npm - @thunderid/nextjs - Versions diffs - 1.3.1 → 1.5.0 - Mend

@thunderid/nextjs 1.3.1 → 1.5.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (400) hide show

package/dist/cjs/client/components/auth/SignIn/SignIn.cjs.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"SignIn.cjs","names":["SignIn: FC<SignInProps>","useThunderID","normalizedError: Error","response: any","EmbeddedFlowType","ThunderIDRuntimeError","BaseSignIn"],"sources":["../../../../../../src/client/components/auth/SignIn/SignIn.tsx"],"sourcesContent":["// Copyright 2025 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\n'use client';\n\nimport {EmbeddedFlowComponent, EmbeddedFlowType, ThunderIDRuntimeError} from '@thunderid/node';\nimport {BaseSignIn, BaseSignInProps, normalizeFlowResponse, useTranslation} from '@thunderid/react';\nimport {FC, useEffect, useRef, useState} from 'react';\nimport useThunderID from '../../../contexts/ThunderID/useThunderID';\n\n/**\n * Props for the SignIn component.\n * Extends BaseSignInProps for full compatibility with the React BaseSignIn component\n */\nexport type SignInProps = Pick<\n BaseSignInProps,\n 'children' | 'className' | 'id' | 'onSuccess' | 'onError' | 'variant' | 'size'\n>;\n\n/**\n * A SignIn component for Next.js that provides native authentication flow.\n * This component delegates to the BaseSignIn from @thunderid/react. Unlike BaseSignUp,\n * BaseSignIn does not manage its own flow state, so this component initiates the flow\n * (using the server-action-backed `signIn`) and tracks `components`/`executionId` itself.\n */\nconst SignIn: FC<SignInProps> = ({size = 'medium', variant = 'outlined', onError, ...rest}: SignInProps) => {\n const {signIn, applicationId, scopes} = useThunderID();\n const {t} = useTranslation();\n\n const [components, setComponents] = useState<EmbeddedFlowComponent[]>([]);\n const [additionalData, setAdditionalData] = useState<Record<string, any>>({});\n const [executionId, setExecutionId] = useState<string | undefined>(undefined);\n const [isFlowInitialized, setIsFlowInitialized] = useState(false);\n const [flowError, setFlowError] = useState<Error | null>(null);\n const initializationAttemptedRef = useRef(false);\n // A fresh challenge token is required on every step to prevent replay attacks; the server\n // rotates it on each response, so it's tracked in a ref (not state) to avoid a stale value\n // from a closure captured before the previous response's state update committed.\n const challengeTokenRef = useRef<string | undefined>(undefined);\n\n const applyFlowResponse = (response: any): void => {\n const normalized = normalizeFlowResponse(response, t, {resolveTranslations: false});\n\n challengeTokenRef.current = response?.challengeToken ?? undefined;\n setExecutionId(normalized.executionId ?? undefined);\n setComponents(normalized.components);\n setAdditionalData(normalized.additionalData);\n };\n\n const handleFlowError = (error: unknown): void => {\n const normalizedError: Error = error instanceof Error ? error : new Error(String(error));\n\n setFlowError(normalizedError);\n onError?.(normalizedError);\n };\n\n useEffect(() => {\n if (initializationAttemptedRef.current || !signIn) {\n return;\n }\n\n initializationAttemptedRef.current = true;\n\n (async (): Promise<void> => {\n try {\n const response: any = await signIn(\n {\n applicationId,\n flowType: EmbeddedFlowType.Authentication,\n ...(scopes && {scopes}),\n },\n {},\n );\n\n // `response` is undefined when the provider already redirected\n // (OAuth-redirect or completed flows are handled there directly).\n if (response) {\n applyFlowResponse(response);\n }\n } catch (error) {\n handleFlowError(error);\n } finally {\n setIsFlowInitialized(true);\n }\n })();\n // eslint-disable-next-line react-hooks/exhaustive-deps\n }, [signIn]);\n\n const handleOnSubmit = async (payload: any): Promise<void> => {\n if (!signIn) {\n throw new ThunderIDRuntimeError(\n '`signIn` function is not available.',\n 'SignIn-handleOnSubmit-RuntimeError-001',\n 'nextjs',\n );\n }\n\n const response: any = await signIn(\n {\n ...payload,\n executionId,\n ...(challengeTokenRef.current ? {challengeToken: challengeTokenRef.current} : {}),\n },\n {},\n );\n\n if (response) {\n applyFlowResponse(response);\n }\n };\n\n return (\n <BaseSignIn\n additionalData={additionalData}\n components={components}\n error={flowError}\n isLoading={!isFlowInitialized}\n onError={onError}\n onSubmit={handleOnSubmit}\n size={size}\n variant={variant}\n {...rest}\n />\n );\n};\n\nSignIn.displayName = 'SignIn';\n\nexport default SignIn;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;AAyBA,MAAMA,UAA2B,EAAC,OAAO,UAAU,UAAU,YAAY,QAAS,GAAG,WAAuB;CAC1G,MAAM,EAAC,QAAQ,eAAe,WAAUC,8BAAc;CACtD,MAAM,EAAC,6CAAqB;CAE5B,MAAM,CAAC,YAAY,qCAAmD,EAAE,CAAC;CACzE,MAAM,CAAC,gBAAgB,yCAAmD,EAAE,CAAC;CAC7E,MAAM,CAAC,aAAa,sCAA+C,OAAU;CAC7E,MAAM,CAAC,mBAAmB,4CAAiC,MAAM;CACjE,MAAM,CAAC,WAAW,oCAAuC,KAAK;CAC9D,MAAM,+CAAoC,MAAM;CAIhD,MAAM,sCAA+C,OAAU;CAE/D,MAAM,qBAAqB,aAAwB;EACjD,MAAM,0DAAmC,UAAU,GAAG,EAAC,qBAAqB,OAAM,CAAC;AAEnF,oBAAkB,UAAU,UAAU,kBAAkB;AACxD,iBAAe,WAAW,eAAe,OAAU;AACnD,gBAAc,WAAW,WAAW;AACpC,oBAAkB,WAAW,eAAe;;CAG9C,MAAM,mBAAmB,UAAyB;EAChD,MAAMC,kBAAyB,iBAAiB,QAAQ,QAAQ,IAAI,MAAM,OAAO,MAAM,CAAC;AAExF,eAAa,gBAAgB;AAC7B,YAAU,gBAAgB;;AAG5B,4BAAgB;AACd,MAAI,2BAA2B,WAAW,CAAC,OACzC;AAGF,6BAA2B,UAAU;AAErC,GAAC,YAA2B;AAC1B,OAAI;IACF,MAAMC,WAAgB,MAAM,OAC1B;KACE;KACA,UAAUC,kCAAiB;KAC3B,GAAI,UAAU,EAAC,QAAO;KACvB,EACD,EAAE,CACH;AAID,QAAI,SACF,mBAAkB,SAAS;YAEtB,OAAO;AACd,oBAAgB,MAAM;aACd;AACR,yBAAqB,KAAK;;MAE1B;IAEH,CAAC,OAAO,CAAC;CAEZ,MAAM,iBAAiB,OAAO,YAAgC;AAC5D,MAAI,CAAC,OACH,OAAM,IAAIC,uCACR,uCACA,0CACA,SACD;EAGH,MAAMF,WAAgB,MAAM,OAC1B;GACE,GAAG;GACH;GACA,GAAI,kBAAkB,UAAU,EAAC,gBAAgB,kBAAkB,SAAQ,GAAG,EAAE;GACjF,EACD,EAAE,CACH;AAED,MAAI,SACF,mBAAkB,SAAS;;AAI/B,QACE,2CAACG;EACiB;EACJ;EACZ,OAAO;EACP,WAAW,CAAC;EACH;EACT,UAAU;EACJ;EACG;EACT,GAAI;GACJ;;AAIN,OAAO,cAAc;AAErB,qBAAe"}

package/dist/cjs/client/components/{presentation → auth}/SignUp/SignUp.cjs RENAMED Viewed

@@ -10,7 +10,7 @@ __thunderid_react = require_rolldown_runtime.__toESM(__thunderid_react);
 let react_jsx_runtime = require("react/jsx-runtime");
 react_jsx_runtime = require_rolldown_runtime.__toESM(react_jsx_runtime);
-//#region src/client/components/presentation/SignUp/SignUp.tsx
+//#region src/client/components/auth/SignUp/SignUp.tsx
 /**
 * A styled SignUp component that provides embedded sign-up flow with pre-built styling.
 * This component handles the API calls for sign-up and delegates UI logic to BaseSignUp.

package/dist/cjs/client/components/auth/SignUp/SignUp.cjs.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"SignUp.cjs","names":["SignUp: FC<SignUpProps>","useThunderID","ThunderIDRuntimeError","EmbeddedFlowType","BaseSignUp"],"sources":["../../../../../../src/client/components/auth/SignUp/SignUp.tsx"],"sourcesContent":["// Copyright 2025 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\n'use client';\n\nimport {ThunderIDRuntimeError, EmbeddedFlowType} from '@thunderid/node';\nimport {BaseSignUp, BaseSignUpProps} from '@thunderid/react';\nimport {FC} from 'react';\nimport useThunderID from '../../../contexts/ThunderID/useThunderID';\n\n/**\n * Props for the SignUp component.\n */\nexport type SignUpProps = BaseSignUpProps;\n\n/**\n * A styled SignUp component that provides embedded sign-up flow with pre-built styling.\n * This component handles the API calls for sign-up and delegates UI logic to BaseSignUp.\n *\n * @example\n * ```tsx\n * import { SignUp } from '@thunderid/react';\n *\n * const App = () => {\n * return (\n * <SignUp\n * onSuccess={(response) => {\n * console.log('Sign-up successful:', response);\n * // Handle successful sign-up (e.g., redirect, show confirmation)\n * }}\n * onError={(error) => {\n * console.error('Sign-up failed:', error);\n * }}\n * onComplete={(redirectUrl) => {\n * // Platform-specific redirect handling (e.g., Next.js router.push)\n * router.push(redirectUrl); // or window.location.href = redirectUrl\n * }}\n * size=\"medium\"\n * variant=\"outlined\"\n * afterSignUpUrl=\"/welcome\"\n * />\n * );\n * };\n * ```\n */\nconst SignUp: FC<SignUpProps> = ({\n className,\n size = 'medium',\n variant = 'outlined',\n afterSignUpUrl,\n onError,\n children,\n}: SignUpProps) => {\n const {signUp, applicationId: contextApplicationId, scopes} = useThunderID();\n\n /**\n * Initialize the sign-up flow.\n */\n const handleInitialize = async (payload?: any): Promise<any> => {\n if (!signUp) {\n throw new ThunderIDRuntimeError(\n '`signUp` function is not available.',\n 'SignUp-handleInitialize-RuntimeError-001',\n 'nextjs',\n );\n }\n\n return (await signUp({\n flowType: EmbeddedFlowType.Registration,\n ...(contextApplicationId && {applicationId: contextApplicationId}),\n ...(scopes && {scopes}),\n ...payload,\n })) as unknown as Promise<any>;\n };\n\n /**\n * Handle sign-up steps.\n */\n const handleOnSubmit = async (payload: any): Promise<any> => {\n if (!signUp) {\n throw new ThunderIDRuntimeError(\n '`signUp` function is not available.',\n 'SignUp-handleOnSubmit-RuntimeError-001',\n 'nextjs',\n );\n }\n\n return (await signUp(payload)) as unknown as Promise<any>;\n };\n\n return (\n <BaseSignUp\n afterSignUpUrl={afterSignUpUrl}\n onInitialize={handleInitialize}\n onSubmit={handleOnSubmit}\n onError={onError}\n className={className}\n size={size}\n variant={variant}\n isInitialized={true}\n >\n {children}\n </BaseSignUp>\n );\n};\n\nexport default SignUp;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA6CA,MAAMA,UAA2B,EAC/B,WACA,OAAO,UACP,UAAU,YACV,gBACA,SACA,eACiB;CACjB,MAAM,EAAC,QAAQ,eAAe,sBAAsB,WAAUC,8BAAc;;;;CAK5E,MAAM,mBAAmB,OAAO,YAAgC;AAC9D,MAAI,CAAC,OACH,OAAM,IAAIC,uCACR,uCACA,4CACA,SACD;AAGH,SAAQ,MAAM,OAAO;GACnB,UAAUC,kCAAiB;GAC3B,GAAI,wBAAwB,EAAC,eAAe,sBAAqB;GACjE,GAAI,UAAU,EAAC,QAAO;GACtB,GAAG;GACJ,CAAC;;;;;CAMJ,MAAM,iBAAiB,OAAO,YAA+B;AAC3D,MAAI,CAAC,OACH,OAAM,IAAID,uCACR,uCACA,0CACA,SACD;AAGH,SAAQ,MAAM,OAAO,QAAQ;;AAG/B,QACE,2CAACE;EACiB;EAChB,cAAc;EACd,UAAU;EACD;EACE;EACL;EACG;EACT,eAAe;EAEd;GACU;;AAIjB,qBAAe"}

package/dist/cjs/client/components/{actions → auth/buttons}/SignInButton/SignInButton.cjs RENAMED Viewed

