@thunderid/react 1.10.1 → 1.11.1

package/dist/cjs/contexts/ThunderID/ThunderIDProvider.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"ThunderIDProvider.cjs","names":["logger: ReturnType<typeof createPackageComponentLogger>","ThunderIDProvider: FC<PropsWithChildren<ThunderIDProviderProps>>","reRenderCheckRef: RefObject<boolean>","client: ThunderIDReactClient","ThunderIDReactClient","invalidator: ResourceInvalidator","storageManagerRef: any","useBrowserUrl","pendingSessionUpdateRef: RefObject<Promise<void> | null>","resolvedBaseUrl: string","decodedToken: IdToken","shouldFetchProfile: boolean","claims: User","currentSignInStatus: boolean","getUsersMe","getUsersMeMeta","arg1: any","isV2FlowRequest: boolean","ThunderIDRuntimeError","currentUrl: URL","urlParams: URLSearchParams","code: string | null","executionIdFromUrl: string | null","storedExecutionId: string | null","SPAUtils","interval: NodeJS.Timeout","status: boolean","getDecodedIdToken: () => Promise<IdToken>","getIdToken: () => Promise<string>","getAccessToken: () => Promise<string>","getStorageManager: ThunderIDContextProps['getStorageManager']","storageManager: Awaited<ReturnType<ThunderIDContextProps['getStorageManager']>>","request: (...args: any[]) => Promise<any>","requestAll: (...args: any[]) => Promise<any>","exchangeToken: (exchangeConfig: any) => Promise<any>","signOut: (...args: any[]) => Promise<any>","recover: ThunderIDContextProps['recover']","signUp: (...args: any[]) => Promise<any>","clearSession: (...args: any[]) => Promise<any>","reInitialize: (reInitConfig: any) => Promise<any>","result: any","reinitializedConfig: ThunderIDReactConfig","value: any","ThunderIDContext","I18nProvider","FlowMetaProvider","ThemeProvider","FlowProvider","UserProvider","ComponentRendererProvider"],"sources":["../../../../src/contexts/ThunderID/ThunderIDProvider.tsx"],"sourcesContent":["// Copyright 2025-2026 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\nimport {\n  ResourceInvalidator,\n  createResourceInvalidator,\n  ThunderIDRuntimeError,\n  generateFlattenedUserProfile,\n  OIDCDiscoveryApiResponse,\n  SignInOptions,\n  User,\n  UserProfile,\n  IdToken,\n  extractUserClaimsFromIdToken,\n  EmbeddedSignInFlowResponse,\n  EmbeddedRecoveryFlowRequest,\n  EmbeddedRecoveryFlowResponse,\n  createPackageComponentLogger,\n  getVendorPrefix,\n  resolveResourceEndpoint,\n  AttributeSchema,\n  SPAUtils,\n} from '@thunderid/browser';\nimport {FC, RefObject, PropsWithChildren, ReactElement, useEffect, useMemo, useRef, useState, useCallback} from 'react';\nimport ThunderIDContext, {ThunderIDContextProps} from './ThunderIDContext';\nimport getUsersMe from '../../api/account/getUsersMe';\nimport getUsersMeMeta from '../../api/account/getUsersMeMeta';\nimport useBrowserUrl from '../../hooks/useBrowserUrl';\nimport {ThunderIDReactConfig} from '../../models/config';\nimport {configureEmotionNonce} from '../../styles/emotion';\nimport ThunderIDReactClient from '../../ThunderIDReactClient';\nimport ComponentRendererProvider from '../ComponentRenderer/ComponentRendererProvider';\nimport FlowProvider from '../Flow/FlowProvider';\nimport FlowMetaProvider from '../FlowMeta/FlowMetaProvider';\nimport I18nProvider from '../I18n/I18nProvider';\nimport ThemeProvider from '../Theme/ThemeProvider';\nimport UserProvider from '../User/UserProvider';\n\nconst logger: ReturnType<typeof createPackageComponentLogger> = createPackageComponentLogger(\n  '@thunderid/react',\n  'ThunderIDProvider',\n);\n\n/**\n * Props interface of {@link ThunderIDProvider}\n */\nexport type ThunderIDProviderProps = ThunderIDReactConfig;\n\nconst ThunderIDProvider: FC<PropsWithChildren<ThunderIDProviderProps>> = ({\n  afterSignInUrl,\n  afterSignOutUrl,\n  baseUrl: initialBaseUrl,\n  clientId,\n  children,\n  extensions,\n  scopes,\n  preferences,\n  signInUrl,\n  signUpUrl,\n  organizationHandle,\n  applicationId,\n  signInOptions,\n  tokenRequest,\n  instanceId = 0,\n  organizationChain,\n  cspNonce,\n  vendor,\n  namespace,\n  http: httpOptions,\n  ...rest\n}: PropsWithChildren<ThunderIDProviderProps>): ReactElement => {\n  // Must run synchronously here, in the render body, before any descendant's css()/cx()/\n  // keyframes() calls execute during this same render pass - see the doc comment on\n  // `configureEmotionNonce` for why a `useEffect` would be too late.\n  configureEmotionNonce(cspNonce, vendor);\n\n  const reRenderCheckRef: RefObject<boolean> = useRef(false);\n  const client: ThunderIDReactClient = useMemo(() => new ThunderIDReactClient(instanceId), [instanceId]);\n  const invalidator: ResourceInvalidator = useMemo(() => createResourceInvalidator(), []);\n  const storageManagerRef: any = useRef<any>(null);\n  const {hasAuthParams, hasCalledForThisInstance} = useBrowserUrl();\n  const [user, setUser] = useState<User | null>(null);\n  const [isSignedInSync, setIsSignedInSync] = useState<boolean>(false);\n  const [isInitializedSync, setIsInitializedSync] = useState<boolean>(false);\n  const [isLoadingSync, setIsLoadingSync] = useState<boolean>(true);\n\n  const [userProfile, setUserProfile] = useState<UserProfile | null>(null);\n  const [userSchema, setUserSchema] = useState<Record<string, AttributeSchema> | null>(null);\n  const [baseUrl, setBaseUrl] = useState<string>(initialBaseUrl ?? '');\n  const [config, setConfig] = useState<ThunderIDReactConfig>({\n    afterSignInUrl: afterSignInUrl ?? window.location.origin,\n    afterSignOutUrl: afterSignOutUrl ?? window.location.origin,\n    applicationId,\n    baseUrl,\n    clientId,\n    organizationChain,\n    organizationHandle,\n    scopes,\n    signInOptions,\n    tokenRequest,\n    signInUrl,\n    signUpUrl,\n    vendor,\n    ...rest,\n  });\n\n  const [isUpdatingSession, setIsUpdatingSession] = useState<boolean>(false);\n  const [wellKnown, setWellKnown] = useState<OIDCDiscoveryApiResponse | null>(null);\n\n  // Holds the in-flight `updateSession()` promise so concurrent callers coalesce onto a single\n  // `/users/me` request instead of issuing one each.\n  const pendingSessionUpdateRef: RefObject<Promise<void> | null> = useRef<Promise<void> | null>(null);\n\n  useEffect(() => {\n    setBaseUrl(initialBaseUrl ?? '');\n  }, [initialBaseUrl]);\n\n  useEffect(() => {\n    (async (): Promise<void> => {\n      await client.initialize(config);\n      const initializedConfig: ThunderIDReactConfig = await client.getConfiguration();\n      setConfig(initializedConfig);\n      setWellKnown(await client.getDiscoveryResponse());\n    })();\n  }, []);\n\n  async function performSessionUpdate(): Promise<void> {\n    try {\n      // Set flag to prevent loading state tracking from interfering\n      setIsUpdatingSession(true);\n      setIsLoadingSync(true);\n      let resolvedBaseUrl: string = baseUrl;\n\n      const decodedToken: IdToken = await client.getDecodedIdToken();\n\n      // If there's a `user_org` claim in the ID token,\n      // Treat this login as a organization login.\n      if (decodedToken?.['user_org']) {\n        resolvedBaseUrl = `${(await client.getConfiguration()).baseUrl}/o`;\n        setBaseUrl(resolvedBaseUrl);\n      }\n\n      const shouldFetchProfile: boolean = preferences?.user?.fetchUserProfile !== false;\n      const claims: User = extractUserClaimsFromIdToken(decodedToken) as User;\n      let profileData = claims;\n      const currentSignInStatus: boolean = await client.isSignedIn();\n\n      if (currentSignInStatus && shouldFetchProfile) {\n        try {\n          const fetchedProfile = await getUsersMe({\n            baseUrl: resolvedBaseUrl,\n            url: resolveResourceEndpoint('usersMe', config),\n            instanceId,\n          });\n          profileData = {...claims, ...fetchedProfile};\n        } catch (err) {\n          logger.warn('Failed to fetch user profile from /users/me:', err);\n        }\n\n        try {\n          const metaRes = await getUsersMeMeta({\n            baseUrl: resolvedBaseUrl,\n            url: resolveResourceEndpoint('usersMeMeta', config),\n            instanceId,\n          });\n          if (metaRes?.schema) {\n            setUserSchema(metaRes.schema);\n          } else {\n            setUserSchema(null);\n          }\n        } catch (err) {\n          setUserSchema(null);\n          logger.warn('Failed to fetch user schema metadata from /users/me/meta:', err);\n        }\n      } else {\n        setUserSchema(null);\n      }\n\n      setUser(profileData);\n      setUserProfile({\n        flattenedProfile: generateFlattenedUserProfile(profileData, []),\n        profile: profileData,\n      });\n\n      // CRITICAL: Update sign-in status BEFORE setting loading to false\n      // This prevents the race condition where ProtectedRoute sees isLoading=false but isSignedIn=false\n      setIsSignedInSync(currentSignInStatus);\n    } catch (error) {\n      // TODO: Add an error log.\n    } finally {\n      // Clear the flag and set final loading state\n      setIsUpdatingSession(false);\n      setIsLoadingSync(client.isLoading());\n    }\n  }\n\n  /**\n   * Single-flight wrapper around {@link performSessionUpdate}.\n   *\n   * Concurrent callers share the in-flight request instead of each issuing their own `/users/me`.\n   * This is not a cache: once the request settles the ref is cleared, so a later caller (e.g.\n   * revalidation after a profile update) fetches again.\n   */\n  async function updateSession(): Promise<void> {\n    if (pendingSessionUpdateRef.current) {\n      return pendingSessionUpdateRef.current;\n    }\n\n    pendingSessionUpdateRef.current = performSessionUpdate().finally(() => {\n      pendingSessionUpdateRef.current = null;\n    });\n\n    return pendingSessionUpdateRef.current;\n  }\n\n  async function signIn(...args: any): Promise<User | EmbeddedSignInFlowResponse> {\n    // Check if this is a V2 embedded flow request BEFORE calling signIn\n    // This allows us to skip session checks entirely for V2 flows\n    const arg1: any = args[0];\n    const isV2FlowRequest: boolean =\n      typeof arg1 === 'object' && arg1 !== null && ('executionId' in arg1 || 'applicationId' in arg1);\n\n    try {\n      if (!isV2FlowRequest) {\n        setIsUpdatingSession(true);\n        setIsLoadingSync(true);\n      }\n\n      return await client.signIn(...args);\n    } catch (error) {\n      throw new ThunderIDRuntimeError(\n        `Sign in failed: ${error instanceof Error ? error.message : String(JSON.stringify(error))}`,\n        'thunderid-signIn-Error',\n        'react',\n        'An error occurred while trying to sign in.',\n      );\n    } finally {\n      if (!isV2FlowRequest) {\n        setIsUpdatingSession(false);\n        setIsLoadingSync(client.isLoading());\n      }\n    }\n  }\n\n  /**\n   * Try signing in when the component is mounted.\n   */\n  useEffect(() => {\n    // React 18.x Strict.Mode has a new check for `Ensuring reusable state` to facilitate an upcoming react feature.\n    // https://reactjs.org/docs/strict-mode.html#ensuring-reusable-state\n    // This will remount all the useEffects to ensure that there are no unexpected side effects.\n    // When react remounts the signIn hook of the AuthProvider, it will cause a race condition. Hence, we have to\n    // prevent the re-render of this hook as suggested in the following discussion.\n    // https://github.com/reactwg/react-18/discussions/18#discussioncomment-795623\n    if (reRenderCheckRef.current) {\n      return;\n    }\n\n    reRenderCheckRef.current = true;\n\n    (async (): Promise<void> => {\n      // Sync session state whenever sign-in completes (both redirect and embedded V2 flows).\n      // Pass the user returned by the SDK's sign-in flow so users/me result is not discarded.