@thunderid/nextjs 1.12.0 → 1.14.0

package/dist/cjs/server/actions/account/getCurrentOrganizationUnitAction.cjs

@@ -0,0 +1,31 @@
+'use server';
+
+
+const require_rolldown_runtime = require('../../../_virtual/rolldown_runtime.cjs');
+const require_getAccessToken = require('../getAccessToken.cjs');
+let __thunderid_node = require("@thunderid/node");
+__thunderid_node = require_rolldown_runtime.__toESM(__thunderid_node);
+let jose = require("jose");
+jose = require_rolldown_runtime.__toESM(jose);
+
+//#region src/server/actions/account/getCurrentOrganizationUnitAction.ts
+/**
+* Reads the organization unit the signed-in session was issued for from the `ouId`, `ouHandle` and
+* `ouName` claims of the session's token, or `null` when they are absent (an access token carries
+* `ouId` only when the application's token configuration asks for it). For display only, never for
+* an authorization decision.
+*/
+const getCurrentOrganizationUnitAction = async () => {
+	const accessToken = await require_getAccessToken.default();
+	if (!accessToken) return null;
+	try {
+		return (0, __thunderid_node.getCurrentOrganizationUnitFromClaims)((0, jose.decodeJwt)(accessToken));
+	} catch {
+		return null;
+	}
+};
+var getCurrentOrganizationUnitAction_default = getCurrentOrganizationUnitAction;
+
+//#endregion
+exports.default = getCurrentOrganizationUnitAction_default;
+//# sourceMappingURL=getCurrentOrganizationUnitAction.cjs.map

package/dist/cjs/server/actions/account/getCurrentOrganizationUnitAction.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"getCurrentOrganizationUnitAction.cjs","names":["accessToken: string | undefined","getAccessToken"],"sources":["../../../../../src/server/actions/account/getCurrentOrganizationUnitAction.ts"],"sourcesContent":["// Copyright 2026 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\n'use server';\n\nimport {CurrentOrganizationUnit, getCurrentOrganizationUnitFromClaims} from '@thunderid/node';\nimport {decodeJwt} from 'jose';\nimport getAccessToken from '../getAccessToken';\n\n/**\n * Reads the organization unit the signed-in session was issued for from the `ouId`, `ouHandle` and\n * `ouName` claims of the session's token, or `null` when they are absent (an access token carries\n * `ouId` only when the application's token configuration asks for it). For display only, never for\n * an authorization decision.\n */\nconst getCurrentOrganizationUnitAction = async (): Promise<CurrentOrganizationUnit | null> => {\n  const accessToken: string | undefined = await getAccessToken();\n\n  if (!accessToken) {\n    return null;\n  }\n\n  try {\n    return getCurrentOrganizationUnitFromClaims(decodeJwt(accessToken) as Record<string, unknown>);\n  } catch {\n    return null;\n  }\n};\n\nexport default getCurrentOrganizationUnitAction;\n"],"mappings":";;;;;;;;;;;;;;;;;AAeA,MAAM,mCAAmC,YAAqD;CAC5F,MAAMA,cAAkC,MAAMC,gCAAgB;AAE9D,KAAI,CAAC,YACH,QAAO;AAGT,KAAI;AACF,wFAAsD,YAAY,CAA4B;SACxF;AACN,SAAO;;;AAIX,+CAAe"}

package/dist/cjs/server/actions/auth/executeSelfFlowAction.cjs

@@ -0,0 +1,47 @@
+'use server';
+
+
+const require_rolldown_runtime = require('../../../_virtual/rolldown_runtime.cjs');
+const require_getSessionId = require('../getSessionId.cjs');
+const require_getClient = require('../../getClient.cjs');
+let __thunderid_node = require("@thunderid/node");
+__thunderid_node = require_rolldown_runtime.__toESM(__thunderid_node);
+
+//#region src/server/actions/auth/executeSelfFlowAction.ts
+/**
+* Executes one step of a `SELF` flow, such as self attribute verification, for the signed-in
+* user, with the access token of the server-held session. The request carries no session ID, token
+* or user ID: the session comes from the request cookie, and only the fields of a step are forwarded.
+* A new flow must be a `SELF` flow named by its handle.
+*
+* Never throws across the server action boundary. A failure carries only its HTTP status, never the
+* reply of the server, which the browser reports as a refusal.
+*/
+const executeSelfFlowAction = async (request) => {
+	const sessionId = await require_getSessionId.default();
+	if (!sessionId) return {
+		statusCode: 401,
+		success: false
+	};
+	const checked = (0, __thunderid_node.parseSelfFlowRequest)(request);
+	if ("invalid" in checked) return {
+		statusCode: 400,
+		success: false
+	};
+	try {
+		return {
+			data: await require_getClient.default().executeEmbeddedSelfFlow(checked.request, sessionId),
+			success: true
+		};
+	} catch (error) {
+		return error instanceof __thunderid_node.ThunderIDAPIError && error.statusCode ? {
+			statusCode: error.statusCode,
+			success: false
+		} : { success: false };
+	}
+};
+var executeSelfFlowAction_default = executeSelfFlowAction;
+
+//#endregion
+exports.default = executeSelfFlowAction_default;
+//# sourceMappingURL=executeSelfFlowAction.cjs.map

package/dist/cjs/server/actions/auth/executeSelfFlowAction.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"executeSelfFlowAction.cjs","names":["sessionId: string | undefined","getSessionId","checked: SelfFlowRequestParseResult","getClient","ThunderIDAPIError"],"sources":["../../../../../src/server/actions/auth/executeSelfFlowAction.ts"],"sourcesContent":["// Copyright 2026 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\n'use server';\n\nimport {\n  EmbeddedSelfFlowResponse,\n  SelfFlowRequestParseResult,\n  ThunderIDAPIError,\n  parseSelfFlowRequest,\n} from '@thunderid/node';\nimport getClient from '../../getClient';\nimport getSessionId from '../getSessionId';\n\nexport type ExecuteSelfFlowActionResult =\n  | {data: EmbeddedSelfFlowResponse; success: true}\n  | {statusCode?: number; success: false};\n\n/**\n * Executes one step of a `SELF` flow, such as self attribute verification, for the signed-in\n * user, with the access token of the server-held session. The request carries no session ID, token\n * or user ID: the session comes from the request cookie, and only the fields of a step are forwarded.\n * A new flow must be a `SELF` flow named by its handle.\n *\n * Never throws across the server action boundary. A failure carries only its HTTP status, never the\n * reply of the server, which the browser reports as a refusal.\n */\nconst executeSelfFlowAction = async (request: unknown): Promise<ExecuteSelfFlowActionResult> => {\n  const sessionId: string | undefined = await getSessionId();\n\n  if (!sessionId) {\n    return {statusCode: 401, success: false};\n  }\n\n  const checked: SelfFlowRequestParseResult = parseSelfFlowRequest(request);\n\n  if ('invalid' in checked) {\n    return {statusCode: 400, success: false};\n  }\n\n  try {\n    const data: EmbeddedSelfFlowResponse = await getClient().executeEmbeddedSelfFlow(checked.request, sessionId);\n\n    return {data, success: true};\n  } catch (error) {\n    return error instanceof ThunderIDAPIError && error.statusCode\n      ? {statusCode: error.statusCode, success: false}\n      : {success: false};\n  }\n};\n\nexport default executeSelfFlowAction;\n"],"mappings":";;;;;;;;;;;;;;;;;;;AA2BA,MAAM,wBAAwB,OAAO,YAA2D;CAC9F,MAAMA,YAAgC,MAAMC,8BAAc;AAE1D,KAAI,CAAC,UACH,QAAO;EAAC,YAAY;EAAK,SAAS;EAAM;CAG1C,MAAMC,qDAA2D,QAAQ;AAEzE,KAAI,aAAa,QACf,QAAO;EAAC,YAAY;EAAK,SAAS;EAAM;AAG1C,KAAI;AAGF,SAAO;GAAC,MAF+B,MAAMC,2BAAW,CAAC,wBAAwB,QAAQ,SAAS,UAAU;GAE9F,SAAS;GAAK;UACrB,OAAO;AACd,SAAO,iBAAiBC,sCAAqB,MAAM,aAC/C;GAAC,YAAY,MAAM;GAAY,SAAS;GAAM,GAC9C,EAAC,SAAS,OAAM;;;AAIxB,oCAAe"}