@@ -1,8 +1,8 @@
 'use client';
-const require_rolldown_runtime = require('../../../../_virtual/rolldown_runtime.cjs');
-const require_useThunderID = require('../../../contexts/ThunderID/useThunderID.cjs');
+const require_rolldown_runtime = require('../../../../../_virtual/rolldown_runtime.cjs');
+const require_useThunderID = require('../../../../contexts/ThunderID/useThunderID.cjs');
 let __thunderid_node = require("@thunderid/node");
 __thunderid_node = require_rolldown_runtime.__toESM(__thunderid_node);
 let __thunderid_react = require("@thunderid/react");
@@ -14,7 +14,7 @@ react = require_rolldown_runtime.__toESM(react);
 let react_jsx_runtime = require("react/jsx-runtime");
 react_jsx_runtime = require_rolldown_runtime.__toESM(react_jsx_runtime);
-//#region src/client/components/actions/SignInButton/SignInButton.tsx
+//#region src/client/components/auth/buttons/SignInButton/SignInButton.tsx
 /**
 * SignInButton component that uses server actions for authentication in Next.js.
 *

package/dist/cjs/client/components/auth/buttons/SignInButton/SignInButton.cjs.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"SignInButton.cjs","names":["SignInButton: ForwardRefExoticComponent<SignInButtonProps & RefAttributes<HTMLButtonElement>>","useThunderID","router: AppRouterInstance","ThunderIDRuntimeError","BaseSignInButton"],"sources":["../../../../../../../src/client/components/auth/buttons/SignInButton/SignInButton.tsx"],"sourcesContent":["// Copyright 2025 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\n'use client';\n\nimport {ThunderIDRuntimeError} from '@thunderid/node';\nimport {BaseSignInButton, BaseSignInButtonProps, useTranslation} from '@thunderid/react';\nimport {AppRouterInstance} from 'next/dist/shared/lib/app-router-context.shared-runtime';\nimport {useRouter} from 'next/navigation';\nimport {forwardRef, ForwardRefExoticComponent, ReactElement, Ref, RefAttributes, MouseEvent, useState} from 'react';\nimport useThunderID from '../../../../contexts/ThunderID/useThunderID';\n\n/**\n * Props interface of {@link SignInButton}\n */\nexport type SignInButtonProps = BaseSignInButtonProps & {\n /**\n * Additional parameters to pass to the `authorize` request.\n */\n signInOptions?: Record<string, any>;\n};\n\n/**\n * SignInButton component that uses server actions for authentication in Next.js.\n *\n * @example Using render props\n * ```tsx\n * <SignInButton>\n * {({isLoading}) => (\n * <button type=\"submit\" disabled={isLoading}>\n * {isLoading ? 'Signing in...' : 'Sign In'}\n * </button>\n * )}\n * </SignInButton>\n * ```\n *\n * @example Using traditional props\n * ```tsx\n * <SignInButton className=\"custom-button\">Sign In</SignInButton>\n * ```\n *\n * @remarks\n * In Next.js with server actions, the sign-in is handled via the server action.\n * When using render props, the custom button should use `type=\"submit\"` instead of `onClick={signIn}`.\n * The `signIn` function in render props is provided for API consistency but should not be used directly.\n */\nconst SignInButton: ForwardRefExoticComponent<SignInButtonProps & RefAttributes<HTMLButtonElement>> = forwardRef<\n HTMLButtonElement,\n SignInButtonProps\n>(\n (\n {className, style, children, preferences, onClick, signInOptions = {}, ...rest}: SignInButtonProps,\n ref: Ref<HTMLButtonElement>,\n ): ReactElement => {\n const {signIn, signInUrl} = useThunderID();\n const router: AppRouterInstance = useRouter();\n const {t} = useTranslation(preferences?.i18n);\n\n const [isLoading, setIsLoading] = useState(false);\n\n const handleSignIn = async (): Promise<void> => {\n try {\n setIsLoading(true);\n\n // If a custom `signInUrl` is provided, use it for navigation.\n if (signInUrl) {\n router.push(signInUrl);\n } else if (signIn) {\n await signIn(signInOptions);\n }\n } catch (error) {\n throw new ThunderIDRuntimeError(\n `Sign in failed: ${error instanceof Error ? error.message : String(error)}`,\n 'SignInButton-handleSignIn-RuntimeError-001',\n 'nextjs',\n 'Something went wrong while trying to sign in. Please try again later.',\n );\n } finally {\n setIsLoading(false);\n }\n };\n\n const handleOnClick = async (e: MouseEvent<HTMLButtonElement>): Promise<void> => {\n await handleSignIn();\n if (onClick) {\n onClick(e);\n }\n };\n\n return (\n <BaseSignInButton\n className={className}\n style={style}\n ref={ref}\n preferences={preferences}\n isLoading={isLoading}\n signIn={handleSignIn}\n onClick={handleOnClick}\n {...rest}\n >\n {children ?? t('elements.buttons.signin.text')}\n </BaseSignInButton>\n );\n },\n);\n\nSignInButton.displayName = 'SignInButton';\n\nexport default SignInButton;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA8CA,MAAMA,sCAKF,EAAC,WAAW,OAAO,UAAU,aAAa,SAAS,gBAAgB,EAAE,CAAE,GAAG,QAC1E,QACiB;CACjB,MAAM,EAAC,QAAQ,cAAaC,8BAAc;CAC1C,MAAMC,yCAAuC;CAC7C,MAAM,EAAC,4CAAoB,aAAa,KAAK;CAE7C,MAAM,CAAC,WAAW,oCAAyB,MAAM;CAEjD,MAAM,eAAe,YAA2B;AAC9C,MAAI;AACF,gBAAa,KAAK;AAGlB,OAAI,UACF,QAAO,KAAK,UAAU;YACb,OACT,OAAM,OAAO,cAAc;WAEtB,OAAO;AACd,SAAM,IAAIC,uCACR,mBAAmB,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM,IACzE,8CACA,UACA,wEACD;YACO;AACR,gBAAa,MAAM;;;CAIvB,MAAM,gBAAgB,OAAO,MAAoD;AAC/E,QAAM,cAAc;AACpB,MAAI,QACF,SAAQ,EAAE;;AAId,QACE,2CAACC;EACY;EACJ;EACF;EACQ;EACF;EACX,QAAQ;EACR,SAAS;EACT,GAAI;YAEH,YAAY,EAAE,+BAA+B;GAC7B;EAGxB;AAED,aAAa,cAAc;AAE3B,2BAAe"}

package/dist/cjs/client/components/{actions → auth/buttons}/SignOutButton/SignOutButton.cjs RENAMED Viewed

@@ -1,9 +1,9 @@
 'use client';
-const require_rolldown_runtime = require('../../../../_virtual/rolldown_runtime.cjs');
-const require_logger = require('../../../../utils/logger.cjs');
-const require_useThunderID = require('../../../contexts/ThunderID/useThunderID.cjs');
+const require_rolldown_runtime = require('../../../../../_virtual/rolldown_runtime.cjs');
+const require_logger = require('../../../../../utils/logger.cjs');
+const require_useThunderID = require('../../../../contexts/ThunderID/useThunderID.cjs');
 let __thunderid_react = require("@thunderid/react");
 __thunderid_react = require_rolldown_runtime.__toESM(__thunderid_react);
 let react = require("react");
@@ -11,7 +11,7 @@ react = require_rolldown_runtime.__toESM(react);
 let react_jsx_runtime = require("react/jsx-runtime");
 react_jsx_runtime = require_rolldown_runtime.__toESM(react_jsx_runtime);
-//#region src/client/components/actions/SignOutButton/SignOutButton.tsx
+//#region src/client/components/auth/buttons/SignOutButton/SignOutButton.tsx
 /**
 * SignInButton component. This button initiates the sign-in process when clicked.
 *

package/dist/cjs/client/components/auth/buttons/SignOutButton/SignOutButton.cjs.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"SignOutButton.cjs","names":["SignOutButton: ForwardRefExoticComponent<SignOutButtonProps & RefAttributes<HTMLButtonElement>>","useThunderID","BaseSignOutButton"],"sources":["../../../../../../../src/client/components/auth/buttons/SignOutButton/SignOutButton.tsx"],"sourcesContent":["// Copyright 2025 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\n'use client';\n\nimport {BaseSignOutButton, BaseSignOutButtonProps, useTranslation} from '@thunderid/react';\nimport {forwardRef, ForwardRefExoticComponent, ReactElement, Ref, RefAttributes, useState, MouseEvent} from 'react';\nimport logger from '../../../../../utils/logger';\nimport useThunderID from '../../../../contexts/ThunderID/useThunderID';\n\n/**\n * Interface for SignInButton component props.\n */\nexport type SignOutButtonProps = BaseSignOutButtonProps;\n\n/**\n * SignInButton component. This button initiates the sign-in process when clicked.\n *\n * @example\n * ```tsx\n * import { SignInButton } from '@thunderid/auth-react';\n *\n * const App = () => {\n * const buttonRef = useRef<HTMLButtonElement>(null);\n * return (\n * <SignInButton ref={buttonRef} className=\"custom-class\" style={{ backgroundColor: 'blue' }}>\n * Sign In\n * </SignInButton>\n * );\n * }\n * ```\n */\nconst SignOutButton: ForwardRefExoticComponent<SignOutButtonProps & RefAttributes<HTMLButtonElement>> = forwardRef<\n HTMLButtonElement,\n SignOutButtonProps\n>(\n (\n {className, style, preferences, onClick, children, ...rest}: SignOutButtonProps,\n ref: Ref<HTMLButtonElement>,\n ): ReactElement => {\n const {signOut} = useThunderID();\n const {t} = useTranslation(preferences?.i18n);\n\n const [isLoading, setIsLoading] = useState(false);\n\n const handleOnClick = async (e: MouseEvent<HTMLButtonElement>): Promise<void> => {\n try {\n setIsLoading(true);\n\n logger.debug('[SignOutButton] Initiating a sign-out from a button click');\n\n await signOut();\n\n if (onClick) {\n onClick(e);\n }\n } catch (error) {\n logger.error('[SignOutButton] Error occurred initiating sign-out from a button click:', error);\n } finally {\n setIsLoading(false);\n }\n };\n\n return (\n <BaseSignOutButton ref={ref} onClick={handleOnClick} isLoading={isLoading} preferences={preferences} {...rest}>\n {children ?? t('elements.buttons.signout.text')}\n </BaseSignOutButton>\n );\n },\n);\n\nexport default SignOutButton;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAgCA,MAAMA,uCAKF,EAAC,WAAW,OAAO,aAAa,SAAS,SAAU,GAAG,QACtD,QACiB;CACjB,MAAM,EAAC,YAAWC,8BAAc;CAChC,MAAM,EAAC,4CAAoB,aAAa,KAAK;CAE7C,MAAM,CAAC,WAAW,oCAAyB,MAAM;CAEjD,MAAM,gBAAgB,OAAO,MAAoD;AAC/E,MAAI;AACF,gBAAa,KAAK;AAElB,0BAAO,MAAM,4DAA4D;AAEzE,SAAM,SAAS;AAEf,OAAI,QACF,SAAQ,EAAE;WAEL,OAAO;AACd,0BAAO,MAAM,2EAA2E,MAAM;YACtF;AACR,gBAAa,MAAM;;;AAIvB,QACE,2CAACC;EAAuB;EAAK,SAAS;EAA0B;EAAwB;EAAa,GAAI;YACtG,YAAY,EAAE,gCAAgC;GAC7B;EAGzB;AAED,4BAAe"}

package/dist/cjs/client/components/{actions → auth/buttons}/SignUpButton/SignUpButton.cjs RENAMED Viewed

@@ -1,8 +1,8 @@
 'use client';
-const require_rolldown_runtime = require('../../../../_virtual/rolldown_runtime.cjs');
-const require_useThunderID = require('../../../contexts/ThunderID/useThunderID.cjs');
+const require_rolldown_runtime = require('../../../../../_virtual/rolldown_runtime.cjs');
+const require_useThunderID = require('../../../../contexts/ThunderID/useThunderID.cjs');
 let __thunderid_node = require("@thunderid/node");
 __thunderid_node = require_rolldown_runtime.__toESM(__thunderid_node);
 let __thunderid_react = require("@thunderid/react");
@@ -14,7 +14,7 @@ react = require_rolldown_runtime.__toESM(react);
 let react_jsx_runtime = require("react/jsx-runtime");
 react_jsx_runtime = require_rolldown_runtime.__toESM(react_jsx_runtime);
-//#region src/client/components/actions/SignUpButton/SignUpButton.tsx
+//#region src/client/components/auth/buttons/SignUpButton/SignUpButton.tsx
 /**
 * SignUpButton component that supports both render props and traditional props patterns.
 * It redirects the user to the ThunderID sign-up page configured for the application.

