@thunderid/nextjs 1.13.0 → 1.14.0

package/dist/cjs/index.cjs

@@ -21,25 +21,36 @@ const require_UserProfile = require('./client/components/account/UserProfile/Use
 const require_UserDropdown = require('./client/components/account/UserDropdown/UserDropdown.cjs');
 const require_UserAvatar = require('./client/components/account/UserAvatar/UserAvatar.cjs');
 const require_ChangeCredential = require('./client/components/account/ChangeCredential/ChangeCredential.cjs');
+const require_OrganizationUnitSwitcher = require('./client/components/account/OrganizationUnitSwitcher/OrganizationUnitSwitcher.cjs');
 const require_UserSelect = require('./client/components/primitives/UserSelect/UserSelect.cjs');
 const require_AuthFlowSelect = require('./client/components/primitives/AuthFlowSelect/AuthFlowSelect.cjs');
 const require_UserTypeSelect = require('./client/components/primitives/UserTypeSelect/UserTypeSelect.cjs');
-const require_UserList = require('./client/components/admin/UserList/UserList.cjs');
-const require_UserCreate = require('./client/components/admin/UserCreate/UserCreate.cjs');
-const require_UserDetails = require('./client/components/admin/UserDetails/UserDetails.cjs');
-const require_GroupList = require('./client/components/admin/GroupList/GroupList.cjs');
-const require_GroupCreate = require('./client/components/admin/GroupCreate/GroupCreate.cjs');
-const require_GroupMembers = require('./client/components/admin/GroupMembers/GroupMembers.cjs');
-const require_RoleList = require('./client/components/admin/RoleList/RoleList.cjs');
-const require_RoleCreate = require('./client/components/admin/RoleCreate/RoleCreate.cjs');
-const require_RoleAssignments = require('./client/components/admin/RoleAssignments/RoleAssignments.cjs');
-const require_RolePermissions = require('./client/components/admin/RolePermissions/RolePermissions.cjs');
-const require_AgentList = require('./client/components/admin/AgentList/AgentList.cjs');
-const require_AgentCreate = require('./client/components/admin/AgentCreate/AgentCreate.cjs');
-const require_AgentDetails = require('./client/components/admin/AgentDetails/AgentDetails.cjs');
-const require_ApplicationList = require('./client/components/admin/ApplicationList/ApplicationList.cjs');
-const require_ApplicationCreate = require('./client/components/admin/ApplicationCreate/ApplicationCreate.cjs');
-const require_ApplicationDetails = require('./client/components/admin/ApplicationDetails/ApplicationDetails.cjs');
+const require_UserList = require('./client/components/management/UserList/UserList.cjs');
+const require_UserCreate = require('./client/components/management/UserCreate/UserCreate.cjs');
+const require_UserDetails = require('./client/components/management/UserDetails/UserDetails.cjs');
+const require_GroupList = require('./client/components/management/GroupList/GroupList.cjs');
+const require_GroupCreate = require('./client/components/management/GroupCreate/GroupCreate.cjs');
+const require_GroupMembers = require('./client/components/management/GroupMembers/GroupMembers.cjs');
+const require_RoleList = require('./client/components/management/RoleList/RoleList.cjs');
+const require_RoleCreate = require('./client/components/management/RoleCreate/RoleCreate.cjs');
+const require_RoleAssignments = require('./client/components/management/RoleAssignments/RoleAssignments.cjs');
+const require_RolePermissions = require('./client/components/management/RolePermissions/RolePermissions.cjs');
+const require_GroupDetails = require('./client/components/management/GroupDetails/GroupDetails.cjs');
+const require_RoleDetails = require('./client/components/management/RoleDetails/RoleDetails.cjs');
+const require_AgentList = require('./client/components/management/AgentList/AgentList.cjs');
+const require_AgentCreate = require('./client/components/management/AgentCreate/AgentCreate.cjs');
+const require_AgentDetails = require('./client/components/management/AgentDetails/AgentDetails.cjs');
+const require_ApplicationList = require('./client/components/management/ApplicationList/ApplicationList.cjs');
+const require_ApplicationCreate = require('./client/components/management/ApplicationCreate/ApplicationCreate.cjs');
+const require_ApplicationDetails = require('./client/components/management/ApplicationDetails/ApplicationDetails.cjs');
+const require_ProjectList = require('./client/components/management/ProjectList/ProjectList.cjs');
+const require_ProjectCreate = require('./client/components/management/ProjectCreate/ProjectCreate.cjs');
+const require_ProjectDetails = require('./client/components/management/ProjectDetails/ProjectDetails.cjs');
+const require_ProjectSwitcher = require('./client/components/management/ProjectSwitcher/ProjectSwitcher.cjs');
+const require_OrganizationUnitList = require('./client/components/management/OrganizationUnitList/OrganizationUnitList.cjs');
+const require_OrganizationUnitCreate = require('./client/components/management/OrganizationUnitCreate/OrganizationUnitCreate.cjs');
+const require_OrganizationUnitDetails = require('./client/components/management/OrganizationUnitDetails/OrganizationUnitDetails.cjs');
+const require_SharingPolicies = require('./client/components/management/SharingPolicies/SharingPolicies.cjs');
 const require_useGrantedPermissions = require('./client/hooks/management/useGrantedPermissions.cjs');
 require('./client/index.cjs');
 let __thunderid_react = require("@thunderid/react");
@@ -94,6 +105,12 @@ Object.defineProperty(exports, 'BaseGroupCreate', {
     return __thunderid_react.BaseGroupCreate;
   }
 });
+Object.defineProperty(exports, 'BaseGroupDetails', {
+  enumerable: true,
+  get: function () {
+    return __thunderid_react.BaseGroupDetails;
+  }
+});
 Object.defineProperty(exports, 'BaseGroupList', {
   enumerable: true,
   get: function () {
@@ -106,6 +123,48 @@ Object.defineProperty(exports, 'BaseGroupMembers', {
     return __thunderid_react.BaseGroupMembers;
   }
 });
+Object.defineProperty(exports, 'BaseOrganizationUnitCreate', {
+  enumerable: true,
+  get: function () {
+    return __thunderid_react.BaseOrganizationUnitCreate;
+  }
+});
+Object.defineProperty(exports, 'BaseOrganizationUnitDetails', {
+  enumerable: true,
+  get: function () {
+    return __thunderid_react.BaseOrganizationUnitDetails;
+  }
+});
+Object.defineProperty(exports, 'BaseOrganizationUnitList', {
+  enumerable: true,
+  get: function () {
+    return __thunderid_react.BaseOrganizationUnitList;
+  }
+});
+Object.defineProperty(exports, 'BaseProjectCreate', {
+  enumerable: true,
+  get: function () {
+    return __thunderid_react.BaseProjectCreate;
+  }
+});
+Object.defineProperty(exports, 'BaseProjectDetails', {
+  enumerable: true,
+  get: function () {
+    return __thunderid_react.BaseProjectDetails;
+  }
+});
+Object.defineProperty(exports, 'BaseProjectList', {
+  enumerable: true,
+  get: function () {
+    return __thunderid_react.BaseProjectList;
+  }
+});
+Object.defineProperty(exports, 'BaseProjectSwitcher', {
+  enumerable: true,
+  get: function () {
+    return __thunderid_react.BaseProjectSwitcher;
+  }
+});
 Object.defineProperty(exports, 'BaseRoleAssignments', {
   enumerable: true,
   get: function () {
@@ -118,6 +177,12 @@ Object.defineProperty(exports, 'BaseRoleCreate', {
     return __thunderid_react.BaseRoleCreate;
   }
 });
+Object.defineProperty(exports, 'BaseRoleDetails', {
+  enumerable: true,
+  get: function () {
+    return __thunderid_react.BaseRoleDetails;
+  }
+});
 Object.defineProperty(exports, 'BaseRoleList', {
   enumerable: true,
   get: function () {
@@ -130,6 +195,12 @@ Object.defineProperty(exports, 'BaseRolePermissions', {
     return __thunderid_react.BaseRolePermissions;
   }
 });
+Object.defineProperty(exports, 'BaseSharingPolicies', {
+  enumerable: true,
+  get: function () {
+    return __thunderid_react.BaseSharingPolicies;
+  }
+});
 Object.defineProperty(exports, 'BaseUserCreate', {
   enumerable: true,
   get: function () {
@@ -151,12 +222,23 @@ Object.defineProperty(exports, 'BaseUserList', {
 exports.ChangeCredential = require_ChangeCredential.default;
 exports.DeviceGrant = require_DeviceGrant.default;
 exports.GroupCreate = require_GroupCreate.default;
+exports.GroupDetails = require_GroupDetails.default;
 exports.GroupList = require_GroupList.default;
 exports.GroupMembers = require_GroupMembers.default;
+exports.OrganizationUnitCreate = require_OrganizationUnitCreate.default;
+exports.OrganizationUnitDetails = require_OrganizationUnitDetails.default;
+exports.OrganizationUnitList = require_OrganizationUnitList.default;
+exports.OrganizationUnitSwitcher = require_OrganizationUnitSwitcher.default;
+exports.ProjectCreate = require_ProjectCreate.default;
+exports.ProjectDetails = require_ProjectDetails.default;
+exports.ProjectList = require_ProjectList.default;
+exports.ProjectSwitcher = require_ProjectSwitcher.default;
 exports.RoleAssignments = require_RoleAssignments.default;
 exports.RoleCreate = require_RoleCreate.default;
+exports.RoleDetails = require_RoleDetails.default;
 exports.RoleList = require_RoleList.default;
 exports.RolePermissions = require_RolePermissions.default;
+exports.SharingPolicies = require_SharingPolicies.default;
 exports.SignIn = require_SignIn.default;
 exports.SignInButton = require_SignInButton.default;
 exports.SignOutButton = require_SignOutButton.default;

