@thunderid/nextjs 1.3.1 → 1.5.0

package/dist/cjs/server/actions/{getFlowMetaAction.cjs → auth/getFlowMetaAction.cjs}

@@ -1,13 +1,13 @@
 'use server';
 
 
-const require_rolldown_runtime = require('../../_virtual/rolldown_runtime.cjs');
-const require_getClient = require('../getClient.cjs');
-const require_logger = require('../../utils/logger.cjs');
+const require_rolldown_runtime = require('../../../_virtual/rolldown_runtime.cjs');
+const require_getClient = require('../../getClient.cjs');
+const require_logger = require('../../../utils/logger.cjs');
 let __thunderid_node = require("@thunderid/node");
 __thunderid_node = require_rolldown_runtime.__toESM(__thunderid_node);
 
-//#region src/server/actions/getFlowMetaAction.ts
+//#region src/server/actions/auth/getFlowMetaAction.ts
 /**
 * Server Action that fetches `GET /flow/meta` server-side.
 *

package/dist/cjs/server/actions/auth/getFlowMetaAction.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"getFlowMetaAction.cjs","names":["config: ThunderIDNextConfig","getClient","url: string | undefined","applicationId: string | undefined","FlowMetaType","ThunderIDAPIError"],"sources":["../../../../../src/server/actions/auth/getFlowMetaAction.ts"],"sourcesContent":["// Copyright 2026 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\n'use server';\n\nimport {\n  FlowMetadataResponse,\n  FlowMetaType,\n  getFlowMeta,\n  resolveResourceEndpoint,\n  ThunderIDAPIError,\n} from '@thunderid/node';\nimport {ThunderIDNextConfig} from '../../../models/config';\nimport logger from '../../../utils/logger';\nimport getClient from '../../getClient';\n\n/**\n * What {@link getFlowMetaAction} returns: the flow metadata, or a plain failure. It never throws, because a thrown\n * error reaches the browser as a generic 500 and loses its prototype chain crossing the server action boundary. A\n * failure carries a message built on the server and the status, never the text of the upstream reply.\n */\nexport type GetFlowMetaActionResult =\n  | {meta: FlowMetadataResponse; success: true}\n  | {message: string; statusCode?: number; success: false};\n\n/**\n * Server Action that fetches `GET /flow/meta` server-side.\n *\n * `FlowMetaProvider` (from `@thunderid/react`) otherwise fetches this endpoint directly from the\n * browser against `baseUrl`, which requires the ThunderID server to allow CORS for the app's\n * origin. Routing it through this action instead means the browser never talks to `baseUrl`\n * directly — the request happens server-to-server, same as `signInAction`/`signUpAction`.\n *\n * Never throws across the server action boundary; failures are mapped to a plain result.\n *\n * @param language - Optional language override, used by `FlowMetaProvider.switchLanguage()`.\n */\nconst getFlowMetaAction = async (params?: {\n  applicationId?: string;\n  language?: string;\n}): Promise<GetFlowMetaActionResult> => {\n  try {\n    const client = getClient();\n    const config: ThunderIDNextConfig = await client.getConfiguration();\n\n    const url: string | undefined = resolveResourceEndpoint('flowMeta', config);\n\n    if (!url && !config?.baseUrl) {\n      return {message: 'Failed to load flow metadata: no base URL is configured.', success: false};\n    }\n\n    const applicationId: string | undefined = params?.applicationId ?? config?.applicationId;\n\n    const meta: FlowMetadataResponse = await getFlowMeta({\n      baseUrl: config?.baseUrl,\n      url,\n      ...(applicationId ? {id: applicationId, type: FlowMetaType.App} : {}),\n      ...(params?.language ? {language: params.language} : {}),\n    });\n\n    return {meta, success: true};\n  } catch (error) {\n    const message = error instanceof Error ? error.message : String(error);\n    logger.error(`[getFlowMetaAction] Error fetching flow metadata: ${message}`);\n\n    if (error instanceof ThunderIDAPIError && error.statusCode !== undefined) {\n      return {\n        message: `Failed to load flow metadata (HTTP ${error.statusCode}).`,\n        statusCode: error.statusCode,\n        success: false,\n      };\n    }\n\n    return {message: 'Failed to load flow metadata.', success: false};\n  }\n};\n\nexport default getFlowMetaAction;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAqCA,MAAM,oBAAoB,OAAO,WAGO;AACtC,KAAI;EAEF,MAAMA,SAA8B,MADrBC,2BAAW,CACuB,kBAAkB;EAEnE,MAAMC,oDAAkD,YAAY,OAAO;AAE3E,MAAI,CAAC,OAAO,CAAC,QAAQ,QACnB,QAAO;GAAC,SAAS;GAA4D,SAAS;GAAM;EAG9F,MAAMC,gBAAoC,QAAQ,iBAAiB,QAAQ;AAS3E,SAAO;GAAC,MAP2B,wCAAkB;IACnD,SAAS,QAAQ;IACjB;IACA,GAAI,gBAAgB;KAAC,IAAI;KAAe,MAAMC,8BAAa;KAAI,GAAG,EAAE;IACpE,GAAI,QAAQ,WAAW,EAAC,UAAU,OAAO,UAAS,GAAG,EAAE;IACxD,CAAC;GAEY,SAAS;GAAK;UACrB,OAAO;EACd,MAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM;AACtE,yBAAO,MAAM,qDAAqD,UAAU;AAE5E,MAAI,iBAAiBC,sCAAqB,MAAM,eAAe,OAC7D,QAAO;GACL,SAAS,sCAAsC,MAAM,WAAW;GAChE,YAAY,MAAM;GAClB,SAAS;GACV;AAGH,SAAO;GAAC,SAAS;GAAiC,SAAS;GAAM;;;AAIrE,gCAAe"}

package/dist/cjs/server/actions/{handleOAuthCallbackAction.cjs → auth/handleOAuthCallbackAction.cjs}

@@ -1,15 +1,15 @@
 'use server';
 
 
-const require_rolldown_runtime = require('../../_virtual/rolldown_runtime.cjs');
-const require_chunkedCookie = require('../../utils/chunkedCookie.cjs');
-const require_SessionManager = require('../../utils/SessionManager.cjs');
-const require_getClient = require('../getClient.cjs');
-const require_logger = require('../../utils/logger.cjs');
+const require_rolldown_runtime = require('../../../_virtual/rolldown_runtime.cjs');
+const require_chunkedCookie = require('../../../utils/chunkedCookie.cjs');
+const require_SessionManager = require('../../../utils/SessionManager.cjs');
+const require_getClient = require('../../getClient.cjs');
+const require_logger = require('../../../utils/logger.cjs');
 let next_headers = require("next/headers");
 next_headers = require_rolldown_runtime.__toESM(next_headers);
 
-//#region src/server/actions/handleOAuthCallbackAction.ts
+//#region src/server/actions/auth/handleOAuthCallbackAction.ts
 /**
 * Server action to handle OAuth callback with authorization code.
 * This action processes the authorization code received from the OAuth provider

package/dist/cjs/server/actions/auth/handleOAuthCallbackAction.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"handleOAuthCallbackAction.cjs","names":["getClient","cookieStore: RequestCookies","sessionId: string | undefined","tempSessionToken: string | undefined","SessionManager","signInResult: Record<string, unknown>","config: ThunderIDNextConfig","idToken: IdToken","accessToken: string","refreshToken: string","userIdFromToken: string","scopes: string","organizationId: string | undefined","expiresIn: number","sessionCookieExpiryTime: number","sessionToken: string"],"sources":["../../../../../src/server/actions/auth/handleOAuthCallbackAction.ts"],"sourcesContent":["// Copyright 2025 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\n'use server';\n\nimport {IdToken} from '@thunderid/node';\nimport {cookies} from 'next/headers';\nimport {ThunderIDNextConfig} from '../../../models/config';\nimport {setChunkedCookie} from '../../../utils/chunkedCookie';\nimport logger from '../../../utils/logger';\nimport SessionManager from '../../../utils/SessionManager';\nimport getClient from '../../getClient';\n\ntype RequestCookies = Awaited<ReturnType<typeof cookies>>;\n\n/**\n * Server action to handle OAuth callback with authorization code.\n * This action processes the authorization code received from the OAuth provider\n * and exchanges it for tokens to complete the authentication flow.\n *\n * @param code - Authorization code from OAuth provider\n * @param state - State parameter from OAuth provider for CSRF protection\n * @returns Promise that resolves with success status and optional error message\n */\nconst handleOAuthCallbackAction = async (\n  code: string,\n  state: string,\n): Promise<{\n  error?: string;\n  redirectUrl?: string;\n  success: boolean;\n}> => {\n  try {\n    if (!code || !state) {\n      return {\n        error: 'Missing required OAuth parameters: code and state are required',\n        success: false,\n      };\n    }\n\n    const thunderIDClient = getClient();\n\n    // A server action can run in a module context that no provider render has initialized, for\n    // example after the dev server recompiles, so initialize from the environment first.\n    if (!thunderIDClient.isInitialized) {\n      await thunderIDClient.initialize({} as ThunderIDNextConfig);\n    }\n\n    if (!thunderIDClient.isInitialized) {\n      return {\n        error: 'ThunderID client is not initialized',\n        success: false,\n      };\n    }\n\n    const cookieStore: RequestCookies = await cookies();\n    let sessionId: string | undefined;\n\n    const tempSessionToken: string | undefined = cookieStore.get(SessionManager.getTempSessionCookieName())?.value;\n\n    if (tempSessionToken) {\n      try {\n        const tempSession: {sessionId: string} = await SessionManager.verifyTempSession(tempSessionToken);\n        sessionId = tempSession.sessionId;\n      } catch {\n        logger.error(\n          '[handleOAuthCallbackAction] Invalid temporary session token, falling back to session ID from cookies.',\n        );\n      }\n    }\n\n    if (!sessionId) {\n      logger.error('[handleOAuthCallbackAction] No session ID found in cookies or temporary session token.');\n\n      return {\n        error: 'No session found. Please start the authentication flow again.',\n        success: false,\n      };\n    }\n\n    // Exchange the authorization code for tokens\n    const signInResult: Record<string, unknown> = await thunderIDClient.signIn(\n      {\n        code,\n        state,\n      } as any,\n      {},\n      sessionId,\n    );\n\n    const config: ThunderIDNextConfig = await thunderIDClient.getConfiguration();\n\n    if (signInResult) {\n      try {\n        const idToken: IdToken = await thunderIDClient.getDecodedIdToken(\n          sessionId,\n          (signInResult['id_token'] || signInResult['idToken']) as string,\n        );\n        const accessToken: string = (signInResult['accessToken'] || signInResult['access_token']) as string;\n        const refreshToken: string = (signInResult['refreshToken'] as string | undefined) ?? '';\n        const userIdFromToken: string = (idToken.sub || signInResult['sub'] || sessionId) as string;\n        const scopes: string = signInResult['scope'] as string;\n        const organizationId: string | undefined = (idToken['user_org'] || idToken['organization_id']) as\n          | string\n          | undefined;\n        const expiresIn: number = signInResult['expiresIn'] as number;\n        const sessionCookieExpiryTime: number = SessionManager.resolveSessionCookieExpiry(\n          config.sessionCookie?.expiryTime,\n        );\n\n        const sessionToken: string = await SessionManager.createSessionToken(\n          accessToken,\n          userIdFromToken,\n          sessionId,\n          scopes,\n          expiresIn,\n          refreshToken,\n          organizationId,\n          {sid: typeof idToken['sid'] === 'string' ? idToken['sid'] : undefined},\n        );\n\n        setChunkedCookie(\n          cookieStore,\n          SessionManager.getSessionCookieName(),\n          sessionToken,\n          SessionManager.getSessionCookieOptions(sessionCookieExpiryTime),\n        );\n\n        cookieStore.delete(SessionManager.getTempSessionCookieName());\n      } catch (error) {\n        logger.error(\n          `[handleOAuthCallbackAction] Failed to create JWT session, continuing with legacy session:\n          ${typeof error === 'string' ? error : JSON.stringify(error)}`,\n        );\n      }\n    }\n\n    const afterSignInUrl: string = config.afterSignInUrl || '/';\n\n    return {\n      redirectUrl: afterSignInUrl,\n      success: true,\n    };\n  } catch (error) {\n    let errorMessage = 'Authentication failed';\n\n    if (error instanceof Error) {\n      errorMessage = error.message;\n    } else if (error && typeof error === 'object' && 'message' in error) {\n      errorMessage = String((error as {message: unknown}).message);\n    } else if (typeof error === 'string') {\n      errorMessage = error;\n    }\n\n    return {\n      error: errorMessage,\n      success: false,\n    };\n  }\n};\n\nexport default handleOAuthCallbackAction;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;AAwBA,MAAM,4BAA4B,OAChC,MACA,UAKI;AACJ,KAAI;AACF,MAAI,CAAC,QAAQ,CAAC,MACZ,QAAO;GACL,OAAO;GACP,SAAS;GACV;EAGH,MAAM,kBAAkBA,2BAAW;AAInC,MAAI,CAAC,gBAAgB,cACnB,OAAM,gBAAgB,WAAW,EAAE,CAAwB;AAG7D,MAAI,CAAC,gBAAgB,cACnB,QAAO;GACL,OAAO;GACP,SAAS;GACV;EAGH,MAAMC,cAA8B,iCAAe;EACnD,IAAIC;EAEJ,MAAMC,mBAAuC,YAAY,IAAIC,+BAAe,0BAA0B,CAAC,EAAE;AAEzG,MAAI,iBACF,KAAI;AAEF,gBADyC,MAAMA,+BAAe,kBAAkB,iBAAiB,EACzE;UAClB;AACN,0BAAO,MACL,wGACD;;AAIL,MAAI,CAAC,WAAW;AACd,0BAAO,MAAM,yFAAyF;AAEtG,UAAO;IACL,OAAO;IACP,SAAS;IACV;;EAIH,MAAMC,eAAwC,MAAM,gBAAgB,OAClE;GACE;GACA;GACD,EACD,EAAE,EACF,UACD;EAED,MAAMC,SAA8B,MAAM,gBAAgB,kBAAkB;AAE5E,MAAI,aACF,KAAI;GACF,MAAMC,UAAmB,MAAM,gBAAgB,kBAC7C,WACC,aAAa,eAAe,aAAa,WAC3C;GACD,MAAMC,cAAuB,aAAa,kBAAkB,aAAa;GACzE,MAAMC,eAAwB,aAAa,mBAA0C;GACrF,MAAMC,kBAA2B,QAAQ,OAAO,aAAa,UAAU;GACvE,MAAMC,SAAiB,aAAa;GACpC,MAAMC,iBAAsC,QAAQ,eAAe,QAAQ;GAG3E,MAAMC,YAAoB,aAAa;GACvC,MAAMC,0BAAkCV,+BAAe,2BACrD,OAAO,eAAe,WACvB;GAED,MAAMW,eAAuB,MAAMX,+BAAe,mBAChD,aACA,iBACA,WACA,QACA,WACA,cACA,gBACA,EAAC,KAAK,OAAO,QAAQ,WAAW,WAAW,QAAQ,SAAS,QAAU,CACvE;AAED,0CACE,aACAA,+BAAe,sBAAsB,EACrC,cACAA,+BAAe,wBAAwB,wBAAwB,CAChE;AAED,eAAY,OAAOA,+BAAe,0BAA0B,CAAC;WACtD,OAAO;AACd,0BAAO,MACL;YACE,OAAO,UAAU,WAAW,QAAQ,KAAK,UAAU,MAAM,GAC5D;;AAML,SAAO;GACL,aAH6B,OAAO,kBAAkB;GAItD,SAAS;GACV;UACM,OAAO;EACd,IAAI,eAAe;AAEnB,MAAI,iBAAiB,MACnB,gBAAe,MAAM;WACZ,SAAS,OAAO,UAAU,YAAY,aAAa,MAC5D,gBAAe,OAAQ,MAA6B,QAAQ;WACnD,OAAO,UAAU,SAC1B,gBAAe;AAGjB,SAAO;GACL,OAAO;GACP,SAAS;GACV;;;AAIL,wCAAe"}

