@thunderid/nextjs 1.2.3 → 1.3.1

package/dist/server/actions/getFlowMetaAction.js.map

@@ -1 +1 @@
-{"version":3,"file":"getFlowMetaAction.js","names":["config: ThunderIDNextConfig","getClient","applicationId: string | undefined"],"sources":["../../../src/server/actions/getFlowMetaAction.ts"],"sourcesContent":["// Copyright 2026 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\n'use server';\n\nimport {FlowMetadataResponse, FlowMetaType, getFlowMeta, resolveResourceEndpoint} from '@thunderid/node';\nimport {ThunderIDNextConfig} from '../../models/config';\nimport logger from '../../utils/logger';\nimport getClient from '../getClient';\n\n/**\n * Server Action that fetches `GET /flow/meta` server-side.\n *\n * `FlowMetaProvider` (from `@thunderid/react`) otherwise fetches this endpoint directly from the\n * browser against `baseUrl`, which requires the ThunderID server to allow CORS for the app's\n * origin. Routing it through this action instead means the browser never talks to `baseUrl`\n * directly — the request happens server-to-server, same as `signInAction`/`signUpAction`.\n *\n * @param language - Optional language override, used by `FlowMetaProvider.switchLanguage()`.\n */\nconst getFlowMetaAction = async (params?: {\n  applicationId?: string;\n  language?: string;\n}): Promise<FlowMetadataResponse> => {\n  const client = getClient();\n  const config: ThunderIDNextConfig = await client.getConfiguration();\n\n  const applicationId: string | undefined = params?.applicationId ?? config?.applicationId;\n\n  try {\n    return await getFlowMeta({\n      baseUrl: config?.baseUrl,\n      url: resolveResourceEndpoint('flowMeta', config),\n      ...(applicationId ? {id: applicationId, type: FlowMetaType.App} : {}),\n      ...(params?.language ? {language: params.language} : {}),\n    });\n  } catch (error) {\n    const message = error instanceof Error ? error.message : String(error);\n    logger.error(`[getFlowMetaAction] Error fetching flow metadata: ${message}`);\n    throw error;\n  }\n};\n\nexport default getFlowMetaAction;\n"],"mappings":";;;;;;;;;;;;;;;;;;AAoBA,MAAM,oBAAoB,OAAO,WAGI;CAEnC,MAAMA,SAA8B,MADrBC,mBAAW,CACuB,kBAAkB;CAEnE,MAAMC,gBAAoC,QAAQ,iBAAiB,QAAQ;AAE3E,KAAI;AACF,SAAO,MAAM,YAAY;GACvB,SAAS,QAAQ;GACjB,KAAK,wBAAwB,YAAY,OAAO;GAChD,GAAI,gBAAgB;IAAC,IAAI;IAAe,MAAM,aAAa;IAAI,GAAG,EAAE;GACpE,GAAI,QAAQ,WAAW,EAAC,UAAU,OAAO,UAAS,GAAG,EAAE;GACxD,CAAC;UACK,OAAO;EACd,MAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM;AACtE,iBAAO,MAAM,qDAAqD,UAAU;AAC5E,QAAM;;;AAIV,gCAAe"}
+{"version":3,"file":"getFlowMetaAction.js","names":["config: ThunderIDNextConfig","getClient","url: string | undefined","applicationId: string | undefined"],"sources":["../../../src/server/actions/getFlowMetaAction.ts"],"sourcesContent":["// Copyright 2026 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\n'use server';\n\nimport {\n  FlowMetadataResponse,\n  FlowMetaType,\n  getFlowMeta,\n  resolveResourceEndpoint,\n  ThunderIDAPIError,\n} from '@thunderid/node';\nimport {ThunderIDNextConfig} from '../../models/config';\nimport logger from '../../utils/logger';\nimport getClient from '../getClient';\n\n/**\n * What {@link getFlowMetaAction} returns: the flow metadata, or a plain failure. It never throws, because a thrown\n * error reaches the browser as a generic 500 and loses its prototype chain crossing the server action boundary. A\n * failure carries a message built on the server and the status, never the text of the upstream reply.\n */\nexport type GetFlowMetaActionResult =\n  | {meta: FlowMetadataResponse; success: true}\n  | {message: string; statusCode?: number; success: false};\n\n/**\n * Server Action that fetches `GET /flow/meta` server-side.\n *\n * `FlowMetaProvider` (from `@thunderid/react`) otherwise fetches this endpoint directly from the\n * browser against `baseUrl`, which requires the ThunderID server to allow CORS for the app's\n * origin. Routing it through this action instead means the browser never talks to `baseUrl`\n * directly — the request happens server-to-server, same as `signInAction`/`signUpAction`.\n *\n * Never throws across the server action boundary; failures are mapped to a plain result.\n *\n * @param language - Optional language override, used by `FlowMetaProvider.switchLanguage()`.\n */\nconst getFlowMetaAction = async (params?: {\n  applicationId?: string;\n  language?: string;\n}): Promise<GetFlowMetaActionResult> => {\n  try {\n    const client = getClient();\n    const config: ThunderIDNextConfig = await client.getConfiguration();\n\n    const url: string | undefined = resolveResourceEndpoint('flowMeta', config);\n\n    if (!url && !config?.baseUrl) {\n      return {message: 'Failed to load flow metadata: no base URL is configured.', success: false};\n    }\n\n    const applicationId: string | undefined = params?.applicationId ?? config?.applicationId;\n\n    const meta: FlowMetadataResponse = await getFlowMeta({\n      baseUrl: config?.baseUrl,\n      url,\n      ...(applicationId ? {id: applicationId, type: FlowMetaType.App} : {}),\n      ...(params?.language ? {language: params.language} : {}),\n    });\n\n    return {meta, success: true};\n  } catch (error) {\n    const message = error instanceof Error ? error.message : String(error);\n    logger.error(`[getFlowMetaAction] Error fetching flow metadata: ${message}`);\n\n    if (error instanceof ThunderIDAPIError && error.statusCode !== undefined) {\n      return {\n        message: `Failed to load flow metadata (HTTP ${error.statusCode}).`,\n        statusCode: error.statusCode,\n        success: false,\n      };\n    }\n\n    return {message: 'Failed to load flow metadata.', success: false};\n  }\n};\n\nexport default getFlowMetaAction;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAqCA,MAAM,oBAAoB,OAAO,WAGO;AACtC,KAAI;EAEF,MAAMA,SAA8B,MADrBC,mBAAW,CACuB,kBAAkB;EAEnE,MAAMC,MAA0B,wBAAwB,YAAY,OAAO;AAE3E,MAAI,CAAC,OAAO,CAAC,QAAQ,QACnB,QAAO;GAAC,SAAS;GAA4D,SAAS;GAAM;EAG9F,MAAMC,gBAAoC,QAAQ,iBAAiB,QAAQ;AAS3E,SAAO;GAAC,MAP2B,MAAM,YAAY;IACnD,SAAS,QAAQ;IACjB;IACA,GAAI,gBAAgB;KAAC,IAAI;KAAe,MAAM,aAAa;KAAI,GAAG,EAAE;IACpE,GAAI,QAAQ,WAAW,EAAC,UAAU,OAAO,UAAS,GAAG,EAAE;IACxD,CAAC;GAEY,SAAS;GAAK;UACrB,OAAO;EACd,MAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM;AACtE,iBAAO,MAAM,qDAAqD,UAAU;AAE5E,MAAI,iBAAiB,qBAAqB,MAAM,eAAe,OAC7D,QAAO;GACL,SAAS,sCAAsC,MAAM,WAAW;GAChE,YAAY,MAAM;GAClB,SAAS;GACV;AAGH,SAAO;GAAC,SAAS;GAAiC,SAAS;GAAM;;;AAIrE,gCAAe"}

package/dist/server/actions/getUserTypesAction.d.ts

@@ -0,0 +1,18 @@
+import { SelectPageActionResult } from './runSelectPageAction';
+/**
+ * Request from the browser. Carries only paging; the session comes from the request cookie.
+ */
+export interface GetUserTypesActionRequest {
+    limit?: number;
+    offset?: number;
+}
+export type GetUserTypesActionResult = SelectPageActionResult;
+/**
+ * Loads one page of user types for a `USER_TYPE_SELECT` picker using the signed-in user's server-held
+ * session.
+ *
+ * Never throws across the server action boundary; failures are mapped to a plain result.
+ */
+declare const getUserTypesAction: ({ limit, offset }?: GetUserTypesActionRequest) => Promise<GetUserTypesActionResult>;
+export default getUserTypesAction;
+//# sourceMappingURL=getUserTypesAction.d.ts.map

package/dist/server/actions/getUserTypesAction.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"getUserTypesAction.d.ts","sourceRoot":"","sources":["../../../src/server/actions/getUserTypesAction.ts"],"names":[],"mappings":"AAMA,OAA4B,EAAC,sBAAsB,EAAC,MAAM,uBAAuB,CAAC;AAElF;;GAEG;AACH,MAAM,WAAW,yBAAyB;IACxC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,MAAM,wBAAwB,GAAG,sBAAsB,CAAC;AAE9D;;;;;GAKG;AACH,QAAA,MAAM,kBAAkB,GAAU,oBAAiB,yBAA8B,KAAG,OAAO,CAAC,wBAAwB,CAMjH,CAAC;AAEJ,eAAe,kBAAkB,CAAC"}

package/dist/server/actions/getUserTypesAction.js

@@ -0,0 +1,25 @@
+'use server';
+
+
+import runSelectPageAction_default from "./runSelectPageAction.js";
+import { capPageSize, toUserTypeSelectPage } from "@thunderid/node";
+
+//#region src/server/actions/getUserTypesAction.ts
+/**
+* Loads one page of user types for a `USER_TYPE_SELECT` picker using the signed-in user's server-held
+* session.
+*
+* Never throws across the server action boundary; failures are mapped to a plain result.
+*/
+const getUserTypesAction = async ({ limit, offset } = {}) => runSelectPageAction_default("user types", {
+	limit,
+	offset
+}, async (client, sessionId, query) => toUserTypeSelectPage(await client.getUserTypes({
+	limit: capPageSize(query.limit),
+	offset: query.offset
+}, sessionId), query.offset ?? 0));
+var getUserTypesAction_default = getUserTypesAction;
+
+//#endregion
+export { getUserTypesAction_default as default };
+//# sourceMappingURL=getUserTypesAction.js.map

package/dist/server/actions/getUserTypesAction.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"getUserTypesAction.js","names":["runSelectPageAction"],"sources":["../../../src/server/actions/getUserTypesAction.ts"],"sourcesContent":["// Copyright 2026 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\n'use server';\n\nimport {capPageSize, toUserTypeSelectPage} from '@thunderid/node';\nimport runSelectPageAction, {SelectPageActionResult} from './runSelectPageAction';\n\n/**\n * Request from the browser. Carries only paging; the session comes from the request cookie.\n */\nexport interface GetUserTypesActionRequest {\n  limit?: number;\n  offset?: number;\n}\n\nexport type GetUserTypesActionResult = SelectPageActionResult;\n\n/**\n * Loads one page of user types for a `USER_TYPE_SELECT` picker using the signed-in user's server-held\n * session.\n *\n * Never throws across the server action boundary; failures are mapped to a plain result.\n */\nconst getUserTypesAction = async ({limit, offset}: GetUserTypesActionRequest = {}): Promise<GetUserTypesActionResult> =>\n  runSelectPageAction('user types', {limit, offset}, async (client, sessionId, query) =>\n    toUserTypeSelectPage(\n      await client.getUserTypes({limit: capPageSize(query.limit), offset: query.offset}, sessionId),\n      query.offset ?? 0,\n    ),\n  );\n\nexport default getUserTypesAction;\n"],"mappings":";;;;;;;;;;;;;AAwBA,MAAM,qBAAqB,OAAO,EAAC,OAAO,WAAqC,EAAE,KAC/EA,4BAAoB,cAAc;CAAC;CAAO;CAAO,EAAE,OAAO,QAAQ,WAAW,UAC3E,qBACE,MAAM,OAAO,aAAa;CAAC,OAAO,YAAY,MAAM,MAAM;CAAE,QAAQ,MAAM;CAAO,EAAE,UAAU,EAC7F,MAAM,UAAU,EACjB,CACF;AAEH,iCAAe"}