package/dist/cjs/server/actions/account/getAccessibleOrganizationUnitsAction.cjs

@@ -0,0 +1,53 @@
+'use server';
+
+
+const require_rolldown_runtime = require('../../../_virtual/rolldown_runtime.cjs');
+const require_getClient = require('../../getClient.cjs');
+const require_getAccessToken = require('../getAccessToken.cjs');
+let __thunderid_node = require("@thunderid/node");
+__thunderid_node = require_rolldown_runtime.__toESM(__thunderid_node);
+
+//#region src/server/actions/account/getAccessibleOrganizationUnitsAction.ts
+/**
+* Lists the organization units the signed-in user can access (`/users/me/ous`) with the session's
+* access token, which stays on the server. Only `scope`, `limit` and `offset` are taken from the caller;
+* the session is the one in the request's cookie.
+*
+* Failures are returned rather than thrown, so the error crosses the server action boundary with its
+* status and code, and without the server's message.
+*/
+const getAccessibleOrganizationUnitsAction = async ({ limit, offset, scope } = {}) => {
+	const accessToken = await require_getAccessToken.default();
+	if (!accessToken) return {
+		statusCode: 401,
+		success: false
+	};
+	try {
+		const client = require_getClient.default();
+		if (!client.isInitialized) await client.initialize({});
+		const config = await client.getConfiguration();
+		return {
+			data: await (0, __thunderid_node.getAccessibleOrganizationUnits)({
+				baseUrl: config.baseUrl,
+				headers: { Authorization: `Bearer ${accessToken}` },
+				limit,
+				offset,
+				scope: scope === "siblings" ? "siblings" : void 0,
+				url: (0, __thunderid_node.resolveResourceEndpoint)("usersMeOrganizationUnits", config)
+			}),
+			success: true
+		};
+	} catch (error) {
+		if (error instanceof __thunderid_node.ThunderIDAPIError) return {
+			code: error.code,
+			statusCode: error.statusCode,
+			success: false
+		};
+		return { success: false };
+	}
+};
+var getAccessibleOrganizationUnitsAction_default = getAccessibleOrganizationUnitsAction;
+
+//#endregion
+exports.default = getAccessibleOrganizationUnitsAction_default;
+//# sourceMappingURL=getAccessibleOrganizationUnitsAction.cjs.map

package/dist/cjs/server/actions/account/getAccessibleOrganizationUnitsAction.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"getAccessibleOrganizationUnitsAction.cjs","names":["accessToken: string | undefined","getAccessToken","getClient","config: ThunderIDNextConfig","ThunderIDAPIError"],"sources":["../../../../../src/server/actions/account/getAccessibleOrganizationUnitsAction.ts"],"sourcesContent":["// Copyright 2026 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\n'use server';\n\nimport {\n  AccessibleOrganizationUnitList,\n  AccessibleOrganizationUnitsOptions,\n  ThunderIDAPIError,\n  getAccessibleOrganizationUnits,\n  resolveResourceEndpoint,\n} from '@thunderid/node';\nimport {ThunderIDNextConfig} from '../../../models/config';\nimport getClient from '../../getClient';\nimport getAccessToken from '../getAccessToken';\n\nexport type GetAccessibleOrganizationUnitsActionResult =\n  | {data: AccessibleOrganizationUnitList; success: true}\n  | {code?: string; statusCode?: number; success: false};\n\n/**\n * Lists the organization units the signed-in user can access (`/users/me/ous`) with the session's\n * access token, which stays on the server. Only `scope`, `limit` and `offset` are taken from the caller;\n * the session is the one in the request's cookie.\n *\n * Failures are returned rather than thrown, so the error crosses the server action boundary with its\n * status and code, and without the server's message.\n */\nconst getAccessibleOrganizationUnitsAction = async ({\n  limit,\n  offset,\n  scope,\n}: AccessibleOrganizationUnitsOptions = {}): Promise<GetAccessibleOrganizationUnitsActionResult> => {\n  const accessToken: string | undefined = await getAccessToken();\n\n  if (!accessToken) {\n    return {statusCode: 401, success: false};\n  }\n\n  try {\n    const client = getClient();\n\n    if (!client.isInitialized) {\n      await client.initialize({} as ThunderIDNextConfig);\n    }\n\n    const config: ThunderIDNextConfig = await client.getConfiguration();\n    const data: AccessibleOrganizationUnitList = await getAccessibleOrganizationUnits({\n      baseUrl: config.baseUrl,\n      headers: {Authorization: `Bearer ${accessToken}`},\n      limit,\n      offset,\n      scope: scope === 'siblings' ? 'siblings' : undefined,\n      url: resolveResourceEndpoint('usersMeOrganizationUnits', config),\n    });\n\n    return {data, success: true};\n  } catch (error) {\n    if (error instanceof ThunderIDAPIError) {\n      return {code: error.code, statusCode: error.statusCode, success: false};\n    }\n\n    return {success: false};\n  }\n};\n\nexport default getAccessibleOrganizationUnitsAction;\n"],"mappings":";;;;;;;;;;;;;;;;;;AA4BA,MAAM,uCAAuC,OAAO,EAClD,OACA,QACA,UACsC,EAAE,KAA0D;CAClG,MAAMA,cAAkC,MAAMC,gCAAgB;AAE9D,KAAI,CAAC,YACH,QAAO;EAAC,YAAY;EAAK,SAAS;EAAM;AAG1C,KAAI;EACF,MAAM,SAASC,2BAAW;AAE1B,MAAI,CAAC,OAAO,cACV,OAAM,OAAO,WAAW,EAAE,CAAwB;EAGpD,MAAMC,SAA8B,MAAM,OAAO,kBAAkB;AAUnE,SAAO;GAAC,MATqC,2DAAqC;IAChF,SAAS,OAAO;IAChB,SAAS,EAAC,eAAe,UAAU,eAAc;IACjD;IACA;IACA,OAAO,UAAU,aAAa,aAAa;IAC3C,mDAA6B,4BAA4B,OAAO;IACjE,CAAC;GAEY,SAAS;GAAK;UACrB,OAAO;AACd,MAAI,iBAAiBC,mCACnB,QAAO;GAAC,MAAM,MAAM;GAAM,YAAY,MAAM;GAAY,SAAS;GAAM;AAGzE,SAAO,EAAC,SAAS,OAAM;;;AAI3B,mDAAe"}