\n      await client.on('sign-in', async () => {\n        await updateSession();\n      });\n\n      // A session that ends elsewhere, such as a sign-out in another app, signs this app out too.\n      await client.on('sign-out', () => {\n        setUser(null);\n        setUserProfile(null);\n        setIsSignedInSync(false);\n      });\n\n      // Start auto-refresh with a soft failure. This also covers the case where the access token\n      // expired while the refresh token is still valid — startAutoRefreshToken() calls\n      // refreshAccessToken() immediately when timeUntilRefresh <= 0 — so the sign-in check below\n      // sees the refreshed state.\n      try {\n        await client.startAutoRefreshToken();\n      } catch (error) {\n        logger.warn('Failed to schedule automatic token refresh.', error);\n      }\n\n      // User is already authenticated. Restore the session and skip the sign-in path.\n      if (await client.isSignedIn()) {\n        await updateSession();\n\n        return;\n      }\n\n      const currentUrl: URL = new URL(window.location.href);\n      const hasAuthParamsResult: boolean =\n        hasAuthParams(currentUrl, config.afterSignInUrl!) && hasCalledForThisInstance(currentUrl, instanceId ?? 0);\n\n      if (hasAuthParamsResult) {\n        try {\n          const urlParams: URLSearchParams = currentUrl.searchParams;\n          const code: string | null = urlParams.get('code');\n          const executionIdFromUrl: string | null = urlParams.get('executionId');\n          const storedExecutionId: string | null = sessionStorage.getItem(\n            `${getVendorPrefix(config.vendor)}_execution_id`,\n          );\n\n          // A silent sign-in response is handled even without a code: an error such as\n          // login_required must still be relayed from the iframe to the waiting parent.\n          if ((code || SPAUtils.isSilentStatePresentInURL()) && !executionIdFromUrl && !storedExecutionId) {\n            await signIn();\n          }\n        } catch (error) {\n          throw new ThunderIDRuntimeError(\n            `Sign in failed: ${error instanceof Error ? error.message : String(JSON.stringify(error))}`,\n            'thunderid-signIn-Error',\n            'react',\n            'An error occurred while trying to sign in.',\n          );\n        }\n      }\n    })();\n  }, []);\n\n  /**\n   * Check if the user is signed in and update the state accordingly.\n   * This will also set an interval to check for the sign-in status every second\n   * until the user is signed in.\n   */\n  useEffect(() => {\n    let interval: NodeJS.Timeout;\n\n    (async (): Promise<void> => {\n      try {\n        const status: boolean = await client.isSignedIn();\n\n        setIsSignedInSync(status);\n\n        if (!status) {\n          interval = setInterval(async () => {\n            const newStatus: boolean = await client.isSignedIn();\n\n            if (newStatus) {\n              setIsSignedInSync(true);\n              clearInterval(interval);\n            }\n          }, 1000);\n        } else {\n          // TODO: Add a debug log to indicate that the user is already signed in.\n        }\n      } catch (error) {\n        setIsSignedInSync(false);\n      }\n    })();\n\n    return (): void => {\n      if (interval) {\n        clearInterval(interval);\n      }\n    };\n  }, [client]);\n\n  useEffect(() => {\n    (async (): Promise<void> => {\n      try {\n        const status: boolean = await client.isInitialized();\n\n        setIsInitializedSync(status);\n      } catch (error) {\n        setIsInitializedSync(false);\n      }\n    })();\n  }, [client]);\n\n  /**\n   * Track loading state changes from the ThunderID client\n   */\n  useEffect(() => {\n    const checkLoadingState = (): void => {\n      // Don't override loading state during critical session updates\n      if (isUpdatingSession) {\n        return;\n      }\n\n      // Don't set loading=false while auth params are in the URL and user isn't signed in yet.\n      // This prevents ProtectedRoute from redirecting before the sign-in effect processes the auth code.\n      const currentUrl: URL = new URL(window.location.href);\n      if (!isSignedInSync && hasAuthParams(currentUrl, config.afterSignInUrl!)) {\n        return;\n      }\n\n      setIsLoadingSync(client.isLoading());\n    };\n\n    // Initial check\n    checkLoadingState();\n\n    // Set up an interval to check for loading state changes\n    const interval: NodeJS.Timeout = setInterval(checkLoadingState, 100);\n\n    return (): void => {\n      clearInterval(interval);\n    };\n  }, [client, isLoadingSync, isSignedInSync, isUpdatingSession]);\n\n  const signInSilently = async (options?: SignInOptions): Promise<User | boolean> => {\n    try {\n      setIsUpdatingSession(true);\n      setIsLoadingSync(true);\n      return await client.signInSilently(options);\n    } catch (error) {\n      throw new ThunderIDRuntimeError(\n        `Error while signing in silently: ${error instanceof Error ? error.message : String(JSON.stringify(error))}`,\n        'thunderid-signInSilently-Error',\n        'react',\n        'An error occurred while trying to sign in silently.',\n      );\n    } finally {\n      setIsUpdatingSession(false);\n      setIsLoadingSync(client.isLoading());\n    }\n  };\n\n  const handleProfileUpdate = (payload: User): void => {\n    setUser(payload);\n    setUserProfile((prev: UserProfile | null) => ({\n      flattenedProfile: generateFlattenedUserProfile(payload),\n      profile: payload,\n    }));\n  };\n\n  const getDecodedIdToken: () => Promise<IdToken> = useCallback(\n    async (): Promise<IdToken> => client.getDecodedIdToken(),\n    [client],\n  );\n\n  const getIdToken: () => Promise<string> = useCallback(async (): Promise<string> => client.getIdToken(), [client]);\n\n  const getAccessToken: () => Promise<string> = useCallback(\n    async (): Promise<string> => client.getAccessToken(),\n    [client],\n  );\n\n  const getStorageManager: ThunderIDContextProps['getStorageManager'] = useCallback(async () => {\n    const storageManager: Awaited<ReturnType<ThunderIDContextProps['getStorageManager']>> =\n      storageManagerRef.current ?? (await client.getStorageManager());\n    if (storageManager) {\n      storageManagerRef.current = storageManager;\n    }\n    return storageManager;\n  }, [client]);\n\n  const request: (...args: any[]) => Promise<any> = useCallback(\n    async (...args: any[]): Promise<any> => client.request(...args),\n    [client],\n  );\n\n  const requestAll: (...args: any[]) => Promise<any> = useCallback(\n    async (...args: any[]): Promise<any> => client.requestAll(...args),\n    [client],\n  );\n\n  const exchangeToken: (exchangeConfig: any) => Promise<any> = useCallback(\n    async (exchangeConfig: any): Promise<any> => client.exchangeToken(exchangeConfig),\n    [client],\n  );\n\n  const signOut: (...args: any[]) => Promise<any> = useCallback(\n    async (...args: any[]): Promise<any> => client.signOut(...args),\n    [client],\n  );\n\n  const recover: ThunderIDContextProps['recover'] = useCallback(\n    async (payload?: EmbeddedRecoveryFlowRequest): Promise<EmbeddedRecoveryFlowResponse> =>\n      (await client.recover(payload)) as EmbeddedRecoveryFlowResponse,\n    [client],\n  );\n\n  const signUp: (...args: any[]) => Promise<any> = useCallback(\n    async (...args: any[]): Promise<any> => client.signUp(...args),\n    [client],\n  );\n\n  const clearSession: (...args: any[]) => Promise<any> = useCallback(\n    async (...args: any[]): Promise<any> => client.clearSession(...args),\n    [client],\n  );\n\n  const reInitialize: (reInitConfig: any) => Promise<any> = useCallback(\n    async (reInitConfig: any): Promise<any> => {\n      const result: any = await client.reInitialize(reInitConfig);\n\n      // Refresh React state from the reinitialized client so the context (config.endpoints,\n      // baseUrl, discovery) reflects the new configuration instead of the pre-reinitialization state.\n      const reinitializedConfig: ThunderIDReactConfig = await client.getConfiguration();\n      setConfig(reinitializedConfig);\n      setBaseUrl(reinitializedConfig.baseUrl ?? '');\n      setWellKnown(await client.getDiscoveryResponse());\n\n      return result;\n    },\n    [client],\n  );\n\n  const value: any = useMemo(\n    () => ({\n      afterSignInUrl: config.afterSignInUrl,\n      applicationId: config.applicationId,\n      baseUrl,\n      endpoints: config.endpoints,\n      scopes: config.scopes,\n      clearSession,\n      clientId,\n      discovery: {\n        wellKnown,\n      },\n      exchangeToken,\n      getAccessToken,\n      getDecodedIdToken,\n      getIdToken,\n      getStorageManager,\n      http: {\n        fetcher: httpOptions?.fetcher,\n        request,\n        requestAll,\n      },\n      instanceId,\n      invalidator,\n      isInitialized: isInitializedSync,\n      isLoading: isLoadingSync,\n      isSignedIn: isSignedInSync,\n      organizationChain,\n      organizationHandle: config?.organizationHandle,\n      preferences,\n      reInitialize,\n      recover,\n      signIn,\n      signInOptions,\n      tokenRequest,\n      signInSilently,\n      signInUrl,\n      signOut,\n      signUp,\n      signUpUrl,\n      user,\n      userSchema,\n      vendor: getVendorPrefix(config.vendor),\n    }),\n    [\n      applicationId,\n      config?.organizationHandle,\n      config.vendor,\n      config.afterSignInUrl,\n      config.endpoints,\n      config.scopes,\n      signInUrl,\n      signUpUrl,\n      baseUrl,\n      clientId,\n      wellKnown,\n      isInitializedSync,\n      isLoadingSync,\n      isSignedInSync,\n      signIn,\n      signInSilently,\n      user,\n      userSchema,\n      client,\n      signInOptions,\n      tokenRequest,\n      getDecodedIdToken,\n      clearSession,\n      exchangeToken,\n      httpOptions?.fetcher,\n      getAccessToken,\n      getStorageManager,\n      instanceId,\n      invalidator,\n      organizationChain,\n      preferences,\n      recover,\n      reInitialize,\n      request,\n      requestAll,\n      signOut,\n      signUp,\n    ],\n  );\n\n  return (\n    <ThunderIDContext.Provider value={value}>\n      <I18nProvider preferences={preferences?.i18n} vendor={getVendorPrefix(config.vendor)}>\n        <FlowMetaProvider enabled={preferences?.resolveFromMeta !== false} namespace={namespace}>\n          <ThemeProvider\n            theme={{\n              ...preferences?.theme?.overrides,\n              direction: preferences?.theme?.direction,\n            }}\n          >\n            <FlowProvider>\n              <UserProvider profile={userProfile!