package/dist/server/actions/getUsersAction.d.ts

@@ -0,0 +1,18 @@
+import { SelectPageActionResult } from './runSelectPageAction';
+/**
+ * Request from the browser. Carries no session ID, token, or URL; the session comes from the request cookie.
+ */
+export interface GetUsersActionRequest {
+    filter?: string;
+    limit?: number;
+    offset?: number;
+}
+export type GetUsersActionResult = SelectPageActionResult;
+/**
+ * Loads one page of users for a `USER_SELECT` picker using the signed-in user's server-held session.
+ *
+ * Never throws across the server action boundary; failures are mapped to a plain result.
+ */
+declare const getUsersAction: ({ filter, limit, offset }?: GetUsersActionRequest) => Promise<GetUsersActionResult>;
+export default getUsersAction;
+//# sourceMappingURL=getUsersAction.d.ts.map

package/dist/server/actions/getUsersAction.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"getUsersAction.d.ts","sourceRoot":"","sources":["../../../src/server/actions/getUsersAction.ts"],"names":[],"mappings":"AAMA,OAA4B,EAAC,sBAAsB,EAAC,MAAM,uBAAuB,CAAC;AAElF;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,MAAM,oBAAoB,GAAG,sBAAsB,CAAC;AAE1D;;;;GAIG;AACH,QAAA,MAAM,cAAc,GAAU,4BAAyB,qBAA0B,KAAG,OAAO,CAAC,oBAAoB,CAU7G,CAAC;AAEJ,eAAe,cAAc,CAAC"}

package/dist/server/actions/getUsersAction.js

@@ -0,0 +1,26 @@
+'use server';
+
+
+import runSelectPageAction_default from "./runSelectPageAction.js";
+import { toUserSelectPage } from "@thunderid/node";
+
+//#region src/server/actions/getUsersAction.ts
+/**
+* Loads one page of users for a `USER_SELECT` picker using the signed-in user's server-held session.
+*
+* Never throws across the server action boundary; failures are mapped to a plain result.
+*/
+const getUsersAction = async ({ filter, limit, offset } = {}) => runSelectPageAction_default("users", {
+	filter,
+	limit,
+	offset
+}, async (client, sessionId, query) => toUserSelectPage(await client.getUsers({
+	filter: query.filter,
+	limit: query.limit,
+	offset: query.offset
+}, sessionId), query.offset ?? 0), { allowFilter: true });
+var getUsersAction_default = getUsersAction;
+
+//#endregion
+export { getUsersAction_default as default };
+//# sourceMappingURL=getUsersAction.js.map

package/dist/server/actions/getUsersAction.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"getUsersAction.js","names":["runSelectPageAction"],"sources":["../../../src/server/actions/getUsersAction.ts"],"sourcesContent":["// Copyright 2026 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\n'use server';\n\nimport {toUserSelectPage} from '@thunderid/node';\nimport runSelectPageAction, {SelectPageActionResult} from './runSelectPageAction';\n\n/**\n * Request from the browser. Carries no session ID, token, or URL; the session comes from the request cookie.\n */\nexport interface GetUsersActionRequest {\n  filter?: string;\n  limit?: number;\n  offset?: number;\n}\n\nexport type GetUsersActionResult = SelectPageActionResult;\n\n/**\n * Loads one page of users for a `USER_SELECT` picker using the signed-in user's server-held session.\n *\n * Never throws across the server action boundary; failures are mapped to a plain result.\n */\nconst getUsersAction = async ({filter, limit, offset}: GetUsersActionRequest = {}): Promise<GetUsersActionResult> =>\n  runSelectPageAction(\n    'users',\n    {filter, limit, offset},\n    async (client, sessionId, query) =>\n      toUserSelectPage(\n        await client.getUsers({filter: query.filter, limit: query.limit, offset: query.offset}, sessionId),\n        query.offset ?? 0,\n      ),\n    {allowFilter: true},\n  );\n\nexport default getUsersAction;\n"],"mappings":";;;;;;;;;;;;AAwBA,MAAM,iBAAiB,OAAO,EAAC,QAAQ,OAAO,WAAiC,EAAE,KAC/EA,4BACE,SACA;CAAC;CAAQ;CAAO;CAAO,EACvB,OAAO,QAAQ,WAAW,UACxB,iBACE,MAAM,OAAO,SAAS;CAAC,QAAQ,MAAM;CAAQ,OAAO,MAAM;CAAO,QAAQ,MAAM;CAAO,EAAE,UAAU,EAClG,MAAM,UAAU,EACjB,EACH,EAAC,aAAa,MAAK,CACpB;AAEH,6BAAe"}

package/dist/server/actions/handleOAuthCallbackAction.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"handleOAuthCallbackAction.d.ts","sourceRoot":"","sources":["../../../src/server/actions/handleOAuthCallbackAction.ts"],"names":[],"mappings":"AAeA;;;;;;;;GAQG;AACH,QAAA,MAAM,yBAAyB,GAC7B,MAAM,MAAM,EACZ,OAAO,MAAM,KACZ,OAAO,CAAC;IACT,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,OAAO,CAAC;CAClB,CA0HA,CAAC;AAEF,eAAe,yBAAyB,CAAC"}
+{"version":3,"file":"handleOAuthCallbackAction.d.ts","sourceRoot":"","sources":["../../../src/server/actions/handleOAuthCallbackAction.ts"],"names":[],"mappings":"AAeA;;;;;;;;GAQG;AACH,QAAA,MAAM,yBAAyB,GAC7B,MAAM,MAAM,EACZ,OAAO,MAAM,KACZ,OAAO,CAAC;IACT,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,OAAO,CAAC;CAClB,CAgIA,CAAC;AAEF,eAAe,yBAAyB,CAAC"}

package/dist/server/actions/handleOAuthCallbackAction.js

@@ -24,6 +24,7 @@ const handleOAuthCallbackAction = async (code, state) => {
 			success: false
 		};
 		const thunderIDClient = getClient_default();
+		if (!thunderIDClient.isInitialized) await thunderIDClient.initialize({});
 		if (!thunderIDClient.isInitialized) return {
 			error: "ThunderID client is not initialized",
 			success: false

