ChangeCredential, SignIn_default as SignIn, SignInButton_default as SignInButton, SignOutButton_default as SignOutButton, SignUp_default as SignUp, SignUpButton_default as SignUpButton, SignedIn_default as SignedIn, SignedOut_default as SignedOut, ThunderIDNextClient_default as ThunderIDNext, ThunderIDProvider_default as ThunderIDProvider, User_default as User, UserAvatar_default as UserAvatar, UserDropdown_default as UserDropdown, UserProfile_default as UserProfile, backchannelLogout_default as backchannelLogout, createRouteMatcher_default as createRouteMatcher, removeChunkedCookieFromHeader, replaceChunkedCookieInHeader, thunderIDProxy_default as thunderIDProxy, thunderid_default as thunderid, useThunderID_default as useThunderID };
+export { AuthFlowSelect_default as AuthFlowSelect, ChangeCredential_default as ChangeCredential, SignIn_default as SignIn, SignInButton_default as SignInButton, SignOutButton_default as SignOutButton, SignUp_default as SignUp, SignUpButton_default as SignUpButton, SignedIn_default as SignedIn, SignedOut_default as SignedOut, ThunderIDNextClient_default as ThunderIDNext, ThunderIDProvider_default as ThunderIDProvider, User_default as User, UserAvatar_default as UserAvatar, UserDropdown_default as UserDropdown, UserProfile_default as UserProfile, UserSelect_default as UserSelect, UserTypeSelect_default as UserTypeSelect, backchannelLogout_default as backchannelLogout, createRouteMatcher_default as createRouteMatcher, removeChunkedCookieFromHeader, replaceChunkedCookieInHeader, thunderIDProxy_default as thunderIDProxy, thunderid_default as thunderid, useThunderID_default as useThunderID };

package/dist/server/ThunderIDProvider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ThunderIDProvider.d.ts","sourceRoot":"","sources":["../../src/server/ThunderIDProvider.tsx"],"names":[],"mappings":"AAiBA,OAAO,EAAC,sBAAsB,EAAC,MAAM,kBAAkB,CAAC;AACxD,OAAO,EAAC,EAAE,EAAE,iBAAiB,EAAe,MAAM,OAAO,CAAC;AAqB1D;;GAEG;AACH,MAAM,MAAM,4BAA4B,GAAG,OAAO,CAAC,sBAAsB,CAAC,GAAG;IAC3E,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;;;;;;;;;OAYG;IACH,uBAAuB,CAAC,EAAE,MAAM,CAAC;CAClC,CAAC;AAEF;;;;;;;;;;;;;;;GAeG;AACH,QAAA,MAAM,uBAAuB,EAAE,EAAE,CAAC,iBAAiB,CAAC,4BAA4B,CAAC,CAuJhF,CAAC;AAEF,eAAe,uBAAuB,CAAC"}
+{"version":3,"file":"ThunderIDProvider.d.ts","sourceRoot":"","sources":["../../src/server/ThunderIDProvider.tsx"],"names":[],"mappings":"AAiBA,OAAO,EAAC,sBAAsB,EAAC,MAAM,kBAAkB,CAAC;AACxD,OAAO,EAAC,EAAE,EAAE,iBAAiB,EAAe,MAAM,OAAO,CAAC;AAoB1D;;GAEG;AACH,MAAM,MAAM,4BAA4B,GAAG,OAAO,CAAC,sBAAsB,CAAC,GAAG;IAC3E,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;;;;;;;;;OAYG;IACH,uBAAuB,CAAC,EAAE,MAAM,CAAC;CAClC,CAAC;AAEF;;;;;;;;;;;;;;;GAeG;AACH,QAAA,MAAM,uBAAuB,EAAE,EAAE,CAAC,iBAAiB,CAAC,4BAA4B,CAAC,CAsJhF,CAAC;AAEF,eAAe,uBAAuB,CAAC"}

package/dist/server/ThunderIDProvider.js

@@ -16,7 +16,6 @@ import signInAction_default from "./actions/signInAction.js";
 import signOutAction_default from "./actions/signOutAction.js";
 import signUpAction_default from "./actions/signUpAction.js";
 import updateUserProfileAction_default from "./actions/updateUserProfileAction.js";
-import getFlowMetaAction_default from "./actions/getFlowMetaAction.js";
 import ThunderIDProvider_default from "../client/contexts/ThunderID/ThunderIDProvider.js";
 import { FlowMetaType, ThunderIDRuntimeError, extractUserClaimsFromIdToken, getFlowMeta, resolveResourceEndpoint } from "@thunderid/node";
 import { Fragment, jsx } from "react/jsx-runtime";
@@ -123,7 +122,6 @@ const ThunderIDServerProvider = async ({ children, afterSignInUrl, afterSignOutU
 		applicationId: config?.applicationId,
 		baseUrl: config?.baseUrl,
 		initialMeta: flowMeta,
-		fetchMeta: getFlowMetaAction_default,
 		signIn: signInAction_default,
 		clearSession: clearSession_default,
 		refreshToken: refreshToken_default,