} userSchema={userSchema} onUpdateProfile={handleProfileUpdate}>\n                <ComponentRendererProvider renderers={(extensions?.components?.renderers ?? {}) as any}>\n                  {children}\n                </ComponentRendererProvider>\n              </UserProvider>\n            </FlowProvider>\n          </ThemeProvider>\n        </FlowMetaProvider>\n      </I18nProvider>\n    </ThunderIDContext.Provider>\n  );\n};\n\nexport default ThunderIDProvider;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;AAsCA,MAAMA,+DACJ,oBACA,oBACD;AAOD,MAAMC,qBAAoE,EACxE,gBACA,iBACA,SAAS,gBACT,UACA,UACA,YACA,QACA,aACA,WACA,WACA,oBACA,eACA,eACA,cACA,aAAa,GACb,mBACA,UACA,QACA,WACA,MAAM,YACN,GAAG,WAC0D;AAI7D,uCAAsB,UAAU,OAAO;CAEvC,MAAMC,qCAA8C,MAAM;CAC1D,MAAMC,kCAA6C,IAAIC,qCAAqB,WAAW,EAAE,CAAC,WAAW,CAAC;CACtG,MAAMC,2FAA4E,EAAE,EAAE,CAAC;CACvF,MAAMC,sCAAqC,KAAK;CAChD,MAAM,EAAC,eAAe,6BAA4BC,+BAAe;CACjE,MAAM,CAAC,MAAM,+BAAiC,KAAK;CACnD,MAAM,CAAC,gBAAgB,yCAAuC,MAAM;CACpE,MAAM,CAAC,mBAAmB,4CAA0C,MAAM;CAC1E,MAAM,CAAC,eAAe,wCAAsC,KAAK;CAEjE,MAAM,CAAC,aAAa,sCAA+C,KAAK;CACxE,MAAM,CAAC,YAAY,qCAAkE,KAAK;CAC1F,MAAM,CAAC,SAAS,kCAA+B,kBAAkB,GAAG;CACpE,MAAM,CAAC,QAAQ,iCAA4C;EACzD,gBAAgB,kBAAkB,OAAO,SAAS;EAClD,iBAAiB,mBAAmB,OAAO,SAAS;EACpD;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA,GAAG;EACJ,CAAC;CAEF,MAAM,CAAC,mBAAmB,4CAA0C,MAAM;CAC1E,MAAM,CAAC,WAAW,oCAA0D,KAAK;CAIjF,MAAMC,4CAAwF,KAAK;AAEnG,4BAAgB;AACd,aAAW,kBAAkB,GAAG;IAC/B,CAAC,eAAe,CAAC;AAEpB,4BAAgB;AACd,GAAC,YAA2B;AAC1B,SAAM,OAAO,WAAW,OAAO;AAE/B,aADgD,MAAM,OAAO,kBAAkB,CACnD;AAC5B,gBAAa,MAAM,OAAO,sBAAsB,CAAC;MAC/C;IACH,EAAE,CAAC;CAEN,eAAe,uBAAsC;AACnD,MAAI;AAEF,wBAAqB,KAAK;AAC1B,oBAAiB,KAAK;GACtB,IAAIC,kBAA0B;GAE9B,MAAMC,eAAwB,MAAM,OAAO,mBAAmB;AAI9D,OAAI,eAAe,aAAa;AAC9B,sBAAkB,IAAI,MAAM,OAAO,kBAAkB,EAAE,QAAQ;AAC/D,eAAW,gBAAgB;;GAG7B,MAAMC,qBAA8B,aAAa,MAAM,qBAAqB;GAC5E,MAAMC,+DAA4C,aAAa;GAC/D,IAAI,cAAc;GAClB,MAAMC,sBAA+B,MAAM,OAAO,YAAY;AAE9D,OAAI,uBAAuB,oBAAoB;AAC7C,QAAI;KACF,MAAM,iBAAiB,MAAMC,2BAAW;MACtC,SAAS;MACT,sDAA6B,WAAW,OAAO;MAC/C;MACD,CAAC;AACF,mBAAc;MAAC,GAAG;MAAQ,GAAG;MAAe;aACrC,KAAK;AACZ,YAAO,KAAK,gDAAgD,IAAI;;AAGlE,QAAI;KACF,MAAM,UAAU,MAAMC,+BAAe;MACnC,SAAS;MACT,sDAA6B,eAAe,OAAO;MACnD;MACD,CAAC;AACF,SAAI,SAAS,OACX,eAAc,QAAQ,OAAO;SAE7B,eAAc,KAAK;aAEd,KAAK;AACZ,mBAAc,KAAK;AACnB,YAAO,KAAK,6DAA6D,IAAI;;SAG/E,eAAc,KAAK;AAGrB,WAAQ,YAAY;AACpB,kBAAe;IACb,wEAA+C,aAAa,EAAE,CAAC;IAC/D,SAAS;IACV,CAAC;AAIF,qBAAkB,oBAAoB;WAC/B,OAAO,WAEN;AAER,wBAAqB,MAAM;AAC3B,oBAAiB,OAAO,WAAW,CAAC;;;;;;;;;;CAWxC,eAAe,gBAA+B;AAC5C,MAAI,wBAAwB,QAC1B,QAAO,wBAAwB;AAGjC,0BAAwB,UAAU,sBAAsB,CAAC,cAAc;AACrE,2BAAwB,UAAU;IAClC;AAEF,SAAO,wBAAwB;;CAGjC,eAAe,OAAO,GAAG,MAAuD;EAG9E,MAAMC,OAAY,KAAK;EACvB,MAAMC,kBACJ,OAAO,SAAS,YAAY,SAAS,SAAS,iBAAiB,QAAQ,mBAAmB;AAE5F,MAAI;AACF,OAAI,CAAC,iBAAiB;AACpB,yBAAqB,KAAK;AAC1B,qBAAiB,KAAK;;AAGxB,UAAO,MAAM,OAAO,OAAO,GAAG,KAAK;WAC5B,OAAO;AACd,SAAM,IAAIC,0CACR,mBAAmB,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,UAAU,MAAM,CAAC,IACzF,0BACA,SACA,6CACD;YACO;AACR,OAAI,CAAC,iBAAiB;AACpB,yBAAqB,MAAM;AAC3B,qBAAiB,OAAO,WAAW,CAAC;;;;;;;AAQ1C,4BAAgB;AAOd,MAAI,iBAAiB,QACnB;AAGF,mBAAiB,UAAU;AAE3B,GAAC,YAA2B;AAG1B,SAAM,OAAO,GAAG,WAAW,YAAY;AACrC,UAAM,eAAe;KACrB;AAGF,SAAM,OAAO,GAAG,kBAAkB;AAChC,YAAQ,KAAK;AACb,mBAAe,KAAK;AACpB,sBAAkB,MAAM;KACxB;AAMF,OAAI;AACF,UAAM,OAAO,uBAAuB;YAC7B,OAAO;AACd,WAAO,KAAK,+CAA+C,MAAM;;AAInE,OAAI,MAAM,OAAO,YAAY,EAAE;AAC7B,UAAM,eAAe;AAErB;;GAGF,MAAMC,aAAkB,IAAI,IAAI,OAAO,SAAS,KAAK;AAIrD,OAFE,cAAc,YAAY,OAAO,eAAgB,IAAI,yBAAyB,YAAY,cAAc,EAAE,CAG1G,KAAI;IACF,MAAMC,YAA6B,WAAW;IAC9C,MAAMC,OAAsB,UAAU,IAAI,OAAO;IACjD,MAAMC,qBAAoC,UAAU,IAAI,cAAc;IACtE,MAAMC,oBAAmC,eAAe,QACtD,4CAAmB,OAAO,OAAO,CAAC,eACnC;AAID,SAAK,QAAQC,6BAAS,2BAA2B,KAAK,CAAC,sBAAsB,CAAC,kBAC5E,OAAM,QAAQ;YAET,OAAO;AACd,UAAM,IAAIN,0CACR,mBAAmB,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,UAAU,MAAM,CAAC,IACzF,0BACA,SACA,6CACD;;MAGH;IACH,EAAE,CAAC;;;;;;AAON,4BAAgB;EACd,IAAIO;AAEJ,GAAC,YAA2B;AAC1B,OAAI;IACF,MAAMC,SAAkB,MAAM,OAAO,YAAY;AAEjD,sBAAkB,OAAO;AAEzB,QAAI,CAAC,OACH,YAAW,YAAY,YAAY;AAGjC,SAF2B,MAAM,OAAO,YAAY,EAErC;AACb,wBAAkB,KAAK;AACvB,oBAAc,SAAS;;OAExB,IAAK;YAIH,OAAO;AACd,sBAAkB,MAAM;;MAExB;AAEJ,eAAmB;AACjB,OAAI,SACF,eAAc,SAAS;;IAG1B,CAAC,OAAO,CAAC;AAEZ,4BAAgB;AACd,GAAC,YAA2B;AAC1B,OAAI;AAGF,yBAFwB,MAAM,OAAO,eAAe,CAExB;YACrB,OAAO;AACd,yBAAqB,MAAM;;MAE3B;IACH,CAAC,OAAO,CAAC;;;;AAKZ,4BAAgB;EACd,MAAM,0BAAgC;AAEpC,OAAI,kBACF;GAKF,MAAMP,aAAkB,IAAI,IAAI,OAAO,SAAS,KAAK;AACrD,OAAI,CAAC,kBAAkB,cAAc,YAAY,OAAO,eAAgB,CACtE;AAGF,oBAAiB,OAAO,WAAW,CAAC;;AAItC,qBAAmB;EAGnB,MAAMM,WAA2B,YAAY,mBAAmB,IAAI;AAEpE,eAAmB;AACjB,iBAAc,SAAS;;IAExB;EAAC;EAAQ;EAAe;EAAgB;EAAkB,CAAC;CAE9D,MAAM,iBAAiB,OAAO,YAAqD;AACjF,MAAI;AACF,wBAAqB,KAAK;AAC1B,oBAAiB,KAAK;AACtB,UAAO,MAAM,OAAO,eAAe,QAAQ;WACpC,OAAO;AACd,SAAM,IAAIP,0CACR,oCAAoC,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,UAAU,MAAM,CAAC,IAC1G,kCACA,SACA,sDACD;YACO;AACR,wBAAqB,MAAM;AAC3B,oBAAiB,OAAO,WAAW,CAAC;;;CAIxC,MAAM,uBAAuB,YAAwB;AACnD,UAAQ,QAAQ;AAChB,kBAAgB,UAA8B;GAC5C,wEAA+C,QAAQ;GACvD,SAAS;GACV,EAAE;;CAGL,MAAMS,2CACJ,YAA8B,OAAO,mBAAmB,EACxD,CAAC,OAAO,CACT;CAED,MAAMC,oCAAgD,YAA6B,OAAO,YAAY,EAAE,CAAC,OAAO,CAAC;CAEjH,MAAMC,wCACJ,YAA6B,OAAO,gBAAgB,EACpD,CAAC,OAAO,CACT;CAED,MAAMC,2CAA4E,YAAY;EAC5F,MAAMC,iBACJ,kBAAkB,WAAY,MAAM,OAAO,mBAAmB;AAChE,MAAI,eACF,mBAAkB,UAAU;AAE9B,SAAO;IACN,CAAC,OAAO,CAAC;CAEZ,MAAMC,iCACJ,OAAO,GAAG,SAA8B,OAAO,QAAQ,GAAG,KAAK,EAC/D,CAAC,OAAO,CACT;CAED,MAAMC,oCACJ,OAAO,GAAG,SAA8B,OAAO,WAAW,GAAG,KAAK,EAClE,CAAC,OAAO,CACT;CAED,MAAMC,uCACJ,OAAO,mBAAsC,OAAO,cAAc,eAAe,EACjF,CAAC,OAAO,CACT;CAED,MAAMC,iCACJ,OAAO,GAAG,SAA8B,OAAO,QAAQ,GAAG,KAAK,EAC/D,CAAC,OAAO,CACT;CAED,MAAMC,iCACJ,OAAO,YACJ,MAAM,OAAO,QAAQ,QAAQ,EAChC,CAAC,OAAO,CACT;CAED,MAAMC,gCACJ,OAAO,GAAG,SAA8B,OAAO,OAAO,GAAG,KAAK,EAC9D,CAAC,OAAO,CACT;CAED,MAAMC,sCACJ,OAAO,GAAG,SAA8B,OAAO,aAAa,GAAG,KAAK,EACpE,CAAC,OAAO,CACT;CAED,MAAMC,sCACJ,OAAO,iBAAoC;EACzC,MAAMC,SAAc,MAAM,OAAO,aAAa,aAAa;EAI3D,MAAMC,sBAA4C,MAAM,OAAO,kBAAkB;AACjF,YAAU,oBAAoB;AAC9B,aAAW,oBAAoB,WAAW,GAAG;AAC7C,eAAa,MAAM,OAAO,sBAAsB,CAAC;AAEjD,SAAO;IAET,CAAC,OAAO,CACT;CAED,MAAMC,kCACG;EACL,gBAAgB,OAAO;EACvB,eAAe,OAAO;EACtB;EACA,WAAW,OAAO;EAClB,QAAQ,OAAO;EACf;EACA;EACA,WAAW,EACT,WACD;EACD;EACA;EACA;EACA;EACA;EACA,MAAM;GACJ,SAAS,aAAa;GACtB;GACA;GACD;EACD;EACA;EACA,eAAe;EACf,WAAW;EACX,YAAY;EACZ;EACA,oBAAoB,QAAQ;EAC5B;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA,iDAAwB,OAAO,OAAO;EACvC,GACD;EACE;EACA,QAAQ;EACR,OAAO;EACP,OAAO;EACP,OAAO;EACP,OAAO;EACP;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA,aAAa;EACb;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACD,CACF;AAED,QACE,2CAACC,iCAAiB;EAAgB;YAChC,2CAACC;GAAa,aAAa,aAAa;GAAM,iDAAwB,OAAO,OAAO;aAClF,2CAACC;IAAiB,SAAS,aAAa,oBAAoB;IAAkB;cAC5E,2CAACC;KACC,OAAO;MACL,GAAG,aAAa,OAAO;MACvB,WAAW,aAAa,OAAO;MAChC;eAED,2CAACC,0CACC,2CAACC;MAAa,SAAS;MAA0B;MAAY,iBAAiB;gBAC5E,2CAACC;OAA0B,WAAY,YAAY,YAAY,aAAa,EAAE;OAC3E;QACyB;OACf,GACF;MACD;KACC;IACN;GACW;;AAIhC,gCAAe"}
+{"version":3,"file":"ThunderIDProvider.cjs","names":["logger: ReturnType<typeof createPackageComponentLogger>","ThunderIDProvider: FC<PropsWithChildren<ThunderIDProviderProps>>","reRenderCheckRef: RefObject<boolean>","client: ThunderIDReactClient","ThunderIDReactClient","invalidator: ResourceInvalidator","storageManagerRef: any","useBrowserUrl","pendingSessionUpdateRef: RefObject<Promise<void> | null>","resolvedBaseUrl: string","decodedToken: IdToken","shouldFetchProfile: boolean","claims: User","currentSignInStatus: boolean","getUsersMe","getUsersMeMeta","arg1: any","isV2FlowRequest: boolean","ThunderIDRuntimeError","currentUrl: URL","urlParams: URLSearchParams","code: string | null","executionIdFromUrl: string | null","storedExecutionId: string | null","SPAUtils","interval: NodeJS.Timeout","status: boolean","getDecodedIdToken: () => Promise<IdToken>","getIdToken: () => Promise<string>","getAccessToken: () => Promise<string>","getGrantedPermissions: () => Promise<string[]>","getStorageManager: ThunderIDContextProps['getStorageManager']","storageManager: Awaited<ReturnType<ThunderIDContextProps['getStorageManager']>>","request: (...args: any[]) => Promise<any>","requestAll: (...args: any[]) => Promise<any>","exchangeToken: (exchangeConfig: any) => Promise<any>","signOut: (...args: any[]) => Promise<any>","recover: ThunderIDContextProps['recover']","signUp: (...args: any[]) => Promise<any>","clearSession: (...args: any[]) => Promise<any>","reInitialize: (reInitConfig: any) => Promise<any>","result: any","reinitializedConfig: ThunderIDReactConfig","value: any","ThunderIDContext","I18nProvider","FlowMetaProvider","ThemeProvider","FlowProvider","UserProvider","ComponentRendererProvider"],"sources":["../../../../src/contexts/ThunderID/ThunderIDProvider.tsx"],"sourcesContent":["// Copyright 2025-2026 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\nimport {\n  ResourceInvalidator,\n  createResourceInvalidator,\n  ThunderIDRuntimeError,\n  generateFlattenedUserProfile,\n  OIDCDiscoveryApiResponse,\n  SignInOptions,\n  User,\n  UserProfile,\n  IdToken,\n  extractUserClaimsFromIdToken,\n  EmbeddedSignInFlowResponse,\n  EmbeddedRecoveryFlowRequest,\n  EmbeddedRecoveryFlowResponse,\n  createPackageComponentLogger,\n  getVendorPrefix,\n  resolveResourceEndpoint,\n  AttributeSchema,\n  SPAUtils,\n} from '@thunderid/browser';\nimport {FC, RefObject, PropsWithChildren, ReactElement, useEffect, useMemo, useRef, useState, useCallback} from 'react';\nimport ThunderIDContext, {ThunderIDContextProps} from './ThunderIDContext';\nimport getUsersMe from '../../api/account/getUsersMe';\nimport getUsersMeMeta from '../../api/account/getUsersMeMeta';\nimport useBrowserUrl from '../../hooks/useBrowserUrl';\nimport {ThunderIDReactConfig} from '../../models/config';\nimport {configureEmotionNonce} from '../../styles/emotion';\nimport ThunderIDReactClient from '../../ThunderIDReactClient';\nimport ComponentRendererProvider from '../ComponentRenderer/ComponentRendererProvider';\nimport FlowProvider from '../Flow/FlowProvider';\nimport FlowMetaProvider from '../FlowMeta/FlowMetaProvider';\nimport I18nProvider from '../I18n/I18nProvider';\nimport ThemeProvider from '../Theme/ThemeProvider';\nimport UserProvider from '../User/UserProvider';\n\nconst logger: ReturnType<typeof createPackageComponentLogger> = createPackageComponentLogger(\n  '@thunderid/react',\n  'ThunderIDProvider',\n);\n\n/**\n * Props interface of {@link ThunderIDProvider}\n */\nexport type ThunderIDProviderProps = ThunderIDReactConfig;\n\nconst ThunderIDProvider: FC<PropsWithChildren<ThunderIDProviderProps>> = ({\n  afterSignInUrl,\n  afterSignOutUrl,\n  baseUrl: initialBaseUrl,\n  clientId,\n  children,\n  extensions,\n  scopes,\n  preferences,\n  signInUrl,\n  signUpUrl,\n  organizationHandle,\n  applicationId,\n  signInOptions,\n  tokenRequest,\n  instanceId = 0,\n  organizationChain,\n  cspNonce,\n  vendor,\n  namespace,\n  http: httpOptions,\n  ...rest\n}: PropsWithChildren<ThunderIDProviderProps>): ReactElement => {\n  // Must run synchronously here, in the render body, before any descendant's css()/cx()/\n  // keyframes() calls execute during this same render pass - see the doc comment on\n  // `configureEmotionNonce` for why a `useEffect` would be too late.\n  configureEmotionNonce(cspNonce, vendor);\n\n  const reRenderCheckRef: RefObject<boolean> = useRef(false);\n  const client: ThunderIDReactClient = useMemo(() => new ThunderIDReactClient(instanceId), [instanceId]);\n  const invalidator: ResourceInvalidator = useMemo(() => createResourceInvalidator(), []);\n  const storageManagerRef: any = useRef<any>(null);\n  const {hasAuthParams, hasCalledForThisInstance} = useBrowserUrl();\n  const [user, setUser] = useState<User | null>(null);\n  const [isSignedInSync, setIsSignedInSync] = useState<boolean>(false);\n  const [isInitializedSync, setIsInitializedSync] = useState<boolean>(false);\n  const [isLoadingSync, setIsLoadingSync] = useState<boolean>(true);\n\n  const [userProfile, setUserProfile] = useState<UserProfile | null>(null);\n  const [userSchema, setUserSchema] = useState<Record<string, AttributeSchema> | null>(null);\n  const [baseUrl, setBaseUrl] = useState<string>(initialBaseUrl ?? '');\n  const [config, setConfig] = useState<ThunderIDReactConfig>({\n    afterSignInUrl: afterSignInUrl ?? window.location.origin,\n    afterSignOutUrl: afterSignOutUrl ?? window.location.origin,\n    applicationId,\n    baseUrl,\n    clientId,\n    organizationChain,\n    organizationHandle,\n    scopes,\n    signInOptions,\n    tokenRequest,\n    signInUrl,\n    signUpUrl,\n    vendor,\n    ...rest,\n  });\n\n  const [isUpdatingSession, setIsUpdatingSession] = useState<boolean>(false);\n  const [wellKnown, setWellKnown] = useState<OIDCDiscoveryApiResponse | null>(null);\n\n  // Holds the in-flight `updateSession()` promise so concurrent callers coalesce onto a single\n  // `/users/me` request instead of issuing one each.