package/dist/cjs/server/actions/account/getCurrentOrganizationUnitAction.cjs

@@ -0,0 +1,31 @@
+'use server';
+
+
+const require_rolldown_runtime = require('../../../_virtual/rolldown_runtime.cjs');
+const require_getAccessToken = require('../getAccessToken.cjs');
+let __thunderid_node = require("@thunderid/node");
+__thunderid_node = require_rolldown_runtime.__toESM(__thunderid_node);
+let jose = require("jose");
+jose = require_rolldown_runtime.__toESM(jose);
+
+//#region src/server/actions/account/getCurrentOrganizationUnitAction.ts
+/**
+* Reads the organization unit the signed-in session was issued for from the `ouId`, `ouHandle` and
+* `ouName` claims of the session's token, or `null` when they are absent (an access token carries
+* `ouId` only when the application's token configuration asks for it). For display only, never for
+* an authorization decision.
+*/
+const getCurrentOrganizationUnitAction = async () => {
+	const accessToken = await require_getAccessToken.default();
+	if (!accessToken) return null;
+	try {
+		return (0, __thunderid_node.getCurrentOrganizationUnitFromClaims)((0, jose.decodeJwt)(accessToken));
+	} catch {
+		return null;
+	}
+};
+var getCurrentOrganizationUnitAction_default = getCurrentOrganizationUnitAction;
+
+//#endregion
+exports.default = getCurrentOrganizationUnitAction_default;
+//# sourceMappingURL=getCurrentOrganizationUnitAction.cjs.map

package/dist/cjs/server/actions/account/getCurrentOrganizationUnitAction.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"getCurrentOrganizationUnitAction.cjs","names":["accessToken: string | undefined","getAccessToken"],"sources":["../../../../../src/server/actions/account/getCurrentOrganizationUnitAction.ts"],"sourcesContent":["// Copyright 2026 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\n'use server';\n\nimport {CurrentOrganizationUnit, getCurrentOrganizationUnitFromClaims} from '@thunderid/node';\nimport {decodeJwt} from 'jose';\nimport getAccessToken from '../getAccessToken';\n\n/**\n * Reads the organization unit the signed-in session was issued for from the `ouId`, `ouHandle` and\n * `ouName` claims of the session's token, or `null` when they are absent (an access token carries\n * `ouId` only when the application's token configuration asks for it). For display only, never for\n * an authorization decision.\n */\nconst getCurrentOrganizationUnitAction = async (): Promise<CurrentOrganizationUnit | null> => {\n  const accessToken: string | undefined = await getAccessToken();\n\n  if (!accessToken) {\n    return null;\n  }\n\n  try {\n    return getCurrentOrganizationUnitFromClaims(decodeJwt(accessToken) as Record<string, unknown>);\n  } catch {\n    return null;\n  }\n};\n\nexport default getCurrentOrganizationUnitAction;\n"],"mappings":";;;;;;;;;;;;;;;;;AAeA,MAAM,mCAAmC,YAAqD;CAC5F,MAAMA,cAAkC,MAAMC,gCAAgB;AAE9D,KAAI,CAAC,YACH,QAAO;AAGT,KAAI;AACF,wFAAsD,YAAY,CAA4B;SACxF;AACN,SAAO;;;AAIX,+CAAe"}

package/dist/cjs/server/actions/auth/switchOrganizationUnitAction.cjs

@@ -0,0 +1,85 @@
+'use server';
+
+
+const require_rolldown_runtime = require('../../../_virtual/rolldown_runtime.cjs');
+const require_SessionManager = require('../../../utils/SessionManager.cjs');
+const require_getSessionId = require('../getSessionId.cjs');
+const require_getClient = require('../../getClient.cjs');
+const require_signInAction = require('./signInAction.cjs');
+let __thunderid_node = require("@thunderid/node");
+__thunderid_node = require_rolldown_runtime.__toESM(__thunderid_node);
+let next_headers = require("next/headers");
+next_headers = require_rolldown_runtime.__toESM(next_headers);
+
+//#region src/server/actions/auth/switchOrganizationUnitAction.ts
+/**
+* Starts a switch of the signed-in session to the organization unit `organizationUnitId`.
+*
+* - Redirect mode returns the unit's authorization URL (`{baseUrl}/ou/{ouId}/oauth2/authorize`) to send
+*   the browser to, and marks the session so the OAuth callback redeems the code for it: the code is
+*   redeemed at the unit's token endpoint and replaces the session. With `redirect: false` it fails
+*   with `interaction_required` instead, since a server cannot switch silently.
+* - Embedded mode starts an `AUTHENTICATION` flow with `ouId`. When the SSO session is reused the flow
+*   completes at once and its assertion replaces the session cookie; a flow that needs input fails
+*   with `interaction_required`.
+*
+* The previous session stays as it was on any failure. The error code is one of
+* `OrganizationUnitSwitchErrorCodes`.
+*/
+const switchOrganizationUnitAction = async (organizationUnitId, options = {}) => {
+	if (typeof organizationUnitId !== "string" || organizationUnitId.trim() === "") return {
+		code: __thunderid_node.OrganizationUnitSwitchErrorCodes.InvalidOrganizationUnit,
+		statusCode: 400,
+		success: false
+	};
+	const sessionId = await require_getSessionId.default();
+	if (!sessionId) return {
+		code: __thunderid_node.OrganizationUnitSwitchErrorCodes.Failed,
+		statusCode: 401,
+		success: false
+	};
+	try {
+		const client = require_getClient.default();
+		if (!client.isInitialized) await client.initialize({});
+		const config = await client.getConfiguration();
+		if (config.mode === "embedded") {
+			const result = await require_signInAction.default({
+				applicationId: config.applicationId,
+				flowType: __thunderid_node.EmbeddedFlowType.Authentication,
+				ouId: organizationUnitId
+			});
+			if (result.success && result.data?.afterSignInUrl) return {
+				data: { switched: true },
+				success: true
+			};
+			if (result.success) return {
+				code: __thunderid_node.OrganizationUnitSwitchErrorCodes.InteractionRequired,
+				success: false
+			};
+			return {
+				code: (result.error ?? "").includes("FES-1023") ? __thunderid_node.OrganizationUnitSwitchErrorCodes.UnauthorizedClient : __thunderid_node.OrganizationUnitSwitchErrorCodes.Failed,
+				success: false
+			};
+		}
+		if (options.redirect === false) return {
+			code: __thunderid_node.OrganizationUnitSwitchErrorCodes.InteractionRequired,
+			success: false
+		};
+		const signInUrl = await client.getAuthorizeRequestUrl({ organizationUnitId }, sessionId);
+		(await (0, next_headers.cookies)()).set(require_SessionManager.default.getTempSessionCookieName(), await require_SessionManager.default.createTempSession(sessionId), require_SessionManager.default.getTempSessionCookieOptions());
+		return {
+			data: { signInUrl },
+			success: true
+		};
+	} catch {
+		return {
+			code: __thunderid_node.OrganizationUnitSwitchErrorCodes.Failed,
+			success: false
+		};
+	}
+};
+var switchOrganizationUnitAction_default = switchOrganizationUnitAction;
+
+//#endregion
+exports.default = switchOrganizationUnitAction_default;
+//# sourceMappingURL=switchOrganizationUnitAction.cjs.map

