@thunderid/nextjs 1.3.1 → 1.5.0

package/dist/server/actions/{getAuthFlowsAction.js → auth/getAuthFlowsAction.js}

@@ -1,10 +1,10 @@
 'use server';
 
 
-import runSelectPageAction_default from "./runSelectPageAction.js";
+import runSelectPageAction_default from "../runSelectPageAction.js";
 import { AuthFlowSelectConstants, capPageSize, toAuthFlowSelectPage } from "@thunderid/node";
 
-//#region src/server/actions/getAuthFlowsAction.ts
+//#region src/server/actions/auth/getAuthFlowsAction.ts
 /**
 * Loads one page of authentication flows for an `AUTH_FLOW_SELECT` picker using the signed-in user's
 * server-held session.

package/dist/server/actions/auth/getAuthFlowsAction.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"getAuthFlowsAction.js","names":["runSelectPageAction"],"sources":["../../../../src/server/actions/auth/getAuthFlowsAction.ts"],"sourcesContent":["// Copyright 2026 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\n'use server';\n\nimport {AuthFlowSelectConstants, capPageSize, toAuthFlowSelectPage} from '@thunderid/node';\nimport runSelectPageAction, {SelectPageActionResult} from '../runSelectPageAction';\n\n/**\n * Request from the browser. Carries only paging; the session comes from the request cookie and the flow\n * type is fixed to authentication on the server.\n */\nexport interface GetAuthFlowsActionRequest {\n  limit?: number;\n  offset?: number;\n}\n\nexport type GetAuthFlowsActionResult = SelectPageActionResult;\n\n/**\n * Loads one page of authentication flows for an `AUTH_FLOW_SELECT` picker using the signed-in user's\n * server-held session.\n *\n * Never throws across the server action boundary; failures are mapped to a plain result.\n */\nconst getAuthFlowsAction = async ({limit, offset}: GetAuthFlowsActionRequest = {}): Promise<GetAuthFlowsActionResult> =>\n  runSelectPageAction('auth flows', {limit, offset}, async (client, sessionId, query) =>\n    toAuthFlowSelectPage(\n      await client.getFlows(\n        {flowType: AuthFlowSelectConstants.FLOW_TYPE, limit: capPageSize(query.limit), offset: query.offset},\n        sessionId,\n      ),\n      query.offset ?? 0,\n    ),\n  );\n\nexport default getAuthFlowsAction;\n"],"mappings":";;;;;;;;;;;;;AAyBA,MAAM,qBAAqB,OAAO,EAAC,OAAO,WAAqC,EAAE,KAC/EA,4BAAoB,cAAc;CAAC;CAAO;CAAO,EAAE,OAAO,QAAQ,WAAW,UAC3E,qBACE,MAAM,OAAO,SACX;CAAC,UAAU,wBAAwB;CAAW,OAAO,YAAY,MAAM,MAAM;CAAE,QAAQ,MAAM;CAAO,EACpG,UACD,EACD,MAAM,UAAU,EACjB,CACF;AAEH,iCAAe"}

package/dist/server/actions/auth/getFlowMetaAction.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"getFlowMetaAction.d.ts","sourceRoot":"","sources":["../../../../src/server/actions/auth/getFlowMetaAction.ts"],"names":[],"mappings":"AAKA,OAAO,EACL,oBAAoB,EAKrB,MAAM,iBAAiB,CAAC;AAKzB;;;;GAIG;AACH,MAAM,MAAM,uBAAuB,GAC/B;IAAC,IAAI,EAAE,oBAAoB,CAAC;IAAC,OAAO,EAAE,IAAI,CAAA;CAAC,GAC3C;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,KAAK,CAAA;CAAC,CAAC;AAE3D;;;;;;;;;;;GAWG;AACH,QAAA,MAAM,iBAAiB,GAAU,SAAS;IACxC,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,KAAG,OAAO,CAAC,uBAAuB,CAmClC,CAAC;AAEF,eAAe,iBAAiB,CAAC"}

package/dist/server/actions/{getFlowMetaAction.js → auth/getFlowMetaAction.js}

@@ -1,11 +1,11 @@
 'use server';
 
 
-import getClient_default from "../getClient.js";
-import logger_default from "../../utils/logger.js";
+import getClient_default from "../../getClient.js";
+import logger_default from "../../../utils/logger.js";
 import { FlowMetaType, ThunderIDAPIError, getFlowMeta, resolveResourceEndpoint } from "@thunderid/node";
 
-//#region src/server/actions/getFlowMetaAction.ts
+//#region src/server/actions/auth/getFlowMetaAction.ts
 /**
 * Server Action that fetches `GET /flow/meta` server-side.
 *