package/dist/server/actions/handleOAuthCallbackAction.js.map

@@ -1 +1 @@
-{"version":3,"file":"handleOAuthCallbackAction.js","names":["getClient","cookieStore: RequestCookies","sessionId: string | undefined","tempSessionToken: string | undefined","SessionManager","signInResult: Record<string, unknown>","config: ThunderIDNextConfig","idToken: IdToken","accessToken: string","refreshToken: string","userIdFromToken: string","scopes: string","organizationId: string | undefined","expiresIn: number","sessionCookieExpiryTime: number","sessionToken: string"],"sources":["../../../src/server/actions/handleOAuthCallbackAction.ts"],"sourcesContent":["// Copyright 2025 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\n'use server';\n\nimport {IdToken} from '@thunderid/node';\nimport {cookies} from 'next/headers';\nimport {ThunderIDNextConfig} from '../../models/config';\nimport {setChunkedCookie} from '../../utils/chunkedCookie';\nimport logger from '../../utils/logger';\nimport SessionManager from '../../utils/SessionManager';\nimport getClient from '../getClient';\n\ntype RequestCookies = Awaited<ReturnType<typeof cookies>>;\n\n/**\n * Server action to handle OAuth callback with authorization code.\n * This action processes the authorization code received from the OAuth provider\n * and exchanges it for tokens to complete the authentication flow.\n *\n * @param code - Authorization code from OAuth provider\n * @param state - State parameter from OAuth provider for CSRF protection\n * @returns Promise that resolves with success status and optional error message\n */\nconst handleOAuthCallbackAction = async (\n  code: string,\n  state: string,\n): Promise<{\n  error?: string;\n  redirectUrl?: string;\n  success: boolean;\n}> => {\n  try {\n    if (!code || !state) {\n      return {\n        error: 'Missing required OAuth parameters: code and state are required',\n        success: false,\n      };\n    }\n\n    const thunderIDClient = getClient();\n\n    if (!thunderIDClient.isInitialized) {\n      return {\n        error: 'ThunderID client is not initialized',\n        success: false,\n      };\n    }\n\n    const cookieStore: RequestCookies = await cookies();\n    let sessionId: string | undefined;\n\n    const tempSessionToken: string | undefined = cookieStore.get(SessionManager.getTempSessionCookieName())?.value;\n\n    if (tempSessionToken) {\n      try {\n        const tempSession: {sessionId: string} = await SessionManager.verifyTempSession(tempSessionToken);\n        sessionId = tempSession.sessionId;\n      } catch {\n        logger.error(\n          '[handleOAuthCallbackAction] Invalid temporary session token, falling back to session ID from cookies.',\n        );\n      }\n    }\n\n    if (!sessionId) {\n      logger.error('[handleOAuthCallbackAction] No session ID found in cookies or temporary session token.');\n\n      return {\n        error: 'No session found. Please start the authentication flow again.',\n        success: false,\n      };\n    }\n\n    // Exchange the authorization code for tokens\n    const signInResult: Record<string, unknown> = await thunderIDClient.signIn(\n      {\n        code,\n        state,\n      } as any,\n      {},\n      sessionId,\n    );\n\n    const config: ThunderIDNextConfig = await thunderIDClient.getConfiguration();\n\n    if (signInResult) {\n      try {\n        const idToken: IdToken = await thunderIDClient.getDecodedIdToken(\n          sessionId,\n          (signInResult['id_token'] || signInResult['idToken']) as string,\n        );\n        const accessToken: string = (signInResult['accessToken'] || signInResult['access_token']) as string;\n        const refreshToken: string = (signInResult['refreshToken'] as string | undefined) ?? '';\n        const userIdFromToken: string = (idToken.sub || signInResult['sub'] || sessionId) as string;\n        const scopes: string = signInResult['scope'] as string;\n        const organizationId: string | undefined = (idToken['user_org'] || idToken['organization_id']) as\n          | string\n          | undefined;\n        const expiresIn: number = signInResult['expiresIn'] as number;\n        const sessionCookieExpiryTime: number = SessionManager.resolveSessionCookieExpiry(\n          config.sessionCookie?.expiryTime,\n        );\n\n        const sessionToken: string = await SessionManager.createSessionToken(\n          accessToken,\n          userIdFromToken,\n          sessionId,\n          scopes,\n          expiresIn,\n          refreshToken,\n          organizationId,\n          {sid: typeof idToken['sid'] === 'string' ? idToken['sid'] : undefined},\n        );\n\n        setChunkedCookie(\n          cookieStore,\n          SessionManager.getSessionCookieName(),\n          sessionToken,\n          SessionManager.getSessionCookieOptions(sessionCookieExpiryTime),\n        );\n\n        cookieStore.delete(SessionManager.getTempSessionCookieName());\n      } catch (error) {\n        logger.error(\n          `[handleOAuthCallbackAction] Failed to create JWT session, continuing with legacy session:\n          ${typeof error === 'string' ? error : JSON.stringify(error)}`,\n        );\n      }\n    }\n\n    const afterSignInUrl: string = config.afterSignInUrl || '/';\n\n    return {\n      redirectUrl: afterSignInUrl,\n      success: true,\n    };\n  } catch (error) {\n    let errorMessage = 'Authentication failed';\n\n    if (error instanceof Error) {\n      errorMessage = error.message;\n    } else if (error && typeof error === 'object' && 'message' in error) {\n      errorMessage = String((error as {message: unknown}).message);\n    } else if (typeof error === 'string') {\n      errorMessage = error;\n    }\n\n    return {\n      error: errorMessage,\n      success: false,\n    };\n  }\n};\n\nexport default handleOAuthCallbackAction;\n"],"mappings":";;;;;;;;;;;;;;;;;;;AAwBA,MAAM,4BAA4B,OAChC,MACA,UAKI;AACJ,KAAI;AACF,MAAI,CAAC,QAAQ,CAAC,MACZ,QAAO;GACL,OAAO;GACP,SAAS;GACV;EAGH,MAAM,kBAAkBA,mBAAW;AAEnC,MAAI,CAAC,gBAAgB,cACnB,QAAO;GACL,OAAO;GACP,SAAS;GACV;EAGH,MAAMC,cAA8B,MAAM,SAAS;EACnD,IAAIC;EAEJ,MAAMC,mBAAuC,YAAY,IAAIC,uBAAe,0BAA0B,CAAC,EAAE;AAEzG,MAAI,iBACF,KAAI;AAEF,gBADyC,MAAMA,uBAAe,kBAAkB,iBAAiB,EACzE;UAClB;AACN,kBAAO,MACL,wGACD;;AAIL,MAAI,CAAC,WAAW;AACd,kBAAO,MAAM,yFAAyF;AAEtG,UAAO;IACL,OAAO;IACP,SAAS;IACV;;EAIH,MAAMC,eAAwC,MAAM,gBAAgB,OAClE;GACE;GACA;GACD,EACD,EAAE,EACF,UACD;EAED,MAAMC,SAA8B,MAAM,gBAAgB,kBAAkB;AAE5E,MAAI,aACF,KAAI;GACF,MAAMC,UAAmB,MAAM,gBAAgB,kBAC7C,WACC,aAAa,eAAe,aAAa,WAC3C;GACD,MAAMC,cAAuB,aAAa,kBAAkB,aAAa;GACzE,MAAMC,eAAwB,aAAa,mBAA0C;GACrF,MAAMC,kBAA2B,QAAQ,OAAO,aAAa,UAAU;GACvE,MAAMC,SAAiB,aAAa;GACpC,MAAMC,iBAAsC,QAAQ,eAAe,QAAQ;GAG3E,MAAMC,YAAoB,aAAa;GACvC,MAAMC,0BAAkCV,uBAAe,2BACrD,OAAO,eAAe,WACvB;GAED,MAAMW,eAAuB,MAAMX,uBAAe,mBAChD,aACA,iBACA,WACA,QACA,WACA,cACA,gBACA,EAAC,KAAK,OAAO,QAAQ,WAAW,WAAW,QAAQ,SAAS,QAAU,CACvE;AAED,oBACE,aACAA,uBAAe,sBAAsB,EACrC,cACAA,uBAAe,wBAAwB,wBAAwB,CAChE;AAED,eAAY,OAAOA,uBAAe,0BAA0B,CAAC;WACtD,OAAO;AACd,kBAAO,MACL;YACE,OAAO,UAAU,WAAW,QAAQ,KAAK,UAAU,MAAM,GAC5D;;AAML,SAAO;GACL,aAH6B,OAAO,kBAAkB;GAItD,SAAS;GACV;UACM,OAAO;EACd,IAAI,eAAe;AAEnB,MAAI,iBAAiB,MACnB,gBAAe,MAAM;WACZ,SAAS,OAAO,UAAU,YAAY,aAAa,MAC5D,gBAAe,OAAQ,MAA6B,QAAQ;WACnD,OAAO,UAAU,SAC1B,gBAAe;AAGjB,SAAO;GACL,OAAO;GACP,SAAS;GACV;;;AAIL,wCAAe"}
+{"version":3,"file":"handleOAuthCallbackAction.js","names":["getClient","cookieStore: RequestCookies","sessionId: string | undefined","tempSessionToken: string | undefined","SessionManager","signInResult: Record<string, unknown>","config: ThunderIDNextConfig","idToken: IdToken","accessToken: string","refreshToken: string","userIdFromToken: string","scopes: string","organizationId: string | undefined","expiresIn: number","sessionCookieExpiryTime: number","sessionToken: string"],"sources":["../../../src/server/actions/handleOAuthCallbackAction.ts"],"sourcesContent":["// Copyright 2025 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\n'use server';\n\nimport {IdToken} from '@thunderid/node';\nimport {cookies} from 'next/headers';\nimport {ThunderIDNextConfig} from '../../models/config';\nimport {setChunkedCookie} from '../../utils/chunkedCookie';\nimport logger from '../../utils/logger';\nimport SessionManager from '../../utils/SessionManager';\nimport getClient from '../getClient';\n\ntype RequestCookies = Awaited<ReturnType<typeof cookies>>;\n\n/**\n * Server action to handle OAuth callback with authorization code.\n * This action processes the authorization code received from the OAuth provider\n * and exchanges it for tokens to complete the authentication flow.\n *\n * @param code - Authorization code from OAuth provider\n * @param state - State parameter from OAuth provider for CSRF protection\n * @returns Promise that resolves with success status and optional error message\n */\nconst handleOAuthCallbackAction = async (\n  code: string,\n  state: string,\n): Promise<{\n  error?: string;\n  redirectUrl?: string;\n  success: boolean;\n}> => {\n  try {\n    if (!code || !state) {\n      return {\n        error: 'Missing required OAuth parameters: code and state are required',\n        success: false,\n      };\n    }\n\n    const thunderIDClient = getClient();\n\n    // A server action can run in a module context that no provider render has initialized, for\n    // example after the dev server recompiles, so initialize from the environment first.\n    if (!thunderIDClient.isInitialized) {\n      await thunderIDClient.initialize({} as ThunderIDNextConfig);\n    }\n\n    if (!thunderIDClient.isInitialized) {\n      return {\n        error: 'ThunderID client is not initialized',\n        success: false,\n      };\n    }\n\n    const cookieStore: RequestCookies = await cookies();\n    let sessionId: string | undefined;\n\n    const tempSessionToken: string | undefined = cookieStore.get(SessionManager.getTempSessionCookieName())?.value;\n\n    if (tempSessionToken) {\n      try {\n        const tempSession: {sessionId: string} = await SessionManager.verifyTempSession(tempSessionToken);\n        sessionId = tempSession.sessionId;\n      } catch {\n        logger.error(\n          '[handleOAuthCallbackAction] Invalid temporary session token, falling back to session ID from cookies.',\n        );\n      }\n    }\n\n    if (!sessionId) {\n      logger.error('[handleOAuthCallbackAction] No session ID found in cookies or temporary session token.');\n\n      return {\n        error: 'No session found. Please start the authentication flow again.',\n        success: false,\n      };\n    }\n\n    // Exchange the authorization code for tokens\n    const signInResult: Record<string, unknown> = await thunderIDClient.signIn(\n      {\n        code,\n        state,\n      } as any,\n      {},\n      sessionId,\n    );\n\n    const config: ThunderIDNextConfig = await thunderIDClient.getConfiguration();\n\n    if (signInResult) {\n      try {\n        const idToken: IdToken = await thunderIDClient.getDecodedIdToken(\n          sessionId,\n          (signInResult['id_token'] || signInResult['idToken']) as string,\n        );\n        const accessToken: string = (signInResult['accessToken'] || signInResult['access_token']) as string;\n        const refreshToken: string = (signInResult['refreshToken'] as string | undefined) ?? '';\n        const userIdFromToken: string = (idToken.sub || signInResult['sub'] || sessionId) as string;\n        const scopes: string = signInResult['scope'] as string;\n        const organizationId: string | undefined = (idToken['user_org'] || idToken['organization_id']) as\n          | string\n          | undefined;\n        const expiresIn: number = signInResult['expiresIn'] as number;\n        const sessionCookieExpiryTime: number = SessionManager.resolveSessionCookieExpiry(\n          config.sessionCookie?.expiryTime,\n        );\n\n        const sessionToken: string = await SessionManager.createSessionToken(\n          accessToken,\n          userIdFromToken,\n          sessionId,\n          scopes,\n          expiresIn,\n          refreshToken,\n          organizationId,\n          {sid: typeof idToken['sid'] === 'string' ? idToken['sid'] : undefined},\n        );\n\n        setChunkedCookie(\n          cookieStore,\n          SessionManager.getSessionCookieName(),\n          sessionToken,\n          SessionManager.getSessionCookieOptions(sessionCookieExpiryTime),\n        );\n\n        cookieStore.delete(SessionManager.getTempSessionCookieName());\n      } catch (error) {\n        logger.error(\n          `[handleOAuthCallbackAction] Failed to create JWT session, continuing with legacy session:\n          ${typeof error === 'string' ? error : JSON.stringify(error)}`,\n        );\n      }\n    }\n\n    const afterSignInUrl: string = config.afterSignInUrl || '/';\n\n    return {\n      redirectUrl: afterSignInUrl,\n      success: true,\n    };\n  } catch (error) {\n    let errorMessage = 'Authentication failed';\n\n    if (error instanceof Error) {\n      errorMessage = error.message;\n    } else if (error && typeof error === 'object' && 'message' in error) {\n      errorMessage = String((error as {message: unknown}).message);\n    } else if (typeof error === 'string') {\n      errorMessage = error;\n    }\n\n    return {\n      error: errorMessage,\n      success: false,\n    };\n  }\n};\n\nexport default handleOAuthCallbackAction;\n"],"mappings":";;;;;;;;;;;;;;;;;;;AAwBA,MAAM,4BAA4B,OAChC,MACA,UAKI;AACJ,KAAI;AACF,MAAI,CAAC,QAAQ,CAAC,MACZ,QAAO;GACL,OAAO;GACP,SAAS;GACV;EAGH,MAAM,kBAAkBA,mBAAW;AAInC,MAAI,CAAC,gBAAgB,cACnB,OAAM,gBAAgB,WAAW,EAAE,CAAwB;AAG7D,MAAI,CAAC,gBAAgB,cACnB,QAAO;GACL,OAAO;GACP,SAAS;GACV;EAGH,MAAMC,cAA8B,MAAM,SAAS;EACnD,IAAIC;EAEJ,MAAMC,mBAAuC,YAAY,IAAIC,uBAAe,0BAA0B,CAAC,EAAE;AAEzG,MAAI,iBACF,KAAI;AAEF,gBADyC,MAAMA,uBAAe,kBAAkB,iBAAiB,EACzE;UAClB;AACN,kBAAO,MACL,wGACD;;AAIL,MAAI,CAAC,WAAW;AACd,kBAAO,MAAM,yFAAyF;AAEtG,UAAO;IACL,OAAO;IACP,SAAS;IACV;;EAIH,MAAMC,eAAwC,MAAM,gBAAgB,OAClE;GACE;GACA;GACD,EACD,EAAE,EACF,UACD;EAED,MAAMC,SAA8B,MAAM,gBAAgB,kBAAkB;AAE5E,MAAI,aACF,KAAI;GACF,MAAMC,UAAmB,MAAM,gBAAgB,kBAC7C,WACC,aAAa,eAAe,aAAa,WAC3C;GACD,MAAMC,cAAuB,aAAa,kBAAkB,aAAa;GACzE,MAAMC,eAAwB,aAAa,mBAA0C;GACrF,MAAMC,kBAA2B,QAAQ,OAAO,aAAa,UAAU;GACvE,MAAMC,SAAiB,aAAa;GACpC,MAAMC,iBAAsC,QAAQ,eAAe,QAAQ;GAG3E,MAAMC,YAAoB,aAAa;GACvC,MAAMC,0BAAkCV,uBAAe,2BACrD,OAAO,eAAe,WACvB;GAED,MAAMW,eAAuB,MAAMX,uBAAe,mBAChD,aACA,iBACA,WACA,QACA,WACA,cACA,gBACA,EAAC,KAAK,OAAO,QAAQ,WAAW,WAAW,QAAQ,SAAS,QAAU,CACvE;AAED,oBACE,aACAA,uBAAe,sBAAsB,EACrC,cACAA,uBAAe,wBAAwB,wBAAwB,CAChE;AAED,eAAY,OAAOA,uBAAe,0BAA0B,CAAC;WACtD,OAAO;AACd,kBAAO,MACL;YACE,OAAO,UAAU,WAAW,QAAQ,KAAK,UAAU,MAAM,GAC5D;;AAML,SAAO;GACL,aAH6B,OAAO,kBAAkB;GAItD,SAAS;GACV;UACM,OAAO;EACd,IAAI,eAAe;AAEnB,MAAI,iBAAiB,MACnB,gBAAe,MAAM;WACZ,SAAS,OAAO,UAAU,YAAY,aAAa,MAC5D,gBAAe,OAAQ,MAA6B,QAAQ;WACnD,OAAO,UAAU,SAC1B,gBAAe;AAGjB,SAAO;GACL,OAAO;GACP,SAAS;GACV;;;AAIL,wCAAe"}

