@thunderid/nextjs 1.12.0 → 1.14.0

package/dist/cjs/client/components/management/SharingPolicies/SharingPolicies.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"SharingPolicies.cjs","names":["SharingPolicies: FC<SharingPoliciesProps>","ReactSharingPolicies"],"sources":["../../../../../../src/client/components/management/SharingPolicies/SharingPolicies.tsx"],"sourcesContent":["// Copyright 2026 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\n'use client';\n\nimport {\n  SharingPolicies as ReactSharingPolicies,\n  SharingPoliciesProps as ReactSharingPoliciesProps,\n} from '@thunderid/react';\nimport {FC, ReactElement} from 'react';\n\nexport type SharingPoliciesProps = ReactSharingPoliciesProps;\n\n/**\n * Lists the sharing policies of a user, an application, a role or a flow, and lets the signed-in user manage them when `editable`.\n *\n * Management requests go through a server action with the signed-in user's server-held session, so\n * the access token never reaches the browser. Whether a request succeeds is the server's decision.\n *\n * @example\n * ```tsx\n * <SharingPolicies resourceType=\"role\" resourceId={roleId} editable />\n * ```\n */\nconst SharingPolicies: FC<SharingPoliciesProps> = (props: SharingPoliciesProps): ReactElement => (\n  <ReactSharingPolicies {...props} />\n);\n\nSharingPolicies.displayName = 'SharingPolicies';\n\nexport default SharingPolicies;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;AAwBA,MAAMA,mBAA6C,UACjD,2CAACC,qCAAqB,GAAI,QAAS;AAGrC,gBAAgB,cAAc;AAE9B,8BAAe"}

package/dist/cjs/client/components/{admin → management}/UserCreate/UserCreate.cjs

@@ -7,7 +7,7 @@ __thunderid_react = require_rolldown_runtime.__toESM(__thunderid_react);
 let react_jsx_runtime = require("react/jsx-runtime");
 react_jsx_runtime = require_rolldown_runtime.__toESM(react_jsx_runtime);
 
-//#region src/client/components/admin/UserCreate/UserCreate.tsx
+//#region src/client/components/management/UserCreate/UserCreate.tsx
 /**
 * Creates a user, or invites one with `mode="invite"`.
 *

package/dist/cjs/client/components/management/UserCreate/UserCreate.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"UserCreate.cjs","names":["UserCreate: FC<UserCreateProps>","ReactUserCreate"],"sources":["../../../../../../src/client/components/management/UserCreate/UserCreate.tsx"],"sourcesContent":["// Copyright 2026 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\n'use client';\n\nimport {UserCreate as ReactUserCreate, UserCreateProps as ReactUserCreateProps} from '@thunderid/react';\nimport {FC, ReactElement} from 'react';\n\nexport type UserCreateProps = ReactUserCreateProps;\n\n/**\n * Creates a user, or invites one with `mode=\"invite\"`.\n *\n * Management requests go through a server action with the signed-in user's server-held session, so\n * the access token never reaches the browser. Whether a request succeeds is the server's decision.\n *\n * @example\n * ```tsx\n * <UserCreate onCreated={(user) => router.push(`/admin/users/${user.id}`)} />\n * ```\n */\nconst UserCreate: FC<UserCreateProps> = (props: UserCreateProps): ReactElement => <ReactUserCreate {...props} />;\n\nUserCreate.displayName = 'UserCreate';\n\nexport default UserCreate;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;AAqBA,MAAMA,cAAmC,UAAyC,2CAACC,gCAAgB,GAAI,QAAS;AAEhH,WAAW,cAAc;AAEzB,yBAAe"}

package/dist/cjs/client/components/{admin → management}/UserDetails/UserDetails.cjs

@@ -7,7 +7,7 @@ __thunderid_react = require_rolldown_runtime.__toESM(__thunderid_react);
 let react_jsx_runtime = require("react/jsx-runtime");
 react_jsx_runtime = require_rolldown_runtime.__toESM(react_jsx_runtime);
 
-//#region src/client/components/admin/UserDetails/UserDetails.tsx
+//#region src/client/components/management/UserDetails/UserDetails.tsx
 /**
 * Shows a user's attributes and groups, and optionally edits or deletes the user.
 *

package/dist/cjs/client/components/management/UserDetails/UserDetails.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"UserDetails.cjs","names":["UserDetails: FC<UserDetailsProps>","ReactUserDetails"],"sources":["../../../../../../src/client/components/management/UserDetails/UserDetails.tsx"],"sourcesContent":["// Copyright 2026 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\n'use client';\n\nimport {UserDetails as ReactUserDetails, UserDetailsProps as ReactUserDetailsProps} from '@thunderid/react';\nimport {FC, ReactElement} from 'react';\n\nexport type UserDetailsProps = ReactUserDetailsProps;\n\n/**\n * Shows a user's attributes and groups, and optionally edits or deletes the user.\n *\n * Management requests go through a server action with the signed-in user's server-held session, so\n * the access token never reaches the browser. Whether a request succeeds is the server's decision.\n *\n * @example\n * ```tsx\n * <UserDetails userId={id} editable deletable onDeleted={() => router.push('/admin/users')} />\n * ```\n */\nconst UserDetails: FC<UserDetailsProps> = (props: UserDetailsProps): ReactElement => <ReactUserDetails {...props} />;\n\nUserDetails.displayName = 'UserDetails';\n\nexport default UserDetails;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;AAqBA,MAAMA,eAAqC,UAA0C,2CAACC,iCAAiB,GAAI,QAAS;AAEpH,YAAY,cAAc;AAE1B,0BAAe"}

package/dist/cjs/client/components/{admin → management}/UserList/UserList.cjs

@@ -7,7 +7,7 @@ __thunderid_react = require_rolldown_runtime.__toESM(__thunderid_react);
 let react_jsx_runtime = require("react/jsx-runtime");
 react_jsx_runtime = require_rolldown_runtime.__toESM(react_jsx_runtime);
 
-//#region src/client/components/admin/UserList/UserList.tsx
+//#region src/client/components/management/UserList/UserList.tsx
 /**
 * Lists the users the signed-in user is allowed to see, a page at a time.
 *

package/dist/cjs/client/components/management/UserList/UserList.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"UserList.cjs","names":["UserList: FC<UserListProps>","ReactUserList"],"sources":["../../../../../../src/client/components/management/UserList/UserList.tsx"],"sourcesContent":["// Copyright 2026 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\n'use client';\n\nimport {UserList as ReactUserList, UserListProps as ReactUserListProps} from '@thunderid/react';\nimport {FC, ReactElement} from 'react';\n\nexport type UserListProps = ReactUserListProps;\n\n/**\n * Lists the users the signed-in user is allowed to see, a page at a time.\n *\n * Management requests go through a server action with the signed-in user's server-held session, so\n * the access token never reaches the browser. Whether a request succeeds is the server's decision.\n *\n * @example\n * ```tsx\n * <UserList onSelect={(user) => router.push(`/admin/users/${user.id}`)} />\n * ```\n */\nconst UserList: FC<UserListProps> = (props: UserListProps): ReactElement => <ReactUserList {...props} />;\n\nUserList.displayName = 'UserList';\n\nexport default UserList;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;AAqBA,MAAMA,YAA+B,UAAuC,2CAACC,8BAAc,GAAI,QAAS;AAExG,SAAS,cAAc;AAEvB,uBAAe"}

package/dist/cjs/client/contexts/ThunderID/ThunderIDProvider.cjs

@@ -2,8 +2,13 @@
 
 
 const require_rolldown_runtime = require('../../../_virtual/rolldown_runtime.cjs');
+const require_getSessionId = require('../../../server/actions/getSessionId.cjs');
+const require_getUserAction = require('../../../server/actions/account/getUserAction.cjs');
+const require_getUserProfileAction = require('../../../server/actions/account/getUserProfileAction.cjs');
 const require_logger = require('../../../utils/logger.cjs');
 const require_ThunderIDContext = require('./ThunderIDContext.cjs');
+const require_getCurrentOrganizationUnitAction = require('../../../server/actions/account/getCurrentOrganizationUnitAction.cjs');
+const require_switchOrganizationUnitAction = require('../../../server/actions/auth/switchOrganizationUnitAction.cjs');
 const require_fetchFlowMetaFromServer = require('../../fetchFlowMetaFromServer.cjs');
 const require_fetchManagementFromServer = require('../../fetchManagementFromServer.cjs');
 let __thunderid_node = require("@thunderid/node");
@@ -62,6 +67,38 @@ const ThunderIDClientProvider = ({ baseUrl, children, endpoints, signIn, clearSe
 	(0, react.useEffect)(() => {
 		setIsLoading(false);
 	}, [isSignedIn, user]);
+	const [currentOrganizationUnit, setCurrentOrganizationUnit] = (0, react.useState)(null);
+	const { currentProject, setCurrentProject } = (0, __thunderid_react.useCurrentProjectState)((0, __thunderid_node.getVendorPrefix)(vendor));
+	(0, react.useEffect)(() => {
+		if (!isSignedIn) {
+			setCurrentOrganizationUnit(null);
+			return;
+		}
+		require_getCurrentOrganizationUnitAction.default().then(setCurrentOrganizationUnit).catch(() => setCurrentOrganizationUnit(null));
+	}, [isSignedIn, user]);
+	/**
+	* Signs in again bounded to another organization unit through a server action. Redirect mode sends the
+	* browser to the unit's authorization endpoint and resolves with `undefined`; embedded mode replaces
+	* the session in place and resolves with the refreshed user. A failure keeps the previous session and
+	* rejects with an error whose code is one of `OrganizationUnitSwitchErrorCodes`.
+	*/
+	const handleSwitchOrganizationUnit = async (organizationUnitId, options) => {
+		const result = await require_switchOrganizationUnitAction.default(organizationUnitId, { redirect: options?.redirect });
+		if (!result.success) throw new __thunderid_node.ThunderIDAPIError(JSON.stringify({
+			code: result.code,
+			message: { defaultValue: "Switching the organization unit failed" }
+		}), result.code, "nextjs", result.statusCode);
+		if (result.data.signInUrl) {
+			window.location.href = result.data.signInUrl;
+			return;
+		}
+		const sessionId = await require_getSessionId.default();
+		const refreshedUser = (sessionId ? await require_getUserAction.default(sessionId) : void 0)?.data?.user ?? null;
+		if (refreshedUser) setUser(refreshedUser);
+		setCurrentOrganizationUnit(await require_getCurrentOrganizationUnitAction.default());
+		router.refresh();
+		return refreshedUser ?? void 0;
+	};
 	const handleSignIn = async (payload, request) => {
 		if (!signIn) throw new __thunderid_node.ThunderIDRuntimeError("`signIn` function is not available.", "ThunderIDClientProvider-handleSignIn-RuntimeError-001", "nextjs");
 		const result = await signIn(payload, request);
@@ -113,11 +150,16 @@ const ThunderIDClientProvider = ({ baseUrl, children, endpoints, signIn, clearSe
 		applicationId,
 		baseUrl,
 		clearSession,
+		currentOrganizationUnit,
+		currentProject,
+		getCurrentOrganizationUnit: require_getCurrentOrganizationUnitAction.default,
 		isLoading,
 		isSignedIn,
 		organizationHandle,
 		preferences,
 		refreshToken,
+		setCurrentProject,
+		switchOrganizationUnit: handleSwitchOrganizationUnit,
 		scopes,
 		signIn: handleSignIn,
 		signInUrl,
@@ -135,7 +177,10 @@ const ThunderIDClientProvider = ({ baseUrl, children, endpoints, signIn, clearSe
 		applicationId,
 		organizationHandle,
 		scopes,
-		preferences
+		preferences,
+		currentOrganizationUnit,
+		currentProject,
+		setCurrentProject
 	]);
 	const handleProfileUpdate = (payload) => {
 		setUser(payload);
@@ -145,6 +190,15 @@ const ThunderIDClientProvider = ({ baseUrl, children, endpoints, signIn, clearSe
 			profile: payload
 		}));
 	};
+	/**
+	* Re-reads `/users/me` through the server-held session, so a change made outside the profile API,
+	* such as a recorded verification, shows.
+	*/
+	const revalidateProfile = async () => {
+		if (preferences?.user?.fetchUserProfile === false) return;
+		const result = await require_getUserProfileAction.default(await require_getSessionId.default() ?? "");
+		if (result.success) handleProfileUpdate(result.data.userProfile.profile);
+	};
 	const unsupported = (name) => {
 		return () => Promise.reject(new __thunderid_node.ThunderIDRuntimeError(`\`${name}\` is not supported in @thunderid/nextjs.`, `ThunderIDClientProvider-${name}-NotSupportedError-001`, "nextjs"));
 	};
@@ -154,10 +208,13 @@ const ThunderIDClientProvider = ({ baseUrl, children, endpoints, signIn, clearSe
 		baseUrl,
 		clearSession,
 		clientId: void 0,
+		currentOrganizationUnit,
+		currentProject,
 		discovery: { wellKnown: null },
 		endpoints,
 		exchangeToken: unsupported("exchangeToken"),
 		getAccessToken: unsupported("getAccessToken"),
+		getCurrentOrganizationUnit: require_getCurrentOrganizationUnitAction.default,
 		getDecodedIdToken: unsupported("getDecodedIdToken"),
 		getGrantedPermissions: unsupported("getGrantedPermissions"),
 		getIdToken: unsupported("getIdToken"),
@@ -178,12 +235,14 @@ const ThunderIDClientProvider = ({ baseUrl, children, endpoints, signIn, clearSe
 		recover: unsupported("recover"),
 		resolveFlowTemplateLiterals: (text) => text ?? "",
 		scopes,
+		setCurrentProject,
 		signIn: handleSignIn,
 		signInSilently: unsupported("signInSilently"),
 		signInUrl,
 		signOut: handleSignOut,
 		signUp: handleSignUp,
 		signUpUrl,
+		switchOrganizationUnit: handleSwitchOrganizationUnit,
 		user,
 		userSchema,
 		vendor: (0, __thunderid_node.getVendorPrefix)(vendor)
@@ -201,7 +260,10 @@ const ThunderIDClientProvider = ({ baseUrl, children, endpoints, signIn, clearSe
 		user,
 		userSchema,
 		initialMeta,
-		vendor
+		vendor,
+		currentOrganizationUnit,
+		currentProject,
+		setCurrentProject
 	]);
 	return /* @__PURE__ */ (0, react_jsx_runtime.jsx)(require_ThunderIDContext.default.Provider, {
 		value: contextValue,
@@ -220,6 +282,7 @@ const ThunderIDClientProvider = ({ baseUrl, children, endpoints, signIn, clearSe
 							profile: userProfile,
 							userSchema,
 							onUpdateProfile: handleProfileUpdate,
+							revalidateProfile,
 							updateProfile,
 							children
 						}) })