package/dist/cjs/server/actions/auth/switchOrganizationUnitAction.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"switchOrganizationUnitAction.cjs","names":["OrganizationUnitSwitchErrorCodes","sessionId: string | undefined","getSessionId","getClient","config: ThunderIDNextConfig","result: Awaited<ReturnType<typeof signInAction>>","signInAction","EmbeddedFlowType","signInUrl: string","SessionManager"],"sources":["../../../../../src/server/actions/auth/switchOrganizationUnitAction.ts"],"sourcesContent":["// Copyright 2026 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\n'use server';\n\nimport {EmbeddedFlowType, OrganizationUnitSwitchErrorCodes} from '@thunderid/node';\nimport {cookies} from 'next/headers';\nimport signInAction from './signInAction';\nimport {ThunderIDNextConfig} from '../../../models/config';\nimport SessionManager from '../../../utils/SessionManager';\nimport getClient from '../../getClient';\nimport getSessionId from '../getSessionId';\n\ntype RequestCookies = Awaited<ReturnType<typeof cookies>>;\n\nexport type SwitchOrganizationUnitActionResult =\n  | {data: {signInUrl?: string; switched?: boolean}; success: true}\n  | {code: string; statusCode?: number; success: false};\n\n/**\n * Starts a switch of the signed-in session to the organization unit `organizationUnitId`.\n *\n * - Redirect mode returns the unit's authorization URL (`{baseUrl}/ou/{ouId}/oauth2/authorize`) to send\n *   the browser to, and marks the session so the OAuth callback redeems the code for it: the code is\n *   redeemed at the unit's token endpoint and replaces the session. With `redirect: false` it fails\n *   with `interaction_required` instead, since a server cannot switch silently.\n * - Embedded mode starts an `AUTHENTICATION` flow with `ouId`. When the SSO session is reused the flow\n *   completes at once and its assertion replaces the session cookie; a flow that needs input fails\n *   with `interaction_required`.\n *\n * The previous session stays as it was on any failure. The error code is one of\n * `OrganizationUnitSwitchErrorCodes`.\n */\nconst switchOrganizationUnitAction = async (\n  organizationUnitId: string,\n  options: {redirect?: boolean} = {},\n): Promise<SwitchOrganizationUnitActionResult> => {\n  if (typeof organizationUnitId !== 'string' || organizationUnitId.trim() === '') {\n    return {code: OrganizationUnitSwitchErrorCodes.InvalidOrganizationUnit, statusCode: 400, success: false};\n  }\n\n  const sessionId: string | undefined = await getSessionId();\n\n  if (!sessionId) {\n    return {code: OrganizationUnitSwitchErrorCodes.Failed, statusCode: 401, success: false};\n  }\n\n  try {\n    const client = getClient();\n\n    if (!client.isInitialized) {\n      await client.initialize({} as ThunderIDNextConfig);\n    }\n\n    const config: ThunderIDNextConfig = await client.getConfiguration();\n\n    if (config.mode === 'embedded') {\n      const result: Awaited<ReturnType<typeof signInAction>> = await signInAction({\n        applicationId: config.applicationId,\n        flowType: EmbeddedFlowType.Authentication,\n        ouId: organizationUnitId,\n      });\n\n      if (result.success && (result.data as {afterSignInUrl?: string} | undefined)?.afterSignInUrl) {\n        return {data: {switched: true}, success: true};\n      }\n\n      if (result.success) {\n        return {code: OrganizationUnitSwitchErrorCodes.InteractionRequired, success: false};\n      }\n\n      // FES-1023: a unit the application is not accessible from, or one that does not exist.\n      return {\n        code: (result.error ?? '').includes('FES-1023')\n          ? OrganizationUnitSwitchErrorCodes.UnauthorizedClient\n          : OrganizationUnitSwitchErrorCodes.Failed,\n        success: false,\n      };\n    }\n\n    if (options.redirect === false) {\n      return {code: OrganizationUnitSwitchErrorCodes.InteractionRequired, success: false};\n    }\n\n    const signInUrl: string = await client.getAuthorizeRequestUrl({organizationUnitId}, sessionId);\n    const cookieStore: RequestCookies = await cookies();\n\n    // The OAuth callback finds the session it completes through the temporary session cookie.\n    cookieStore.set(\n      SessionManager.getTempSessionCookieName(),\n      await SessionManager.createTempSession(sessionId),\n      SessionManager.getTempSessionCookieOptions(),\n    );\n\n    return {data: {signInUrl}, success: true};\n  } catch {\n    return {code: OrganizationUnitSwitchErrorCodes.Failed, success: false};\n  }\n};\n\nexport default switchOrganizationUnitAction;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAiCA,MAAM,+BAA+B,OACnC,oBACA,UAAgC,EAAE,KACc;AAChD,KAAI,OAAO,uBAAuB,YAAY,mBAAmB,MAAM,KAAK,GAC1E,QAAO;EAAC,MAAMA,kDAAiC;EAAyB,YAAY;EAAK,SAAS;EAAM;CAG1G,MAAMC,YAAgC,MAAMC,8BAAc;AAE1D,KAAI,CAAC,UACH,QAAO;EAAC,MAAMF,kDAAiC;EAAQ,YAAY;EAAK,SAAS;EAAM;AAGzF,KAAI;EACF,MAAM,SAASG,2BAAW;AAE1B,MAAI,CAAC,OAAO,cACV,OAAM,OAAO,WAAW,EAAE,CAAwB;EAGpD,MAAMC,SAA8B,MAAM,OAAO,kBAAkB;AAEnE,MAAI,OAAO,SAAS,YAAY;GAC9B,MAAMC,SAAmD,MAAMC,6BAAa;IAC1E,eAAe,OAAO;IACtB,UAAUC,kCAAiB;IAC3B,MAAM;IACP,CAAC;AAEF,OAAI,OAAO,WAAY,OAAO,MAAgD,eAC5E,QAAO;IAAC,MAAM,EAAC,UAAU,MAAK;IAAE,SAAS;IAAK;AAGhD,OAAI,OAAO,QACT,QAAO;IAAC,MAAMP,kDAAiC;IAAqB,SAAS;IAAM;AAIrF,UAAO;IACL,OAAO,OAAO,SAAS,IAAI,SAAS,WAAW,GAC3CA,kDAAiC,qBACjCA,kDAAiC;IACrC,SAAS;IACV;;AAGH,MAAI,QAAQ,aAAa,MACvB,QAAO;GAAC,MAAMA,kDAAiC;GAAqB,SAAS;GAAM;EAGrF,MAAMQ,YAAoB,MAAM,OAAO,uBAAuB,EAAC,oBAAmB,EAAE,UAAU;AAI9F,GAHoC,iCAAe,EAGvC,IACVC,+BAAe,0BAA0B,EACzC,MAAMA,+BAAe,kBAAkB,UAAU,EACjDA,+BAAe,6BAA6B,CAC7C;AAED,SAAO;GAAC,MAAM,EAAC,WAAU;GAAE,SAAS;GAAK;SACnC;AACN,SAAO;GAAC,MAAMT,kDAAiC;GAAQ,SAAS;GAAM;;;AAI1E,2CAAe"}