package/dist/server/actions/runSelectPageAction.d.ts

@@ -0,0 +1,28 @@
+import type { SelectPageErrorResult, SelectPage, SelectPageQuery } from '@thunderid/node';
+import type ThunderIDNextClient from '../../ThunderIDNextClient';
+/**
+ * What a select page server action returns: the normalized page, or a plain failure. It never
+ * throws, because a thrown class instance loses its prototype chain crossing the server action boundary. A failure
+ * carries a message built on the server and the status, never the text of the upstream reply.
+ */
+export type SelectPageActionResult = {
+    page: SelectPage;
+    success: true;
+} | ({
+    success: false;
+} & SelectPageErrorResult);
+/**
+ * Runs one select page load with the signed-in user's server-held session. The session comes from the
+ * request cookie, never from the caller. A server action is a public endpoint, so the paging values the caller
+ * sends are checked here and not trusted from their TypeScript types. A missing session, a malformed request or any
+ * failure becomes a plain result.
+ */
+declare const runSelectPageAction: (resource: string, rawQuery: {
+    filter?: unknown;
+    limit?: unknown;
+    offset?: unknown;
+}, load: (client: ThunderIDNextClient, sessionId: string, query: SelectPageQuery) => Promise<SelectPage>, { allowFilter }?: {
+    allowFilter?: boolean;
+}) => Promise<SelectPageActionResult>;
+export default runSelectPageAction;
+//# sourceMappingURL=runSelectPageAction.d.ts.map

package/dist/server/actions/runSelectPageAction.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runSelectPageAction.d.ts","sourceRoot":"","sources":["../../../src/server/actions/runSelectPageAction.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAC,qBAAqB,EAAE,UAAU,EAAE,eAAe,EAAwB,MAAM,iBAAiB,CAAC;AAE/G,OAAO,KAAK,mBAAmB,MAAM,2BAA2B,CAAC;AAGjE;;;;GAIG;AACH,MAAM,MAAM,sBAAsB,GAAG;IAAC,IAAI,EAAE,UAAU,CAAC;IAAC,OAAO,EAAE,IAAI,CAAA;CAAC,GAAG,CAAC;IAAC,OAAO,EAAE,KAAK,CAAA;CAAC,GAAG,qBAAqB,CAAC,CAAC;AAEpH;;;;;GAKG;AACH,QAAA,MAAM,mBAAmB,GACvB,UAAU,MAAM,EAChB,UAAU;IAAC,MAAM,CAAC,EAAE,OAAO,CAAC;IAAC,KAAK,CAAC,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,OAAO,CAAA;CAAC,EAC/D,MAAM,CAAC,MAAM,EAAE,mBAAmB,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,eAAe,KAAK,OAAO,CAAC,UAAU,CAAC,EACrG,kBAAuB;IAAC,WAAW,CAAC,EAAE,OAAO,CAAA;CAAM,KAClD,OAAO,CAAC,sBAAsB,CA0BhC,CAAC;AAEF,eAAe,mBAAmB,CAAC"}

package/dist/server/actions/runSelectPageAction.js

@@ -0,0 +1,45 @@
+import getSessionId_default from "./getSessionId.js";
+import getClient_default from "../getClient.js";
+import { loadPageWithRetryAndLog, mapSelectPageError, parseSelectPageQuery } from "@thunderid/node";
+
+//#region src/server/actions/runSelectPageAction.ts
+/**
+* Runs one select page load with the signed-in user's server-held session. The session comes from the
+* request cookie, never from the caller. A server action is a public endpoint, so the paging values the caller
+* sends are checked here and not trusted from their TypeScript types. A missing session, a malformed request or any
+* failure becomes a plain result.
+*/
+const runSelectPageAction = async (resource, rawQuery, load, { allowFilter = false } = {}) => {
+	const sessionId = await getSessionId_default();
+	if (!sessionId) return {
+		message: `Failed to load ${resource} (HTTP 401).`,
+		statusCode: 401,
+		success: false
+	};
+	const checked = parseSelectPageQuery(rawQuery ?? {}, { allowFilter });
+	if (checked.invalid !== void 0) return {
+		message: `Failed to load ${resource} (HTTP 400).`,
+		statusCode: 400,
+		success: false
+	};
+	const { query } = checked;
+	try {
+		return {
+			page: await loadPageWithRetryAndLog(resource, {
+				limit: query.limit,
+				offset: query.offset
+			}, () => load(getClient_default(), sessionId, query)),
+			success: true
+		};
+	} catch (error) {
+		return {
+			...mapSelectPageError(error, resource),
+			success: false
+		};
+	}
+};
+var runSelectPageAction_default = runSelectPageAction;
+
+//#endregion
+export { runSelectPageAction_default as default };
+//# sourceMappingURL=runSelectPageAction.js.map

package/dist/server/actions/runSelectPageAction.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runSelectPageAction.js","names":["sessionId: string | undefined","getSessionId","checked: SelectPageQueryResult","getClient"],"sources":["../../../src/server/actions/runSelectPageAction.ts"],"sourcesContent":["// Copyright 2026 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\nimport {loadPageWithRetryAndLog, mapSelectPageError, parseSelectPageQuery} from '@thunderid/node';\nimport type {SelectPageErrorResult, SelectPage, SelectPageQuery, SelectPageQueryResult} from '@thunderid/node';\nimport getSessionId from './getSessionId';\nimport type ThunderIDNextClient from '../../ThunderIDNextClient';\nimport getClient from '../getClient';\n\n/**\n * What a select page server action returns: the normalized page, or a plain failure. It never\n * throws, because a thrown class instance loses its prototype chain crossing the server action boundary. A failure\n * carries a message built on the server and the status, never the text of the upstream reply.\n */\nexport type SelectPageActionResult = {page: SelectPage; success: true} | ({success: false} & SelectPageErrorResult);\n\n/**\n * Runs one select page load with the signed-in user's server-held session. The session comes from the\n * request cookie, never from the caller. A server action is a public endpoint, so the paging values the caller\n * sends are checked here and not trusted from their TypeScript types. A missing session, a malformed request or any\n * failure becomes a plain result.\n */\nconst runSelectPageAction = async (\n  resource: string,\n  rawQuery: {filter?: unknown; limit?: unknown; offset?: unknown},\n  load: (client: ThunderIDNextClient, sessionId: string, query: SelectPageQuery) => Promise<SelectPage>,\n  {allowFilter = false}: {allowFilter?: boolean} = {},\n): Promise<SelectPageActionResult> => {\n  const sessionId: string | undefined = await getSessionId();\n\n  if (!sessionId) {\n    return {message: `Failed to load ${resource} (HTTP 401).`, statusCode: 401, success: false};\n  }\n\n  const checked: SelectPageQueryResult = parseSelectPageQuery(rawQuery ?? {}, {allowFilter});\n\n  if (checked.invalid !== undefined) {\n    return {message: `Failed to load ${resource} (HTTP 400).`, statusCode: 400, success: false};\n  }\n\n  const {query} = checked;\n\n  try {\n    // The retry and the failure log live here, where the real error and its status still exist. The plain result\n    // sent to the browser carries only a message built here and the status.\n    const page: SelectPage = await loadPageWithRetryAndLog(resource, {limit: query.limit, offset: query.offset}, () =>\n      load(getClient(), sessionId, query),\n    );\n\n    return {page, success: true};\n  } catch (error) {\n    return {...mapSelectPageError(error, resource), success: false};\n  }\n};\n\nexport default runSelectPageAction;\n"],"mappings":";;;;;;;;;;;AAsBA,MAAM,sBAAsB,OAC1B,UACA,UACA,MACA,EAAC,cAAc,UAAkC,EAAE,KACf;CACpC,MAAMA,YAAgC,MAAMC,sBAAc;AAE1D,KAAI,CAAC,UACH,QAAO;EAAC,SAAS,kBAAkB,SAAS;EAAe,YAAY;EAAK,SAAS;EAAM;CAG7F,MAAMC,UAAiC,qBAAqB,YAAY,EAAE,EAAE,EAAC,aAAY,CAAC;AAE1F,KAAI,QAAQ,YAAY,OACtB,QAAO;EAAC,SAAS,kBAAkB,SAAS;EAAe,YAAY;EAAK,SAAS;EAAM;CAG7F,MAAM,EAAC,UAAS;AAEhB,KAAI;AAOF,SAAO;GAAC,MAJiB,MAAM,wBAAwB,UAAU;IAAC,OAAO,MAAM;IAAO,QAAQ,MAAM;IAAO,QACzG,KAAKC,mBAAW,EAAE,WAAW,MAAM,CACpC;GAEa,SAAS;GAAK;UACrB,OAAO;AACd,SAAO;GAAC,GAAG,mBAAmB,OAAO,SAAS;GAAE,SAAS;GAAM;;;AAInE,kCAAe"}

package/dist/server/proxy/createRouteMatcher.d.ts

@@ -1,23 +1,4 @@
 import { NextRequest } from 'next/server';
-/**
- * Creates a route matcher function that tests if a request matches any of the given patterns.
- *
- * @param patterns - Array of route patterns to match. Supports glob-like patterns.
- * @returns Function that tests if a request matches any of the patterns
- *
- * @example
- * ```typescript
- * const isProtectedRoute = createRouteMatcher([
- *   '/dashboard(.*)',
- *   '/admin(.*)',
- *   '/profile'
- * ]);
- *
- * if (isProtectedRoute(req)) {
- *   // Route is protected
- * }
- * ```
- */
 declare const createRouteMatcher: (patterns: string[]) => ((req: NextRequest) => boolean);
 export default createRouteMatcher;
 //# sourceMappingURL=createRouteMatcher.d.ts.map