package/dist/cjs/client/components/auth/buttons/SignUpButton/SignUpButton.cjs.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"SignUpButton.cjs","names":["SignUpButton: ForwardRefExoticComponent<SignUpButtonProps & RefAttributes<HTMLButtonElement>>","useThunderID","router: AppRouterInstance","ThunderIDRuntimeError","BaseSignUpButton"],"sources":["../../../../../../../src/client/components/auth/buttons/SignUpButton/SignUpButton.tsx"],"sourcesContent":["// Copyright 2025 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\n'use client';\n\nimport {ThunderIDRuntimeError} from '@thunderid/node';\nimport {BaseSignUpButton, BaseSignUpButtonProps, useTranslation} from '@thunderid/react';\nimport {AppRouterInstance} from 'next/dist/shared/lib/app-router-context.shared-runtime';\nimport {useRouter} from 'next/navigation';\nimport {forwardRef, ForwardRefExoticComponent, MouseEvent, ReactElement, Ref, RefAttributes, useState} from 'react';\nimport useThunderID from '../../../../contexts/ThunderID/useThunderID';\n\n/**\n * Props interface of {@link SignUpButton}\n */\nexport type SignUpButtonProps = BaseSignUpButtonProps;\n\n/**\n * SignUpButton component that supports both render props and traditional props patterns.\n * It redirects the user to the ThunderID sign-up page configured for the application.\n *\n * @remarks This component is only supported in browser based React applications (CSR).\n *\n * @example Using render props pattern\n * ```tsx\n * <SignUpButton>\n * {({ signUp, isLoading }) => (\n * <button onClick={signUp} disabled={isLoading}>\n * {isLoading ? 'Creating Account...' : 'Create Account'}\n * </button>\n * )}\n * </SignUpButton>\n * ```\n *\n * @example Using traditional props pattern\n * ```tsx\n * <SignUpButton className=\"custom-button\">Create Account</SignUpButton>\n * ```\n *\n * @example Using component-level preferences\n * ```tsx\n * <SignUpButton\n * preferences={{\n * i18n: {\n * bundles: {\n * 'en-US': {\n * translations: {\n * 'buttons.signUp': 'Custom Sign Up Text'\n * }\n * }\n * }\n * }\n * }}\n * >\n * Custom Sign Up\n * </SignUpButton>\n * ```\n */\nconst SignUpButton: ForwardRefExoticComponent<SignUpButtonProps & RefAttributes<HTMLButtonElement>> = forwardRef<\n HTMLButtonElement,\n SignUpButtonProps\n>(({children, onClick, preferences, ...rest}: SignUpButtonProps, ref: Ref<HTMLButtonElement>): ReactElement => {\n const {signUp, signUpUrl} = useThunderID();\n const router: AppRouterInstance = useRouter();\n const {t} = useTranslation(preferences?.i18n);\n\n const [isLoading, setIsLoading] = useState(false);\n\n const handleSignUp = async (e?: MouseEvent<HTMLButtonElement>): Promise<void> => {\n try {\n setIsLoading(true);\n\n // If a custom `signUpUrl` is provided, use it for navigation.\n if (signUpUrl) {\n router.push(signUpUrl);\n } else if (signUp) {\n await signUp();\n }\n\n if (onClick) {\n onClick(e!);\n }\n } catch (error) {\n throw new ThunderIDRuntimeError(\n `Sign up failed: ${error instanceof Error ? error.message : String(error)}`,\n 'SignUpButton-handleSignUp-RuntimeError-001',\n 'nextjs',\n 'Something went wrong while trying to sign up. Please try again later.',\n );\n } finally {\n setIsLoading(false);\n }\n };\n\n return (\n <BaseSignUpButton\n ref={ref}\n onClick={handleSignUp}\n isLoading={isLoading}\n signUp={handleSignUp}\n preferences={preferences}\n {...rest}\n >\n {children ?? t('elements.buttons.signup.text')}\n </BaseSignUpButton>\n );\n});\n\nSignUpButton.displayName = 'SignUpButton';\n\nexport default SignUpButton;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA0DA,MAAMA,sCAGH,EAAC,UAAU,SAAS,YAAa,GAAG,QAA0B,QAA8C;CAC7G,MAAM,EAAC,QAAQ,cAAaC,8BAAc;CAC1C,MAAMC,yCAAuC;CAC7C,MAAM,EAAC,4CAAoB,aAAa,KAAK;CAE7C,MAAM,CAAC,WAAW,oCAAyB,MAAM;CAEjD,MAAM,eAAe,OAAO,MAAqD;AAC/E,MAAI;AACF,gBAAa,KAAK;AAGlB,OAAI,UACF,QAAO,KAAK,UAAU;YACb,OACT,OAAM,QAAQ;AAGhB,OAAI,QACF,SAAQ,EAAG;WAEN,OAAO;AACd,SAAM,IAAIC,uCACR,mBAAmB,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM,IACzE,8CACA,UACA,wEACD;YACO;AACR,gBAAa,MAAM;;;AAIvB,QACE,2CAACC;EACM;EACL,SAAS;EACE;EACX,QAAQ;EACK;EACb,GAAI;YAEH,YAAY,EAAE,+BAA+B;GAC7B;EAErB;AAEF,aAAa,cAAc;AAE3B,2BAAe"}

package/dist/cjs/client/components/{control → auth/guards}/SignedIn/SignedIn.cjs RENAMED Viewed

@@ -1,12 +1,12 @@
 'use client';
-const require_rolldown_runtime = require('../../../../_virtual/rolldown_runtime.cjs');
-const require_useThunderID = require('../../../contexts/ThunderID/useThunderID.cjs');
+const require_rolldown_runtime = require('../../../../../_virtual/rolldown_runtime.cjs');
+const require_useThunderID = require('../../../../contexts/ThunderID/useThunderID.cjs');
 let react_jsx_runtime = require("react/jsx-runtime");
 react_jsx_runtime = require_rolldown_runtime.__toESM(react_jsx_runtime);
-//#region src/client/components/control/SignedIn/SignedIn.tsx
+//#region src/client/components/auth/guards/SignedIn/SignedIn.tsx
 /**
 * A component that only renders its children when the user is signed in.
 *

package/dist/cjs/client/components/auth/guards/SignedIn/SignedIn.cjs.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"SignedIn.cjs","names":["SignedIn: FC<PropsWithChildren<SignedInProps>>","useThunderID"],"sources":["../../../../../../../src/client/components/auth/guards/SignedIn/SignedIn.tsx"],"sourcesContent":["// Copyright 2025 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\n'use client';\n\nimport {FC, PropsWithChildren, ReactNode} from 'react';\nimport useThunderID from '../../../../contexts/ThunderID/useThunderID';\n\n/**\n * Props interface of {@link SignedIn}\n */\nexport interface SignedInProps {\n /**\n * Content to show when the user is not signed in.\n */\n fallback?: ReactNode;\n}\n\n/**\n * A component that only renders its children when the user is signed in.\n *\n * @example\n * ```tsx\n * import { SignedIn } from '@thunderid/auth-next';\n *\n * const App = () => {\n * return (\n * <SignedIn fallback={<p>Please sign in to continue</p>}>\n * <p>Welcome! You are signed in.</p>\n * </SignedIn>\n * );\n * }\n * ```\n */\nconst SignedIn: FC<PropsWithChildren<SignedInProps>> = ({\n children,\n fallback = null,\n}: PropsWithChildren<SignedInProps>) => {\n const {isSignedIn} = useThunderID();\n\n return <>{isSignedIn ? children : fallback}</>;\n};\n\nexport default SignedIn;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAkCA,MAAMA,YAAkD,EACtD,UACA,WAAW,WAC2B;CACtC,MAAM,EAAC,eAAcC,8BAAc;AAEnC,QAAO,mFAAG,aAAa,WAAW,WAAY;;AAGhD,uBAAe"}

package/dist/cjs/client/components/{control → auth/guards}/SignedOut/SignedOut.cjs RENAMED Viewed

@@ -1,12 +1,12 @@
 'use client';
-const require_rolldown_runtime = require('../../../../_virtual/rolldown_runtime.cjs');
-const require_useThunderID = require('../../../contexts/ThunderID/useThunderID.cjs');
+const require_rolldown_runtime = require('../../../../../_virtual/rolldown_runtime.cjs');
+const require_useThunderID = require('../../../../contexts/ThunderID/useThunderID.cjs');
 let react_jsx_runtime = require("react/jsx-runtime");
 react_jsx_runtime = require_rolldown_runtime.__toESM(react_jsx_runtime);
-//#region src/client/components/control/SignedOut/SignedOut.tsx
+//#region src/client/components/auth/guards/SignedOut/SignedOut.tsx
 /**
 * A component that only renders its children when the user is signed out.
 *

package/dist/cjs/client/components/auth/guards/SignedOut/SignedOut.cjs.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"SignedOut.cjs","names":["SignedOut: FC<PropsWithChildren<SignedOutProps>>","useThunderID"],"sources":["../../../../../../../src/client/components/auth/guards/SignedOut/SignedOut.tsx"],"sourcesContent":["// Copyright 2025 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\n'use client';\n\nimport {FC, PropsWithChildren, ReactNode} from 'react';\nimport useThunderID from '../../../../contexts/ThunderID/useThunderID';\n\n/**\n * Props interface of {@link SignedOut}\n */\nexport interface SignedOutProps {\n /**\n * Content to show when the user is not signed-out.\n */\n fallback?: ReactNode;\n}\n\n/**\n * A component that only renders its children when the user is signed out.\n *\n * @example\n * ```tsx\n * import { SignedOut } from '@thunderid/auth-next';\n *\n * const App = () => {\n * return (\n * <SignedOut fallback={<p>Please sign out to continue</p>}>\n * <p>Welcome! You are signed out.</p>\n * </SignedOut>\n * );\n * }\n * ```\n */\nconst SignedOut: FC<PropsWithChildren<SignedOutProps>> = ({\n children,\n fallback = null,\n}: PropsWithChildren<SignedOutProps>) => {\n const {isSignedIn} = useThunderID();\n\n return <>{!isSignedIn ? children : fallback}</>;\n};\n\nexport default SignedOut;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAkCA,MAAMA,aAAoD,EACxD,UACA,WAAW,WAC4B;CACvC,MAAM,EAAC,eAAcC,8BAAc;AAEnC,QAAO,mFAAG,CAAC,aAAa,WAAW,WAAY;;AAGjD,wBAAe"}

package/dist/cjs/client/components/{presentation → primitives}/AuthFlowSelect/AuthFlowSelect.cjs RENAMED Viewed

@@ -8,7 +8,7 @@ __thunderid_react = require_rolldown_runtime.__toESM(__thunderid_react);
 let react_jsx_runtime = require("react/jsx-runtime");
 react_jsx_runtime = require_rolldown_runtime.__toESM(react_jsx_runtime);
-//#region src/client/components/presentation/AuthFlowSelect/AuthFlowSelect.tsx
+//#region src/client/components/primitives/AuthFlowSelect/AuthFlowSelect.tsx
 /**
 * Authentication-flow picker for signed-in screens. Flows load through a server action that uses the
 * signed-in user's server-held session, so the access token never reaches the browser. It takes no

package/dist/cjs/client/components/primitives/AuthFlowSelect/AuthFlowSelect.cjs.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"AuthFlowSelect.cjs","names":["AuthFlowSelect: FC<AuthFlowSelectProps>","BaseAuthFlowSelect","fetchAuthFlowsFromServer"],"sources":["../../../../../../src/client/components/primitives/AuthFlowSelect/AuthFlowSelect.tsx"],"sourcesContent":["// Copyright 2026 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\n'use client';\n\nimport {BaseAuthFlowSelect, BaseAuthFlowSelectProps} from '@thunderid/react';\nimport {FC} from 'react';\nimport fetchAuthFlowsFromServer from '../../../fetchAuthFlowsFromServer';\n\nexport type AuthFlowSelectProps = Omit<BaseAuthFlowSelectProps, 'fetchAuthFlows'>;\n\n/**\n * Authentication-flow picker for signed-in screens. Flows load through a server action that uses the\n * signed-in user's server-held session, so the access token never reaches the browser. It takes no\n * data source; for a custom one use `Select` with `useInfiniteOptions`.\n */\nconst AuthFlowSelect: FC<AuthFlowSelectProps> = (props: AuthFlowSelectProps) => (\n <BaseAuthFlowSelect {...props} fetchAuthFlows={fetchAuthFlowsFromServer} />\n);\n\nexport default AuthFlowSelect;\n"],"mappings":";;;;;;;;;;;;;;;;AAgBA,MAAMA,kBAA2C,UAC/C,2CAACC;CAAmB,GAAI;CAAO,gBAAgBC;EAA4B;AAG7E,6BAAe"}

package/dist/cjs/client/components/{presentation → primitives}/UserSelect/UserSelect.cjs RENAMED Viewed

@@ -8,7 +8,7 @@ __thunderid_react = require_rolldown_runtime.__toESM(__thunderid_react);
 let react_jsx_runtime = require("react/jsx-runtime");
 react_jsx_runtime = require_rolldown_runtime.__toESM(react_jsx_runtime);
-//#region src/client/components/presentation/UserSelect/UserSelect.tsx
+//#region src/client/components/primitives/UserSelect/UserSelect.tsx
 /**
 * Single-user picker for signed-in screens. Users load through a server action that uses the
 * signed-in user's server-held session, so the access token never reaches the browser. It takes no

package/dist/cjs/client/components/primitives/UserSelect/UserSelect.cjs.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"UserSelect.cjs","names":["UserSelect: FC<UserSelectProps>","BaseUserSelect","fetchUsersFromServer"],"sources":["../../../../../../src/client/components/primitives/UserSelect/UserSelect.tsx"],"sourcesContent":["// Copyright 2026 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\n'use client';\n\nimport {BaseUserSelect, BaseUserSelectProps} from '@thunderid/react';\nimport {FC} from 'react';\nimport fetchUsersFromServer from '../../../fetchUsersFromServer';\n\nexport type UserSelectProps = Omit<BaseUserSelectProps, 'fetchUsers'>;\n\n/**\n * Single-user picker for signed-in screens. Users load through a server action that uses the\n * signed-in user's server-held session, so the access token never reaches the browser. It takes no\n * data source; for a custom one use `Select` with `useInfiniteOptions`.\n */\nconst UserSelect: FC<UserSelectProps> = (props: UserSelectProps) => (\n <BaseUserSelect {...props} fetchUsers={fetchUsersFromServer} />\n);\n\nexport default UserSelect;\n"],"mappings":";;;;;;;;;;;;;;;;AAgBA,MAAMA,cAAmC,UACvC,2CAACC;CAAe,GAAI;CAAO,YAAYC;EAAwB;AAGjE,yBAAe"}

package/dist/cjs/client/components/{presentation → primitives}/UserTypeSelect/UserTypeSelect.cjs RENAMED Viewed