package/dist/cjs/client/contexts/ThunderID/ThunderIDProvider.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"ThunderIDProvider.cjs","names":["ThunderIDClientProvider: FC<PropsWithChildren<ThunderIDClientProviderProps>>","reRenderCheckRef: RefObject<boolean>","router: AppRouterInstance","searchParams: ReadonlyURLSearchParams","code: string | null","state: string | null","result: {error?: string; redirectUrl?: string; success: boolean}","ThunderIDRuntimeError","result: any","contextValue: ThunderIDContextProps","reactContextValue: ReactThunderIDContextProps","fetchManagementFromServer","ThunderIDContext","ReactThunderIDContext","I18nProvider","FlowMetaProvider","fetchFlowMetaFromServer","ThemeProvider","FlowProvider","UserProvider"],"sources":["../../../../../src/client/contexts/ThunderID/ThunderIDProvider.tsx"],"sourcesContent":["// Copyright 2025 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\n'use client';\n\nimport {\n  AttributeSchema,\n  EmbeddedFlowExecuteRequestConfig,\n  FlowMetadataResponse,\n  generateFlattenedUserProfile,\n  UpdateMeProfileConfig,\n  User,\n  UserProfile,\n  ThunderIDRuntimeError,\n  getVendorPrefix,\n} from '@thunderid/node';\nimport {\n  I18nProvider,\n  FlowMetaProvider,\n  FlowProvider,\n  UserProvider,\n  ThemeProvider,\n  ThunderIDContext as ReactThunderIDContext,\n  ThunderIDContextProps as ReactThunderIDContextProps,\n  ThunderIDProviderProps,\n} from '@thunderid/react';\nimport {ReadonlyURLSearchParams} from 'next/dist/client/components/navigation.react-server';\nimport {AppRouterInstance} from 'next/dist/shared/lib/app-router-context.shared-runtime';\nimport {useRouter, useSearchParams} from 'next/navigation';\nimport {FC, PropsWithChildren, RefObject, useEffect, useMemo, useRef, useState} from 'react';\nimport ThunderIDContext, {ThunderIDContextProps} from './ThunderIDContext';\nimport {RefreshResult} from '../../../server/actions/refreshToken';\nimport logger from '../../../utils/logger';\nimport fetchFlowMetaFromServer from '../../fetchFlowMetaFromServer';\nimport fetchManagementFromServer from '../../fetchManagementFromServer';\n\n/**\n * Props interface of {@link ThunderIDClientProvider}\n */\nexport type ThunderIDClientProviderProps = Partial<Omit<ThunderIDProviderProps, 'baseUrl' | 'clientId'>> &\n  Pick<ThunderIDProviderProps, 'baseUrl' | 'clientId'> & {\n    applicationId: ThunderIDContextProps['applicationId'];\n    clearSession: () => Promise<void>;\n    handleOAuthCallback: (\n      code: string,\n      state: string,\n    ) => Promise<{error?: string; redirectUrl?: string; success: boolean}>;\n    /**\n     * Flow metadata fetched server-side ahead of time, seeding `FlowMetaProvider` so it can skip\n     * its own initial client-side fetch (avoiding a flash of untranslated i18n keys).\n     */\n    initialMeta?: FlowMetadataResponse | null;\n    isSignedIn: boolean;\n    organizationHandle: ThunderIDContextProps['organizationHandle'];\n    refreshToken: () => Promise<RefreshResult>;\n    signIn: ThunderIDContextProps['signIn'];\n    signOut: ThunderIDContextProps['signOut'];\n    signUp: ThunderIDContextProps['signUp'];\n    updateProfile: (\n      requestConfig: UpdateMeProfileConfig,\n      sessionId?: string,\n    ) => Promise<{data: {user: User}; error: string; success: boolean}>;\n    user: User | null;\n    userProfile: UserProfile;\n    userSchema?: Record<string, AttributeSchema> | null;\n  };\n\nconst ThunderIDClientProvider: FC<PropsWithChildren<ThunderIDClientProviderProps>> = ({\n  baseUrl,\n  children,\n  endpoints,\n  signIn,\n  clearSession,\n  refreshToken,\n  signOut,\n  signUp,\n  handleOAuthCallback,\n  preferences,\n  isSignedIn,\n  signInUrl,\n  signUpUrl,\n  user: _user,\n  userProfile: _userProfile,\n  userSchema: _userSchema = null,\n  updateProfile,\n  applicationId,\n  organizationHandle,\n  scopes,\n  vendor,\n  initialMeta = null,\n}: PropsWithChildren<ThunderIDClientProviderProps>) => {\n  const reRenderCheckRef: RefObject<boolean> = useRef(false);\n  const router: AppRouterInstance = useRouter();\n  const searchParams: ReadonlyURLSearchParams = useSearchParams();\n  const [isLoading, setIsLoading] = useState<boolean>(true);\n  const [user, setUser] = useState<User | null>(_user);\n  const [userProfile, setUserProfile] = useState<UserProfile>(_userProfile);\n  const [userSchema, setUserSchema] = useState<Record<string, AttributeSchema> | null>(_userSchema);\n\n  useEffect(() => {\n    setUserProfile(_userProfile);\n  }, [_userProfile]);\n\n  useEffect(() => {\n    setUserSchema(_userSchema);\n  }, [_userSchema]);\n\n  useEffect(() => {\n    setUser(_user);\n  }, [_user]);\n\n  // Handle OAuth callback automatically\n  useEffect(() => {\n    // React 18.x Strict.Mode has a new check for `Ensuring reusable state` to facilitate an upcoming react feature.\n    // https://reactjs.org/docs/strict-mode.html#ensuring-reusable-state\n    // This will remount all the useEffects to ensure that there are no unexpected side effects.\n    // When react remounts the signIn hook of the AuthProvider, it will cause a race condition. Hence, we have to\n    // prevent the re-render of this hook as suggested in the following discussion.\n    // https://github.com/reactwg/react-18/discussions/18#discussioncomment-795623\n    if (reRenderCheckRef.current) {\n      return;\n    }\n\n    reRenderCheckRef.current = true;\n\n    // Don't handle callback if already signed in\n    if (isSignedIn) return;\n\n    (async (): Promise<void> => {\n      try {\n        const code: string | null = searchParams.get('code');\n        const state: string | null = searchParams.get('state');\n        const error: string | null = searchParams.get('error');\n\n        // Check for OAuth errors first\n        if (error) {\n          logger.error('[ThunderIDClientProvider] An error was received for the initiated sign-in request.');\n\n          return;\n        }\n\n        // Handle OAuth callback if code and state are present\n        if (code && state) {\n          setIsLoading(true);\n\n          const result: {error?: string; redirectUrl?: string; success: boolean} = await handleOAuthCallback(\n            code,\n            state,\n          );\n\n          if (result.success) {\n            // Redirect to the success URL\n            if (result.redirectUrl) {\n              router.push(result.redirectUrl);\n            } else {\n              // Refresh the page to update authentication state\n              window.location.reload();\n            }\n          } else {\n            logger.error(\n              `[ThunderIDClientProvider] An error occurred while signing in: ${result.error || 'Authentication failed'}`,\n            );\n          }\n        }\n      } catch (error) {\n        logger.error('[ThunderIDClientProvider] Failed to handle OAuth callback:', error);\n      }\n    })();\n  }, []);\n\n  useEffect(() => {\n    // Set loading to false when server has resolved authentication state\n    setIsLoading(false);\n  }, [isSignedIn, user]);\n\n  const handleSignIn = async (payload: any, request: EmbeddedFlowExecuteRequestConfig): Promise<any> => {\n    if (!signIn) {\n      throw new ThunderIDRuntimeError(\n        '`signIn` function is not available.',\n        'ThunderIDClientProvider-handleSignIn-RuntimeError-001',\n        'nextjs',\n      );\n    }\n\n    const result: any = await signIn(payload, request);\n\n    // Redirect based flow URL is sent as `signInUrl` in the response.\n    // Use window.location.href instead of router.push() — the OAuth authorization\n    // endpoint is on an external server, and router.push() would send RSC fetch\n    // headers that the identity provider doesn't understand, causing a CORS error.\n    if (result?.data?.signInUrl) {\n      window.location.href = result.data.signInUrl;\n\n      return undefined;\n    }\n\n    // After the Embedded flow is successful, the URL to navigate next is sent as `afterSignInUrl` in the response.\n    if (result?.data?.afterSignInUrl) {\n      router.push(result.data.afterSignInUrl);\n\n      return undefined;\n    }\n\n    if (result?.error) {\n      throw new Error(result.error);\n    }\n\n    return result?.data ?? result;\n  };\n\n  const handleSignUp = async (payload: any, request: EmbeddedFlowExecuteRequestConfig): Promise<any> => {\n    if (!signUp) {\n      throw new ThunderIDRuntimeError(\n        '`signUp` function is not available.',\n        'ThunderIDClientProvider-handleSignUp-RuntimeError-001',\n        'nextjs',\n      );\n    }\n\n    const result: any = await signUp(payload, request);\n\n    // Redirect based flow URL is sent as `signUpUrl` in the response.