@carlonicora/nextjs-jsonapi 1.141.0 → 1.141.2

package/dist/server/index.mjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/server/cache.ts","../../src/server/ServerSession.ts","../../src/server/JsonApiServer.ts"],"sourcesContent":["// Server-only utilities (NOT server actions - these cannot be called from client components)\n\nimport { revalidateTag } from \"next/cache\";\n\nexport type CacheProfile = \"seconds\" | \"minutes\" | \"hours\" | \"days\" | \"weeks\" | \"max\" | \"default\";\n\n/**\n * Revalidate a cache tag to invalidate cached data.\n * Next.js 16+ requires a profile parameter.\n *\n * @param tag - The cache tag to invalidate\n * @param profile - The cache profile (defaults to \"max\" for immediate invalidation)\n */\nexport async function invalidateCacheTag(tag: string, profile: CacheProfile = \"max\"): Promise<void> {\n  revalidateTag(tag, profile);\n}\n\n/**\n * Revalidate multiple cache tags.\n *\n * @param tags - Array of cache tags to invalidate\n * @param profile - The cache profile (defaults to \"max\" for immediate invalidation)\n */\nexport async function invalidateCacheTags(tags: string[], profile: CacheProfile = \"max\"): Promise<void> {\n  for (const tag of tags) {\n    revalidateTag(tag, profile);\n  }\n}\n","import { cookies } from \"next/headers\";\nimport { redirect } from \"next/navigation\";\nimport pako from \"pako\";\nimport { Action, checkPermissionsFromServer, ModuleWithPermissions } from \"../permissions\";\n\nexport class ServerSession {\n  static async isLogged() {\n    const cookieStore = await cookies();\n    const token = cookieStore.get(\"token\");\n\n    if (!token || !token.value) return false;\n    return true;\n  }\n\n  static async companyId() {\n    const cookieStore = await cookies();\n    return cookieStore.get(\"companyId\")?.value ?? \"\";\n  }\n\n  static async userId() {\n    const cookieStore = await cookies();\n    return cookieStore.get(\"userId\")?.value ?? \"\";\n  }\n\n  static async checkPermission<M extends ModuleWithPermissions>(params: { module: M; action: Action; data?: any }) {\n    if (!(await this.hasPermissionToModule(params))) redirect(`/401`);\n  }\n\n  static async hasRole(roleId: string): Promise<boolean> {\n    const cookieStore = await cookies();\n    const roles = cookieStore.get(\"roles\")?.value;\n\n    if (!roles || !roles.includes(roleId)) return false;\n\n    return true;\n  }\n\n  static async hasFeature(featureId: string): Promise<boolean> {\n    const cookieStore = await cookies();\n    const features = cookieStore.get(\"features\")?.value;\n\n    if (!features || !features.includes(featureId)) return false;\n\n    return true;\n  }\n\n  static async hasPermissionToModule<M extends ModuleWithPermissions>(params: {\n    module: M;\n    action: Action;\n    data?: any;\n  }): Promise<boolean> {\n    const cookieStore = await cookies();\n\n    if (params.module.feature) {\n      const features = cookieStore.get(\"features\")?.value;\n\n      if (features && !features.includes(params.module.feature)) return false;\n    }\n\n    const rawModules = cookieStore.get(\"modules\")?.value;\n    if (!rawModules) return false;\n\n    const modules: {\n      id: string;\n      permissions: {\n        create: boolean | string;\n        read: boolean | string;\n        update: boolean | string;\n        delete: boolean | string;\n      };\n    }[] = JSON.parse(pako.ungzip(Buffer.from(rawModules, \"base64\"), { to: \"string\" }));\n\n    const selectedModule = modules.find((module) => module.id === params.module.moduleId);\n\n    return checkPermissionsFromServer({\n      module: params.module,\n      action: params.action,\n      data: params.data,\n      userId: await this.userId(),\n      selectedModule: selectedModule,\n    });\n\n    // if (!selectedModule) return false;\n\n    // if (!selectedModule.permissions[params.action]) return false;\n    // if (typeof selectedModule.permissions[params.action] === \"boolean\")\n    //   return selectedModule.permissions[params.action] as boolean;\n\n    // if (!params.data) return false;\n\n    // return params.data[selectedModule.permissions[params.action] as string] === this.userId;\n  }\n}\n","// Server-only utilities (NOT server actions - these cannot be called from client components)\n\nimport { JsonApiDataFactory } from \"../core/factories/JsonApiDataFactory\";\nimport { ApiRequestDataTypeInterface } from \"../core/interfaces/ApiRequestDataTypeInterface\";\nimport { ApiResponseInterface } from \"../core/interfaces/ApiResponseInterface\";\nimport { translateResponse } from \"../core/utils/translateResponse\";\nimport { ModuleWithPermissions } from \"../permissions/types\";\nimport { serverRequest } from \"./request\";\nimport { getServerToken } from \"./token\";\n\n// Config storage for server contexts\nlet _serverConfig: {\n  apiUrl: string;\n  appUrl?: string;\n  trackablePages?: ModuleWithPermissions[];\n  bootstrapper?: () => void;\n  additionalHeaders?: Record<string, string>;\n} | null = null;\n\n/**\n * Configure the JSON:API server client.\n * Call this in your Bootstrapper or server initialization.