package/dist/cjs/server/actions/auth/switchOrganizationUnitAction.cjs

@@ -0,0 +1,85 @@
+'use server';
+
+
+const require_rolldown_runtime = require('../../../_virtual/rolldown_runtime.cjs');
+const require_SessionManager = require('../../../utils/SessionManager.cjs');
+const require_getSessionId = require('../getSessionId.cjs');
+const require_getClient = require('../../getClient.cjs');
+const require_signInAction = require('./signInAction.cjs');
+let __thunderid_node = require("@thunderid/node");
+__thunderid_node = require_rolldown_runtime.__toESM(__thunderid_node);
+let next_headers = require("next/headers");
+next_headers = require_rolldown_runtime.__toESM(next_headers);
+
+//#region src/server/actions/auth/switchOrganizationUnitAction.ts
+/**
+* Starts a switch of the signed-in session to the organization unit `organizationUnitId`.
+*
+* - Redirect mode returns the unit's authorization URL (`{baseUrl}/ou/{ouId}/oauth2/authorize`) to send
+*   the browser to, and marks the session so the OAuth callback redeems the code for it: the code is
+*   redeemed at the unit's token endpoint and replaces the session. With `redirect: false` it fails
+*   with `interaction_required` instead, since a server cannot switch silently.
+* - Embedded mode starts an `AUTHENTICATION` flow with `ouId`. When the SSO session is reused the flow
+*   completes at once and its assertion replaces the session cookie; a flow that needs input fails
+*   with `interaction_required`.
+*
+* The previous session stays as it was on any failure. The error code is one of
+* `OrganizationUnitSwitchErrorCodes`.
+*/
+const switchOrganizationUnitAction = async (organizationUnitId, options = {}) => {
+	if (typeof organizationUnitId !== "string" || organizationUnitId.trim() === "") return {
+		code: __thunderid_node.OrganizationUnitSwitchErrorCodes.InvalidOrganizationUnit,
+		statusCode: 400,
+		success: false
+	};
+	const sessionId = await require_getSessionId.default();
+	if (!sessionId) return {
+		code: __thunderid_node.OrganizationUnitSwitchErrorCodes.Failed,
+		statusCode: 401,
+		success: false
+	};
+	try {
+		const client = require_getClient.default();
+		if (!client.isInitialized) await client.initialize({});
+		const config = await client.getConfiguration();
+		if (config.mode === "embedded") {
+			const result = await require_signInAction.default({
+				applicationId: config.applicationId,
+				flowType: __thunderid_node.EmbeddedFlowType.Authentication,
+				ouId: organizationUnitId
+			});
+			if (result.success && result.data?.afterSignInUrl) return {
+				data: { switched: true },
+				success: true
+			};
+			if (result.success) return {
+				code: __thunderid_node.OrganizationUnitSwitchErrorCodes.InteractionRequired,
+				success: false
+			};
+			return {
+				code: (result.error ?? "").includes("FES-1023") ? __thunderid_node.OrganizationUnitSwitchErrorCodes.UnauthorizedClient : __thunderid_node.OrganizationUnitSwitchErrorCodes.Failed,
+				success: false
+			};
+		}
+		if (options.redirect === false) return {
+			code: __thunderid_node.OrganizationUnitSwitchErrorCodes.InteractionRequired,
+			success: false
+		};
+		const signInUrl = await client.getAuthorizeRequestUrl({ organizationUnitId }, sessionId);
+		(await (0, next_headers.cookies)()).set(require_SessionManager.default.getTempSessionCookieName(), await require_SessionManager.default.createTempSession(sessionId), require_SessionManager.default.getTempSessionCookieOptions());
+		return {
+			data: { signInUrl },
+			success: true
+		};
+	} catch {
+		return {
+			code: __thunderid_node.OrganizationUnitSwitchErrorCodes.Failed,
+			success: false
+		};
+	}
+};
+var switchOrganizationUnitAction_default = switchOrganizationUnitAction;
+
+//#endregion
+exports.default = switchOrganizationUnitAction_default;
+//# sourceMappingURL=switchOrganizationUnitAction.cjs.map

package/dist/cjs/server/actions/auth/switchOrganizationUnitAction.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"switchOrganizationUnitAction.cjs","names":["OrganizationUnitSwitchErrorCodes","sessionId: string | undefined","getSessionId","getClient","config: ThunderIDNextConfig","result: Awaited<ReturnType<typeof signInAction>>","signInAction","EmbeddedFlowType","signInUrl: string","SessionManager"],"sources":["../../../../../src/server/actions/auth/switchOrganizationUnitAction.ts"],"sourcesContent":["// Copyright 2026 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\n'use server';\n\nimport {EmbeddedFlowType, OrganizationUnitSwitchErrorCodes} from '@thunderid/node';\nimport {cookies} from 'next/headers';\nimport signInAction from './signInAction';\nimport {ThunderIDNextConfig} from '../../../models/config';\nimport SessionManager from '../../../utils/SessionManager';\nimport getClient from '../../getClient';\nimport getSessionId from '../getSessionId';\n\ntype RequestCookies = Awaited<ReturnType<typeof cookies>>;\n\nexport type SwitchOrganizationUnitActionResult =\n  | {data: {signInUrl?: string; switched?: boolean}; success: true}\n  | {code: string; statusCode?: number; success: false};\n\n/**\n * Starts a switch of the signed-in session to the organization unit `organizationUnitId`.\n *\n * - Redirect mode returns the unit's authorization URL (`{baseUrl}/ou/{ouId}/oauth2/authorize`) to send\n *   the browser to, and marks the session so the OAuth callback redeems the code for it: the code is\n *   redeemed at the unit's token endpoint and replaces the session. With `redirect: false` it fails\n *   with `interaction_required` instead, since a server cannot switch silently.\n * - Embedded mode starts an `AUTHENTICATION` flow with `ouId`. When the SSO session is reused the flow\n *   completes at once and its assertion replaces the session cookie; a flow that needs input fails\n *   with `interaction_required`.\n *\n * The previous session stays as it was on any failure. The error code is one of\n * `OrganizationUnitSwitchErrorCodes`.\n */\nconst switchOrganizationUnitAction = async (\n  organizationUnitId: string,\n  options: {redirect?: boolean} = {},\n): Promise<SwitchOrganizationUnitActionResult> => {\n  if (typeof organizationUnitId !== 'string' || organizationUnitId.trim() === '') {\n    return {code: OrganizationUnitSwitchErrorCodes.InvalidOrganizationUnit, statusCode: 400, success: false};\n  }\n\n  const sessionId: string | undefined = await getSessionId();\n\n  if (!sessionId) {\n    return {code: OrganizationUnitSwitchErrorCodes.Failed, statusCode: 401, success: false};\n  }\n\n  try {\n    const client = getClient();\n\n    if (!client.isInitialized) {\n      await client.initialize({} as ThunderIDNextConfig);\n    }\n\n    const config: ThunderIDNextConfig = await client.getConfiguration();\n\n    if (config.mode === 'embedded') {\n      const result: Awaited<ReturnType<typeof signInAction>> = await signInAction({\n        applicationId: config.applicationId,\n        flowType: EmbeddedFlowType.Authentication,\n        ouId: organizationUnitId,\n      });\n\n      if (result.success && (result.data as {afterSignInUrl?: string} | undefined)?.afterSignInUrl) {\n        return {data: {switched: true}, success: true};\n      }\n\n      if (result.success) {\n        return {code: OrganizationUnitSwitchErrorCodes.InteractionRequired, success: false};\n      }\n\n      // FES-1023: a unit the application is not accessible from, or one that does not exist.\n      return {\n        code: (result.error ?? '').includes('FES-1023')\n          ? OrganizationUnitSwitchErrorCodes.UnauthorizedClient\n          : OrganizationUnitSwitchErrorCodes.Failed,\n        success: false,\n      };\n    }\n\n    if (options.redirect === false) {\n      return {code: OrganizationUnitSwitchErrorCodes.InteractionRequired, success: false};\n    }\n\n    const signInUrl: string = await client.getAuthorizeRequestUrl({organizationUnitId}, sessionId);\n    const cookieStore: RequestCookies = await cookies();\n\n    // The OAuth callback finds the session it completes through the temporary session cookie.\n    cookieStore.set(\n      SessionManager.getTempSessionCookieName(),\n      await SessionManager.createTempSession(sessionId),\n      SessionManager.getTempSessionCookieOptions(),\n    );\n\n    return {data: {signInUrl}, success: true};\n  } catch {\n    return {code: OrganizationUnitSwitchErrorCodes.Failed, success: false};\n  }\n};\n\nexport default switchOrganizationUnitAction;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAiCA,MAAM,+BAA+B,OACnC,oBACA,UAAgC,EAAE,KACc;AAChD,KAAI,OAAO,uBAAuB,YAAY,mBAAmB,MAAM,KAAK,GAC1E,QAAO;EAAC,MAAMA,kDAAiC;EAAyB,YAAY;EAAK,SAAS;EAAM;CAG1G,MAAMC,YAAgC,MAAMC,8BAAc;AAE1D,KAAI,CAAC,UACH,QAAO;EAAC,MAAMF,kDAAiC;EAAQ,YAAY;EAAK,SAAS;EAAM;AAGzF,KAAI;EACF,MAAM,SAASG,2BAAW;AAE1B,MAAI,CAAC,OAAO,cACV,OAAM,OAAO,WAAW,EAAE,CAAwB;EAGpD,MAAMC,SAA8B,MAAM,OAAO,kBAAkB;AAEnE,MAAI,OAAO,SAAS,YAAY;GAC9B,MAAMC,SAAmD,MAAMC,6BAAa;IAC1E,eAAe,OAAO;IACtB,UAAUC,kCAAiB;IAC3B,MAAM;IACP,CAAC;AAEF,OAAI,OAAO,WAAY,OAAO,MAAgD,eAC5E,QAAO;IAAC,MAAM,EAAC,UAAU,MAAK;IAAE,SAAS;IAAK;AAGhD,OAAI,OAAO,QACT,QAAO;IAAC,MAAMP,kDAAiC;IAAqB,SAAS;IAAM;AAIrF,UAAO;IACL,OAAO,OAAO,SAAS,IAAI,SAAS,WAAW,GAC3CA,kDAAiC,qBACjCA,kDAAiC;IACrC,SAAS;IACV;;AAGH,MAAI,QAAQ,aAAa,MACvB,QAAO;GAAC,MAAMA,kDAAiC;GAAqB,SAAS;GAAM;EAGrF,MAAMQ,YAAoB,MAAM,OAAO,uBAAuB,EAAC,oBAAmB,EAAE,UAAU;AAI9F,GAHoC,iCAAe,EAGvC,IACVC,+BAAe,0BAA0B,EACzC,MAAMA,+BAAe,kBAAkB,UAAU,EACjDA,+BAAe,6BAA6B,CAC7C;AAED,SAAO;GAAC,MAAM,EAAC,WAAU;GAAE,SAAS;GAAK;SACnC;AACN,SAAO;GAAC,MAAMT,kDAAiC;GAAQ,SAAS;GAAM;;;AAI1E,2CAAe"}

package/dist/cjs/server/thunderid.cjs

@@ -1,5 +1,9 @@
+const require_rolldown_runtime = require('../_virtual/rolldown_runtime.cjs');
 const require_getSessionId = require('./actions/getSessionId.cjs');
 const require_getClient = require('./getClient.cjs');
+const require_getAccessibleOrganizationUnitsAction = require('./actions/account/getAccessibleOrganizationUnitsAction.cjs');
+let __thunderid_node = require("@thunderid/node");
+__thunderid_node = require_rolldown_runtime.__toESM(__thunderid_node);
 