\n    if (result?.data?.signUpUrl) {\n      router.push(result.data.signUpUrl);\n\n      return undefined;\n    }\n\n    // After the Embedded flow is successful, the URL to navigate next is sent as `afterSignUpUrl` in the response.\n    if (result?.data?.afterSignUpUrl) {\n      router.push(result.data.afterSignUpUrl);\n\n      return undefined;\n    }\n\n    if (result?.error) {\n      throw new Error(result.error);\n    }\n\n    return result?.data ?? result;\n  };\n\n  const handleSignOut = async (): Promise<any> => {\n    logger.debug('[ThunderIDClientProvider][handleSignOut] `handleSignOut` called.');\n\n    try {\n      const result: any = await signOut();\n\n      logger.debug('[ThunderIDClientProvider][handleSignOut] Sign out result:', result);\n\n      if (result?.data?.afterSignOutUrl) {\n        router.push(result.data.afterSignOutUrl);\n\n        return {location: result.data.afterSignOutUrl, redirected: true};\n      }\n\n      if (result?.error) {\n        logger.error(\n          '[ThunderIDClientProvider][handleSignOut] Error result was returned during signing the user out with a button click:',\n          result.error,\n        );\n      }\n\n      return result?.data ?? result;\n    } catch (error) {\n      logger.error(\n        '[ThunderIDClientProvider][handleSignOut] Error occurred during signing the user out with a button click:',\n        error,\n      );\n\n      return undefined;\n    }\n  };\n\n  const contextValue: ThunderIDContextProps = useMemo(\n    () => ({\n      applicationId,\n      baseUrl,\n      clearSession,\n      isLoading,\n      isSignedIn,\n      organizationHandle,\n      preferences,\n      refreshToken,\n      scopes,\n      signIn: handleSignIn,\n      signInUrl,\n      signOut: handleSignOut,\n      signUp: handleSignUp,\n      signUpUrl,\n      user,\n    }),\n    [\n      baseUrl,\n      user,\n      isSignedIn,\n      isLoading,\n      signInUrl,\n      signUpUrl,\n      applicationId,\n      organizationHandle,\n      scopes,\n      preferences,\n    ],\n  );\n\n  const handleProfileUpdate = (payload: User): void => {\n    setUser(payload);\n    setUserProfile((prev: UserProfile) => ({\n      ...prev,\n      flattenedProfile: generateFlattenedUserProfile(payload),\n      profile: payload,\n    }));\n  };\n\n  // Bridge into @thunderid/react's own ThunderIDContext. Internal react components rendered by\n  // BaseSignIn/BaseSignUp — most notably FlowMetaProvider, which fetches `/flow/meta` and injects\n  // its i18n bundle — call react's `useThunderID()` directly. Without this bridge they'd only see\n  // react's context default (applicationId/baseUrl undefined, isInitialized false), so the meta\n  // fetch would never fire and flow labels would render as untranslated i18n keys. Fields with no\n  // nextjs equivalent (token/http helpers meant for direct browser API calls) are stubbed out,\n  // since nextjs routes those operations through server actions instead.\n  const unsupported = (name: string): (() => Promise<never>) => {\n    return () =>\n      Promise.reject(\n        new ThunderIDRuntimeError(\n          `\\`${name}\\` is not supported in @thunderid/nextjs.`,\n          `ThunderIDClientProvider-${name}-NotSupportedError-001`,\n          'nextjs',\n        ),\n      );\n  };\n\n  const reactContextValue: ReactThunderIDContextProps = useMemo(\n    () => ({\n      afterSignInUrl: undefined,\n      applicationId,\n      baseUrl,\n      clearSession,\n      clientId: undefined,\n      discovery: {wellKnown: null},\n      // Only the management collection overrides arrive here, so the admin hooks build the URLs the\n      // management server action accepts.\n      endpoints,\n      exchangeToken: unsupported('exchangeToken'),\n      getAccessToken: unsupported('getAccessToken'),\n      getDecodedIdToken: unsupported('getDecodedIdToken'),\n      // The Next.js useGrantedPermissions reads them through a server action instead.\n      getGrantedPermissions: unsupported('getGrantedPermissions'),\n      getIdToken: unsupported('getIdToken'),\n      getStorageManager: () => Promise.resolve(null),\n      http: {\n        // The admin components and hooks send management requests through a server action that adds\n        // the server-held access token, so the token never reaches the browser.\n        fetcher: fetchManagementFromServer,\n        request: unsupported('http.request'),\n        requestAll: unsupported('http.requestAll'),\n      },\n      instanceId: 0,\n      isInitialized: !isLoading,\n      isLoading,\n      isMetaLoading: false,\n      isSignedIn,\n      meta: initialMeta ?? null,\n      organizationHandle,\n      reInitialize: unsupported('reInitialize'),\n      recover: unsupported('recover'),\n      resolveFlowTemplateLiterals: (text: string | undefined): string => text ?? '',\n      scopes,\n      signIn: handleSignIn,\n      signInSilently: unsupported('signInSilently'),\n      signInUrl,\n      signOut: handleSignOut,\n      signUp: handleSignUp,\n      signUpUrl,\n      user,\n      userSchema,\n      vendor: getVendorPrefix(vendor),\n    }),\n    [\n      applicationId,\n      baseUrl,\n      clearSession,\n      endpoints,\n      isLoading,\n      isSignedIn,\n      organizationHandle,\n      scopes,\n      signInUrl,\n      signUpUrl,\n      user,\n      userSchema,\n      initialMeta,\n      vendor,\n    ],\n  );\n\n  return (\n    <ThunderIDContext.Provider value={contextValue}>\n      <ReactThunderIDContext.Provider value={reactContextValue}>\n        <I18nProvider preferences={preferences?.i18n}>\n          <FlowMetaProvider\n            enabled={preferences?.resolveFromMeta !== false}\n            initialMeta={initialMeta}\n            fetchMeta={fetchFlowMetaFromServer}\n          >\n            <ThemeProvider theme={preferences?.theme?.overrides} mode={preferences?.theme?.mode}>\n              <FlowProvider>\n                <UserProvider\n                  profile={userProfile}\n                  userSchema={userSchema}\n                  onUpdateProfile={handleProfileUpdate}\n                  updateProfile={updateProfile}\n                >\n                  {children}\n                </UserProvider>\n              </FlowProvider>\n            </ThemeProvider>\n          </FlowMetaProvider>\n        </I18nProvider>\n      </ReactThunderIDContext.Provider>\n    </ThunderIDContext.Provider>\n  );\n};\n\nexport default ThunderIDClientProvider;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAmEA,MAAMA,2BAAgF,EACpF,SACA,UACA,WACA,QACA,cACA,cACA,SACA,QACA,qBACA,aACA,YACA,WACA,WACA,MAAM,OACN,aAAa,cACb,YAAY,cAAc,MAC1B,eACA,eACA,oBACA,QACA,QACA,cAAc,WACuC;CACrD,MAAMC,qCAA8C,MAAM;CAC1D,MAAMC,yCAAuC;CAC7C,MAAMC,qDAAyD;CAC/D,MAAM,CAAC,WAAW,oCAAkC,KAAK;CACzD,MAAM,CAAC,MAAM,+BAAiC,MAAM;CACpD,MAAM,CAAC,aAAa,sCAAwC,aAAa;CACzE,MAAM,CAAC,YAAY,qCAAkE,YAAY;AAEjG,4BAAgB;AACd,iBAAe,aAAa;IAC3B,CAAC,aAAa,CAAC;AAElB,4BAAgB;AACd,gBAAc,YAAY;IACzB,CAAC,YAAY,CAAC;AAEjB,4BAAgB;AACd,UAAQ,MAAM;IACb,CAAC,MAAM,CAAC;AAGX,4BAAgB;AAOd,MAAI,iBAAiB,QACnB;AAGF,mBAAiB,UAAU;AAG3B,MAAI,WAAY;AAEhB,GAAC,YAA2B;AAC1B,OAAI;IACF,MAAMC,OAAsB,aAAa,IAAI,OAAO;IACpD,MAAMC,QAAuB,aAAa,IAAI,QAAQ;AAItD,QAH6B,aAAa,IAAI,QAAQ,EAG3C;AACT,4BAAO,MAAM,qFAAqF;AAElG;;AAIF,QAAI,QAAQ,OAAO;AACjB,kBAAa,KAAK;KAElB,MAAMC,SAAmE,MAAM,oBAC7E,MACA,MACD;AAED,SAAI,OAAO,QAET,KAAI,OAAO,YACT,QAAO,KAAK,OAAO,YAAY;SAG/B,QAAO,SAAS,QAAQ;SAG1B,wBAAO,MACL,iEAAiE,OAAO,SAAS,0BAClF;;YAGE,OAAO;AACd,2BAAO,MAAM,8DAA8D,MAAM;;MAEjF;IACH,EAAE,CAAC;AAEN,4BAAgB;AAEd,eAAa,MAAM;IAClB,CAAC,YAAY,KAAK,CAAC;CAEtB,MAAM,eAAe,OAAO,SAAc,YAA4D;AACpG,MAAI,CAAC,OACH,OAAM,IAAIC,uCACR,uCACA,yDACA,SACD;EAGH,MAAMC,SAAc,MAAM,OAAO,SAAS,QAAQ;AAMlD,MAAI,QAAQ,MAAM,WAAW;AAC3B,UAAO,SAAS,OAAO,OAAO,KAAK;AAEnC;;AAIF,MAAI,QAAQ,MAAM,gBAAgB;AAChC,UAAO,KAAK,OAAO,KAAK,eAAe;AAEvC;;AAGF,MAAI,QAAQ,MACV,OAAM,IAAI,MAAM,OAAO,MAAM;AAG/B,SAAO,QAAQ,QAAQ;;CAGzB,MAAM,eAAe,OAAO,SAAc,YAA4D;AACpG,MAAI,CAAC,OACH,OAAM,IAAID,uCACR,uCACA,yDACA,SACD;EAGH,MAAMC,SAAc,MAAM,OAAO,SAAS,QAAQ;AAGlD,MAAI,QAAQ,MAAM,WAAW;AAC3B,UAAO,KAAK,OAAO,KAAK,UAAU;AAElC;;AAIF,MAAI,QAAQ,MAAM,gBAAgB;AAChC,UAAO,KAAK,OAAO,KAAK,eAAe;AAEvC;;AAGF,MAAI,QAAQ,MACV,OAAM,IAAI,MAAM,OAAO,MAAM;AAG/B,SAAO,QAAQ,QAAQ;;CAGzB,MAAM,gBAAgB,YAA0B;AAC9C,yBAAO,MAAM,mEAAmE;AAEhF,MAAI;GACF,MAAMA,SAAc,MAAM,SAAS;AAEnC,0BAAO,MAAM,6DAA6D,OAAO;AAEjF,OAAI,QAAQ,MAAM,iBAAiB;AACjC,WAAO,KAAK,OAAO,KAAK,gBAAgB;AAExC,WAAO;KAAC,UAAU,OAAO,KAAK;KAAiB,YAAY;KAAK;;AAGlE,OAAI,QAAQ,MACV,wBAAO,MACL,uHACA,OAAO,MACR;AAGH,UAAO,QAAQ,QAAQ;WAChB,OAAO;AACd,0BAAO,MACL,4GACA,MACD;AAED;;;CAIJ,MAAMC,yCACG;EACL;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA,QAAQ;EACR;EACA,SAAS;EACT,QAAQ;EACR;EACA;EACD,GACD;EACE;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACD,CACF;CAED,MAAM,uBAAuB,YAAwB;AACnD,UAAQ,QAAQ;AAChB,kBAAgB,UAAuB;GACrC,GAAG;GACH,qEAA+C,QAAQ;GACvD,SAAS;GACV,EAAE;;CAUL,MAAM,eAAe,SAAyC;AAC5D,eACE,QAAQ,OACN,IAAIF,uCACF,KAAK,KAAK,4CACV,2BAA2B,KAAK,yBAChC,SACD,CACF;;CAGL,MAAMG,8CACG;EACL,gBAAgB;EAChB;EACA;EACA;EACA,UAAU;EACV,WAAW,EAAC,WAAW,MAAK;EAG5B;EACA,eAAe,YAAY,gBAAgB;EAC3C,gBAAgB,YAAY,iBAAiB;EAC7C,mBAAmB,YAAY,oBAAoB;EAEnD,uBAAuB,YAAY,wBAAwB;EAC3D,YAAY,YAAY,aAAa;EACrC,yBAAyB,QAAQ,QAAQ,KAAK;EAC9C,MAAM;GAGJ,SAASC;GACT,SAAS,YAAY,eAAe;GACpC,YAAY,YAAY,kBAAkB;GAC3C;EACD,YAAY;EACZ,eAAe,CAAC;EAChB;EACA,eAAe;EACf;EACA,MAAM,eAAe;EACrB;EACA,cAAc,YAAY,eAAe;EACzC,SAAS,YAAY,UAAU;EAC/B,8BAA8B,SAAqC,QAAQ;EAC3E;EACA,QAAQ;EACR,gBAAgB,YAAY,iBAAiB;EAC7C;EACA,SAAS;EACT,QAAQ;EACR;EACA;EACA;EACA,8CAAwB,OAAO;EAChC,GACD;EACE;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACD,CACF;AAED,QACE,2CAACC,iCAAiB;EAAS,OAAO;YAChC,2CAACC,mCAAsB;GAAS,OAAO;aACrC,2CAACC;IAAa,aAAa,aAAa;cACtC,2CAACC;KACC,SAAS,aAAa,oBAAoB;KAC7B;KACb,WAAWC;eAEX,2CAACC;MAAc,OAAO,aAAa,OAAO;MAAW,MAAM,aAAa,OAAO;gBAC7E,2CAACC,4CACC,2CAACC;OACC,SAAS;OACG;OACZ,iBAAiB;OACF;OAEd;QACY,GACF;OACD;MACC;KACN;IACgB;GACP;;AAIhC,gCAAe"}
+{"version":3,"file":"ThunderIDProvider.cjs","names":["ThunderIDClientProvider: FC<PropsWithChildren<ThunderIDClientProviderProps>>","reRenderCheckRef: RefObject<boolean>","router: AppRouterInstance","searchParams: ReadonlyURLSearchParams","code: string | null","state: string | null","result: {error?: string; redirectUrl?: string; success: boolean}","result: SwitchOrganizationUnitActionResult","switchOrganizationUnitAction","ThunderIDAPIError","sessionId: string | undefined","getSessionId","refreshedUser: User | null","getUserAction","getCurrentOrganizationUnitAction","ThunderIDRuntimeError","result: any","contextValue: ThunderIDContextProps","result: Awaited<ReturnType<typeof getUserProfileAction>>","getUserProfileAction","reactContextValue: ReactThunderIDContextProps","fetchManagementFromServer","ThunderIDContext","ReactThunderIDContext","I18nProvider","FlowMetaProvider","fetchFlowMetaFromServer","ThemeProvider","FlowProvider","UserProvider"],"sources":["../../../../../src/client/contexts/ThunderID/ThunderIDProvider.tsx"],"sourcesContent":["// Copyright 2025 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\n'use client';\n\nimport {\n  AttributeSchema,\n  EmbeddedFlowExecuteRequestConfig,\n  FlowMetadataResponse,\n  generateFlattenedUserProfile,\n  UpdateMeProfileConfig,\n  User,\n  UserProfile,\n  ThunderIDRuntimeError,\n  getVendorPrefix,\n  CurrentOrganizationUnit,\n  SwitchOrganizationUnitOptions,\n  ThunderIDAPIError,\n} from '@thunderid/node';\nimport {\n  I18nProvider,\n  FlowMetaProvider,\n  FlowProvider,\n  UserProvider,\n  ThemeProvider,\n  ThunderIDContext as ReactThunderIDContext,\n  ThunderIDContextProps as ReactThunderIDContextProps,\n  ThunderIDProviderProps,\n  useCurrentProjectState,\n} from '@thunderid/react';\nimport {ReadonlyURLSearchParams} from 'next/dist/client/components/navigation.react-server';\nimport {AppRouterInstance} from 'next/dist/shared/lib/app-router-context.shared-runtime';\nimport {useRouter, useSearchParams} from 'next/navigation';\nimport {FC, PropsWithChildren, RefObject, useEffect, useMemo, useRef, useState} from 'react';\nimport ThunderIDContext, {ThunderIDContextProps} from './ThunderIDContext';\nimport getCurrentOrganizationUnitAction from '../../../server/actions/account/getCurrentOrganizationUnitAction';\nimport getUserAction from '../../../server/actions/account/getUserAction';\nimport getUserProfileAction from '../../../server/actions/account/getUserProfileAction';\nimport switchOrganizationUnitAction, {\n  SwitchOrganizationUnitActionResult,\n} from '../../../server/actions/auth/switchOrganizationUnitAction';\nimport getSessionId from '../../../server/actions/getSessionId';\nimport {RefreshResult} from '../../../server/actions/refreshToken';\nimport logger from '../../../utils/logger';\nimport fetchFlowMetaFromServer from '../../fetchFlowMetaFromServer';\nimport fetchManagementFromServer from '../../fetchManagementFromServer';\n\n/**\n * Props interface of {@link ThunderIDClientProvider}\n */\nexport type ThunderIDClientProviderProps = Partial<Omit<ThunderIDProviderProps, 'baseUrl' | 'clientId'>> &\n  Pick<ThunderIDProviderProps, 'baseUrl' | 'clientId'> & {\n    applicationId: ThunderIDContextProps['applicationId'];\n    clearSession: () => Promise<void>;\n    handleOAuthCallback: (\n      code: string,\n      state: string,\n    ) => Promise<{error?: string; redirectUrl?: string; success: boolean}>;\n    /**\n     * Flow metadata fetched server-side ahead of time, seeding `FlowMetaProvider` so it can skip\n     * its own initial client-side fetch (avoiding a flash of untranslated i18n keys).\n     */\n    initialMeta?: FlowMetadataResponse | null;\n    isSignedIn: boolean;\n    organizationHandle: ThunderIDContextProps['organizationHandle'];\n    refreshToken: () => Promise<RefreshResult>;\n    signIn: ThunderIDContextProps['signIn'];\n    signOut: ThunderIDContextProps['signOut'];\n    signUp: ThunderIDContextProps['signUp'];\n    updateProfile: (\n      requestConfig: UpdateMeProfileConfig,\n      sessionId?: string,\n    ) => Promise<{data: {user: User}; error: string; success: boolean}>;\n    user: User | null;\n    userProfile: UserProfile;\n    userSchema?: Record<string, AttributeSchema> | null;\n  };\n\nconst ThunderIDClientProvider: FC<PropsWithChildren<ThunderIDClientProviderProps>> = ({\n  baseUrl,\n  children,\n  endpoints,\n  signIn,\n  clearSession,\n  refreshToken,\n  signOut,\n  signUp,\n  handleOAuthCallback,\n  preferences,\n  isSignedIn,\n  signInUrl,\n  signUpUrl,\n  user: _user,\n  userProfile: _userProfile,\n  userSchema: _userSchema = null,\n  updateProfile,\n  applicationId,\n  organizationHandle,\n  scopes,\n  vendor,\n  initialMeta = null,\n}: PropsWithChildren<ThunderIDClientProviderProps>) => {\n  const reRenderCheckRef: RefObject<boolean> = useRef(false);\n  const router: AppRouterInstance = useRouter();\n  const searchParams: ReadonlyURLSearchParams = useSearchParams();\n  const [isLoading, setIsLoading] = useState<boolean>(true);\n  const [user, setUser] = useState<User | null>(_user);\n  const [userProfile, setUserProfile] = useState<UserProfile>(_userProfile);\n  const [userSchema, setUserSchema] = useState<Record<string, AttributeSchema> | null>(_userSchema);\n\n  useEffect(() => {\n    setUserProfile(_userProfile);\n  }, [_userProfile]);\n\n  useEffect(() => {\n    setUserSchema(_userSchema);\n  }, [_userSchema]);\n\n  useEffect(() => {\n    setUser(_user);\n  }, [_user]);\n\n  // Handle OAuth callback automatically\n  useEffect(() => {\n    // React 18.x Strict.Mode has a new check for `Ensuring reusable state` to facilitate an upcoming react feature.\n    // https://reactjs.org/docs/strict-mode.html#ensuring-reusable-state\n    // This will remount all the useEffects to ensure that there are no unexpected side effects.\n    // When react remounts the signIn hook of the AuthProvider, it will cause a race condition. Hence, we have to\n    // prevent the re-render of this hook as suggested in the following discussion.