package/dist/cjs/server/thunderid.cjs

@@ -1,5 +1,9 @@
+const require_rolldown_runtime = require('../_virtual/rolldown_runtime.cjs');
 const require_getSessionId = require('./actions/getSessionId.cjs');
 const require_getClient = require('./getClient.cjs');
+const require_getAccessibleOrganizationUnitsAction = require('./actions/account/getAccessibleOrganizationUnitsAction.cjs');
+let __thunderid_node = require("@thunderid/node");
+__thunderid_node = require_rolldown_runtime.__toESM(__thunderid_node);
 
 //#region src/server/thunderid.ts
 const thunderid = async () => {
@@ -13,8 +17,20 @@ const thunderid = async () => {
 	const reInitialize = async (config) => {
 		return require_getClient.default().reInitialize(config);
 	};
+	/**
+	* Lists the organization units the signed-in user of this request can access (`/users/me/ous`).
+	*
+	* @throws {ThunderIDAPIError} With the status and code of the failure; the server's message is not
+	*   carried.
+	*/
+	const getAccessibleOrganizationUnits = async (options) => {
+		const result = await require_getAccessibleOrganizationUnitsAction.default(options);
+		if (!result.success) throw new __thunderid_node.ThunderIDAPIError("Failed to list the accessible organization units", result.code ?? "getAccessibleOrganizationUnits-ResponseError-001", "nextjs", result.statusCode);
+		return result.data;
+	};
 	return {
 		exchangeToken,
+		getAccessibleOrganizationUnits,
 		getAccessToken,
 		getSessionId,
 		reInitialize

package/dist/cjs/server/thunderid.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"thunderid.cjs","names":["getClient","getSessionIdAction"],"sources":["../../../src/server/thunderid.ts"],"sourcesContent":["// Copyright 2025 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\nimport {TokenExchangeRequestConfig, TokenResponse} from '@thunderid/node';\nimport getSessionIdAction from './actions/getSessionId';\nimport getClient from './getClient';\nimport {ThunderIDNextConfig} from '../models/config';\n\nconst thunderid = async (): Promise<{\n  exchangeToken: (config: TokenExchangeRequestConfig, sessionId: string) => Promise<TokenResponse | Response>;\n  getAccessToken: (sessionId: string) => Promise<string>;\n  getSessionId: () => Promise<string | undefined>;\n  reInitialize: (config: Partial<ThunderIDNextConfig>) => Promise<boolean>;\n}> => {\n  const getAccessToken = async (sessionId: string): Promise<string> => {\n    const client = getClient();\n    return client.getAccessToken(sessionId);\n  };\n\n  const getSessionId = async (): Promise<string | undefined> => getSessionIdAction();\n\n  const exchangeToken = async (\n    config: TokenExchangeRequestConfig,\n    sessionId: string,\n  ): Promise<TokenResponse | Response> => {\n    const client = getClient();\n    return client.exchangeToken(config, sessionId);\n  };\n\n  const reInitialize = async (config: Partial<ThunderIDNextConfig>): Promise<boolean> => {\n    const client = getClient();\n    return client.reInitialize(config);\n  };\n\n  return {\n    exchangeToken,\n    getAccessToken,\n    getSessionId,\n    reInitialize,\n  };\n};\n\nexport default thunderid;\n"],"mappings":";;;;AAQA,MAAM,YAAY,YAKZ;CACJ,MAAM,iBAAiB,OAAO,cAAuC;AAEnE,SADeA,2BAAW,CACZ,eAAe,UAAU;;CAGzC,MAAM,eAAe,YAAyCC,8BAAoB;CAElF,MAAM,gBAAgB,OACpB,QACA,cACsC;AAEtC,SADeD,2BAAW,CACZ,cAAc,QAAQ,UAAU;;CAGhD,MAAM,eAAe,OAAO,WAA2D;AAErF,SADeA,2BAAW,CACZ,aAAa,OAAO;;AAGpC,QAAO;EACL;EACA;EACA;EACA;EACD;;AAGH,wBAAe"}
+{"version":3,"file":"thunderid.cjs","names":["getClient","getSessionIdAction","result: GetAccessibleOrganizationUnitsActionResult","getAccessibleOrganizationUnitsAction","ThunderIDAPIError"],"sources":["../../../src/server/thunderid.ts"],"sourcesContent":["// Copyright 2025 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\nimport {\n  AccessibleOrganizationUnitList,\n  AccessibleOrganizationUnitsOptions,\n  ThunderIDAPIError,\n  TokenExchangeRequestConfig,\n  TokenResponse,\n} from '@thunderid/node';\nimport getAccessibleOrganizationUnitsAction, {\n  GetAccessibleOrganizationUnitsActionResult,\n} from './actions/account/getAccessibleOrganizationUnitsAction';\nimport getSessionIdAction from './actions/getSessionId';\nimport getClient from './getClient';\nimport {ThunderIDNextConfig} from '../models/config';\n\nconst thunderid = async (): Promise<{\n  exchangeToken: (config: TokenExchangeRequestConfig, sessionId: string) => Promise<TokenResponse | Response>;\n  getAccessibleOrganizationUnits: (\n    options?: AccessibleOrganizationUnitsOptions,\n  ) => Promise<AccessibleOrganizationUnitList>;\n  getAccessToken: (sessionId: string) => Promise<string>;\n  getSessionId: () => Promise<string | undefined>;\n  reInitialize: (config: Partial<ThunderIDNextConfig>) => Promise<boolean>;\n}> => {\n  const getAccessToken = async (sessionId: string): Promise<string> => {\n    const client = getClient();\n    return client.getAccessToken(sessionId);\n  };\n\n  const getSessionId = async (): Promise<string | undefined> => getSessionIdAction();\n\n  const exchangeToken = async (\n    config: TokenExchangeRequestConfig,\n    sessionId: string,\n  ): Promise<TokenResponse | Response> => {\n    const client = getClient();\n    return client.exchangeToken(config, sessionId);\n  };\n\n  const reInitialize = async (config: Partial<ThunderIDNextConfig>): Promise<boolean> => {\n    const client = getClient();\n    return client.reInitialize(config);\n  };\n\n  /**\n   * Lists the organization units the signed-in user of this request can access (`/users/me/ous`).\n   *\n   * @throws {ThunderIDAPIError} With the status and code of the failure; the server's message is not\n   *   carried.\n   */\n  const getAccessibleOrganizationUnits = async (\n    options?: AccessibleOrganizationUnitsOptions,\n  ): Promise<AccessibleOrganizationUnitList> => {\n    const result: GetAccessibleOrganizationUnitsActionResult = await getAccessibleOrganizationUnitsAction(options);\n\n    if (!result.success) {\n      throw new ThunderIDAPIError(\n        'Failed to list the accessible organization units',\n        result.code ?? 'getAccessibleOrganizationUnits-ResponseError-001',\n        'nextjs',\n        result.statusCode,\n      );\n    }\n\n    return result.data;\n  };\n\n  return {\n    exchangeToken,\n    getAccessibleOrganizationUnits,\n    getAccessToken,\n    getSessionId,\n    reInitialize,\n  };\n};\n\nexport default thunderid;\n"],"mappings":";;;;;;;;AAiBA,MAAM,YAAY,YAQZ;CACJ,MAAM,iBAAiB,OAAO,cAAuC;AAEnE,SADeA,2BAAW,CACZ,eAAe,UAAU;;CAGzC,MAAM,eAAe,YAAyCC,8BAAoB;CAElF,MAAM,gBAAgB,OACpB,QACA,cACsC;AAEtC,SADeD,2BAAW,CACZ,cAAc,QAAQ,UAAU;;CAGhD,MAAM,eAAe,OAAO,WAA2D;AAErF,SADeA,2BAAW,CACZ,aAAa,OAAO;;;;;;;;CASpC,MAAM,iCAAiC,OACrC,YAC4C;EAC5C,MAAME,SAAqD,MAAMC,qDAAqC,QAAQ;AAE9G,MAAI,CAAC,OAAO,QACV,OAAM,IAAIC,mCACR,oDACA,OAAO,QAAQ,oDACf,UACA,OAAO,WACR;AAGH,SAAO,OAAO;;AAGhB,QAAO;EACL;EACA;EACA;EACA;EACA;EACD;;AAGH,wBAAe"}