\n */\nexport function configureServerJsonApi(config: {\n  apiUrl: string;\n  appUrl?: string;\n  trackablePages?: ModuleWithPermissions[];\n  bootstrapper?: () => void;\n  additionalHeaders?: Record<string, string>;\n}): void {\n  _serverConfig = config;\n  if (config.bootstrapper) {\n    config.bootstrapper();\n  }\n}\n\nexport function getServerApiUrl(): string {\n  if (_serverConfig?.apiUrl) {\n    return _serverConfig.apiUrl;\n  }\n  const envUrl = process.env.NEXT_PUBLIC_API_URL;\n  if (!envUrl) {\n    throw new Error(\n      \"API URL not configured. Use configureServerJsonApi() or set NEXT_PUBLIC_API_URL environment variable.\",\n    );\n  }\n  return envUrl;\n}\n\nexport function getServerAppUrl(): string {\n  if (_serverConfig?.appUrl) {\n    return _serverConfig.appUrl;\n  }\n  const envUrl = process.env.NEXT_PUBLIC_ADDRESS;\n  if (!envUrl) {\n    throw new Error(\n      \"App URL not configured. Use configureServerJsonApi({ appUrl }) or set NEXT_PUBLIC_ADDRESS environment variable.\",\n    );\n  }\n  return envUrl.trim().replace(/\\/+$/, \"\");\n}\n\nexport function getServerTrackablePages(): ModuleWithPermissions[] {\n  return _serverConfig?.trackablePages ?? [];\n}\n\nfunction runServerBootstrapper(): void {\n  if (_serverConfig?.bootstrapper) {\n    _serverConfig.bootstrapper();\n  }\n}\n\nfunction buildServerUrl(endpoint: string): string {\n  const apiUrl = getServerApiUrl();\n  return endpoint.startsWith(\"http\") ? endpoint : `${apiUrl}${endpoint}`;\n}\n\nexport async function ServerJsonApiGet(params: {\n  classKey: ApiRequestDataTypeInterface;\n  endpoint: string;\n  companyId?: string;\n  language: string;\n}): Promise<ApiResponseInterface> {\n  runServerBootstrapper();\n  const token = await getServerToken();\n\n  const apiResponse = await serverRequest({\n    method: \"GET\",\n    url: buildServerUrl(params.endpoint),\n    token,\n    cache: params.classKey.cache,\n    companyId: params.companyId,\n    language: params.language,\n    additionalHeaders: _serverConfig?.additionalHeaders,\n  });\n\n  return translateResponse({\n    classKey: params.classKey,\n    apiResponse,\n    companyId: params.companyId,\n    language: params.language,\n    paginationHandler: async (endpoint: string) =>\n      ServerJsonApiGet({\n        classKey: params.classKey,\n        endpoint,\n        companyId: params.companyId,\n        language: params.language,\n      }),\n  });\n}\n\nexport async function ServerJsonApiPost(params: {\n  classKey: ApiRequestDataTypeInterface;\n  endpoint: string;\n  companyId?: string;\n  body?: any;\n  overridesJsonApiCreation?: boolean;\n  files?: { [key: string]: File | Blob } | File | Blob;\n  language: string;\n  responseType?: ApiRequestDataTypeInterface;\n}): Promise<ApiResponseInterface> {\n  runServerBootstrapper();\n  const token = await getServerToken();\n\n  let body = params.body;\n  if (!body) {\n    body = {};\n  } else if (params.overridesJsonApiCreation !== true) {\n    body = JsonApiDataFactory.create(params.classKey, body);\n  }\n\n  const apiResponse = await serverRequest({\n    method: \"POST\",\n    url: buildServerUrl(params.endpoint),\n    token,\n    body,\n    files: params.files,\n    companyId: params.companyId,\n    language: params.language,\n    additionalHeaders: _serverConfig?.additionalHeaders,\n  });\n\n  return translateResponse({\n    classKey: params.responseType ?? params.classKey,\n    apiResponse,\n    companyId: params.companyId,\n    language: params.language,\n  });\n}\n\nexport async function ServerJsonApiPut(params: {\n  classKey: ApiRequestDataTypeInterface;\n  endpoint: string;\n  companyId?: string;\n  body?: any;\n  files?: { [key: string]: File | Blob } | File | Blob;\n  language: string;\n  responseType?: ApiRequestDataTypeInterface;\n}): Promise<ApiResponseInterface> {\n  runServerBootstrapper();\n  const token = await getServerToken();\n\n  let body = params.body;\n  if (!body) {\n    body = {};\n  } else {\n    body = JsonApiDataFactory.create(params.classKey, body);\n  }\n\n  const apiResponse = await serverRequest({\n    method: \"PUT\",\n    url: buildServerUrl(params.endpoint),\n    token,\n    body,\n    files: params.files,\n    companyId: params.companyId,\n    language: params.language,\n    additionalHeaders: _serverConfig?.additionalHeaders,\n  });\n\n  return translateResponse({\n    classKey: params.responseType ?? params.classKey,\n    apiResponse,\n    companyId: params.companyId,\n    language: params.language,\n  });\n}\n\nexport async function ServerJsonApiPatch(params: {\n  classKey: ApiRequestDataTypeInterface;\n  endpoint: string;\n  companyId?: string;\n  body?: any;\n  files?: { [key: string]: File | Blob } | File | Blob;\n  overridesJsonApiCreation?: boolean;\n  responseType?: ApiRequestDataTypeInterface;\n  language: string;\n}): Promise<ApiResponseInterface> {\n  runServerBootstrapper();\n  const token = await getServerToken();\n\n  let body = params.body;\n  if (!body) {\n    body = {};\n  } else if (params.overridesJsonApiCreation !