\n    // https://github.com/reactwg/react-18/discussions/18#discussioncomment-795623\n    if (reRenderCheckRef.current) {\n      return;\n    }\n\n    reRenderCheckRef.current = true;\n\n    // Don't handle callback if already signed in\n    if (isSignedIn) return;\n\n    (async (): Promise<void> => {\n      try {\n        const code: string | null = searchParams.get('code');\n        const state: string | null = searchParams.get('state');\n        const error: string | null = searchParams.get('error');\n\n        // Check for OAuth errors first\n        if (error) {\n          logger.error('[ThunderIDClientProvider] An error was received for the initiated sign-in request.');\n\n          return;\n        }\n\n        // Handle OAuth callback if code and state are present\n        if (code && state) {\n          setIsLoading(true);\n\n          const result: {error?: string; redirectUrl?: string; success: boolean} = await handleOAuthCallback(\n            code,\n            state,\n          );\n\n          if (result.success) {\n            // Redirect to the success URL\n            if (result.redirectUrl) {\n              router.push(result.redirectUrl);\n            } else {\n              // Refresh the page to update authentication state\n              window.location.reload();\n            }\n          } else {\n            logger.error(\n              `[ThunderIDClientProvider] An error occurred while signing in: ${result.error || 'Authentication failed'}`,\n            );\n          }\n        }\n      } catch (error) {\n        logger.error('[ThunderIDClientProvider] Failed to handle OAuth callback:', error);\n      }\n    })();\n  }, []);\n\n  useEffect(() => {\n    // Set loading to false when server has resolved authentication state\n    setIsLoading(false);\n  }, [isSignedIn, user]);\n\n  const [currentOrganizationUnit, setCurrentOrganizationUnit] = useState<CurrentOrganizationUnit | null>(null);\n  // The current project is client-side context for the management UI, kept in the browser like the\n  // React SDK's: it changes no session, cookie or token.\n  const {currentProject, setCurrentProject} = useCurrentProjectState(getVendorPrefix(vendor));\n\n  useEffect(() => {\n    if (!isSignedIn) {\n      setCurrentOrganizationUnit(null);\n\n      return;\n    }\n\n    getCurrentOrganizationUnitAction()\n      .then(setCurrentOrganizationUnit)\n      .catch(() => setCurrentOrganizationUnit(null));\n  }, [isSignedIn, user]);\n\n  /**\n   * Signs in again bounded to another organization unit through a server action. Redirect mode sends the\n   * browser to the unit's authorization endpoint and resolves with `undefined`; embedded mode replaces\n   * the session in place and resolves with the refreshed user. A failure keeps the previous session and\n   * rejects with an error whose code is one of `OrganizationUnitSwitchErrorCodes`.\n   */\n  const handleSwitchOrganizationUnit = async (\n    organizationUnitId: string,\n    options?: SwitchOrganizationUnitOptions,\n  ): Promise<User | undefined> => {\n    const result: SwitchOrganizationUnitActionResult = await switchOrganizationUnitAction(organizationUnitId, {\n      redirect: options?.redirect,\n    });\n\n    if (!result.success) {\n      throw new ThunderIDAPIError(\n        JSON.stringify({code: result.code, message: {defaultValue: 'Switching the organization unit failed'}}),\n        result.code,\n        'nextjs',\n        result.statusCode,\n      );\n    }\n\n    if (result.data.signInUrl) {\n      // The authorization endpoint is on the identity server, so leave the app rather than route.\n      window.location.href = result.data.signInUrl;\n\n      return undefined;\n    }\n\n    const sessionId: string | undefined = await getSessionId();\n    const refreshed: Awaited<ReturnType<typeof getUserAction>> | undefined = sessionId\n      ? await getUserAction(sessionId)\n      : undefined;\n    const refreshedUser: User | null = refreshed?.data?.user ?? null;\n\n    if (refreshedUser) {\n      setUser(refreshedUser);\n    }\n\n    setCurrentOrganizationUnit(await getCurrentOrganizationUnitAction());\n    router.refresh();\n\n    return refreshedUser ?? undefined;\n  };\n\n  const handleSignIn = async (payload: any, request: EmbeddedFlowExecuteRequestConfig): Promise<any> => {\n    if (!signIn) {\n      throw new ThunderIDRuntimeError(\n        '`signIn` function is not available.',\n        'ThunderIDClientProvider-handleSignIn-RuntimeError-001',\n        'nextjs',\n      );\n    }\n\n    const result: any = await signIn(payload, request);\n\n    // Redirect based flow URL is sent as `signInUrl` in the response.\n    // Use window.location.href instead of router.push() — the OAuth authorization\n    // endpoint is on an external server, and router.push() would send RSC fetch\n    // headers that the identity provider doesn't understand, causing a CORS error.\n    if (result?.data?.signInUrl) {\n      window.location.href = result.data.signInUrl;\n\n      return undefined;\n    }\n\n    // After the Embedded flow is successful, the URL to navigate next is sent as `afterSignInUrl` in the response.\n    if (result?.data?.afterSignInUrl) {\n      router.push(result.data.afterSignInUrl);\n\n      return undefined;\n    }\n\n    if (result?.error) {\n      throw new Error(result.error);\n    }\n\n    return result?.data ?? result;\n  };\n\n  const handleSignUp = async (payload: any, request: EmbeddedFlowExecuteRequestConfig): Promise<any> => {\n    if (!signUp) {\n      throw new ThunderIDRuntimeError(\n        '`signUp` function is not available.',\n        'ThunderIDClientProvider-handleSignUp-RuntimeError-001',\n        'nextjs',\n      );\n    }\n\n    const result: any = await signUp(payload, request);\n\n    // Redirect based flow URL is sent as `signUpUrl` in the response.\n    if (result?.data?.signUpUrl) {\n      router.push(result.data.signUpUrl);\n\n      return undefined;\n    }\n\n    // After the Embedded flow is successful, the URL to navigate next is sent as `afterSignUpUrl` in the response.\n    if (result?.data?.afterSignUpUrl) {\n      router.push(result.data.afterSignUpUrl);\n\n      return undefined;\n    }\n\n    if (result?.error) {\n      throw new Error(result.error);\n    }\n\n    return result?.data ?? result;\n  };\n\n  const handleSignOut = async (): Promise<any> => {\n    logger.debug('[ThunderIDClientProvider][handleSignOut] `handleSignOut` called.');\n\n    try {\n      const result: any = await signOut();\n\n      logger.debug('[ThunderIDClientProvider][handleSignOut] Sign out result:', result);\n\n      if (result?.data?.afterSignOutUrl) {\n        router.push(result.data.afterSignOutUrl);\n\n        return {location: result.data.afterSignOutUrl, redirected: true};\n      }\n\n      if (result?.error) {\n        logger.error(\n          '[ThunderIDClientProvider][handleSignOut] Error result was returned during signing the user out with a button click:',\n          result.error,\n        );\n      }\n\n      return result?.data ?? result;\n    } catch (error) {\n      logger.error(\n        '[ThunderIDClientProvider][handleSignOut] Error occurred during signing the user out with a button click:',\n        error,\n      );\n\n      return undefined;\n    }\n  };\n\n  const contextValue: ThunderIDContextProps = useMemo(\n    () => ({\n      applicationId,\n      baseUrl,\n      clearSession,\n      currentOrganizationUnit,\n      currentProject,\n      getCurrentOrganizationUnit: getCurrentOrganizationUnitAction,\n      isLoading,\n      isSignedIn,\n      organizationHandle,\n      preferences,\n      refreshToken,\n      setCurrentProject,\n      switchOrganizationUnit: handleSwitchOrganizationUnit,\n      scopes,\n      signIn: handleSignIn,\n      signInUrl,\n      signOut: handleSignOut,\n      signUp: handleSignUp,\n      signUpUrl,\n      user,\n    }),\n    [\n      baseUrl,\n      user,\n      isSignedIn,\n      isLoading,\n      signInUrl,\n      signUpUrl,\n      applicationId,\n      organizationHandle,\n      scopes,\n      preferences,\n      currentOrganizationUnit,\n      currentProject,\n      setCurrentProject,\n    ],\n  );\n\n  const handleProfileUpdate = (payload: User): void => {\n    setUser(payload);\n    setUserProfile((prev: UserProfile) => ({\n      ...prev,\n      flattenedProfile: generateFlattenedUserProfile(payload),\n      profile: payload,\n    }));\n  };\n\n  /**\n   * Re-reads `/users/me` through the server-held session, so a change made outside the profile API,\n   * such as a recorded verification, shows.\n   */\n  const revalidateProfile = async (): Promise<void> => {\n    if (preferences?.user?.fetchUserProfile === false) return;\n\n    const result: Awaited<ReturnType<typeof getUserProfileAction>> = await getUserProfileAction(\n      (await getSessionId()) ?? '',\n    );\n\n    if (result.success) {\n      handleProfileUpdate(result.data.userProfile.profile);\n    }\n  };\n\n  // Bridge into @thunderid/react's own ThunderIDContext. Internal react components rendered by\n  // BaseSignIn/BaseSignUp — most notably FlowMetaProvider, which fetches `/flow/meta` and injects\n  // its i18n bundle — call react's `useThunderID()` directly. Without this bridge they'd only see\n  // react's context default (applicationId/baseUrl undefined, isInitialized false), so the meta\n  // fetch would never fire and flow labels would render as untranslated i18n keys. Fields with no\n  // nextjs equivalent (token/http helpers meant for direct browser API calls) are stubbed out,\n  // since nextjs routes those operations through server actions instead.