package/dist/client/components/account/OrganizationUnitSwitcher/OrganizationUnitSwitcher.d.ts

@@ -0,0 +1,24 @@
+import { OrganizationUnitSwitcherProps as ReactOrganizationUnitSwitcherProps } from '@thunderid/react';
+import { FC } from 'react';
+/**
+ * Props for the OrganizationUnitSwitcher component. Mirrors `@thunderid/react`'s
+ * `OrganizationUnitSwitcherProps`, so a consumer moving between the React and Next.js SDKs calls it the
+ * same way.
+ */
+export type OrganizationUnitSwitcherProps = ReactOrganizationUnitSwitcherProps;
+/**
+ * Lists the organization units the signed-in user can access, marks the current one, and switches the
+ * session to another.
+ *
+ * This is the Next.js implementation: it renders `BaseOrganizationUnitSwitcher` from `@thunderid/react`,
+ * reads the units through `getAccessibleOrganizationUnitsAction` (a server action, so the access token
+ * stays on the server), and switches through the provider's `switchOrganizationUnit`.
+ *
+ * @example
+ * ```tsx
+ * <OrganizationUnitSwitcher scope="siblings" />
+ * ```
+ */
+declare const OrganizationUnitSwitcher: FC<OrganizationUnitSwitcherProps>;
+export default OrganizationUnitSwitcher;
+//# sourceMappingURL=OrganizationUnitSwitcher.d.ts.map

package/dist/client/components/account/OrganizationUnitSwitcher/OrganizationUnitSwitcher.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"OrganizationUnitSwitcher.d.ts","sourceRoot":"","sources":["../../../../../src/client/components/account/OrganizationUnitSwitcher/OrganizationUnitSwitcher.tsx"],"names":[],"mappings":"AAMA,OAAO,EAEL,6BAA6B,IAAI,kCAAkC,EAGpE,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAC,EAAE,EAAkE,MAAM,OAAO,CAAC;AAM1F;;;;GAIG;AACH,MAAM,MAAM,6BAA6B,GAAG,kCAAkC,CAAC;AAE/E;;;;;;;;;;;;GAYG;AACH,QAAA,MAAM,wBAAwB,EAAE,EAAE,CAAC,6BAA6B,CA8G/D,CAAC;AAEF,eAAe,wBAAwB,CAAC"}

package/dist/client/components/account/OrganizationUnitSwitcher/OrganizationUnitSwitcher.js

@@ -0,0 +1,112 @@
+'use client';
+
+
+import getAccessibleOrganizationUnitsAction_default from "../../../../server/actions/account/getAccessibleOrganizationUnitsAction.js";
+import useThunderID_default from "../../../contexts/ThunderID/useThunderID.js";
+import { BaseOrganizationUnitSwitcher, getOrganizationUnitSwitchErrorKey, useTranslation } from "@thunderid/react";
+import { useCallback, useEffect, useMemo, useRef, useState } from "react";
+import { jsx } from "react/jsx-runtime";
+
+//#region src/client/components/account/OrganizationUnitSwitcher/OrganizationUnitSwitcher.tsx
+/**
+* Lists the organization units the signed-in user can access, marks the current one, and switches the
+* session to another.
+*
+* This is the Next.js implementation: it renders `BaseOrganizationUnitSwitcher` from `@thunderid/react`,
+* reads the units through `getAccessibleOrganizationUnitsAction` (a server action, so the access token
+* stays on the server), and switches through the provider's `switchOrganizationUnit`.
+*
+* @example
+* ```tsx
+* <OrganizationUnitSwitcher scope="siblings" />
+* ```
+*/
+const OrganizationUnitSwitcher = ({ limit = 10, onError, onSelect, onSwitch, preferences, scope, switchOptions,...rest }) => {
+	const { currentOrganizationUnit, isSignedIn, preferences: contextPreferences, switchOrganizationUnit } = useThunderID_default();
+	const resolvedPreferences = useMemo(() => ({
+		...contextPreferences,
+		...preferences
+	}), [contextPreferences, preferences]);
+	const { t } = useTranslation(resolvedPreferences?.i18n);
+	const [list, setList] = useState(null);
+	const [offset, setOffset] = useState(0);
+	const [isLoading, setIsLoading] = useState(false);
+	const [error, setError] = useState(null);
+	const [switchingId, setSwitchingId] = useState(null);
+	const requestRef = useRef(0);
+	const latestRef = useRef({
+		onError,
+		t
+	});
+	latestRef.current = {
+		onError,
+		t
+	};
+	const load = useCallback(async (pageOffset) => {
+		const request = requestRef.current + 1;
+		requestRef.current = request;
+		setIsLoading(true);
+		setError(null);
+		const result = await getAccessibleOrganizationUnitsAction_default({
+			limit,
+			offset: pageOffset,
+			scope
+		});
+		if (requestRef.current !== request) return;
+		if (result.success) setList(result.data);
+		else {
+			setError(latestRef.current.t("organization_unit.switcher.error.load"));
+			latestRef.current.onError?.(result);
+		}
+		setIsLoading(false);
+	}, [limit, scope]);
+	useEffect(() => {
+		if (isSignedIn) load(offset);
+	}, [
+		isSignedIn,
+		load,
+		offset
+	]);
+	const handleSwitch = async (unit) => {
+		if (onSelect) {
+			onSelect(unit);
+			return;
+		}
+		if (!switchOrganizationUnit) return;
+		setError(null);
+		setSwitchingId(unit.id);
+		try {
+			const user = await switchOrganizationUnit(unit.id, switchOptions);
+			if (user) {
+				onSwitch?.(unit, user);
+				await load(offset);
+			}
+		} catch (caught) {
+			setError(t(getOrganizationUnitSwitchErrorKey(caught), { name: unit.name }));
+			onError?.(caught);
+		} finally {
+			setSwitchingId(null);
+		}
+	};
+	return /* @__PURE__ */ jsx(BaseOrganizationUnitSwitcher, {
+		...rest,
+		current: (list?.current === "" ? void 0 : list?.current) ?? currentOrganizationUnit?.id ?? null,
+		error,
+		isLoading,
+		limit,
+		offset,
+		organizationUnits: list?.organizationUnits ?? [],
+		preferences: resolvedPreferences,
+		switchingId,
+		totalResults: list?.totalResults ?? 0,
+		onPageChange: setOffset,
+		onSwitch: (unit) => {
+			handleSwitch(unit);
+		}
+	});
+};
+var OrganizationUnitSwitcher_default = OrganizationUnitSwitcher;
+
+//#endregion
+export { OrganizationUnitSwitcher_default as default };
+//# sourceMappingURL=OrganizationUnitSwitcher.js.map