package/dist/server/ThunderIDProvider.js.map

@@ -1 +1 @@
-{"version":3,"file":"ThunderIDProvider.js","names":["ThunderIDServerProvider: FC<PropsWithChildren<ThunderIDServerProviderProps>>","getClient","config: Partial<ThunderIDNextConfig>","flowMeta: FlowMetadataResponse | null","sessionPayload: SessionTokenPayload | undefined","getSessionPayload","sessionId: string","getSessionId","signedIn: boolean","isSignedIn","user: User","userProfile: UserProfile","userSchema: Record<string, AttributeSchema> | null","updatedBaseUrl: string | undefined","userResponse: {\n          data: {user: User | null};\n          error: string | null;\n          success: boolean;\n        }","getUserAction","userProfileResponse: {\n          data: {userProfile: UserProfile};\n          error: string | null;\n          success: boolean;\n        }","getUserProfileAction","userSchemaResponse: {\n          data: {userSchema: Record<string, AttributeSchema> | null};\n          error: string | null;\n          success: boolean;\n        }","getUserSchemaAction","ThunderIDClientProvider","getFlowMetaAction","signInAction","clearSession","refreshToken","signOutAction","signUpAction","handleOAuthCallbackAction","updateUserProfileAction"],"sources":["../../src/server/ThunderIDProvider.tsx"],"sourcesContent":["// Copyright 2025 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\n'use server';\n\nimport {\n  ThunderIDRuntimeError,\n  AttributeSchema,\n  FlowMetadataResponse,\n  FlowMetaType,\n  IdToken,\n  User,\n  UserProfile,\n  getFlowMeta,\n  extractUserClaimsFromIdToken,\n  resolveResourceEndpoint,\n} from '@thunderid/node';\nimport {ThunderIDProviderProps} from '@thunderid/react';\nimport {FC, PropsWithChildren, ReactElement} from 'react';\nimport clearSession from './actions/clearSession';\nimport getSessionId from './actions/getSessionId';\nimport getSessionPayload from './actions/getSessionPayload';\nimport getUserAction from './actions/getUserAction';\nimport getUserProfileAction from './actions/getUserProfileAction';\nimport getUserSchemaAction from './actions/getUserSchemaAction';\nimport handleOAuthCallbackAction from './actions/handleOAuthCallbackAction';\nimport isSignedIn from './actions/isSignedIn';\nimport refreshToken from './actions/refreshToken';\nimport signInAction from './actions/signInAction';\nimport signOutAction from './actions/signOutAction';\nimport signUpAction from './actions/signUpAction';\nimport updateUserProfileAction from './actions/updateUserProfileAction';\nimport getFlowMetaAction from './actions/getFlowMetaAction';\nimport getClient from './getClient';\nimport ThunderIDClientProvider from '../client/contexts/ThunderID/ThunderIDProvider.js';\nimport {ThunderIDNextConfig} from '../models/config';\nimport logger from '../utils/logger';\nimport {SessionTokenPayload} from '../utils/SessionManager';\n\n/**\n * Props interface of {@link ThunderIDServerProvider}\n */\nexport type ThunderIDServerProviderProps = Partial<ThunderIDProviderProps> & {\n  clientSecret?: string;\n  /**\n   * Session cookie lifetime in seconds. Determines how long the session cookie\n   * remains valid in the browser after sign-in.\n   *\n   * Resolution order (first defined value wins):\n   *   1. This prop — set here when mounting the provider.\n   *   2. `THUNDERID_SESSION_COOKIE_EXPIRY_TIME` environment variable.\n   *   3. Built-in default of 86400 seconds (24 hours).\n   *\n   * @example\n   * // 8-hour session cookie\n   * <ThunderIDServerProvider sessionCookieExpiryTime={28800} ... />\n   */\n  sessionCookieExpiryTime?: number;\n};\n\n/**\n * Server-side provider component for ThunderID authentication.\n * Wraps the client-side provider and handles server-side authentication logic.\n * Uses the singleton ThunderIDNextClient instance for consistent authentication state.\n *\n * @param props - Props injected into the component.\n *\n * @example\n * ```tsx\n * <ThunderIDServerProvider config={thunderidConfig}>\n *   <YourApp />\n * </ThunderIDServerProvider>\n * ```\n *\n * @returns ThunderIDServerProvider component.