@@ -8,7 +8,7 @@ __thunderid_react = require_rolldown_runtime.__toESM(__thunderid_react);
 let react_jsx_runtime = require("react/jsx-runtime");
 react_jsx_runtime = require_rolldown_runtime.__toESM(react_jsx_runtime);
-//#region src/client/components/presentation/UserTypeSelect/UserTypeSelect.tsx
+//#region src/client/components/primitives/UserTypeSelect/UserTypeSelect.tsx
 /**
 * User-type picker for signed-in screens. User types load through a server action that uses the
 * signed-in user's server-held session, so the access token never reaches the browser. It takes no

package/dist/cjs/client/components/primitives/UserTypeSelect/UserTypeSelect.cjs.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"UserTypeSelect.cjs","names":["UserTypeSelect: FC<UserTypeSelectProps>","BaseUserTypeSelect","fetchUserTypesFromServer"],"sources":["../../../../../../src/client/components/primitives/UserTypeSelect/UserTypeSelect.tsx"],"sourcesContent":["// Copyright 2026 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\n'use client';\n\nimport {BaseUserTypeSelect, BaseUserTypeSelectProps} from '@thunderid/react';\nimport {FC} from 'react';\nimport fetchUserTypesFromServer from '../../../fetchUserTypesFromServer';\n\nexport type UserTypeSelectProps = Omit<BaseUserTypeSelectProps, 'fetchUserTypes'>;\n\n/**\n * User-type picker for signed-in screens. User types load through a server action that uses the\n * signed-in user's server-held session, so the access token never reaches the browser. It takes no\n * data source; for a custom one use `Select` with `useInfiniteOptions`.\n */\nconst UserTypeSelect: FC<UserTypeSelectProps> = (props: UserTypeSelectProps) => (\n <BaseUserTypeSelect {...props} fetchUserTypes={fetchUserTypesFromServer} />\n);\n\nexport default UserTypeSelect;\n"],"mappings":";;;;;;;;;;;;;;;;AAgBA,MAAMA,kBAA2C,UAC/C,2CAACC;CAAmB,GAAI;CAAO,gBAAgBC;EAA4B;AAG7E,6BAAe"}

package/dist/cjs/client/contexts/ThunderID/ThunderIDProvider.cjs CHANGED Viewed

@@ -5,6 +5,7 @@ const require_rolldown_runtime = require('../../../_virtual/rolldown_runtime.cjs
 const require_logger = require('../../../utils/logger.cjs');
 const require_ThunderIDContext = require('./ThunderIDContext.cjs');
 const require_fetchFlowMetaFromServer = require('../../fetchFlowMetaFromServer.cjs');
+const require_fetchManagementFromServer = require('../../fetchManagementFromServer.cjs');
 let __thunderid_node = require("@thunderid/node");
 __thunderid_node = require_rolldown_runtime.__toESM(__thunderid_node);
 let __thunderid_react = require("@thunderid/react");
@@ -17,7 +18,7 @@ let react_jsx_runtime = require("react/jsx-runtime");
 react_jsx_runtime = require_rolldown_runtime.__toESM(react_jsx_runtime);
 //#region src/client/contexts/ThunderID/ThunderIDProvider.tsx
-const ThunderIDClientProvider = ({ baseUrl, children, signIn, clearSession, refreshToken, signOut, signUp, handleOAuthCallback, preferences, isSignedIn, signInUrl, signUpUrl, user: _user, userProfile: _userProfile, userSchema: _userSchema = null, updateProfile, applicationId, organizationHandle, scopes, vendor, initialMeta = null }) => {
+const ThunderIDClientProvider = ({ baseUrl, children, endpoints, signIn, clearSession, refreshToken, signOut, signUp, handleOAuthCallback, preferences, isSignedIn, signInUrl, signUpUrl, user: _user, userProfile: _userProfile, userSchema: _userSchema = null, updateProfile, applicationId, organizationHandle, scopes, vendor, initialMeta = null }) => {
 	const reRenderCheckRef = (0, react.useRef)(false);
 	const router = (0, next_navigation.useRouter)();
 	const searchParams = (0, next_navigation.useSearchParams)();
@@ -154,12 +155,14 @@ const ThunderIDClientProvider = ({ baseUrl, children, signIn, clearSession, refr
 		clearSession,
 		clientId: void 0,
 		discovery: { wellKnown: null },
+		endpoints,
 		exchangeToken: unsupported("exchangeToken"),
 		getAccessToken: unsupported("getAccessToken"),
 		getDecodedIdToken: unsupported("getDecodedIdToken"),
 		getIdToken: unsupported("getIdToken"),
 		getStorageManager: () => Promise.resolve(null),
 		http: {
+			fetcher: require_fetchManagementFromServer.default,
 			request: unsupported("http.request"),
 			requestAll: unsupported("http.requestAll")
 		},
@@ -187,6 +190,7 @@ const ThunderIDClientProvider = ({ baseUrl, children, signIn, clearSession, refr
 		applicationId,
 		baseUrl,
 		clearSession,
+		endpoints,
 		isLoading,
 		isSignedIn,
 		organizationHandle,