\n  const pendingSessionUpdateRef: RefObject<Promise<void> | null> = useRef<Promise<void> | null>(null);\n\n  useEffect(() => {\n    setBaseUrl(initialBaseUrl ?? '');\n  }, [initialBaseUrl]);\n\n  useEffect(() => {\n    (async (): Promise<void> => {\n      await client.initialize(config);\n      const initializedConfig: ThunderIDReactConfig = await client.getConfiguration();\n      setConfig(initializedConfig);\n      setWellKnown(await client.getDiscoveryResponse());\n    })();\n  }, []);\n\n  async function performSessionUpdate(): Promise<void> {\n    try {\n      // Set flag to prevent loading state tracking from interfering\n      setIsUpdatingSession(true);\n      setIsLoadingSync(true);\n      let resolvedBaseUrl: string = baseUrl;\n\n      const decodedToken: IdToken = await client.getDecodedIdToken();\n\n      // If there's a `user_org` claim in the ID token,\n      // Treat this login as a organization login.\n      if (decodedToken?.['user_org']) {\n        resolvedBaseUrl = `${(await client.getConfiguration()).baseUrl}/o`;\n        setBaseUrl(resolvedBaseUrl);\n      }\n\n      const shouldFetchProfile: boolean = preferences?.user?.fetchUserProfile !== false;\n      const claims: User = extractUserClaimsFromIdToken(decodedToken) as User;\n      let profileData = claims;\n      const currentSignInStatus: boolean = await client.isSignedIn();\n\n      if (currentSignInStatus && shouldFetchProfile) {\n        try {\n          const fetchedProfile = await getUsersMe({\n            baseUrl: resolvedBaseUrl,\n            url: resolveResourceEndpoint('usersMe', config),\n            instanceId,\n          });\n          profileData = {...claims, ...fetchedProfile};\n        } catch (err) {\n          logger.warn('Failed to fetch user profile from /users/me:', err);\n        }\n\n        try {\n          const metaRes = await getUsersMeMeta({\n            baseUrl: resolvedBaseUrl,\n            url: resolveResourceEndpoint('usersMeMeta', config),\n            instanceId,\n          });\n          if (metaRes?.schema) {\n            setUserSchema(metaRes.schema);\n          } else {\n            setUserSchema(null);\n          }\n        } catch (err) {\n          setUserSchema(null);\n          logger.warn('Failed to fetch user schema metadata from /users/me/meta:', err);\n        }\n      } else {\n        setUserSchema(null);\n      }\n\n      setUser(profileData);\n      setUserProfile({\n        flattenedProfile: generateFlattenedUserProfile(profileData, []),\n        profile: profileData,\n      });\n\n      // CRITICAL: Update sign-in status BEFORE setting loading to false\n      // This prevents the race condition where ProtectedRoute sees isLoading=false but isSignedIn=false\n      setIsSignedInSync(currentSignInStatus);\n    } catch (error) {\n      // TODO: Add an error log.\n    } finally {\n      // Clear the flag and set final loading state\n      setIsUpdatingSession(false);\n      setIsLoadingSync(client.isLoading());\n    }\n  }\n\n  /**\n   * Single-flight wrapper around {@link performSessionUpdate}.\n   *\n   * Concurrent callers share the in-flight request instead of each issuing their own `/users/me`.\n   * This is not a cache: once the request settles the ref is cleared, so a later caller (e.g.\n   * revalidation after a profile update) fetches again.\n   */\n  async function updateSession(): Promise<void> {\n    if (pendingSessionUpdateRef.current) {\n      return pendingSessionUpdateRef.current;\n    }\n\n    pendingSessionUpdateRef.current = performSessionUpdate().finally(() => {\n      pendingSessionUpdateRef.current = null;\n    });\n\n    return pendingSessionUpdateRef.current;\n  }\n\n  async function signIn(...args: any): Promise<User | EmbeddedSignInFlowResponse> {\n    // Check if this is a V2 embedded flow request BEFORE calling signIn\n    // This allows us to skip session checks entirely for V2 flows\n    const arg1: any = args[0];\n    const isV2FlowRequest: boolean =\n      typeof arg1 === 'object' && arg1 !== null && ('executionId' in arg1 || 'applicationId' in arg1);\n\n    try {\n      if (!isV2FlowRequest) {\n        setIsUpdatingSession(true);\n        setIsLoadingSync(true);\n      }\n\n      return await client.signIn(...args);\n    } catch (error) {\n      throw new ThunderIDRuntimeError(\n        `Sign in failed: ${error instanceof Error ? error.message : String(JSON.stringify(error))}`,\n        'thunderid-signIn-Error',\n        'react',\n        'An error occurred while trying to sign in.',\n      );\n    } finally {\n      if (!isV2FlowRequest) {\n        setIsUpdatingSession(false);\n        setIsLoadingSync(client.isLoading());\n      }\n    }\n  }\n\n  /**\n   * Try signing in when the component is mounted.\n   */\n  useEffect(() => {\n    // React 18.x Strict.Mode has a new check for `Ensuring reusable state` to facilitate an upcoming react feature.\n    // https://reactjs.org/docs/strict-mode.html#ensuring-reusable-state\n    // This will remount all the useEffects to ensure that there are no unexpected side effects.\n    // When react remounts the signIn hook of the AuthProvider, it will cause a race condition. Hence, we have to\n    // prevent the re-render of this hook as suggested in the following discussion.\n    // https://github.com/reactwg/react-18/discussions/18#discussioncomment-795623\n    if (reRenderCheckRef.current) {\n      return;\n    }\n\n    reRenderCheckRef.current = true;\n\n    (async (): Promise<void> => {\n      // Sync session state whenever sign-in completes (both redirect and embedded V2 flows).\n      // Pass the user returned by the SDK's sign-in flow so users/me result is not discarded.\n      await client.on('sign-in', async () => {\n        await updateSession();\n      });\n\n      // A session that ends elsewhere, such as a sign-out in another app, signs this app out too.\n      await client.on('sign-out', () => {\n        setUser(null);\n        setUserProfile(null);\n        setIsSignedInSync(false);\n      });\n\n      // Start auto-refresh with a soft failure. This also covers the case where the access token\n      // expired while the refresh token is still valid — startAutoRefreshToken() calls\n      // refreshAccessToken() immediately when timeUntilRefresh <= 0 — so the sign-in check below\n      // sees the refreshed state.\n      try {\n        await client.startAutoRefreshToken();\n      } catch (error) {\n        logger.warn('Failed to schedule automatic token refresh.', error);\n      }\n\n      // User is already authenticated. Restore the session and skip the sign-in path.\n      if (await client.isSignedIn()) {\n        await updateSession();\n\n        return;\n      }\n\n      const currentUrl: URL = new URL(window.location.href);\n      const hasAuthParamsResult: boolean =\n        hasAuthParams(currentUrl, config.afterSignInUrl!) && hasCalledForThisInstance(currentUrl, instanceId ?? 0);\n\n      if (hasAuthParamsResult) {\n        try {\n          const urlParams: URLSearchParams = currentUrl.searchParams;\n          const code: string | null = urlParams.get('code');\n          const executionIdFromUrl: string | null = urlParams.get('executionId');\n          const storedExecutionId: string | null = sessionStorage.getItem(\n            `${getVendorPrefix(config.vendor)}_execution_id`,\n          );\n\n          // A silent sign-in response is handled even without a code: an error such as\n          // login_required must still be relayed from the iframe to the waiting parent.\n          if ((code || SPAUtils.isSilentStatePresentInURL()) && !executionIdFromUrl && !storedExecutionId) {\n            await signIn();\n          }\n        } catch (error) {\n          throw new ThunderIDRuntimeError(\n            `Sign in failed: ${error instanceof Error ? error.message : String(JSON.stringify(error))}`,\n            'thunderid-signIn-Error',\n            'react',\n            'An error occurred while trying to sign in.',\n          );\n        }\n      }\n    })();\n  }, []);\n\n  /**\n   * Check if the user is signed in and update the state accordingly.\n   * This will also set an interval to check for the sign-in status every second\n   * until the user is signed in.\n   */\n  useEffect(() => {\n    let interval: NodeJS.Timeout;\n\n    (async (): Promise<void> => {\n      try {\n        const status: boolean = await client.isSignedIn();\n\n        setIsSignedInSync(status);\n\n        if (!status) {\n          interval = setInterval(async () => {\n            const newStatus: boolean = await client.isSignedIn();\n\n            if (newStatus) {\n              setIsSignedInSync(true);\n              clearInterval(interval);\n            }\n          }, 1000);\n        } else {\n          // TODO: Add a debug log to indicate that the user is already signed in.\n        }\n      } catch (error) {\n        setIsSignedInSync(false);\n      }\n    })();\n\n    return (): void => {\n      if (interval) {\n        clearInterval(interval);\n      }\n    };\n  }, [client]);\n\n  useEffect(() => {\n    (async (): Promise<void> => {\n      try {\n        const status: boolean = await client.isInitialized();\n\n        setIsInitializedSync(status);\n      } catch (error) {\n        setIsInitializedSync(false);\n      }\n    })();\n  }, [client]);\n\n  /**\n   * Track loading state changes from the ThunderID client\n   */\n  useEffect(() => {\n    const checkLoadingState = (): void => {\n      // Don't override loading state during critical session updates\n      if (isUpdatingSession) {\n        return;\n      }\n\n      // Don't set loading=false while auth params are in the URL and user isn't signed in yet.\n      // This prevents ProtectedRoute from redirecting before the sign-in effect processes the auth code.\n      const currentUrl: URL = new URL(window.location.href);\n      if (!isSignedInSync && hasAuthParams(currentUrl, config.afterSignInUrl!)) {\n        return;\n      }\n\n      setIsLoadingSync(client.isLoading());\n    };\n\n    // Initial check\n    checkLoadingState();\n\n    // Set up an interval to check for loading state changes\n    const interval: NodeJS.Timeout = setInterval(checkLoadingState, 100);\n\n    return (): void => {\n      clearInterval(interval);\n    };\n  }, [client, isLoadingSync, isSignedInSync, isUpdatingSession]);\n\n  const signInSilently = async (options?: SignInOptions): Promise<User | boolean> => {\n    try {\n      setIsUpdatingSession(true);\n      setIsLoadingSync(true);\n      return await client.signInSilently(options);\n    } catch (error) {\n      throw new ThunderIDRuntimeError(\n        `Error while signing in silently: ${error instanceof Error ? error.message : String(JSON.stringify(error))}`,\n        'thunderid-signInSilently-Error',\n        'react',\n        'An error occurred while trying to sign in silently.',\n      );\n    } finally {\n      setIsUpdatingSession(false);\n      setIsLoadingSync(client.isLoading());\n    }\n  };\n\n  const handleProfileUpdate = (payload: User): void => {\n    setUser(payload);\n    setUserProfile((prev: UserProfile | null) => ({\n      flattenedProfile: generateFlattenedUserProfile(payload),\n      profile: payload,\n    }));\n  };\n\n  const getDecodedIdToken: () => Promise<IdToken> = useCallback(\n    async (): Promise<IdToken> => client.getDecodedIdToken(),\n    [client],\n  );\n\n  const getIdToken: () => Promise<string> = useCallback(async (): Promise<string> => client.getIdToken(), [client]);\n\n  const getAccessToken: () => Promise<string> = useCallback(\n    async (): Promise<string> => client.getAccessToken(),\n    [client],\n  );\n\n  const getGrantedPermissions: () => Promise<string[]> = useCallback(\n    async (): Promise<string[]> => client.getGrantedPermissions(),\n    [client],\n  );\n\n  const getStorageManager: ThunderIDContextProps['getStorageManager'] = useCallback(async () => {\n    const storageManager: Awaited<ReturnType<ThunderIDContextProps['getStorageManager']>> =\n      