 //#region src/server/thunderid.ts
 const thunderid = async () => {
@@ -13,8 +17,20 @@ const thunderid = async () => {
 	const reInitialize = async (config) => {
 		return require_getClient.default().reInitialize(config);
 	};
+	/**
+	* Lists the organization units the signed-in user of this request can access (`/users/me/ous`).
+	*
+	* @throws {ThunderIDAPIError} With the status and code of the failure; the server's message is not
+	*   carried.
+	*/
+	const getAccessibleOrganizationUnits = async (options) => {
+		const result = await require_getAccessibleOrganizationUnitsAction.default(options);
+		if (!result.success) throw new __thunderid_node.ThunderIDAPIError("Failed to list the accessible organization units", result.code ?? "getAccessibleOrganizationUnits-ResponseError-001", "nextjs", result.statusCode);
+		return result.data;
+	};
 	return {
 		exchangeToken,
+		getAccessibleOrganizationUnits,
 		getAccessToken,
 		getSessionId,
 		reInitialize

package/dist/cjs/server/thunderid.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"thunderid.cjs","names":["getClient","getSessionIdAction"],"sources":["../../../src/server/thunderid.ts"],"sourcesContent":["// Copyright 2025 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\nimport {TokenExchangeRequestConfig, TokenResponse} from '@thunderid/node';\nimport getSessionIdAction from './actions/getSessionId';\nimport getClient from './getClient';\nimport {ThunderIDNextConfig} from '../models/config';\n\nconst thunderid = async (): Promise<{\n  exchangeToken: (config: TokenExchangeRequestConfig, sessionId: string) => Promise<TokenResponse | Response>;\n  getAccessToken: (sessionId: string) => Promise<string>;\n  getSessionId: () => Promise<string | undefined>;\n  reInitialize: (config: Partial<ThunderIDNextConfig>) => Promise<boolean>;\n}> => {\n  const getAccessToken = async (sessionId: string): Promise<string> => {\n    const client = getClient();\n    return client.getAccessToken(sessionId);\n  };\n\n  const getSessionId = async (): Promise<string | undefined> => getSessionIdAction();\n\n  const exchangeToken = async (\n    config: TokenExchangeRequestConfig,\n    sessionId: string,\n  ): Promise<TokenResponse | Response> => {\n    const client = getClient();\n    return client.exchangeToken(config, sessionId);\n  };\n\n  const reInitialize = async (config: Partial<ThunderIDNextConfig>): Promise<boolean> => {\n    const client = getClient();\n    return client.reInitialize(config);\n  };\n\n  return {\n    exchangeToken,\n    getAccessToken,\n    getSessionId,\n    reInitialize,\n  };\n};\n\nexport default thunderid;\n"],"mappings":";;;;AAQA,MAAM,YAAY,YAKZ;CACJ,MAAM,iBAAiB,OAAO,cAAuC;AAEnE,SADeA,2BAAW,CACZ,eAAe,UAAU;;CAGzC,MAAM,eAAe,YAAyCC,8BAAoB;CAElF,MAAM,gBAAgB,OACpB,QACA,cACsC;AAEtC,SADeD,2BAAW,CACZ,cAAc,QAAQ,UAAU;;CAGhD,MAAM,eAAe,OAAO,WAA2D;AAErF,SADeA,2BAAW,CACZ,aAAa,OAAO;;AAGpC,QAAO;EACL;EACA;EACA;EACA;EACD;;AAGH,wBAAe"}
+{"version":3,"file":"thunderid.cjs","names":["getClient","getSessionIdAction","result: GetAccessibleOrganizationUnitsActionResult","getAccessibleOrganizationUnitsAction","ThunderIDAPIError"],"sources":["../../../src/server/thunderid.ts"],"sourcesContent":["// Copyright 2025 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\nimport {\n  AccessibleOrganizationUnitList,\n  AccessibleOrganizationUnitsOptions,\n  ThunderIDAPIError,\n  TokenExchangeRequestConfig,\n  TokenResponse,\n} from '@thunderid/node';\nimport getAccessibleOrganizationUnitsAction, {\n  GetAccessibleOrganizationUnitsActionResult,\n} from './actions/account/getAccessibleOrganizationUnitsAction';\nimport getSessionIdAction from './actions/getSessionId';\nimport getClient from './getClient';\nimport {ThunderIDNextConfig} from '../models/config';\n\nconst thunderid = async (): Promise<{\n  exchangeToken: (config: TokenExchangeRequestConfig, sessionId: string) => Promise<TokenResponse | Response>;\n  getAccessibleOrganizationUnits: (\n    options?: AccessibleOrganizationUnitsOptions,\n  ) => Promise<AccessibleOrganizationUnitList>;\n  getAccessToken: (sessionId: string) => Promise<string>;\n  getSessionId: () => Promise<string | undefined>;\n  reInitialize: (config: Partial<ThunderIDNextConfig>) => Promise<boolean>;\n}> => {\n  const getAccessToken = async (sessionId: string): Promise<string> => {\n    const client = getClient();\n    return client.getAccessToken(sessionId);\n  };\n\n  const getSessionId = async (): Promise<string | undefined> => getSessionIdAction();\n\n  const exchangeToken = async (\n    config: TokenExchangeRequestConfig,\n    sessionId: string,\n  ): Promise<TokenResponse | Response> => {\n    const client = getClient();\n    return client.exchangeToken(config, sessionId);\n  };\n\n  const reInitialize = async (config: Partial<ThunderIDNextConfig>): Promise<boolean> => {\n    const client = getClient();\n    return client.reInitialize(config);\n  };\n\n  /**\n   * Lists the organization units the signed-in user of this request can access (`/users/me/ous`).\n   *\n   * @throws {ThunderIDAPIError} With the status and code of the failure; the server's message is not\n   *   carried.\n   */\n  const getAccessibleOrganizationUnits = async (\n    options?: AccessibleOrganizationUnitsOptions,\n  ): Promise<AccessibleOrganizationUnitList> => {\n    const result: GetAccessibleOrganizationUnitsActionResult = await getAccessibleOrganizationUnitsAction(options);\n\n    if (!result.success) {\n      throw new ThunderIDAPIError(\n        'Failed to list the accessible organization units',\n        result.code ?? 'getAccessibleOrganizationUnits-ResponseError-001',\n        'nextjs',\n        result.statusCode,\n      );\n    }\n\n    return result.data;\n  };\n\n  return {\n    exchangeToken,\n    getAccessibleOrganizationUnits,\n    getAccessToken,\n    getSessionId,\n    reInitialize,\n  };\n};\n\nexport default thunderid;\n"],"mappings":";;;;;;;;AAiBA,MAAM,YAAY,YAQZ;CACJ,MAAM,iBAAiB,OAAO,cAAuC;AAEnE,SADeA,2BAAW,CACZ,eAAe,UAAU;;CAGzC,MAAM,eAAe,YAAyCC,8BAAoB;CAElF,MAAM,gBAAgB,OACpB,QACA,cACsC;AAEtC,SADeD,2BAAW,CACZ,cAAc,QAAQ,UAAU;;CAGhD,MAAM,eAAe,OAAO,WAA2D;AAErF,SADeA,2BAAW,CACZ,aAAa,OAAO;;;;;;;;CASpC,MAAM,iCAAiC,OACrC,YAC4C;EAC5C,MAAME,SAAqD,MAAMC,qDAAqC,QAAQ;AAE9G,MAAI,CAAC,OAAO,QACV,OAAM,IAAIC,mCACR,oDACA,OAAO,QAAQ,oDACf,UACA,OAAO,WACR;AAGH,SAAO,OAAO;;AAGhB,QAAO;EACL;EACA;EACA;EACA;EACA;EACD;;AAGH,wBAAe"}

package/dist/client/components/account/OrganizationUnitSwitcher/OrganizationUnitSwitcher.d.ts