package/dist/cjs/client/contexts/ThunderID/ThunderIDProvider.cjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"ThunderIDProvider.cjs","names":["ThunderIDClientProvider: FC<PropsWithChildren<ThunderIDClientProviderProps>>","reRenderCheckRef: RefObject<boolean>","router: AppRouterInstance","searchParams: ReadonlyURLSearchParams","code: string \| null","state: string \| null","result: {error?: string; redirectUrl?: string; success: boolean}","ThunderIDRuntimeError","result: any","contextValue: ThunderIDContextProps","reactContextValue: ReactThunderIDContextProps","ThunderIDContext","ReactThunderIDContext","I18nProvider","FlowMetaProvider","fetchFlowMetaFromServer","ThemeProvider","FlowProvider","UserProvider"],"sources":["../../../../../src/client/contexts/ThunderID/ThunderIDProvider.tsx"],"sourcesContent":["// Copyright 2025 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\n'use client';\n\nimport {\n AttributeSchema,\n EmbeddedFlowExecuteRequestConfig,\n FlowMetadataResponse,\n generateFlattenedUserProfile,\n UpdateMeProfileConfig,\n User,\n UserProfile,\n ThunderIDRuntimeError,\n getVendorPrefix,\n} from '@thunderid/node';\nimport {\n I18nProvider,\n FlowMetaProvider,\n FlowProvider,\n UserProvider,\n ThemeProvider,\n ThunderIDContext as ReactThunderIDContext,\n ThunderIDContextProps as ReactThunderIDContextProps,\n ThunderIDProviderProps,\n} from '@thunderid/react';\nimport {ReadonlyURLSearchParams} from 'next/dist/client/components/navigation.react-server';\nimport {AppRouterInstance} from 'next/dist/shared/lib/app-router-context.shared-runtime';\nimport {useRouter, useSearchParams} from 'next/navigation';\nimport {FC, PropsWithChildren, RefObject, useEffect, useMemo, useRef, useState} from 'react';\nimport ThunderIDContext, {ThunderIDContextProps} from './ThunderIDContext';\nimport {RefreshResult} from '../../../server/actions/refreshToken';\nimport logger from '../../../utils/logger';\nimport fetchFlowMetaFromServer from '../../fetchFlowMetaFromServer';\n\n/*\n Props interface of {@link ThunderIDClientProvider}\n /\nexport type ThunderIDClientProviderProps = Partial<Omit<ThunderIDProviderProps, 'baseUrl' \| 'clientId'>> &\n Pick<ThunderIDProviderProps, 'baseUrl' \| 'clientId'> & {\n applicationId: ThunderIDContextProps['applicationId'];\n clearSession: () => Promise<void>;\n handleOAuthCallback: (\n code: string,\n state: string,\n ) => Promise<{error?: string; redirectUrl?: string; success: boolean}>;\n /\n Flow metadata fetched server-side ahead of time, seeding `FlowMetaProvider` so it can skip\n * its own initial client-side fetch (avoiding a flash of untranslated i18n keys).\n */\n initialMeta?: FlowMetadataResponse \| null;\n isSignedIn: boolean;\n organizationHandle: ThunderIDContextProps['organizationHandle'];\n refreshToken: () => Promise<RefreshResult>;\n signIn: ThunderIDContextProps['signIn'];\n signOut: ThunderIDContextProps['signOut'];\n signUp: ThunderIDContextProps['signUp'];\n updateProfile: (\n requestConfig: UpdateMeProfileConfig,\n sessionId?: string,\n ) => Promise<{data: {user: User}; error: string; success: boolean}>;\n user: User \| null;\n userProfile: UserProfile;\n userSchema?: Record<string, AttributeSchema> \| null;\n };\n\nconst ThunderIDClientProvider: FC<PropsWithChildren<ThunderIDClientProviderProps>> = ({\n baseUrl,\n children,\n signIn,\n clearSession,\n refreshToken,\n signOut,\n signUp,\n handleOAuthCallback,\n preferences,\n isSignedIn,\n signInUrl,\n signUpUrl,\n user: _user,\n userProfile: _userProfile,\n userSchema: _userSchema = null,\n updateProfile,\n applicationId,\n organizationHandle,\n scopes,\n vendor,\n initialMeta = null,\n}: PropsWithChildren<ThunderIDClientProviderProps>) => {\n const reRenderCheckRef: RefObject<boolean> = useRef(false);\n const router: AppRouterInstance = useRouter();\n const searchParams: ReadonlyURLSearchParams = useSearchParams();\n const [isLoading, setIsLoading] = useState<boolean>(true);\n const [user, setUser] = useState<User \| null>(_user);\n const [userProfile, setUserProfile] = useState<UserProfile>(_userProfile);\n const [userSchema, setUserSchema] = useState<Record<string, AttributeSchema> \| null>(_userSchema);\n\n useEffect(() => {\n setUserProfile(_userProfile);\n }, [_userProfile]);\n\n useEffect(() => {\n setUserSchema(_userSchema);\n }, [_userSchema]);\n\n useEffect(() => {\n setUser(_user);\n }, [_user]);\n\n // Handle OAuth callback automatically\n useEffect(() => {\n // React 18.x Strict.Mode has a new check for `Ensuring reusable state` to facilitate an upcoming react feature.\n // https://reactjs.org/docs/strict-mode.html#ensuring-reusable-state\n // This will remount all the useEffects to ensure that there are no unexpected side effects.\n // When react remounts the signIn hook of the AuthProvider, it will cause a race condition. Hence, we have to\n // prevent the re-render of this hook as suggested in the following discussion.\n // https://github.com/reactwg/react-18/discussions/18#discussioncomment-795623\n if (reRenderCheckRef.current) {\n return;\n }\n\n reRenderCheckRef.current = true;\n\n // Don't handle callback if already signed in\n if (isSignedIn) return;\n\n (async (): Promise<void> => {\n try {\n const code: string \| null = searchParams.get('code');\n const state: string \| null = searchParams.get('state');\n const error: string \| null = searchParams.get('error');\n\n // Check for OAuth errors first\n if (error) {\n logger.error('[ThunderIDClientProvider] An error was received for the initiated sign-in request.');\n\n return;\n }\n\n // Handle OAuth callback if code and state are present\n if (code && state) {\n setIsLoading(true);\n\n const result: {error?: string; redirectUrl?: string; success: boolean} = await handleOAuthCallback(\n code,\n state,\n );\n\n if (result.success) {\n // Redirect to the success URL\n if (result.redirectUrl) {\n router.push(result.redirectUrl);\n } else {\n // Refresh the page to update authentication state\n window.location.reload();\n }\n } else {\n logger.error(\n `[ThunderIDClientProvider] An error occurred while signing in: ${result.error \|\| 'Authentication failed'}`,\n );\n }\n }\n } catch (error) {\n logger.error('[ThunderIDClientProvider] Failed to handle OAuth callback:', error);\n }\n })();\n }, []);\n\n useEffect(() => {\n // Set loading to false when server has resolved authentication state\n setIsLoading(false);\n }, [isSignedIn, user]);\n\n const handleSignIn = async (payload: any, request: EmbeddedFlowExecuteRequestConfig): Promise<any> => {\n if (!signIn) {\n throw new ThunderIDRuntimeError(\n '`signIn` function is not available.',\n 'ThunderIDClientProvider-handleSignIn-RuntimeError-001',\n 'nextjs',\n );\n }\n\n const result: any = await signIn(payload, request);\n\n // Redirect based flow URL is sent as `signInUrl` in the response.\n // Use window.location.href instead of router.push() — the OAuth authorization\n // endpoint is on an external server, and router.push() would send RSC fetch\n // headers that the identity provider doesn't understand, causing a CORS error.\n if (result?.data?.signInUrl) {\n window.location.href = result.data.signInUrl;\n\n return undefined;\n }\n\n // After the Embedded flow is successful, the URL to navigate next is sent as `afterSignInUrl` in the response.\n if (result?.data?.afterSignInUrl) {\n router.push(result.data.afterSignInUrl);\n\n return undefined;\n }\n\n if (result?.error) {\n throw new Error(result.error);\n }\n\n return result?.data ?? result;\n };\n\n const handleSignUp = async (payload: any, request: EmbeddedFlowExecuteRequestConfig): Promise<any> => {\n if (!signUp) {\n throw new ThunderIDRuntimeError(\n '`signUp` function is not available.',\n 'ThunderIDClientProvider-handleSignUp-RuntimeError-001',\n 'nextjs',\n );\n }\n\n const result: any = await signUp(payload, request);\n\n // Redirect based flow URL is sent as `signUpUrl` in the response.\n if (result?.data?.signUpUrl) {\n router.push(result.data.signUpUrl);\n\n return undefined;\n }\n\n // After the Embedded flow is successful, the URL to navigate next is sent as `afterSignUpUrl` in the response.\n if (result?.data?.afterSignUpUrl) {\n router.push(result.data.afterSignUpUrl);\n\n return undefined;\n }\n\n if (result?.error) {\n throw new Error(result.error);\n }\n\n return result?.data ?? result;\n };\n\n const handleSignOut = async (): Promise<any> => {\n logger.debug('[ThunderIDClientProvider][handleSignOut] `handleSignOut` called.');\n\n try {\n const result: any = await signOut();\n\n logger.debug('[ThunderIDClientProvider][handleSignOut] Sign out result:', result);\n\n if (result?.data?.afterSignOutUrl) {\n router.push(result.data.afterSignOutUrl);\n\n return {location: result.data.afterSignOutUrl, redirected: true};\n }\n\n if (result?.error) {\n logger.error(\n '[ThunderIDClientProvider][handleSignOut] Error result was returned during signing the user out with a button click:',\n result.error,\n );\n }\n\n return result?.data ?? result;\n } catch (error) {\n logger.error(\n '[ThunderIDClientProvider][handleSignOut] Error occurred during signing the user out with a button click:',\n error,\n );\n\n return undefined;\n }\n };\n\n const contextValue: ThunderIDContextProps = useMemo(\n () => ({\n applicationId,\n baseUrl,\n clearSession,\n isLoading,\n isSignedIn,\n organizationHandle,\n preferences,\n refreshToken,\n scopes,\n signIn: handleSignIn,\n signInUrl,\n signOut: handleSignOut,\n signUp: handleSignUp,\n signUpUrl,\n user,\n }),\n [\n baseUrl,\n user,\n isSignedIn,\n isLoading,\n signInUrl,\n signUpUrl,\n applicationId,\n organizationHandle,\n scopes,\n preferences,\n ],\n );\n\n const handleProfileUpdate = (payload: User): void => {\n setUser(payload);\n setUserProfile((prev: UserProfile) => ({\n ...prev,\n flattenedProfile: generateFlattenedUserProfile(payload),\n profile: payload,\n }));\n };\n\n // Bridge into @thunderid/react's own ThunderIDContext. Internal react components rendered by\n // BaseSignIn/BaseSignUp — most notably FlowMetaProvider, which fetches `/flow/meta` and injects\n // its i18n bundle — call react's `useThunderID()` directly. Without this bridge they'd only see\n // react's context default (applicationId/baseUrl undefined, isInitialized false), so the meta\n // fetch would never fire and flow labels would render as untranslated i18n keys. Fields with no\n // nextjs equivalent (token/http helpers meant for direct browser API calls) are stubbed out,\n // since nextjs routes those operations through server actions instead.\n const unsupported = (name: string): (() => Promise<never>) => {\n return () =>\n Promise.reject(\n new ThunderIDRuntimeError(\n `\\`${name}\\` is not supported in @thunderid/nextjs.`,\n `ThunderIDClientProvider-${name}-NotSupportedError-001`,\n 'nextjs',\n ),\n );\n };\n\n const reactContextValue: ReactThunderIDContextProps = useMemo(\n () => ({\n afterSignInUrl: undefined,\n applicationId,\n baseUrl,\n clearSession,\n clientId: undefined,\n discovery: {wellKnown: null},\n exchangeToken: unsupported('exchangeToken'),\n getAccessToken: unsupported('getAccessToken'),\n getDecodedIdToken: unsupported('getDecodedIdToken'),\n getIdToken: unsupported('getIdToken'),\n getStorageManager: () => Promise.resolve(null),\n http: {\n request: unsupported('http.request'),\n requestAll: unsupported('http.requestAll'),\n },\n instanceId: 0,\n isInitialized: !isLoading,\n isLoading,\n isMetaLoading: false,\n isSignedIn,\n meta: initialMeta ?? null,\n organizationHandle,\n reInitialize: unsupported('reInitialize'),\n recover: unsupported('recover'),\n resolveFlowTemplateLiterals: (text: string \| undefined): string => text ?? '',\n scopes,\n signIn: handleSignIn,\n signInSilently: unsupported('signInSilently'),\n signInUrl,\n signOut: handleSignOut,\n signUp: handleSignUp,\n signUpUrl,\n user,\n userSchema,\n vendor: getVendorPrefix(vendor),\n }),\n [\n applicationId,\n baseUrl,\n clearSession,\n isLoading,\n isSignedIn,\n organizationHandle,\n scopes,\n signInUrl,\n signUpUrl,\n user,\n userSchema,\n initialMeta,\n vendor,\n ],\n );\n\n return (\n <ThunderIDContext.Provider value={contextValue}>\n <ReactThunderIDContext.Provider value={reactContextValue}>\n <I18nProvider preferences={preferences?.i18n}>\n <FlowMetaProvider\n enabled={preferences?.resolveFromMeta !== false}\n initialMeta={initialMeta}\n fetchMeta={fetchFlowMetaFromServer}\n >\n <ThemeProvider theme={preferences?.theme?.overrides} mode={preferences?.theme?.mode}>\n <FlowProvider>\n <UserProvider\n profile={userProfile}\n userSchema={userSchema}\n onUpdateProfile={handleProfileUpdate}\n updateProfile={updateProfile}\n >\n {children}\n </UserProvider>\n </FlowProvider>\n </ThemeProvider>\n </FlowMetaProvider>\n </I18nProvider>\n </ReactThunderIDContext.Provider>\n </ThunderIDContext.Provider>\n );\n};\n\nexport default ThunderIDClientProvider;\n"],"mappings":";;;;;;;;;;;;;;;;;;;AAkEA,MAAMA,2BAAgF,EACpF,SACA,UACA,QACA,cACA,cACA,SACA,QACA,qBACA,aACA,YACA,WACA,WACA,MAAM,OACN,aAAa,cACb,YAAY,cAAc,MAC1B,eACA,eACA,oBACA,QACA,QACA,cAAc,WACuC;CACrD,MAAMC,qCAA8C,MAAM;CAC1D,MAAMC,yCAAuC;CAC7C,MAAMC,qDAAyD;CAC/D,MAAM,CAAC,WAAW,oCAAkC,KAAK;CACzD,MAAM,CAAC,MAAM,+BAAiC,MAAM;CACpD,MAAM,CAAC,aAAa,sCAAwC,aAAa;CACzE,MAAM,CAAC,YAAY,qCAAkE,YAAY;AAEjG,4BAAgB;AACd,iBAAe,aAAa;IAC3B,CAAC,aAAa,CAAC;AAElB,4BAAgB;AACd,gBAAc,YAAY;IACzB,CAAC,YAAY,CAAC;AAEjB,4BAAgB;AACd,UAAQ,MAAM;IACb,CAAC,MAAM,CAAC;AAGX,4BAAgB;AAOd,MAAI,iBAAiB,QACnB;AAGF,mBAAiB,UAAU;AAG3B,MAAI,WAAY;AAEhB,GAAC,YAA2B;AAC1B,OAAI;IACF,MAAMC,OAAsB,aAAa,IAAI,OAAO;IACpD,MAAMC,QAAuB,aAAa,IAAI,QAAQ;AAItD,QAH6B,aAAa,IAAI,QAAQ,EAG3C;AACT,4BAAO,MAAM,qFAAqF;AAElG;;AAIF,QAAI,QAAQ,OAAO;AACjB,kBAAa,KAAK;KAElB,MAAMC,SAAmE,MAAM,oBAC7E,MACA,MACD;AAED,SAAI,OAAO,QAET,KAAI,OAAO,YACT,QAAO,KAAK,OAAO,YAAY;SAG/B,QAAO,SAAS,QAAQ;SAG1B,wBAAO,MACL,iEAAiE,OAAO,SAAS,0BAClF;;YAGE,OAAO;AACd,2BAAO,MAAM,8DAA8D,MAAM;;MAEjF;IACH,EAAE,CAAC;AAEN,4BAAgB;AAEd,eAAa,MAAM;IAClB,CAAC,YAAY,KAAK,CAAC;CAEtB,MAAM,eAAe,OAAO,SAAc,YAA4D;AACpG,MAAI,CAAC,OACH,OAAM,IAAIC,uCACR,uCACA,yDACA,SACD;EAGH,MAAMC,SAAc,MAAM,OAAO,SAAS,QAAQ;AAMlD,MAAI,QAAQ,MAAM,WAAW;AAC3B,UAAO,SAAS,OAAO,OAAO,KAAK;AAEnC;;AAIF,MAAI,QAAQ,MAAM,gBAAgB;AAChC,UAAO,KAAK,OAAO,KAAK,eAAe;AAEvC;;AAGF,MAAI,QAAQ,MACV,OAAM,IAAI,MAAM,OAAO,MAAM;AAG/B,SAAO,QAAQ,QAAQ;;CAGzB,MAAM,eAAe,OAAO,SAAc,YAA4D;AACpG,MAAI,CAAC,OACH,OAAM,IAAID,uCACR,uCACA,yDACA,SACD;EAGH,MAAMC,SAAc,MAAM,OAAO,SAAS,QAAQ;AAGlD,MAAI,QAAQ,MAAM,WAAW;AAC3B,UAAO,KAAK,OAAO,KAAK,UAAU;AAElC;;AAIF,MAAI,QAAQ,MAAM,gBAAgB;AAChC,UAAO,KAAK,OAAO,KAAK,eAAe;AAEvC;;AAGF,MAAI,QAAQ,MACV,OAAM,IAAI,MAAM,OAAO,MAAM;AAG/B,SAAO,QAAQ,QAAQ;;CAGzB,MAAM,gBAAgB,YAA0B;AAC9C,yBAAO,MAAM,mEAAmE;AAEhF,MAAI;GACF,MAAMA,SAAc,MAAM,SAAS;AAEnC,0BAAO,MAAM,6DAA6D,OAAO;AAEjF,OAAI,QAAQ,MAAM,iBAAiB;AACjC,WAAO,KAAK,OAAO,KAAK,gBAAgB;AAExC,WAAO;KAAC,UAAU,OAAO,KAAK;KAAiB,YAAY;KAAK;;AAGlE,OAAI,QAAQ,MACV,wBAAO,MACL,uHACA,OAAO,MACR;AAGH,UAAO,QAAQ,QAAQ;WAChB,OAAO;AACd,0BAAO,MACL,4GACA,MACD;AAED;;;CAIJ,MAAMC,yCACG;EACL;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA,QAAQ;EACR;EACA,SAAS;EACT,QAAQ;EACR;EACA;EACD,GACD;EACE;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACD,CACF;CAED,MAAM,uBAAuB,YAAwB;AACnD,UAAQ,QAAQ;AAChB,kBAAgB,UAAuB;GACrC,GAAG;GACH,qEAA+C,QAAQ;GACvD,SAAS;GACV,EAAE;;CAUL,MAAM,eAAe,SAAyC;AAC5D,eACE,QAAQ,OACN,IAAIF,uCACF,KAAK,KAAK,4CACV,2BAA2B,KAAK,yBAChC,SACD,CACF;;CAGL,MAAMG,8CACG;EACL,gBAAgB;EAChB;EACA;EACA;EACA,UAAU;EACV,WAAW,EAAC,WAAW,MAAK;EAC5B,eAAe,YAAY,gBAAgB;EAC3C,gBAAgB,YAAY,iBAAiB;EAC7C,mBAAmB,YAAY,oBAAoB;EACnD,YAAY,YAAY,aAAa;EACrC,yBAAyB,QAAQ,QAAQ,KAAK;EAC9C,MAAM;GACJ,SAAS,YAAY,eAAe;GACpC,YAAY,YAAY,kBAAkB;GAC3C;EACD,YAAY;EACZ,eAAe,CAAC;EAChB;EACA,eAAe;EACf;EACA,MAAM,eAAe;EACrB;EACA,cAAc,YAAY,eAAe;EACzC,SAAS,YAAY,UAAU;EAC/B,8BAA8B,SAAqC,QAAQ;EAC3E;EACA,QAAQ;EACR,gBAAgB,YAAY,iBAAiB;EAC7C;EACA,SAAS;EACT,QAAQ;EACR;EACA;EACA;EACA,8CAAwB,OAAO;EAChC,GACD;EACE;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACD,CACF;AAED,QACE,2CAACC,iCAAiB;EAAS,OAAO;YAChC,2CAACC,mCAAsB;GAAS,OAAO;aACrC,2CAACC;IAAa,aAAa,aAAa;cACtC,2CAACC;KACC,SAAS,aAAa,oBAAoB;KAC7B;KACb,WAAWC;eAEX,2CAACC;MAAc,OAAO,aAAa,OAAO;MAAW,MAAM,aAAa,OAAO;gBAC7E,2CAACC,4CACC,2CAACC;OACC,SAAS;OACG;OACZ,iBAAiB;OACF;OAEd;QACY,GACF;OACD;MACC;KACN;IACgB;GACP;;AAIhC,gCAAe"}