storageManagerRef.current ?? (await client.getStorageManager());\n    if (storageManager) {\n      storageManagerRef.current = storageManager;\n    }\n    return storageManager;\n  }, [client]);\n\n  const request: (...args: any[]) => Promise<any> = useCallback(\n    async (...args: any[]): Promise<any> => client.request(...args),\n    [client],\n  );\n\n  const requestAll: (...args: any[]) => Promise<any> = useCallback(\n    async (...args: any[]): Promise<any> => client.requestAll(...args),\n    [client],\n  );\n\n  const exchangeToken: (exchangeConfig: any) => Promise<any> = useCallback(\n    async (exchangeConfig: any): Promise<any> => client.exchangeToken(exchangeConfig),\n    [client],\n  );\n\n  const signOut: (...args: any[]) => Promise<any> = useCallback(\n    async (...args: any[]): Promise<any> => client.signOut(...args),\n    [client],\n  );\n\n  const recover: ThunderIDContextProps['recover'] = useCallback(\n    async (payload?: EmbeddedRecoveryFlowRequest): Promise<EmbeddedRecoveryFlowResponse> =>\n      (await client.recover(payload)) as EmbeddedRecoveryFlowResponse,\n    [client],\n  );\n\n  const signUp: (...args: any[]) => Promise<any> = useCallback(\n    async (...args: any[]): Promise<any> => client.signUp(...args),\n    [client],\n  );\n\n  const clearSession: (...args: any[]) => Promise<any> = useCallback(\n    async (...args: any[]): Promise<any> => client.clearSession(...args),\n    [client],\n  );\n\n  const reInitialize: (reInitConfig: any) => Promise<any> = useCallback(\n    async (reInitConfig: any): Promise<any> => {\n      const result: any = await client.reInitialize(reInitConfig);\n\n      // Refresh React state from the reinitialized client so the context (config.endpoints,\n      // baseUrl, discovery) reflects the new configuration instead of the pre-reinitialization state.\n      const reinitializedConfig: ThunderIDReactConfig = await client.getConfiguration();\n      setConfig(reinitializedConfig);\n      setBaseUrl(reinitializedConfig.baseUrl ?? '');\n      setWellKnown(await client.getDiscoveryResponse());\n\n      return result;\n    },\n    [client],\n  );\n\n  const value: any = useMemo(\n    () => ({\n      afterSignInUrl: config.afterSignInUrl,\n      applicationId: config.applicationId,\n      baseUrl,\n      endpoints: config.endpoints,\n      scopes: config.scopes,\n      clearSession,\n      clientId,\n      discovery: {\n        wellKnown,\n      },\n      exchangeToken,\n      getAccessToken,\n      getDecodedIdToken,\n      getGrantedPermissions,\n      getIdToken,\n      getStorageManager,\n      http: {\n        fetcher: httpOptions?.fetcher,\n        request,\n        requestAll,\n      },\n      instanceId,\n      invalidator,\n      isInitialized: isInitializedSync,\n      isLoading: isLoadingSync,\n      isSignedIn: isSignedInSync,\n      organizationChain,\n      organizationHandle: config?.organizationHandle,\n      preferences,\n      reInitialize,\n      recover,\n      signIn,\n      signInOptions,\n      tokenRequest,\n      signInSilently,\n      signInUrl,\n      signOut,\n      signUp,\n      signUpUrl,\n      user,\n      userSchema,\n      vendor: getVendorPrefix(config.vendor),\n    }),\n    [\n      applicationId,\n      config?.organizationHandle,\n      config.vendor,\n      config.afterSignInUrl,\n      config.endpoints,\n      config.scopes,\n      signInUrl,\n      signUpUrl,\n      baseUrl,\n      clientId,\n      wellKnown,\n      isInitializedSync,\n      isLoadingSync,\n      isSignedInSync,\n      signIn,\n      signInSilently,\n      user,\n      userSchema,\n      client,\n      signInOptions,\n      tokenRequest,\n      getDecodedIdToken,\n      clearSession,\n      exchangeToken,\n      httpOptions?.fetcher,\n      getAccessToken,\n      getGrantedPermissions,\n      getStorageManager,\n      instanceId,\n      invalidator,\n      organizationChain,\n      preferences,\n      recover,\n      reInitialize,\n      request,\n      requestAll,\n      signOut,\n      signUp,\n    ],\n  );\n\n  return (\n    <ThunderIDContext.Provider value={value}>\n      <I18nProvider preferences={preferences?.i18n} vendor={getVendorPrefix(config.vendor)}>\n        <FlowMetaProvider enabled={preferences?.resolveFromMeta !== false} namespace={namespace}>\n          <ThemeProvider\n            theme={{\n              ...preferences?.theme?.overrides,\n              direction: preferences?.theme?.direction,\n            }}\n          >\n            <FlowProvider>\n              <UserProvider profile={userProfile!} userSchema={userSchema} onUpdateProfile={handleProfileUpdate}>\n                <ComponentRendererProvider renderers={(extensions?.components?.renderers ?? {}) as any}>\n                  {children}\n                </ComponentRendererProvider>\n              </UserProvider>\n            </FlowProvider>\n          </ThemeProvider>\n        </FlowMetaProvider>\n      </I18nProvider>\n    </ThunderIDContext.Provider>\n  );\n};\n\nexport default ThunderIDProvider;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;AAsCA,MAAMA,+DACJ,oBACA,oBACD;AAOD,MAAMC,qBAAoE,EACxE,gBACA,iBACA,SAAS,gBACT,UACA,UACA,YACA,QACA,aACA,WACA,WACA,oBACA,eACA,eACA,cACA,aAAa,GACb,mBACA,UACA,QACA,WACA,MAAM,YACN,GAAG,WAC0D;AAI7D,uCAAsB,UAAU,OAAO;CAEvC,MAAMC,qCAA8C,MAAM;CAC1D,MAAMC,kCAA6C,IAAIC,qCAAqB,WAAW,EAAE,CAAC,WAAW,CAAC;CACtG,MAAMC,2FAA4E,EAAE,EAAE,CAAC;CACvF,MAAMC,sCAAqC,KAAK;CAChD,MAAM,EAAC,eAAe,6BAA4BC,+BAAe;CACjE,MAAM,CAAC,MAAM,+BAAiC,KAAK;CACnD,MAAM,CAAC,gBAAgB,yCAAuC,MAAM;CACpE,MAAM,CAAC,mBAAmB,4CAA0C,MAAM;CAC1E,MAAM,CAAC,eAAe,wCAAsC,KAAK;CAEjE,MAAM,CAAC,aAAa,sCAA+C,KAAK;CACxE,MAAM,CAAC,YAAY,qCAAkE,KAAK;CAC1F,MAAM,CAAC,SAAS,kCAA+B,kBAAkB,GAAG;CACpE,MAAM,CAAC,QAAQ,iCAA4C;EACzD,gBAAgB,kBAAkB,OAAO,SAAS;EAClD,iBAAiB,mBAAmB,OAAO,SAAS;EACpD;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA,GAAG;EACJ,CAAC;CAEF,MAAM,CAAC,mBAAmB,4CAA0C,MAAM;CAC1E,MAAM,CAAC,WAAW,oCAA0D,KAAK;CAIjF,MAAMC,4CAAwF,KAAK;AAEnG,4BAAgB;AACd,aAAW,kBAAkB,GAAG;IAC/B,CAAC,eAAe,CAAC;AAEpB,4BAAgB;AACd,GAAC,YAA2B;AAC1B,SAAM,OAAO,WAAW,OAAO;AAE/B,aADgD,MAAM,OAAO,kBAAkB,CACnD;AAC5B,gBAAa,MAAM,OAAO,sBAAsB,CAAC;MAC/C;IACH,EAAE,CAAC;CAEN,eAAe,uBAAsC;AACnD,MAAI;AAEF,wBAAqB,KAAK;AAC1B,oBAAiB,KAAK;GACtB,IAAIC,kBAA0B;GAE9B,MAAMC,eAAwB,MAAM,OAAO,mBAAmB;AAI9D,OAAI,eAAe,aAAa;AAC9B,sBAAkB,IAAI,MAAM,OAAO,kBAAkB,EAAE,QAAQ;AAC/D,eAAW,gBAAgB;;GAG7B,MAAMC,qBAA8B,aAAa,MAAM,qBAAqB;GAC5E,MAAMC,+DAA4C,aAAa;GAC/D,IAAI,cAAc;GAClB,MAAMC,sBAA+B,MAAM,OAAO,YAAY;AAE9D,OAAI,uBAAuB,oBAAoB;AAC7C,QAAI;KACF,MAAM,iBAAiB,MAAMC,2BAAW;MACtC,SAAS;MACT,sDAA6B,WAAW,OAAO;MAC/C;MACD,CAAC;AACF,mBAAc;MAAC,GAAG;MAAQ,GAAG;MAAe;aACrC,KAAK;AACZ,YAAO,KAAK,gDAAgD,IAAI;;AAGlE,QAAI;KACF,MAAM,UAAU,MAAMC,+BAAe;MACnC,SAAS;MACT,sDAA6B,eAAe,OAAO;MACnD;MACD,CAAC;AACF,SAAI,SAAS,OACX,eAAc,QAAQ,OAAO;SAE7B,eAAc,KAAK;aAEd,KAAK;AACZ,mBAAc,KAAK;AACnB,YAAO,KAAK,6DAA6D,IAAI;;SAG/E,eAAc,KAAK;AAGrB,WAAQ,YAAY;AACpB,kBAAe;IACb,wEAA+C,aAAa,EAAE,CAAC;IAC/D,SAAS;IACV,CAAC;AAIF,qBAAkB,oBAAoB;WAC/B,OAAO,WAEN;AAER,wBAAqB,MAAM;AAC3B,oBAAiB,OAAO,WAAW,CAAC;;;;;;;;;;CAWxC,eAAe,gBAA+B;AAC5C,MAAI,wBAAwB,QAC1B,QAAO,wBAAwB;AAGjC,0BAAwB,UAAU,sBAAsB,CAAC,cAAc;AACrE,2BAAwB,UAAU;IAClC;AAEF,SAAO,wBAAwB;;CAGjC,eAAe,OAAO,GAAG,MAAuD;EAG9E,MAAMC,OAAY,KAAK;EACvB,MAAMC,kBACJ,OAAO,SAAS,YAAY,SAAS,SAAS,iBAAiB,QAAQ,mBAAmB;AAE5F,MAAI;AACF,OAAI,CAAC,iBAAiB;AACpB,yBAAqB,KAAK;AAC1B,qBAAiB,KAAK;;AAGxB,UAAO,MAAM,OAAO,OAAO,GAAG,KAAK;WAC5B,OAAO;AACd,SAAM,IAAIC,0CACR,mBAAmB,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,UAAU,MAAM,CAAC,IACzF,0BACA,SACA,6CACD;YACO;AACR,OAAI,CAAC,iBAAiB;AACpB,yBAAqB,MAAM;AAC3B,qBAAiB,OAAO,WAAW,CAAC;;;;;;;AAQ1C,4BAAgB;AAOd,MAAI,iBAAiB,QACnB;AAGF,mBAAiB,UAAU;AAE3B,GAAC,YAA2B;AAG1B,SAAM,OAAO,GAAG,WAAW,YAAY;AACrC,UAAM,eAAe;KACrB;AAGF,SAAM,OAAO,GAAG,kBAAkB;AAChC,YAAQ,KAAK;AACb,mBAAe,KAAK;AACpB,sBAAkB,MAAM;KACxB;AAMF,OAAI;AACF,UAAM,OAAO,uBAAuB;YAC7B,OAAO;AACd,WAAO,KAAK,+CAA+C,MAAM;;AAInE,OAAI,MAAM,OAAO,YAAY,EAAE;AAC7B,UAAM,eAAe;AAErB;;GAGF,MAAMC,aAAkB,IAAI,IAAI,OAAO,SAAS,KAAK;AAIrD,OAFE,cAAc,YAAY,OAAO,eAAgB,IAAI,yBAAyB,YAAY,cAAc,EAAE,CAG1G,KAAI;IACF,MAAMC,YAA6B,WAAW;IAC9C,MAAMC,OAAsB,UAAU,IAAI,OAAO;IACjD,MAAMC,qBAAoC,UAAU,IAAI,cAAc;IACtE,MAAMC,oBAAmC,eAAe,QACtD,4CAAmB,OAAO,OAAO,CAAC,eACnC;AAID,SAAK,QAAQC,6BAAS,2BAA2B,KAAK,CAAC,sBAAsB,CAAC,kBAC5E,OAAM,QAAQ;YAET,OAAO;AACd,UAAM,IAAIN,0CACR,mBAAmB,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,UAAU,MAAM,CAAC,IACzF,0BACA,SACA,6CACD;;MAGH;IACH,EAAE,CAAC;;;;;;AAON,4BAAgB;EACd,IAAIO;AAEJ,GAAC,YAA2B;AAC1B,OAAI;IACF,MAAMC,SAAkB,MAAM,OAAO,YAAY;AAEjD,sBAAkB,OAAO;AAEzB,QAAI,CAAC,OACH,YAAW,YAAY,YAAY;AAGjC,SAF2B,MAAM,OAAO,YAAY,EAErC;AACb,wBAAkB,KAAK;AACvB,oBAAc,SAAS;;OAExB,IAAK;YAIH,OAAO;AACd,sBAAkB,MAAM;;MAExB;AAEJ,eAAmB;AACjB,OAAI,SACF,eAAc,SAAS;;IAG1B,CAAC,OAAO,CAAC;AAEZ,4BAAgB;AACd,GAAC,YAA2B;AAC1B,OAAI;AAGF,yBAFwB,MAAM,OAAO,eAAe,CAExB;YACrB,OAAO;AACd,yBAAqB,MAAM;;MAE3B;IACH,CAAC,OAAO,CAAC;;;;AAKZ,4BAAgB;EACd,MAAM,0BAAgC;AAEpC,OAAI,kBACF;GAKF,MAAMP,aAAkB,IAAI,IAAI,OAAO,SAAS,KAAK;AACrD,OAAI,CAAC,kBAAkB,cAAc,YAAY,OAAO,eAAgB,CACtE;AAGF,oBAAiB,OAAO,WAAW,CAAC;;AAItC,qBAAmB;EAGnB,MAAMM,WAA2B,YAAY,mBAAmB,IAAI;AAEpE,eAAmB;AACjB,iBAAc,SAAS;;IAExB;EAAC;EAAQ;EAAe;EAAgB;EAAkB,CAAC;CAE9D,MAAM,iBAAiB,OAAO,YAAqD;AACjF,MAAI;AACF,wBAAqB,KAAK;AAC1B,oBAAiB,KAAK;AACtB,UAAO,MAAM,OAAO,eAAe,QAAQ;WACpC,OAAO;AACd,SAAM,IAAIP,0CACR,oCAAoC,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,UAAU,MAAM,CAAC,IAC1G,kCACA,SACA,sDACD;YACO;AACR,wBAAqB,MAAM;AAC3B,oBAAiB,OAAO,WAAW,CAAC;;;CAIxC,MAAM,uBAAuB,YAAwB;AACnD,UAAQ,QAAQ;AAChB,kBAAgB,UAA8B;GAC5C,wEAA+C,QAAQ;GACvD,SAAS;GACV,EAAE;;CAGL,MAAMS,2CACJ,YAA8B,OAAO,mBAAmB,EACxD,CAAC,OAAO,CACT;CAED,MAAMC,oCAAgD,YAA6B,OAAO,YAAY,EAAE,CAAC,OAAO,CAAC;CAEjH,MAAMC,wCACJ,YAA6B,OAAO,gBAAgB,EACpD,CAAC,OAAO,CACT;CAED,MAAMC,+CACJ,YAA+B,OAAO,uBAAuB,EAC7D,CAAC,OAAO,CACT;CAED,MAAMC,2CAA4E,YAAY;EAC5F,MAAMC,iBACJ,kBAAkB,WAAY,MAAM,OAAO,mBAAmB;AAChE,MAAI,eACF,mBAAkB,UAAU;AAE9B,SAAO;IACN,CAAC,OAAO,CAAC;CAEZ,MAAMC,iCACJ,OAAO,GAAG,SAA8B,OAAO,QAAQ,GAAG,KAAK,EAC/D,CAAC,OAAO,CACT;CAED,MAAMC,oCACJ,OAAO,GAAG,SAA8B,OAAO,WAAW,GAAG,KAAK,EAClE,CAAC,OAAO,CACT;CAED,MAAMC,uCACJ,OAAO,mBAAsC,OAAO,cAAc,eAAe,EACjF,CAAC,OAAO,CACT;CAED,MAAMC,iCACJ,OAAO,GAAG,SAA8B,OAAO,QAAQ,GAAG,KAAK,EAC/D,CAAC,OAAO,CACT;CAED,MAAMC,iCACJ,OAAO,YACJ,MAAM,OAAO,QAAQ,QAAQ,EAChC,CAAC,OAAO,CACT;CAED,MAAMC,gCACJ,OAAO,GAAG,SAA8B,OAAO,OAAO,GAAG,KAAK,EAC9D,CAAC,OAAO,CACT;CAED,MAAMC,sCACJ,OAAO,GAAG,SAA8B,OAAO,aAAa,GAAG,KAAK,EACpE,CAAC,OAAO,CACT;CAED,MAAMC,sCACJ,OAAO,iBAAoC;EACzC,MAAMC,SAAc,MAAM,OAAO,aAAa,aAAa;EAI3D,MAAMC,sBAA4C,MAAM,OAAO,kBAAkB;AACjF,YAAU,oBAAoB;AAC9B,aAAW,oBAAoB,WAAW,GAAG;AAC7C,eAAa,MAAM,OAAO,sBAAsB,CAAC;AAEjD,SAAO;IAET,CAAC,OAAO,CACT;CAED,MAAMC,kCACG;EACL,gBAAgB,OAAO;EACvB,eAAe,OAAO;EACtB;EACA,WAAW,OAAO;EAClB,QAAQ,OAAO;EACf;EACA;EACA,WAAW,EACT,WACD;EACD;EACA;EACA;EACA;EACA;EACA;EACA,MAAM;GACJ,SAAS,aAAa;GACtB;GACA;GACD;EACD;EACA;EACA,eAAe;EACf,WAAW;EACX,YAAY;EACZ;EACA,oBAAoB,QAAQ;EAC5B;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA,iDAAwB,OAAO,OAAO;EACvC,GACD;EACE;EACA,QAAQ;EACR,OAAO;EACP,OAAO;EACP,OAAO;EACP,OAAO;EACP;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA,aAAa;EACb;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACD,CACF;AAED,QACE,2CAACC,iCAAiB;EAAgB;YAChC,2CAACC;GAAa,aAAa,aAAa;GAAM,iDAAwB,OAAO,OAAO;aAClF,2CAACC;IAAiB,SAAS,aAAa,oBAAoB;IAAkB;cAC5E,2CAACC;KACC,OAAO;MACL,GAAG,aAAa,OAAO;MACvB,WAAW,aAAa,OAAO;MAChC;eAED,2CAACC,0CACC,2CAACC;MAAa,SAAS;MAA0B;MAAY,iBAAiB;gBAC5E,2CAACC;OAA0B,WAAY,YAAY,YAAY,aAAa,EAAE;OAC3E;QACyB;OACf,GACF;MACD;KACC;IACN;GACW;;AAIhC,gCAAe"}

package/dist/cjs/hooks/management/useGrantedPermissions.cjs

@@ -8,7 +8,8 @@ react = require_rolldown_runtime.__toESM(react);
 //#region src/hooks/management/useGrantedPermissions.ts
 /**
 * Reads the permissions the signed-in user's access token grants, for example to hide a page the
-* user cannot use.