== true) {\n    body = JsonApiDataFactory.create(params.classKey, body);\n  }\n\n  const apiResponse = await serverRequest({\n    method: \"PATCH\",\n    url: buildServerUrl(params.endpoint),\n    token,\n    body,\n    files: params.files,\n    companyId: params.companyId,\n    language: params.language,\n    additionalHeaders: _serverConfig?.additionalHeaders,\n  });\n\n  return translateResponse({\n    classKey: params.responseType ?? params.classKey,\n    apiResponse,\n    companyId: params.companyId,\n    language: params.language,\n  });\n}\n\nexport async function ServerJsonApiDelete(params: {\n  classKey: ApiRequestDataTypeInterface;\n  endpoint: string;\n  companyId?: string;\n  language: string;\n  responseType?: ApiRequestDataTypeInterface;\n}): Promise<ApiResponseInterface> {\n  runServerBootstrapper();\n  const token = await getServerToken();\n\n  const apiResponse = await serverRequest({\n    method: \"DELETE\",\n    url: buildServerUrl(params.endpoint),\n    token,\n    companyId: params.companyId,\n    language: params.language,\n    additionalHeaders: _serverConfig?.additionalHeaders,\n  });\n\n  return translateResponse({\n    classKey: params.responseType ?? params.classKey,\n    apiResponse,\n    companyId: params.companyId,\n    language: params.language,\n  });\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAEA,SAAS,qBAAqB;AAW9B,eAAsB,mBAAmB,KAAa,UAAwB,OAAsB;AAClG,gBAAc,KAAK,OAAO;AAC5B;AAFsB;AAUtB,eAAsB,oBAAoB,MAAgB,UAAwB,OAAsB;AACtG,aAAW,OAAO,MAAM;AACtB,kBAAc,KAAK,OAAO;AAAA,EAC5B;AACF;AAJsB;;;ACvBtB,SAAS,eAAe;AACxB,SAAS,gBAAgB;AACzB,OAAO,UAAU;AAGV,IAAM,gBAAN,MAAoB;AAAA,EAL3B,OAK2B;AAAA;AAAA;AAAA,EACzB,aAAa,WAAW;AACtB,UAAM,cAAc,MAAM,QAAQ;AAClC,UAAM,QAAQ,YAAY,IAAI,OAAO;AAErC,QAAI,CAAC,SAAS,CAAC,MAAM,MAAO,QAAO;AACnC,WAAO;AAAA,EACT;AAAA,EAEA,aAAa,YAAY;AACvB,UAAM,cAAc,MAAM,QAAQ;AAClC,WAAO,YAAY,IAAI,WAAW,GAAG,SAAS;AAAA,EAChD;AAAA,EAEA,aAAa,SAAS;AACpB,UAAM,cAAc,MAAM,QAAQ;AAClC,WAAO,YAAY,IAAI,QAAQ,GAAG,SAAS;AAAA,EAC7C;AAAA,EAEA,aAAa,gBAAiD,QAAmD;AAC/G,QAAI,CAAE,MAAM,KAAK,sBAAsB,MAAM,EAAI,UAAS,MAAM;AAAA,EAClE;AAAA,EAEA,aAAa,QAAQ,QAAkC;AACrD,UAAM,cAAc,MAAM,QAAQ;AAClC,UAAM,QAAQ,YAAY,IAAI,OAAO,GAAG;AAExC,QAAI,CAAC,SAAS,CAAC,MAAM,SAAS,MAAM,EAAG,QAAO;AAE9C,WAAO;AAAA,EACT;AAAA,EAEA,aAAa,WAAW,WAAqC;AAC3D,UAAM,cAAc,MAAM,QAAQ;AAClC,UAAM,WAAW,YAAY,IAAI,UAAU,GAAG;AAE9C,QAAI,CAAC,YAAY,CAAC,SAAS,SAAS,SAAS,EAAG,QAAO;AAEvD,WAAO;AAAA,EACT;AAAA,EAEA,aAAa,sBAAuD,QAI/C;AACnB,UAAM,cAAc,MAAM,QAAQ;AAElC,QAAI,OAAO,OAAO,SAAS;AACzB,YAAM,WAAW,YAAY,IAAI,UAAU,GAAG;AAE9C,UAAI,YAAY,CAAC,SAAS,SAAS,OAAO,OAAO,OAAO,EAAG,QAAO;AAAA,IACpE;AAEA,UAAM,aAAa,YAAY,IAAI,SAAS,GAAG;AAC/C,QAAI,CAAC,WAAY,QAAO;AAExB,UAAM,UAQA,KAAK,MAAM,KAAK,OAAO,OAAO,KAAK,YAAY,QAAQ,GAAG,EAAE,IAAI,SAAS,CAAC,CAAC;AAEjF,UAAM,iBAAiB,QAAQ,KAAK,CAAC,WAAW,OAAO,OAAO,OAAO,OAAO,QAAQ;AAEpF,WAAO,2BAA2B;AAAA,MAChC,QAAQ,OAAO;AAAA,MACf,QAAQ,OAAO;AAAA,MACf,MAAM,OAAO;AAAA,MACb,QAAQ,MAAM,KAAK,OAAO;AAAA,MAC1B;AAAA,IACF,CAAC;AAAA,EAWH;AACF;;;ACjFA,IAAI,gBAMO;AAMJ,SAAS,uBAAuB,QAM9B;AACP,kBAAgB;AAChB,MAAI,OAAO,cAAc;AACvB,WAAO,aAAa;AAAA,EACtB;AACF;AAXgB;AAaT,SAAS,kBAA0B;AACxC,MAAI,eAAe,QAAQ;AACzB,WAAO,cAAc;AAAA,EACvB;AACA,QAAM,SAAS,QAAQ,IAAI;AAC3B,MAAI,CAAC,QAAQ;AACX,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,SAAO;AACT;AAXgB;AAaT,SAAS,kBAA0B;AACxC,MAAI,eAAe,QAAQ;AACzB,WAAO,cAAc;AAAA,EACvB;AACA,QAAM,SAAS,QAAQ,IAAI;AAC3B,MAAI,CAAC,QAAQ;AACX,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,SAAO,OAAO,KAAK,EAAE,QAAQ,QAAQ,EAAE;AACzC;AAXgB;AAaT,SAAS,0BAAmD;AACjE,SAAO,eAAe,kBAAkB,CAAC;AAC3C;AAFgB;AAIhB,SAAS,wBAA8B;AACrC,MAAI,eAAe,cAAc;AAC/B,kBAAc,aAAa;AAAA,EAC7B;AACF;AAJS;AAMT,SAAS,eAAe,UAA0B;AAChD,QAAM,SAAS,gBAAgB;AAC/B,SAAO,SAAS,WAAW,MAAM,IAAI,WAAW,GAAG,MAAM,GAAG,QAAQ;AACtE;AAHS;AAKT,eAAsB,iBAAiB,QAKL;AAChC,wBAAsB;AACtB,QAAM,QAAQ,MAAM,eAAe;AAEnC,QAAM,cAAc,MAAM,cAAc;AAAA,IACtC,QAAQ;AAAA,IACR,KAAK,eAAe,OAAO,QAAQ;AAAA,IACnC;AAAA,IACA,OAAO,OAAO,SAAS;AAAA,IACvB,WAAW,OAAO;AAAA,IAClB,UAAU,OAAO;AAAA,IACjB,mBAAmB,eAAe;AAAA,EACpC,CAAC;AAED,SAAO,kBAAkB;AAAA,IACvB,UAAU,OAAO;AAAA,IACjB;AAAA,IACA,WAAW,OAAO;AAAA,IAClB,UAAU,OAAO;AAAA,IACjB,mBAAmB,8BAAO,aACxB,iBAAiB;AAAA,MACf,UAAU,OAAO;AAAA,MACjB;AAAA,MACA,WAAW,OAAO;AAAA,MAClB,UAAU,OAAO;AAAA,IACnB,CAAC,GANgB;AAAA,EAOrB,CAAC;AACH;AAhCsB;AAkCtB,eAAsB,kBAAkB,QASN;AAChC,wBAAsB;AACtB,QAAM,QAAQ,MAAM,eAAe;AAEnC,MAAI,OAAO,OAAO;AAClB,MAAI,CAAC,MAAM;AACT,WAAO,CAAC;AAAA,EACV,WAAW,OAAO,6BAA6B,MAAM;AACnD,WAAO,mBAAmB,OAAO,OAAO,UAAU,IAAI;AAAA,EACxD;AAEA,QAAM,cAAc,MAAM,cAAc;AAAA,IACtC,QAAQ;AAAA,IACR,KAAK,eAAe,OAAO,QAAQ;AAAA,IACnC;AAAA,IACA;AAAA,IACA,OAAO,OAAO;AAAA,IACd,WAAW,OAAO;AAAA,IAClB,UAAU,OAAO;AAAA,IACjB,mBAAmB,eAAe;AAAA,EACpC,CAAC;AAED,SAAO,kBAAkB;AAAA,IACvB,UAAU,OAAO,gBAAgB,OAAO;AAAA,IACxC;AAAA,IACA,WAAW,OAAO;AAAA,IAClB,UAAU,OAAO;AAAA,EACnB,CAAC;AACH;AArCsB;AAuCtB,eAAsB,iBAAiB,QAQL;AAChC,wBAAsB;AACtB,QAAM,QAAQ,MAAM,eAAe;AAEnC,MAAI,OAAO,OAAO;AAClB,MAAI,CAAC,MAAM;AACT,WAAO,CAAC;AAAA,EACV,OAAO;AACL,WAAO,mBAAmB,OAAO,OAAO,UAAU,IAAI;AAAA,EACxD;AAEA,QAAM,cAAc,MAAM,cAAc;AAAA,IACtC,QAAQ;AAAA,IACR,KAAK,eAAe,OAAO,QAAQ;AAAA,IACnC;AAAA,IACA;AAAA,IACA,OAAO,OAAO;AAAA,IACd,WAAW,OAAO;AAAA,IAClB,UAAU,OAAO;AAAA,IACjB,mBAAmB,eAAe;AAAA,EACpC,CAAC;AAED,SAAO,kBAAkB;AAAA,IACvB,UAAU,OAAO,gBAAgB,OAAO;AAAA,IACxC;AAAA,IACA,WAAW,OAAO;AAAA,IAClB,UAAU,OAAO;AAAA,EACnB,CAAC;AACH;AApCsB;AAsCtB,eAAsB,mBAAmB,QASP;AAChC,wBAAsB;AACtB,QAAM,QAAQ,MAAM,eAAe;AAEnC,MAAI,OAAO,OAAO;AAClB,MAAI,CAAC,MAAM;AACT,WAAO,CAAC;AAAA,EACV,WAAW,OAAO,6BAA6B,MAAM;AACnD,WAAO,mBAAmB,OAAO,OAAO,UAAU,IAAI;AAAA,EACxD;AAEA,QAAM,cAAc,MAAM,cAAc;AAAA,IACtC,QAAQ;AAAA,IACR,KAAK,eAAe,OAAO,QAAQ;AAAA,IACnC;AAAA,IACA;AAAA,IACA,OAAO,OAAO;AAAA,IACd,WAAW,OAAO;AAAA,IAClB,UAAU,OAAO;AAAA,IACjB,mBAAmB,eAAe;AAAA,EACpC,CAAC;AAED,SAAO,kBAAkB;AAAA,IACvB,UAAU,OAAO,gBAAgB,OAAO;AAAA,IACxC;AAAA,IACA,WAAW,OAAO;AAAA,IAClB,UAAU,OAAO;AAAA,EACnB,CAAC;AACH;AArCsB;AAuCtB,eAAsB,oBAAoB,QAMR;AAChC,wBAAsB;AACtB,QAAM,QAAQ,MAAM,eAAe;AAEnC,QAAM,cAAc,MAAM,cAAc;AAAA,IACtC,QAAQ;AAAA,IACR,KAAK,eAAe,OAAO,QAAQ;AAAA,IACnC;AAAA,IACA,WAAW,OAAO;AAAA,IAClB,UAAU,OAAO;AAAA,IACjB,mBAAmB,eAAe;AAAA,EACpC,CAAC;AAED,SAAO,kBAAkB;AAAA,IACvB,UAAU,OAAO,gBAAgB,OAAO;AAAA,IACxC;AAAA,IACA,WAAW,OAAO;AAAA,IAClB,UAAU,OAAO;AAAA,EACnB,CAAC;AACH;AAzBsB;","names":[]}