\n  const unsupported = (name: string): (() => Promise<never>) => {\n    return () =>\n      Promise.reject(\n        new ThunderIDRuntimeError(\n          `\\`${name}\\` is not supported in @thunderid/nextjs.`,\n          `ThunderIDClientProvider-${name}-NotSupportedError-001`,\n          'nextjs',\n        ),\n      );\n  };\n\n  const reactContextValue: ReactThunderIDContextProps = useMemo(\n    () => ({\n      afterSignInUrl: undefined,\n      applicationId,\n      baseUrl,\n      clearSession,\n      clientId: undefined,\n      currentOrganizationUnit,\n      currentProject,\n      discovery: {wellKnown: null},\n      // Only the management collection overrides arrive here, so the admin hooks build the URLs the\n      // management server action accepts.\n      endpoints,\n      exchangeToken: unsupported('exchangeToken'),\n      getAccessToken: unsupported('getAccessToken'),\n      getCurrentOrganizationUnit: getCurrentOrganizationUnitAction,\n      getDecodedIdToken: unsupported('getDecodedIdToken'),\n      // The Next.js useGrantedPermissions reads them through a server action instead.\n      getGrantedPermissions: unsupported('getGrantedPermissions'),\n      getIdToken: unsupported('getIdToken'),\n      getStorageManager: () => Promise.resolve(null),\n      http: {\n        // The admin components and hooks send management requests through a server action that adds\n        // the server-held access token, so the token never reaches the browser.\n        fetcher: fetchManagementFromServer,\n        request: unsupported('http.request'),\n        requestAll: unsupported('http.requestAll'),\n      },\n      instanceId: 0,\n      isInitialized: !isLoading,\n      isLoading,\n      isMetaLoading: false,\n      isSignedIn,\n      meta: initialMeta ?? null,\n      organizationHandle,\n      reInitialize: unsupported('reInitialize'),\n      recover: unsupported('recover'),\n      resolveFlowTemplateLiterals: (text: string | undefined): string => text ?? '',\n      scopes,\n      setCurrentProject,\n      signIn: handleSignIn,\n      signInSilently: unsupported('signInSilently'),\n      signInUrl,\n      signOut: handleSignOut,\n      signUp: handleSignUp,\n      signUpUrl,\n      switchOrganizationUnit: handleSwitchOrganizationUnit,\n      user,\n      userSchema,\n      vendor: getVendorPrefix(vendor),\n    }),\n    [\n      applicationId,\n      baseUrl,\n      clearSession,\n      endpoints,\n      isLoading,\n      isSignedIn,\n      organizationHandle,\n      scopes,\n      signInUrl,\n      signUpUrl,\n      user,\n      userSchema,\n      initialMeta,\n      vendor,\n      currentOrganizationUnit,\n      currentProject,\n      setCurrentProject,\n    ],\n  );\n\n  return (\n    <ThunderIDContext.Provider value={contextValue}>\n      <ReactThunderIDContext.Provider value={reactContextValue}>\n        <I18nProvider preferences={preferences?.i18n}>\n          <FlowMetaProvider\n            enabled={preferences?.resolveFromMeta !== false}\n            initialMeta={initialMeta}\n            fetchMeta={fetchFlowMetaFromServer}\n          >\n            <ThemeProvider theme={preferences?.theme?.overrides} mode={preferences?.theme?.mode}>\n              <FlowProvider>\n                <UserProvider\n                  profile={userProfile}\n                  userSchema={userSchema}\n                  onUpdateProfile={handleProfileUpdate}\n                  revalidateProfile={revalidateProfile}\n                  updateProfile={updateProfile}\n                >\n                  {children}\n                </UserProvider>\n              </FlowProvider>\n            </ThemeProvider>\n          </FlowMetaProvider>\n        </I18nProvider>\n      </ReactThunderIDContext.Provider>\n    </ThunderIDContext.Provider>\n  );\n};\n\nexport default ThunderIDClientProvider;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AA8EA,MAAMA,2BAAgF,EACpF,SACA,UACA,WACA,QACA,cACA,cACA,SACA,QACA,qBACA,aACA,YACA,WACA,WACA,MAAM,OACN,aAAa,cACb,YAAY,cAAc,MAC1B,eACA,eACA,oBACA,QACA,QACA,cAAc,WACuC;CACrD,MAAMC,qCAA8C,MAAM;CAC1D,MAAMC,yCAAuC;CAC7C,MAAMC,qDAAyD;CAC/D,MAAM,CAAC,WAAW,oCAAkC,KAAK;CACzD,MAAM,CAAC,MAAM,+BAAiC,MAAM;CACpD,MAAM,CAAC,aAAa,sCAAwC,aAAa;CACzE,MAAM,CAAC,YAAY,qCAAkE,YAAY;AAEjG,4BAAgB;AACd,iBAAe,aAAa;IAC3B,CAAC,aAAa,CAAC;AAElB,4BAAgB;AACd,gBAAc,YAAY;IACzB,CAAC,YAAY,CAAC;AAEjB,4BAAgB;AACd,UAAQ,MAAM;IACb,CAAC,MAAM,CAAC;AAGX,4BAAgB;AAOd,MAAI,iBAAiB,QACnB;AAGF,mBAAiB,UAAU;AAG3B,MAAI,WAAY;AAEhB,GAAC,YAA2B;AAC1B,OAAI;IACF,MAAMC,OAAsB,aAAa,IAAI,OAAO;IACpD,MAAMC,QAAuB,aAAa,IAAI,QAAQ;AAItD,QAH6B,aAAa,IAAI,QAAQ,EAG3C;AACT,4BAAO,MAAM,qFAAqF;AAElG;;AAIF,QAAI,QAAQ,OAAO;AACjB,kBAAa,KAAK;KAElB,MAAMC,SAAmE,MAAM,oBAC7E,MACA,MACD;AAED,SAAI,OAAO,QAET,KAAI,OAAO,YACT,QAAO,KAAK,OAAO,YAAY;SAG/B,QAAO,SAAS,QAAQ;SAG1B,wBAAO,MACL,iEAAiE,OAAO,SAAS,0BAClF;;YAGE,OAAO;AACd,2BAAO,MAAM,8DAA8D,MAAM;;MAEjF;IACH,EAAE,CAAC;AAEN,4BAAgB;AAEd,eAAa,MAAM;IAClB,CAAC,YAAY,KAAK,CAAC;CAEtB,MAAM,CAAC,yBAAyB,kDAAuE,KAAK;CAG5G,MAAM,EAAC,gBAAgB,0GAA4D,OAAO,CAAC;AAE3F,4BAAgB;AACd,MAAI,CAAC,YAAY;AACf,8BAA2B,KAAK;AAEhC;;AAGF,oDAAkC,CAC/B,KAAK,2BAA2B,CAChC,YAAY,2BAA2B,KAAK,CAAC;IAC/C,CAAC,YAAY,KAAK,CAAC;;;;;;;CAQtB,MAAM,+BAA+B,OACnC,oBACA,YAC8B;EAC9B,MAAMC,SAA6C,MAAMC,6CAA6B,oBAAoB,EACxG,UAAU,SAAS,UACpB,CAAC;AAEF,MAAI,CAAC,OAAO,QACV,OAAM,IAAIC,mCACR,KAAK,UAAU;GAAC,MAAM,OAAO;GAAM,SAAS,EAAC,cAAc,0CAAyC;GAAC,CAAC,EACtG,OAAO,MACP,UACA,OAAO,WACR;AAGH,MAAI,OAAO,KAAK,WAAW;AAEzB,UAAO,SAAS,OAAO,OAAO,KAAK;AAEnC;;EAGF,MAAMC,YAAgC,MAAMC,8BAAc;EAI1D,MAAMC,iBAHmE,YACrE,MAAMC,8BAAc,UAAU,GAC9B,SAC0C,MAAM,QAAQ;AAE5D,MAAI,cACF,SAAQ,cAAc;AAGxB,6BAA2B,MAAMC,kDAAkC,CAAC;AACpE,SAAO,SAAS;AAEhB,SAAO,iBAAiB;;CAG1B,MAAM,eAAe,OAAO,SAAc,YAA4D;AACpG,MAAI,CAAC,OACH,OAAM,IAAIC,uCACR,uCACA,yDACA,SACD;EAGH,MAAMC,SAAc,MAAM,OAAO,SAAS,QAAQ;AAMlD,MAAI,QAAQ,MAAM,WAAW;AAC3B,UAAO,SAAS,OAAO,OAAO,KAAK;AAEnC;;AAIF,MAAI,QAAQ,MAAM,gBAAgB;AAChC,UAAO,KAAK,OAAO,KAAK,eAAe;AAEvC;;AAGF,MAAI,QAAQ,MACV,OAAM,IAAI,MAAM,OAAO,MAAM;AAG/B,SAAO,QAAQ,QAAQ;;CAGzB,MAAM,eAAe,OAAO,SAAc,YAA4D;AACpG,MAAI,CAAC,OACH,OAAM,IAAID,uCACR,uCACA,yDACA,SACD;EAGH,MAAMC,SAAc,MAAM,OAAO,SAAS,QAAQ;AAGlD,MAAI,QAAQ,MAAM,WAAW;AAC3B,UAAO,KAAK,OAAO,KAAK,UAAU;AAElC;;AAIF,MAAI,QAAQ,MAAM,gBAAgB;AAChC,UAAO,KAAK,OAAO,KAAK,eAAe;AAEvC;;AAGF,MAAI,QAAQ,MACV,OAAM,IAAI,MAAM,OAAO,MAAM;AAG/B,SAAO,QAAQ,QAAQ;;CAGzB,MAAM,gBAAgB,YAA0B;AAC9C,yBAAO,MAAM,mEAAmE;AAEhF,MAAI;GACF,MAAMA,SAAc,MAAM,SAAS;AAEnC,0BAAO,MAAM,6DAA6D,OAAO;AAEjF,OAAI,QAAQ,MAAM,iBAAiB;AACjC,WAAO,KAAK,OAAO,KAAK,gBAAgB;AAExC,WAAO;KAAC,UAAU,OAAO,KAAK;KAAiB,YAAY;KAAK;;AAGlE,OAAI,QAAQ,MACV,wBAAO,MACL,uHACA,OAAO,MACR;AAGH,UAAO,QAAQ,QAAQ;WAChB,OAAO;AACd,0BAAO,MACL,4GACA,MACD;AAED;;;CAIJ,MAAMC,yCACG;EACL;EACA;EACA;EACA;EACA;EACA,4BAA4BH;EAC5B;EACA;EACA;EACA;EACA;EACA;EACA,wBAAwB;EACxB;EACA,QAAQ;EACR;EACA,SAAS;EACT,QAAQ;EACR;EACA;EACD,GACD;EACE;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACD,CACF;CAED,MAAM,uBAAuB,YAAwB;AACnD,UAAQ,QAAQ;AAChB,kBAAgB,UAAuB;GACrC,GAAG;GACH,qEAA+C,QAAQ;GACvD,SAAS;GACV,EAAE;;;;;;CAOL,MAAM,oBAAoB,YAA2B;AACnD,MAAI,aAAa,MAAM,qBAAqB,MAAO;EAEnD,MAAMI,SAA2D,MAAMC,qCACpE,MAAMR,8BAAc,IAAK,GAC3B;AAED,MAAI,OAAO,QACT,qBAAoB,OAAO,KAAK,YAAY,QAAQ;;CAWxD,MAAM,eAAe,SAAyC;AAC5D,eACE,QAAQ,OACN,IAAII,uCACF,KAAK,KAAK,4CACV,2BAA2B,KAAK,yBAChC,SACD,CACF;;CAGL,MAAMK,8CACG;EACL,gBAAgB;EAChB;EACA;EACA;EACA,UAAU;EACV;EACA;EACA,WAAW,EAAC,WAAW,MAAK;EAG5B;EACA,eAAe,YAAY,gBAAgB;EAC3C,gBAAgB,YAAY,iBAAiB;EAC7C,4BAA4BN;EAC5B,mBAAmB,YAAY,oBAAoB;EAEnD,uBAAuB,YAAY,wBAAwB;EAC3D,YAAY,YAAY,aAAa;EACrC,yBAAyB,QAAQ,QAAQ,KAAK;EAC9C,MAAM;GAGJ,SAASO;GACT,SAAS,YAAY,eAAe;GACpC,YAAY,YAAY,kBAAkB;GAC3C;EACD,YAAY;EACZ,eAAe,CAAC;EAChB;EACA,eAAe;EACf;EACA,MAAM,eAAe;EACrB;EACA,cAAc,YAAY,eAAe;EACzC,SAAS,YAAY,UAAU;EAC/B,8BAA8B,SAAqC,QAAQ;EAC3E;EACA;EACA,QAAQ;EACR,gBAAgB,YAAY,iBAAiB;EAC7C;EACA,SAAS;EACT,QAAQ;EACR;EACA,wBAAwB;EACxB;EACA;EACA,8CAAwB,OAAO;EAChC,GACD;EACE;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACD,CACF;AAED,QACE,2CAACC,iCAAiB;EAAS,OAAO;YAChC,2CAACC,mCAAsB;GAAS,OAAO;aACrC,2CAACC;IAAa,aAAa,aAAa;cACtC,2CAACC;KACC,SAAS,aAAa,oBAAoB;KAC7B;KACb,WAAWC;eAEX,2CAACC;MAAc,OAAO,aAAa,OAAO;MAAW,MAAM,aAAa,OAAO;gBAC7E,2CAACC,4CACC,2CAACC;OACC,SAAS;OACG;OACZ,iBAAiB;OACE;OACJ;OAEd;QACY,GACF;OACD;MACC;KACN;IACgB;GACP;;AAIhC,gCAAe"}