package/dist/cjs/server/actions/{signInAction.cjs → auth/signInAction.cjs}

@@ -1,17 +1,17 @@
 'use server';
 
 
-const require_rolldown_runtime = require('../../_virtual/rolldown_runtime.cjs');
-const require_chunkedCookie = require('../../utils/chunkedCookie.cjs');
-const require_SessionManager = require('../../utils/SessionManager.cjs');
-const require_getClient = require('../getClient.cjs');
-const require_logger = require('../../utils/logger.cjs');
+const require_rolldown_runtime = require('../../../_virtual/rolldown_runtime.cjs');
+const require_chunkedCookie = require('../../../utils/chunkedCookie.cjs');
+const require_SessionManager = require('../../../utils/SessionManager.cjs');
+const require_getClient = require('../../getClient.cjs');
+const require_logger = require('../../../utils/logger.cjs');
 let __thunderid_node = require("@thunderid/node");
 __thunderid_node = require_rolldown_runtime.__toESM(__thunderid_node);
 let next_headers = require("next/headers");
 next_headers = require_rolldown_runtime.__toESM(next_headers);
 
-//#region src/server/actions/signInAction.ts
+//#region src/server/actions/auth/signInAction.ts
 /**
 * Server action for signing in a user.
 * Handles the embedded sign-in flow and manages session cookies.

package/dist/cjs/server/actions/auth/signInAction.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"signInAction.cjs","names":["getClient","cookieStore: RequestCookies","sessionId: string | undefined","existingSessionToken: string | undefined","getChunkedCookie","SessionManager","tempSessionToken: string | undefined","tempSessionToken: string","defaultSignInUrl: string","response: any","EmbeddedSignInFlowStatus","idToken: IdToken","userIdFromToken: string","organizationId: string | undefined","scopes: string","iat: number","exp: number","expiresIn: number","config: ThunderIDNextConfig","sessionCookieExpiryTime: number","sessionToken: string","afterSignInUrl: string"],"sources":["../../../../../src/server/actions/auth/signInAction.ts"],"sourcesContent":["// Copyright 2025 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\n'use server';\n\nimport {\n  generateSessionId,\n  EmbeddedSignInFlowStatus,\n  EmbeddedFlowExecuteRequestConfig,\n  IdToken,\n  isEmpty,\n} from '@thunderid/node';\nimport {cookies} from 'next/headers';\nimport {ThunderIDNextConfig} from '../../../models/config';\nimport {getChunkedCookie, setChunkedCookie} from '../../../utils/chunkedCookie';\nimport logger from '../../../utils/logger';\nimport SessionManager, {SessionTokenPayload} from '../../../utils/SessionManager';\nimport getClient from '../../getClient';\n\ntype RequestCookies = Awaited<ReturnType<typeof cookies>>;\n\n/**\n * Server action for signing in a user.\n * Handles the embedded sign-in flow and manages session cookies.\n *\n * @param payload - The embedded sign-in flow payload\n * @param request - The embedded flow execute request config\n * @returns Promise that resolves when sign-in is complete\n */\nconst signInAction = async (\n  payload?: any,\n  request?: EmbeddedFlowExecuteRequestConfig,\n): Promise<{\n  data?:\n    | {\n        afterSignInUrl?: string;\n        signInUrl?: string;\n      }\n    | Record<string, unknown>;\n  error?: string;\n  success: boolean;\n}> => {\n  try {\n    const client = getClient();\n    const cookieStore: RequestCookies = await cookies();\n\n    let sessionId: string | undefined;\n\n    const existingSessionToken: string | undefined = getChunkedCookie(\n      cookieStore,\n      SessionManager.getSessionCookieName(),\n    );\n\n    if (existingSessionToken) {\n      try {\n        const sessionPayload: SessionTokenPayload = await SessionManager.verifySessionToken(existingSessionToken);\n        sessionId = sessionPayload.sessionId;\n      } catch {\n        // Invalid session token, will create new temp session\n      }\n    }\n\n    if (!sessionId) {\n      const tempSessionToken: string | undefined = cookieStore.get(SessionManager.getTempSessionCookieName())?.value;\n\n      if (tempSessionToken) {\n        try {\n          const tempSession: {sessionId: string} = await SessionManager.verifyTempSession(tempSessionToken);\n          sessionId = tempSession.sessionId;\n        } catch {\n          // Invalid temp session, will create new one\n        }\n      }\n    }\n\n    if (!sessionId) {\n      sessionId = generateSessionId();\n\n      const tempSessionToken: string = await SessionManager.createTempSession(sessionId);\n\n      cookieStore.set(\n        SessionManager.getTempSessionCookieName(),\n        tempSessionToken,\n        SessionManager.getTempSessionCookieOptions(),\n      );\n    }\n\n    // If no payload provided, redirect to sign-in URL for redirect-based sign-in.\n    if (!payload || isEmpty(payload)) {\n      const defaultSignInUrl: string = await client.getAuthorizeRequestUrl({}, sessionId);\n      return {data: {signInUrl: String(defaultSignInUrl)}, success: true};\n    }\n\n    // Handle embedded sign-in flow\n    const response: any = await client.signIn(payload, request!, sessionId);\n\n    if (response.flowStatus === EmbeddedSignInFlowStatus.Complete) {\n      // On the V2 platform, a completed embedded flow (without a preceding `/authorize` redirect,\n      // i.e. no `authId`) returns a self-contained JWT `assertion` rather than an authorization\n      // code to exchange. This mirrors how @thunderid/react and @thunderid/vue treat it: the\n      // assertion is used directly as the bearer session token.\n      if (!response.assertion) {\n        throw new Error('[signInAction] Flow completed without an assertion.');\n      }\n\n      const idToken: IdToken = await client.getDecodedIdToken(sessionId, response.assertion);\n      const userIdFromToken: string = (idToken.sub as string | undefined) ?? sessionId;\n      const organizationId: string | undefined = (idToken['user_org'] || idToken['organization_id']) as\n        | string\n        | undefined;\n      const scopes: string = (idToken['scope'] as string | undefined) ?? '';\n      const iat: number = (idToken['iat'] as number | undefined) ?? Math.floor(Date.now() / 1000);\n      const exp: number = (idToken['exp'] as number | undefined) ?? iat + 3600;\n      const expiresIn: number = Math.max(exp - iat, 0);\n\n      const config: ThunderIDNextConfig = await client.getConfiguration();\n      const sessionCookieExpiryTime: number = SessionManager.resolveSessionCookieExpiry(\n        config.sessionCookie?.expiryTime,\n      );\n\n      const sessionToken: string = await SessionManager.createSessionToken(\n        response.assertion,\n        userIdFromToken,\n        sessionId,\n        scopes,\n        expiresIn,\n        '',\n        organizationId,\n        {sid: typeof idToken['sid'] === 'string' ? idToken['sid'] : undefined},\n      );\n\n      setChunkedCookie(\n        cookieStore,\n        SessionManager.getSessionCookieName(),\n        sessionToken,\n        SessionManager.getSessionCookieOptions(sessionCookieExpiryTime),\n      );\n\n      cookieStore.delete(SessionManager.getTempSessionCookieName());\n\n      const afterSignInUrl: string = await (await client.getStorageManager()).getConfigDataParameter('afterSignInUrl');\n      return {data: {afterSignInUrl: String(afterSignInUrl)}, success: true};\n    }\n\n    return {data: response as Record<string, unknown>, success: true};\n  } catch (error) {\n    const message =\n      error instanceof Error\n        ? error.message\n        : typeof (error as any)?.message === 'string'\n          ? (error as any).message\n          : String(error);\n    logger.error(`[signInAction] Error during sign-in: ${message}`);\n    return {error: message, success: false};\n  }\n};\n\nexport default signInAction;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AA6BA,MAAM,eAAe,OACnB,SACA,YAUI;AACJ,KAAI;EACF,MAAM,SAASA,2BAAW;EAC1B,MAAMC,cAA8B,iCAAe;EAEnD,IAAIC;EAEJ,MAAMC,uBAA2CC,uCAC/C,aACAC,+BAAe,sBAAsB,CACtC;AAED,MAAI,qBACF,KAAI;AAEF,gBAD4C,MAAMA,+BAAe,mBAAmB,qBAAqB,EAC9E;UACrB;AAKV,MAAI,CAAC,WAAW;GACd,MAAMC,mBAAuC,YAAY,IAAID,+BAAe,0BAA0B,CAAC,EAAE;AAEzG,OAAI,iBACF,KAAI;AAEF,iBADyC,MAAMA,+BAAe,kBAAkB,iBAAiB,EACzE;WAClB;;AAMZ,MAAI,CAAC,WAAW;AACd,wDAA+B;GAE/B,MAAME,mBAA2B,MAAMF,+BAAe,kBAAkB,UAAU;AAElF,eAAY,IACVA,+BAAe,0BAA0B,EACzC,kBACAA,+BAAe,6BAA6B,CAC7C;;AAIH,MAAI,CAAC,yCAAmB,QAAQ,EAAE;GAChC,MAAMG,mBAA2B,MAAM,OAAO,uBAAuB,EAAE,EAAE,UAAU;AACnF,UAAO;IAAC,MAAM,EAAC,WAAW,OAAO,iBAAiB,EAAC;IAAE,SAAS;IAAK;;EAIrE,MAAMC,WAAgB,MAAM,OAAO,OAAO,SAAS,SAAU,UAAU;AAEvE,MAAI,SAAS,eAAeC,0CAAyB,UAAU;AAK7D,OAAI,CAAC,SAAS,UACZ,OAAM,IAAI,MAAM,sDAAsD;GAGxE,MAAMC,UAAmB,MAAM,OAAO,kBAAkB,WAAW,SAAS,UAAU;GACtF,MAAMC,kBAA2B,QAAQ,OAA8B;GACvE,MAAMC,iBAAsC,QAAQ,eAAe,QAAQ;GAG3E,MAAMC,SAAkB,QAAQ,YAAmC;GACnE,MAAMC,MAAe,QAAQ,UAAiC,KAAK,MAAM,KAAK,KAAK,GAAG,IAAK;GAC3F,MAAMC,MAAe,QAAQ,UAAiC,MAAM;GACpE,MAAMC,YAAoB,KAAK,IAAI,MAAM,KAAK,EAAE;GAEhD,MAAMC,SAA8B,MAAM,OAAO,kBAAkB;GACnE,MAAMC,0BAAkCd,+BAAe,2BACrD,OAAO,eAAe,WACvB;GAED,MAAMe,eAAuB,MAAMf,+BAAe,mBAChD,SAAS,WACT,iBACA,WACA,QACA,WACA,IACA,gBACA,EAAC,KAAK,OAAO,QAAQ,WAAW,WAAW,QAAQ,SAAS,QAAU,CACvE;AAED,0CACE,aACAA,+BAAe,sBAAsB,EACrC,cACAA,+BAAe,wBAAwB,wBAAwB,CAChE;AAED,eAAY,OAAOA,+BAAe,0BAA0B,CAAC;GAE7D,MAAMgB,iBAAyB,OAAO,MAAM,OAAO,mBAAmB,EAAE,uBAAuB,iBAAiB;AAChH,UAAO;IAAC,MAAM,EAAC,gBAAgB,OAAO,eAAe,EAAC;IAAE,SAAS;IAAK;;AAGxE,SAAO;GAAC,MAAM;GAAqC,SAAS;GAAK;UAC1D,OAAO;EACd,MAAM,UACJ,iBAAiB,QACb,MAAM,UACN,OAAQ,OAAe,YAAY,WAChC,MAAc,UACf,OAAO,MAAM;AACrB,yBAAO,MAAM,wCAAwC,UAAU;AAC/D,SAAO;GAAC,OAAO;GAAS,SAAS;GAAM;;;AAI3C,2BAAe"}