+{"version":3,"sources":["../../src/server/cache.ts","../../src/server/ServerSession.ts","../../src/server/JsonApiServer.ts"],"sourcesContent":["// Server-only utilities (NOT server actions - these cannot be called from client components)\n\nimport { revalidateTag } from \"next/cache\";\n\nexport type CacheProfile = \"seconds\" | \"minutes\" | \"hours\" | \"days\" | \"weeks\" | \"max\" | \"default\";\n\n/**\n * Revalidate a cache tag to invalidate cached data.\n * Next.js 16+ requires a profile parameter.\n *\n * @param tag - The cache tag to invalidate\n * @param profile - The cache profile (defaults to \"max\" for immediate invalidation)\n */\nexport async function invalidateCacheTag(tag: string, profile: CacheProfile = \"max\"): Promise<void> {\n  revalidateTag(tag, profile);\n}\n\n/**\n * Revalidate multiple cache tags.\n *\n * @param tags - Array of cache tags to invalidate\n * @param profile - The cache profile (defaults to \"max\" for immediate invalidation)\n */\nexport async function invalidateCacheTags(tags: string[], profile: CacheProfile = \"max\"): Promise<void> {\n  for (const tag of tags) {\n    revalidateTag(tag, profile);\n  }\n}\n","import { cookies } from \"next/headers\";\nimport { redirect } from \"next/navigation\";\nimport { ungzip } from \"pako\";\nimport { Action, checkPermissionsFromServer, ModuleWithPermissions } from \"../permissions\";\n\nexport class ServerSession {\n  static async isLogged() {\n    const cookieStore = await cookies();\n    const token = cookieStore.get(\"token\");\n\n    if (!token || !token.value) return false;\n    return true;\n  }\n\n  static async companyId() {\n    const cookieStore = await cookies();\n    return cookieStore.get(\"companyId\")?.value ?? \"\";\n  }\n\n  static async userId() {\n    const cookieStore = await cookies();\n    return cookieStore.get(\"userId\")?.value ?? \"\";\n  }\n\n  static async checkPermission<M extends ModuleWithPermissions>(params: { module: M; action: Action; data?: any }) {\n    if (!(await this.hasPermissionToModule(params))) redirect(`/401`);\n  }\n\n  static async hasRole(roleId: string): Promise<boolean> {\n    const cookieStore = await cookies();\n    const roles = cookieStore.get(\"roles\")?.value;\n\n    if (!roles || !roles.includes(roleId)) return false;\n\n    return true;\n  }\n\n  static async hasFeature(featureId: string): Promise<boolean> {\n    const cookieStore = await cookies();\n    const features = cookieStore.get(\"features\")?.value;\n\n    if (!features || !features.includes(featureId)) return false;\n\n    return true;\n  }\n\n  static async hasPermissionToModule<M extends ModuleWithPermissions>(params: {\n    module: M;\n    action: Action;\n    data?: any;\n  }): Promise<boolean> {\n    const cookieStore = await cookies();\n\n    if (params.module.feature) {\n      const features = cookieStore.get(\"features\")?.value;\n\n      if (features && !features.includes(params.module.feature)) return false;\n    }\n\n    const rawModules = cookieStore.get(\"modules\")?.value;\n    if (!rawModules) return false;\n\n    const modules: {\n      id: string;\n      permissions: {\n        create: boolean | string;\n        read: boolean | string;\n        update: boolean | string;\n        delete: boolean | string;\n      };\n    }[] = JSON.parse(ungzip(Buffer.from(rawModules, \"base64\"), { toText: true }));\n\n    const selectedModule = modules.find((module) => module.id === params.module.moduleId);\n\n    return checkPermissionsFromServer({\n      module: params.module,\n      action: params.action,\n      data: params.data,\n      userId: await this.userId(),\n      selectedModule: selectedModule,\n    });\n\n    // if (!selectedModule) return false;\n\n    // if (!selectedModule.permissions[params.action]) return false;\n    // if (typeof selectedModule.permissions[params.action] === \"boolean\")\n    //   return selectedModule.permissions[params.action] as boolean;\n\n    // if (!params.data) return false;\n\n    // return params.data[selectedModule.permissions[params.action] as string] === this.userId;\n  }\n}\n","// Server-only utilities (NOT server actions - these cannot be called from client components)\n\nimport { JsonApiDataFactory } from \"../core/factories/JsonApiDataFactory\";\nimport { ApiRequestDataTypeInterface } from \"../core/interfaces/ApiRequestDataTypeInterface\";\nimport { ApiResponseInterface } from \"../core/interfaces/ApiResponseInterface\";\nimport { translateResponse } from \"../core/utils/translateResponse\";\nimport { ModuleWithPermissions } from \"../permissions/types\";\nimport { serverRequest } from \"./request\";\nimport { getServerToken } from \"./token\";\n\n// Config storage for server contexts\nlet _serverConfig: {\n  apiUrl: string;\n  appUrl?: string;\n  trackablePages?: ModuleWithPermissions[];\n  bootstrapper?: () => void;\n  additionalHeaders?: Record<string, string>;\n} | null = null;\n\n/**\n * Configure the JSON:API server client.\n * Call this in your Bootstrapper or server initialization.