package/dist/client/components/account/OrganizationUnitSwitcher/OrganizationUnitSwitcher.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"OrganizationUnitSwitcher.js","names":["OrganizationUnitSwitcher: FC<OrganizationUnitSwitcherProps>","useThunderID","request: number","result: GetAccessibleOrganizationUnitsActionResult","getAccessibleOrganizationUnitsAction","user: User | undefined","caught: unknown"],"sources":["../../../../../src/client/components/account/OrganizationUnitSwitcher/OrganizationUnitSwitcher.tsx"],"sourcesContent":["// Copyright 2026 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\n'use client';\n\nimport {AccessibleOrganizationUnit, AccessibleOrganizationUnitList, User} from '@thunderid/node';\nimport {\n  BaseOrganizationUnitSwitcher,\n  OrganizationUnitSwitcherProps as ReactOrganizationUnitSwitcherProps,\n  getOrganizationUnitSwitchErrorKey,\n  useTranslation,\n} from '@thunderid/react';\nimport {FC, ReactElement, useCallback, useEffect, useMemo, useRef, useState} from 'react';\nimport getAccessibleOrganizationUnitsAction, {\n  GetAccessibleOrganizationUnitsActionResult,\n} from '../../../../server/actions/account/getAccessibleOrganizationUnitsAction';\nimport useThunderID from '../../../contexts/ThunderID/useThunderID';\n\n/**\n * Props for the OrganizationUnitSwitcher component. Mirrors `@thunderid/react`'s\n * `OrganizationUnitSwitcherProps`, so a consumer moving between the React and Next.js SDKs calls it the\n * same way.\n */\nexport type OrganizationUnitSwitcherProps = ReactOrganizationUnitSwitcherProps;\n\n/**\n * Lists the organization units the signed-in user can access, marks the current one, and switches the\n * session to another.\n *\n * This is the Next.js implementation: it renders `BaseOrganizationUnitSwitcher` from `@thunderid/react`,\n * reads the units through `getAccessibleOrganizationUnitsAction` (a server action, so the access token\n * stays on the server), and switches through the provider's `switchOrganizationUnit`.\n *\n * @example\n * ```tsx\n * <OrganizationUnitSwitcher scope=\"siblings\" />\n * ```\n */\nconst OrganizationUnitSwitcher: FC<OrganizationUnitSwitcherProps> = ({\n  limit = 10,\n  onError,\n  onSelect,\n  onSwitch,\n  preferences,\n  scope,\n  switchOptions,\n  ...rest\n}: OrganizationUnitSwitcherProps): ReactElement => {\n  const {currentOrganizationUnit, isSignedIn, preferences: contextPreferences, switchOrganizationUnit} = useThunderID();\n\n  const resolvedPreferences = useMemo(\n    () => ({...contextPreferences, ...preferences}),\n    [contextPreferences, preferences],\n  );\n  const {t} = useTranslation(resolvedPreferences?.i18n);\n\n  const [list, setList] = useState<AccessibleOrganizationUnitList | null>(null);\n  const [offset, setOffset] = useState<number>(0);\n  const [isLoading, setIsLoading] = useState<boolean>(false);\n  const [error, setError] = useState<string | null>(null);\n  const [switchingId, setSwitchingId] = useState<string | null>(null);\n  const requestRef = useRef<number>(0);\n  // The latest callbacks, read when a load settles, so a new `onError` on each render does not reload.\n  const latestRef = useRef<{onError?: (error: unknown) => void; t: typeof t}>({onError, t});\n  latestRef.current = {onError, t};\n\n  const load = useCallback(\n    async (pageOffset: number): Promise<void> => {\n      const request: number = requestRef.current + 1;\n      requestRef.current = request;\n      setIsLoading(true);\n      setError(null);\n\n      const result: GetAccessibleOrganizationUnitsActionResult = await getAccessibleOrganizationUnitsAction({\n        limit,\n        offset: pageOffset,\n        scope,\n      });\n\n      if (requestRef.current !== request) {\n        return;\n      }\n\n      if (result.success) {\n        setList(result.data);\n      } else {\n        setError(latestRef.current.t('organization_unit.switcher.error.load'));\n        latestRef.current.onError?.(result);\n      }\n\n      setIsLoading(false);\n    },\n    [limit, scope],\n  );\n\n  useEffect(() => {\n    if (isSignedIn) {\n      void load(offset);\n    }\n  }, [isSignedIn, load, offset]);\n\n  const handleSwitch = async (unit: AccessibleOrganizationUnit): Promise<void> => {\n    if (onSelect) {\n      onSelect(unit);\n\n      return;\n    }\n\n    if (!switchOrganizationUnit) {\n      return;\n    }\n\n    setError(null);\n    setSwitchingId(unit.id);\n\n    try {\n      const user: User | undefined = await switchOrganizationUnit(unit.id, switchOptions);\n\n      if (user) {\n        onSwitch?.(unit, user);\n        await load(offset);\n      }\n    } catch (caught: unknown) {\n      setError(t(getOrganizationUnitSwitchErrorKey(caught), {name: unit.name}));\n      onError?.(caught);\n    } finally {\n      setSwitchingId(null);\n    }\n  };\n\n  return (\n    <BaseOrganizationUnitSwitcher\n      {...rest}\n      current={(list?.current === '' ? undefined : list?.current) ?? currentOrganizationUnit?.id ?? null}\n      error={error}\n      isLoading={isLoading}\n      limit={limit}\n      offset={offset}\n      organizationUnits={list?.organizationUnits ?? []}\n      preferences={resolvedPreferences}\n      switchingId={switchingId}\n      totalResults={list?.totalResults ?? 0}\n      onPageChange={setOffset}\n      onSwitch={(unit: AccessibleOrganizationUnit): void => {\n        void handleSwitch(unit);\n      }}\n    />\n  );\n};\n\nexport default OrganizationUnitSwitcher;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAsCA,MAAMA,4BAA+D,EACnE,QAAQ,IACR,SACA,UACA,UACA,aACA,OACA,cACA,GAAG,WAC8C;CACjD,MAAM,EAAC,yBAAyB,YAAY,aAAa,oBAAoB,2BAA0BC,sBAAc;CAErH,MAAM,sBAAsB,eACnB;EAAC,GAAG;EAAoB,GAAG;EAAY,GAC9C,CAAC,oBAAoB,YAAY,CAClC;CACD,MAAM,EAAC,MAAK,eAAe,qBAAqB,KAAK;CAErD,MAAM,CAAC,MAAM,WAAW,SAAgD,KAAK;CAC7E,MAAM,CAAC,QAAQ,aAAa,SAAiB,EAAE;CAC/C,MAAM,CAAC,WAAW,gBAAgB,SAAkB,MAAM;CAC1D,MAAM,CAAC,OAAO,YAAY,SAAwB,KAAK;CACvD,MAAM,CAAC,aAAa,kBAAkB,SAAwB,KAAK;CACnE,MAAM,aAAa,OAAe,EAAE;CAEpC,MAAM,YAAY,OAA0D;EAAC;EAAS;EAAE,CAAC;AACzF,WAAU,UAAU;EAAC;EAAS;EAAE;CAEhC,MAAM,OAAO,YACX,OAAO,eAAsC;EAC3C,MAAMC,UAAkB,WAAW,UAAU;AAC7C,aAAW,UAAU;AACrB,eAAa,KAAK;AAClB,WAAS,KAAK;EAEd,MAAMC,SAAqD,MAAMC,6CAAqC;GACpG;GACA,QAAQ;GACR;GACD,CAAC;AAEF,MAAI,WAAW,YAAY,QACzB;AAGF,MAAI,OAAO,QACT,SAAQ,OAAO,KAAK;OACf;AACL,YAAS,UAAU,QAAQ,EAAE,wCAAwC,CAAC;AACtE,aAAU,QAAQ,UAAU,OAAO;;AAGrC,eAAa,MAAM;IAErB,CAAC,OAAO,MAAM,CACf;AAED,iBAAgB;AACd,MAAI,WACF,CAAK,KAAK,OAAO;IAElB;EAAC;EAAY;EAAM;EAAO,CAAC;CAE9B,MAAM,eAAe,OAAO,SAAoD;AAC9E,MAAI,UAAU;AACZ,YAAS,KAAK;AAEd;;AAGF,MAAI,CAAC,uBACH;AAGF,WAAS,KAAK;AACd,iBAAe,KAAK,GAAG;AAEvB,MAAI;GACF,MAAMC,OAAyB,MAAM,uBAAuB,KAAK,IAAI,cAAc;AAEnF,OAAI,MAAM;AACR,eAAW,MAAM,KAAK;AACtB,UAAM,KAAK,OAAO;;WAEbC,QAAiB;AACxB,YAAS,EAAE,kCAAkC,OAAO,EAAE,EAAC,MAAM,KAAK,MAAK,CAAC,CAAC;AACzE,aAAU,OAAO;YACT;AACR,kBAAe,KAAK;;;AAIxB,QACE,oBAAC;EACC,GAAI;EACJ,UAAU,MAAM,YAAY,KAAK,SAAY,MAAM,YAAY,yBAAyB,MAAM;EACvF;EACI;EACJ;EACC;EACR,mBAAmB,MAAM,qBAAqB,EAAE;EAChD,aAAa;EACA;EACb,cAAc,MAAM,gBAAgB;EACpC,cAAc;EACd,WAAW,SAA2C;AACpD,GAAK,aAAa,KAAK;;GAEzB;;AAIN,uCAAe"}