package/dist/cjs/server/actions/{signOutAction.cjs → auth/signOutAction.cjs}

@@ -1,16 +1,16 @@
 'use server';
 
 
-const require_rolldown_runtime = require('../../_virtual/rolldown_runtime.cjs');
-const require_chunkedCookie = require('../../utils/chunkedCookie.cjs');
-const require_SessionManager = require('../../utils/SessionManager.cjs');
-const require_getSessionId = require('./getSessionId.cjs');
-const require_getClient = require('../getClient.cjs');
-const require_logger = require('../../utils/logger.cjs');
+const require_rolldown_runtime = require('../../../_virtual/rolldown_runtime.cjs');
+const require_chunkedCookie = require('../../../utils/chunkedCookie.cjs');
+const require_SessionManager = require('../../../utils/SessionManager.cjs');
+const require_getSessionId = require('../getSessionId.cjs');
+const require_getClient = require('../../getClient.cjs');
+const require_logger = require('../../../utils/logger.cjs');
 let next_headers = require("next/headers");
 next_headers = require_rolldown_runtime.__toESM(next_headers);
 
-//#region src/server/actions/signOutAction.ts
+//#region src/server/actions/auth/signOutAction.ts
 /**
 * Server action for signing out a user.
 * Clears both JWT and legacy session cookies.

package/dist/cjs/server/actions/auth/signOutAction.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"signOutAction.cjs","names":["cookieStore: RequestCookies","SessionManager","getClient","sessionId: string | undefined","getSessionId","errorMessage: unknown"],"sources":["../../../../../src/server/actions/auth/signOutAction.ts"],"sourcesContent":["// Copyright 2025 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\n'use server';\n\nimport {cookies} from 'next/headers';\nimport {deleteChunkedCookie} from '../../../utils/chunkedCookie';\nimport logger from '../../../utils/logger';\nimport SessionManager from '../../../utils/SessionManager';\nimport getClient from '../../getClient';\nimport getSessionId from '../getSessionId';\n\ntype RequestCookies = Awaited<ReturnType<typeof cookies>>;\n\n/**\n * Server action for signing out a user.\n * Clears both JWT and legacy session cookies.\n *\n * @returns Promise that resolves with success status and optional after sign-out URL\n */\nconst signOutAction = async (): Promise<{data?: {afterSignOutUrl?: string}; error?: unknown; success: boolean}> => {\n  logger.debug('[signOutAction] Initiating sign out process from the server action.');\n\n  const clearSessionCookies = async (): Promise<void> => {\n    const cookieStore: RequestCookies = await cookies();\n\n    deleteChunkedCookie(cookieStore, SessionManager.getSessionCookieName());\n    cookieStore.delete(SessionManager.getTempSessionCookieName());\n  };\n\n  try {\n    const client = getClient();\n    const sessionId: string | undefined = await getSessionId();\n\n    let afterSignOutUrl = '/';\n\n    if (sessionId) {\n      logger.debug('[signOutAction] Session ID found, invoking the `signOut` to obtain the `afterSignOutUrl`.');\n\n      afterSignOutUrl = await client.signOut({}, sessionId);\n    }\n\n    await clearSessionCookies();\n\n    return {data: {afterSignOutUrl}, success: true};\n  } catch (error) {\n    logger.error('[signOutAction] Error during sign out from the server action:', error);\n\n    logger.debug('[signOutAction] Clearing session cookies due to error as a fallback.');\n\n    await clearSessionCookies();\n\n    let errorMessage: unknown;\n    if (typeof error === 'string') {\n      errorMessage = error;\n    } else if (error instanceof Error) {\n      errorMessage = error.message;\n    } else {\n      errorMessage = JSON.stringify(error);\n    }\n\n    return {\n      error: errorMessage,\n      success: false,\n    };\n  }\n};\n\nexport default signOutAction;\n"],"mappings":";;;;;;;;;;;;;;;;;;;AAoBA,MAAM,gBAAgB,YAA6F;AACjH,wBAAO,MAAM,sEAAsE;CAEnF,MAAM,sBAAsB,YAA2B;EACrD,MAAMA,cAA8B,iCAAe;AAEnD,4CAAoB,aAAaC,+BAAe,sBAAsB,CAAC;AACvE,cAAY,OAAOA,+BAAe,0BAA0B,CAAC;;AAG/D,KAAI;EACF,MAAM,SAASC,2BAAW;EAC1B,MAAMC,YAAgC,MAAMC,8BAAc;EAE1D,IAAI,kBAAkB;AAEtB,MAAI,WAAW;AACb,0BAAO,MAAM,4FAA4F;AAEzG,qBAAkB,MAAM,OAAO,QAAQ,EAAE,EAAE,UAAU;;AAGvD,QAAM,qBAAqB;AAE3B,SAAO;GAAC,MAAM,EAAC,iBAAgB;GAAE,SAAS;GAAK;UACxC,OAAO;AACd,yBAAO,MAAM,iEAAiE,MAAM;AAEpF,yBAAO,MAAM,uEAAuE;AAEpF,QAAM,qBAAqB;EAE3B,IAAIC;AACJ,MAAI,OAAO,UAAU,SACnB,gBAAe;WACN,iBAAiB,MAC1B,gBAAe,MAAM;MAErB,gBAAe,KAAK,UAAU,MAAM;AAGtC,SAAO;GACL,OAAO;GACP,SAAS;GACV;;;AAIL,4BAAe"}

package/dist/cjs/server/actions/{signUpAction.cjs → auth/signUpAction.cjs}

@@ -1,9 +1,9 @@
 'use server';
 
 
-const require_getClient = require('../getClient.cjs');
+const require_getClient = require('../../getClient.cjs');
 
-//#region src/server/actions/signUpAction.ts
+//#region src/server/actions/auth/signUpAction.ts
 /**
 * Server action for initiating the sign-up redirect flow.
 */

package/dist/cjs/server/actions/auth/signUpAction.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"signUpAction.cjs","names":["getClient"],"sources":["../../../../../src/server/actions/auth/signUpAction.ts"],"sourcesContent":["// Copyright 2025 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\n'use server';\n\nimport getClient from '../../getClient';\n\n/**\n * Server action for initiating the sign-up redirect flow.\n */\nconst signUpAction = async (): Promise<{\n  data?: {signUpUrl?: string};\n  error?: string;\n  success: boolean;\n}> => {\n  try {\n    const client = getClient();\n    const config = client.getConfiguration() as any;\n    const signUpUrl: string = config?.signUpUrl ?? '';\n\n    return {data: {signUpUrl}, success: true};\n  } catch (error) {\n    return {error: String(error), success: false};\n  }\n};\n\nexport default signUpAction;\n"],"mappings":";;;;;;;;;AAUA,MAAM,eAAe,YAIf;AACJ,KAAI;AAKF,SAAO;GAAC,MAAM,EAAC,WAJAA,2BAAW,CACJ,kBAAkB,EACN,aAAa,IAEtB;GAAE,SAAS;GAAK;UAClC,OAAO;AACd,SAAO;GAAC,OAAO,OAAO,MAAM;GAAE,SAAS;GAAM;;;AAIjD,2BAAe"}

package/dist/cjs/server/actions/management/getGrantedPermissionsAction.cjs

@@ -0,0 +1,32 @@
+'use server';
+
+
+const require_rolldown_runtime = require('../../../_virtual/rolldown_runtime.cjs');
+const require_getSessionId = require('../getSessionId.cjs');
+const require_getClient = require('../../getClient.cjs');
+let __thunderid_node = require("@thunderid/node");
+__thunderid_node = require_rolldown_runtime.__toESM(__thunderid_node);
+
+//#region src/server/actions/management/getGrantedPermissionsAction.ts
+/**
+* Reads the permissions the signed-in user's access token grants, on the server, so only the list of
+* permissions reaches the browser and the token itself never does. Use the result only to decide what
+* to show; the server still checks every request.
+*
+* Never throws across the server action boundary: without a session or a readable token it returns
+* an empty list.
+*/
+const getGrantedPermissionsAction = async () => {
+	const sessionId = await require_getSessionId.default();
+	if (!sessionId) return [];
+	try {
+		return (0, __thunderid_node.getTokenPermissions)(await require_getClient.default().getAccessToken(sessionId));
+	} catch {
+		return [];
+	}
+};
+var getGrantedPermissionsAction_default = getGrantedPermissionsAction;
+
+//#endregion
+exports.default = getGrantedPermissionsAction_default;
+//# sourceMappingURL=getGrantedPermissionsAction.cjs.map

package/dist/cjs/server/actions/management/getGrantedPermissionsAction.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"getGrantedPermissionsAction.cjs","names":["sessionId: string | undefined","getSessionId","getClient"],"sources":["../../../../../src/server/actions/management/getGrantedPermissionsAction.ts"],"sourcesContent":["// Copyright 2026 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\n'use server';\n\nimport {getTokenPermissions} from '@thunderid/node';\nimport getClient from '../../getClient';\nimport getSessionId from '../getSessionId';\n\n/**\n * Reads the permissions the signed-in user's access token grants, on the server, so only the list of\n * permissions reaches the browser and the token itself never does. Use the result only to decide what\n * to show; the server still checks every request.\n *\n * Never throws across the server action boundary: without a session or a readable token it returns\n * an empty list.\n */\nconst getGrantedPermissionsAction = async (): Promise<string[]> => {\n  const sessionId: string | undefined = await getSessionId();\n\n  if (!sessionId) {\n    return [];\n  }\n\n  try {\n    return getTokenPermissions(await getClient().getAccessToken(sessionId));\n  } catch {\n    return [];\n  }\n};\n\nexport default getGrantedPermissionsAction;\n"],"mappings":";;;;;;;;;;;;;;;;;;AAiBA,MAAM,8BAA8B,YAA+B;CACjE,MAAMA,YAAgC,MAAMC,8BAAc;AAE1D,KAAI,CAAC,UACH,QAAO,EAAE;AAGX,KAAI;AACF,mDAA2B,MAAMC,2BAAW,CAAC,eAAe,UAAU,CAAC;SACjE;AACN,SAAO,EAAE;;;AAIb,0CAAe"}

package/dist/cjs/server/actions/{getUserTypesAction.cjs → management/getUserTypesAction.cjs}

@@ -1,12 +1,12 @@
 'use server';
 