+* user cannot use. In backend mode they come from the backend's session, so the token stays on the
+* backend.
 *
 * @returns The granted permissions and a `can` check.
 *
@@ -19,18 +20,18 @@ react = require_rolldown_runtime.__toESM(react);
 * ```
 */
 const useGrantedPermissions = () => {
-	const { getAccessToken, isSignedIn } = require_useThunderID.default();
+	const { getGrantedPermissions, isSignedIn } = require_useThunderID.default();
 	const [granted, setGranted] = (0, react.useState)(null);
 	(0, react.useEffect)(() => {
 		if (!isSignedIn) return;
 		let active = true;
-		getAccessToken().then((token) => (0, __thunderid_browser.getTokenPermissions)(token)).catch(() => []).then((tokenPermissions) => {
-			if (active) setGranted(tokenPermissions);
+		getGrantedPermissions().catch(() => []).then((grantedPermissions) => {
+			if (active) setGranted(grantedPermissions);
 		});
 		return () => {
 			active = false;
 		};
-	}, [getAccessToken, isSignedIn]);
+	}, [getGrantedPermissions, isSignedIn]);
 	const permissions = (0, react.useMemo)(() => isSignedIn ? granted ?? [] : [], [granted, isSignedIn]);
 	const isLoading = isSignedIn && granted === null;
 	return {

package/dist/cjs/hooks/management/useGrantedPermissions.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"useGrantedPermissions.cjs","names":["useThunderID","permissions: string[]","isLoading: boolean"],"sources":["../../../../src/hooks/management/useGrantedPermissions.ts"],"sourcesContent":["// Copyright 2026 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\nimport {getTokenPermissions, hasPermission} from '@thunderid/browser';\nimport {useCallback, useEffect, useMemo, useState} from 'react';\nimport useThunderID from '../../contexts/ThunderID/useThunderID';\n\n/**\n * The permissions the signed-in user's access token grants.\n */\nexport interface GrantedPermissions {\n  /**\n   * Whether the granted permissions cover a required one. A permission covers everything under it,\n   * so `system:user` covers `system:user:view`. Use it to decide what to show; the server still\n   * checks every request.\n   */\n  can: (required: string) => boolean;\n  isLoading: boolean;\n  permissions: string[];\n}\n\n/**\n * Reads the permissions the signed-in user's access token grants, for example to hide a page the\n * user cannot use.\n *\n * @returns The granted permissions and a `can` check.\n *\n * @example\n * ```tsx\n * const {can} = useGrantedPermissions();\n * return can('system:group:view') ? <GroupList /> : null;\n * ```\n */\nconst useGrantedPermissions = (): GrantedPermissions => {\n  const {getAccessToken, isSignedIn} = useThunderID();\n  const [granted, setGranted] = useState<string[] | null>(null);\n\n  useEffect(() => {\n    if (!isSignedIn) {\n      return undefined;\n    }\n\n    let active = true;\n\n    void getAccessToken()\n      .then((token: string) => getTokenPermissions(token))\n      .catch((): string[] => [])\n      .then((tokenPermissions: string[]) => {\n        if (active) {\n          setGranted(tokenPermissions);\n        }\n      });\n\n    return (): void => {\n      active = false;\n    };\n  }, [getAccessToken, isSignedIn]);\n\n  const permissions: string[] = useMemo(() => (isSignedIn ? (granted ?? []) : []), [granted, isSignedIn]);\n  const isLoading: boolean = isSignedIn && granted === null;\n\n  const can: (required: string) => boolean = useCallback(\n    (required: string): boolean => hasPermission(permissions, required),\n    [permissions],\n  );\n\n  return {can, isLoading, permissions};\n};\n\nexport default useGrantedPermissions;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAiCA,MAAM,8BAAkD;CACtD,MAAM,EAAC,gBAAgB,eAAcA,8BAAc;CACnD,MAAM,CAAC,SAAS,kCAAwC,KAAK;AAE7D,4BAAgB;AACd,MAAI,CAAC,WACH;EAGF,IAAI,SAAS;AAEb,EAAK,gBAAgB,CAClB,MAAM,uDAAsC,MAAM,CAAC,CACnD,YAAsB,EAAE,CAAC,CACzB,MAAM,qBAA+B;AACpC,OAAI,OACF,YAAW,iBAAiB;IAE9B;AAEJ,eAAmB;AACjB,YAAS;;IAEV,CAAC,gBAAgB,WAAW,CAAC;CAEhC,MAAMC,uCAAuC,aAAc,WAAW,EAAE,GAAI,EAAE,EAAG,CAAC,SAAS,WAAW,CAAC;CACvG,MAAMC,YAAqB,cAAc,YAAY;AAOrD,QAAO;EAAC,6BAJL,oDAA4C,aAAa,SAAS,EACnE,CAAC,YAAY,CACd;EAEY;EAAW;EAAY;;AAGtC,oCAAe"}
+{"version":3,"file":"useGrantedPermissions.cjs","names":["useThunderID","permissions: string[]","isLoading: boolean"],"sources":["../../../../src/hooks/management/useGrantedPermissions.ts"],"sourcesContent":["// Copyright 2026 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\nimport {hasPermission} from '@thunderid/browser';\nimport {useCallback, useEffect, useMemo, useState} from 'react';\nimport useThunderID from '../../contexts/ThunderID/useThunderID';\n\n/**\n * The permissions the signed-in user's access token grants.\n */\nexport interface GrantedPermissions {\n  /**\n   * Whether the granted permissions cover a required one. A permission covers everything under it,\n   * so `system:user` covers `system:user:view`. Use it to decide what to show; the server still\n   * checks every request.\n   */\n  can: (required: string) => boolean;\n  isLoading: boolean;\n  permissions: string[];\n}\n\n/**\n * Reads the permissions the signed-in user's access token grants, for example to hide a page the\n * user cannot use. In backend mode they come from the backend's session, so the token stays on the\n * backend.\n *\n * @returns The granted permissions and a `can` check.\n *\n * @example\n * ```tsx\n * const {can} = useGrantedPermissions();\n * return can('system:group:view') ? <GroupList /> : null;\n * ```\n */\nconst useGrantedPermissions = (): GrantedPermissions => {\n  const {getGrantedPermissions, isSignedIn} = useThunderID();\n  const [granted, setGranted] = useState<string[] | null>(null);\n\n  useEffect(() => {\n    if (!isSignedIn) {\n      return undefined;\n    }\n\n    let active = true;\n\n    void getGrantedPermissions()\n      .catch((): string[] => [])\n      .then((grantedPermissions: string[]) => {\n        if (active) {\n          setGranted(grantedPermissions);\n        }\n      });\n\n    return (): void => {\n      active = false;\n    };\n  }, [getGrantedPermissions, isSignedIn]);\n\n  const permissions: string[] = useMemo(() => (isSignedIn ? (granted ?? []) : []), [granted, isSignedIn]);\n  const isLoading: boolean = isSignedIn && granted === null;\n\n  const can: (required: string) => boolean = useCallback(\n    (required: string): boolean => hasPermission(permissions, required),\n    [permissions],\n  );\n\n  return {can, isLoading, permissions};\n};\n\nexport default useGrantedPermissions;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;AAkCA,MAAM,8BAAkD;CACtD,MAAM,EAAC,uBAAuB,eAAcA,8BAAc;CAC1D,MAAM,CAAC,SAAS,kCAAwC,KAAK;AAE7D,4BAAgB;AACd,MAAI,CAAC,WACH;EAGF,IAAI,SAAS;AAEb,EAAK,uBAAuB,CACzB,YAAsB,EAAE,CAAC,CACzB,MAAM,uBAAiC;AACtC,OAAI,OACF,YAAW,mBAAmB;IAEhC;AAEJ,eAAmB;AACjB,YAAS;;IAEV,CAAC,uBAAuB,WAAW,CAAC;CAEvC,MAAMC,uCAAuC,aAAc,WAAW,EAAE,GAAI,EAAE,EAAG,CAAC,SAAS,WAAW,CAAC;CACvG,MAAMC,YAAqB,cAAc,YAAY;AAOrD,QAAO;EAAC,6BAJL,oDAA4C,aAAa,SAAS,EACnE,CAAC,YAAY,CACd;EAEY;EAAW;EAAY;;AAGtC,oCAAe"}

package/dist/cjs/index.cjs

@@ -38,13 +38,13 @@ const require_SignUpButton = require('./components/auth/buttons/SignUpButton/Sig
 const require_SignedIn = require('./components/auth/guards/SignedIn.cjs');
 const require_SignedOut = require('./components/auth/guards/SignedOut.cjs');
 const require_Loading = require('./components/auth/guards/Loading.cjs');
+const require_Typography = require('./components/primitives/Typography/Typography.cjs');
+const require_Card = require('./components/primitives/Card/Card.cjs');
 const require_CircleAlert = require('./components/primitives/Icons/CircleAlert.cjs');
 const require_CircleCheck = require('./components/primitives/Icons/CircleCheck.cjs');
 const require_Info = require('./components/primitives/Icons/Info.cjs');
 const require_TriangleAlert = require('./components/primitives/Icons/TriangleAlert.cjs');
-const require_Typography = require('./components/primitives/Typography/Typography.cjs');
 const require_Alert = require('./components/primitives/Alert/Alert.cjs');
-const require_Card = require('./components/primitives/Card/Card.cjs');
 const require_FormControl = require('./components/primitives/FormControl/FormControl.cjs');
 const require_InputLabel = require('./components/primitives/InputLabel/InputLabel.cjs');
 const require_Toggle = require('./components/primitives/Toggle/Toggle.cjs');
@@ -82,6 +82,8 @@ const require_LinkedInButton = require('./components/auth/buttons/LinkedInButton
 const require_MicrosoftButton = require('./components/auth/buttons/MicrosoftButton.cjs');
 const require_SignInWithEthereumButton = require('./components/auth/buttons/SignInWithEthereumButton.cjs');
 const require_BaseSignIn = require('./components/auth/SignIn/BaseSignIn.cjs');
+const require_BaseDeviceGrant = require('./components/auth/DeviceGrant/BaseDeviceGrant.cjs');
+const require_DeviceGrant = require('./components/auth/DeviceGrant/DeviceGrant.cjs');
 const require_useOAuthCallback = require('./hooks/auth/useOAuthCallback.cjs');
 const require_SignIn = require('./components/auth/SignIn/SignIn.cjs');
 const require_Logo = require('./components/primitives/Logo/Logo.cjs');
@@ -250,6 +252,7 @@ exports.BaseApplicationDetails = require_BaseApplicationDetails.default;
 exports.BaseApplicationList = require_BaseApplicationList.default;
 exports.BaseAuthFlowSelect = require_BaseAuthFlowSelect.default;
 exports.BaseChangeCredential = require_BaseChangeCredential.default;
+exports.BaseDeviceGrant = require_BaseDeviceGrant.default;
 exports.BaseGroupCreate = require_BaseGroupCreate.default;
 exports.BaseGroupList = require_BaseGroupList.default;
 exports.BaseGroupMembers = require_BaseGroupMembers.default;
@@ -301,6 +304,7 @@ exports.ConsentCheckboxList = require_ConsentCheckboxList.default;
 exports.ConsentDetailField = require_ConsentDetailField.default;
 exports.DataTable = require_DataTable.default;
 exports.DatePicker = require_DatePicker.default;
+exports.DeviceGrant = require_DeviceGrant.default;
 exports.Divider = require_Divider.default;
 Object.defineProperty(exports, 'EMOJI_URI_SCHEME', {
   enumerable: true,

package/dist/components/account/UserProfile/BaseUserProfile.js

@@ -3,8 +3,8 @@ import useTheme_default from "../../../contexts/Theme/useTheme.js";
 import useTranslation_default from "../../../hooks/useTranslation.js";
 import Button_default from "../../primitives/Button/Button.js";
 import Typography_default from "../../primitives/Typography/Typography.js";
-import Alert_default from "../../primitives/Alert/Alert.js";
 import Card_default from "../../primitives/Card/Card.js";
+import Alert_default from "../../primitives/Alert/Alert.js";
 import TextField_default from "../../primitives/TextField/TextField.js";
 import Checkbox_default from "../../primitives/Checkbox/Checkbox.js";
 import DatePicker_default from "../../primitives/DatePicker/DatePicker.js";

package/dist/components/auth/AcceptInvite/BaseAcceptInvite.js

@@ -7,8 +7,8 @@ import { extractErrorMessage, normalizeFlowResponse } from "../../../utils/flowT
 import Spinner_default from "../../primitives/Spinner/Spinner.js";
 import Button_default from "../../primitives/Button/Button.js";
 import Typography_default from "../../primitives/Typography/Typography.js";