@@ -0,0 +1,24 @@
+import { OrganizationUnitSwitcherProps as ReactOrganizationUnitSwitcherProps } from '@thunderid/react';
+import { FC } from 'react';
+/**
+ * Props for the OrganizationUnitSwitcher component. Mirrors `@thunderid/react`'s
+ * `OrganizationUnitSwitcherProps`, so a consumer moving between the React and Next.js SDKs calls it the
+ * same way.
+ */
+export type OrganizationUnitSwitcherProps = ReactOrganizationUnitSwitcherProps;
+/**
+ * Lists the organization units the signed-in user can access, marks the current one, and switches the
+ * session to another.
+ *
+ * This is the Next.js implementation: it renders `BaseOrganizationUnitSwitcher` from `@thunderid/react`,
+ * reads the units through `getAccessibleOrganizationUnitsAction` (a server action, so the access token
+ * stays on the server), and switches through the provider's `switchOrganizationUnit`.
+ *
+ * @example
+ * ```tsx
+ * <OrganizationUnitSwitcher scope="siblings" />
+ * ```
+ */
+declare const OrganizationUnitSwitcher: FC<OrganizationUnitSwitcherProps>;
+export default OrganizationUnitSwitcher;
+//# sourceMappingURL=OrganizationUnitSwitcher.d.ts.map

package/dist/client/components/account/OrganizationUnitSwitcher/OrganizationUnitSwitcher.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"OrganizationUnitSwitcher.d.ts","sourceRoot":"","sources":["../../../../../src/client/components/account/OrganizationUnitSwitcher/OrganizationUnitSwitcher.tsx"],"names":[],"mappings":"AAMA,OAAO,EAEL,6BAA6B,IAAI,kCAAkC,EAGpE,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAC,EAAE,EAAkE,MAAM,OAAO,CAAC;AAM1F;;;;GAIG;AACH,MAAM,MAAM,6BAA6B,GAAG,kCAAkC,CAAC;AAE/E;;;;;;;;;;;;GAYG;AACH,QAAA,MAAM,wBAAwB,EAAE,EAAE,CAAC,6BAA6B,CA8G/D,CAAC;AAEF,eAAe,wBAAwB,CAAC"}

package/dist/client/components/account/OrganizationUnitSwitcher/OrganizationUnitSwitcher.js

@@ -0,0 +1,112 @@
+'use client';
+
+
+import getAccessibleOrganizationUnitsAction_default from "../../../../server/actions/account/getAccessibleOrganizationUnitsAction.js";
+import useThunderID_default from "../../../contexts/ThunderID/useThunderID.js";
+import { BaseOrganizationUnitSwitcher, getOrganizationUnitSwitchErrorKey, useTranslation } from "@thunderid/react";
+import { useCallback, useEffect, useMemo, useRef, useState } from "react";
+import { jsx } from "react/jsx-runtime";
+
+//#region src/client/components/account/OrganizationUnitSwitcher/OrganizationUnitSwitcher.tsx
+/**
+* Lists the organization units the signed-in user can access, marks the current one, and switches the
+* session to another.
+*
+* This is the Next.js implementation: it renders `BaseOrganizationUnitSwitcher` from `@thunderid/react`,
+* reads the units through `getAccessibleOrganizationUnitsAction` (a server action, so the access token
+* stays on the server), and switches through the provider's `switchOrganizationUnit`.
+*
+* @example
+* ```tsx
+* <OrganizationUnitSwitcher scope="siblings" />
+* ```
+*/
+const OrganizationUnitSwitcher = ({ limit = 10, onError, onSelect, onSwitch, preferences, scope, switchOptions,...rest }) => {
+	const { currentOrganizationUnit, isSignedIn, preferences: contextPreferences, switchOrganizationUnit } = useThunderID_default();
+	const resolvedPreferences = useMemo(() => ({
+		...contextPreferences,
+		...preferences
+	}), [contextPreferences, preferences]);
+	const { t } = useTranslation(resolvedPreferences?.i18n);
+	const [list, setList] = useState(null);
+	const [offset, setOffset] = useState(0);
+	const [isLoading, setIsLoading] = useState(false);
+	const [error, setError] = useState(null);
+	const [switchingId, setSwitchingId] = useState(null);
+	const requestRef = useRef(0);
+	const latestRef = useRef({
+		onError,
+		t
+	});
+	latestRef.current = {
+		onError,
+		t
+	};
+	const load = useCallback(async (pageOffset) => {
+		const request = requestRef.current + 1;
+		requestRef.current = request;
+		setIsLoading(true);
+		setError(null);
+		const result = await getAccessibleOrganizationUnitsAction_default({
+			limit,
+			offset: pageOffset,
+			scope
+		});
+		if (requestRef.current !== request) return;
+		if (result.success) setList(result.data);
+		else {
+			setError(latestRef.current.t("organization_unit.switcher.error.load"));
+			latestRef.current.onError?.(result);
+		}
+		setIsLoading(false);
+	}, [limit, scope]);
+	useEffect(() => {
+		if (isSignedIn) load(offset);
+	}, [
+		isSignedIn,
+		load,
+		offset
+	]);
+	const handleSwitch = async (unit) => {
+		if (onSelect) {
+			onSelect(unit);
+			return;
+		}
+		if (!switchOrganizationUnit) return;
+		setError(null);
+		setSwitchingId(unit.id);
+		try {
+			const user = await switchOrganizationUnit(unit.id, switchOptions);
+			if (user) {
+				onSwitch?.(unit, user);
+				await load(offset);
+			}
+		} catch (caught) {
+			setError(t(getOrganizationUnitSwitchErrorKey(caught), { name: unit.name }));
+			onError?.(caught);
+		} finally {
+			setSwitchingId(null);
+		}
+	};
+	return /* @__PURE__ */ jsx(BaseOrganizationUnitSwitcher, {
+		...rest,
+		current: (list?.current === "" ? void 0 : list?.current) ?? currentOrganizationUnit?.id ?? null,
+		error,
+		isLoading,
+		limit,
+		offset,
+		organizationUnits: list?.organizationUnits ?? [],
+		preferences: resolvedPreferences,
+		switchingId,
+		totalResults: list?.totalResults ?? 0,
+		onPageChange: setOffset,
+		onSwitch: (unit) => {
+			handleSwitch(unit);
+		}
+	});
+};
+var OrganizationUnitSwitcher_default = OrganizationUnitSwitcher;
+
+//#endregion
+export { OrganizationUnitSwitcher_default as default };
+//# sourceMappingURL=OrganizationUnitSwitcher.js.map