 
-const require_rolldown_runtime = require('../../_virtual/rolldown_runtime.cjs');
-const require_runSelectPageAction = require('./runSelectPageAction.cjs');
+const require_rolldown_runtime = require('../../../_virtual/rolldown_runtime.cjs');
+const require_runSelectPageAction = require('../runSelectPageAction.cjs');
 let __thunderid_node = require("@thunderid/node");
 __thunderid_node = require_rolldown_runtime.__toESM(__thunderid_node);
 
-//#region src/server/actions/getUserTypesAction.ts
+//#region src/server/actions/management/getUserTypesAction.ts
 /**
 * Loads one page of user types for a `USER_TYPE_SELECT` picker using the signed-in user's server-held
 * session.

package/dist/cjs/server/actions/management/getUserTypesAction.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"getUserTypesAction.cjs","names":["runSelectPageAction"],"sources":["../../../../../src/server/actions/management/getUserTypesAction.ts"],"sourcesContent":["// Copyright 2026 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\n'use server';\n\nimport {capPageSize, toUserTypeSelectPage} from '@thunderid/node';\nimport runSelectPageAction, {SelectPageActionResult} from '../runSelectPageAction';\n\n/**\n * Request from the browser. Carries only paging; the session comes from the request cookie.\n */\nexport interface GetUserTypesActionRequest {\n  limit?: number;\n  offset?: number;\n}\n\nexport type GetUserTypesActionResult = SelectPageActionResult;\n\n/**\n * Loads one page of user types for a `USER_TYPE_SELECT` picker using the signed-in user's server-held\n * session.\n *\n * Never throws across the server action boundary; failures are mapped to a plain result.\n */\nconst getUserTypesAction = async ({limit, offset}: GetUserTypesActionRequest = {}): Promise<GetUserTypesActionResult> =>\n  runSelectPageAction('user types', {limit, offset}, async (client, sessionId, query) =>\n    toUserTypeSelectPage(\n      await client.getUserTypes({limit: capPageSize(query.limit), offset: query.offset}, sessionId),\n      query.offset ?? 0,\n    ),\n  );\n\nexport default getUserTypesAction;\n"],"mappings":";;;;;;;;;;;;;;;AAwBA,MAAM,qBAAqB,OAAO,EAAC,OAAO,WAAqC,EAAE,KAC/EA,oCAAoB,cAAc;CAAC;CAAO;CAAO,EAAE,OAAO,QAAQ,WAAW,qDAEzE,MAAM,OAAO,aAAa;CAAC,yCAAmB,MAAM,MAAM;CAAE,QAAQ,MAAM;CAAO,EAAE,UAAU,EAC7F,MAAM,UAAU,EACjB,CACF;AAEH,iCAAe"}

package/dist/cjs/server/actions/{getUsersAction.cjs → management/getUsersAction.cjs}

@@ -1,12 +1,12 @@
 'use server';
 
 
-const require_rolldown_runtime = require('../../_virtual/rolldown_runtime.cjs');
-const require_runSelectPageAction = require('./runSelectPageAction.cjs');
+const require_rolldown_runtime = require('../../../_virtual/rolldown_runtime.cjs');
+const require_runSelectPageAction = require('../runSelectPageAction.cjs');
 let __thunderid_node = require("@thunderid/node");
 __thunderid_node = require_rolldown_runtime.__toESM(__thunderid_node);
 
-//#region src/server/actions/getUsersAction.ts
+//#region src/server/actions/management/getUsersAction.ts
 /**
 * Loads one page of users for a `USER_SELECT` picker using the signed-in user's server-held session.
 *

package/dist/cjs/server/actions/management/getUsersAction.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"getUsersAction.cjs","names":["runSelectPageAction"],"sources":["../../../../../src/server/actions/management/getUsersAction.ts"],"sourcesContent":["// Copyright 2026 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\n'use server';\n\nimport {toUserSelectPage} from '@thunderid/node';\nimport runSelectPageAction, {SelectPageActionResult} from '../runSelectPageAction';\n\n/**\n * Request from the browser. Carries no session ID, token, or URL; the session comes from the request cookie.\n */\nexport interface GetUsersActionRequest {\n  filter?: string;\n  limit?: number;\n  offset?: number;\n}\n\nexport type GetUsersActionResult = SelectPageActionResult;\n\n/**\n * Loads one page of users for a `USER_SELECT` picker using the signed-in user's server-held session.\n *\n * Never throws across the server action boundary; failures are mapped to a plain result.\n */\nconst getUsersAction = async ({filter, limit, offset}: GetUsersActionRequest = {}): Promise<GetUsersActionResult> =>\n  runSelectPageAction(\n    'users',\n    {filter, limit, offset},\n    async (client, sessionId, query) =>\n      toUserSelectPage(\n        await client.getUsers({filter: query.filter, limit: query.limit, offset: query.offset}, sessionId),\n        query.offset ?? 0,\n      ),\n    {allowFilter: true},\n  );\n\nexport default getUsersAction;\n"],"mappings":";;;;;;;;;;;;;;AAwBA,MAAM,iBAAiB,OAAO,EAAC,QAAQ,OAAO,WAAiC,EAAE,KAC/EA,oCACE,SACA;CAAC;CAAQ;CAAO;CAAO,EACvB,OAAO,QAAQ,WAAW,iDAEtB,MAAM,OAAO,SAAS;CAAC,QAAQ,MAAM;CAAQ,OAAO,MAAM;CAAO,QAAQ,MAAM;CAAO,EAAE,UAAU,EAClG,MAAM,UAAU,EACjB,EACH,EAAC,aAAa,MAAK,CACpB;AAEH,6BAAe"}

package/dist/cjs/server/actions/management/managementRequestAction.cjs

@@ -0,0 +1,79 @@
+'use server';
+
+
+const require_rolldown_runtime = require('../../../_virtual/rolldown_runtime.cjs');
+const require_getSessionId = require('../getSessionId.cjs');
+const require_getClient = require('../../getClient.cjs');
+let __thunderid_node = require("@thunderid/node");
+__thunderid_node = require_rolldown_runtime.__toESM(__thunderid_node);
+
+//#region src/server/actions/management/managementRequestAction.ts
+const ALLOWED_METHODS = [
+	"DELETE",
+	"GET",
+	"POST",
+	"PUT"
+];
+/** Large enough for any management payload, small enough that the action cannot be used to stream data. */
+const MAX_BODY_LENGTH = 1024 * 1024;
+const failure = (status) => ({
+	body: `Management request failed (HTTP ${status}).`,
+	status,
+	statusText: ""
+});
+/**
+* Performs one management API request with the signed-in user's server-held session, so the access
+* token never reaches the browser. Used as the `http.fetcher` of the admin components and hooks.
+*
+* A server action is a public endpoint, so everything the caller sends is checked here rather than
+* trusted from its TypeScript type: the method must be one the management API uses, the body must be
+* a bounded string, and the URL must address a configured management collection on the configured
+* host, so the bearer token is only ever sent where the SDK would have sent it.
+*
+* Never throws across the server action boundary; failures are mapped to a plain result.
+*/
+const managementRequestAction = async (request) => {
+	const { body, method: rawMethod, url: rawUrl } = request ?? {};
+	const method = typeof rawMethod === "string" ? rawMethod.toUpperCase() : "GET";
+	if (!ALLOWED_METHODS.includes(method) || body !== void 0 && (typeof body !== "string" || body.length > MAX_BODY_LENGTH)) return failure(400);
+	const sessionId = await require_getSessionId.default();
+	if (!sessionId) return failure(401);
+	try {
+		const client = require_getClient.default();
+		if (!client.isInitialized) await client.initialize({});
+		const url = (0, __thunderid_node.matchManagementUrl)(rawUrl, (0, __thunderid_node.getManagementCollectionUrls)(await Promise.resolve(client.getConfiguration())));
+		if (!url) return failure(400);
+		let accessToken;
+		try {
+			accessToken = await client.getAccessToken(sessionId);
+		} catch {
+			return failure(401);
+		}
+		const response = await fetch(url.toString(), {
+			headers: {
+				Accept: "application/json",
+				Authorization: `Bearer ${accessToken}`,
+				...body !== void 0 ? { "Content-Type": "application/json" } : {}
+			},
+			method,
+			redirect: "error",
+			...body !== void 0 ? { body } : {}
+		});
+		if (!response.ok) return {
+			...failure(response.status),
+			statusText: response.statusText ?? ""
+		};
+		return {
+			body: await response.text(),
+			status: response.status,
+			statusText: response.statusText ?? ""
+		};
+	} catch {
+		return failure(502);
+	}
+};
+var managementRequestAction_default = managementRequestAction;
+
+//#endregion
+exports.default = managementRequestAction_default;
+//# sourceMappingURL=managementRequestAction.cjs.map

package/dist/cjs/server/actions/management/managementRequestAction.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"managementRequestAction.cjs","names":["ALLOWED_METHODS: readonly string[]","MAX_BODY_LENGTH: number","method: string","sessionId: string | undefined","getSessionId","getClient","url: URL | undefined","accessToken: string","response: Response"],"sources":["../../../../../src/server/actions/management/managementRequestAction.ts"],"sourcesContent":["// Copyright 2026 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\n'use server';\n\nimport {getManagementCollectionUrls, matchManagementUrl} from '@thunderid/node';\nimport {ThunderIDNextConfig} from '../../../models/config';\nimport getClient from '../../getClient';\nimport getSessionId from '../getSessionId';\n\n/**\n * Request from the browser: one management API request as the core API function built it. It carries\n * no token or session; the session comes from the request cookie, and the URL must address one of\n * the configured management collections.\n */\nexport interface ManagementRequestActionRequest {\n  /**\n   * JSON request body, already serialized.\n   */\n  body?: string;\n  method?: string;\n  url: string;\n}\n\n/**\n * The upstream reply, as plain data that can cross the server action boundary. A failure carries a\n * message built on the server and the status, never the text of the upstream reply.\n */\nexport interface ManagementRequestActionResult {\n  body: string;\n  status: number;\n  statusText: string;\n}\n\nconst ALLOWED_METHODS: readonly string[] = ['DELETE', 'GET', 'POST', 'PUT'];\n\n/** Large enough for any management payload, small enough that the action cannot be used to stream data. */\nconst MAX_BODY_LENGTH: number = 1024 * 1024;\n\nconst failure = (status: number): ManagementRequestActionResult => ({\n  body: `Management request failed (HTTP ${status}).`,\n  status,\n  statusText: '',\n});\n\n/**\n * Performs one management API request with the signed-in user's server-held session, so the access\n * token never reaches the browser. Used as the `http.fetcher` of the admin components and hooks.\n *\n * A server action is a public endpoint, so everything the caller sends is checked here rather than\n * trusted from its TypeScript type: the method must be one the management API uses, the body must be\n * a bounded string, and the URL must address a configured management collection on the configured\n * host, so the bearer token is only ever sent where the SDK would have sent it.\n *\n * Never throws across the server action boundary; failures are mapped to a plain result.\n */\nconst managementRequestAction = async (\n  request: ManagementRequestActionRequest,\n): Promise<ManagementRequestActionResult> => {\n  const {\n    body,\n    method: rawMethod,\n    url: rawUrl,\n  } = (request ?? {}) as Partial<Record<keyof ManagementRequestActionRequest, unknown>>;\n  const method: string = typeof rawMethod === 'string' ? rawMethod.toUpperCase() : 'GET';\n\n  if (\n    !ALLOWED_METHODS.includes(method) ||\n    (body !== undefined && (typeof body !== 'string' || body.length > MAX_BODY_LENGTH))\n  ) {\n    return failure(400);\n  }\n\n  const sessionId: string | undefined = await getSessionId();\n\n  if (!sessionId) {\n    return failure(401);\n  }\n\n  try {\n    const client = getClient();\n\n    if (!client.isInitialized) {\n      await client.initialize({} as ThunderIDNextConfig);\n    }\n\n    // The storage manager may hand the configuration back as a promise.\n    const config: ThunderIDNextConfig = await Promise.resolve(client.getConfiguration());\n    const url: URL | undefined = matchManagementUrl(rawUrl, getManagementCollectionUrls(config));\n\n    if (!url) {\n      return failure(400);\n    }\n\n    let accessToken: string;\n\n    try {\n      accessToken = await client.getAccessToken(sessionId);\n    } catch {\n      return failure(401);\n    }\n\n    const response: Response = await fetch(url.toString(), {\n      headers: {\n        Accept: 'application/json',\n        Authorization: `Bearer ${accessToken}`,\n        ...(body !== undefined ? {'Content-Type': 'application/json'} : {}),\n      },\n      method,\n      // A redirect could carry the request to a host the URL check never saw.\n      redirect: 'error',\n      ...(body !== undefined ? {body} : {}),\n    });\n\n    if (!response.ok) {\n      return {...failure(response.status), statusText: response.statusText ?? ''};\n    }\n\n    return {body: await response.text(), status: response.status, statusText: response.statusText ?? ''};\n  } catch {\n    // Not logged: a management operation reports failure to its caller and leaves logging to the application.\n    return failure(502);\n  }\n};\n\nexport default managementRequestAction;\n"],"mappings":";;;;;;;;;;AAkCA,MAAMA,kBAAqC;CAAC;CAAU;CAAO;CAAQ;CAAM;;AAG3E,MAAMC,kBAA0B,OAAO;AAEvC,MAAM,WAAW,YAAmD;CAClE,MAAM,mCAAmC,OAAO;CAChD;CACA,YAAY;CACb;;;;;;;;;;;;AAaD,MAAM,0BAA0B,OAC9B,YAC2C;CAC3C,MAAM,EACJ,MACA,QAAQ,WACR,KAAK,WACF,WAAW,EAAE;CAClB,MAAMC,SAAiB,OAAO,cAAc,WAAW,UAAU,aAAa,GAAG;AAEjF,KACE,CAAC,gBAAgB,SAAS,OAAO,IAChC,SAAS,WAAc,OAAO,SAAS,YAAY,KAAK,SAAS,iBAElE,QAAO,QAAQ,IAAI;CAGrB,MAAMC,YAAgC,MAAMC,8BAAc;AAE1D,KAAI,CAAC,UACH,QAAO,QAAQ,IAAI;AAGrB,KAAI;EACF,MAAM,SAASC,2BAAW;AAE1B,MAAI,CAAC,OAAO,cACV,OAAM,OAAO,WAAW,EAAE,CAAwB;EAKpD,MAAMC,+CAA0C,0DADZ,MAAM,QAAQ,QAAQ,OAAO,kBAAkB,CAAC,CACO,CAAC;AAE5F,MAAI,CAAC,IACH,QAAO,QAAQ,IAAI;EAGrB,IAAIC;AAEJ,MAAI;AACF,iBAAc,MAAM,OAAO,eAAe,UAAU;UAC9C;AACN,UAAO,QAAQ,IAAI;;EAGrB,MAAMC,WAAqB,MAAM,MAAM,IAAI,UAAU,EAAE;GACrD,SAAS;IACP,QAAQ;IACR,eAAe,UAAU;IACzB,GAAI,SAAS,SAAY,EAAC,gBAAgB,oBAAmB,GAAG,EAAE;IACnE;GACD;GAEA,UAAU;GACV,GAAI,SAAS,SAAY,EAAC,MAAK,GAAG,EAAE;GACrC,CAAC;AAEF,MAAI,CAAC,SAAS,GACZ,QAAO;GAAC,GAAG,QAAQ,SAAS,OAAO;GAAE,YAAY,SAAS,cAAc;GAAG;AAG7E,SAAO;GAAC,MAAM,MAAM,SAAS,MAAM;GAAE,QAAQ,SAAS;GAAQ,YAAY,SAAS,cAAc;GAAG;SAC9F;AAEN,SAAO,QAAQ,IAAI;;;AAIvB,sCAAe"}