-import Alert_default from "../../primitives/Alert/Alert.js";
 import Card_default from "../../primitives/Card/Card.js";
+import Alert_default from "../../primitives/Alert/Alert.js";
 import isConsentApprovalBlocked_default from "../../../utils/isConsentApprovalBlocked.js";
 import { renderInviteUserComponents } from "../flow/AuthOptionFactory.js";
 import { useOAuthCallback } from "../../../hooks/auth/useOAuthCallback.js";

package/dist/components/auth/DeviceGrant/BaseDeviceGrant.d.ts

@@ -0,0 +1,17 @@
+import type { EmbeddedFlowComponent } from '@thunderid/browser';
+import { FC } from 'react';
+import { type BaseSignInProps } from '../SignIn/BaseSignIn';
+export type DeviceGrantResult = 'failure' | 'success' | null;
+export interface BaseDeviceGrantProps extends Omit<BaseSignInProps, 'components' | 'onSubmit'> {
+    components: EmbeddedFlowComponent[];
+    completeMessage?: string;
+    completeDescription?: string;
+    failedMessage?: string;
+    failedDescription?: string;
+    onSubmit: NonNullable<BaseSignInProps['onSubmit']>;
+    result?: DeviceGrantResult;
+}
+/** Renders the server-described Device Grant prompt independently of SDK orchestration. */
+declare const BaseDeviceGrant: FC<BaseDeviceGrantProps>;
+export default BaseDeviceGrant;
+//# sourceMappingURL=BaseDeviceGrant.d.ts.map

package/dist/components/auth/DeviceGrant/BaseDeviceGrant.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"BaseDeviceGrant.d.ts","sourceRoot":"","sources":["../../../../src/components/auth/DeviceGrant/BaseDeviceGrant.tsx"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAC,qBAAqB,EAAC,MAAM,oBAAoB,CAAC;AAC9D,OAAO,EAAC,EAAE,EAAe,MAAM,OAAO,CAAC;AAMvC,OAAmB,EAAC,KAAK,eAAe,EAAC,MAAM,sBAAsB,CAAC;AAEtE,MAAM,MAAM,iBAAiB,GAAG,SAAS,GAAG,SAAS,GAAG,IAAI,CAAC;AAE7D,MAAM,WAAW,oBAAqB,SAAQ,IAAI,CAAC,eAAe,EAAE,YAAY,GAAG,UAAU,CAAC;IAC5F,UAAU,EAAE,qBAAqB,EAAE,CAAC;IACpC,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,EAAE,WAAW,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC,CAAC;IACnD,MAAM,CAAC,EAAE,iBAAiB,CAAC;CAC5B;AAED,2FAA2F;AAC3F,QAAA,MAAM,eAAe,EAAE,EAAE,CAAC,oBAAoB,CAgE7C,CAAC;AAEF,eAAe,eAAe,CAAC"}

package/dist/components/auth/DeviceGrant/BaseDeviceGrant.js

@@ -0,0 +1,58 @@
+import useTheme_default from "../../../contexts/Theme/useTheme.js";
+import useTranslation_default from "../../../hooks/useTranslation.js";
+import BaseDeviceGrant_styles_default from "./BaseDeviceGrant.styles.js";
+import Typography_default from "../../primitives/Typography/Typography.js";
+import Card_default from "../../primitives/Card/Card.js";
+import BaseSignIn_default from "../SignIn/BaseSignIn.js";
+import { createElement } from "react";
+import { jsx, jsxs } from "react/jsx-runtime";
+
+//#region src/components/auth/DeviceGrant/BaseDeviceGrant.tsx
+/** Renders the server-described Device Grant prompt independently of SDK orchestration. */
+const BaseDeviceGrant = ({ components, className = "", completeMessage = void 0, completeDescription = void 0, failedMessage = void 0, failedDescription = void 0, error, isLoading, preferences, result = null, variant = "default",...signInProps }) => {
+	const { theme } = useTheme_default();
+	const { t } = useTranslation_default(preferences?.i18n);
+	const styles = BaseDeviceGrant_styles_default(theme);
+	if ((error || result) && components.length === 0) {
+		const isSuccess = result === "success" && !error;
+		const resolvedCompleteMessage = completeMessage ?? t("deviceGrant.messages.complete");
+		const resolvedCompleteDescription = completeDescription ?? t("deviceGrant.messages.completeDescription");
+		const resolvedFailedMessage = failedMessage ?? t("deviceGrant.messages.failed");
+		const resolvedFailedDescription = failedDescription ?? t("deviceGrant.messages.failedDescription");
+		const title = isSuccess ? resolvedCompleteMessage : resolvedFailedMessage;
+		const description = isSuccess ? resolvedCompleteDescription : !error || error.message === resolvedFailedMessage ? resolvedFailedDescription : error.message;
+		return /* @__PURE__ */ jsxs(Card_default, {
+			className: `${styles["terminalCard"]} ${className}`,
+			"data-testid": "device-grant-result",
+			variant,
+			children: [/* @__PURE__ */ jsx(Typography_default, {
+				className: styles["terminalTitle"],
+				color: isSuccess ? "success" : "error",
+				component: "h2",
+				fontWeight: 600,
+				variant: "h6",
+				children: title
+			}), /* @__PURE__ */ jsx(Typography_default, {
+				className: styles["terminalDescription"],
+				color: "textSecondary",
+				component: "p",
+				variant: "caption",
+				children: description
+			})]
+		});
+	}
+	return /* @__PURE__ */ createElement(BaseSignIn_default, {
+		...signInProps,
+		className,
+		key: components.map((component) => component.id).join("|"),
+		components,
+		error,
+		isLoading,
+		preferences
+	});
+};
+var BaseDeviceGrant_default = BaseDeviceGrant;
+
+//#endregion
+export { BaseDeviceGrant_default as default };
+//# sourceMappingURL=BaseDeviceGrant.js.map

package/dist/components/auth/DeviceGrant/BaseDeviceGrant.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"BaseDeviceGrant.js","names":["BaseDeviceGrant: FC<BaseDeviceGrantProps>","useTheme","useTranslation","useStyles","CardPrimitive","Typography","BaseSignIn"],"sources":["../../../../src/components/auth/DeviceGrant/BaseDeviceGrant.tsx"],"sourcesContent":["// Copyright 2025-2026 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\nimport type {EmbeddedFlowComponent} from '@thunderid/browser';\nimport {FC, ReactElement} from 'react';\nimport useStyles from './BaseDeviceGrant.styles';\nimport useTheme from '../../../contexts/Theme/useTheme';\nimport useTranslation from '../../../hooks/useTranslation';\nimport CardPrimitive from '../../primitives/Card/Card';\nimport Typography from '../../primitives/Typography/Typography';\nimport BaseSignIn, {type BaseSignInProps} from '../SignIn/BaseSignIn';\n\nexport type DeviceGrantResult = 'failure' | 'success' | null;\n\nexport interface BaseDeviceGrantProps extends Omit<BaseSignInProps, 'components' | 'onSubmit'> {\n  components: EmbeddedFlowComponent[];\n  completeMessage?: string;\n  completeDescription?: string;\n  failedMessage?: string;\n  failedDescription?: string;\n  onSubmit: NonNullable<BaseSignInProps['onSubmit']>;\n  result?: DeviceGrantResult;\n}\n\n/** Renders the server-described Device Grant prompt independently of SDK orchestration. */\nconst BaseDeviceGrant: FC<BaseDeviceGrantProps> = ({\n  components,\n  className = '',\n  completeMessage = undefined,\n  completeDescription = undefined,\n  failedMessage = undefined,\n  failedDescription = undefined,\n  error,\n  isLoading,\n  preferences,\n  result = null,\n  variant = 'default',\n  ...signInProps\n}: BaseDeviceGrantProps): ReactElement => {\n  const {theme} = useTheme();\n  const {t} = useTranslation(preferences?.i18n);\n  const styles = useStyles(theme);\n\n  if ((error || result) && components.length === 0) {\n    const isSuccess = result === 'success' && !error;\n    const resolvedCompleteMessage = completeMessage ?? t('deviceGrant.messages.complete');\n    const resolvedCompleteDescription = completeDescription ?? t('deviceGrant.messages.completeDescription');\n    const resolvedFailedMessage = failedMessage ?? t('deviceGrant.messages.failed');\n    const resolvedFailedDescription = failedDescription ?? t('deviceGrant.messages.failedDescription');\n    const title = isSuccess ? resolvedCompleteMessage : resolvedFailedMessage;\n    const description = isSuccess\n      ? resolvedCompleteDescription\n      : !error || error.message === resolvedFailedMessage\n        ? resolvedFailedDescription\n        : error.message;\n\n    return (\n      <CardPrimitive\n        className={`${styles['terminalCard']} ${className}`}\n        data-testid=\"device-grant-result\"\n        variant={variant}\n      >\n        <Typography\n          className={styles['terminalTitle']}\n          color={isSuccess ? 'success' : 'error'}\n          component=\"h2\"\n          fontWeight={600}\n          variant=\"h6\"\n        >\n          {title}\n        </Typography>\n        <Typography className={styles['terminalDescription']} color=\"textSecondary\" component=\"p\" variant=\"caption\">\n          {description}\n        </Typography>\n      </CardPrimitive>\n    );\n  }\n\n  return (\n    <BaseSignIn\n      {...signInProps}\n      className={className}\n      key={components.map((component: EmbeddedFlowComponent) => component.id).join('|')}\n      components={components}\n      error={error}\n      isLoading={isLoading}\n      preferences={preferences}\n    />\n  );\n};\n\nexport default BaseDeviceGrant;\n"],"mappings":";;;;;;;;;;;AAyBA,MAAMA,mBAA6C,EACjD,YACA,YAAY,IACZ,kBAAkB,QAClB,sBAAsB,QACtB,gBAAgB,QAChB,oBAAoB,QACpB,OACA,WACA,aACA,SAAS,MACT,UAAU,UACV,GAAG,kBACqC;CACxC,MAAM,EAAC,UAASC,kBAAU;CAC1B,MAAM,EAAC,MAAKC,uBAAe,aAAa,KAAK;CAC7C,MAAM,SAASC,+BAAU,MAAM;AAE/B,MAAK,SAAS,WAAW,WAAW,WAAW,GAAG;EAChD,MAAM,YAAY,WAAW,aAAa,CAAC;EAC3C,MAAM,0BAA0B,mBAAmB,EAAE,gCAAgC;EACrF,MAAM,8BAA8B,uBAAuB,EAAE,2CAA2C;EACxG,MAAM,wBAAwB,iBAAiB,EAAE,8BAA8B;EAC/E,MAAM,4BAA4B,qBAAqB,EAAE,yCAAyC;EAClG,MAAM,QAAQ,YAAY,0BAA0B;EACpD,MAAM,cAAc,YAChB,8BACA,CAAC,SAAS,MAAM,YAAY,wBAC1B,4BACA,MAAM;AAEZ,SACE,qBAACC;GACC,WAAW,GAAG,OAAO,gBAAgB,GAAG;GACxC,eAAY;GACH;cAET,oBAACC;IACC,WAAW,OAAO;IAClB,OAAO,YAAY,YAAY;IAC/B,WAAU;IACV,YAAY;IACZ,SAAQ;cAEP;KACU,EACb,oBAACA;IAAW,WAAW,OAAO;IAAwB,OAAM;IAAgB,WAAU;IAAI,SAAQ;cAC/F;KACU;IACC;;AAIpB,QACE,8BAACC;EACC,GAAI;EACO;EACX,KAAK,WAAW,KAAK,cAAqC,UAAU,GAAG,CAAC,KAAK,IAAI;EACrE;EACL;EACI;EACE;GACb;;AAIN,8BAAe"}

package/dist/components/auth/DeviceGrant/BaseDeviceGrant.styles.d.ts

@@ -0,0 +1,4 @@
+import { Theme } from '@thunderid/browser';
+declare const useStyles: (theme: Theme) => Record<string, string>;
+export default useStyles;
+//# sourceMappingURL=BaseDeviceGrant.styles.d.ts.map

package/dist/components/auth/DeviceGrant/BaseDeviceGrant.styles.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"BaseDeviceGrant.styles.d.ts","sourceRoot":"","sources":["../../../../src/components/auth/DeviceGrant/BaseDeviceGrant.styles.ts"],"names":[],"mappings":"AAGA,OAAO,EAAC,KAAK,EAAC,MAAM,oBAAoB,CAAC;AAIzC,QAAA,MAAM,SAAS,GAAI,OAAO,KAAK,KAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAkBpD,CAAC;AAEJ,eAAe,SAAS,CAAC"}

package/dist/components/auth/DeviceGrant/BaseDeviceGrant.styles.js

@@ -0,0 +1,24 @@
+import { css } from "../../../styles/emotion.js";
+import { useMemo } from "react";
+
+//#region src/components/auth/DeviceGrant/BaseDeviceGrant.styles.ts
+const useStyles = (theme) => useMemo(() => ({
+	terminalCard: css`
+        box-sizing: border-box;
+        width: 100%;
+        max-width: calc(${theme.vars.spacing.unit} * 60);
+        margin: 0 auto;
+        gap: ${theme.vars.spacing.unit};
+      `,
+	terminalDescription: css`
+        margin: 0;
+      `,
+	terminalTitle: css`
+        margin: 0;
+      `
+}), [theme]);
+var BaseDeviceGrant_styles_default = useStyles;
+
+//#endregion
+export { BaseDeviceGrant_styles_default as default };
+//# sourceMappingURL=BaseDeviceGrant.styles.js.map