package/dist/client/components/account/OrganizationUnitSwitcher/OrganizationUnitSwitcher.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"OrganizationUnitSwitcher.js","names":["OrganizationUnitSwitcher: FC<OrganizationUnitSwitcherProps>","useThunderID","request: number","result: GetAccessibleOrganizationUnitsActionResult","getAccessibleOrganizationUnitsAction","user: User | undefined","caught: unknown"],"sources":["../../../../../src/client/components/account/OrganizationUnitSwitcher/OrganizationUnitSwitcher.tsx"],"sourcesContent":["// Copyright 2026 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\n'use client';\n\nimport {AccessibleOrganizationUnit, AccessibleOrganizationUnitList, User} from '@thunderid/node';\nimport {\n  BaseOrganizationUnitSwitcher,\n  OrganizationUnitSwitcherProps as ReactOrganizationUnitSwitcherProps,\n  getOrganizationUnitSwitchErrorKey,\n  useTranslation,\n} from '@thunderid/react';\nimport {FC, ReactElement, useCallback, useEffect, useMemo, useRef, useState} from 'react';\nimport getAccessibleOrganizationUnitsAction, {\n  GetAccessibleOrganizationUnitsActionResult,\n} from '../../../../server/actions/account/getAccessibleOrganizationUnitsAction';\nimport useThunderID from '../../../contexts/ThunderID/useThunderID';\n\n/**\n * Props for the OrganizationUnitSwitcher component. Mirrors `@thunderid/react`'s\n * `OrganizationUnitSwitcherProps`, so a consumer moving between the React and Next.js SDKs calls it the\n * same way.\n */\nexport type OrganizationUnitSwitcherProps = ReactOrganizationUnitSwitcherProps;\n\n/**\n * Lists the organization units the signed-in user can access, marks the current one, and switches the\n * session to another.\n *\n * This is the Next.js implementation: it renders `BaseOrganizationUnitSwitcher` from `@thunderid/react`,\n * reads the units through `getAccessibleOrganizationUnitsAction` (a server action, so the access token\n * stays on the server), and switches through the provider's `switchOrganizationUnit`.\n *\n * @example\n * ```tsx\n * <OrganizationUnitSwitcher scope=\"siblings\" />\n * ```\n */\nconst OrganizationUnitSwitcher: FC<OrganizationUnitSwitcherProps> = ({\n  limit = 10,\n  onError,\n  onSelect,\n  onSwitch,\n  preferences,\n  scope,\n  switchOptions,\n  ...rest\n}: OrganizationUnitSwitcherProps): ReactElement => {\n  const {currentOrganizationUnit, isSignedIn, preferences: contextPreferences, switchOrganizationUnit} = useThunderID();\n\n  const resolvedPreferences = useMemo(\n    () => ({...contextPreferences, ...preferences}),\n    [contextPreferences, preferences],\n  );\n  const {t} = useTranslation(resolvedPreferences?.i18n);\n\n  const [list, setList] = useState<AccessibleOrganizationUnitList | null>(null);\n  const [offset, setOffset] = useState<number>(0);\n  const [isLoading, setIsLoading] = useState<boolean>(false);\n  const [error, setError] = useState<string | null>(null);\n  const [switchingId, setSwitchingId] = useState<string | null>(null);\n  const requestRef = useRef<number>(0);\n  // The latest callbacks, read when a load settles, so a new `onError` on each render does not reload.\n  const latestRef = useRef<{onError?: (error: unknown) => void; t: typeof t}>({onError, t});\n  latestRef.current = {onError, t};\n\n  const load = useCallback(\n    async (pageOffset: number): Promise<void> => {\n      const request: number = requestRef.current + 1;\n      requestRef.current = request;\n      setIsLoading(true);\n      setError(null);\n\n      const result: GetAccessibleOrganizationUnitsActionResult = await getAccessibleOrganizationUnitsAction({\n        limit,\n        offset: pageOffset,\n        scope,\n      });\n\n      if (requestRef.current !== request) {\n        return;\n      }\n\n      if (result.success) {\n        setList(result.data);\n      } else {\n        setError(latestRef.current.t('organization_unit.switcher.error.load'));\n        latestRef.current.onError?.(result);\n      }\n\n      setIsLoading(false);\n    },\n    [limit, scope],\n  );\n\n  useEffect(() => {\n    if (isSignedIn) {\n      void load(offset);\n    }\n  }, [isSignedIn, load, offset]);\n\n  const handleSwitch = async (unit: AccessibleOrganizationUnit): Promise<void> => {\n    if (onSelect) {\n      onSelect(unit);\n\n      return;\n    }\n\n    if (!switchOrganizationUnit) {\n      return;\n    }\n\n    setError(null);\n    setSwitchingId(unit.id);\n\n    try {\n      const user: User | undefined = await switchOrganizationUnit(unit.id, switchOptions);\n\n      if (user) {\n        onSwitch?.(unit, user);\n        await load(offset);\n      }\n    } catch (caught: unknown) {\n      setError(t(getOrganizationUnitSwitchErrorKey(caught), {name: unit.name}));\n      onError?.(caught);\n    } finally {\n      setSwitchingId(null);\n    }\n  };\n\n  return (\n    <BaseOrganizationUnitSwitcher\n      {...rest}\n      current={(list?.current === '' ? undefined : list?.current) ?? currentOrganizationUnit?.id ?? null}\n      error={error}\n      isLoading={isLoading}\n      limit={limit}\n      offset={offset}\n      organizationUnits={list?.organizationUnits ?? []}\n      preferences={resolvedPreferences}\n      switchingId={switchingId}\n      totalResults={list?.totalResults ?? 0}\n      onPageChange={setOffset}\n      onSwitch={(unit: AccessibleOrganizationUnit): void => {\n        void handleSwitch(unit);\n      }}\n    />\n  );\n};\n\nexport default OrganizationUnitSwitcher;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAsCA,MAAMA,4BAA+D,EACnE,QAAQ,IACR,SACA,UACA,UACA,aACA,OACA,cACA,GAAG,WAC8C;CACjD,MAAM,EAAC,yBAAyB,YAAY,aAAa,oBAAoB,2BAA0BC,sBAAc;CAErH,MAAM,sBAAsB,eACnB;EAAC,GAAG;EAAoB,GAAG;EAAY,GAC9C,CAAC,oBAAoB,YAAY,CAClC;CACD,MAAM,EAAC,MAAK,eAAe,qBAAqB,KAAK;CAErD,MAAM,CAAC,MAAM,WAAW,SAAgD,KAAK;CAC7E,MAAM,CAAC,QAAQ,aAAa,SAAiB,EAAE;CAC/C,MAAM,CAAC,WAAW,gBAAgB,SAAkB,MAAM;CAC1D,MAAM,CAAC,OAAO,YAAY,SAAwB,KAAK;CACvD,MAAM,CAAC,aAAa,kBAAkB,SAAwB,KAAK;CACnE,MAAM,aAAa,OAAe,EAAE;CAEpC,MAAM,YAAY,OAA0D;EAAC;EAAS;EAAE,CAAC;AACzF,WAAU,UAAU;EAAC;EAAS;EAAE;CAEhC,MAAM,OAAO,YACX,OAAO,eAAsC;EAC3C,MAAMC,UAAkB,WAAW,UAAU;AAC7C,aAAW,UAAU;AACrB,eAAa,KAAK;AAClB,WAAS,KAAK;EAEd,MAAMC,SAAqD,MAAMC,6CAAqC;GACpG;GACA,QAAQ;GACR;GACD,CAAC;AAEF,MAAI,WAAW,YAAY,QACzB;AAGF,MAAI,OAAO,QACT,SAAQ,OAAO,KAAK;OACf;AACL,YAAS,UAAU,QAAQ,EAAE,wCAAwC,CAAC;AACtE,aAAU,QAAQ,UAAU,OAAO;;AAGrC,eAAa,MAAM;IAErB,CAAC,OAAO,MAAM,CACf;AAED,iBAAgB;AACd,MAAI,WACF,CAAK,KAAK,OAAO;IAElB;EAAC;EAAY;EAAM;EAAO,CAAC;CAE9B,MAAM,eAAe,OAAO,SAAoD;AAC9E,MAAI,UAAU;AACZ,YAAS,KAAK;AAEd;;AAGF,MAAI,CAAC,uBACH;AAGF,WAAS,KAAK;AACd,iBAAe,KAAK,GAAG;AAEvB,MAAI;GACF,MAAMC,OAAyB,MAAM,uBAAuB,KAAK,IAAI,cAAc;AAEnF,OAAI,MAAM;AACR,eAAW,MAAM,KAAK;AACtB,UAAM,KAAK,OAAO;;WAEbC,QAAiB;AACxB,YAAS,EAAE,kCAAkC,OAAO,EAAE,EAAC,MAAM,KAAK,MAAK,CAAC,CAAC;AACzE,aAAU,OAAO;YACT;AACR,kBAAe,KAAK;;;AAIxB,QACE,oBAAC;EACC,GAAI;EACJ,UAAU,MAAM,YAAY,KAAK,SAAY,MAAM,YAAY,yBAAyB,MAAM;EACvF;EACI;EACJ;EACC;EACR,mBAAmB,MAAM,qBAAqB,EAAE;EAChD,aAAa;EACA;EACb,cAAc,MAAM,gBAAgB;EACpC,cAAc;EACd,WAAW,SAA2C;AACpD,GAAK,aAAa,KAAK;;GAEzB;;AAIN,uCAAe"}

package/dist/client/components/account/UserProfile/UserProfile.d.ts

@@ -4,7 +4,13 @@ import { FC } from 'react';
  * Props for the UserProfile component.
  * Extends BaseUserProfileProps but makes the user prop optional since it will be obtained from useThunderID
  */
-export type UserProfileProps = Omit<BaseUserProfileProps, 'user' | 'profile' | 'flattenedProfile'>;
+export type UserProfileProps = Omit<BaseUserProfileProps, 'user' | 'profile' | 'flattenedProfile'> & {
+    /**
+     * Handle of the `SELF` flow that verifies an attribute. Defaults to the server's shipped
+     * `default-self-attribute-verification-flow`.
+     */
+    verificationFlowHandle?: string;
+};
 /**
  * UserProfile component displays the authenticated user's profile information in a
  * structured and styled format. It shows user details such as display name, email,

package/dist/client/components/account/UserProfile/UserProfile.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"UserProfile.d.ts","sourceRoot":"","sources":["../../../../../src/client/components/account/UserProfile/UserProfile.tsx"],"names":[],"mappings":"AAMA,OAAO,EAAkB,oBAAoB,EAA0B,MAAM,kBAAkB,CAAC;AAChG,OAAO,EAAC,EAAE,EAAyB,MAAM,OAAO,CAAC;AAIjD;;;GAGG;AACH,MAAM,MAAM,gBAAgB,GAAG,IAAI,CAAC,oBAAoB,EAAE,MAAM,GAAG,SAAS,GAAG,kBAAkB,CAAC,CAAC;AAEnG;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,QAAA,MAAM,WAAW,EAAE,EAAE,CAAC,gBAAgB,CAmDrC,CAAC;AAEF,eAAe,WAAW,CAAC"}
+{"version":3,"file":"UserProfile.d.ts","sourceRoot":"","sources":["../../../../../src/client/components/account/UserProfile/UserProfile.tsx"],"names":[],"mappings":"AAMA,OAAO,EAEL,oBAAoB,EAIrB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAC,EAAE,EAAoC,MAAM,OAAO,CAAC;AAK5D;;;GAGG;AACH,MAAM,MAAM,gBAAgB,GAAG,IAAI,CAAC,oBAAoB,EAAE,MAAM,GAAG,SAAS,GAAG,kBAAkB,CAAC,GAAG;IACnG;;;OAGG;IACH,sBAAsB,CAAC,EAAE,MAAM,CAAC;CACjC,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,QAAA,MAAM,WAAW,EAAE,EAAE,CAAC,gBAAgB,CAyErC,CAAC;AAEF,eAAe,WAAW,CAAC"}