package/dist/cjs/utils/managementCollections.cjs

@@ -0,0 +1,22 @@
+const require_rolldown_runtime = require('../_virtual/rolldown_runtime.cjs');
+let __thunderid_node = require("@thunderid/node");
+__thunderid_node = require_rolldown_runtime.__toESM(__thunderid_node);
+
+//#region src/utils/managementCollections.ts
+/**
+* Picks the management collection overrides out of `config.endpoints`, so the browser builds the
+* same URLs the server will accept, without receiving the other endpoint overrides.
+*/
+const pickManagementEndpoints = (endpoints) => {
+	if (!endpoints) return;
+	const picked = {};
+	__thunderid_node.MANAGEMENT_COLLECTION_KEYS.forEach((key) => {
+		const value = endpoints[key];
+		if (typeof value === "string" && value) picked[key] = value;
+	});
+	return Object.keys(picked).length > 0 ? picked : void 0;
+};
+
+//#endregion
+exports.pickManagementEndpoints = pickManagementEndpoints;
+//# sourceMappingURL=managementCollections.cjs.map

package/dist/cjs/utils/managementCollections.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"managementCollections.cjs","names":["picked: Partial<Record<ManagementCollectionKey, string>>","value: unknown"],"sources":["../../../src/utils/managementCollections.ts"],"sourcesContent":["// Copyright 2026 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\nimport {MANAGEMENT_COLLECTION_KEYS} from '@thunderid/node';\nimport type {ManagementCollectionKey} from '@thunderid/node';\nimport type {ThunderIDNextConfig} from '../models/config';\n\n/**\n * Picks the management collection overrides out of `config.endpoints`, so the browser builds the\n * same URLs the server will accept, without receiving the other endpoint overrides.\n */\nexport const pickManagementEndpoints = (\n  endpoints: ThunderIDNextConfig['endpoints'] | undefined,\n): Partial<Record<ManagementCollectionKey, string>> | undefined => {\n  if (!endpoints) {\n    return undefined;\n  }\n\n  const picked: Partial<Record<ManagementCollectionKey, string>> = {};\n\n  MANAGEMENT_COLLECTION_KEYS.forEach((key: ManagementCollectionKey) => {\n    const value: unknown = (endpoints as Record<string, unknown>)[key];\n\n    if (typeof value === 'string' && value) {\n      picked[key] = value;\n    }\n  });\n\n  return Object.keys(picked).length > 0 ? picked : undefined;\n};\n"],"mappings":";;;;;;;;;AAWA,MAAa,2BACX,cACiE;AACjE,KAAI,CAAC,UACH;CAGF,MAAMA,SAA2D,EAAE;AAEnE,6CAA2B,SAAS,QAAiC;EACnE,MAAMC,QAAkB,UAAsC;AAE9D,MAAI,OAAO,UAAU,YAAY,MAC/B,QAAO,OAAO;GAEhB;AAEF,QAAO,OAAO,KAAK,OAAO,CAAC,SAAS,IAAI,SAAS"}

package/dist/client/admin.d.ts

@@ -0,0 +1,3 @@
+export { type AdminListRenderProps, BaseUserList, type BaseUserListProps, type BaseUserListRenderProps, BaseUserCreate, type BaseUserCreateProps, type BaseUserCreateRenderProps, BaseUserDetails, type BaseUserDetailsProps, type BaseUserDetailsRenderProps, BaseGroupList, type BaseGroupListProps, type BaseGroupListRenderProps, BaseGroupCreate, type BaseGroupCreateProps, type BaseGroupCreateRenderProps, BaseGroupMembers, type BaseGroupMembersProps, type BaseGroupMembersRenderProps, BaseRoleList, type BaseRoleListProps, type BaseRoleListRenderProps, BaseRoleCreate, type BaseRoleCreateProps, type BaseRoleCreateRenderProps, BaseRoleAssignments, type BaseRoleAssignmentsProps, type BaseRoleAssignmentsRenderProps, BaseRolePermissions, type BaseRolePermissionsProps, type BaseRolePermissionsRenderProps, BaseAgentList, type BaseAgentListProps, type BaseAgentListRenderProps, BaseAgentCreate, type BaseAgentCreateProps, type BaseAgentCreateRenderProps, BaseAgentDetails, type BaseAgentDetailsProps, type BaseAgentDetailsRenderProps, } from '@thunderid/react';
+export { useGetUsers, useGetUser, useCreateUser, useUpdateUser, useDeleteUser, useGetUserGroups, useGetUserTypes, useGetGroups, useGetGroup, useCreateGroup, useUpdateGroup, useDeleteGroup, useGetGroupMembers, useAddGroupMembers, useRemoveGroupMembers, useGetRoles, useGetRole, useCreateRole, useUpdateRole, useDeleteRole, useGetRoleAssignments, useAddRoleAssignments, useRemoveRoleAssignments, useGetAgents, useGetAgent, useCreateAgent, useUpdateAgent, useDeleteAgent, useGetAgentGroups, useGetAgentRoles, useGetAgentTypes, type ResourceQueryOptions, type ResourceQueryResult, type ResourceMutationOptions, type ResourceMutationResult, type UpdateUserVariables, type UseGetGroupsParams, type UpdateGroupVariables, type UseGetGroupMembersParams, type GroupMembersVariables, type UseGetRolesParams, type UpdateRoleVariables, type UseGetRoleAssignmentsParams, type RoleAssignmentsVariables, type UseGetAgentsParams, type UpdateAgentVariables, type GrantedPermissions, } from '@thunderid/react';
+//# sourceMappingURL=admin.d.ts.map

package/dist/client/admin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin.d.ts","sourceRoot":"","sources":["../../src/client/admin.ts"],"names":[],"mappings":"AAWA,OAAO,EACL,KAAK,oBAAoB,EACzB,YAAY,EACZ,KAAK,iBAAiB,EACtB,KAAK,uBAAuB,EAC5B,cAAc,EACd,KAAK,mBAAmB,EACxB,KAAK,yBAAyB,EAC9B,eAAe,EACf,KAAK,oBAAoB,EACzB,KAAK,0BAA0B,EAC/B,aAAa,EACb,KAAK,kBAAkB,EACvB,KAAK,wBAAwB,EAC7B,eAAe,EACf,KAAK,oBAAoB,EACzB,KAAK,0BAA0B,EAC/B,gBAAgB,EAChB,KAAK,qBAAqB,EAC1B,KAAK,2BAA2B,EAChC,YAAY,EACZ,KAAK,iBAAiB,EACtB,KAAK,uBAAuB,EAC5B,cAAc,EACd,KAAK,mBAAmB,EACxB,KAAK,yBAAyB,EAC9B,mBAAmB,EACnB,KAAK,wBAAwB,EAC7B,KAAK,8BAA8B,EACnC,mBAAmB,EACnB,KAAK,wBAAwB,EAC7B,KAAK,8BAA8B,EACnC,aAAa,EACb,KAAK,kBAAkB,EACvB,KAAK,wBAAwB,EAC7B,eAAe,EACf,KAAK,oBAAoB,EACzB,KAAK,0BAA0B,EAC/B,gBAAgB,EAChB,KAAK,qBAAqB,EAC1B,KAAK,2BAA2B,GACjC,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EACL,WAAW,EACX,UAAU,EACV,aAAa,EACb,aAAa,EACb,aAAa,EACb,gBAAgB,EAChB,eAAe,EACf,YAAY,EACZ,WAAW,EACX,cAAc,EACd,cAAc,EACd,cAAc,EACd,kBAAkB,EAClB,kBAAkB,EAClB,qBAAqB,EACrB,WAAW,EACX,UAAU,EACV,aAAa,EACb,aAAa,EACb,aAAa,EACb,qBAAqB,EACrB,qBAAqB,EACrB,wBAAwB,EACxB,YAAY,EACZ,WAAW,EACX,cAAc,EACd,cAAc,EACd,cAAc,EACd,iBAAiB,EACjB,gBAAgB,EAChB,gBAAgB,EAChB,KAAK,oBAAoB,EACzB,KAAK,mBAAmB,EACxB,KAAK,uBAAuB,EAC5B,KAAK,sBAAsB,EAC3B,KAAK,mBAAmB,EACxB,KAAK,kBAAkB,EACvB,KAAK,oBAAoB,EACzB,KAAK,wBAAwB,EAC7B,KAAK,qBAAqB,EAC1B,KAAK,iBAAiB,EACtB,KAAK,mBAAmB,EACxB,KAAK,2BAA2B,EAChC,KAAK,wBAAwB,EAC7B,KAAK,kBAAkB,EACvB,KAAK,oBAAoB,EACzB,KAAK,kBAAkB,GACxB,MAAM,kBAAkB,CAAC"}

package/dist/client/admin.js

@@ -0,0 +1,6 @@
+'use client';
+
+
+import { BaseAgentCreate, BaseAgentDetails, BaseAgentList, BaseGroupCreate, BaseGroupList, BaseGroupMembers, BaseRoleAssignments, BaseRoleCreate, BaseRoleList, BaseRolePermissions, BaseUserCreate, BaseUserDetails, BaseUserList, useAddGroupMembers, useAddRoleAssignments, useCreateAgent, useCreateGroup, useCreateRole, useCreateUser, useDeleteAgent, useDeleteGroup, useDeleteRole, useDeleteUser, useGetAgent, useGetAgentGroups, useGetAgentRoles, useGetAgentTypes, useGetAgents, useGetGroup, useGetGroupMembers, useGetGroups, useGetRole, useGetRoleAssignments, useGetRoles, useGetUser, useGetUserGroups, useGetUserTypes, useGetUsers, useRemoveGroupMembers, useRemoveRoleAssignments, useUpdateAgent, useUpdateGroup, useUpdateRole, useUpdateUser } from "@thunderid/react";
+
+export { BaseAgentCreate, BaseAgentDetails, BaseAgentList, BaseGroupCreate, BaseGroupList, BaseGroupMembers, BaseRoleAssignments, BaseRoleCreate, BaseRoleList, BaseRolePermissions, BaseUserCreate, BaseUserDetails, BaseUserList, useAddGroupMembers, useAddRoleAssignments, useCreateAgent, useCreateGroup, useCreateRole, useCreateUser, useDeleteAgent, useDeleteGroup, useDeleteRole, useDeleteUser, useGetAgent, useGetAgentGroups, useGetAgentRoles, useGetAgentTypes, useGetAgents, useGetGroup, useGetGroupMembers, useGetGroups, useGetRole, useGetRoleAssignments, useGetRoles, useGetUser, useGetUserGroups, useGetUserTypes, useGetUsers, useRemoveGroupMembers, useRemoveRoleAssignments, useUpdateAgent, useUpdateGroup, useUpdateRole, useUpdateUser };