\n */\nconst ThunderIDServerProvider: FC<PropsWithChildren<ThunderIDServerProviderProps>> = async ({\n  children,\n  afterSignInUrl,\n  afterSignOutUrl,\n  ..._config\n}: PropsWithChildren<ThunderIDServerProviderProps>): Promise<ReactElement> => {\n  const thunderIDClient = getClient();\n  let config: Partial<ThunderIDNextConfig> = {};\n\n  try {\n    await thunderIDClient.initialize(_config as ThunderIDNextConfig);\n\n    logger.debug('[ThunderIDServerProvider] ThunderID client initialized successfully.');\n\n    config = await thunderIDClient.getConfiguration();\n  } catch (error) {\n    logger.error('[ThunderIDServerProvider] Failed to initialize ThunderID client:', error?.toString());\n\n    throw new ThunderIDRuntimeError(\n      `Failed to initialize ThunderID client: ${error?.toString()}`,\n      'next-ConfigurationError-001',\n      'next',\n      'An error occurred while initializing the ThunderID client. Please check your configuration.',\n    );\n  }\n\n  if (!thunderIDClient.isInitialized) {\n    return <></>;\n  }\n\n  // Fetch flow metadata (design config + i18n bundle) server-side so `FlowMetaProvider` can seed\n  // its state and skip a redundant client-side fetch — avoiding a flash of untranslated i18n keys\n  // (e.g. raw `signin.forms.credentials.title`) while embedded flow components first render.\n  let flowMeta: FlowMetadataResponse | null = null;\n  try {\n    flowMeta = await getFlowMeta({\n      baseUrl: config?.baseUrl,\n      url: resolveResourceEndpoint('flowMeta', config),\n      ...(config?.applicationId ? {id: config.applicationId, type: FlowMetaType.App} : {}),\n    });\n  } catch (error) {\n    logger.warn('[ThunderIDServerProvider] Failed to fetch flow metadata:', error?.toString());\n  }\n\n  // Try to get session information from JWT first, then fall back to legacy\n  const sessionPayload: SessionTokenPayload | undefined = await getSessionPayload();\n  const sessionId: string = sessionPayload?.sessionId || (await getSessionId()) || '';\n  const signedIn: boolean = await isSignedIn(sessionId);\n\n  let user: User = {};\n  let userProfile: UserProfile = {\n    flattenedProfile: {},\n    profile: {},\n  };\n  let userSchema: Record<string, AttributeSchema> | null = null;\n\n  const resolvedPreferences = {\n    ...config?.preferences,\n    ..._config.preferences,\n    user: {\n      ...config?.preferences?.user,\n      ..._config.preferences?.user,\n    },\n  };\n\n  if (signedIn) {\n    let updatedBaseUrl: string | undefined = config?.baseUrl;\n\n    if (sessionPayload?.organizationId) {\n      updatedBaseUrl = `${config?.baseUrl}/o`;\n      config = {...config, baseUrl: updatedBaseUrl};\n    } else if (sessionId) {\n      try {\n        const idToken: IdToken = await thunderIDClient.getDecodedIdToken(sessionId);\n        if (idToken?.['user_org']) {\n          updatedBaseUrl = `${config?.baseUrl}/o`;\n          config = {...config, baseUrl: updatedBaseUrl};\n        }\n      } catch {\n        // Continue without organization info\n      }\n    }\n\n    // Check if user profile fetching is enabled (default: true)\n    const shouldFetchUserProfile: boolean = resolvedPreferences?.user?.fetchUserProfile !== false;\n\n    if (shouldFetchUserProfile) {\n      try {\n        const userResponse: {\n          data: {user: User | null};\n          error: string | null;\n          success: boolean;\n        } = await getUserAction(sessionId);\n        const userProfileResponse: {\n          data: {userProfile: UserProfile};\n          error: string | null;\n          success: boolean;\n        } = await getUserProfileAction(sessionId);\n        const userSchemaResponse: {\n          data: {userSchema: Record<string, AttributeSchema> | null};\n          error: string | null;\n          success: boolean;\n        } = await getUserSchemaAction(sessionId);\n\n        user = userResponse.data?.user || {};\n        userProfile = userProfileResponse.data?.userProfile ?? userProfile;\n        userSchema = userSchemaResponse.data?.userSchema ?? null;\n      } catch (error) {\n        logger.warn('[ThunderIDServerProvider] Failed to fetch user profile from /users/me:', error?.toString());\n      }\n    } else {\n      try {\n        const decodedIdToken: IdToken = await thunderIDClient.getDecodedIdToken(sessionId);\n        const claims = extractUserClaimsFromIdToken(decodedIdToken);\n        user = claims;\n        userProfile = {\n          flattenedProfile: claims,\n          profile: claims,\n        };\n      } catch (error) {\n        logger.warn('[ThunderIDServerProvider] Failed to extract user claims from ID token:', error?.toString());\n      }\n    }\n  }\n\n  return (\n    <ThunderIDClientProvider\n      organizationHandle={config?.organizationHandle}\n      applicationId={config?.applicationId}\n      baseUrl={config?.baseUrl}\n      initialMeta={flowMeta}\n      fetchMeta={getFlowMetaAction}\n      signIn={signInAction}\n      clearSession={clearSession}\n      refreshToken={refreshToken}\n      signOut={signOutAction}\n      signUp={signUpAction}\n      