package/dist/server/proxy/createRouteMatcher.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"createRouteMatcher.d.ts","sourceRoot":"","sources":["../../../src/server/proxy/createRouteMatcher.ts"],"names":[],"mappings":"AAGA,OAAO,EAAC,WAAW,EAAC,MAAM,aAAa,CAAC;AAExC;;;;;;;;;;;;;;;;;;GAkBG;AACH,QAAA,MAAM,kBAAkB,GAAI,UAAU,MAAM,EAAE,KAAG,CAAC,CAAC,GAAG,EAAE,WAAW,KAAK,OAAO,CAe9E,CAAC;AAEF,eAAe,kBAAkB,CAAC"}
+{"version":3,"file":"createRouteMatcher.d.ts","sourceRoot":"","sources":["../../../src/server/proxy/createRouteMatcher.ts"],"names":[],"mappings":"AAGA,OAAO,EAAC,WAAW,EAAC,MAAM,aAAa,CAAC;AAmDxC,QAAA,MAAM,kBAAkB,GAAI,UAAU,MAAM,EAAE,KAAG,CAAC,CAAC,GAAG,EAAE,WAAW,KAAK,OAAO,CAO9E,CAAC;AAEF,eAAe,kBAAkB,CAAC"}

package/dist/server/proxy/createRouteMatcher.js

@@ -18,11 +18,28 @@
 * }
 * ```
 */
+/**
+* Converts one route pattern to a regular expression source. A parenthesized group such as `(.*)` is kept as
+* regex, so `/dashboard(.*)` matches `/dashboard` and everything under it. Outside a group a `.` is a literal dot
+* and a `*` matches any run of characters.
+*/
+const toRegexSource = (pattern) => {
+	let source = "";
+	let depth = 0;
+	for (const char of pattern) if (char === "(") {
+		depth += 1;
+		source += char;
+	} else if (char === ")") {
+		depth = Math.max(depth - 1, 0);
+		source += char;
+	} else if (depth > 0) source += char;
+	else if (char === ".") source += "\\.";
+	else if (char === "*") source += ".*";
+	else source += char;
+	return source;
+};
 const createRouteMatcher = (patterns) => {
-	const regexPatterns = patterns.map((pattern) => {
-		const regexPattern = pattern.replace(/\./g, "\\.").replace(/\*/g, ".*").replace(/\(\.\*\)/g, "(.*)");
-		return /* @__PURE__ */ new RegExp(`^${regexPattern}$`);
-	});
+	const regexPatterns = patterns.map((pattern) => /* @__PURE__ */ new RegExp(`^${toRegexSource(pattern)}$`));
 	return (req) => {
 		const { pathname } = req.nextUrl;
 		return regexPatterns.some((regex) => regex.test(pathname));

package/dist/server/proxy/createRouteMatcher.js.map

@@ -1 +1 @@
-{"version":3,"file":"createRouteMatcher.js","names":["regexPatterns: RegExp[]","regexPattern: string"],"sources":["../../../src/server/proxy/createRouteMatcher.ts"],"sourcesContent":["// Copyright 2025 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\nimport {NextRequest} from 'next/server';\n\n/**\n * Creates a route matcher function that tests if a request matches any of the given patterns.\n *\n * @param patterns - Array of route patterns to match. Supports glob-like patterns.\n * @returns Function that tests if a request matches any of the patterns\n *\n * @example\n * ```typescript\n * const isProtectedRoute = createRouteMatcher([\n *   '/dashboard(.*)',\n *   '/admin(.*)',\n *   '/profile'\n * ]);\n *\n * if (isProtectedRoute(req)) {\n *   // Route is protected\n * }\n * ```\n */\nconst createRouteMatcher = (patterns: string[]): ((req: NextRequest) => boolean) => {\n  const regexPatterns: RegExp[] = patterns.map((pattern: string): RegExp => {\n    // Convert glob-like patterns to regex\n    const regexPattern: string = pattern\n      .replace(/\\./g, '\\\\.') // Escape dots\n      .replace(/\\*/g, '.*') // Convert * to .*\n      .replace(/\\(\\.\\*\\)/g, '(.*)'); // Handle explicit (.*) patterns\n\n    return new RegExp(`^${regexPattern}$`);\n  });\n\n  return (req: NextRequest): boolean => {\n    const {pathname} = req.nextUrl;\n    return regexPatterns.some((regex: RegExp): boolean => regex.test(pathname));\n  };\n};\n\nexport default createRouteMatcher;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAwBA,MAAM,sBAAsB,aAAwD;CAClF,MAAMA,gBAA0B,SAAS,KAAK,YAA4B;EAExE,MAAMC,eAAuB,QAC1B,QAAQ,OAAO,MAAM,CACrB,QAAQ,OAAO,KAAK,CACpB,QAAQ,aAAa,OAAO;AAE/B,yBAAO,IAAI,OAAO,IAAI,aAAa,GAAG;GACtC;AAEF,SAAQ,QAA8B;EACpC,MAAM,EAAC,aAAY,IAAI;AACvB,SAAO,cAAc,MAAM,UAA2B,MAAM,KAAK,SAAS,CAAC;;;AAI/E,iCAAe"}
+{"version":3,"file":"createRouteMatcher.js","names":["regexPatterns: RegExp[]"],"sources":["../../../src/server/proxy/createRouteMatcher.ts"],"sourcesContent":["// Copyright 2025 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\nimport {NextRequest} from 'next/server';\n\n/**\n * Creates a route matcher function that tests if a request matches any of the given patterns.\n *\n * @param patterns - Array of route patterns to match. Supports glob-like patterns.\n * @returns Function that tests if a request matches any of the patterns\n *\n * @example\n * ```typescript\n * const isProtectedRoute = createRouteMatcher([\n *   '/dashboard(.*)',\n *   '/admin(.*)',\n *   '/profile'\n * ]);\n *\n * if (isProtectedRoute(req)) {\n *   // Route is protected\n * }\n * ```\n */\n/**\n * Converts one route pattern to a regular expression source. A parenthesized group such as `(.*)` is kept as\n * regex, so `/dashboard(.*)` matches `/dashboard` and everything under it. Outside a group a `.` is a literal dot\n * and a `*` matches any run of characters.\n */\nconst toRegexSource = (pattern: string): string => {\n  let source = '';\n  let depth = 0;\n\n  for (const char of pattern) {\n    if (char === '(') {\n      depth += 1;\n      source += char;\n    } else if (char === ')') {\n      depth = Math.max(depth - 1, 0);\n      source += char;\n    } else if (depth > 0) {\n      source += char;\n    } else if (char === '.') {\n      source += '\\\\.';\n    } else if (char === '*') {\n      source += '.*';\n    } else {\n      source += char;\n    }\n  }\n\n  return source;\n};\n\nconst createRouteMatcher = (patterns: string[]): ((req: NextRequest) => boolean) => {\n  const regexPatterns: RegExp[] = patterns.map((pattern: string): RegExp => new RegExp(`^${toRegexSource(pattern)}$`));\n\n  return (req: NextRequest): boolean => {\n    const {pathname} = req.nextUrl;\n    return regexPatterns.some((regex: RegExp): boolean => regex.test(pathname));\n  };\n};\n\nexport default createRouteMatcher;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AA6BA,MAAM,iBAAiB,YAA4B;CACjD,IAAI,SAAS;CACb,IAAI,QAAQ;AAEZ,MAAK,MAAM,QAAQ,QACjB,KAAI,SAAS,KAAK;AAChB,WAAS;AACT,YAAU;YACD,SAAS,KAAK;AACvB,UAAQ,KAAK,IAAI,QAAQ,GAAG,EAAE;AAC9B,YAAU;YACD,QAAQ,EACjB,WAAU;UACD,SAAS,IAClB,WAAU;UACD,SAAS,IAClB,WAAU;KAEV,WAAU;AAId,QAAO;;AAGT,MAAM,sBAAsB,aAAwD;CAClF,MAAMA,gBAA0B,SAAS,KAAK,4BAA4B,IAAI,OAAO,IAAI,cAAc,QAAQ,CAAC,GAAG,CAAC;AAEpH,SAAQ,QAA8B;EACpC,MAAM,EAAC,aAAY,IAAI;AACvB,SAAO,cAAc,MAAM,UAA2B,MAAM,KAAK,SAAS,CAAC;;;AAI/E,iCAAe"}

package/dist/utils/SessionManager.d.ts

@@ -1,4 +1,4 @@
-import { JWTPayload } from 'jose';
+import type { JWTPayload } from 'jose';
 /**
  * Session token payload interface
  */

package/dist/utils/SessionManager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"SessionManager.d.ts","sourceRoot":"","sources":["../../src/utils/SessionManager.ts"],"names":[],"mappings":"AAIA,OAAO,EAAoC,UAAU,EAAC,MAAM,MAAM,CAAC;AAInE;;GAEG;AACH,MAAM,WAAW,mBAAoB,SAAQ,UAAU;IACrD,8FAA8F;IAC9F,GAAG,EAAE,MAAM,CAAC;IACZ,0BAA0B;IAC1B,GAAG,EAAE,MAAM,CAAC;IACZ,oCAAoC;IACpC,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,yEAAyE;IACzE,YAAY,EAAE,MAAM,CAAC;IACrB,mBAAmB;IACnB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,iBAAiB;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,8EAA8E;IAC9E,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,oFAAoF;IACpF,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,cAAc;IACd,GAAG,EAAE,MAAM,CAAC;IACZ,0EAA0E;IAC1E,IAAI,EAAE,SAAS,CAAC;CACjB;AAED;;GAEG;AACH,cAAM,cAAc;IAClB;;;OAGG;IACH,OAAO,CAAC,MAAM,CAAC,SAAS;IAqBxB;;OAEG;WACU,iBAAiB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAelE;;;;;;;OAOG;IACH,MAAM,CAAC,0BAA0B,CAAC,gBAAgB,CAAC,EAAE,MAAM,GAAG,MAAM;WAkBvD,kBAAkB,CAC7B,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EACd,qBAAqB,EAAE,MAAM,EAC7B,YAAY,EAAE,MAAM,EACpB,cAAc,CAAC,EAAE,MAAM,EACvB,aAAa,CAAC,EAAE;QAAC,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAC,GAClD,OAAO,CAAC,MAAM,CAAC;IAuBlB;;OAEG;WACU,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC;IAsB5E;;;;;;;;;;OAUG;WACU,4BAA4B,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC;IAuBtF;;OAEG;WACU,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAC,CAAC;IAoB3E;;OAEG;IACH;;;OAGG;mBACkB,sBAAsB;IAY3C,MAAM,CAAC,uBAAuB,CAAC,MAAM,EAAE,MAAM,GAAG;QAC9C,QAAQ,EAAE,OAAO,CAAC;QAClB,MAAM,EAAE,MAAM,CAAC;QACf,IAAI,EAAE,MAAM,CAAC;QACb,QAAQ,EAAE,KAAK,CAAC;QAChB,MAAM,EAAE,OAAO,CAAC;KACjB;IAUD;;OAEG;IACH,MAAM,CAAC,2BAA2B,IAAI;QACpC,QAAQ,EAAE,OAAO,CAAC;QAClB,MAAM,EAAE,MAAM,CAAC;QACf,IAAI,EAAE,MAAM,CAAC;QACb,QAAQ,EAAE,KAAK,CAAC;QAChB,MAAM,EAAE,OAAO,CAAC;KACjB;IAUD;;OAEG;IACH,MAAM,CAAC,oBAAoB,IAAI,MAAM;IAIrC;;OAEG;IACH,MAAM,CAAC,wBAAwB,IAAI,MAAM;CAG1C;AAED,eAAe,cAAc,CAAC"}