\n */\nexport function configureServerJsonApi(config: {\n  apiUrl: string;\n  appUrl?: string;\n  trackablePages?: ModuleWithPermissions[];\n  bootstrapper?: () => void;\n  additionalHeaders?: Record<string, string>;\n}): void {\n  _serverConfig = config;\n  if (config.bootstrapper) {\n    config.bootstrapper();\n  }\n}\n\nexport function getServerApiUrl(): string {\n  if (_serverConfig?.apiUrl) {\n    return _serverConfig.apiUrl;\n  }\n  const envUrl = process.env.NEXT_PUBLIC_API_URL;\n  if (!envUrl) {\n    throw new Error(\n      \"API URL not configured. Use configureServerJsonApi() or set NEXT_PUBLIC_API_URL environment variable.\",\n    );\n  }\n  return envUrl;\n}\n\nexport function getServerAppUrl(): string {\n  if (_serverConfig?.appUrl) {\n    return _serverConfig.appUrl;\n  }\n  const envUrl = process.env.NEXT_PUBLIC_ADDRESS;\n  if (!envUrl) {\n    throw new Error(\n      \"App URL not configured. Use configureServerJsonApi({ appUrl }) or set NEXT_PUBLIC_ADDRESS environment variable.\",\n    );\n  }\n  return envUrl.trim().replace(/\\/+$/, \"\");\n}\n\nexport function getServerTrackablePages(): ModuleWithPermissions[] {\n  return _serverConfig?.trackablePages ?? [];\n}\n\nfunction runServerBootstrapper(): void {\n  if (_serverConfig?.bootstrapper) {\n    _serverConfig.bootstrapper();\n  }\n}\n\nfunction buildServerUrl(endpoint: string): string {\n  const apiUrl = getServerApiUrl();\n  return endpoint.startsWith(\"http\") ? endpoint : `${apiUrl}${endpoint}`;\n}\n\nexport async function ServerJsonApiGet(params: {\n  classKey: ApiRequestDataTypeInterface;\n  endpoint: string;\n  companyId?: string;\n  language: string;\n}): Promise<ApiResponseInterface> {\n  runServerBootstrapper();\n  const token = await getServerToken();\n\n  const apiResponse = await serverRequest({\n    method: \"GET\",\n    url: buildServerUrl(params.endpoint),\n    token,\n    cache: params.classKey.cache,\n    companyId: params.companyId,\n    language: params.language,\n    additionalHeaders: _serverConfig?.additionalHeaders,\n  });\n\n  return translateResponse({\n    classKey: params.classKey,\n    apiResponse,\n    companyId: params.companyId,\n    language: params.language,\n    paginationHandler: async (endpoint: string) =>\n      ServerJsonApiGet({\n        classKey: params.classKey,\n        endpoint,\n        companyId: params.companyId,\n        language: params.language,\n      }),\n  });\n}\n\nexport async function ServerJsonApiPost(params: {\n  classKey: ApiRequestDataTypeInterface;\n  endpoint: string;\n  companyId?: string;\n  body?: any;\n  overridesJsonApiCreation?: boolean;\n  files?: { [key: string]: File | Blob } | File | Blob;\n  language: string;\n  responseType?: ApiRequestDataTypeInterface;\n}): Promise<ApiResponseInterface> {\n  runServerBootstrapper();\n  const token = await getServerToken();\n\n  let body = params.body;\n  if (!body) {\n    body = {};\n  } else if (params.overridesJsonApiCreation !== true) {\n    body = JsonApiDataFactory.create(params.classKey, body);\n  }\n\n  const apiResponse = await serverRequest({\n    method: \"POST\",\n    url: buildServerUrl(params.endpoint),\n    token,\n    body,\n    files: params.files,\n    companyId: params.companyId,\n    language: params.language,\n    additionalHeaders: _serverConfig?.additionalHeaders,\n  });\n\n  return translateResponse({\n    classKey: params.responseType ?? params.classKey,\n    apiResponse,\n    companyId: params.companyId,\n    language: params.language,\n  });\n}\n\nexport async function ServerJsonApiPut(params: {\n  classKey: ApiRequestDataTypeInterface;\n  endpoint: string;\n  companyId?: string;\n  body?: any;\n  files?: { [key: string]: File | Blob } | File | Blob;\n  language: string;\n  responseType?: ApiRequestDataTypeInterface;\n}): Promise<ApiResponseInterface> {\n  runServerBootstrapper();\n  const token = await getServerToken();\n\n  let body = params.body;\n  if (!body) {\n    body = {};\n  } else {\n    body = JsonApiDataFactory.create(params.classKey, body);\n  }\n\n  const apiResponse = await serverRequest({\n    method: \"PUT\",\n    url: buildServerUrl(params.endpoint),\n    token,\n    body,\n    files: params.files,\n    companyId: params.companyId,\n    language: params.language,\n    additionalHeaders: _serverConfig?.additionalHeaders,\n  });\n\n  return translateResponse({\n    classKey: params.responseType ?? params.classKey,\n    apiResponse,\n    companyId: params.companyId,\n    language: params.language,\n  });\n}\n\nexport async function ServerJsonApiPatch(params: {\n  classKey: ApiRequestDataTypeInterface;\n  endpoint: string;\n  companyId?: string;\n  body?: any;\n  files?: { [key: string]: File | Blob } | File | Blob;\n  overridesJsonApiCreation?: boolean;\n  responseType?: ApiRequestDataTypeInterface;\n  language: string;\n}): Promise<ApiResponseInterface> {\n  runServerBootstrapper();\n  const token = await getServerToken();\n\n  let body = params.body;\n  if (!body) {\n    body = {};\n  } else if (params.overridesJsonApiCreation !