package/dist/client/components/account/UserProfile/UserProfile.js

@@ -3,7 +3,8 @@
 
 import getSessionId_default from "../../../../server/actions/getSessionId.js";
 import useThunderID_default from "../../../contexts/ThunderID/useThunderID.js";
-import { deepMerge } from "@thunderid/node";
+import VerifyAttribute_default from "../VerifyAttribute/VerifyAttribute.js";
+import { AttributeVerificationConstants, deepMerge } from "@thunderid/node";
 import { BaseUserProfile, useTranslation, useUser } from "@thunderid/react";
 import { useState } from "react";
 import { jsx } from "react/jsx-runtime";
@@ -32,7 +33,7 @@ import { jsx } from "react/jsx-runtime";
 * />
 * ```
 */
-const UserProfile = ({ preferences, editable = true,...rest }) => {
+const UserProfile = ({ preferences, editable = true, verificationFlowHandle = AttributeVerificationConstants.DEFAULT_FLOW_HANDLE,...rest }) => {
 	const { preferences: contextPreferences } = useThunderID_default();
 	const { profile, flattenedProfile, onUpdateProfile, updateProfile, userSchema } = useUser();
 	const resolvedPreferences = {
@@ -56,7 +57,16 @@ const UserProfile = ({ preferences, editable = true,...rest }) => {
 		if (result.success) onUpdateProfile(result.data.user);
 		else setError(result.error || t("user.profile.update.generic.error"));
 	};
+	const renderVerification = ({ attribute, attributeDisplayName, onCancel }) => /* @__PURE__ */ jsx(VerifyAttribute_default, {
+		attribute,
+		attributeDisplayName,
+		flowHandle: verificationFlowHandle,
+		preferences: resolvedPreferences,
+		onCancel,
+		onDone: onCancel
+	}, attribute);
 	return /* @__PURE__ */ jsx(BaseUserProfile, {
+		renderVerification: isEditableProfile ? renderVerification : void 0,
 		profile,
 		flattenedProfile,
 		userSchema,

package/dist/client/components/account/UserProfile/UserProfile.js.map

@@ -1 +1 @@
-{"version":3,"file":"UserProfile.js","names":["UserProfile: FC<UserProfileProps>","useThunderID","isEditableProfile: boolean","result: {data: {user: User}; error: string; success: boolean}","getSessionId"],"sources":["../../../../../src/client/components/account/UserProfile/UserProfile.tsx"],"sourcesContent":["// Copyright 2025 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\n'use client';\n\nimport {deepMerge, User} from '@thunderid/node';\nimport {BaseUserProfile, BaseUserProfileProps, useUser, useTranslation} from '@thunderid/react';\nimport {FC, ReactElement, useState} from 'react';\nimport useThunderID from '../../../contexts/ThunderID/useThunderID';\nimport getSessionId from '../../../../server/actions/getSessionId';\n\n/**\n * Props for the UserProfile component.\n * Extends BaseUserProfileProps but makes the user prop optional since it will be obtained from useThunderID\n */\nexport type UserProfileProps = Omit<BaseUserProfileProps, 'user' | 'profile' | 'flattenedProfile'>;\n\n/**\n * UserProfile component displays the authenticated user's profile information in a\n * structured and styled format. It shows user details such as display name, email,\n * username, and other available profile information from ThunderID.\n *\n * This component is the React-specific implementation that uses the BaseUserProfile\n * and automatically retrieves the user data from ThunderID context if not provided.\n *\n * @example\n * ```tsx\n * // Basic usage - will use user from ThunderID context\n * <UserProfile />\n *\n * // With explicit user data\n * <UserProfile user={specificUser} />\n *\n * // With card layout and custom fallback\n * <UserProfile\n *   cardLayout={true}\n *   fallback={<div>Please sign in to view your profile</div>}\n * />\n * ```\n */\nconst UserProfile: FC<UserProfileProps> = ({preferences, editable = true, ...rest}: UserProfileProps): ReactElement => {\n  const {preferences: contextPreferences} = useThunderID();\n  const {profile, flattenedProfile, onUpdateProfile, updateProfile, userSchema} = useUser();\n  const resolvedPreferences = {\n    ...contextPreferences,\n    ...preferences,\n    user: {\n      ...contextPreferences?.user,\n      ...preferences?.user,\n    },\n  };\n  const {t} = useTranslation(resolvedPreferences?.i18n);\n  const isEditableProfile: boolean = resolvedPreferences?.user?.fetchUserProfile === false ? false : editable;\n\n  const [error, setError] = useState<string | null>(null);\n\n  const handleProfileUpdate = async (payload: any): Promise<void> => {\n    setError(null);\n\n    const updatedAttributes = deepMerge((profile?.['attributes'] as Record<string, unknown>) ?? {}, payload);\n\n    Object.keys(updatedAttributes).forEach((key) => {\n      if (updatedAttributes[key] === undefined || updatedAttributes[key] === null) {\n        delete updatedAttributes[key];\n      }\n    });\n\n    const result: {data: {user: User}; error: string; success: boolean} = await updateProfile(\n      {payload: updatedAttributes},\n      await getSessionId(),\n    );\n\n    if (result.success) {\n      onUpdateProfile(result.data.user);\n    } else {\n      setError(result.error || t('user.profile.update.generic.error'));\n    }\n  };\n\n  return (\n    <BaseUserProfile\n      profile={profile!}\n      flattenedProfile={flattenedProfile!}\n      userSchema={userSchema}\n      editable={isEditableProfile}\n      onUpdate={isEditableProfile ? handleProfileUpdate : undefined}\n      error={error}\n      preferences={resolvedPreferences}\n      {...rest}\n    />\n  );\n};\n\nexport default UserProfile;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAwCA,MAAMA,eAAqC,EAAC,aAAa,WAAW,KAAM,GAAG,WAA0C;CACrH,MAAM,EAAC,aAAa,uBAAsBC,sBAAc;CACxD,MAAM,EAAC,SAAS,kBAAkB,iBAAiB,eAAe,eAAc,SAAS;CACzF,MAAM,sBAAsB;EAC1B,GAAG;EACH,GAAG;EACH,MAAM;GACJ,GAAG,oBAAoB;GACvB,GAAG,aAAa;GACjB;EACF;CACD,MAAM,EAAC,MAAK,eAAe,qBAAqB,KAAK;CACrD,MAAMC,oBAA6B,qBAAqB,MAAM,qBAAqB,QAAQ,QAAQ;CAEnG,MAAM,CAAC,OAAO,YAAY,SAAwB,KAAK;CAEvD,MAAM,sBAAsB,OAAO,YAAgC;AACjE,WAAS,KAAK;EAEd,MAAM,oBAAoB,UAAW,UAAU,iBAA6C,EAAE,EAAE,QAAQ;AAExG,SAAO,KAAK,kBAAkB,CAAC,SAAS,QAAQ;AAC9C,OAAI,kBAAkB,SAAS,UAAa,kBAAkB,SAAS,KACrE,QAAO,kBAAkB;IAE3B;EAEF,MAAMC,SAAgE,MAAM,cAC1E,EAAC,SAAS,mBAAkB,EAC5B,MAAMC,sBAAc,CACrB;AAED,MAAI,OAAO,QACT,iBAAgB,OAAO,KAAK,KAAK;MAEjC,UAAS,OAAO,SAAS,EAAE,oCAAoC,CAAC;;AAIpE,QACE,oBAAC;EACU;EACS;EACN;EACZ,UAAU;EACV,UAAU,oBAAoB,sBAAsB;EAC7C;EACP,aAAa;EACb,GAAI;GACJ;;AAIN,0BAAe"}
+{"version":3,"file":"UserProfile.js","names":["UserProfile: FC<UserProfileProps>","useThunderID","isEditableProfile: boolean","result: {data: {user: User}; error: string; success: boolean}","getSessionId","VerifyAttribute"],"sources":["../../../../../src/client/components/account/UserProfile/UserProfile.tsx"],"sourcesContent":["// Copyright 2025 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\n'use client';\n\nimport {AttributeVerificationConstants, deepMerge, User} from '@thunderid/node';\nimport {\n  BaseUserProfile,\n  BaseUserProfileProps,\n  BaseUserProfileVerificationRenderProps,\n  useUser,\n  useTranslation,\n} from '@thunderid/react';\nimport {FC, ReactElement, ReactNode, useState} from 'react';\nimport useThunderID from '../../../contexts/ThunderID/useThunderID';\nimport getSessionId from '../../../../server/actions/getSessionId';\nimport VerifyAttribute from '../VerifyAttribute/VerifyAttribute';\n\n/**\n * Props for the UserProfile component.\n * Extends BaseUserProfileProps but makes the user prop optional since it will be obtained from useThunderID\n */\nexport type UserProfileProps = Omit<BaseUserProfileProps, 'user' | 'profile' | 'flattenedProfile'> & {\n  /**\n   * Handle of the `SELF` flow that verifies an attribute. Defaults to the server's shipped\n   * `default-self-attribute-verification-flow`.\n   */\n  verificationFlowHandle?: string;\n};\n\n/**\n * UserProfile component displays the authenticated user's profile information in a\n * structured and styled format. It shows user details such as display name, email,\n * username, and other available profile information from ThunderID.\n *\n * This component is the React-specific implementation that uses the BaseUserProfile\n * and automatically retrieves the user data from ThunderID context if not provided.