handleOAuthCallback={handleOAuthCallbackAction}\n      signInUrl={config?.signInUrl}\n      signUpUrl={config?.signUpUrl}\n      preferences={resolvedPreferences}\n      clientId={config?.clientId}\n      user={user}\n      userProfile={userProfile}\n      userSchema={userSchema}\n      updateProfile={updateUserProfileAction}\n      isSignedIn={signedIn}\n    >\n      {children}\n    </ThunderIDClientProvider>\n  );\n};\n\nexport default ThunderIDServerProvider;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA4EA,MAAMA,0BAA+E,OAAO,EAC1F,UACA,gBACA,gBACA,GAAG,cACyE;CAC5E,MAAM,kBAAkBC,mBAAW;CACnC,IAAIC,SAAuC,EAAE;AAE7C,KAAI;AACF,QAAM,gBAAgB,WAAW,QAA+B;AAEhE,iBAAO,MAAM,uEAAuE;AAEpF,WAAS,MAAM,gBAAgB,kBAAkB;UAC1C,OAAO;AACd,iBAAO,MAAM,oEAAoE,OAAO,UAAU,CAAC;AAEnG,QAAM,IAAI,sBACR,0CAA0C,OAAO,UAAU,IAC3D,+BACA,QACA,8FACD;;AAGH,KAAI,CAAC,gBAAgB,cACnB,QAAO,iCAAK;CAMd,IAAIC,WAAwC;AAC5C,KAAI;AACF,aAAW,MAAM,YAAY;GAC3B,SAAS,QAAQ;GACjB,KAAK,wBAAwB,YAAY,OAAO;GAChD,GAAI,QAAQ,gBAAgB;IAAC,IAAI,OAAO;IAAe,MAAM,aAAa;IAAI,GAAG,EAAE;GACpF,CAAC;UACK,OAAO;AACd,iBAAO,KAAK,4DAA4D,OAAO,UAAU,CAAC;;CAI5F,MAAMC,iBAAkD,MAAMC,2BAAmB;CACjF,MAAMC,YAAoB,gBAAgB,aAAc,MAAMC,sBAAc,IAAK;CACjF,MAAMC,WAAoB,MAAMC,mBAAW,UAAU;CAErD,IAAIC,OAAa,EAAE;CACnB,IAAIC,cAA2B;EAC7B,kBAAkB,EAAE;EACpB,SAAS,EAAE;EACZ;CACD,IAAIC,aAAqD;CAEzD,MAAM,sBAAsB;EAC1B,GAAG,QAAQ;EACX,GAAG,QAAQ;EACX,MAAM;GACJ,GAAG,QAAQ,aAAa;GACxB,GAAG,QAAQ,aAAa;GACzB;EACF;AAED,KAAI,UAAU;EACZ,IAAIC,iBAAqC,QAAQ;AAEjD,MAAI,gBAAgB,gBAAgB;AAClC,oBAAiB,GAAG,QAAQ,QAAQ;AACpC,YAAS;IAAC,GAAG;IAAQ,SAAS;IAAe;aACpC,UACT,KAAI;AAEF,QADyB,MAAM,gBAAgB,kBAAkB,UAAU,IAC7D,aAAa;AACzB,qBAAiB,GAAG,QAAQ,QAAQ;AACpC,aAAS;KAAC,GAAG;KAAQ,SAAS;KAAe;;UAEzC;AAQV,MAFwC,qBAAqB,MAAM,qBAAqB,MAGtF,KAAI;GACF,MAAMC,eAIF,MAAMC,sBAAc,UAAU;GAClC,MAAMC,sBAIF,MAAMC,6BAAqB,UAAU;GACzC,MAAMC,qBAIF,MAAMC,4BAAoB,UAAU;AAExC,UAAO,aAAa,MAAM,QAAQ,EAAE;AACpC,iBAAc,oBAAoB,MAAM,eAAe;AACvD,gBAAa,mBAAmB,MAAM,cAAc;WAC7C,OAAO;AACd,kBAAO,KAAK,0EAA0E,OAAO,UAAU,CAAC;;MAG1G,KAAI;GAEF,MAAM,SAAS,6BADiB,MAAM,gBAAgB,kBAAkB,UAAU,CACvB;AAC3D,UAAO;AACP,iBAAc;IACZ,kBAAkB;IAClB,SAAS;IACV;WACM,OAAO;AACd,kBAAO,KAAK,0EAA0E,OAAO,UAAU,CAAC;;;AAK9G,QACE,oBAACC;EACC,oBAAoB,QAAQ;EAC5B,eAAe,QAAQ;EACvB,SAAS,QAAQ;EACjB,aAAa;EACb,WAAWC;EACX,QAAQC;EACR,cAAcC;EACd,cAAcC;EACd,SAASC;EACT,QAAQC;EACR,qBAAqBC;EACrB,WAAW,QAAQ;EACnB,WAAW,QAAQ;EACnB,aAAa;EACb,UAAU,QAAQ;EACZ;EACO;EACD;EACZ,eAAeC;EACf,YAAY;EAEX;GACuB;;AAI9B,kCAAe"}
+{"version":3,"file":"ThunderIDProvider.js","names":["ThunderIDServerProvider: FC<PropsWithChildren<ThunderIDServerProviderProps>>","getClient","config: Partial<ThunderIDNextConfig>","flowMeta: FlowMetadataResponse | null","sessionPayload: SessionTokenPayload | undefined","getSessionPayload","sessionId: string","getSessionId","signedIn: boolean","isSignedIn","user: User","userProfile: UserProfile","userSchema: Record<string, AttributeSchema> | null","updatedBaseUrl: string | undefined","userResponse: {\n          data: {user: User | null};\n          error: string | null;\n          success: boolean;\n        }","getUserAction","userProfileResponse: {\n          data: {userProfile: UserProfile};\n          error: string | null;\n          success: boolean;\n        }","getUserProfileAction","userSchemaResponse: {\n          data: {userSchema: Record<string, AttributeSchema> | null};\n          error: string | null;\n          success: boolean;\n        }","getUserSchemaAction","ThunderIDClientProvider","signInAction","clearSession","refreshToken","signOutAction","signUpAction","handleOAuthCallbackAction","updateUserProfileAction"],"sources":["../../src/server/ThunderIDProvider.tsx"],"sourcesContent":["// Copyright 2025 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\n'use server';\n\nimport {\n  ThunderIDRuntimeError,\n  AttributeSchema,\n  FlowMetadataResponse,\n  FlowMetaType,\n  IdToken,\n  User,\n  UserProfile,\n  getFlowMeta,\n  extractUserClaimsFromIdToken,\n  resolveResourceEndpoint,\n} from '@thunderid/node';\nimport {ThunderIDProviderProps} from '@thunderid/react';\nimport {FC, PropsWithChildren, ReactElement} from 'react';\nimport clearSession from './actions/clearSession';\nimport getSessionId from './actions/getSessionId';\nimport getSessionPayload from './actions/getSessionPayload';\nimport getUserAction from './actions/getUserAction';\nimport getUserProfileAction from './actions/getUserProfileAction';\nimport getUserSchemaAction from './actions/getUserSchemaAction';\nimport handleOAuthCallbackAction from './actions/handleOAuthCallbackAction';\nimport isSignedIn from './actions/isSignedIn';\nimport refreshToken from './actions/refreshToken';\nimport