1	+ {"version":3,"file":"ThunderIDProvider.cjs","names":["ThunderIDClientProvider: FC<PropsWithChildren<ThunderIDClientProviderProps>>","reRenderCheckRef: RefObject<boolean>","router: AppRouterInstance","searchParams: ReadonlyURLSearchParams","code: string \| null","state: string \| null","result: {error?: string; redirectUrl?: string; success: boolean}","ThunderIDRuntimeError","result: any","contextValue: ThunderIDContextProps","reactContextValue: ReactThunderIDContextProps","fetchManagementFromServer","ThunderIDContext","ReactThunderIDContext","I18nProvider","FlowMetaProvider","fetchFlowMetaFromServer","ThemeProvider","FlowProvider","UserProvider"],"sources":["../../../../../src/client/contexts/ThunderID/ThunderIDProvider.tsx"],"sourcesContent":["// Copyright 2025 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\n'use client';\n\nimport {\n AttributeSchema,\n EmbeddedFlowExecuteRequestConfig,\n FlowMetadataResponse,\n generateFlattenedUserProfile,\n UpdateMeProfileConfig,\n User,\n UserProfile,\n ThunderIDRuntimeError,\n getVendorPrefix,\n} from '@thunderid/node';\nimport {\n I18nProvider,\n FlowMetaProvider,\n FlowProvider,\n UserProvider,\n ThemeProvider,\n ThunderIDContext as ReactThunderIDContext,\n ThunderIDContextProps as ReactThunderIDContextProps,\n ThunderIDProviderProps,\n} from '@thunderid/react';\nimport {ReadonlyURLSearchParams} from 'next/dist/client/components/navigation.react-server';\nimport {AppRouterInstance} from 'next/dist/shared/lib/app-router-context.shared-runtime';\nimport {useRouter, useSearchParams} from 'next/navigation';\nimport {FC, PropsWithChildren, RefObject, useEffect, useMemo, useRef, useState} from 'react';\nimport ThunderIDContext, {ThunderIDContextProps} from './ThunderIDContext';\nimport {RefreshResult} from '../../../server/actions/refreshToken';\nimport logger from '../../../utils/logger';\nimport fetchFlowMetaFromServer from '../../fetchFlowMetaFromServer';\nimport fetchManagementFromServer from '../../fetchManagementFromServer';\n\n/*\n Props interface of {@link ThunderIDClientProvider}\n /\nexport type ThunderIDClientProviderProps = Partial<Omit<ThunderIDProviderProps, 'baseUrl' \| 'clientId'>> &\n Pick<ThunderIDProviderProps, 'baseUrl' \| 'clientId'> & {\n applicationId: ThunderIDContextProps['applicationId'];\n clearSession: () => Promise<void>;\n handleOAuthCallback: (\n code: string,\n state: string,\n ) => Promise<{error?: string; redirectUrl?: string; success: boolean}>;\n /\n Flow metadata fetched server-side ahead of time, seeding `FlowMetaProvider` so it can skip\n * its own initial client-side fetch (avoiding a flash of untranslated i18n keys).\n */\n initialMeta?: FlowMetadataResponse \| null;\n isSignedIn: boolean;\n organizationHandle: ThunderIDContextProps['organizationHandle'];\n refreshToken: () => Promise<RefreshResult>;\n signIn: ThunderIDContextProps['signIn'];\n signOut: ThunderIDContextProps['signOut'];\n signUp: ThunderIDContextProps['signUp'];\n updateProfile: (\n requestConfig: UpdateMeProfileConfig,\n sessionId?: string,\n ) => Promise<{data: {user: User}; error: string; success: boolean}>;\n user: User \| null;\n userProfile: UserProfile;\n userSchema?: Record<string, AttributeSchema> \| null;\n };\n\nconst ThunderIDClientProvider: FC<PropsWithChildren<ThunderIDClientProviderProps>> = ({\n baseUrl,\n children,\n endpoints,\n signIn,\n clearSession,\n refreshToken,\n signOut,\n signUp,\n handleOAuthCallback,\n preferences,\n isSignedIn,\n signInUrl,\n signUpUrl,\n user: _user,\n userProfile: _userProfile,\n userSchema: _userSchema = null,\n updateProfile,\n applicationId,\n organizationHandle,\n scopes,\n vendor,\n initialMeta = null,\n}: PropsWithChildren<ThunderIDClientProviderProps>) => {\n const reRenderCheckRef: RefObject<boolean> = useRef(false);\n const router: AppRouterInstance = useRouter();\n const searchParams: ReadonlyURLSearchParams = useSearchParams();\n const [isLoading, setIsLoading] = useState<boolean>(true);\n const [user, setUser] = useState<User \| null>(_user);\n const [userProfile, setUserProfile] = useState<UserProfile>(_userProfile);\n const [userSchema, setUserSchema] = useState<Record<string, AttributeSchema> \| null>(_userSchema);\n\n useEffect(() => {\n setUserProfile(_userProfile);\n }, [_userProfile]);\n\n useEffect(() => {\n setUserSchema(_userSchema);\n }, [_userSchema]);\n\n useEffect(() => {\n setUser(_user);\n }, [_user]);\n\n // Handle OAuth callback automatically\n useEffect(() => {\n // React 18.x Strict.Mode has a new check for `Ensuring reusable state` to facilitate an upcoming react feature.\n // https://reactjs.org/docs/strict-mode.html#ensuring-reusable-state\n // This will remount all the useEffects to ensure that there are no unexpected side effects.\n // When react remounts the signIn hook of the AuthProvider, it will cause a race condition. Hence, we have to\n // prevent the re-render of this hook as suggested in the following discussion.\n // https://github.com/reactwg/react-18/discussions/18#discussioncomment-795623\n if (reRenderCheckRef.current) {\n return;\n }\n\n reRenderCheckRef.current = true;\n\n // Don't handle callback if already signed in\n if (isSignedIn) return;\n\n (async (): Promise<void> => {\n try {\n const code: string \| null = searchParams.get('code');\n const state: string \| null = searchParams.get('state');\n const error: string \| null = searchParams.get('error');\n\n // Check for OAuth errors first\n if (error) {\n logger.error('[ThunderIDClientProvider] An error was received for the initiated sign-in request.');\n\n return;\n }\n\n // Handle OAuth callback if code and state are present\n if (code && state) {\n setIsLoading(true);\n\n const result: {error?: string; redirectUrl?: string; success: boolean} = await handleOAuthCallback(\n code,\n state,\n );\n\n if (result.success) {\n // Redirect to the success URL\n if (result.redirectUrl) {\n router.push(result.redirectUrl);\n } else {\n // Refresh the page to update authentication state\n window.location.reload();\n }\n } else {\n logger.error(\n `[ThunderIDClientProvider] An error occurred while signing in: ${result.error \|\| 'Authentication failed'}`,\n );\n }\n }\n } catch (error) {\n logger.error('[ThunderIDClientProvider] Failed to handle OAuth callback:', error);\n }\n })();\n }, []);\n\n useEffect(() => {\n // Set loading to false when server has resolved authentication state\n setIsLoading(false);\n }, [isSignedIn, user]);\n\n const handleSignIn = async (payload: any, request: EmbeddedFlowExecuteRequestConfig): Promise<any> => {\n if (!signIn) {\n throw new ThunderIDRuntimeError(\n '`signIn` function is not available.',\n 'ThunderIDClientProvider-handleSignIn-RuntimeError-001',\n 'nextjs',\n );\n }\n\n const result: any = await signIn(payload, request);\n\n // Redirect based flow URL is sent as `signInUrl` in the response.\n // Use window.location.href instead of router.push() — the OAuth authorization\n // endpoint is on an external server, and router.push() would send RSC fetch\n // headers that the identity provider doesn't understand, causing a CORS error.\n if (result?.data?.signInUrl) {\n window.location.href = result.data.signInUrl;\n\n return undefined;\n }\n\n // After the Embedded flow is successful, the URL to navigate next is sent as `afterSignInUrl` in the response.\n if (result?.data?.afterSignInUrl) {\n router.push(result.data.afterSignInUrl);\n\n return undefined;\n }\n\n if (result?.error) {\n throw new Error(result.error);\n }\n\n return result?.data ?? result;\n };\n\n const handleSignUp = async (payload: any, request: EmbeddedFlowExecuteRequestConfig): Promise<any> => {\n if (!signUp) {\n throw new ThunderIDRuntimeError(\n '`signUp` function is not available.',\n 'ThunderIDClientProvider-handleSignUp-RuntimeError-001',\n 'nextjs',\n );\n }\n\n const result: any = await signUp(payload, request);\n\n // Redirect based flow URL is sent as `signUpUrl` in the response.\n if (result?.data?.signUpUrl) {\n router.push(result.data.signUpUrl);\n\n return undefined;\n }\n\n // After the Embedded flow is successful, the URL to navigate next is sent as `afterSignUpUrl` in the response.\n if (result?.data?.afterSignUpUrl) {\n router.push(result.data.afterSignUpUrl);\n\n return undefined;\n }\n\n if (result?.error) {\n throw new Error(result.error);\n }\n\n return result?.data ?? result;\n };\n\n const handleSignOut = async (): Promise<any> => {\n logger.debug('[ThunderIDClientProvider][handleSignOut] `handleSignOut` called.');\n\n try {\n const result: any = await signOut();\n\n logger.debug('[ThunderIDClientProvider][handleSignOut] Sign out result:', result);\n\n if (result?.data?.afterSignOutUrl) {\n router.push(result.data.afterSignOutUrl);\n\n return {location: result.data.afterSignOutUrl, redirected: true};\n }\n\n if (result?.error) {\n logger.error(\n '[ThunderIDClientProvider][handleSignOut] Error result was returned during signing the user out with a button click:',\n result.error,\n );\n }\n\n return result?.data ?? result;\n } catch (error) {\n logger.error(\n '[ThunderIDClientProvider][handleSignOut] Error occurred during signing the user out with a button click:',\n error,\n );\n\n return undefined;\n }\n };\n\n const contextValue: ThunderIDContextProps = useMemo(\n () => ({\n applicationId,\n baseUrl,\n clearSession,\n isLoading,\n isSignedIn,\n organizationHandle,\n preferences,\n refreshToken,\n scopes,\n signIn: handleSignIn,\n signInUrl,\n signOut: handleSignOut,\n signUp: handleSignUp,\n signUpUrl,\n user,\n }),\n [\n baseUrl,\n user,\n isSignedIn,\n isLoading,\n signInUrl,\n signUpUrl,\n applicationId,\n organizationHandle,\n scopes,\n preferences,\n ],\n );\n\n const handleProfileUpdate = (payload: User): void => {\n setUser(payload);\n setUserProfile((prev: UserProfile) => ({\n ...prev,\n flattenedProfile: generateFlattenedUserProfile(payload),\n profile: payload,\n }));\n };\n\n // Bridge into @thunderid/react's own ThunderIDContext. Internal react components rendered by\n // BaseSignIn/BaseSignUp — most notably FlowMetaProvider, which fetches `/flow/meta` and injects\n // its i18n bundle — call react's `useThunderID()` directly. Without this bridge they'd only see\n // react's context default (applicationId/baseUrl undefined, isInitialized false), so the meta\n // fetch would never fire and flow labels would render as untranslated i18n keys. Fields with no\n // nextjs equivalent (token/http helpers meant for direct browser API calls) are stubbed out,\n // since nextjs routes those operations through server actions instead.\n const unsupported = (name: string): (() => Promise<never>) => {\n return () =>\n Promise.reject(\n new ThunderIDRuntimeError(\n `\\`${name}\\` is not supported in @thunderid/nextjs.`,\n `ThunderIDClientProvider-${name}-NotSupportedError-001`,\n 'nextjs',\n ),\n );\n };\n\n const reactContextValue: ReactThunderIDContextProps = useMemo(\n () => ({\n afterSignInUrl: undefined,\n applicationId,\n baseUrl,\n clearSession,\n clientId: undefined,\n discovery: {wellKnown: null},\n // Only the management collection overrides arrive here, so the admin hooks build the URLs the\n // management server action accepts.\n endpoints,\n exchangeToken: unsupported('exchangeToken'),\n getAccessToken: unsupported('getAccessToken'),\n getDecodedIdToken: unsupported('getDecodedIdToken'),\n getIdToken: unsupported('getIdToken'),\n getStorageManager: () => Promise.resolve(null),\n http: {\n // The admin components and hooks send management requests through a server action that adds\n // the server-held access token, so the token never reaches the browser.\n fetcher: fetchManagementFromServer,\n request: unsupported('http.request'),\n requestAll: unsupported('http.requestAll'),\n },\n instanceId: 0,\n isInitialized: !isLoading,\n isLoading,\n isMetaLoading: false,\n isSignedIn,\n meta: initialMeta ?? null,\n organizationHandle,\n reInitialize: unsupported('reInitialize'),\n recover: unsupported('recover'),\n resolveFlowTemplateLiterals: (text: string \| undefined): string => text ?? '',\n scopes,\n signIn: handleSignIn,\n signInSilently: unsupported('signInSilently'),\n signInUrl,\n signOut: handleSignOut,\n signUp: handleSignUp,\n signUpUrl,\n user,\n userSchema,\n vendor: getVendorPrefix(vendor),\n }),\n [\n applicationId,\n baseUrl,\n clearSession,\n endpoints,\n isLoading,\n isSignedIn,\n organizationHandle,\n scopes,\n signInUrl,\n signUpUrl,\n user,\n userSchema,\n initialMeta,\n vendor,\n ],\n );\n\n return (\n <ThunderIDContext.Provider value={contextValue}>\n <ReactThunderIDContext.Provider value={reactContextValue}>\n <I18nProvider preferences={preferences?.i18n}>\n <FlowMetaProvider\n enabled={preferences?.resolveFromMeta !== false}\n initialMeta={initialMeta}\n fetchMeta={fetchFlowMetaFromServer}\n >\n <ThemeProvider theme={preferences?.theme?.overrides} mode={preferences?.theme?.mode}>\n <FlowProvider>\n <UserProvider\n profile={userProfile}\n userSchema={userSchema}\n onUpdateProfile={handleProfileUpdate}\n updateProfile={updateProfile}\n >\n {children}\n </UserProvider>\n </FlowProvider>\n </ThemeProvider>\n </FlowMetaProvider>\n </I18nProvider>\n </ReactThunderIDContext.Provider>\n </ThunderIDContext.Provider>\n );\n};\n\nexport default ThunderIDClientProvider;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAmEA,MAAMA,2BAAgF,EACpF,SACA,UACA,WACA,QACA,cACA,cACA,SACA,QACA,qBACA,aACA,YACA,WACA,WACA,MAAM,OACN,aAAa,cACb,YAAY,cAAc,MAC1B,eACA,eACA,oBACA,QACA,QACA,cAAc,WACuC;CACrD,MAAMC,qCAA8C,MAAM;CAC1D,MAAMC,yCAAuC;CAC7C,MAAMC,qDAAyD;CAC/D,MAAM,CAAC,WAAW,oCAAkC,KAAK;CACzD,MAAM,CAAC,MAAM,+BAAiC,MAAM;CACpD,MAAM,CAAC,aAAa,sCAAwC,aAAa;CACzE,MAAM,CAAC,YAAY,qCAAkE,YAAY;AAEjG,4BAAgB;AACd,iBAAe,aAAa;IAC3B,CAAC,aAAa,CAAC;AAElB,4BAAgB;AACd,gBAAc,YAAY;IACzB,CAAC,YAAY,CAAC;AAEjB,4BAAgB;AACd,UAAQ,MAAM;IACb,CAAC,MAAM,CAAC;AAGX,4BAAgB;AAOd,MAAI,iBAAiB,QACnB;AAGF,mBAAiB,UAAU;AAG3B,MAAI,WAAY;AAEhB,GAAC,YAA2B;AAC1B,OAAI;IACF,MAAMC,OAAsB,aAAa,IAAI,OAAO;IACpD,MAAMC,QAAuB,aAAa,IAAI,QAAQ;AAItD,QAH6B,aAAa,IAAI,QAAQ,EAG3C;AACT,4BAAO,MAAM,qFAAqF;AAElG;;AAIF,QAAI,QAAQ,OAAO;AACjB,kBAAa,KAAK;KAElB,MAAMC,SAAmE,MAAM,oBAC7E,MACA,MACD;AAED,SAAI,OAAO,QAET,KAAI,OAAO,YACT,QAAO,KAAK,OAAO,YAAY;SAG/B,QAAO,SAAS,QAAQ;SAG1B,wBAAO,MACL,iEAAiE,OAAO,SAAS,0BAClF;;YAGE,OAAO;AACd,2BAAO,MAAM,8DAA8D,MAAM;;MAEjF;IACH,EAAE,CAAC;AAEN,4BAAgB;AAEd,eAAa,MAAM;IAClB,CAAC,YAAY,KAAK,CAAC;CAEtB,MAAM,eAAe,OAAO,SAAc,YAA4D;AACpG,MAAI,CAAC,OACH,OAAM,IAAIC,uCACR,uCACA,yDACA,SACD;EAGH,MAAMC,SAAc,MAAM,OAAO,SAAS,QAAQ;AAMlD,MAAI,QAAQ,MAAM,WAAW;AAC3B,UAAO,SAAS,OAAO,OAAO,KAAK;AAEnC;;AAIF,MAAI,QAAQ,MAAM,gBAAgB;AAChC,UAAO,KAAK,OAAO,KAAK,eAAe;AAEvC;;AAGF,MAAI,QAAQ,MACV,OAAM,IAAI,MAAM,OAAO,MAAM;AAG/B,SAAO,QAAQ,QAAQ;;CAGzB,MAAM,eAAe,OAAO,SAAc,YAA4D;AACpG,MAAI,CAAC,OACH,OAAM,IAAID,uCACR,uCACA,yDACA,SACD;EAGH,MAAMC,SAAc,MAAM,OAAO,SAAS,QAAQ;AAGlD,MAAI,QAAQ,MAAM,WAAW;AAC3B,UAAO,KAAK,OAAO,KAAK,UAAU;AAElC;;AAIF,MAAI,QAAQ,MAAM,gBAAgB;AAChC,UAAO,KAAK,OAAO,KAAK,eAAe;AAEvC;;AAGF,MAAI,QAAQ,MACV,OAAM,IAAI,MAAM,OAAO,MAAM;AAG/B,SAAO,QAAQ,QAAQ;;CAGzB,MAAM,gBAAgB,YAA0B;AAC9C,yBAAO,MAAM,mEAAmE;AAEhF,MAAI;GACF,MAAMA,SAAc,MAAM,SAAS;AAEnC,0BAAO,MAAM,6DAA6D,OAAO;AAEjF,OAAI,QAAQ,MAAM,iBAAiB;AACjC,WAAO,KAAK,OAAO,KAAK,gBAAgB;AAExC,WAAO;KAAC,UAAU,OAAO,KAAK;KAAiB,YAAY;KAAK;;AAGlE,OAAI,QAAQ,MACV,wBAAO,MACL,uHACA,OAAO,MACR;AAGH,UAAO,QAAQ,QAAQ;WAChB,OAAO;AACd,0BAAO,MACL,4GACA,MACD;AAED;;;CAIJ,MAAMC,yCACG;EACL;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA,QAAQ;EACR;EACA,SAAS;EACT,QAAQ;EACR;EACA;EACD,GACD;EACE;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACD,CACF;CAED,MAAM,uBAAuB,YAAwB;AACnD,UAAQ,QAAQ;AAChB,kBAAgB,UAAuB;GACrC,GAAG;GACH,qEAA+C,QAAQ;GACvD,SAAS;GACV,EAAE;;CAUL,MAAM,eAAe,SAAyC;AAC5D,eACE,QAAQ,OACN,IAAIF,uCACF,KAAK,KAAK,4CACV,2BAA2B,KAAK,yBAChC,SACD,CACF;;CAGL,MAAMG,8CACG;EACL,gBAAgB;EAChB;EACA;EACA;EACA,UAAU;EACV,WAAW,EAAC,WAAW,MAAK;EAG5B;EACA,eAAe,YAAY,gBAAgB;EAC3C,gBAAgB,YAAY,iBAAiB;EAC7C,mBAAmB,YAAY,oBAAoB;EACnD,YAAY,YAAY,aAAa;EACrC,yBAAyB,QAAQ,QAAQ,KAAK;EAC9C,MAAM;GAGJ,SAASC;GACT,SAAS,YAAY,eAAe;GACpC,YAAY,YAAY,kBAAkB;GAC3C;EACD,YAAY;EACZ,eAAe,CAAC;EAChB;EACA,eAAe;EACf;EACA,MAAM,eAAe;EACrB;EACA,cAAc,YAAY,eAAe;EACzC,SAAS,YAAY,UAAU;EAC/B,8BAA8B,SAAqC,QAAQ;EAC3E;EACA,QAAQ;EACR,gBAAgB,YAAY,iBAAiB;EAC7C;EACA,SAAS;EACT,QAAQ;EACR;EACA;EACA;EACA,8CAAwB,OAAO;EAChC,GACD;EACE;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACD,CACF;AAED,QACE,2CAACC,iCAAiB;EAAS,OAAO;YAChC,2CAACC,mCAAsB;GAAS,OAAO;aACrC,2CAACC;IAAa,aAAa,aAAa;cACtC,2CAACC;KACC,SAAS,aAAa,oBAAoB;KAC7B;KACb,WAAWC;eAEX,2CAACC;MAAc,OAAO,aAAa,OAAO;MAAW,MAAM,aAAa,OAAO;gBAC7E,2CAACC,4CACC,2CAACC;OACC,SAAS;OACG;OACZ,iBAAiB;OACF;OAEd;QACY,GACF;OACD;MACC;KACN;IACgB;GACP;;AAIhC,gCAAe"}