package/dist/client/components/account/ChangeCredential/ChangeCredential.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ChangeCredential.d.ts","sourceRoot":"","sources":["../../../../../src/client/components/account/ChangeCredential/ChangeCredential.tsx"],"names":[],"mappings":"AAMA,OAAO,EAEL,yBAAyB,EAI1B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAC,EAAE,EAAkC,MAAM,OAAO,CAAC;AAa1D;;;;GAIG;AACH,MAAM,MAAM,qBAAqB,GAAG,IAAI,CACtC,yBAAyB,EACzB,uBAAuB,GAAG,OAAO,GAAG,aAAa,GAAG,SAAS,GAAG,UAAU,GAAG,SAAS,CACvF,GAAG;IACF;;;;;;OAMG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;OAEG;IACH,SAAS,CAAC,EAAE,MAAM,IAAI,CAAC;CACxB,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,QAAA,MAAM,gBAAgB,EAAE,EAAE,CAAC,qBAAqB,CA4E/C,CAAC;AAEF,eAAe,gBAAgB,CAAC"}

package/dist/client/components/{presentation → account}/ChangeCredential/ChangeCredential.js

@@ -3,13 +3,13 @@
 
 import getSessionId_default from "../../../../server/actions/getSessionId.js";
 import useThunderID_default from "../../../contexts/ThunderID/useThunderID.js";
-import updateUserCredentialsAction_default from "../../../../server/actions/updateUserCredentialsAction.js";
+import updateUserCredentialsAction_default from "../../../../server/actions/account/updateUserCredentialsAction.js";
 import { CredentialConstants, resolveChangeCredentialPolicy, supportsCredential } from "@thunderid/node";
 import { BaseChangeCredential, useTranslation, useUser } from "@thunderid/react";
 import { useMemo, useState } from "react";
 import { jsx } from "react/jsx-runtime";
 
-//#region src/client/components/presentation/ChangeCredential/ChangeCredential.tsx
+//#region src/client/components/account/ChangeCredential/ChangeCredential.tsx
 /**
 * Title-cases a credential attribute name for use as a display-name fallback when the schema
 * declares no `displayName` for it, e.g. `pin` -> `Pin`.

package/dist/client/components/account/ChangeCredential/ChangeCredential.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ChangeCredential.js","names":["ChangeCredential: FC<ChangeCredentialProps>","useThunderID","resolvedDisplayName: string","resolvedPolicy: PasswordPolicy","result: UpdateUserCredentialsActionResult","updateUserCredentialsAction","getSessionId","text: string"],"sources":["../../../../../src/client/components/account/ChangeCredential/ChangeCredential.tsx"],"sourcesContent":["// Copyright 2026 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\n'use client';\n\nimport {CredentialConstants, PasswordPolicy, resolveChangeCredentialPolicy, supportsCredential} from '@thunderid/node';\nimport {\n  BaseChangeCredential,\n  BaseChangeCredentialProps,\n  ChangePasswordValues,\n  useTranslation,\n  useUser,\n} from '@thunderid/react';\nimport {FC, ReactElement, useMemo, useState} from 'react';\nimport updateUserCredentialsAction, {\n  UpdateUserCredentialsActionResult,\n} from '../../../../server/actions/account/updateUserCredentialsAction';\nimport getSessionId from '../../../../server/actions/getSessionId';\nimport useThunderID from '../../../contexts/ThunderID/useThunderID';\n\n/**\n * Title-cases a credential attribute name for use as a display-name fallback when the schema\n * declares no `displayName` for it, e.g. `pin` -> `Pin`.\n */\nconst defaultDisplayName = (attribute: string): string => attribute.charAt(0).toUpperCase() + attribute.slice(1);\n\n/**\n * Props for the ChangeCredential component.\n * Mirrors `@thunderid/react`'s `ChangeCredentialProps` exactly, so a consumer moving between\n * the React and Next.js SDKs doesn't need to change how they call it.\n */\nexport type ChangeCredentialProps = Omit<\n  BaseChangeCredentialProps,\n  'credentialDisplayName' | 'error' | 'fieldErrors' | 'loading' | 'onSubmit' | 'success'\n> & {\n  /**\n   * The credential attribute this instance manages, any attribute the user's entity type\n   * schema declares `credential: true` (for example `password` or `pin`). Defaults to\n   * `password`. Render the component once per credential to let a user manage more than one,\n   * for example `<ChangeCredential />` for the password and\n   * `<ChangeCredential attribute=\"pin\" />` for a PIN.\n   */\n  attribute?: string;\n  /**\n   * Called after the credential has been changed successfully.\n   */\n  onSuccess?: () => void;\n};\n\n/**\n * ChangeCredential lets the signed-in user set a new value for one of their own credentials.\n *\n * This is the Next.js-specific implementation: it uses `BaseChangeCredential` from\n * `@thunderid/react` for rendering, but routes the write through\n * `updateUserCredentialsAction` (a server action) instead of calling the ThunderID server\n * directly from the browser, matching how `UserProfile` reaches `updateUserProfileAction`.\n *\n * Defaults to managing the `password` credential. To manage a different one (for example a\n * PIN declared on the user type schema), set `attribute`; render the component once per\n * credential to let a user manage several.\n *\n * @example\n * ```tsx\n * // Basic usage, manages the password\n * <ChangeCredential onSuccess={() => toast('Password updated')} />\n *\n * // Managing a different credential declared on the schema\n * <ChangeCredential attribute=\"pin\" />\n * ```\n */\nconst ChangeCredential: FC<ChangeCredentialProps> = ({\n  attribute = CredentialConstants.PASSWORD,\n  onSuccess,\n  policy,\n  preferences,\n  ...rest\n}: ChangeCredentialProps): ReactElement => {\n  const {preferences: contextPreferences} = useThunderID();\n  const {userSchema} = useUser();\n  const resolvedDisplayName: string = userSchema?.[attribute]?.displayName ?? defaultDisplayName(attribute);\n\n  const resolvedPreferences = useMemo(\n    () => ({\n      ...contextPreferences,\n      ...preferences,\n      user: {...contextPreferences?.user, ...preferences?.user},\n    }),\n    [contextPreferences, preferences],\n  );\n  const {t} = useTranslation(resolvedPreferences?.i18n);\n\n  const [error, setError] = useState<string | null>(null);\n  const [fieldErrors, setFieldErrors] = useState<Record<string, string>>({});\n  const [loading, setLoading] = useState<boolean>(false);\n  const [success, setSuccess] = useState<boolean>(false);\n\n  const resolvedPolicy: PasswordPolicy = useMemo(\n    () => resolveChangeCredentialPolicy(userSchema, attribute, policy),\n    [userSchema, attribute, policy],\n  );\n\n  const handleSubmit = async ({newPassword}: ChangePasswordValues): Promise<void> => {\n    setError(null);\n    setFieldErrors({});\n    setSuccess(false);\n    setLoading(true);\n\n    const result: UpdateUserCredentialsActionResult = await updateUserCredentialsAction(\n      {[attribute]: newPassword},\n      await getSessionId(),\n    );\n\n    if (result.success) {\n      setSuccess(true);\n      onSuccess?.();\n    } else {\n      const text: string =\n        result.message ??\n        t(result.messageKey, {credential: resolvedDisplayName, credentialLower: resolvedDisplayName.toLowerCase()});\n\n      if (result.field) {\n        setFieldErrors({[result.field]: text});\n      } else {\n        setError(text);\n      }\n    }\n\n    setLoading(false);\n  };\n\n  return (\n    <BaseChangeCredential\n      {...rest}\n      credentialDisplayName={resolvedDisplayName}\n      error={error}\n      fieldErrors={fieldErrors}\n      loading={loading}\n      policy={resolvedPolicy}\n      preferences={resolvedPreferences}\n      success={success}\n      unavailable={!supportsCredential(userSchema, attribute)}\n      onSubmit={(values: ChangePasswordValues): void => {\n        void handleSubmit(values);\n      }}\n    />\n  );\n};\n\nexport default ChangeCredential;\n"],"mappings":";;;;;;;;;;;;;;;;AAwBA,MAAM,sBAAsB,cAA8B,UAAU,OAAO,EAAE,CAAC,aAAa,GAAG,UAAU,MAAM,EAAE;;;;;;;;;;;;;;;;;;;;;;AA8ChH,MAAMA,oBAA+C,EACnD,YAAY,oBAAoB,UAChC,WACA,QACA,YACA,GAAG,WACsC;CACzC,MAAM,EAAC,aAAa,uBAAsBC,sBAAc;CACxD,MAAM,EAAC,eAAc,SAAS;CAC9B,MAAMC,sBAA8B,aAAa,YAAY,eAAe,mBAAmB,UAAU;CAEzG,MAAM,sBAAsB,eACnB;EACL,GAAG;EACH,GAAG;EACH,MAAM;GAAC,GAAG,oBAAoB;GAAM,GAAG,aAAa;GAAK;EAC1D,GACD,CAAC,oBAAoB,YAAY,CAClC;CACD,MAAM,EAAC,MAAK,eAAe,qBAAqB,KAAK;CAErD,MAAM,CAAC,OAAO,YAAY,SAAwB,KAAK;CACvD,MAAM,CAAC,aAAa,kBAAkB,SAAiC,EAAE,CAAC;CAC1E,MAAM,CAAC,SAAS,cAAc,SAAkB,MAAM;CACtD,MAAM,CAAC,SAAS,cAAc,SAAkB,MAAM;CAEtD,MAAMC,iBAAiC,cAC/B,8BAA8B,YAAY,WAAW,OAAO,EAClE;EAAC;EAAY;EAAW;EAAO,CAChC;CAED,MAAM,eAAe,OAAO,EAAC,kBAAsD;AACjF,WAAS,KAAK;AACd,iBAAe,EAAE,CAAC;AAClB,aAAW,MAAM;AACjB,aAAW,KAAK;EAEhB,MAAMC,SAA4C,MAAMC,oCACtD,GAAE,YAAY,aAAY,EAC1B,MAAMC,sBAAc,CACrB;AAED,MAAI,OAAO,SAAS;AAClB,cAAW,KAAK;AAChB,gBAAa;SACR;GACL,MAAMC,OACJ,OAAO,WACP,EAAE,OAAO,YAAY;IAAC,YAAY;IAAqB,iBAAiB,oBAAoB,aAAa;IAAC,CAAC;AAE7G,OAAI,OAAO,MACT,gBAAe,GAAE,OAAO,QAAQ,MAAK,CAAC;OAEtC,UAAS,KAAK;;AAIlB,aAAW,MAAM;;AAGnB,QACE,oBAAC;EACC,GAAI;EACJ,uBAAuB;EAChB;EACM;EACJ;EACT,QAAQ;EACR,aAAa;EACJ;EACT,aAAa,CAAC,mBAAmB,YAAY,UAAU;EACvD,WAAW,WAAuC;AAChD,GAAK,aAAa,OAAO;;GAE3B;;AAIN,+BAAe"}

package/dist/client/components/account/User/User.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"User.d.ts","sourceRoot":"","sources":["../../../../../src/client/components/account/User/User.tsx"],"names":[],"mappings":"AAKA,OAAO,EAAW,aAAa,EAAC,MAAM,kBAAkB,CAAC;AACzD,OAAO,EAAC,EAAE,EAAgB,SAAS,EAAC,MAAM,OAAO,CAAC;AAGlD;;;GAGG;AACH,MAAM,WAAW,SAAU,SAAQ,IAAI,CAAC,aAAa,EAAE,MAAM,CAAC;IAC5D;;;;OAIG;IACH,QAAQ,EAAE,CAAC,IAAI,EAAE,GAAG,GAAG,IAAI,KAAK,SAAS,CAAC;IAE1C;;OAEG;IACH,QAAQ,CAAC,EAAE,SAAS,CAAC;CACtB;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,QAAA,MAAM,IAAI,EAAE,EAAE,CAAC,SAAS,CAQvB,CAAC;AAIF,eAAe,IAAI,CAAC"}

package/dist/client/components/{presentation → account}/User/User.js

@@ -5,7 +5,7 @@ import useThunderID_default from "../../../contexts/ThunderID/useThunderID.js";
 import { BaseUser } from "@thunderid/react";
 import { jsx } from "react/jsx-runtime";
 