signInAction from './actions/signInAction';\nimport signOutAction from './actions/signOutAction';\nimport signUpAction from './actions/signUpAction';\nimport updateUserProfileAction from './actions/updateUserProfileAction';\nimport getClient from './getClient';\nimport ThunderIDClientProvider from '../client/contexts/ThunderID/ThunderIDProvider.js';\nimport {ThunderIDNextConfig} from '../models/config';\nimport logger from '../utils/logger';\nimport {SessionTokenPayload} from '../utils/SessionManager';\n\n/**\n * Props interface of {@link ThunderIDServerProvider}\n */\nexport type ThunderIDServerProviderProps = Partial<ThunderIDProviderProps> & {\n  clientSecret?: string;\n  /**\n   * Session cookie lifetime in seconds. Determines how long the session cookie\n   * remains valid in the browser after sign-in.\n   *\n   * Resolution order (first defined value wins):\n   *   1. This prop — set here when mounting the provider.\n   *   2. `THUNDERID_SESSION_COOKIE_EXPIRY_TIME` environment variable.\n   *   3. Built-in default of 86400 seconds (24 hours).\n   *\n   * @example\n   * // 8-hour session cookie\n   * <ThunderIDServerProvider sessionCookieExpiryTime={28800} ... />\n   */\n  sessionCookieExpiryTime?: number;\n};\n\n/**\n * Server-side provider component for ThunderID authentication.\n * Wraps the client-side provider and handles server-side authentication logic.\n * Uses the singleton ThunderIDNextClient instance for consistent authentication state.\n *\n * @param props - Props injected into the component.\n *\n * @example\n * ```tsx\n * <ThunderIDServerProvider config={thunderidConfig}>\n *   <YourApp />\n * </ThunderIDServerProvider>\n * ```\n *\n * @returns ThunderIDServerProvider component.\n */\nconst ThunderIDServerProvider: FC<PropsWithChildren<ThunderIDServerProviderProps>> = async ({\n  children,\n  afterSignInUrl,\n  afterSignOutUrl,\n  ..._config\n}: PropsWithChildren<ThunderIDServerProviderProps>): Promise<ReactElement> => {\n  const thunderIDClient = getClient();\n  let config: Partial<ThunderIDNextConfig> = {};\n\n  try {\n    await thunderIDClient.initialize(_config as ThunderIDNextConfig);\n\n    logger.debug('[ThunderIDServerProvider] ThunderID client initialized successfully.');\n\n    config = await thunderIDClient.getConfiguration();\n  } catch (error) {\n    logger.error('[ThunderIDServerProvider] Failed to initialize ThunderID client:', error?.toString());\n\n    throw new ThunderIDRuntimeError(\n      `Failed to initialize ThunderID client: ${error?.toString()}`,\n      'next-ConfigurationError-001',\n      'next',\n      'An error occurred while initializing the ThunderID client. Please check your configuration.',\n    );\n  }\n\n  if (!thunderIDClient.isInitialized) {\n    return <></>;\n  }\n\n  // Fetch flow metadata (design config + i18n bundle) server-side so `FlowMetaProvider` can seed\n  // its state and skip a redundant client-side fetch — avoiding a flash of untranslated i18n keys\n  // (e.g. raw `signin.forms.credentials.title`) while embedded flow components first render.\n  let flowMeta: FlowMetadataResponse | null = null;\n  try {\n    flowMeta = await getFlowMeta({\n      baseUrl: config?.baseUrl,\n      url: resolveResourceEndpoint('flowMeta', config),\n      ...(config?.applicationId ? {id: config.applicationId, type: FlowMetaType.App} : {}),\n    });\n  } catch (error) {\n    logger.warn('[ThunderIDServerProvider] Failed to fetch flow metadata:', error?.toString());\n  }\n\n  // Try to get session information from JWT first, then fall back to legacy\n  const sessionPayload: SessionTokenPayload | undefined = await getSessionPayload();\n  const sessionId: string = sessionPayload?.sessionId || (await getSessionId()) || '';\n  const signedIn: boolean = await isSignedIn(sessionId);\n\n  let user: User = {};\n  let userProfile: UserProfile = {\n    flattenedProfile: {},\n    profile: {},\n  };\n  let userSchema: Record<string, AttributeSchema> | null = null;\n\n  const resolvedPreferences = {\n    ...config?.preferences,\n    ..._config.preferences,\n    user: {\n      ...config?.preferences?.user,\n      ..._config.preferences?.user,\n    },\n  };\n\n  if (signedIn) {\n    let updatedBaseUrl: string | undefined = config?.baseUrl;\n\n    if (sessionPayload?.organizationId) {\n      updatedBaseUrl = `${config?.baseUrl}/o`;\n      config = {...config, baseUrl: updatedBaseUrl};\n    } else if (sessionId) {\n      try {\n        const idToken: IdToken = await thunderIDClient.getDecodedIdToken(sessionId);\n        if (idToken?.