package/dist/cjs/client/fetchAuthFlowsFromServer.cjs CHANGED Viewed

@@ -1,5 +1,5 @@
 const require_loadPageFromAction = require('./loadPageFromAction.cjs');
-const require_getAuthFlowsAction = require('../server/actions/getAuthFlowsAction.cjs');
+const require_getAuthFlowsAction = require('../server/actions/auth/getAuthFlowsAction.cjs');
 //#region src/client/fetchAuthFlowsFromServer.ts
 /**

package/dist/cjs/client/fetchAuthFlowsFromServer.cjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"fetchAuthFlowsFromServer.cjs","names":["fetchAuthFlowsFromServer: FetchAuthFlows","loadPageFromAction","getAuthFlowsAction"],"sources":["../../../src/client/fetchAuthFlowsFromServer.ts"],"sourcesContent":["// Copyright 2026 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\nimport type {FetchAuthFlows, SelectPage, SelectPageRequest} from '@thunderid/node';\nimport loadPageFromAction from './loadPageFromAction';\nimport getAuthFlowsAction from '../server/actions/getAuthFlowsAction';\n\n/*\n The loader behind `AuthFlowSelect`: loads authentication flows through {@link getAuthFlowsAction} with the\n * signed-in user's server-held session. Requires an existing session. `request.signal` is not forwarded because\n * an `AbortSignal` cannot cross the server action boundary.\n */\nconst fetchAuthFlowsFromServer: FetchAuthFlows = async ({limit, offset}: SelectPageRequest): Promise<SelectPage> =>\n loadPageFromAction(await getAuthFlowsAction({limit, offset}), 'getAuthFlowsAction-Error-001');\n\nexport default fetchAuthFlowsFromServer;\n"],"mappings":";;;;;;;;;AAYA,MAAMA,2BAA2C,OAAO,EAAC,OAAO,aAC9DC,mCAAmB,MAAMC,mCAAmB;CAAC;CAAO;CAAO,CAAC,EAAE,+BAA+B;AAE/F,uCAAe"}
1	+ {"version":3,"file":"fetchAuthFlowsFromServer.cjs","names":["fetchAuthFlowsFromServer: FetchAuthFlows","loadPageFromAction","getAuthFlowsAction"],"sources":["../../../src/client/fetchAuthFlowsFromServer.ts"],"sourcesContent":["// Copyright 2026 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\nimport type {FetchAuthFlows, SelectPage, SelectPageRequest} from '@thunderid/node';\nimport loadPageFromAction from './loadPageFromAction';\nimport getAuthFlowsAction from '../server/actions/auth/getAuthFlowsAction';\n\n/*\n The loader behind `AuthFlowSelect`: loads authentication flows through {@link getAuthFlowsAction} with the\n * signed-in user's server-held session. Requires an existing session. `request.signal` is not forwarded because\n * an `AbortSignal` cannot cross the server action boundary.\n */\nconst fetchAuthFlowsFromServer: FetchAuthFlows = async ({limit, offset}: SelectPageRequest): Promise<SelectPage> =>\n loadPageFromAction(await getAuthFlowsAction({limit, offset}), 'getAuthFlowsAction-Error-001');\n\nexport default fetchAuthFlowsFromServer;\n"],"mappings":";;;;;;;;;AAYA,MAAMA,2BAA2C,OAAO,EAAC,OAAO,aAC9DC,mCAAmB,MAAMC,mCAAmB;CAAC;CAAO;CAAO,CAAC,EAAE,+BAA+B;AAE/F,uCAAe"}

package/dist/cjs/client/fetchFlowMetaFromServer.cjs CHANGED Viewed

@@ -1,5 +1,5 @@
 const require_rolldown_runtime = require('../_virtual/rolldown_runtime.cjs');
-const require_getFlowMetaAction = require('../server/actions/getFlowMetaAction.cjs');
+const require_getFlowMetaAction = require('../server/actions/auth/getFlowMetaAction.cjs');
 let __thunderid_node = require("@thunderid/node");
 __thunderid_node = require_rolldown_runtime.__toESM(__thunderid_node);

package/dist/cjs/client/fetchFlowMetaFromServer.cjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"fetchFlowMetaFromServer.cjs","names":["result: GetFlowMetaActionResult","getFlowMetaAction","ThunderIDAPIError","ThunderIDRuntimeError"],"sources":["../../../src/client/fetchFlowMetaFromServer.ts"],"sourcesContent":["// Copyright 2026 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\nimport {FlowMetadataResponse, ThunderIDAPIError, ThunderIDRuntimeError} from '@thunderid/node';\nimport getFlowMetaAction, {GetFlowMetaActionResult} from '../server/actions/getFlowMetaAction';\n\n/*\n The `fetchMeta` behind `FlowMetaProvider`: loads flow metadata through {@link getFlowMetaAction} so the browser\n * never calls `baseUrl` directly, and throws the failure the action returned as an SDK error, which\n * `FlowMetaProvider` reports through its `error` state.\n */\nconst fetchFlowMetaFromServer = async (params: {\n applicationId?: string;\n language?: string;\n}): Promise<FlowMetadataResponse> => {\n const result: GetFlowMetaActionResult = await getFlowMetaAction(params);\n\n if (result.success) {\n return result.meta;\n }\n\n if (result.statusCode !== undefined) {\n throw new ThunderIDAPIError(result.message, 'getFlowMetaAction-Error-001', 'nextjs', result.statusCode);\n }\n\n throw new ThunderIDRuntimeError(result.message, 'getFlowMetaAction-Error-001', 'nextjs');\n};\n\nexport default fetchFlowMetaFromServer;\n"],"mappings":";;;;;;;;;;;AAWA,MAAM,0BAA0B,OAAO,WAGF;CACnC,MAAMA,SAAkC,MAAMC,kCAAkB,OAAO;AAEvE,KAAI,OAAO,QACT,QAAO,OAAO;AAGhB,KAAI,OAAO,eAAe,OACxB,OAAM,IAAIC,mCAAkB,OAAO,SAAS,+BAA+B,UAAU,OAAO,WAAW;AAGzG,OAAM,IAAIC,uCAAsB,OAAO,SAAS,+BAA+B,SAAS;;AAG1F,sCAAe"}
1	+ {"version":3,"file":"fetchFlowMetaFromServer.cjs","names":["result: GetFlowMetaActionResult","getFlowMetaAction","ThunderIDAPIError","ThunderIDRuntimeError"],"sources":["../../../src/client/fetchFlowMetaFromServer.ts"],"sourcesContent":["// Copyright 2026 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\nimport {FlowMetadataResponse, ThunderIDAPIError, ThunderIDRuntimeError} from '@thunderid/node';\nimport getFlowMetaAction, {GetFlowMetaActionResult} from '../server/actions/auth/getFlowMetaAction';\n\n/*\n The `fetchMeta` behind `FlowMetaProvider`: loads flow metadata through {@link getFlowMetaAction} so the browser\n * never calls `baseUrl` directly, and throws the failure the action returned as an SDK error, which\n * `FlowMetaProvider` reports through its `error` state.\n */\nconst fetchFlowMetaFromServer = async (params: {\n applicationId?: string;\n language?: string;\n}): Promise<FlowMetadataResponse> => {\n const result: GetFlowMetaActionResult = await getFlowMetaAction(params);\n\n if (result.success) {\n return result.meta;\n }\n\n if (result.statusCode !== undefined) {\n throw new ThunderIDAPIError(result.message, 'getFlowMetaAction-Error-001', 'nextjs', result.statusCode);\n }\n\n throw new ThunderIDRuntimeError(result.message, 'getFlowMetaAction-Error-001', 'nextjs');\n};\n\nexport default fetchFlowMetaFromServer;\n"],"mappings":";;;;;;;;;;;AAWA,MAAM,0BAA0B,OAAO,WAGF;CACnC,MAAMA,SAAkC,MAAMC,kCAAkB,OAAO;AAEvE,KAAI,OAAO,QACT,QAAO,OAAO;AAGhB,KAAI,OAAO,eAAe,OACxB,OAAM,IAAIC,mCAAkB,OAAO,SAAS,+BAA+B,UAAU,OAAO,WAAW;AAGzG,OAAM,IAAIC,uCAAsB,OAAO,SAAS,+BAA+B,SAAS;;AAG1F,sCAAe"}

package/dist/cjs/client/fetchManagementFromServer.cjs ADDED Viewed

@@ -0,0 +1,32 @@
+const require_managementRequestAction = require('../server/actions/management/managementRequestAction.cjs');
+//#region src/client/fetchManagementFromServer.ts
+/**
+* The `http.fetcher` that `ThunderIDProvider` hands to the admin components and hooks of
+* `@thunderid/react`: it sends each management request through {@link managementRequestAction}, which
+* adds the signed-in user's server-held access token, and turns the plain result back into a
+* `Response` so the core API functions can read the status (a 403 stays distinct from a 404).
+*
+* Only the URL, method and body cross to the server. Headers are not forwarded, since the server sets
+* the ones the management API needs, and `signal` is not forwarded because an `AbortSignal` cannot
+* cross the server action boundary.
+*/
+const fetchManagementFromServer = async (url, config) => {
+	const { body, status, statusText } = await require_managementRequestAction.default({
+		...typeof config?.body === "string" ? { body: config.body } : {},
+		method: config?.method ?? "GET",
+		url
+	});
+	return {
+		json: () => Promise.resolve(body ? JSON.parse(body) : void 0),
+		ok: status >= 200 && status < 300,
+		status,
+		statusText,
+		text: () => Promise.resolve(body)
+	};
+};
+var fetchManagementFromServer_default = fetchManagementFromServer;
+//#endregion
+exports.default = fetchManagementFromServer_default;
+//# sourceMappingURL=fetchManagementFromServer.cjs.map