-//#region src/client/components/presentation/User/User.tsx
+//#region src/client/components/account/User/User.tsx
 /**
 * A component that uses render props to expose the authenticated user object.
 * This component automatically retrieves the user from ThunderID context.

package/dist/client/components/account/User/User.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"User.js","names":["User: FC<UserProps>","useThunderID"],"sources":["../../../../../src/client/components/account/User/User.tsx"],"sourcesContent":["// Copyright 2025 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\n'use client';\n\nimport {BaseUser, BaseUserProps} from '@thunderid/react';\nimport {FC, ReactElement, ReactNode} from 'react';\nimport useThunderID from '../../../contexts/ThunderID/useThunderID';\n\n/**\n * Props for the User component.\n * Extends BaseUserProps but makes the user prop optional since it will be obtained from useThunderID\n */\nexport interface UserProps extends Omit<BaseUserProps, 'user'> {\n  /**\n   * Render prop that takes the user object and returns a ReactNode.\n   * @param user - The authenticated user object from ThunderID.\n   * @returns A ReactNode to render.\n   */\n  children: (user: any | null) => ReactNode;\n\n  /**\n   * Optional element to render when no user is signed in.\n   */\n  fallback?: ReactNode;\n}\n\n/**\n * A component that uses render props to expose the authenticated user object.\n * This component automatically retrieves the user from ThunderID context.\n *\n * @remarks This component is only supported in browser based React applications (CSR).\n *\n * @example\n * ```tsx\n * import { User } from '@thunderid/auth-react';\n *\n * const App = () => {\n *   return (\n *     <User fallback={<p>Please sign in</p>}>\n *       {(user) => (\n *         <div>\n *           <h1>Welcome, {user.displayName}!</h1>\n *           <p>Email: {user.email}</p>\n *         </div>\n *       )}\n *     </User>\n *   );\n * }\n * ```\n */\nconst User: FC<UserProps> = ({children, fallback = null}: UserProps): ReactElement => {\n  const {user} = useThunderID();\n\n  return (\n    <BaseUser user={user} fallback={fallback}>\n      {children}\n    </BaseUser>\n  );\n};\n\nUser.displayName = 'User';\n\nexport default User;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAmDA,MAAMA,QAAuB,EAAC,UAAU,WAAW,WAAmC;CACpF,MAAM,EAAC,SAAQC,sBAAc;AAE7B,QACE,oBAAC;EAAe;EAAgB;EAC7B;GACQ;;AAIf,KAAK,cAAc;AAEnB,mBAAe"}

package/dist/client/components/account/UserAvatar/UserAvatar.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"UserAvatar.d.ts","sourceRoot":"","sources":["../../../../../src/client/components/account/UserAvatar/UserAvatar.tsx"],"names":[],"mappings":"AAKA,OAAO,EAAiB,mBAAmB,EAAC,MAAM,kBAAkB,CAAC;AACrE,OAAO,EAAC,EAAE,EAAe,MAAM,OAAO,CAAC;AAGvC,MAAM,MAAM,eAAe,GAAG,IAAI,CAAC,mBAAmB,EAAE,MAAM,CAAC,CAAC;AAEhE;;;;;;;;;GASG;AACH,QAAA,MAAM,UAAU,EAAE,EAAE,CAAC,eAAe,CAInC,CAAC;AAEF,eAAe,UAAU,CAAC"}

package/dist/client/components/{presentation → account}/UserAvatar/UserAvatar.js

@@ -5,7 +5,7 @@ import useThunderID_default from "../../../contexts/ThunderID/useThunderID.js";
 import { BaseUserAvatar } from "@thunderid/react";
 import { jsx } from "react/jsx-runtime";
 
-//#region src/client/components/presentation/UserAvatar/UserAvatar.tsx
+//#region src/client/components/account/UserAvatar/UserAvatar.tsx
 /**
 * UserAvatar component renders an avatar for the currently signed-in user.
 * This component is the Next.js-specific implementation that uses BaseUserAvatar

package/dist/client/components/account/UserAvatar/UserAvatar.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"UserAvatar.js","names":["UserAvatar: FC<UserAvatarProps>","useThunderID"],"sources":["../../../../../src/client/components/account/UserAvatar/UserAvatar.tsx"],"sourcesContent":["// Copyright 2026 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\n'use client';\n\nimport {BaseUserAvatar, BaseUserAvatarProps} from '@thunderid/react';\nimport {FC, ReactElement} from 'react';\nimport useThunderID from '../../../contexts/ThunderID/useThunderID';\n\nexport type UserAvatarProps = Omit<BaseUserAvatarProps, 'user'>;\n\n/**\n * UserAvatar component renders an avatar for the currently signed-in user.\n * This component is the Next.js-specific implementation that uses BaseUserAvatar\n * and automatically retrieves the user data from ThunderID context.\n *\n * @example\n * ```tsx\n * <UserAvatar size={48} />\n * ```\n */\nconst UserAvatar: FC<UserAvatarProps> = (props: UserAvatarProps): ReactElement => {\n  const {user} = useThunderID();\n\n  return <BaseUserAvatar user={user} {...props} />;\n};\n\nexport default UserAvatar;\n"],"mappings":";;;;;;;;;;;;;;;;;;AAqBA,MAAMA,cAAmC,UAAyC;CAChF,MAAM,EAAC,SAAQC,sBAAc;AAE7B,QAAO,oBAAC;EAAqB;EAAM,GAAI;GAAS;;AAGlD,yBAAe"}

package/dist/client/components/account/UserDropdown/UserDropdown.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"UserDropdown.d.ts","sourceRoot":"","sources":["../../../../../src/client/components/account/UserDropdown/UserDropdown.tsx"],"names":[],"mappings":"AAKA,OAAO,EAAmB,qBAAqB,EAAC,MAAM,kBAAkB,CAAC;AACzE,OAAO,EAAC,EAAE,EAAgB,SAAS,EAAW,MAAM,OAAO,CAAC;AAI5D;;GAEG;AACH,MAAM,WAAW,uBAAuB;IACtC,2CAA2C;IAC3C,YAAY,EAAE,MAAM,IAAI,CAAC;IACzB,6CAA6C;IAC7C,SAAS,EAAE,OAAO,CAAC;IACnB,mDAAmD;IACnD,aAAa,EAAE,OAAO,CAAC;IACvB,+CAA+C;IAC/C,WAAW,EAAE,MAAM,IAAI,CAAC;IACxB,oCAAoC;IACpC,OAAO,EAAE,MAAM,IAAI,CAAC;IACpB,oCAAoC;IACpC,IAAI,EAAE,GAAG,CAAC;CACX;AAED;;;GAGG;AACH,MAAM,MAAM,iBAAiB,GAAG,IAAI,CAAC,qBAAqB,EAAE,MAAM,GAAG,iBAAiB,CAAC,GAAG;IACxF;;;OAGG;IACH,QAAQ,CAAC,EAAE,CAAC,KAAK,EAAE,uBAAuB,KAAK,SAAS,CAAC;IACzD;;;;;;;;;;OAUG;IACH,eAAe,CAAC,EAAE,MAAM,IAAI,CAAC;IAC7B;;;OAGG;IACH,cAAc,CAAC,EAAE,CAAC,KAAK,EAAE,uBAAuB,KAAK,SAAS,CAAC;IAC/D;;;OAGG;IACH,aAAa,CAAC,EAAE,CAAC,KAAK,EAAE,uBAAuB,KAAK,SAAS,CAAC;CAC/D,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AACH,QAAA,MAAM,YAAY,EAAE,EAAE,CAAC,iBAAiB,CAwFvC,CAAC;AAEF,eAAe,YAAY,CAAC"}

package/dist/client/components/{presentation → account}/UserDropdown/UserDropdown.js

@@ -7,7 +7,7 @@ import { BaseUserDropdown } from "@thunderid/react";
 import { useState } from "react";
 import { Fragment, jsx, jsxs } from "react/jsx-runtime";
 
-//#region src/client/components/presentation/UserDropdown/UserDropdown.tsx
+//#region src/client/components/account/UserDropdown/UserDropdown.tsx
 /**
 * UserDropdown component displays a user avatar with a dropdown menu.
 * When clicked, it shows a popover with customizable menu items.

package/dist/client/components/account/UserDropdown/UserDropdown.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"UserDropdown.js","names":["UserDropdown: FC<UserDropdownProps>","useThunderID","renderProps: UserDropdownRenderProps","UserProfile"],"sources":["../../../../../src/client/components/account/UserDropdown/UserDropdown.tsx"],"sourcesContent":["// Copyright 2025 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\n'use client';\n\nimport {BaseUserDropdown, BaseUserDropdownProps} from '@thunderid/react';\nimport {FC, ReactElement, ReactNode, useState} from 'react';\nimport useThunderID from '../../../contexts/ThunderID/useThunderID';\nimport UserProfile from '../UserProfile/UserProfile.js';\n\n/**\n * Render props data passed to the children function\n */\nexport interface UserDropdownRenderProps {\n  /** Function to close the profile dialog */\n  closeProfile: () => void;\n  /** Whether user data is currently loading */\n  isLoading: boolean;\n  /** Whether the profile dialog is currently open */\n  isProfileOpen: boolean;\n  /** Function to open the user profile dialog */\n  openProfile: () => void;\n  /** Function to sign out the user */\n  signOut: () => void;\n  /** The authenticated user object */\n  user: any;\n}\n\n/**\n * Props for the UserDropdown component.\n * Extends BaseUserDropdownProps but excludes user, onManageProfile, and onSignOut since they're handled internally\n */\nexport type UserDropdownProps = Omit<BaseUserDropdownProps, 'user' | 'onManageProfile'> & {\n  /**\n   * Render prop function that receives user state and actions.\n   * When provided, this completely replaces the default dropdown rendering.\n   */\n  children?: (props: UserDropdownRenderProps) => ReactNode;\n  /**\n   * Called instead of opening the built-in \"Manage Profile\" popup when the \"Manage Profile\"\n   * menu item (see `manageProfileLabel`) is clicked. Use this when the app has its own\n   * profile/account page it wants to navigate to instead, for example with the router's\n   * `push()`.\n   *\n   * @example\n   * ```tsx\n   * <UserDropdown manageProfileLabel=\"Manage Account\" onManageProfile={() => router.push('/account')} />\n   * ```\n   */\n  onManageProfile?: () => void;\n  /**\n   * Custom render function for the dropdown content.\n   * When provided, this replaces just the dropdown content while keeping the trigger.\n   */\n  renderDropdown?: (props: UserDropdownRenderProps) => ReactNode;\n  /**\n   * Custom render function for the trigger button.\n   * When provided, this replaces just the trigger button while keeping the dropdown.\n   */\n  renderTrigger?: (props: UserDropdownRenderProps) => ReactNode;\n};\n\n/**\n * UserDropdown component displays a user avatar with a dropdown menu.\n * When clicked, it shows a popover with customizable menu items.\n * This component is the React-specific implementation that uses the BaseUserDropdown\n * and automatically retrieves the user data from ThunderID context.\n *\n * Supports render props for complete customization of the dropdown appearance and behavior.\n *\n * @example\n * ```tsx\n * // Basic usage - will use user from ThunderID context\n * <UserDropdown menuItems={[\n *   { label: 'Profile', onClick: () => {} },\n *   { label: 'Settings', href: '/settings' },\n *   { label: 'Sign Out', onClick: () => {} }\n * ]} />\n *\n * // With custom configuration\n * <UserDropdown\n *   showTriggerLabel={true}\n *   avatarSize={40}\n *   fallback={<div>Please sign in</div>}\n * />\n *\n * // Using render props for complete customization\n * <UserDropdown>\n *   {({ user, isLoading, openProfile, signOut }) => (\n *     <div>\n *       <button onClick={openProfile}>\n *         {user?.name || 'Loading...'}\n *       </button>\n *       <button onClick={signOut}>Logout</button>\n *     </div>\n *   )}\n * </UserDropdown>\n *\n * // Using partial render props\n * <UserDropdown\n *   renderTrigger={({ user, openProfile }) => (\n *     <button onClick={openProfile} className=\"custom-trigger\">\n *       Welcome, {user?.name}!\n *     </button>\n *   )}\n * />\n * ```\n */\nconst UserDropdown: FC<UserDropdownProps> = ({\n  children,\n  renderTrigger,\n  renderDropdown,\n  onManageProfile: onManageProfileOverride,\n  onSignOut,\n  ...rest\n}: UserDropdownProps): ReactElement => {\n  const {user, isLoading, signOut} = useThunderID();\n  const [isProfileOpen, setIsProfileOpen] = useState(false);\n\n  const handleManageProfile = (): void => {\n    if (onManageProfileOverride) {\n      onManageProfileOverride();\n      return;\n    }\n    setIsProfileOpen(true);\n  };\n\n  const handleSignOut = (): void => {\n    signOut();\n    if (onSignOut) {\n      onSignOut();\n    }\n  };\n\n  const closeProfile = (): void => {\n    setIsProfileOpen(false);\n  };\n\n  // Prepare render props data\n  const renderProps: UserDropdownRenderProps = {\n    closeProfile,\n    isLoading: isLoading!,\n    isProfileOpen,\n    openProfile: handleManageProfile,\n    signOut: handleSignOut,\n    user,\n  };\n\n  // If children render prop is provided, use it for complete customization\n  if (children) {\n    return (\n      <>\n        {children(renderProps)}\n        {!onManageProfileOverride && <UserProfile mode=\"popup\" open={isProfileOpen} onOpenChange={setIsProfileOpen} />}\n      </>\n    );\n  }\n\n  // If partial render props are provided, customize specific parts\n  if (renderTrigger || renderDropdown) {\n    // This would require significant changes to BaseUserDropdown to support partial customization\n    // For now, we'll provide a simple implementation that shows how it could work\n    return (\n      <>\n        {renderTrigger ? (\n          renderTrigger(renderProps)\n        ) : (\n          <BaseUserDropdown\n            user={user}\n            isLoading={isLoading}\n            onManageProfile={handleManageProfile}\n            onSignOut={handleSignOut}\n            {...rest}\n          />\n        )}\n        {/* Note: renderDropdown would need BaseUserDropdown modifications to implement properly */}\n        {!onManageProfileOverride && <UserProfile mode=\"popup\" open={isProfileOpen} onOpenChange={setIsProfileOpen} />}\n      </>\n    );\n  }\n\n  // Default behavior - use BaseUserDropdown as before\n  return (\n    <>\n      <BaseUserDropdown\n        user={user}\n        isLoading={isLoading}\n        onManageProfile={handleManageProfile}\n        onSignOut={handleSignOut}\n        {...rest}\n      />\n      {!onManageProfileOverride && isProfileOpen && (\n        <UserProfile mode=\"popup\" open={isProfileOpen} onOpenChange={setIsProfileOpen} />\n      )}\n    </>\n  );\n};\n\nexport default UserDropdown;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA4GA,MAAMA,gBAAuC,EAC3C,UACA,eACA,gBACA,iBAAiB,yBACjB,UACA,GAAG,WACkC;CACrC,MAAM,EAAC,MAAM,WAAW,YAAWC,sBAAc;CACjD,MAAM,CAAC,eAAe,oBAAoB,SAAS,MAAM;CAEzD,MAAM,4BAAkC;AACtC,MAAI,yBAAyB;AAC3B,4BAAyB;AACzB;;AAEF,mBAAiB,KAAK;;CAGxB,MAAM,sBAA4B;AAChC,WAAS;AACT,MAAI,UACF,YAAW;;CAIf,MAAM,qBAA2B;AAC/B,mBAAiB,MAAM;;CAIzB,MAAMC,cAAuC;EAC3C;EACW;EACX;EACA,aAAa;EACb,SAAS;EACT;EACD;AAGD,KAAI,SACF,QACE,4CACG,SAAS,YAAY,EACrB,CAAC,2BAA2B,oBAACC;EAAY,MAAK;EAAQ,MAAM;EAAe,cAAc;GAAoB,IAC7G;AAKP,KAAI,iBAAiB,eAGnB,QACE,4CACG,gBACC,cAAc,YAAY,GAE1B,oBAAC;EACO;EACK;EACX,iBAAiB;EACjB,WAAW;EACX,GAAI;GACJ,EAGH,CAAC,2BAA2B,oBAACA;EAAY,MAAK;EAAQ,MAAM;EAAe,cAAc;GAAoB,IAC7G;AAKP,QACE,4CACE,oBAAC;EACO;EACK;EACX,iBAAiB;EACjB,WAAW;EACX,GAAI;GACJ,EACD,CAAC,2BAA2B,iBAC3B,oBAACA;EAAY,MAAK;EAAQ,MAAM;EAAe,cAAc;GAAoB,IAElF;;AAIP,2BAAe"}