['user_org']) {\n          updatedBaseUrl = `${config?.baseUrl}/o`;\n          config = {...config, baseUrl: updatedBaseUrl};\n        }\n      } catch {\n        // Continue without organization info\n      }\n    }\n\n    // Check if user profile fetching is enabled (default: true)\n    const shouldFetchUserProfile: boolean = resolvedPreferences?.user?.fetchUserProfile !== false;\n\n    if (shouldFetchUserProfile) {\n      try {\n        const userResponse: {\n          data: {user: User | null};\n          error: string | null;\n          success: boolean;\n        } = await getUserAction(sessionId);\n        const userProfileResponse: {\n          data: {userProfile: UserProfile};\n          error: string | null;\n          success: boolean;\n        } = await getUserProfileAction(sessionId);\n        const userSchemaResponse: {\n          data: {userSchema: Record<string, AttributeSchema> | null};\n          error: string | null;\n          success: boolean;\n        } = await getUserSchemaAction(sessionId);\n\n        user = userResponse.data?.user || {};\n        userProfile = userProfileResponse.data?.userProfile ?? userProfile;\n        userSchema = userSchemaResponse.data?.userSchema ?? null;\n      } catch (error) {\n        logger.warn('[ThunderIDServerProvider] Failed to fetch user profile from /users/me:', error?.toString());\n      }\n    } else {\n      try {\n        const decodedIdToken: IdToken = await thunderIDClient.getDecodedIdToken(sessionId);\n        const claims = extractUserClaimsFromIdToken(decodedIdToken);\n        user = claims;\n        userProfile = {\n          flattenedProfile: claims,\n          profile: claims,\n        };\n      } catch (error) {\n        logger.warn('[ThunderIDServerProvider] Failed to extract user claims from ID token:', error?.toString());\n      }\n    }\n  }\n\n  return (\n    <ThunderIDClientProvider\n      organizationHandle={config?.organizationHandle}\n      applicationId={config?.applicationId}\n      baseUrl={config?.baseUrl}\n      initialMeta={flowMeta}\n      signIn={signInAction}\n      clearSession={clearSession}\n      refreshToken={refreshToken}\n      signOut={signOutAction}\n      signUp={signUpAction}\n      handleOAuthCallback={handleOAuthCallbackAction}\n      signInUrl={config?.signInUrl}\n      signUpUrl={config?.signUpUrl}\n      preferences={resolvedPreferences}\n      clientId={config?.clientId}\n      user={user}\n      userProfile={userProfile}\n      userSchema={userSchema}\n      updateProfile={updateUserProfileAction}\n      isSignedIn={signedIn}\n    >\n      {children}\n    </ThunderIDClientProvider>\n  );\n};\n\nexport default ThunderIDServerProvider;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA2EA,MAAMA,0BAA+E,OAAO,EAC1F,UACA,gBACA,gBACA,GAAG,cACyE;CAC5E,MAAM,kBAAkBC,mBAAW;CACnC,IAAIC,SAAuC,EAAE;AAE7C,KAAI;AACF,QAAM,gBAAgB,WAAW,QAA+B;AAEhE,iBAAO,MAAM,uEAAuE;AAEpF,WAAS,MAAM,gBAAgB,kBAAkB;UAC1C,OAAO;AACd,iBAAO,MAAM,oEAAoE,OAAO,UAAU,CAAC;AAEnG,QAAM,IAAI,sBACR,0CAA0C,OAAO,UAAU,IAC3D,+BACA,QACA,8FACD;;AAGH,KAAI,CAAC,gBAAgB,cACnB,QAAO,iCAAK;CAMd,IAAIC,WAAwC;AAC5C,KAAI;AACF,aAAW,MAAM,YAAY;GAC3B,SAAS,QAAQ;GACjB,KAAK,wBAAwB,YAAY,OAAO;GAChD,GAAI,QAAQ,gBAAgB;IAAC,IAAI,OAAO;IAAe,MAAM,aAAa;IAAI,GAAG,EAAE;GACpF,CAAC;UACK,OAAO;AACd,iBAAO,KAAK,4DAA4D,OAAO,UAAU,CAAC;;CAI5F,MAAMC,iBAAkD,MAAMC,2BAAmB;CACjF,MAAMC,YAAoB,gBAAgB,aAAc,MAAMC,sBAAc,IAAK;CACjF,MAAMC,WAAoB,MAAMC,mBAAW,UAAU;CAErD,IAAIC,OAAa,EAAE;CACnB,IAAIC,cAA2B;EAC7B,kBAAkB,EAAE;EACpB,SAAS,EAAE;EACZ;CACD,IAAIC,aAAqD;CAEzD,MAAM,sBAAsB;EAC1B,GAAG,QAAQ;EACX,GAAG,QAAQ;EACX,MAAM;GACJ,GAAG,QAAQ,aAAa;GACxB,GAAG,QAAQ,aAAa;GACzB;EACF;AAED,KAAI,UAAU;EACZ,IAAIC,iBAAqC,QAAQ;AAEjD,MAAI,gBAAgB,gBAAgB;AAClC,oBAAiB,GAAG,QAAQ,QAAQ;AACpC,YAAS;IAAC,GAAG;IAAQ,SAAS;IAAe;aACpC,UACT,KAAI;AAEF,QADyB,MAAM,gBAAgB,kBAAkB,UAAU,IAC7D,aAAa;AACzB,qBAAiB,GAAG,QAAQ,QAAQ;AACpC,aAAS;KAAC,GAAG;KAAQ,SAAS;KAAe;;UAEzC;AAQV,MAFwC,qBAAqB,MAAM,qBAAqB,MAGtF,KAAI;GACF,MAAMC,eAIF,MAAMC,sBAAc,UAAU;GAClC,MAAMC,sBAIF,MAAMC,6BAAqB,UAAU;GACzC,MAAMC,qBAIF,MAAMC,4BAAoB,UAAU;AAExC,UAAO,aAAa,MAAM,QAAQ,EAAE;AACpC,iBAAc,oBAAoB,MAAM,eAAe;AACvD,gBAAa,mBAAmB,MAAM,cAAc;WAC7C,OAAO;AACd,kBAAO,KAAK,0EAA0E,OAAO,UAAU,CAAC;;MAG1G,KAAI;GAEF,MAAM,SAAS,6BADiB,MAAM,gBAAgB,kBAAkB,UAAU,CACvB;AAC3D,UAAO;AACP,iBAAc;IACZ,kBAAkB;IAClB,SAAS;IACV;WACM,OAAO;AACd,kBAAO,KAAK,0EAA0E,OAAO,UAAU,CAAC;;;AAK9G,QACE,oBAACC;EACC,oBAAoB,QAAQ;EAC5B,eAAe,QAAQ;EACvB,SAAS,QAAQ;EACjB,aAAa;EACb,QAAQC;EACR,cAAcC;EACd,cAAcC;EACd,SAASC;EACT,QAAQC;EACR,qBAAqBC;EACrB,WAAW,QAAQ;EACnB,WAAW,QAAQ;EACnB,aAAa;EACb,UAAU,QAAQ;EACZ;EACO;EACD;EACZ,eAAeC;EACf,YAAY;EAEX;GACuB;;AAI9B,kCAAe"}