== true) {\n    body = JsonApiDataFactory.create(params.classKey, body);\n  }\n\n  const apiResponse = await serverRequest({\n    method: \"PATCH\",\n    url: buildServerUrl(params.endpoint),\n    token,\n    body,\n    files: params.files,\n    companyId: params.companyId,\n    language: params.language,\n    additionalHeaders: _serverConfig?.additionalHeaders,\n  });\n\n  return translateResponse({\n    classKey: params.responseType ?? params.classKey,\n    apiResponse,\n    companyId: params.companyId,\n    language: params.language,\n  });\n}\n\nexport async function ServerJsonApiDelete(params: {\n  classKey: ApiRequestDataTypeInterface;\n  endpoint: string;\n  companyId?: string;\n  language: string;\n  responseType?: ApiRequestDataTypeInterface;\n}): Promise<ApiResponseInterface> {\n  runServerBootstrapper();\n  const token = await getServerToken();\n\n  const apiResponse = await serverRequest({\n    method: \"DELETE\",\n    url: buildServerUrl(params.endpoint),\n    token,\n    companyId: params.companyId,\n    language: params.language,\n    additionalHeaders: _serverConfig?.additionalHeaders,\n  });\n\n  return translateResponse({\n    classKey: params.responseType ?? params.classKey,\n    apiResponse,\n    companyId: params.companyId,\n    language: params.language,\n  });\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAEA,SAAS,qBAAqB;AAW9B,eAAsB,mBAAmB,KAAa,UAAwB,OAAsB;AAClG,gBAAc,KAAK,OAAO;AAC5B;AAFsB;AAUtB,eAAsB,oBAAoB,MAAgB,UAAwB,OAAsB;AACtG,aAAW,OAAO,MAAM;AACtB,kBAAc,KAAK,OAAO;AAAA,EAC5B;AACF;AAJsB;;;ACvBtB,SAAS,eAAe;AACxB,SAAS,gBAAgB;AACzB,SAAS,cAAc;AAGhB,IAAM,gBAAN,MAAoB;AAAA,EAL3B,OAK2B;AAAA;AAAA;AAAA,EACzB,aAAa,WAAW;AACtB,UAAM,cAAc,MAAM,QAAQ;AAClC,UAAM,QAAQ,YAAY,IAAI,OAAO;AAErC,QAAI,CAAC,SAAS,CAAC,MAAM,MAAO,QAAO;AACnC,WAAO;AAAA,EACT;AAAA,EAEA,aAAa,YAAY;AACvB,UAAM,cAAc,MAAM,QAAQ;AAClC,WAAO,YAAY,IAAI,WAAW,GAAG,SAAS;AAAA,EAChD;AAAA,EAEA,aAAa,SAAS;AACpB,UAAM,cAAc,MAAM,QAAQ;AAClC,WAAO,YAAY,IAAI,QAAQ,GAAG,SAAS;AAAA,EAC7C;AAAA,EAEA,aAAa,gBAAiD,QAAmD;AAC/G,QAAI,CAAE,MAAM,KAAK,sBAAsB,MAAM,EAAI,UAAS,MAAM;AAAA,EAClE;AAAA,EAEA,aAAa,QAAQ,QAAkC;AACrD,UAAM,cAAc,MAAM,QAAQ;AAClC,UAAM,QAAQ,YAAY,IAAI,OAAO,GAAG;AAExC,QAAI,CAAC,SAAS,CAAC,MAAM,SAAS,MAAM,EAAG,QAAO;AAE9C,WAAO;AAAA,EACT;AAAA,EAEA,aAAa,WAAW,WAAqC;AAC3D,UAAM,cAAc,MAAM,QAAQ;AAClC,UAAM,WAAW,YAAY,IAAI,UAAU,GAAG;AAE9C,QAAI,CAAC,YAAY,CAAC,SAAS,SAAS,SAAS,EAAG,QAAO;AAEvD,WAAO;AAAA,EACT;AAAA,EAEA,aAAa,sBAAuD,QAI/C;AACnB,UAAM,cAAc,MAAM,QAAQ;AAElC,QAAI,OAAO,OAAO,SAAS;AACzB,YAAM,WAAW,YAAY,IAAI,UAAU,GAAG;AAE9C,UAAI,YAAY,CAAC,SAAS,SAAS,OAAO,OAAO,OAAO,EAAG,QAAO;AAAA,IACpE;AAEA,UAAM,aAAa,YAAY,IAAI,SAAS,GAAG;AAC/C,QAAI,CAAC,WAAY,QAAO;AAExB,UAAM,UAQA,KAAK,MAAM,OAAO,OAAO,KAAK,YAAY,QAAQ,GAAG,EAAE,QAAQ,KAAK,CAAC,CAAC;AAE5E,UAAM,iBAAiB,QAAQ,KAAK,CAAC,WAAW,OAAO,OAAO,OAAO,OAAO,QAAQ;AAEpF,WAAO,2BAA2B;AAAA,MAChC,QAAQ,OAAO;AAAA,MACf,QAAQ,OAAO;AAAA,MACf,MAAM,OAAO;AAAA,MACb,QAAQ,MAAM,KAAK,OAAO;AAAA,MAC1B;AAAA,IACF,CAAC;AAAA,EAWH;AACF;;;ACjFA,IAAI,gBAMO;AAMJ,SAAS,uBAAuB,QAM9B;AACP,kBAAgB;AAChB,MAAI,OAAO,cAAc;AACvB,WAAO,aAAa;AAAA,EACtB;AACF;AAXgB;AAaT,SAAS,kBAA0B;AACxC,MAAI,eAAe,QAAQ;AACzB,WAAO,cAAc;AAAA,EACvB;AACA,QAAM,SAAS,QAAQ,IAAI;AAC3B,MAAI,CAAC,QAAQ;AACX,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,SAAO;AACT;AAXgB;AAaT,SAAS,kBAA0B;AACxC,MAAI,eAAe,QAAQ;AACzB,WAAO,cAAc;AAAA,EACvB;AACA,QAAM,SAAS,QAAQ,IAAI;AAC3B,MAAI,CAAC,QAAQ;AACX,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,SAAO,OAAO,KAAK,EAAE,QAAQ,QAAQ,EAAE;AACzC;AAXgB;AAaT,SAAS,0BAAmD;AACjE,SAAO,eAAe,kBAAkB,CAAC;AAC3C;AAFgB;AAIhB,SAAS,wBAA8B;AACrC,MAAI,eAAe,cAAc;AAC/B,kBAAc,aAAa;AAAA,EAC7B;AACF;AAJS;AAMT,SAAS,eAAe,UAA0B;AAChD,QAAM,SAAS,gBAAgB;AAC/B,SAAO,SAAS,WAAW,MAAM,IAAI,WAAW,GAAG,MAAM,GAAG,QAAQ;AACtE;AAHS;AAKT,eAAsB,iBAAiB,QAKL;AAChC,wBAAsB;AACtB,QAAM,QAAQ,MAAM,eAAe;AAEnC,QAAM,cAAc,MAAM,cAAc;AAAA,IACtC,QAAQ;AAAA,IACR,KAAK,eAAe,OAAO,QAAQ;AAAA,IACnC;AAAA,IACA,OAAO,OAAO,SAAS;AAAA,IACvB,WAAW,OAAO;AAAA,IAClB,UAAU,OAAO;AAAA,IACjB,mBAAmB,eAAe;AAAA,EACpC,CAAC;AAED,SAAO,kBAAkB;AAAA,IACvB,UAAU,OAAO;AAAA,IACjB;AAAA,IACA,WAAW,OAAO;AAAA,IAClB,UAAU,OAAO;AAAA,IACjB,mBAAmB,8BAAO,aACxB,iBAAiB;AAAA,MACf,UAAU,OAAO;AAAA,MACjB;AAAA,MACA,WAAW,OAAO;AAAA,MAClB,UAAU,OAAO;AAAA,IACnB,CAAC,GANgB;AAAA,EAOrB,CAAC;AACH;AAhCsB;AAkCtB,eAAsB,kBAAkB,QASN;AAChC,wBAAsB;AACtB,QAAM,QAAQ,MAAM,eAAe;AAEnC,MAAI,OAAO,OAAO;AAClB,MAAI,CAAC,MAAM;AACT,WAAO,CAAC;AAAA,EACV,WAAW,OAAO,6BAA6B,MAAM;AACnD,WAAO,mBAAmB,OAAO,OAAO,UAAU,IAAI;AAAA,EACxD;AAEA,QAAM,cAAc,MAAM,cAAc;AAAA,IACtC,QAAQ;AAAA,IACR,KAAK,eAAe,OAAO,QAAQ;AAAA,IACnC;AAAA,IACA;AAAA,IACA,OAAO,OAAO;AAAA,IACd,WAAW,OAAO;AAAA,IAClB,UAAU,OAAO;AAAA,IACjB,mBAAmB,eAAe;AAAA,EACpC,CAAC;AAED,SAAO,kBAAkB;AAAA,IACvB,UAAU,OAAO,gBAAgB,OAAO;AAAA,IACxC;AAAA,IACA,WAAW,OAAO;AAAA,IAClB,UAAU,OAAO;AAAA,EACnB,CAAC;AACH;AArCsB;AAuCtB,eAAsB,iBAAiB,QAQL;AAChC,wBAAsB;AACtB,QAAM,QAAQ,MAAM,eAAe;AAEnC,MAAI,OAAO,OAAO;AAClB,MAAI,CAAC,MAAM;AACT,WAAO,CAAC;AAAA,EACV,OAAO;AACL,WAAO,mBAAmB,OAAO,OAAO,UAAU,IAAI;AAAA,EACxD;AAEA,QAAM,cAAc,MAAM,cAAc;AAAA,IACtC,QAAQ;AAAA,IACR,KAAK,eAAe,OAAO,QAAQ;AAAA,IACnC;AAAA,IACA;AAAA,IACA,OAAO,OAAO;AAAA,IACd,WAAW,OAAO;AAAA,IAClB,UAAU,OAAO;AAAA,IACjB,mBAAmB,eAAe;AAAA,EACpC,CAAC;AAED,SAAO,kBAAkB;AAAA,IACvB,UAAU,OAAO,gBAAgB,OAAO;AAAA,IACxC;AAAA,IACA,WAAW,OAAO;AAAA,IAClB,UAAU,OAAO;AAAA,EACnB,CAAC;AACH;AApCsB;AAsCtB,eAAsB,mBAAmB,QASP;AAChC,wBAAsB;AACtB,QAAM,QAAQ,MAAM,eAAe;AAEnC,MAAI,OAAO,OAAO;AAClB,MAAI,CAAC,MAAM;AACT,WAAO,CAAC;AAAA,EACV,WAAW,OAAO,6BAA6B,MAAM;AACnD,WAAO,mBAAmB,OAAO,OAAO,UAAU,IAAI;AAAA,EACxD;AAEA,QAAM,cAAc,MAAM,cAAc;AAAA,IACtC,QAAQ;AAAA,IACR,KAAK,eAAe,OAAO,QAAQ;AAAA,IACnC;AAAA,IACA;AAAA,IACA,OAAO,OAAO;AAAA,IACd,WAAW,OAAO;AAAA,IAClB,UAAU,OAAO;AAAA,IACjB,mBAAmB,eAAe;AAAA,EACpC,CAAC;AAED,SAAO,kBAAkB;AAAA,IACvB,UAAU,OAAO,gBAAgB,OAAO;AAAA,IACxC;AAAA,IACA,WAAW,OAAO;AAAA,IAClB,UAAU,OAAO;AAAA,EACnB,CAAC;AACH;AArCsB;AAuCtB,eAAsB,oBAAoB,QAMR;AAChC,wBAAsB;AACtB,QAAM,QAAQ,MAAM,eAAe;AAEnC,QAAM,cAAc,MAAM,cAAc;AAAA,IACtC,QAAQ;AAAA,IACR,KAAK,eAAe,OAAO,QAAQ;AAAA,IACnC;AAAA,IACA,WAAW,OAAO;AAAA,IAClB,UAAU,OAAO;AAAA,IACjB,mBAAmB,eAAe;AAAA,EACpC,CAAC;AAED,SAAO,kBAAkB;AAAA,IACvB,UAAU,OAAO,gBAAgB,OAAO;AAAA,IACxC;AAAA,IACA,WAAW,OAAO;AAAA,IAClB,UAAU,OAAO;AAAA,EACnB,CAAC;AACH;AAzBsB;","names":[]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@carlonicora/nextjs-jsonapi",