+{"version":3,"file":"SessionManager.d.ts","sourceRoot":"","sources":["../../src/utils/SessionManager.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAC,UAAU,EAAC,MAAM,MAAM,CAAC;AAQrC;;GAEG;AACH,MAAM,WAAW,mBAAoB,SAAQ,UAAU;IACrD,8FAA8F;IAC9F,GAAG,EAAE,MAAM,CAAC;IACZ,0BAA0B;IAC1B,GAAG,EAAE,MAAM,CAAC;IACZ,oCAAoC;IACpC,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,yEAAyE;IACzE,YAAY,EAAE,MAAM,CAAC;IACrB,mBAAmB;IACnB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,iBAAiB;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,8EAA8E;IAC9E,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,oFAAoF;IACpF,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,cAAc;IACd,GAAG,EAAE,MAAM,CAAC;IACZ,0EAA0E;IAC1E,IAAI,EAAE,SAAS,CAAC;CACjB;AAED;;GAEG;AACH,cAAM,cAAc;IAClB;;;OAGG;IACH,OAAO,CAAC,MAAM,CAAC,SAAS;IAqBxB;;OAEG;WACU,iBAAiB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAelE;;;;;;;OAOG;IACH,MAAM,CAAC,0BAA0B,CAAC,gBAAgB,CAAC,EAAE,MAAM,GAAG,MAAM;WAkBvD,kBAAkB,CAC7B,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EACd,qBAAqB,EAAE,MAAM,EAC7B,YAAY,EAAE,MAAM,EACpB,cAAc,CAAC,EAAE,MAAM,EACvB,aAAa,CAAC,EAAE;QAAC,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAC,GAClD,OAAO,CAAC,MAAM,CAAC;IAuBlB;;OAEG;WACU,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC;IAsB5E;;;;;;;;;;OAUG;WACU,4BAA4B,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC;IAuBtF;;OAEG;WACU,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAC,CAAC;IAoB3E;;OAEG;IACH;;;OAGG;mBACkB,sBAAsB;IAY3C,MAAM,CAAC,uBAAuB,CAAC,MAAM,EAAE,MAAM,GAAG;QAC9C,QAAQ,EAAE,OAAO,CAAC;QAClB,MAAM,EAAE,MAAM,CAAC;QACf,IAAI,EAAE,MAAM,CAAC;QACb,QAAQ,EAAE,KAAK,CAAC;QAChB,MAAM,EAAE,OAAO,CAAC;KACjB;IAUD;;OAEG;IACH,MAAM,CAAC,2BAA2B,IAAI;QACpC,QAAQ,EAAE,OAAO,CAAC;QAClB,MAAM,EAAE,MAAM,CAAC;QACf,IAAI,EAAE,MAAM,CAAC;QACb,QAAQ,EAAE,KAAK,CAAC;QAChB,MAAM,EAAE,OAAO,CAAC;KACjB;IAUD;;OAEG;IACH,MAAM,CAAC,oBAAoB,IAAI,MAAM;IAIrC;;OAEG;IACH,MAAM,CAAC,wBAAwB,IAAI,MAAM;CAG1C;AAED,eAAe,cAAc,CAAC"}

package/dist/utils/SessionManager.js

@@ -1,7 +1,9 @@
 import { getLoggedOutSessions } from "./loggedOutSessions.js";
 import { DEFAULT_SESSION_COOKIE_EXPIRY_TIME } from "../constants/sessionConstants.js";
 import { CookieConfig, ThunderIDRuntimeError } from "@thunderid/node";
-import { SignJWT, compactVerify, jwtVerify } from "jose";
+import { compactVerify } from "jose/jws/compact/verify";
+import { SignJWT } from "jose/jwt/sign";
+import { jwtVerify } from "jose/jwt/verify";
 
 //#region src/utils/SessionManager.ts
 /**

package/dist/utils/SessionManager.js.map

@@ -1 +1 @@
-{"version":3,"file":"SessionManager.js","names":["secret: string | undefined","secret: Uint8Array","envValue: string | undefined","parsed: number","payload: SessionTokenPayload"],"sources":["../../src/utils/SessionManager.ts"],"sourcesContent":["// Copyright 2025 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\nimport {ThunderIDRuntimeError, CookieConfig} from '@thunderid/node';\nimport {SignJWT, jwtVerify, compactVerify, JWTPayload} from 'jose';\nimport {getLoggedOutSessions} from './loggedOutSessions';\nimport {DEFAULT_SESSION_COOKIE_EXPIRY_TIME} from '../constants/sessionConstants';\n\n/**\n * Session token payload interface\n */\nexport interface SessionTokenPayload extends JWTPayload {\n  /** Expiration timestamp — doubles as the access token expiry (JWT exp == access token exp) */\n  exp: number;\n  /** Issued at timestamp */\n  iat: number;\n  /** Organization ID if applicable */\n  organizationId?: string;\n  /** The refresh token; empty string if not provided by the auth server */\n  refreshToken: string;\n  /** OAuth scopes */\n  scopes: string[];\n  /** Session ID */\n  sessionId: string;\n  /** The server session this session joined, from the `sid` of the ID token. */\n  sid?: string;\n  /** When the user signed in, in seconds. Kept across token refresh, unlike `iat`. */\n  signedInAt?: number;\n  /** User ID */\n  sub: string;\n  /** Token type discriminant — must be 'session' for access-session JWTs */\n  type: 'session';\n}\n\n/**\n * Session management utility class for JWT-based session cookies\n */\nclass SessionManager {\n  /**\n   * Get the signing secret from environment variable\n   * Throws error in production if not set\n   */\n  private static getSecret(): Uint8Array {\n    const secret: string | undefined = process.env['THUNDERID_SECRET'];\n\n    if (!secret) {\n      if (process.env['NODE_ENV'] === 'production') {\n        throw new ThunderIDRuntimeError(\n          'THUNDERID_SECRET environment variable is required in production',\n          'session-secret-required',\n          'nextjs',\n          'Set the THUNDERID_SECRET environment variable with a secure random string',\n        );\n      }\n      // Use a default secret for development (not secure)\n      // eslint-disable-next-line no-console\n      console.warn('Using default secret for development. Set THUNDERID_SECRET for production!');\n      return new TextEncoder().encode('development-secret-not-for-production');\n    }\n\n    return new TextEncoder().encode(secret);\n  }\n\n  /**\n   * Create a temporary session cookie for login initiation\n   */\n  static async createTempSession(sessionId: string): Promise<string> {\n    const secret: Uint8Array = this.getSecret();\n\n    const jwt: string = await new SignJWT({\n      sessionId,\n      type: 'temp',\n    })\n      .setProtectedHeader({alg: 'HS256'})\n      .setIssuedAt()\n      .setExpirationTime('15m')\n      .sign(secret);\n\n    return jwt;\n  }\n\n  /**\n   * Resolve the session cookie expiry time in seconds.\n   *\n   * Resolution order (first defined value wins):\n   *   1. `configuredExpiry` — value from `ThunderIDNodeConfig.sessionCookie?.expiryTime`\n   *   2. `THUNDERID_SESSION_COOKIE_EXPIRY_TIME` environment variable\n   *   3. `DEFAULT_SESSION_COOKIE_EXPIRY_TIME` (24 hours)\n   */\n  static resolveSessionCookieExpiry(configuredExpiry?: number): number {\n    if (configuredExpiry != null && configuredExpiry > 0) {\n      return configuredExpiry;\n    }\n\n    const envValue: string | undefined = process.env['THUNDERID_SESSION_COOKIE_EXPIRY_TIME'];\n\n    if (envValue) {\n      const parsed: number = parseInt(envValue, 10);\n\n      if (!Number.isNaN(parsed) && parsed > 0) {\n        return parsed;\n      }\n    }\n\n    return DEFAULT_SESSION_COOKIE_EXPIRY_TIME;\n  }\n\n  static async createSessionToken(\n    accessToken: string,\n    userId: string,\n    sessionId: string,\n    scopes: string,\n    accessTokenTtlSeconds: number,\n    refreshToken: string,\n    organizationId?: string,\n    serverSession?: {sid?: string; signedInAt?: number},\n  ): Promise<string> {\n    const secret: Uint8Array = this.getSecret();\n\n    const jwt: string = await new SignJWT({\n      accessToken,\n      organizationId,\n      refreshToken,\n      scopes,\n      sessionId,\n      // What a back-channel logout matches this session by.\n      sid: serverSession?.sid,\n      signedInAt: serverSession?.signedInAt ?? Math.floor(Date.now() / 1000),\n      type: 'session',\n    } as Omit<SessionTokenPayload, 'sub' | 'iat' | 'exp'>)\n      .setProtectedHeader({alg: 'HS256'})\n      .setSubject(userId)\n      .setIssuedAt()\n      .setExpirationTime(Math.floor(Date.now() / 1000) + accessTokenTtlSeconds)\n      .sign(secret);\n\n    return jwt;\n  }\n\n  /**\n   * Verify and decode a session token\n   */\n  static async verifySessionToken(token: string): Promise<SessionTokenPayload> {\n    try {\n      const secret: Uint8Array = this.getSecret();\n      const {payload} = await jwtVerify(token, secret);\n\n      if (payload['type'] !== 'session') {\n        throw new Error('Invalid token type');\n      }\n\n      await this.refuseLoggedOutSession(payload as SessionTokenPayload);\n\n      return payload as SessionTokenPayload;\n    } catch (error) {\n      throw new ThunderIDRuntimeError(\n        `Invalid session token: ${error instanceof Error ? error.message : 'Unknown error'}`,\n        'invalid-session-token',\n        'nextjs',\n        'Session token verification failed',\n      );\n    }\n  }\n\n  /**\n   * Verify a session token for refresh. Validates the HMAC signature and the\n   * `type === 'session'` discriminant but intentionally skips the `exp` check\n   * so an expired access token can still be exchanged for a new one.\n   *\n   * Session lifetime is still bounded — the cookie's `maxAge` is set from\n   * `sessionCookieExpiryTime`, so the browser drops an over-age session regardless\n   * of the access-token exp embedded in the JWT.\n   *\n   * Never use the returned payload for authorization.\n   */\n  static async verifySessionTokenForRefresh(token: string): Promise<SessionTokenPayload> {\n    try {\n      const secret: Uint8Array = this.getSecret();\n      const {payload: rawPayload} = await compactVerify(token, secret);\n      const payload: SessionTokenPayload = JSON.parse(new TextDecoder().decode(rawPayload)) as SessionTokenPayload;\n\n      if (payload.type !