package/dist/server/actions/getAuthFlowsAction.d.ts

@@ -0,0 +1,19 @@
+import { SelectPageActionResult } from './runSelectPageAction';
+/**
+ * Request from the browser. Carries only paging; the session comes from the request cookie and the flow
+ * type is fixed to authentication on the server.
+ */
+export interface GetAuthFlowsActionRequest {
+    limit?: number;
+    offset?: number;
+}
+export type GetAuthFlowsActionResult = SelectPageActionResult;
+/**
+ * Loads one page of authentication flows for an `AUTH_FLOW_SELECT` picker using the signed-in user's
+ * server-held session.
+ *
+ * Never throws across the server action boundary; failures are mapped to a plain result.
+ */
+declare const getAuthFlowsAction: ({ limit, offset }?: GetAuthFlowsActionRequest) => Promise<GetAuthFlowsActionResult>;
+export default getAuthFlowsAction;
+//# sourceMappingURL=getAuthFlowsAction.d.ts.map

package/dist/server/actions/getAuthFlowsAction.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"getAuthFlowsAction.d.ts","sourceRoot":"","sources":["../../../src/server/actions/getAuthFlowsAction.ts"],"names":[],"mappings":"AAMA,OAA4B,EAAC,sBAAsB,EAAC,MAAM,uBAAuB,CAAC;AAElF;;;GAGG;AACH,MAAM,WAAW,yBAAyB;IACxC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,MAAM,wBAAwB,GAAG,sBAAsB,CAAC;AAE9D;;;;;GAKG;AACH,QAAA,MAAM,kBAAkB,GAAU,oBAAiB,yBAA8B,KAAG,OAAO,CAAC,wBAAwB,CASjH,CAAC;AAEJ,eAAe,kBAAkB,CAAC"}

package/dist/server/actions/getAuthFlowsAction.js

@@ -0,0 +1,26 @@
+'use server';
+
+
+import runSelectPageAction_default from "./runSelectPageAction.js";
+import { AuthFlowSelectConstants, capPageSize, toAuthFlowSelectPage } from "@thunderid/node";
+
+//#region src/server/actions/getAuthFlowsAction.ts
+/**
+* Loads one page of authentication flows for an `AUTH_FLOW_SELECT` picker using the signed-in user's
+* server-held session.
+*
+* Never throws across the server action boundary; failures are mapped to a plain result.
+*/
+const getAuthFlowsAction = async ({ limit, offset } = {}) => runSelectPageAction_default("auth flows", {
+	limit,
+	offset
+}, async (client, sessionId, query) => toAuthFlowSelectPage(await client.getFlows({
+	flowType: AuthFlowSelectConstants.FLOW_TYPE,
+	limit: capPageSize(query.limit),
+	offset: query.offset
+}, sessionId), query.offset ?? 0));
+var getAuthFlowsAction_default = getAuthFlowsAction;
+
+//#endregion
+export { getAuthFlowsAction_default as default };
+//# sourceMappingURL=getAuthFlowsAction.js.map

package/dist/server/actions/getAuthFlowsAction.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"getAuthFlowsAction.js","names":["runSelectPageAction"],"sources":["../../../src/server/actions/getAuthFlowsAction.ts"],"sourcesContent":["// Copyright 2026 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\n'use server';\n\nimport {AuthFlowSelectConstants, capPageSize, toAuthFlowSelectPage} from '@thunderid/node';\nimport runSelectPageAction, {SelectPageActionResult} from './runSelectPageAction';\n\n/**\n * Request from the browser. Carries only paging; the session comes from the request cookie and the flow\n * type is fixed to authentication on the server.\n */\nexport interface GetAuthFlowsActionRequest {\n  limit?: number;\n  offset?: number;\n}\n\nexport type GetAuthFlowsActionResult = SelectPageActionResult;\n\n/**\n * Loads one page of authentication flows for an `AUTH_FLOW_SELECT` picker using the signed-in user's\n * server-held session.\n *\n * Never throws across the server action boundary; failures are mapped to a plain result.\n */\nconst getAuthFlowsAction = async ({limit, offset}: GetAuthFlowsActionRequest = {}): Promise<GetAuthFlowsActionResult> =>\n  runSelectPageAction('auth flows', {limit, offset}, async (client, sessionId, query) =>\n    toAuthFlowSelectPage(\n      await client.getFlows(\n        {flowType: AuthFlowSelectConstants.FLOW_TYPE, limit: capPageSize(query.limit), offset: query.offset},\n        sessionId,\n      ),\n      query.offset ?? 0,\n    ),\n  );\n\nexport default getAuthFlowsAction;\n"],"mappings":";;;;;;;;;;;;;AAyBA,MAAM,qBAAqB,OAAO,EAAC,OAAO,WAAqC,EAAE,KAC/EA,4BAAoB,cAAc;CAAC;CAAO;CAAO,EAAE,OAAO,QAAQ,WAAW,UAC3E,qBACE,MAAM,OAAO,SACX;CAAC,UAAU,wBAAwB;CAAW,OAAO,YAAY,MAAM,MAAM;CAAE,QAAQ,MAAM;CAAO,EACpG,UACD,EACD,MAAM,UAAU,EACjB,CACF;AAEH,iCAAe"}