\n *\n * @example\n * ```tsx\n * // Basic usage - will use user from ThunderID context\n * <UserProfile />\n *\n * // With explicit user data\n * <UserProfile user={specificUser} />\n *\n * // With card layout and custom fallback\n * <UserProfile\n *   cardLayout={true}\n *   fallback={<div>Please sign in to view your profile</div>}\n * />\n * ```\n */\nconst UserProfile: FC<UserProfileProps> = ({\n  preferences,\n  editable = true,\n  verificationFlowHandle = AttributeVerificationConstants.DEFAULT_FLOW_HANDLE,\n  ...rest\n}: UserProfileProps): ReactElement => {\n  const {preferences: contextPreferences} = useThunderID();\n  const {profile, flattenedProfile, onUpdateProfile, updateProfile, userSchema} = useUser();\n  const resolvedPreferences = {\n    ...contextPreferences,\n    ...preferences,\n    user: {\n      ...contextPreferences?.user,\n      ...preferences?.user,\n    },\n  };\n  const {t} = useTranslation(resolvedPreferences?.i18n);\n  const isEditableProfile: boolean = resolvedPreferences?.user?.fetchUserProfile === false ? false : editable;\n\n  const [error, setError] = useState<string | null>(null);\n\n  const handleProfileUpdate = async (payload: any): Promise<void> => {\n    setError(null);\n\n    const updatedAttributes = deepMerge((profile?.['attributes'] as Record<string, unknown>) ?? {}, payload);\n\n    Object.keys(updatedAttributes).forEach((key) => {\n      if (updatedAttributes[key] === undefined || updatedAttributes[key] === null) {\n        delete updatedAttributes[key];\n      }\n    });\n\n    const result: {data: {user: User}; error: string; success: boolean} = await updateProfile(\n      {payload: updatedAttributes},\n      await getSessionId(),\n    );\n\n    if (result.success) {\n      onUpdateProfile(result.data.user);\n    } else {\n      setError(result.error || t('user.profile.update.generic.error'));\n    }\n  };\n\n  const renderVerification = ({\n    attribute,\n    attributeDisplayName,\n    onCancel,\n  }: BaseUserProfileVerificationRenderProps): ReactNode => (\n    <VerifyAttribute\n      key={attribute}\n      attribute={attribute}\n      attributeDisplayName={attributeDisplayName}\n      flowHandle={verificationFlowHandle}\n      preferences={resolvedPreferences}\n      onCancel={onCancel}\n      onDone={onCancel}\n    />\n  );\n\n  return (\n    <BaseUserProfile\n      renderVerification={isEditableProfile ? renderVerification : undefined}\n      profile={profile!}\n      flattenedProfile={flattenedProfile!}\n      userSchema={userSchema}\n      editable={isEditableProfile}\n      onUpdate={isEditableProfile ? handleProfileUpdate : undefined}\n      error={error}\n      preferences={resolvedPreferences}\n      {...rest}\n    />\n  );\n};\n\nexport default UserProfile;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAqDA,MAAMA,eAAqC,EACzC,aACA,WAAW,MACX,yBAAyB,+BAA+B,oBACxD,GAAG,WACiC;CACpC,MAAM,EAAC,aAAa,uBAAsBC,sBAAc;CACxD,MAAM,EAAC,SAAS,kBAAkB,iBAAiB,eAAe,eAAc,SAAS;CACzF,MAAM,sBAAsB;EAC1B,GAAG;EACH,GAAG;EACH,MAAM;GACJ,GAAG,oBAAoB;GACvB,GAAG,aAAa;GACjB;EACF;CACD,MAAM,EAAC,MAAK,eAAe,qBAAqB,KAAK;CACrD,MAAMC,oBAA6B,qBAAqB,MAAM,qBAAqB,QAAQ,QAAQ;CAEnG,MAAM,CAAC,OAAO,YAAY,SAAwB,KAAK;CAEvD,MAAM,sBAAsB,OAAO,YAAgC;AACjE,WAAS,KAAK;EAEd,MAAM,oBAAoB,UAAW,UAAU,iBAA6C,EAAE,EAAE,QAAQ;AAExG,SAAO,KAAK,kBAAkB,CAAC,SAAS,QAAQ;AAC9C,OAAI,kBAAkB,SAAS,UAAa,kBAAkB,SAAS,KACrE,QAAO,kBAAkB;IAE3B;EAEF,MAAMC,SAAgE,MAAM,cAC1E,EAAC,SAAS,mBAAkB,EAC5B,MAAMC,sBAAc,CACrB;AAED,MAAI,OAAO,QACT,iBAAgB,OAAO,KAAK,KAAK;MAEjC,UAAS,OAAO,SAAS,EAAE,oCAAoC,CAAC;;CAIpE,MAAM,sBAAsB,EAC1B,WACA,sBACA,eAEA,oBAACC;EAEY;EACW;EACtB,YAAY;EACZ,aAAa;EACH;EACV,QAAQ;IANH,UAOL;AAGJ,QACE,oBAAC;EACC,oBAAoB,oBAAoB,qBAAqB;EACpD;EACS;EACN;EACZ,UAAU;EACV,UAAU,oBAAoB,sBAAsB;EAC7C;EACP,aAAa;EACb,GAAI;GACJ;;AAIN,0BAAe"}

package/dist/client/components/account/VerifyAttribute/VerifyAttribute.d.ts

@@ -0,0 +1,41 @@
+import { BaseVerifyAttributeProps } from '@thunderid/react';
+import { FC } from 'react';
+/**
+ * Props for the VerifyAttribute component.
+ * Mirrors `@thunderid/react`'s `VerifyAttributeProps`, so a consumer moving between the React and
+ * Next.js SDKs doesn't need to change how they call it.
+ */
+export type VerifyAttributeProps = Omit<BaseVerifyAttributeProps, 'onInitialize' | 'onSubmit' | 'isInitialized'> & {
+    /**
+     * Name of the signed-in user's attribute to verify, such as `email`. Only a top-level, single-valued
+     * `email` or `mobile` property of the user's schema can be verified; any other is refused without a
+     * request, through `onError`, with `VerifyAttribute-handleInitialize-RuntimeError-001`.
+     */
+    attribute: string;
+    /**
+     * Handle of the `SELF` flow to run. Defaults to the server's shipped
+     * `default-self-attribute-verification-flow`.
+     */
+    flowHandle?: string;
+};
+/**
+ * VerifyAttribute verifies one of the signed-in user's attributes, such as their email address, by
+ * running a self attribute verification flow named by `flowHandle`.
+ *
+ * This is the Next.js-specific implementation: it renders `BaseVerifyAttribute` from
+ * `@thunderid/react`, but runs every step through `executeSelfFlowAction` (a server action that
+ * attaches the server-held session's access token) instead of calling the ThunderID server from the
+ * browser. Once the server records the verification, and when the user selects Done after a link is
+ * sent, it re-reads the user's profile.
+ *
+ * Mount it with a `key` per attribute: each mount starts a new verification and sends a new code or
+ * link.
+ *
+ * @example
+ * ```tsx
+ * <VerifyAttribute attribute="email" onComplete={() => setOpen(false)} onCancel={() => setOpen(false)} />
+ * ```
+ */
+declare const VerifyAttribute: FC<VerifyAttributeProps>;
+export default VerifyAttribute;
+//# sourceMappingURL=VerifyAttribute.d.ts.map

package/dist/client/components/account/VerifyAttribute/VerifyAttribute.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"VerifyAttribute.d.ts","sourceRoot":"","sources":["../../../../../src/client/components/account/VerifyAttribute/VerifyAttribute.tsx"],"names":[],"mappings":"AAeA,OAAO,EAAsB,wBAAwB,EAAU,MAAM,kBAAkB,CAAC;AACxF,OAAO,EAAC,EAAE,EAA4B,MAAM,OAAO,CAAC;AAMpD;;;;GAIG;AACH,MAAM,MAAM,oBAAoB,GAAG,IAAI,CAAC,wBAAwB,EAAE,cAAc,GAAG,UAAU,GAAG,eAAe,CAAC,GAAG;IACjH;;;;OAIG;IACH,SAAS,EAAE,MAAM,CAAC;IAClB;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,CAAC;AAmBF;;;;;;;;;;;;;;;;;GAiBG;AACH,QAAA,MAAM,eAAe,EAAE,EAAE,CAAC,oBAAoB,CAyD7C,CAAC;AAEF,eAAe,eAAe,CAAC"}

package/dist/client/components/account/VerifyAttribute/VerifyAttribute.js

@@ -0,0 +1,75 @@
+'use client';
+
+
+import useThunderID_default from "../../../contexts/ThunderID/useThunderID.js";
+import executeSelfFlowAction_default from "../../../../server/actions/auth/executeSelfFlowAction.js";
+import { AttributeVerificationConstants, EmbeddedFlowType, ThunderIDAPIError, ThunderIDRuntimeError, isVerifiableAttribute, startCase } from "@thunderid/node";
+import { BaseVerifyAttribute, useUser } from "@thunderid/react";
+import { useCallback } from "react";
+import { jsx } from "react/jsx-runtime";
+
+//#region src/client/components/account/VerifyAttribute/VerifyAttribute.tsx
+const execute = async (payload) => {
+	const result = await executeSelfFlowAction_default(payload);
+	if (!result.success) throw new ThunderIDAPIError("SELF flow request failed", "VerifyAttribute-execute-ResponseError-001", "nextjs", result.statusCode);
+	return result.data;
+};
+/**
+* VerifyAttribute verifies one of the signed-in user's attributes, such as their email address, by
+* running a self attribute verification flow named by `flowHandle`.
+*
+* This is the Next.js-specific implementation: it renders `BaseVerifyAttribute` from
+* `@thunderid/react`, but runs every step through `executeSelfFlowAction` (a server action that
+* attaches the server-held session's access token) instead of calling the ThunderID server from the
+* browser. Once the server records the verification, and when the user selects Done after a link is
+* sent, it re-reads the user's profile.
+*
+* Mount it with a `key` per attribute: each mount starts a new verification and sends a new code or