== 'session') {\n        throw new Error('Invalid token type');\n      }\n\n      await this.refuseLoggedOutSession(payload);\n\n      return payload;\n    } catch (error) {\n      throw new ThunderIDRuntimeError(\n        `Invalid session token: ${error instanceof Error ? error.message : 'Unknown error'}`,\n        'invalid-session-token-for-refresh',\n        'nextjs',\n        'Session token signature or type check failed during refresh',\n      );\n    }\n  }\n\n  /**\n   * Verify and decode a temporary session token\n   */\n  static async verifyTempSession(token: string): Promise<{sessionId: string}> {\n    try {\n      const secret: Uint8Array = this.getSecret();\n      const {payload} = await jwtVerify(token, secret);\n\n      if (payload['type'] !== 'temp') {\n        throw new Error('Invalid token type');\n      }\n\n      return {sessionId: payload['sessionId'] as string};\n    } catch (error) {\n      throw new ThunderIDRuntimeError(\n        `Invalid temporary session token: ${error instanceof Error ? error.message : 'Unknown error'}`,\n        'invalid-temp-session-token',\n        'nextjs',\n        'Temporary session token verification failed',\n      );\n    }\n  }\n\n  /**\n   * Get session cookie options\n   */\n  /**\n   * Throws when a back-channel logout has ended the session this cookie carries. The cookie is\n   * still correctly signed, so this is the only thing that stops it from being used.\n   */\n  private static async refuseLoggedOutSession(payload: SessionTokenPayload): Promise<void> {\n    const loggedOut: boolean = await getLoggedOutSessions().isLoggedOut({\n      sid: payload.sid,\n      startedAt: payload.signedInAt ?? payload.iat,\n      sub: payload.sub,\n    });\n\n    if (loggedOut) {\n      throw new Error('The session was ended by a back-channel logout');\n    }\n  }\n\n  static getSessionCookieOptions(maxAge: number): {\n    httpOnly: boolean;\n    maxAge: number;\n    path: string;\n    sameSite: 'lax';\n    secure: boolean;\n  } {\n    return {\n      httpOnly: true,\n      maxAge,\n      path: '/',\n      sameSite: 'lax' as const,\n      secure: process.env['NODE_ENV'] === 'production',\n    };\n  }\n\n  /**\n   * Get temporary session cookie options\n   */\n  static getTempSessionCookieOptions(): {\n    httpOnly: boolean;\n    maxAge: number;\n    path: string;\n    sameSite: 'lax';\n    secure: boolean;\n  } {\n    return {\n      httpOnly: true,\n      maxAge: 15 * 60,\n      path: '/',\n      sameSite: 'lax' as const,\n      secure: process.env['NODE_ENV'] === 'production',\n    };\n  }\n\n  /**\n   * Get session cookie name\n   */\n  static getSessionCookieName(): string {\n    return CookieConfig.getSessionCookieName();\n  }\n\n  /**\n   * Get temporary session cookie name\n   */\n  static getTempSessionCookieName(): string {\n    return CookieConfig.getTempSessionCookieName();\n  }\n}\n\nexport default SessionManager;\n"],"mappings":";;;;;;;;;AAqCA,IAAM,iBAAN,MAAqB;;;;;CAKnB,OAAe,YAAwB;EACrC,MAAMA,SAA6B,QAAQ,IAAI;AAE/C,MAAI,CAAC,QAAQ;AACX,OAAI,QAAQ,IAAI,gBAAgB,aAC9B,OAAM,IAAI,sBACR,mEACA,2BACA,UACA,4EACD;AAIH,WAAQ,KAAK,6EAA6E;AAC1F,UAAO,IAAI,aAAa,CAAC,OAAO,wCAAwC;;AAG1E,SAAO,IAAI,aAAa,CAAC,OAAO,OAAO;;;;;CAMzC,aAAa,kBAAkB,WAAoC;EACjE,MAAMC,SAAqB,KAAK,WAAW;AAW3C,SAToB,MAAM,IAAI,QAAQ;GACpC;GACA,MAAM;GACP,CAAC,CACC,mBAAmB,EAAC,KAAK,SAAQ,CAAC,CAClC,aAAa,CACb,kBAAkB,MAAM,CACxB,KAAK,OAAO;;;;;;;;;;CAajB,OAAO,2BAA2B,kBAAmC;AACnE,MAAI,oBAAoB,QAAQ,mBAAmB,EACjD,QAAO;EAGT,MAAMC,WAA+B,QAAQ,IAAI;AAEjD,MAAI,UAAU;GACZ,MAAMC,SAAiB,SAAS,UAAU,GAAG;AAE7C,OAAI,CAAC,OAAO,MAAM,OAAO,IAAI,SAAS,EACpC,QAAO;;AAIX,SAAO;;CAGT,aAAa,mBACX,aACA,QACA,WACA,QACA,uBACA,cACA,gBACA,eACiB;EACjB,MAAMF,SAAqB,KAAK,WAAW;AAmB3C,SAjBoB,MAAM,IAAI,QAAQ;GACpC;GACA;GACA;GACA;GACA;GAEA,KAAK,eAAe;GACpB,YAAY,eAAe,cAAc,KAAK,MAAM,KAAK,KAAK,GAAG,IAAK;GACtE,MAAM;GACP,CAAqD,CACnD,mBAAmB,EAAC,KAAK,SAAQ,CAAC,CAClC,WAAW,OAAO,CAClB,aAAa,CACb,kBAAkB,KAAK,MAAM,KAAK,KAAK,GAAG,IAAK,GAAG,sBAAsB,CACxE,KAAK,OAAO;;;;;CAQjB,aAAa,mBAAmB,OAA6C;AAC3E,MAAI;GAEF,MAAM,EAAC,YAAW,MAAM,UAAU,OADP,KAAK,WAAW,CACK;AAEhD,OAAI,QAAQ,YAAY,UACtB,OAAM,IAAI,MAAM,qBAAqB;AAGvC,SAAM,KAAK,uBAAuB,QAA+B;AAEjE,UAAO;WACA,OAAO;AACd,SAAM,IAAI,sBACR,0BAA0B,iBAAiB,QAAQ,MAAM,UAAU,mBACnE,yBACA,UACA,oCACD;;;;;;;;;;;;;;CAeL,aAAa,6BAA6B,OAA6C;AACrF,MAAI;GAEF,MAAM,EAAC,SAAS,eAAc,MAAM,cAAc,OADvB,KAAK,WAAW,CACqB;GAChE,MAAMG,UAA+B,KAAK,MAAM,IAAI,aAAa,CAAC,OAAO,WAAW,CAAC;AAErF,OAAI,QAAQ,SAAS,UACnB,OAAM,IAAI,MAAM,qBAAqB;AAGvC,SAAM,KAAK,uBAAuB,QAAQ;AAE1C,UAAO;WACA,OAAO;AACd,SAAM,IAAI,sBACR,0BAA0B,iBAAiB,QAAQ,MAAM,UAAU,mBACnE,qCACA,UACA,8DACD;;;;;;CAOL,aAAa,kBAAkB,OAA6C;AAC1E,MAAI;GAEF,MAAM,EAAC,YAAW,MAAM,UAAU,OADP,KAAK,WAAW,CACK;AAEhD,OAAI,QAAQ,YAAY,OACtB,OAAM,IAAI,MAAM,qBAAqB;AAGvC,UAAO,EAAC,WAAW,QAAQ,cAAuB;WAC3C,OAAO;AACd,SAAM,IAAI,sBACR,oCAAoC,iBAAiB,QAAQ,MAAM,UAAU,mBAC7E,8BACA,UACA,8CACD;;;;;;;;;;CAWL,aAAqB,uBAAuB,SAA6C;AAOvF,MAN2B,MAAM,sBAAsB,CAAC,YAAY;GAClE,KAAK,QAAQ;GACb,WAAW,QAAQ,cAAc,QAAQ;GACzC,KAAK,QAAQ;GACd,CAAC,CAGA,OAAM,IAAI,MAAM,iDAAiD;;CAIrE,OAAO,wBAAwB,QAM7B;AACA,SAAO;GACL,UAAU;GACV;GACA,MAAM;GACN,UAAU;GACV,QAAQ,QAAQ,IAAI,gBAAgB;GACrC;;;;;CAMH,OAAO,8BAML;AACA,SAAO;GACL,UAAU;GACV,QAAQ;GACR,MAAM;GACN,UAAU;GACV,QAAQ,QAAQ,IAAI,gBAAgB;GACrC;;;;;CAMH,OAAO,uBAA+B;AACpC,SAAO,aAAa,sBAAsB;;;;;CAM5C,OAAO,2BAAmC;AACxC,SAAO,aAAa,0BAA0B;;;AAIlD,6BAAe"}
+{"version":3,"file":"SessionManager.js","names":["secret: string | undefined","secret: Uint8Array","envValue: string | undefined","parsed: number","payload: SessionTokenPayload"],"sources":["../../src/utils/SessionManager.ts"],"sourcesContent":["// Copyright 2025 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\nimport {ThunderIDRuntimeError, CookieConfig} from '@thunderid/node';\nimport type {JWTPayload} from 'jose';\n// Subpath imports keep the proxy's bundle free of jose's JWE code, whose CompressionStream use the Edge runtime rejects.\nimport {compactVerify} from 'jose/jws/compact/verify';\nimport {SignJWT} from 'jose/jwt/sign';\nimport {jwtVerify} from 'jose/jwt/verify';\nimport {getLoggedOutSessions} from './loggedOutSessions';\nimport {DEFAULT_SESSION_COOKIE_EXPIRY_TIME} from '../constants/sessionConstants';\n\n/**\n * Session token payload interface\n */\nexport interface SessionTokenPayload extends JWTPayload {\n  /** Expiration timestamp — doubles as the access token expiry (JWT exp == access token exp) */\n  exp: number;\n  /** Issued at timestamp */\n  iat: number;\n  /** Organization ID if applicable */\n  organizationId?: string;\n  /** The refresh token; empty string if not provided by the auth server */\n  refreshToken: string;\n  /** OAuth scopes */\n  scopes: string[];\n  /** Session ID */\n  sessionId: string;\n  /** The server session this session joined, from the `sid` of the ID token. */\n  sid?: string;\n  /** When the user signed in, in seconds. Kept across token refresh, unlike `iat`. */\n  signedInAt?: number;\n  /** User ID */\n  sub: string;\n  /** Token type discriminant — must be 'session' for access-session JWTs */\n  type: 'session';\n}\n\n/**\n * Session management utility class for JWT-based session cookies\n */\nclass SessionManager {\n  /**\n   * Get the signing secret from environment variable\n   * Throws error in production if not set\n   */\n  private static getSecret(): Uint8Array {\n    const secret: string | undefined = process.env['THUNDERID_SECRET'];\n\n    if (!secret) {\n      if (process.env['NODE_ENV'] === 'production') {\n        throw new ThunderIDRuntimeError(\n          'THUNDERID_SECRET environment variable is required in production',\n          'session-secret-required',\n          'nextjs',\n          'Set the THUNDERID_SECRET environment variable with a secure random string',\n        );\n      }\n      // Use a default secret for development (not secure)\n      // eslint-disable-next-line no-console\n      console.warn('Using default secret for development. Set THUNDERID_SECRET for production!');\n      return new TextEncoder().encode('development-secret-not-for-production');\n    }\n\n    return new TextEncoder().encode(secret);\n  }\n\n  /**\n   * Create a temporary session cookie for login initiation\n   */\n  static async createTempSession(sessionId: string): Promise<string> {\n    const secret: Uint8Array = this.getSecret();\n\n    const jwt: string = await new SignJWT({\n      sessionId,\n      type: 'temp',\n    })\n      .setProtectedHeader({alg: 'HS256'})\n      .setIssuedAt()\n      .setExpirationTime('15m')\n      .sign(secret);\n\n    return jwt;\n  }\n\n  /**\n   * Resolve the session cookie expiry time in seconds.