package/dist/cjs/client/index.cjs

@@ -9,30 +9,42 @@ const require_DeviceGrant = require('./components/auth/DeviceGrant/DeviceGrant.c
 const require_SignOutButton = require('./components/auth/buttons/SignOutButton/SignOutButton.cjs');
 const require_User = require('./components/account/User/User.cjs');
 const require_SignUp = require('./components/auth/SignUp/SignUp.cjs');
+const require_VerifyAttribute = require('./components/account/VerifyAttribute/VerifyAttribute.cjs');
 const require_UserProfile = require('./components/account/UserProfile/UserProfile.cjs');
 const require_UserDropdown = require('./components/account/UserDropdown/UserDropdown.cjs');
 const require_UserAvatar = require('./components/account/UserAvatar/UserAvatar.cjs');
 const require_ChangeCredential = require('./components/account/ChangeCredential/ChangeCredential.cjs');
+const require_OrganizationUnitSwitcher = require('./components/account/OrganizationUnitSwitcher/OrganizationUnitSwitcher.cjs');
 const require_UserSelect = require('./components/primitives/UserSelect/UserSelect.cjs');
 const require_AuthFlowSelect = require('./components/primitives/AuthFlowSelect/AuthFlowSelect.cjs');
 const require_UserTypeSelect = require('./components/primitives/UserTypeSelect/UserTypeSelect.cjs');
-const require_UserList = require('./components/admin/UserList/UserList.cjs');
-const require_UserCreate = require('./components/admin/UserCreate/UserCreate.cjs');
-const require_UserDetails = require('./components/admin/UserDetails/UserDetails.cjs');
-const require_GroupList = require('./components/admin/GroupList/GroupList.cjs');
-const require_GroupCreate = require('./components/admin/GroupCreate/GroupCreate.cjs');
-const require_GroupMembers = require('./components/admin/GroupMembers/GroupMembers.cjs');
-const require_RoleList = require('./components/admin/RoleList/RoleList.cjs');
-const require_RoleCreate = require('./components/admin/RoleCreate/RoleCreate.cjs');
-const require_RoleAssignments = require('./components/admin/RoleAssignments/RoleAssignments.cjs');
-const require_RolePermissions = require('./components/admin/RolePermissions/RolePermissions.cjs');
-const require_AgentList = require('./components/admin/AgentList/AgentList.cjs');
-const require_AgentCreate = require('./components/admin/AgentCreate/AgentCreate.cjs');
-const require_AgentDetails = require('./components/admin/AgentDetails/AgentDetails.cjs');
-const require_ApplicationList = require('./components/admin/ApplicationList/ApplicationList.cjs');
-const require_ApplicationCreate = require('./components/admin/ApplicationCreate/ApplicationCreate.cjs');
-const require_ApplicationDetails = require('./components/admin/ApplicationDetails/ApplicationDetails.cjs');
+const require_UserList = require('./components/management/UserList/UserList.cjs');
+const require_UserCreate = require('./components/management/UserCreate/UserCreate.cjs');
+const require_UserDetails = require('./components/management/UserDetails/UserDetails.cjs');
+const require_GroupList = require('./components/management/GroupList/GroupList.cjs');
+const require_GroupCreate = require('./components/management/GroupCreate/GroupCreate.cjs');
+const require_GroupMembers = require('./components/management/GroupMembers/GroupMembers.cjs');
+const require_RoleList = require('./components/management/RoleList/RoleList.cjs');
+const require_RoleCreate = require('./components/management/RoleCreate/RoleCreate.cjs');
+const require_RoleAssignments = require('./components/management/RoleAssignments/RoleAssignments.cjs');
+const require_RolePermissions = require('./components/management/RolePermissions/RolePermissions.cjs');
+const require_GroupDetails = require('./components/management/GroupDetails/GroupDetails.cjs');
+const require_RoleDetails = require('./components/management/RoleDetails/RoleDetails.cjs');
+const require_AgentList = require('./components/management/AgentList/AgentList.cjs');
+const require_AgentCreate = require('./components/management/AgentCreate/AgentCreate.cjs');
+const require_AgentDetails = require('./components/management/AgentDetails/AgentDetails.cjs');
+const require_ApplicationList = require('./components/management/ApplicationList/ApplicationList.cjs');
+const require_ApplicationCreate = require('./components/management/ApplicationCreate/ApplicationCreate.cjs');
+const require_ApplicationDetails = require('./components/management/ApplicationDetails/ApplicationDetails.cjs');
+const require_ProjectList = require('./components/management/ProjectList/ProjectList.cjs');
+const require_ProjectCreate = require('./components/management/ProjectCreate/ProjectCreate.cjs');
+const require_ProjectDetails = require('./components/management/ProjectDetails/ProjectDetails.cjs');
+const require_ProjectSwitcher = require('./components/management/ProjectSwitcher/ProjectSwitcher.cjs');
+const require_OrganizationUnitList = require('./components/management/OrganizationUnitList/OrganizationUnitList.cjs');
+const require_OrganizationUnitCreate = require('./components/management/OrganizationUnitCreate/OrganizationUnitCreate.cjs');
+const require_OrganizationUnitDetails = require('./components/management/OrganizationUnitDetails/OrganizationUnitDetails.cjs');
+const require_SharingPolicies = require('./components/management/SharingPolicies/SharingPolicies.cjs');
 const require_useGrantedPermissions = require('./hooks/management/useGrantedPermissions.cjs');
-require('./admin.cjs');
+require('./management.cjs');
 let __thunderid_react = require("@thunderid/react");
 __thunderid_react = require_rolldown_runtime.__toESM(__thunderid_react);

package/dist/cjs/index.cjs

@@ -16,29 +16,41 @@ const require_DeviceGrant = require('./client/components/auth/DeviceGrant/Device
 const require_SignOutButton = require('./client/components/auth/buttons/SignOutButton/SignOutButton.cjs');
 const require_User = require('./client/components/account/User/User.cjs');
 const require_SignUp = require('./client/components/auth/SignUp/SignUp.cjs');
+const require_VerifyAttribute = require('./client/components/account/VerifyAttribute/VerifyAttribute.cjs');
 const require_UserProfile = require('./client/components/account/UserProfile/UserProfile.cjs');
 const require_UserDropdown = require('./client/components/account/UserDropdown/UserDropdown.cjs');
 const require_UserAvatar = require('./client/components/account/UserAvatar/UserAvatar.cjs');
 const require_ChangeCredential = require('./client/components/account/ChangeCredential/ChangeCredential.cjs');
+const require_OrganizationUnitSwitcher = require('./client/components/account/OrganizationUnitSwitcher/OrganizationUnitSwitcher.cjs');
 const require_UserSelect = require('./client/components/primitives/UserSelect/UserSelect.cjs');
 const require_AuthFlowSelect = require('./client/components/primitives/AuthFlowSelect/AuthFlowSelect.cjs');
 const require_UserTypeSelect = require('./client/components/primitives/UserTypeSelect/UserTypeSelect.cjs');
-const require_UserList = require('./client/components/admin/UserList/UserList.cjs');
-const require_UserCreate = require('./client/components/admin/UserCreate/UserCreate.cjs');
-const require_UserDetails = require('./client/components/admin/UserDetails/UserDetails.cjs');
-const require_GroupList = require('./client/components/admin/GroupList/GroupList.cjs');
-const require_GroupCreate = require('./client/components/admin/GroupCreate/GroupCreate.cjs');
-const require_GroupMembers = require('./client/components/admin/GroupMembers/GroupMembers.cjs');
-const require_RoleList = require('./client/components/admin/RoleList/RoleList.cjs');
-const require_RoleCreate = require('./client/components/admin/RoleCreate/RoleCreate.cjs');
-const require_RoleAssignments = require('./client/components/admin/RoleAssignments/RoleAssignments.cjs');
-const require_RolePermissions = require('./client/components/admin/RolePermissions/RolePermissions.cjs');
-const require_AgentList = require('./client/components/admin/AgentList/AgentList.cjs');
-const require_AgentCreate = require('./client/components/admin/AgentCreate/AgentCreate.cjs');
-const require_AgentDetails = require('./client/components/admin/AgentDetails/AgentDetails.cjs');
-const require_ApplicationList = require('./client/components/admin/ApplicationList/ApplicationList.cjs');
-const require_ApplicationCreate = require('./client/components/admin/ApplicationCreate/ApplicationCreate.cjs');
-const require_ApplicationDetails = require('./client/components/admin/ApplicationDetails/ApplicationDetails.cjs');
+const require_UserList = require('./client/components/management/UserList/UserList.cjs');
+const require_UserCreate = require('./client/components/management/UserCreate/UserCreate.cjs');
+const require_UserDetails = require('./client/components/management/UserDetails/UserDetails.cjs');
+const require_GroupList = require('./client/components/management/GroupList/GroupList.cjs');
+const require_GroupCreate = require('./client/components/management/GroupCreate/GroupCreate.cjs');
+const require_GroupMembers = require('./client/components/management/GroupMembers/GroupMembers.cjs');
+const require_RoleList = require('./client/components/management/RoleList/RoleList.cjs');
+const require_RoleCreate = require('./client/components/management/RoleCreate/RoleCreate.cjs');
+const require_RoleAssignments = require('./client/components/management/RoleAssignments/RoleAssignments.cjs');
+const require_RolePermissions = require('./client/components/management/RolePermissions/RolePermissions.cjs');
+const require_GroupDetails = require('./client/components/management/GroupDetails/GroupDetails.cjs');
+const require_RoleDetails = require('./client/components/management/RoleDetails/RoleDetails.cjs');
+const require_AgentList = require('./client/components/management/AgentList/AgentList.cjs');
+const require_AgentCreate = require('./client/components/management/AgentCreate/AgentCreate.cjs');
+const require_AgentDetails = require('./client/components/management/AgentDetails/AgentDetails.cjs');
+const require_ApplicationList = require('./client/components/management/ApplicationList/ApplicationList.cjs');
+const require_ApplicationCreate = require('./client/components/management/ApplicationCreate/ApplicationCreate.cjs');
+const require_ApplicationDetails = require('./client/components/management/ApplicationDetails/ApplicationDetails.cjs');
+const require_ProjectList = require('./client/components/management/ProjectList/ProjectList.cjs');
+const require_ProjectCreate = require('./client/components/management/ProjectCreate/ProjectCreate.cjs');
+const require_ProjectDetails = require('./client/components/management/ProjectDetails/ProjectDetails.cjs');
+const require_ProjectSwitcher = require('./client/components/management/ProjectSwitcher/ProjectSwitcher.cjs');
+const require_OrganizationUnitList = require('./client/components/management/OrganizationUnitList/OrganizationUnitList.cjs');
+const require_OrganizationUnitCreate = require('./client/components/management/OrganizationUnitCreate/OrganizationUnitCreate.cjs');
+const require_OrganizationUnitDetails = require('./client/components/management/OrganizationUnitDetails/OrganizationUnitDetails.cjs');
+const require_SharingPolicies = require('./client/components/management/SharingPolicies/SharingPolicies.cjs');
 const require_useGrantedPermissions = require('./client/hooks/management/useGrantedPermissions.cjs');
 require('./client/index.cjs');
 let __thunderid_react = require("@thunderid/react");
@@ -93,6 +105,12 @@ Object.defineProperty(exports, 'BaseGroupCreate', {
     return __thunderid_react.BaseGroupCreate;
   }
 });
+Object.defineProperty(exports, 'BaseGroupDetails', {
+  enumerable: true,
+  get: function () {
+    return __thunderid_react.BaseGroupDetails;
+  }
+});
 Object.defineProperty(exports, 'BaseGroupList', {
   enumerable: true,
   get: function () {
@@ -105,6 +123,48 @@ Object.defineProperty(exports, 'BaseGroupMembers', {
     return __thunderid_react.BaseGroupMembers;
   }
 });
+Object.defineProperty(exports, 'BaseOrganizationUnitCreate', {
+  enumerable: true,
+  get: function () {
+    return __thunderid_react.BaseOrganizationUnitCreate;
+  }
+});
+Object.defineProperty(exports, 'BaseOrganizationUnitDetails', {
+  enumerable: true,
+  get: function () {
+    return __thunderid_react.BaseOrganizationUnitDetails;
+  }
+});
+Object.defineProperty(exports, 'BaseOrganizationUnitList', {
+  enumerable: true,
+  get: function () {
+    return __thunderid_react.BaseOrganizationUnitList;
+  }
+});
+Object.defineProperty(exports, 'BaseProjectCreate', {
+  enumerable: true,
+  get: function () {
+    return __thunderid_react.BaseProjectCreate;
+  }
+});
+Object.defineProperty(exports, 'BaseProjectDetails', {
+  enumerable: true,
+  get: function () {
+    return __thunderid_react.BaseProjectDetails;
+  }
+});
+Object.defineProperty(exports, 'BaseProjectList', {
+  enumerable: true,
+  get: function () {
+    return __thunderid_react.BaseProjectList;
+  }
+});
+Object.defineProperty(exports, 'BaseProjectSwitcher', {
+  enumerable: true,
+  get: function () {
+    return __thunderid_react.BaseProjectSwitcher;
+  }
+});
 Object.defineProperty(exports, 'BaseRoleAssignments', {
   enumerable: true,
   get: function () {
@@ -117,6 +177,12 @@ Object.defineProperty(exports, 'BaseRoleCreate', {
     return __thunderid_react.BaseRoleCreate;
   }
 });
+Object.defineProperty(exports, 'BaseRoleDetails', {
+  enumerable: true,
+  get: function () {
+    return __thunderid_react.BaseRoleDetails;
+  }
+});
 Object.defineProperty(exports, 'BaseRoleList', {
   enumerable: true,
   get: function () {
@@ -129,6 +195,12 @@ Object.defineProperty(exports, 'BaseRolePermissions', {
     return __thunderid_react.BaseRolePermissions;
   }
 });
+Object.defineProperty(exports, 'BaseSharingPolicies', {
+  enumerable: true,
+  get: function () {
+    return __thunderid_react.BaseSharingPolicies;
+  }
+});
 Object.defineProperty(exports, 'BaseUserCreate', {
   enumerable: true,
   get: function () {
@@ -150,12 +222,23 @@ Object.defineProperty(exports, 'BaseUserList', {
 exports.ChangeCredential = require_ChangeCredential.default;
 exports.DeviceGrant = require_DeviceGrant.default;
 exports.GroupCreate = require_GroupCreate.default;
+exports.GroupDetails = require_GroupDetails.default;
 exports.GroupList = require_GroupList.default;
 exports.GroupMembers = require_GroupMembers.default;
+exports.OrganizationUnitCreate = require_OrganizationUnitCreate.default;
+exports.OrganizationUnitDetails = require_OrganizationUnitDetails.default;
+exports.OrganizationUnitList = require_OrganizationUnitList.default;
+exports.OrganizationUnitSwitcher = require_OrganizationUnitSwitcher.default;
+exports.ProjectCreate = require_ProjectCreate.default;
+exports.ProjectDetails = require_ProjectDetails.default;
+exports.ProjectList = require_ProjectList.default;
+exports.ProjectSwitcher = require_ProjectSwitcher.default;
 exports.RoleAssignments = require_RoleAssignments.default;
 exports.RoleCreate = require_RoleCreate.default;
+exports.RoleDetails = require_RoleDetails.default;
 exports.RoleList = require_RoleList.default;
 exports.RolePermissions = require_RolePermissions.default;
+exports.SharingPolicies = require_SharingPolicies.default;
 exports.SignIn = require_SignIn.default;
 exports.SignInButton = require_SignInButton.default;
 exports.SignOutButton = require_SignOutButton.default;
@@ -174,6 +257,7 @@ exports.UserList = require_UserList.default;
 exports.UserProfile = require_UserProfile.default;
 exports.UserSelect = require_UserSelect.default;
 exports.UserTypeSelect = require_UserTypeSelect.default;
+exports.VerifyAttribute = require_VerifyAttribute.default;
 exports.backchannelLogout = require_backchannelLogout.default;
 exports.createRouteMatcher = require_createRouteMatcher.default;
 exports.removeChunkedCookieFromHeader = require_thunderIDProxy.removeChunkedCookieFromHeader;