-  "version": "1.141.0",
+  "version": "1.141.2",
   "description": "Next.js JSON:API client with server/client support and caching",
   "author": "Carlo Nicora",
   "license": "GPL-3.0-or-later",
@@ -112,96 +112,95 @@
     }
   },
   "dependencies": {
-    "@base-ui/react": "1.5.0",
-    "@blocknote/core": "^0.51.2",
-    "@blocknote/react": "^0.51.2",
-    "@blocknote/shadcn": "^0.51.2",
-    "@blocknote/xl-ai": "^0.51.2",
-    "ai": "^6.0.5",
+    "@base-ui/react": "1.6.0",
+    "@blocknote/core": "^0.52.1",
+    "@blocknote/react": "^0.52.1",
+    "@blocknote/shadcn": "^0.52.1",
+    "@blocknote/xl-ai": "^0.52.1",
     "@dnd-kit/core": "^6.3.1",
     "@dnd-kit/sortable": "^10.0.0",
     "@dnd-kit/utilities": "^3.2.2",
-    "@floating-ui/react": "^0.27.19",
+    "@floating-ui/react": "^0.27.20",
     "@handlewithcare/prosemirror-inputrules": "^0.1.4",
-    "@hookform/resolvers": "^5.4.0",
-    "@radix-ui/react-label": "^2.1.8",
-    "@radix-ui/react-slot": "^1.2.4",
+    "@hookform/resolvers": "^5.5.7",
+    "@radix-ui/react-label": "^2.1.15",
+    "@radix-ui/react-slot": "^1.3.3",
     "@simplewebauthn/browser": "^13.3.0",
+    "ai": "^6.0.238",
     "class-variance-authority": "^0.7.1",
     "clsx": "^2.1.1",
     "cmdk": "^1.1.1",
     "codice-fiscale-js": "^2.3.23",
-    "commander": "^14.0.3",
+    "commander": "^15.0.0",
     "cookies-next": "^6.1.1",
     "d3": "^7.9.0",
     "dagre": "^0.8.5",
-    "date-fns": "^4.2.1",
+    "date-fns": "^4.4.0",
     "embla-carousel-react": "^8.6.0",
+    "fuse.js": "^7.5.0",
     "input-otp": "^1.4.2",
-    "jotai": "^2.20.0",
-    "jotai-family": "^1.0.2",
-    "lucide-react": "^1.16.0",
+    "jotai": "^2.20.2",
+    "jotai-family": "^1.1.0",
+    "lucide-react": "^1.28.0",
+    "next-mdx-remote": "^6.0.0",
     "next-themes": "^0.4.6",
-    "pako": "^2.1.0",
+    "pako": "^3.0.1",
     "qrcode.react": "^4.2.0",
-    "react-day-picker": "^9.13.0",
-    "react-dropzone": "^15.0.0",
-    "react-hook-form": "^7.76.0",
+    "react-day-picker": "^10.0.1",
+    "react-dropzone": "^19.1.1",
+    "react-hook-form": "7.83.0",
     "react-markdown": "^10.1.0",
-    "react-resizable-panels": "^4.11.1",
-    "recharts": "^3.8.1",
-    "fuse.js": "^7.0.0",
-    "next-mdx-remote": "^5.0.0",
+    "react-resizable-panels": "^4.12.2",
+    "recharts": "^3.10.1",
     "rehype-autolink-headings": "^7.1.0",
     "rehype-slug": "^6.0.0",
     "remark-gfm": "^4.0.1",
-    "shadcn": "^4.8.0",
+    "shadcn": "^4.16.1",
     "shepherd.js": "^15.2.2",
     "socket.io-client": "^4.8.3",
     "sonner": "^2.0.7",
     "tailwind-merge": "^3.6.0",
     "tw-animate-css": "^1.4.0",
-    "uuid": "^14.0.0",
+    "uuid": "^14.0.1",
     "vaul": "^1.1.2",
     "zod": "^4.4.3"
   },
   "devDependencies": {
-    "@eslint/eslintrc": "^3.3.5",
-    "@eslint/js": "^9.39.2",
-    "@semantic-release/changelog": "^6.0.3",
-    "@semantic-release/git": "^10.0.1",
+    "@eslint/eslintrc": "^3.3.6",
+    "@eslint/js": "^9.39.5",
+    "@semantic-release/changelog": "^7.0.0",
+    "@semantic-release/git": "^11.0.1",
     "@tanstack/react-table": "^8.21.3",
     "@testing-library/dom": "^10.4.1",
-    "@testing-library/jest-dom": "^6.9.1",
+    "@testing-library/jest-dom": "^7.0.0",
     "@testing-library/react": "^16.3.2",
     "@testing-library/user-event": "^14.6.1",
     "@types/d3": "^7.4.3",
     "@types/dagre": "^0.7.54",
-    "@types/node": "^25.9.1",
-    "@types/pako": "^2.0.4",
+    "@types/node": "^26.1.2",
     "@types/qrcode.react": "^3.0.0",
-    "@types/react": "^19.2.15",
-    "@types/react-dom": "^19.2.3",
-    "@typescript-eslint/eslint-plugin": "^8.59.4",
-    "@typescript-eslint/parser": "^8.59.4",
-    "@vitejs/plugin-react": "^6.0.2",
-    "@vitest/coverage-v8": "^4.1.7",
-    "@vitest/ui": "^4.1.7",
-    "conventional-changelog-conventionalcommits": "^9.3.1",
-    "eslint": "^9.39.2",
+    "@types/react": "19.2.18",
+    "@types/react-dom": "19.2.4",
+    "@typescript-eslint/eslint-plugin": "^8.65.0",
+    "@typescript-eslint/parser": "^8.65.0",
+    "@vitejs/plugin-react": "^6.0.5",
+    "@vitest/coverage-v8": "^4.1.10",
+    "@vitest/ui": "^4.1.10",
+    "conventional-changelog-conventionalcommits": "^10.2.1",
+    "eslint": "^9.39.5",
     "eslint-config-prettier": "^10.1.8",
-    "eslint-plugin-prettier": "^5.5.5",
-    "globals": "^17.6.0",
-    "jsdom": "^29.1.1",
-    "next": "^16.2.6",
-    "next-intl": "^4.12.0",
-    "prettier": "^3.8.3",
-    "react": "^19.2.6",
-    "react-dom": "^19.2.6",
-    "semantic-release": "^25.0.3",
+    "eslint-plugin-prettier": "^5.5.6",
+    "globals": "^17.8.0",
+    "jsdom": "^30.0.1",
+    "next": "^16.2.12",
+    "next-intl": "^4.13.4",
+    "prettier": "^3.9.6",
+    "react": "19.2.8",
+    "react-dom": "19.2.8",
+    "semantic-release": "^25.0.8",
     "tsup": "^8.5.1",
     "typescript": "^5.9.3",
-    "vitest": "^4.1.7"
+    "vitest": "^4.1.10"
   },
   "keywords": [
     "nextjs",