package/dist/client/components/auth/SignIn/SignIn.d.ts

@@ -4,7 +4,13 @@ import { FC } from 'react';
  * Props for the SignIn component.
  * Extends BaseSignInProps for full compatibility with the React BaseSignIn component
  */
-export type SignInProps = Pick<BaseSignInProps, 'children' | 'className' | 'id' | 'onSuccess' | 'onError' | 'variant' | 'size'>;
+export type SignInProps = Pick<BaseSignInProps, 'children' | 'className' | 'id' | 'onSuccess' | 'onError' | 'variant' | 'size'> & {
+    /**
+     * Bounds the sign-in to this organization unit. Sent as `ouId` on the request that starts the
+     * `AUTHENTICATION` flow only, never on a continuation.
+     */
+    organizationUnitId?: string;
+};
 /**
  * A SignIn component for Next.js that provides native authentication flow.
  * This component delegates to the BaseSignIn from @thunderid/react. Unlike BaseSignUp,

package/dist/client/components/auth/SignIn/SignIn.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"SignIn.d.ts","sourceRoot":"","sources":["../../../../../src/client/components/auth/SignIn/SignIn.tsx"],"names":[],"mappings":"AAMA,OAAO,EAAa,eAAe,EAAwC,MAAM,kBAAkB,CAAC;AACpG,OAAO,EAAC,EAAE,EAA8B,MAAM,OAAO,CAAC;AAGtD;;;GAGG;AACH,MAAM,MAAM,WAAW,GAAG,IAAI,CAC5B,eAAe,EACf,UAAU,GAAG,WAAW,GAAG,IAAI,GAAG,WAAW,GAAG,SAAS,GAAG,SAAS,GAAG,MAAM,CAC/E,CAAC;AAEF;;;;;GAKG;AACH,QAAA,MAAM,MAAM,EAAE,EAAE,CAAC,WAAW,CAmG3B,CAAC;AAIF,eAAe,MAAM,CAAC"}
+{"version":3,"file":"SignIn.d.ts","sourceRoot":"","sources":["../../../../../src/client/components/auth/SignIn/SignIn.tsx"],"names":[],"mappings":"AAMA,OAAO,EAAa,eAAe,EAAwC,MAAM,kBAAkB,CAAC;AACpG,OAAO,EAAC,EAAE,EAA8B,MAAM,OAAO,CAAC;AAGtD;;;GAGG;AACH,MAAM,MAAM,WAAW,GAAG,IAAI,CAC5B,eAAe,EACf,UAAU,GAAG,WAAW,GAAG,IAAI,GAAG,WAAW,GAAG,SAAS,GAAG,SAAS,GAAG,MAAM,CAC/E,GAAG;IACF;;;OAGG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B,CAAC;AAEF;;;;;GAKG;AACH,QAAA,MAAM,MAAM,EAAE,EAAE,CAAC,WAAW,CA0G3B,CAAC;AAIF,eAAe,MAAM,CAAC"}

package/dist/client/components/auth/SignIn/SignIn.js

@@ -14,7 +14,7 @@ import { jsx } from "react/jsx-runtime";
 * BaseSignIn does not manage its own flow state, so this component initiates the flow
 * (using the server-action-backed `signIn`) and tracks `components`/`executionId` itself.
 */
-const SignIn = ({ size = "medium", variant = "outlined", onError,...rest }) => {
+const SignIn = ({ size = "medium", variant = "outlined", onError, organizationUnitId,...rest }) => {
 	const { signIn, applicationId, scopes } = useThunderID_default();
 	const { t } = useTranslation();
 	const [components, setComponents] = useState([]);
@@ -44,7 +44,8 @@ const SignIn = ({ size = "medium", variant = "outlined", onError,...rest }) => {
 				const response = await signIn({
 					applicationId,
 					flowType: EmbeddedFlowType.Authentication,
-					...scopes && { scopes }
+					...scopes && { scopes },
+					...organizationUnitId && { ouId: organizationUnitId }
 				}, {});
 				if (response) applyFlowResponse(response);
 			} catch (error) {