+* link.
+*
+* @example
+* ```tsx
+* <VerifyAttribute attribute="email" onComplete={() => setOpen(false)} onCancel={() => setOpen(false)} />
+* ```
+*/
+const VerifyAttribute = ({ attribute, attributeDisplayName, flowHandle = AttributeVerificationConstants.DEFAULT_FLOW_HANDLE, onComplete, onDone,...rest }) => {
+	const { isLoading } = useThunderID_default();
+	const { revalidateProfile, userSchema } = useUser();
+	const refreshProfile = useCallback(async () => {
+		try {
+			await revalidateProfile?.();
+		} catch {}
+	}, [revalidateProfile]);
+	const handleInitialize = useCallback(() => {
+		if (!isVerifiableAttribute(userSchema, attribute)) return Promise.reject(new ThunderIDRuntimeError(`Attribute "${attribute}" is not a verifiable email or mobile attribute.`, "VerifyAttribute-handleInitialize-RuntimeError-001", "nextjs", "Only a top-level, single-valued email or mobile attribute of the user schema can be verified."));
+		return execute({
+			flowType: EmbeddedFlowType.Self,
+			handle: flowHandle,
+			inputs: { [AttributeVerificationConstants.ATTRIBUTE_INPUT]: attribute }
+		});
+	}, [
+		attribute,
+		flowHandle,
+		userSchema
+	]);
+	return /* @__PURE__ */ jsx(BaseVerifyAttribute, {
+		...rest,
+		attributeDisplayName: attributeDisplayName ?? userSchema?.[attribute]?.displayName ?? startCase(attribute),
+		isInitialized: !isLoading,
+		onInitialize: handleInitialize,
+		onSubmit: execute,
+		onComplete: (response) => {
+			refreshProfile();
+			onComplete?.(response);
+		},
+		onDone: () => {
+			refreshProfile();
+			onDone?.();
+		}
+	});
+};
+var VerifyAttribute_default = VerifyAttribute;
+
+//#endregion
+export { VerifyAttribute_default as default };
+//# sourceMappingURL=VerifyAttribute.js.map

package/dist/client/components/account/VerifyAttribute/VerifyAttribute.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"VerifyAttribute.js","names":["result: ExecuteSelfFlowActionResult","executeSelfFlowAction","VerifyAttribute: FC<VerifyAttributeProps>","useThunderID"],"sources":["../../../../../src/client/components/account/VerifyAttribute/VerifyAttribute.tsx"],"sourcesContent":["// Copyright 2026 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\n'use client';\n\nimport {\n  AttributeVerificationConstants,\n  EmbeddedFlowType,\n  EmbeddedSelfFlowRequest,\n  EmbeddedSelfFlowResponse,\n  ThunderIDAPIError,\n  ThunderIDRuntimeError,\n  isVerifiableAttribute,\n  startCase,\n} from '@thunderid/node';\nimport {BaseVerifyAttribute, BaseVerifyAttributeProps, useUser} from '@thunderid/react';\nimport {FC, ReactElement, useCallback} from 'react';\nimport executeSelfFlowAction, {\n  ExecuteSelfFlowActionResult,\n} from '../../../../server/actions/auth/executeSelfFlowAction';\nimport useThunderID from '../../../contexts/ThunderID/useThunderID';\n\n/**\n * Props for the VerifyAttribute component.\n * Mirrors `@thunderid/react`'s `VerifyAttributeProps`, so a consumer moving between the React and\n * Next.js SDKs doesn't need to change how they call it.\n */\nexport type VerifyAttributeProps = Omit<BaseVerifyAttributeProps, 'onInitialize' | 'onSubmit' | 'isInitialized'> & {\n  /**\n   * Name of the signed-in user's attribute to verify, such as `email`. Only a top-level, single-valued\n   * `email` or `mobile` property of the user's schema can be verified; any other is refused without a\n   * request, through `onError`, with `VerifyAttribute-handleInitialize-RuntimeError-001`.\n   */\n  attribute: string;\n  /**\n   * Handle of the `SELF` flow to run. Defaults to the server's shipped\n   * `default-self-attribute-verification-flow`.\n   */\n  flowHandle?: string;\n};\n\n// Runs one step through the server action, which attaches the session's access token. A failure\n// raises `VerifyAttribute-execute-ResponseError-001` with the refusal's status, never the server's reply.\nconst execute = async (payload: EmbeddedSelfFlowRequest): Promise<EmbeddedSelfFlowResponse> => {\n  const result: ExecuteSelfFlowActionResult = await executeSelfFlowAction(payload);\n\n  if (!result.success) {\n    throw new ThunderIDAPIError(\n      'SELF flow request failed',\n      'VerifyAttribute-execute-ResponseError-001',\n      'nextjs',\n      result.statusCode,\n    );\n  }\n\n  return result.data;\n};\n\n/**\n * VerifyAttribute verifies one of the signed-in user's attributes, such as their email address, by\n * running a self attribute verification flow named by `flowHandle`.\n *\n * This is the Next.js-specific implementation: it renders `BaseVerifyAttribute` from\n * `@thunderid/react`, but runs every step through `executeSelfFlowAction` (a server action that\n * attaches the server-held session's access token) instead of calling the ThunderID server from the\n * browser. Once the server records the verification, and when the user selects Done after a link is\n * sent, it re-reads the user's profile.\n *\n * Mount it with a `key` per attribute: each mount starts a new verification and sends a new code or\n * link.\n *\n * @example\n * ```tsx\n * <VerifyAttribute attribute=\"email\" onComplete={() => setOpen(false)} onCancel={() => setOpen(false)} />\n * ```\n */\nconst VerifyAttribute: FC<VerifyAttributeProps> = ({\n  attribute,\n  attributeDisplayName,\n  flowHandle = AttributeVerificationConstants.DEFAULT_FLOW_HANDLE,\n  onComplete,\n  onDone,\n  ...rest\n}: VerifyAttributeProps): ReactElement => {\n  const {isLoading} = useThunderID();\n  const {revalidateProfile, userSchema} = useUser();\n\n  // Re-reads the profile so the recorded verification shows; a failure leaves it stale, not broken.\n  const refreshProfile = useCallback(async (): Promise<void> => {\n    try {\n      await revalidateProfile?.();\n    } catch {\n      // Non-fatal: the profile stays stale until the next re-read.\n    }\n  }, [revalidateProfile]);\n\n  const handleInitialize = useCallback((): Promise<EmbeddedSelfFlowResponse> => {\n    if (!isVerifiableAttribute(userSchema, attribute)) {\n      return Promise.reject(\n        new ThunderIDRuntimeError(\n          `Attribute \"${attribute}\" is not a verifiable email or mobile attribute.`,\n          'VerifyAttribute-handleInitialize-RuntimeError-001',\n          'nextjs',\n          'Only a top-level, single-valued email or mobile attribute of the user schema can be verified.',\n        ),\n      );\n    }\n\n    return execute({\n      flowType: EmbeddedFlowType.Self,\n      handle: flowHandle,\n      inputs: {[AttributeVerificationConstants.ATTRIBUTE_INPUT]: attribute},\n    });\n  }, [attribute, flowHandle, userSchema]);\n\n  return (\n    <BaseVerifyAttribute\n      {...rest}\n      attributeDisplayName={attributeDisplayName ?? userSchema?.[attribute]?.displayName ?? startCase(attribute)}\n      // The schema decides whether the attribute can be verified, so wait for the session to load.\n      isInitialized={!isLoading}\n      onInitialize={handleInitialize}\n      onSubmit={execute}\n      onComplete={(response: EmbeddedSelfFlowResponse): void => {\n        void refreshProfile();\n        onComplete?.(response);\n      }}\n      onDone={(): void => {\n        void refreshProfile();\n        onDone?.();\n      }}\n    />\n  );\n};\n\nexport default VerifyAttribute;\n"],"mappings":";;;;;;;;;;;AA2CA,MAAM,UAAU,OAAO,YAAwE;CAC7F,MAAMA,SAAsC,MAAMC,8BAAsB,QAAQ;AAEhF,KAAI,CAAC,OAAO,QACV,OAAM,IAAI,kBACR,4BACA,6CACA,UACA,OAAO,WACR;AAGH,QAAO,OAAO;;;;;;;;;;;;;;;;;;;;AAqBhB,MAAMC,mBAA6C,EACjD,WACA,sBACA,aAAa,+BAA+B,qBAC5C,YACA,OACA,GAAG,WACqC;CACxC,MAAM,EAAC,cAAaC,sBAAc;CAClC,MAAM,EAAC,mBAAmB,eAAc,SAAS;CAGjD,MAAM,iBAAiB,YAAY,YAA2B;AAC5D,MAAI;AACF,SAAM,qBAAqB;UACrB;IAGP,CAAC,kBAAkB,CAAC;CAEvB,MAAM,mBAAmB,kBAAqD;AAC5E,MAAI,CAAC,sBAAsB,YAAY,UAAU,CAC/C,QAAO,QAAQ,OACb,IAAI,sBACF,cAAc,UAAU,mDACxB,qDACA,UACA,gGACD,CACF;AAGH,SAAO,QAAQ;GACb,UAAU,iBAAiB;GAC3B,QAAQ;GACR,QAAQ,GAAE,+BAA+B,kBAAkB,WAAU;GACtE,CAAC;IACD;EAAC;EAAW;EAAY;EAAW,CAAC;AAEvC,QACE,oBAAC;EACC,GAAI;EACJ,sBAAsB,wBAAwB,aAAa,YAAY,eAAe,UAAU,UAAU;EAE1G,eAAe,CAAC;EAChB,cAAc;EACd,UAAU;EACV,aAAa,aAA6C;AACxD,GAAK,gBAAgB;AACrB,gBAAa,SAAS;;EAExB,cAAoB;AAClB,GAAK,gBAAgB;AACrB,aAAU;;GAEZ;;AAIN,8BAAe"}