package/dist/cjs/client/fetchManagementFromServer.cjs.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"fetchManagementFromServer.cjs","names":["fetchManagementFromServer: ApiFetcher","managementRequestAction"],"sources":["../../../src/client/fetchManagementFromServer.ts"],"sourcesContent":["// Copyright 2026 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\nimport type {ApiFetcher} from '@thunderid/node';\nimport managementRequestAction, {\n ManagementRequestActionResult,\n} from '../server/actions/management/managementRequestAction';\n\n/**\n * The `http.fetcher` that `ThunderIDProvider` hands to the admin components and hooks of\n * `@thunderid/react`: it sends each management request through {@link managementRequestAction}, which\n * adds the signed-in user's server-held access token, and turns the plain result back into a\n * `Response` so the core API functions can read the status (a 403 stays distinct from a 404).\n *\n * Only the URL, method and body cross to the server. Headers are not forwarded, since the server sets\n * the ones the management API needs, and `signal` is not forwarded because an `AbortSignal` cannot\n * cross the server action boundary.\n */\nconst fetchManagementFromServer: ApiFetcher = async (url: string, config: RequestInit): Promise<Response> => {\n const result: ManagementRequestActionResult = await managementRequestAction({\n ...(typeof config?.body === 'string' ? {body: config.body} : {}),\n method: config?.method ?? 'GET',\n url,\n });\n\n const {body, status, statusText} = result;\n\n return {\n json: () => Promise.resolve(body ? (JSON.parse(body) as unknown) : undefined),\n ok: status >= 200 && status < 300,\n status,\n statusText,\n text: () => Promise.resolve(body),\n } as Response;\n};\n\nexport default fetchManagementFromServer;\n"],"mappings":";;;;;;;;;;;;;AAkBA,MAAMA,4BAAwC,OAAO,KAAa,WAA2C;CAO3G,MAAM,EAAC,MAAM,QAAQ,eANyB,MAAMC,wCAAwB;EAC1E,GAAI,OAAO,QAAQ,SAAS,WAAW,EAAC,MAAM,OAAO,MAAK,GAAG,EAAE;EAC/D,QAAQ,QAAQ,UAAU;EAC1B;EACD,CAAC;AAIF,QAAO;EACL,YAAY,QAAQ,QAAQ,OAAQ,KAAK,MAAM,KAAK,GAAe,OAAU;EAC7E,IAAI,UAAU,OAAO,SAAS;EAC9B;EACA;EACA,YAAY,QAAQ,QAAQ,KAAK;EAClC;;AAGH,wCAAe"}

package/dist/cjs/client/fetchUserTypesFromServer.cjs CHANGED Viewed

@@ -1,5 +1,5 @@
 const require_loadPageFromAction = require('./loadPageFromAction.cjs');
-const require_getUserTypesAction = require('../server/actions/getUserTypesAction.cjs');
+const require_getUserTypesAction = require('../server/actions/management/getUserTypesAction.cjs');
 //#region src/client/fetchUserTypesFromServer.ts
 /**

package/dist/cjs/client/fetchUserTypesFromServer.cjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"fetchUserTypesFromServer.cjs","names":["fetchUserTypesFromServer: FetchUserTypes","loadPageFromAction","getUserTypesAction"],"sources":["../../../src/client/fetchUserTypesFromServer.ts"],"sourcesContent":["// Copyright 2026 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\nimport type {FetchUserTypes, SelectPage, SelectPageRequest} from '@thunderid/node';\nimport loadPageFromAction from './loadPageFromAction';\nimport getUserTypesAction from '../server/actions/getUserTypesAction';\n\n/*\n The loader behind `UserTypeSelect`: loads user types through {@link getUserTypesAction} with the signed-in\n * user's server-held session. Requires an existing session. `request.signal` is not forwarded because an\n * `AbortSignal` cannot cross the server action boundary.\n */\nconst fetchUserTypesFromServer: FetchUserTypes = async ({limit, offset}: SelectPageRequest): Promise<SelectPage> =>\n loadPageFromAction(await getUserTypesAction({limit, offset}), 'getUserTypesAction-Error-001');\n\nexport default fetchUserTypesFromServer;\n"],"mappings":";;;;;;;;;AAYA,MAAMA,2BAA2C,OAAO,EAAC,OAAO,aAC9DC,mCAAmB,MAAMC,mCAAmB;CAAC;CAAO;CAAO,CAAC,EAAE,+BAA+B;AAE/F,uCAAe"}
1	+ {"version":3,"file":"fetchUserTypesFromServer.cjs","names":["fetchUserTypesFromServer: FetchUserTypes","loadPageFromAction","getUserTypesAction"],"sources":["../../../src/client/fetchUserTypesFromServer.ts"],"sourcesContent":["// Copyright 2026 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\nimport type {FetchUserTypes, SelectPage, SelectPageRequest} from '@thunderid/node';\nimport loadPageFromAction from './loadPageFromAction';\nimport getUserTypesAction from '../server/actions/management/getUserTypesAction';\n\n/*\n The loader behind `UserTypeSelect`: loads user types through {@link getUserTypesAction} with the signed-in\n * user's server-held session. Requires an existing session. `request.signal` is not forwarded because an\n * `AbortSignal` cannot cross the server action boundary.\n */\nconst fetchUserTypesFromServer: FetchUserTypes = async ({limit, offset}: SelectPageRequest): Promise<SelectPage> =>\n loadPageFromAction(await getUserTypesAction({limit, offset}), 'getUserTypesAction-Error-001');\n\nexport default fetchUserTypesFromServer;\n"],"mappings":";;;;;;;;;AAYA,MAAMA,2BAA2C,OAAO,EAAC,OAAO,aAC9DC,mCAAmB,MAAMC,mCAAmB;CAAC;CAAO;CAAO,CAAC,EAAE,+BAA+B;AAE/F,uCAAe"}

package/dist/cjs/client/fetchUsersFromServer.cjs CHANGED Viewed

@@ -1,5 +1,5 @@
 const require_loadPageFromAction = require('./loadPageFromAction.cjs');
-const require_getUsersAction = require('../server/actions/getUsersAction.cjs');
+const require_getUsersAction = require('../server/actions/management/getUsersAction.cjs');
 //#region src/client/fetchUsersFromServer.ts
 /**

package/dist/cjs/client/fetchUsersFromServer.cjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"fetchUsersFromServer.cjs","names":["fetchUsersFromServer: FetchUsers","loadPageFromAction","getUsersAction"],"sources":["../../../src/client/fetchUsersFromServer.ts"],"sourcesContent":["// Copyright 2026 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\nimport type {FetchUsers, SelectPage, SelectPageRequest} from '@thunderid/node';\nimport loadPageFromAction from './loadPageFromAction';\nimport getUsersAction from '../server/actions/getUsersAction';\n\n/*\n The loader behind `UserSelect`: loads users through {@link getUsersAction} with the signed-in user's server-held session.\n * Requires an existing session. `request.signal` is not forwarded because an `AbortSignal` cannot cross the server action boundary.\n */\nconst fetchUsersFromServer: FetchUsers = async ({filter, limit, offset}: SelectPageRequest): Promise<SelectPage> =>\n loadPageFromAction(await getUsersAction({filter, limit, offset}), 'getUsersAction-Error-001');\n\nexport default fetchUsersFromServer;\n"],"mappings":";;;;;;;;AAWA,MAAMA,uBAAmC,OAAO,EAAC,QAAQ,OAAO,aAC9DC,mCAAmB,MAAMC,+BAAe;CAAC;CAAQ;CAAO;CAAO,CAAC,EAAE,2BAA2B;AAE/F,mCAAe"}
1	+ {"version":3,"file":"fetchUsersFromServer.cjs","names":["fetchUsersFromServer: FetchUsers","loadPageFromAction","getUsersAction"],"sources":["../../../src/client/fetchUsersFromServer.ts"],"sourcesContent":["// Copyright 2026 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\nimport type {FetchUsers, SelectPage, SelectPageRequest} from '@thunderid/node';\nimport loadPageFromAction from './loadPageFromAction';\nimport getUsersAction from '../server/actions/management/getUsersAction';\n\n/*\n The loader behind `UserSelect`: loads users through {@link getUsersAction} with the signed-in user's server-held session.\n * Requires an existing session. `request.signal` is not forwarded because an `AbortSignal` cannot cross the server action boundary.\n */\nconst fetchUsersFromServer: FetchUsers = async ({filter, limit, offset}: SelectPageRequest): Promise<SelectPage> =>\n loadPageFromAction(await getUsersAction({filter, limit, offset}), 'getUsersAction-Error-001');\n\nexport default fetchUsersFromServer;\n"],"mappings":";;;;;;;;AAWA,MAAMA,uBAAmC,OAAO,EAAC,QAAQ,OAAO,aAC9DC,mCAAmB,MAAMC,+BAAe;CAAC;CAAQ;CAAO;CAAO,CAAC,EAAE,2BAA2B;AAE/F,mCAAe"}

package/dist/cjs/client/hooks/management/useGrantedPermissions.cjs ADDED Viewed

@@ -0,0 +1,51 @@
+'use client';
+const require_rolldown_runtime = require('../../../_virtual/rolldown_runtime.cjs');
+const require_useThunderID = require('../../contexts/ThunderID/useThunderID.cjs');
+const require_getGrantedPermissionsAction = require('../../../server/actions/management/getGrantedPermissionsAction.cjs');
+let __thunderid_node = require("@thunderid/node");
+__thunderid_node = require_rolldown_runtime.__toESM(__thunderid_node);
+let react = require("react");
+react = require_rolldown_runtime.__toESM(react);
+//#region src/client/hooks/management/useGrantedPermissions.ts
+/**
+* Reads the permissions the signed-in user's access token grants, for example to hide a page the
+* user cannot use. The token stays on the server: only the list of permissions is sent to the
+* browser, through a server action. Same shape as `useGrantedPermissions` in `@thunderid/react`.
+*
+* @returns The granted permissions and a `can` check.
+*
+* @example
+* ```tsx
+* const {can} = useGrantedPermissions();
+* return can('system:group:view') ? <GroupList /> : null;
+* ```
+*/
+const useGrantedPermissions = () => {
+	const { isSignedIn } = require_useThunderID.default();
+	const [granted, setGranted] = (0, react.useState)(null);
+	(0, react.useEffect)(() => {
+		if (!isSignedIn) return;
+		let active = true;
+		require_getGrantedPermissionsAction.default().catch(() => []).then((tokenPermissions) => {
+			if (active) setGranted(tokenPermissions);
+		});
+		return () => {
+			active = false;
+		};
+	}, [isSignedIn]);
+	const permissions = (0, react.useMemo)(() => isSignedIn ? granted ?? [] : [], [granted, isSignedIn]);
+	const isLoading = !!isSignedIn && granted === null;
+	return {
+		can: (0, react.useCallback)((required) => (0, __thunderid_node.hasPermission)(permissions, required), [permissions]),
+		isLoading,
+		permissions
+	};
+};
+var useGrantedPermissions_default = useGrantedPermissions;
+//#endregion
+exports.default = useGrantedPermissions_default;
+//# sourceMappingURL=useGrantedPermissions.cjs.map

package/dist/cjs/client/hooks/management/useGrantedPermissions.cjs.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"useGrantedPermissions.cjs","names":["useThunderID","getGrantedPermissionsAction","permissions: string[]","isLoading: boolean"],"sources":["../../../../../src/client/hooks/management/useGrantedPermissions.ts"],"sourcesContent":["// Copyright 2026 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\n'use client';\n\nimport {hasPermission} from '@thunderid/node';\nimport type {GrantedPermissions} from '@thunderid/react';\nimport {useCallback, useEffect, useMemo, useState} from 'react';\nimport getGrantedPermissionsAction from '../../../server/actions/management/getGrantedPermissionsAction';\nimport useThunderID from '../../contexts/ThunderID/useThunderID';\n\n/**\n * Reads the permissions the signed-in user's access token grants, for example to hide a page the\n * user cannot use. The token stays on the server: only the list of permissions is sent to the\n * browser, through a server action. Same shape as `useGrantedPermissions` in `@thunderid/react`.\n *\n * @returns The granted permissions and a `can` check.\n *\n * @example\n * ```tsx\n * const {can} = useGrantedPermissions();\n * return can('system:group:view') ? <GroupList /> : null;\n * ```\n */\nconst useGrantedPermissions = (): GrantedPermissions => {\n const {isSignedIn} = useThunderID();\n const [granted, setGranted] = useState<string[] | null>(null);\n\n useEffect(() => {\n if (!isSignedIn) {\n return undefined;\n }\n\n let active = true;\n\n void getGrantedPermissionsAction()\n .catch((): string[] => [])\n .then((tokenPermissions: string[]) => {\n if (active) {\n setGranted(tokenPermissions);\n }\n });\n\n return (): void => {\n active = false;\n };\n }, [isSignedIn]);\n\n const permissions: string[] = useMemo(() => (isSignedIn ? (granted ?? []) : []), [granted, isSignedIn]);\n const isLoading: boolean = !!isSignedIn && granted === null;\n\n const can: (required: string) => boolean = useCallback(\n (required: string): boolean => hasPermission(permissions, required),\n [permissions],\n );\n\n return {can, isLoading, permissions};\n};\n\nexport default useGrantedPermissions;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAwBA,MAAM,8BAAkD;CACtD,MAAM,EAAC,eAAcA,8BAAc;CACnC,MAAM,CAAC,SAAS,kCAAwC,KAAK;AAE7D,4BAAgB;AACd,MAAI,CAAC,WACH;EAGF,IAAI,SAAS;AAEb,EAAKC,6CAA6B,CAC/B,YAAsB,EAAE,CAAC,CACzB,MAAM,qBAA+B;AACpC,OAAI,OACF,YAAW,iBAAiB;IAE9B;AAEJ,eAAmB;AACjB,YAAS;;IAEV,CAAC,WAAW,CAAC;CAEhB,MAAMC,uCAAuC,aAAc,WAAW,EAAE,GAAI,EAAE,EAAG,CAAC,SAAS,WAAW,CAAC;CACvG,MAAMC,YAAqB,CAAC,CAAC,cAAc,YAAY;AAOvD,QAAO;EAAC,6BAJL,iDAA4C,aAAa,SAAS,EACnE,CAAC,YAAY,CACd;EAEY;EAAW;EAAY;;AAGtC,oCAAe"}