package/src/components/forms/EditorSheet.tsx

@@ -1,7 +1,7 @@
 "use client";
 
 import { useTranslations } from "next-intl";
-import { ReactElement, ReactNode, useCallback, useEffect, useRef } from "react";
+import { isValidElement, ReactElement, ReactNode, useCallback, useEffect, useRef } from "react";
 import { FieldValues, UseFormReturn } from "react-hook-form";
 import { PencilIcon } from "lucide-react";
 import { ModuleWithPermissions } from "../../permissions/types";
@@ -24,6 +24,39 @@ import { errorToast } from "../errors/errorToast";
 
 type EditorSheetSize = "sm" | "md" | "lg" | "xl" | "2xl";
 
+/**
+ * Resolve the `nativeButton` contract for a caller-supplied `trigger`.
+ *
+ * Base UI checks `nativeButton` against the element the trigger ACTUALLY puts in
+ * the DOM and logs an error when the two disagree — in BOTH directions (see
+ * `@base-ui/react/internals/use-button/useButton`: "expected a native <button>"
+ * / "expected a non-<button>"). Since `trigger` is supplied by the call site and
+ * this package has two live conventions, no constant is correct for all of them:
+ *
+ *   - `<Button render={<div />} nativeButton={false}>` — the pointer-cursor
+ *     convention documented in this package's CLAUDE.md — renders a `<div>`.
+ *   - a plain `<Button>` / `<button>` / `<Button render={<Link />}>` renders a
+ *     native `<button>` / a native `<button>` / an `<a>` respectively.
+ *
+ * So derive it from the element instead of hardcoding it.
+ */
+function resolveTriggerIsNativeButton(trigger: ReactNode): boolean {
+  if (!isValidElement(trigger)) return true;
+
+  const props = (trigger.props ?? {}) as { nativeButton?: boolean; render?: unknown };
+
+  // The call site already declared the contract for its own element — honour it.
+  if (typeof props.nativeButton === "boolean") return props.nativeButton;
+
+  // `render={<X />}` means X is what reaches the DOM (e.g. <Link> → <a>, <div>).
+  if (isValidElement(props.render)) return props.render.type === "button";
+
+  // Intrinsic tags: only <button> is native. Components (this package's <Button>
+  // and the Base UI primitives) default to rendering a native <button>.
+  if (typeof trigger.type === "string") return trigger.type === "button";
+  return true;
+}
+
 const sizeClasses: Record<EditorSheetSize, string> = {
   sm: "data-[side=right]:sm:max-w-2xl",
   md: "data-[side=right]:sm:max-w-3xl",
@@ -212,12 +245,13 @@ export function EditorSheet<T extends FieldValues>({
             // <button> inside SheetTrigger's <button> (invalid HTML / hydration
             // error). `render` also preserves the element's native `disabled`.
             //
-            // `nativeButton={false}` because this package's trigger convention is
-            // `<Button render={<div />} nativeButton={false}>` (see the package
-            // CLAUDE.md "pointer cursor" note). Without it the Trigger defaults to
-            // `nativeButton: true`, promising a native <button> it never renders,
-            // and Base UI logs a semantics/accessibility error at runtime.
-            <SheetTrigger nativeButton={false} render={trigger as ReactElement} />
+            // `nativeButton` must match the element the trigger actually renders,
+            // or Base UI logs a semantics/accessibility error at runtime. Call
+            // sites pass BOTH kinds — a native `<Button>` and the div-rendering
+            // `<Button render={<div />} nativeButton={false}>` convention — so it
+            // is resolved per trigger rather than hardcoded (a constant `false`
+            // warned on every native-button trigger).
+            <SheetTrigger nativeButton={resolveTriggerIsNativeButton(trigger)} render={trigger as ReactElement} />
           ) : (
             <SheetTrigger>
               {isEdit ? (

package/src/components/forms/FileUploader.tsx

@@ -31,6 +31,12 @@ export type { DropzoneOptions } from "react-dropzone";
 
 type DirectionOptions = "rtl" | "ltr" | undefined;
 
+/**
+ * One entry of react-dropzone 19.3's grouped `accept` form. Declared locally rather than
+ * imported because 19.1 has no `AcceptGroup` export, and this file must compile against both.
+ */
+type AcceptGroupLike = { description?: string; accept: Accept };
+
 type FileUploaderContextType = {
   dropzoneState: DropzoneState;
   isLOF: boolean;
@@ -40,7 +46,9 @@ type FileUploaderContextType = {
   setActiveIndex: Dispatch<SetStateAction<number>>;
   orientation: "horizontal" | "vertical";
   direction: DirectionOptions;
-  accept?: Accept;
+  // Mirrors whatever react-dropzone declares: 19.1 had `Accept`, 19.3 widened it to
+  // `Accept | AcceptGroup[]`. Indexing the option type keeps this correct on both.
+  accept?: DropzoneOptions["accept"];
 };
 
 const FileUploaderContext = createContext<FileUploaderContextType | null>(null);
@@ -332,11 +340,18 @@ export const FileInput = forwardRef<HTMLDivElement, React.HTMLAttributes<HTMLDiv
 
     const acceptedLabels = useMemo(() => {
       if (!accept) return null;
+      // react-dropzone 19.3 made two changes to `accept`: it allows a grouped form
+      // (`{ description?, accept }[]`) beside the flat MIME -> extensions record, and it widened
+      // each value from `readonly string[]` to `string | readonly string[]`. Normalise both so a
+      // single-extension string is not iterated character by character.
+      const entries: [string, string | readonly string[]][] = Array.isArray(accept)
+        ? accept.flatMap((group: AcceptGroupLike) => Object.entries(group.accept))
+        : Object.entries(accept);
       const extensions = new Set<string>();
       let hasWildcardImages = false;
-      for (const [mime, exts] of Object.entries(accept)) {
+      for (const [mime, exts] of entries) {
         if (mime === "image/*") hasWildcardImages = true;
-        for (const ext of exts) extensions.add(ext);
+        for (const ext of typeof exts === "string" ? [exts] : exts) extensions.add(ext);
       }
       const labels = Array.from(extensions).sort();
       if (hasWildcardImages) labels.push(t("ui.labels.images"));

package/src/components/forms/FormInput.tsx

@@ -92,8 +92,7 @@ export function FormInput({
             autoFocus: autoFocus === true,
             type: type === "password" ? "password" : "text",
             inputMode: (type === "number" || type === "currency" || type === "decimal" ? "decimal" : undefined) as
-              | "decimal"
-              | undefined,
+              "decimal" | undefined,
             className: `w-full ${type === "number" || type === "currency" || type === "decimal" ? "text-end" : ""}`,
             disabled: disabled === true || form.formState.isSubmitting,
             placeholder: placeholder || "",

package/src/features/auth/utils/AuthCookies.ts

@@ -1,7 +1,7 @@
 // Server-only cookie utilities (consumers should provide their own server actions via configureAuth)
 
 import { cookies } from "next/headers";
-import pako from "pako";
+import { gzip } from "pako";
 
 export async function updateToken(params: {
   token?: string;
@@ -82,7 +82,7 @@ export async function updateToken(params: {
     });
 
   if (params.modules) {
-    const compressedValue = Buffer.from(pako.gzip(JSON.stringify(params.modules))).toString("base64");
+    const compressedValue = Buffer.from(gzip(JSON.stringify(params.modules))).toString("base64");
 
     (await cookies()).set({
       name: "modules",

package/src/server/ServerSession.ts

@@ -1,6 +1,6 @@
 import { cookies } from "next/headers";
 import { redirect } from "next/navigation";
-import pako from "pako";
+import { ungzip } from "pako";
 import { Action, checkPermissionsFromServer, ModuleWithPermissions } from "../permissions";
 
 export class ServerSession {
@@ -68,7 +68,7 @@ export class ServerSession {
         update: boolean | string;
         delete: boolean | string;
       };
-    }[] = JSON.parse(pako.ungzip(Buffer.from(rawModules, "base64"), { to: "string" }));
+    }[] = JSON.parse(ungzip(Buffer.from(rawModules, "base64"), { toText: true }));
 
     const selectedModule = modules.find((module) => module.id === params.module.moduleId);
 

package/src/shadcnui/ui/calendar.tsx

@@ -70,7 +70,7 @@ function Calendar({
             : "cn-calendar-caption-label rounded-(--cell-radius) flex items-center gap-1 text-sm  [&>svg]:text-muted-foreground [&>svg]:size-3.5",
           defaultClassNames.caption_label,
         ),
-        table: "w-full border-collapse",
+        month_grid: cn("w-full border-collapse", defaultClassNames.month_grid),
         weekdays: cn("flex", defaultClassNames.weekdays),
         weekday: cn(
           "text-muted-foreground rounded-(--cell-radius) flex-1 font-normal text-xs select-none",