package/dist/components/auth/DeviceGrant/BaseDeviceGrant.styles.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"BaseDeviceGrant.styles.js","names":[],"sources":["../../../../src/components/auth/DeviceGrant/BaseDeviceGrant.styles.ts"],"sourcesContent":["// Copyright 2025-2026 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\nimport {Theme} from '@thunderid/browser';\nimport {useMemo} from 'react';\nimport {css} from '../../../styles/emotion';\n\nconst useStyles = (theme: Theme): Record<string, string> =>\n  useMemo(\n    () => ({\n      terminalCard: css`\n        box-sizing: border-box;\n        width: 100%;\n        max-width: calc(${theme.vars.spacing.unit} * 60);\n        margin: 0 auto;\n        gap: ${theme.vars.spacing.unit};\n      `,\n      terminalDescription: css`\n        margin: 0;\n      `,\n      terminalTitle: css`\n        margin: 0;\n      `,\n    }),\n    [theme],\n  );\n\nexport default useStyles;\n"],"mappings":";;;;AAOA,MAAM,aAAa,UACjB,eACS;CACL,cAAc,GAAG;;;0BAGG,MAAM,KAAK,QAAQ,KAAK;;eAEnC,MAAM,KAAK,QAAQ,KAAK;;CAEjC,qBAAqB,GAAG;;;CAGxB,eAAe,GAAG;;;CAGnB,GACD,CAAC,MAAM,CACR;AAEH,qCAAe"}

package/dist/components/auth/DeviceGrant/DeviceGrant.d.ts

@@ -0,0 +1,37 @@
+import { executeEmbeddedDeviceGrantFlow } from '@thunderid/browser';
+import type { EmbeddedFlowComponent, EmbeddedSignInFlowRequest, FlowMetadataResponse } from '@thunderid/browser';
+import type { FC, ReactNode } from 'react';
+import { type BaseDeviceGrantProps, type DeviceGrantResult } from './BaseDeviceGrant';
+type EmbeddedDeviceGrantFlowResponse = Awaited<ReturnType<typeof executeEmbeddedDeviceGrantFlow>>;
+/** Values exposed to consumers that provide custom Device Grant UI. */
+export interface DeviceGrantRenderProps {
+    /** Additional values returned for the active flow step. */
+    additionalData: Record<string, unknown>;
+    /** Components returned by the configured flow. */
+    components: EmbeddedFlowComponent[];
+    /** Current flow error, when one needs to be shown. */
+    error: Error | null;
+    /** First server validation message for each field. */
+    fieldErrors: Record<string, string>;
+    /** Values prefilled from the verification URI. */
+    initialValues: Record<string, string>;
+    /** Whether a flow request is in progress. */
+    isLoading: boolean;
+    /** Flow metadata used to resolve application-specific template values. */
+    meta: FlowMetadataResponse | null;
+    /** Submits user-code input or continues the active flow. */
+    onSubmit: (payload: EmbeddedSignInFlowRequest) => Promise<void>;
+    /** Terminal flow result when the flow has no configured prompt to render. */
+    result: DeviceGrantResult;
+}
+export type DeviceGrantProps = Omit<BaseDeviceGrantProps, 'children' | 'components' | 'error' | 'initialValues' | 'isLoading' | 'onSubmit' | 'result' | 'serverFieldErrors'> & {
+    /** Render props for Gate or other consumers that provide their own flow UI. */
+    children?: (props: DeviceGrantRenderProps) => ReactNode;
+    onComplete?: (response: EmbeddedDeviceGrantFlowResponse) => void;
+};
+/**
+ * Runs the application's configured Device Grant flow and exposes its state for custom renderers.
+ */
+declare const DeviceGrant: FC<DeviceGrantProps>;
+export default DeviceGrant;
+//# sourceMappingURL=DeviceGrant.d.ts.map

package/dist/components/auth/DeviceGrant/DeviceGrant.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"DeviceGrant.d.ts","sourceRoot":"","sources":["../../../../src/components/auth/DeviceGrant/DeviceGrant.tsx"],"names":[],"mappings":"AAGA,OAAO,EAA6C,8BAA8B,EAAC,MAAM,oBAAoB,CAAC;AAC9G,OAAO,KAAK,EAAC,qBAAqB,EAAE,yBAAyB,EAAE,oBAAoB,EAAC,MAAM,oBAAoB,CAAC;AAE/G,OAAO,KAAK,EAAC,EAAE,EAAgB,SAAS,EAAC,MAAM,OAAO,CAAC;AACvD,OAAwB,EAAC,KAAK,oBAAoB,EAAE,KAAK,iBAAiB,EAAC,MAAM,mBAAmB,CAAC;AAKrG,KAAK,+BAA+B,GAAG,OAAO,CAAC,UAAU,CAAC,OAAO,8BAA8B,CAAC,CAAC,CAAC;AAGlG,uEAAuE;AACvE,MAAM,WAAW,sBAAsB;IACrC,2DAA2D;IAC3D,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACxC,kDAAkD;IAClD,UAAU,EAAE,qBAAqB,EAAE,CAAC;IACpC,sDAAsD;IACtD,KAAK,EAAE,KAAK,GAAG,IAAI,CAAC;IACpB,sDAAsD;IACtD,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACpC,kDAAkD;IAClD,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,6CAA6C;IAC7C,SAAS,EAAE,OAAO,CAAC;IACnB,0EAA0E;IAC1E,IAAI,EAAE,oBAAoB,GAAG,IAAI,CAAC;IAClC,4DAA4D;IAC5D,QAAQ,EAAE,CAAC,OAAO,EAAE,yBAAyB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAChE,6EAA6E;IAC7E,MAAM,EAAE,iBAAiB,CAAC;CAC3B;AAED,MAAM,MAAM,gBAAgB,GAAG,IAAI,CACjC,oBAAoB,EACpB,UAAU,GAAG,YAAY,GAAG,OAAO,GAAG,eAAe,GAAG,WAAW,GAAG,UAAU,GAAG,QAAQ,GAAG,mBAAmB,CAClH,GAAG;IACF,+EAA+E;IAC/E,QAAQ,CAAC,EAAE,CAAC,KAAK,EAAE,sBAAsB,KAAK,SAAS,CAAC;IACxD,UAAU,CAAC,EAAE,CAAC,QAAQ,EAAE,+BAA+B,KAAK,IAAI,CAAC;CAClE,CAAC;AAgBF;;GAEG;AACH,QAAA,MAAM,WAAW,EAAE,EAAE,CAAC,gBAAgB,CA0MrC,CAAC;AAEF,eAAe,WAAW,CAAC"}

package/dist/components/auth/DeviceGrant/DeviceGrant.js

@@ -0,0 +1,188 @@
+import useThunderID_default from "../../../contexts/ThunderID/useThunderID.js";
+import useTranslation_default from "../../../hooks/useTranslation.js";
+import { extractErrorMessage, normalizeFlowResponse } from "../../../utils/flowTransformer.js";
+import BaseDeviceGrant_default from "./BaseDeviceGrant.js";
+import { EmbeddedFlowType, EmbeddedSignInFlowStatus, executeEmbeddedDeviceGrantFlow } from "@thunderid/browser";
+import { useCallback, useEffect, useMemo, useRef, useState } from "react";
+import { Fragment as Fragment$1, jsx } from "react/jsx-runtime";
+
+//#region src/components/auth/DeviceGrant/DeviceGrant.tsx
+const clearVerificationParameters = () => {
+	if (!window.location.href) return;
+	const url = new URL(window.location.href);
+	url.searchParams.delete("user_code");
+	url.searchParams.delete("applicationId");
+	window.history.replaceState(window.history.state, "", url.toString());
+};
+const hasUserCodeInput = (components) => components.some((component) => component.ref === "user_code" || Array.isArray(component.components) && hasUserCodeInput(component.components));
+/**
+* Runs the application's configured Device Grant flow and exposes its state for custom renderers.
+*/
+const DeviceGrant = ({ children = void 0, className = "", onComplete = void 0, onError = void 0, preferences = {}, size = "medium", variant = "default",...baseProps }) => {
+	const { applicationId, baseUrl, meta } = useThunderID_default();
+	const { t } = useTranslation_default(preferences?.i18n);
+	const [components, setComponents] = useState([]);
+	const [additionalData, setAdditionalData] = useState({});
+	const [initialValues, setInitialValues] = useState({});
+	const [serverFieldErrors, setServerFieldErrors] = useState(null);
+	const [executionId, setExecutionId] = useState("");
+	const [challengeToken, setChallengeToken] = useState("");
+	const [error, setError] = useState(null);
+	const [isLoading, setIsLoading] = useState(() => {
+		if (applicationId) return true;
+		return typeof window !== "undefined" && Boolean(new URL(window.location.href).searchParams.get("applicationId"));
+	});
+	const [result, setResult] = useState(null);
+	const flowStartAttempted = useRef(false);
+	const verificationParametersRead = useRef(false);
+	const handleError = useCallback((flowError) => {
+		setComponents([]);
+		setAdditionalData({});
+		setServerFieldErrors(null);
+		setError(flowError);
+		setResult("failure");
+		onError?.(flowError);
+	}, [onError]);
+	const applyResponse = useCallback((response) => {
+		const normalized = normalizeFlowResponse(response, t, {
+			throwOnError: false,
+			resolveTranslations: false
+		}, meta);
+		setExecutionId(response.executionId);
+		setChallengeToken(response.challengeToken ?? "");
+		setComponents(normalized.components);
+		setAdditionalData(normalized.additionalData);
+		setServerFieldErrors(response.data?.fieldErrors ?? null);
+		setError(response.error ? new Error(extractErrorMessage(response, t)) : null);
+		if (response.flowStatus === EmbeddedSignInFlowStatus.Complete) {
+			setResult("success");
+			onComplete?.(response);
+			return;
+		}
+		if (response.flowStatus === EmbeddedSignInFlowStatus.Error) {
+			const flowError = new Error(extractErrorMessage(response, t, "deviceGrant.messages.failed"));
+			setError(flowError);
+			setResult("failure");
+			onError?.(flowError);
+			return;
+		}
+		setResult(null);
+	}, [
+		meta,
+		onComplete,
+		onError,
+		t
+	]);
+	const startFlow = useCallback(async (appId) => {
+		setIsLoading(true);
+		setError(null);
+		try {
+			const response = await executeEmbeddedDeviceGrantFlow({
+				baseUrl,
+				payload: {
+					applicationId: appId,
+					flowType: EmbeddedFlowType.DeviceGrant,
+					inputs: {}
+				}
+			});
+			clearVerificationParameters();
+			applyResponse(response);
+		} catch (flowError) {
+			handleError(flowError instanceof Error ? flowError : new Error(t("deviceGrant.errors.continue")));
+		} finally {
+			setIsLoading(false);
+		}
+	}, [
+		applyResponse,
+		baseUrl,
+		handleError,
+		t
+	]);
+	useEffect(() => {
+		const url = new URL(window.location.href);
+		if (!verificationParametersRead.current) {
+			verificationParametersRead.current = true;
+			const userCode = url.searchParams.get("user_code") ?? "";
+			if (userCode) setInitialValues({ user_code: userCode });
+		}
+		const applicationIdFromUrl = url.searchParams.get("applicationId");
+		const appId = applicationIdFromUrl?.trim() ? applicationIdFromUrl : applicationId;
+		if (flowStartAttempted.current) return;
+		if (!appId) {
+			flowStartAttempted.current = true;
+			handleError(new Error(t("deviceGrant.errors.start")));
+			return;
+		}
+		flowStartAttempted.current = true;
+		startFlow(appId);
+	}, [
+		applicationId,
+		handleError,
+		startFlow,
+		t
+	]);
+	const submit = async (payload, actionId) => {
+		setIsLoading(true);
+		setError(null);
+		setResult(null);
+		try {
+			if (!executionId) return;
+			applyResponse(await executeEmbeddedDeviceGrantFlow({
+				baseUrl,
+				payload: {
+					action: payload.action ?? actionId,
+					challengeToken,
+					executionId,
+					inputs: {
+						...Object.fromEntries(Object.entries(payload.inputs ?? {}).filter(([key]) => !key.startsWith("__consent_opt__"))),
+						...!hasUserCodeInput(components) ? { user_code: void 0 } : {}
+					}
+				}
+			}));
+		} catch (flowError) {
+			handleError(flowError instanceof Error ? flowError : new Error(t("deviceGrant.errors.continue")));
+		} finally {
+			setIsLoading(false);
+		}
+	};
+	const handleBaseSubmit = (payload, component) => submit(payload, component.id);
+	const fieldErrors = useMemo(() => {
+		const errors = {};
+		(serverFieldErrors ?? []).forEach((fieldError) => {
+			if (!(fieldError.identifier in errors)) errors[fieldError.identifier] = fieldError.message;
+		});
+		return errors;
+	}, [serverFieldErrors]);
+	if (children) return /* @__PURE__ */ jsx(Fragment$1, { children: children({
+		additionalData,
+		components,
+		error,
+		fieldErrors,
+		initialValues,
+		isLoading,
+		meta,
+		onSubmit: submit,
+		result
+	}) });
+	return /* @__PURE__ */ jsx(BaseDeviceGrant_default, {
+		...baseProps,
+		className,
+		components,
+		additionalData,
+		error,
+		initialValues,
+		isLoading,
+		onError: handleError,
+		onSubmit: handleBaseSubmit,
+		preferences,
+		result,
+		serverFieldErrors,
+		size,
+		variant
+	});
+};
+var DeviceGrant_default = DeviceGrant;
+
+//#endregion
+export { DeviceGrant_default as default };
+//# sourceMappingURL=DeviceGrant.js.map