package/dist/cjs/server/actions/account/getAccessibleOrganizationUnitsAction.cjs

@@ -0,0 +1,53 @@
+'use server';
+
+
+const require_rolldown_runtime = require('../../../_virtual/rolldown_runtime.cjs');
+const require_getClient = require('../../getClient.cjs');
+const require_getAccessToken = require('../getAccessToken.cjs');
+let __thunderid_node = require("@thunderid/node");
+__thunderid_node = require_rolldown_runtime.__toESM(__thunderid_node);
+
+//#region src/server/actions/account/getAccessibleOrganizationUnitsAction.ts
+/**
+* Lists the organization units the signed-in user can access (`/users/me/ous`) with the session's
+* access token, which stays on the server. Only `scope`, `limit` and `offset` are taken from the caller;
+* the session is the one in the request's cookie.
+*
+* Failures are returned rather than thrown, so the error crosses the server action boundary with its
+* status and code, and without the server's message.
+*/
+const getAccessibleOrganizationUnitsAction = async ({ limit, offset, scope } = {}) => {
+	const accessToken = await require_getAccessToken.default();
+	if (!accessToken) return {
+		statusCode: 401,
+		success: false
+	};
+	try {
+		const client = require_getClient.default();
+		if (!client.isInitialized) await client.initialize({});
+		const config = await client.getConfiguration();
+		return {
+			data: await (0, __thunderid_node.getAccessibleOrganizationUnits)({
+				baseUrl: config.baseUrl,
+				headers: { Authorization: `Bearer ${accessToken}` },
+				limit,
+				offset,
+				scope: scope === "siblings" ? "siblings" : void 0,
+				url: (0, __thunderid_node.resolveResourceEndpoint)("usersMeOrganizationUnits", config)
+			}),
+			success: true
+		};
+	} catch (error) {
+		if (error instanceof __thunderid_node.ThunderIDAPIError) return {
+			code: error.code,
+			statusCode: error.statusCode,
+			success: false
+		};
+		return { success: false };
+	}
+};
+var getAccessibleOrganizationUnitsAction_default = getAccessibleOrganizationUnitsAction;
+
+//#endregion
+exports.default = getAccessibleOrganizationUnitsAction_default;
+//# sourceMappingURL=getAccessibleOrganizationUnitsAction.cjs.map

package/dist/cjs/server/actions/account/getAccessibleOrganizationUnitsAction.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"getAccessibleOrganizationUnitsAction.cjs","names":["accessToken: string | undefined","getAccessToken","getClient","config: ThunderIDNextConfig","ThunderIDAPIError"],"sources":["../../../../../src/server/actions/account/getAccessibleOrganizationUnitsAction.ts"],"sourcesContent":["// Copyright 2026 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\n'use server';\n\nimport {\n  AccessibleOrganizationUnitList,\n  AccessibleOrganizationUnitsOptions,\n  ThunderIDAPIError,\n  getAccessibleOrganizationUnits,\n  resolveResourceEndpoint,\n} from '@thunderid/node';\nimport {ThunderIDNextConfig} from '../../../models/config';\nimport getClient from '../../getClient';\nimport getAccessToken from '../getAccessToken';\n\nexport type GetAccessibleOrganizationUnitsActionResult =\n  | {data: AccessibleOrganizationUnitList; success: true}\n  | {code?: string; statusCode?: number; success: false};\n\n/**\n * Lists the organization units the signed-in user can access (`/users/me/ous`) with the session's\n * access token, which stays on the server. Only `scope`, `limit` and `offset` are taken from the caller;\n * the session is the one in the request's cookie.\n *\n * Failures are returned rather than thrown, so the error crosses the server action boundary with its\n * status and code, and without the server's message.\n */\nconst getAccessibleOrganizationUnitsAction = async ({\n  limit,\n  offset,\n  scope,\n}: AccessibleOrganizationUnitsOptions = {}): Promise<GetAccessibleOrganizationUnitsActionResult> => {\n  const accessToken: string | undefined = await getAccessToken();\n\n  if (!accessToken) {\n    return {statusCode: 401, success: false};\n  }\n\n  try {\n    const client = getClient();\n\n    if (!client.isInitialized) {\n      await client.initialize({} as ThunderIDNextConfig);\n    }\n\n    const config: ThunderIDNextConfig = await client.getConfiguration();\n    const data: AccessibleOrganizationUnitList = await getAccessibleOrganizationUnits({\n      baseUrl: config.baseUrl,\n      headers: {Authorization: `Bearer ${accessToken}`},\n      limit,\n      offset,\n      scope: scope === 'siblings' ? 'siblings' : undefined,\n      url: resolveResourceEndpoint('usersMeOrganizationUnits', config),\n    });\n\n    return {data, success: true};\n  } catch (error) {\n    if (error instanceof ThunderIDAPIError) {\n      return {code: error.code, statusCode: error.statusCode, success: false};\n    }\n\n    return {success: false};\n  }\n};\n\nexport default getAccessibleOrganizationUnitsAction;\n"],"mappings":";;;;;;;;;;;;;;;;;;AA4BA,MAAM,uCAAuC,OAAO,EAClD,OACA,QACA,UACsC,EAAE,KAA0D;CAClG,MAAMA,cAAkC,MAAMC,gCAAgB;AAE9D,KAAI,CAAC,YACH,QAAO;EAAC,YAAY;EAAK,SAAS;EAAM;AAG1C,KAAI;EACF,MAAM,SAASC,2BAAW;AAE1B,MAAI,CAAC,OAAO,cACV,OAAM,OAAO,WAAW,EAAE,CAAwB;EAGpD,MAAMC,SAA8B,MAAM,OAAO,kBAAkB;AAUnE,SAAO;GAAC,MATqC,2DAAqC;IAChF,SAAS,OAAO;IAChB,SAAS,EAAC,eAAe,UAAU,eAAc;IACjD;IACA;IACA,OAAO,UAAU,aAAa,aAAa;IAC3C,mDAA6B,4BAA4B,OAAO;IACjE,CAAC;GAEY,SAAS;GAAK;UACrB,OAAO;AACd,MAAI,iBAAiBC,mCACnB,QAAO;GAAC,MAAM,MAAM;GAAM,YAAY,MAAM;GAAY,SAAS;GAAM;AAGzE,SAAO,EAAC,SAAS,OAAM;;;AAI3B,mDAAe"}