package/dist/server/actions/getFlowMetaAction.d.ts

@@ -1,4 +1,17 @@
 import { FlowMetadataResponse } from '@thunderid/node';
+/**
+ * What {@link getFlowMetaAction} returns: the flow metadata, or a plain failure. It never throws, because a thrown
+ * error reaches the browser as a generic 500 and loses its prototype chain crossing the server action boundary. A
+ * failure carries a message built on the server and the status, never the text of the upstream reply.
+ */
+export type GetFlowMetaActionResult = {
+    meta: FlowMetadataResponse;
+    success: true;
+} | {
+    message: string;
+    statusCode?: number;
+    success: false;
+};
 /**
  * Server Action that fetches `GET /flow/meta` server-side.
  *
@@ -7,11 +20,13 @@ import { FlowMetadataResponse } from '@thunderid/node';
  * origin. Routing it through this action instead means the browser never talks to `baseUrl`
  * directly — the request happens server-to-server, same as `signInAction`/`signUpAction`.
  *
+ * Never throws across the server action boundary; failures are mapped to a plain result.
+ *
  * @param language - Optional language override, used by `FlowMetaProvider.switchLanguage()`.
  */
 declare const getFlowMetaAction: (params?: {
     applicationId?: string;
     language?: string;
-}) => Promise<FlowMetadataResponse>;
+}) => Promise<GetFlowMetaActionResult>;
 export default getFlowMetaAction;
 //# sourceMappingURL=getFlowMetaAction.d.ts.map

package/dist/server/actions/getFlowMetaAction.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"getFlowMetaAction.d.ts","sourceRoot":"","sources":["../../../src/server/actions/getFlowMetaAction.ts"],"names":[],"mappings":"AAKA,OAAO,EAAC,oBAAoB,EAAqD,MAAM,iBAAiB,CAAC;AAKzG;;;;;;;;;GASG;AACH,QAAA,MAAM,iBAAiB,GAAU,SAAS;IACxC,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,KAAG,OAAO,CAAC,oBAAoB,CAkB/B,CAAC;AAEF,eAAe,iBAAiB,CAAC"}
+{"version":3,"file":"getFlowMetaAction.d.ts","sourceRoot":"","sources":["../../../src/server/actions/getFlowMetaAction.ts"],"names":[],"mappings":"AAKA,OAAO,EACL,oBAAoB,EAKrB,MAAM,iBAAiB,CAAC;AAKzB;;;;GAIG;AACH,MAAM,MAAM,uBAAuB,GAC/B;IAAC,IAAI,EAAE,oBAAoB,CAAC;IAAC,OAAO,EAAE,IAAI,CAAA;CAAC,GAC3C;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,KAAK,CAAA;CAAC,CAAC;AAE3D;;;;;;;;;;;GAWG;AACH,QAAA,MAAM,iBAAiB,GAAU,SAAS;IACxC,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,KAAG,OAAO,CAAC,uBAAuB,CAmClC,CAAC;AAEF,eAAe,iBAAiB,CAAC"}

package/dist/server/actions/getFlowMetaAction.js

@@ -3,7 +3,7 @@
 
 import getClient_default from "../getClient.js";
 import logger_default from "../../utils/logger.js";
-import { FlowMetaType, getFlowMeta, resolveResourceEndpoint } from "@thunderid/node";
+import { FlowMetaType, ThunderIDAPIError, getFlowMeta, resolveResourceEndpoint } from "@thunderid/node";
 
 //#region src/server/actions/getFlowMetaAction.ts
 /**
@@ -14,25 +14,43 @@ import { FlowMetaType, getFlowMeta, resolveResourceEndpoint } from "@thunderid/n
 * origin. Routing it through this action instead means the browser never talks to `baseUrl`
 * directly — the request happens server-to-server, same as `signInAction`/`signUpAction`.
 *
+* Never throws across the server action boundary; failures are mapped to a plain result.
+*
 * @param language - Optional language override, used by `FlowMetaProvider.switchLanguage()`.
 */
 const getFlowMetaAction = async (params) => {
-	const config = await getClient_default().getConfiguration();
-	const applicationId = params?.applicationId ?? config?.applicationId;
 	try {
-		return await getFlowMeta({
-			baseUrl: config?.baseUrl,
-			url: resolveResourceEndpoint("flowMeta", config),
-			...applicationId ? {
-				id: applicationId,
-				type: FlowMetaType.App
-			} : {},
-			...params?.language ? { language: params.language } : {}
-		});
+		const config = await getClient_default().getConfiguration();
+		const url = resolveResourceEndpoint("flowMeta", config);
+		if (!url && !config?.baseUrl) return {
+			message: "Failed to load flow metadata: no base URL is configured.",
+			success: false
+		};
+		const applicationId = params?.applicationId ?? config?.applicationId;
+		return {
+			meta: await getFlowMeta({
+				baseUrl: config?.baseUrl,
+				url,
+				...applicationId ? {
+					id: applicationId,
+					type: FlowMetaType.App
+				} : {},
+				...params?.language ? { language: params.language } : {}
+			}),
+			success: true
+		};
 	} catch (error) {
 		const message = error instanceof Error ? error.message : String(error);
 		logger_default.error(`[getFlowMetaAction] Error fetching flow metadata: ${message}`);
-		throw error;
+		if (error instanceof ThunderIDAPIError && error.statusCode !== void 0) return {
+			message: `Failed to load flow metadata (HTTP ${error.statusCode}).`,
+			statusCode: error.statusCode,
+			success: false
+		};
+		return {
+			message: "Failed to load flow metadata.",
+			success: false
+		};
 	}
 };
 var getFlowMetaAction_default = getFlowMetaAction;