package/dist/client/components/account/UserProfile/UserProfile.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"UserProfile.d.ts","sourceRoot":"","sources":["../../../../../src/client/components/account/UserProfile/UserProfile.tsx"],"names":[],"mappings":"AAMA,OAAO,EAAkB,oBAAoB,EAA0B,MAAM,kBAAkB,CAAC;AAChG,OAAO,EAAC,EAAE,EAAyB,MAAM,OAAO,CAAC;AAIjD;;;GAGG;AACH,MAAM,MAAM,gBAAgB,GAAG,IAAI,CAAC,oBAAoB,EAAE,MAAM,GAAG,SAAS,GAAG,kBAAkB,CAAC,CAAC;AAEnG;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,QAAA,MAAM,WAAW,EAAE,EAAE,CAAC,gBAAgB,CAmDrC,CAAC;AAEF,eAAe,WAAW,CAAC"}

package/dist/client/components/{presentation → account}/UserProfile/UserProfile.js

@@ -8,7 +8,7 @@ import { BaseUserProfile, useTranslation, useUser } from "@thunderid/react";
 import { useState } from "react";
 import { jsx } from "react/jsx-runtime";
 
-//#region src/client/components/presentation/UserProfile/UserProfile.tsx
+//#region src/client/components/account/UserProfile/UserProfile.tsx
 /**
 * UserProfile component displays the authenticated user's profile information in a
 * structured and styled format. It shows user details such as display name, email,

package/dist/client/components/account/UserProfile/UserProfile.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"UserProfile.js","names":["UserProfile: FC<UserProfileProps>","useThunderID","isEditableProfile: boolean","result: {data: {user: User}; error: string; success: boolean}","getSessionId"],"sources":["../../../../../src/client/components/account/UserProfile/UserProfile.tsx"],"sourcesContent":["// Copyright 2025 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\n'use client';\n\nimport {deepMerge, User} from '@thunderid/node';\nimport {BaseUserProfile, BaseUserProfileProps, useUser, useTranslation} from '@thunderid/react';\nimport {FC, ReactElement, useState} from 'react';\nimport useThunderID from '../../../contexts/ThunderID/useThunderID';\nimport getSessionId from '../../../../server/actions/getSessionId';\n\n/**\n * Props for the UserProfile component.\n * Extends BaseUserProfileProps but makes the user prop optional since it will be obtained from useThunderID\n */\nexport type UserProfileProps = Omit<BaseUserProfileProps, 'user' | 'profile' | 'flattenedProfile'>;\n\n/**\n * UserProfile component displays the authenticated user's profile information in a\n * structured and styled format. It shows user details such as display name, email,\n * username, and other available profile information from ThunderID.\n *\n * This component is the React-specific implementation that uses the BaseUserProfile\n * and automatically retrieves the user data from ThunderID context if not provided.\n *\n * @example\n * ```tsx\n * // Basic usage - will use user from ThunderID context\n * <UserProfile />\n *\n * // With explicit user data\n * <UserProfile user={specificUser} />\n *\n * // With card layout and custom fallback\n * <UserProfile\n *   cardLayout={true}\n *   fallback={<div>Please sign in to view your profile</div>}\n * />\n * ```\n */\nconst UserProfile: FC<UserProfileProps> = ({preferences, editable = true, ...rest}: UserProfileProps): ReactElement => {\n  const {preferences: contextPreferences} = useThunderID();\n  const {profile, flattenedProfile, onUpdateProfile, updateProfile, userSchema} = useUser();\n  const resolvedPreferences = {\n    ...contextPreferences,\n    ...preferences,\n    user: {\n      ...contextPreferences?.user,\n      ...preferences?.user,\n    },\n  };\n  const {t} = useTranslation(resolvedPreferences?.i18n);\n  const isEditableProfile: boolean = resolvedPreferences?.user?.fetchUserProfile === false ? false : editable;\n\n  const [error, setError] = useState<string | null>(null);\n\n  const handleProfileUpdate = async (payload: any): Promise<void> => {\n    setError(null);\n\n    const updatedAttributes = deepMerge((profile?.['attributes'] as Record<string, unknown>) ?? {}, payload);\n\n    Object.keys(updatedAttributes).forEach((key) => {\n      if (updatedAttributes[key] === undefined || updatedAttributes[key] === null) {\n        delete updatedAttributes[key];\n      }\n    });\n\n    const result: {data: {user: User}; error: string; success: boolean} = await updateProfile(\n      {payload: updatedAttributes},\n      await getSessionId(),\n    );\n\n    if (result.success) {\n      onUpdateProfile(result.data.user);\n    } else {\n      setError(result.error || t('user.profile.update.generic.error'));\n    }\n  };\n\n  return (\n    <BaseUserProfile\n      profile={profile!}\n      flattenedProfile={flattenedProfile!}\n      userSchema={userSchema}\n      editable={isEditableProfile}\n      onUpdate={isEditableProfile ? handleProfileUpdate : undefined}\n      error={error}\n      preferences={resolvedPreferences}\n      {...rest}\n    />\n  );\n};\n\nexport default UserProfile;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAwCA,MAAMA,eAAqC,EAAC,aAAa,WAAW,KAAM,GAAG,WAA0C;CACrH,MAAM,EAAC,aAAa,uBAAsBC,sBAAc;CACxD,MAAM,EAAC,SAAS,kBAAkB,iBAAiB,eAAe,eAAc,SAAS;CACzF,MAAM,sBAAsB;EAC1B,GAAG;EACH,GAAG;EACH,MAAM;GACJ,GAAG,oBAAoB;GACvB,GAAG,aAAa;GACjB;EACF;CACD,MAAM,EAAC,MAAK,eAAe,qBAAqB,KAAK;CACrD,MAAMC,oBAA6B,qBAAqB,MAAM,qBAAqB,QAAQ,QAAQ;CAEnG,MAAM,CAAC,OAAO,YAAY,SAAwB,KAAK;CAEvD,MAAM,sBAAsB,OAAO,YAAgC;AACjE,WAAS,KAAK;EAEd,MAAM,oBAAoB,UAAW,UAAU,iBAA6C,EAAE,EAAE,QAAQ;AAExG,SAAO,KAAK,kBAAkB,CAAC,SAAS,QAAQ;AAC9C,OAAI,kBAAkB,SAAS,UAAa,kBAAkB,SAAS,KACrE,QAAO,kBAAkB;IAE3B;EAEF,MAAMC,SAAgE,MAAM,cAC1E,EAAC,SAAS,mBAAkB,EAC5B,MAAMC,sBAAc,CACrB;AAED,MAAI,OAAO,QACT,iBAAgB,OAAO,KAAK,KAAK;MAEjC,UAAS,OAAO,SAAS,EAAE,oCAAoC,CAAC;;AAIpE,QACE,oBAAC;EACU;EACS;EACN;EACZ,UAAU;EACV,UAAU,oBAAoB,sBAAsB;EAC7C;EACP,aAAa;EACb,GAAI;GACJ;;AAIN,0BAAe"}

package/dist/client/components/admin/AgentCreate/AgentCreate.d.ts

@@ -0,0 +1,17 @@
+import { AgentCreateProps as ReactAgentCreateProps } from '@thunderid/react';
+import { FC } from 'react';
+export type AgentCreateProps = ReactAgentCreateProps;
+/**
+ * Creates an agent.
+ *
+ * Management requests go through a server action with the signed-in user's server-held session, so
+ * the access token never reaches the browser. Whether a request succeeds is the server's decision.
+ *
+ * @example
+ * ```tsx
+ * <AgentCreate onCreated={(agent) => router.push(`/admin/agents/${agent.id}`)} />
+ * ```
+ */
+declare const AgentCreate: FC<AgentCreateProps>;
+export default AgentCreate;
+//# sourceMappingURL=AgentCreate.d.ts.map

package/dist/client/components/admin/AgentCreate/AgentCreate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AgentCreate.d.ts","sourceRoot":"","sources":["../../../../../src/client/components/admin/AgentCreate/AgentCreate.tsx"],"names":[],"mappings":"AAKA,OAAO,EAAkC,gBAAgB,IAAI,qBAAqB,EAAC,MAAM,kBAAkB,CAAC;AAC5G,OAAO,EAAC,EAAE,EAAe,MAAM,OAAO,CAAC;AAEvC,MAAM,MAAM,gBAAgB,GAAG,qBAAqB,CAAC;AAErD;;;;;;;;;;GAUG;AACH,QAAA,MAAM,WAAW,EAAE,EAAE,CAAC,gBAAgB,CAA8E,CAAC;AAIrH,eAAe,WAAW,CAAC"}