\n   *\n   * Resolution order (first defined value wins):\n   *   1. `configuredExpiry` — value from `ThunderIDNodeConfig.sessionCookie?.expiryTime`\n   *   2. `THUNDERID_SESSION_COOKIE_EXPIRY_TIME` environment variable\n   *   3. `DEFAULT_SESSION_COOKIE_EXPIRY_TIME` (24 hours)\n   */\n  static resolveSessionCookieExpiry(configuredExpiry?: number): number {\n    if (configuredExpiry != null && configuredExpiry > 0) {\n      return configuredExpiry;\n    }\n\n    const envValue: string | undefined = process.env['THUNDERID_SESSION_COOKIE_EXPIRY_TIME'];\n\n    if (envValue) {\n      const parsed: number = parseInt(envValue, 10);\n\n      if (!Number.isNaN(parsed) && parsed > 0) {\n        return parsed;\n      }\n    }\n\n    return DEFAULT_SESSION_COOKIE_EXPIRY_TIME;\n  }\n\n  static async createSessionToken(\n    accessToken: string,\n    userId: string,\n    sessionId: string,\n    scopes: string,\n    accessTokenTtlSeconds: number,\n    refreshToken: string,\n    organizationId?: string,\n    serverSession?: {sid?: string; signedInAt?: number},\n  ): Promise<string> {\n    const secret: Uint8Array = this.getSecret();\n\n    const jwt: string = await new SignJWT({\n      accessToken,\n      organizationId,\n      refreshToken,\n      scopes,\n      sessionId,\n      // What a back-channel logout matches this session by.\n      sid: serverSession?.sid,\n      signedInAt: serverSession?.signedInAt ?? Math.floor(Date.now() / 1000),\n      type: 'session',\n    } as Omit<SessionTokenPayload, 'sub' | 'iat' | 'exp'>)\n      .setProtectedHeader({alg: 'HS256'})\n      .setSubject(userId)\n      .setIssuedAt()\n      .setExpirationTime(Math.floor(Date.now() / 1000) + accessTokenTtlSeconds)\n      .sign(secret);\n\n    return jwt;\n  }\n\n  /**\n   * Verify and decode a session token\n   */\n  static async verifySessionToken(token: string): Promise<SessionTokenPayload> {\n    try {\n      const secret: Uint8Array = this.getSecret();\n      const {payload} = await jwtVerify(token, secret);\n\n      if (payload['type'] !== 'session') {\n        throw new Error('Invalid token type');\n      }\n\n      await this.refuseLoggedOutSession(payload as SessionTokenPayload);\n\n      return payload as SessionTokenPayload;\n    } catch (error) {\n      throw new ThunderIDRuntimeError(\n        `Invalid session token: ${error instanceof Error ? error.message : 'Unknown error'}`,\n        'invalid-session-token',\n        'nextjs',\n        'Session token verification failed',\n      );\n    }\n  }\n\n  /**\n   * Verify a session token for refresh. Validates the HMAC signature and the\n   * `type === 'session'` discriminant but intentionally skips the `exp` check\n   * so an expired access token can still be exchanged for a new one.\n   *\n   * Session lifetime is still bounded — the cookie's `maxAge` is set from\n   * `sessionCookieExpiryTime`, so the browser drops an over-age session regardless\n   * of the access-token exp embedded in the JWT.\n   *\n   * Never use the returned payload for authorization.\n   */\n  static async verifySessionTokenForRefresh(token: string): Promise<SessionTokenPayload> {\n    try {\n      const secret: Uint8Array = this.getSecret();\n      const {payload: rawPayload} = await compactVerify(token, secret);\n      const payload: SessionTokenPayload = JSON.parse(new TextDecoder().decode(rawPayload)) as SessionTokenPayload;\n\n      if (payload.type !== 'session') {\n        throw new Error('Invalid token type');\n      }\n\n      await this.refuseLoggedOutSession(payload);\n\n      return payload;\n    } catch (error) {\n      throw new ThunderIDRuntimeError(\n        `Invalid session token: ${error instanceof Error ? error.message : 'Unknown error'}`,\n        'invalid-session-token-for-refresh',\n        'nextjs',\n        'Session token signature or type check failed during refresh',\n      );\n    }\n  }\n\n  /**\n   * Verify and decode a temporary session token\n   */\n  static async verifyTempSession(token: string): Promise<{sessionId: string}> {\n    try {\n      const secret: Uint8Array = this.getSecret();\n      const {payload} = await jwtVerify(token, secret);\n\n      if (payload['type'] !== 'temp') {\n        throw new Error('Invalid token type');\n      }\n\n      return {sessionId: payload['sessionId'] as string};\n    } catch (error) {\n      throw new ThunderIDRuntimeError(\n        `Invalid temporary session token: ${error instanceof Error ? error.message : 'Unknown error'}`,\n        'invalid-temp-session-token',\n        'nextjs',\n        'Temporary session token verification failed',\n      );\n    }\n  }\n\n  /**\n   * Get session cookie options\n   */\n  /**\n   * Throws when a back-channel logout has ended the session this cookie carries. The cookie is\n   * still correctly signed, so this is the only thing that stops it from being used.\n   */\n  private static async refuseLoggedOutSession(payload: SessionTokenPayload): Promise<void> {\n    const loggedOut: boolean = await getLoggedOutSessions().isLoggedOut({\n      sid: payload.sid,\n      startedAt: payload.signedInAt ?? payload.iat,\n      sub: payload.sub,\n    });\n\n    if (loggedOut) {\n      throw new Error('The session was ended by a back-channel logout');\n    }\n  }\n\n  static getSessionCookieOptions(maxAge: number): {\n    httpOnly: boolean;\n    maxAge: number;\n    path: string;\n    sameSite: 'lax';\n    secure: boolean;\n  } {\n    return {\n      httpOnly: true,\n      maxAge,\n      path: '/',\n      sameSite: 'lax' as const,\n      secure: process.env['NODE_ENV'] === 'production',\n    };\n  }\n\n  /**\n   * Get temporary session cookie options\n   */\n  static getTempSessionCookieOptions(): {\n    httpOnly: boolean;\n    maxAge: number;\n    path: string;\n    sameSite: 'lax';\n    secure: boolean;\n  } {\n    return {\n      httpOnly: true,\n      maxAge: 15 * 60,\n      path: '/',\n      sameSite: 'lax' as const,\n      secure: process.env['NODE_ENV'] === 'production',\n    };\n  }\n\n  /**\n   * Get session cookie name\n   */\n  static getSessionCookieName(): string {\n    return CookieConfig.getSessionCookieName();\n  }\n\n  /**\n   * Get temporary session cookie name\n   */\n  static getTempSessionCookieName(): string {\n    return CookieConfig.getTempSessionCookieName();\n  }\n}\n\nexport default SessionManager;\n"],"mappings":";;;;;;;;;;;AAyCA,IAAM,iBAAN,MAAqB;;;;;CAKnB,OAAe,YAAwB;EACrC,MAAMA,SAA6B,QAAQ,IAAI;AAE/C,MAAI,CAAC,QAAQ;AACX,OAAI,QAAQ,IAAI,gBAAgB,aAC9B,OAAM,IAAI,sBACR,mEACA,2BACA,UACA,4EACD;AAIH,WAAQ,KAAK,6EAA6E;AAC1F,UAAO,IAAI,aAAa,CAAC,OAAO,wCAAwC;;AAG1E,SAAO,IAAI,aAAa,CAAC,OAAO,OAAO;;;;;CAMzC,aAAa,kBAAkB,WAAoC;EACjE,MAAMC,SAAqB,KAAK,WAAW;AAW3C,SAToB,MAAM,IAAI,QAAQ;GACpC;GACA,MAAM;GACP,CAAC,CACC,mBAAmB,EAAC,KAAK,SAAQ,CAAC,CAClC,aAAa,CACb,kBAAkB,MAAM,CACxB,KAAK,OAAO;;;;;;;;;;CAajB,OAAO,2BAA2B,kBAAmC;AACnE,MAAI,oBAAoB,QAAQ,mBAAmB,EACjD,QAAO;EAGT,MAAMC,WAA+B,QAAQ,IAAI;AAEjD,MAAI,UAAU;GACZ,MAAMC,SAAiB,SAAS,UAAU,GAAG;AAE7C,OAAI,CAAC,OAAO,MAAM,OAAO,IAAI,SAAS,EACpC,QAAO;;AAIX,SAAO;;CAGT,aAAa,mBACX,aACA,QACA,WACA,QACA,uBACA,cACA,gBACA,eACiB;EACjB,MAAMF,SAAqB,KAAK,WAAW;AAmB3C,SAjBoB,MAAM,IAAI,QAAQ;GACpC;GACA;GACA;GACA;GACA;GAEA,KAAK,eAAe;GACpB,YAAY,eAAe,cAAc,KAAK,MAAM,KAAK,KAAK,GAAG,IAAK;GACtE,MAAM;GACP,CAAqD,CACnD,mBAAmB,EAAC,KAAK,SAAQ,CAAC,CAClC,WAAW,OAAO,CAClB,aAAa,CACb,kBAAkB,KAAK,MAAM,KAAK,KAAK,GAAG,IAAK,GAAG,sBAAsB,CACxE,KAAK,OAAO;;;;;CAQjB,aAAa,mBAAmB,OAA6C;AAC3E,MAAI;GAEF,MAAM,EAAC,YAAW,MAAM,UAAU,OADP,KAAK,WAAW,CACK;AAEhD,OAAI,QAAQ,YAAY,UACtB,OAAM,IAAI,MAAM,qBAAqB;AAGvC,SAAM,KAAK,uBAAuB,QAA+B;AAEjE,UAAO;WACA,OAAO;AACd,SAAM,IAAI,sBACR,0BAA0B,iBAAiB,QAAQ,MAAM,UAAU,mBACnE,yBACA,UACA,oCACD;;;;;;;;;;;;;;CAeL,aAAa,6BAA6B,OAA6C;AACrF,MAAI;GAEF,MAAM,EAAC,SAAS,eAAc,MAAM,cAAc,OADvB,KAAK,WAAW,CACqB;GAChE,MAAMG,UAA+B,KAAK,MAAM,IAAI,aAAa,CAAC,OAAO,WAAW,CAAC;AAErF,OAAI,QAAQ,SAAS,UACnB,OAAM,IAAI,MAAM,qBAAqB;AAGvC,SAAM,KAAK,uBAAuB,QAAQ;AAE1C,UAAO;WACA,OAAO;AACd,SAAM,IAAI,sBACR,0BAA0B,iBAAiB,QAAQ,MAAM,UAAU,mBACnE,qCACA,UACA,8DACD;;;;;;CAOL,aAAa,kBAAkB,OAA6C;AAC1E,MAAI;GAEF,MAAM,EAAC,YAAW,MAAM,UAAU,OADP,KAAK,WAAW,CACK;AAEhD,OAAI,QAAQ,YAAY,OACtB,OAAM,IAAI,MAAM,qBAAqB;AAGvC,UAAO,EAAC,WAAW,QAAQ,cAAuB;WAC3C,OAAO;AACd,SAAM,IAAI,sBACR,oCAAoC,iBAAiB,QAAQ,MAAM,UAAU,mBAC7E,8BACA,UACA,8CACD;;;;;;;;;;CAWL,aAAqB,uBAAuB,SAA6C;AAOvF,MAN2B,MAAM,sBAAsB,CAAC,YAAY;GAClE,KAAK,QAAQ;GACb,WAAW,QAAQ,cAAc,QAAQ;GACzC,KAAK,QAAQ;GACd,CAAC,CAGA,OAAM,IAAI,MAAM,iDAAiD;;CAIrE,OAAO,wBAAwB,QAM7B;AACA,SAAO;GACL,UAAU;GACV;GACA,MAAM;GACN,UAAU;GACV,QAAQ,QAAQ,IAAI,gBAAgB;GACrC;;;;;CAMH,OAAO,8BAML;AACA,SAAO;GACL,UAAU;GACV,QAAQ;GACR,MAAM;GACN,UAAU;GACV,QAAQ,QAAQ,IAAI,gBAAgB;GACrC;;;;;CAMH,OAAO,uBAA+B;AACpC,SAAO,aAAa,sBAAsB;;;;;CAM5C,OAAO,2BAAmC;AACxC,SAAO,aAAa,0BAA0B;;;AAIlD,6BAAe"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@thunderid/nextjs",
-  "version": "1.2.3",
+  "version": "1.3.1",
   "description": "Next.js SDK for ThunderID",
   "keywords": [
     "thunderid",
@@ -37,8 +37,8 @@
     "directory": "packages/nextjs"
   },
   "dependencies": {
-    "@thunderid/node": "^1.2.2",
-    "@thunderid/react": "^1.3.3",
+    "@thunderid/node": "^1.3.1",
+    "@thunderid/react": "^1.4.1",
     "@types/react": "19.2.14",
     "jose": "6.2.3",
     "tslib": "2.8.1"
@@ -48,7 +48,7 @@
     "@thunderid/prettier-config": "1.0.1",
     "@types/node": "24.7.2",
     "eslint": "9.39.4",
-    "next": "15.5.25",
+    "next": "15.5.28",
     "prettier": "3.6.2",
     "react": "19.2.3",
     "rimraf": "6.1.3",