package/dist/server/actions/auth/getFlowMetaAction.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"getFlowMetaAction.js","names":["config: ThunderIDNextConfig","getClient","url: string | undefined","applicationId: string | undefined"],"sources":["../../../../src/server/actions/auth/getFlowMetaAction.ts"],"sourcesContent":["// Copyright 2026 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\n'use server';\n\nimport {\n  FlowMetadataResponse,\n  FlowMetaType,\n  getFlowMeta,\n  resolveResourceEndpoint,\n  ThunderIDAPIError,\n} from '@thunderid/node';\nimport {ThunderIDNextConfig} from '../../../models/config';\nimport logger from '../../../utils/logger';\nimport getClient from '../../getClient';\n\n/**\n * What {@link getFlowMetaAction} returns: the flow metadata, or a plain failure. It never throws, because a thrown\n * error reaches the browser as a generic 500 and loses its prototype chain crossing the server action boundary. A\n * failure carries a message built on the server and the status, never the text of the upstream reply.\n */\nexport type GetFlowMetaActionResult =\n  | {meta: FlowMetadataResponse; success: true}\n  | {message: string; statusCode?: number; success: false};\n\n/**\n * Server Action that fetches `GET /flow/meta` server-side.\n *\n * `FlowMetaProvider` (from `@thunderid/react`) otherwise fetches this endpoint directly from the\n * browser against `baseUrl`, which requires the ThunderID server to allow CORS for the app's\n * origin. Routing it through this action instead means the browser never talks to `baseUrl`\n * directly — the request happens server-to-server, same as `signInAction`/`signUpAction`.\n *\n * Never throws across the server action boundary; failures are mapped to a plain result.\n *\n * @param language - Optional language override, used by `FlowMetaProvider.switchLanguage()`.\n */\nconst getFlowMetaAction = async (params?: {\n  applicationId?: string;\n  language?: string;\n}): Promise<GetFlowMetaActionResult> => {\n  try {\n    const client = getClient();\n    const config: ThunderIDNextConfig = await client.getConfiguration();\n\n    const url: string | undefined = resolveResourceEndpoint('flowMeta', config);\n\n    if (!url && !config?.baseUrl) {\n      return {message: 'Failed to load flow metadata: no base URL is configured.', success: false};\n    }\n\n    const applicationId: string | undefined = params?.applicationId ?? config?.applicationId;\n\n    const meta: FlowMetadataResponse = await getFlowMeta({\n      baseUrl: config?.baseUrl,\n      url,\n      ...(applicationId ? {id: applicationId, type: FlowMetaType.App} : {}),\n      ...(params?.language ? {language: params.language} : {}),\n    });\n\n    return {meta, success: true};\n  } catch (error) {\n    const message = error instanceof Error ? error.message : String(error);\n    logger.error(`[getFlowMetaAction] Error fetching flow metadata: ${message}`);\n\n    if (error instanceof ThunderIDAPIError && error.statusCode !== undefined) {\n      return {\n        message: `Failed to load flow metadata (HTTP ${error.statusCode}).`,\n        statusCode: error.statusCode,\n        success: false,\n      };\n    }\n\n    return {message: 'Failed to load flow metadata.', success: false};\n  }\n};\n\nexport default getFlowMetaAction;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAqCA,MAAM,oBAAoB,OAAO,WAGO;AACtC,KAAI;EAEF,MAAMA,SAA8B,MADrBC,mBAAW,CACuB,kBAAkB;EAEnE,MAAMC,MAA0B,wBAAwB,YAAY,OAAO;AAE3E,MAAI,CAAC,OAAO,CAAC,QAAQ,QACnB,QAAO;GAAC,SAAS;GAA4D,SAAS;GAAM;EAG9F,MAAMC,gBAAoC,QAAQ,iBAAiB,QAAQ;AAS3E,SAAO;GAAC,MAP2B,MAAM,YAAY;IACnD,SAAS,QAAQ;IACjB;IACA,GAAI,gBAAgB;KAAC,IAAI;KAAe,MAAM,aAAa;KAAI,GAAG,EAAE;IACpE,GAAI,QAAQ,WAAW,EAAC,UAAU,OAAO,UAAS,GAAG,EAAE;IACxD,CAAC;GAEY,SAAS;GAAK;UACrB,OAAO;EACd,MAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM;AACtE,iBAAO,MAAM,qDAAqD,UAAU;AAE5E,MAAI,iBAAiB,qBAAqB,MAAM,eAAe,OAC7D,QAAO;GACL,SAAS,sCAAsC,MAAM,WAAW;GAChE,YAAY,MAAM;GAClB,SAAS;GACV;AAGH,SAAO;GAAC,SAAS;GAAiC,SAAS;GAAM;;;AAIrE,gCAAe"}

package/dist/server/actions/auth/handleOAuthCallbackAction.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"handleOAuthCallbackAction.d.ts","sourceRoot":"","sources":["../../../../src/server/actions/auth/handleOAuthCallbackAction.ts"],"names":[],"mappings":"AAeA;;;;;;;;GAQG;AACH,QAAA,MAAM,yBAAyB,GAC7B,MAAM,MAAM,EACZ,OAAO,MAAM,KACZ,OAAO,CAAC;IACT,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,OAAO,CAAC;CAClB,CAgIA,CAAC;AAEF,eAAe,yBAAyB,CAAC"}

package/dist/server/actions/{handleOAuthCallbackAction.js → auth/handleOAuthCallbackAction.js}

@@ -1,13 +1,13 @@
 'use server';
 
 
-import { setChunkedCookie } from "../../utils/chunkedCookie.js";
-import SessionManager_default from "../../utils/SessionManager.js";
-import getClient_default from "../getClient.js";
-import logger_default from "../../utils/logger.js";
+import { setChunkedCookie } from "../../../utils/chunkedCookie.js";
+import SessionManager_default from "../../../utils/SessionManager.js";
+import getClient_default from "../../getClient.js";
+import logger_default from "../../../utils/logger.js";
 import { cookies } from "next/headers";
 
-//#region src/server/actions/handleOAuthCallbackAction.ts
+//#region src/server/actions/auth/handleOAuthCallbackAction.ts
 /**
 * Server action to handle OAuth callback with authorization code.
 * This action processes the authorization code received from the OAuth provider

package/dist/server/actions/auth/handleOAuthCallbackAction.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"handleOAuthCallbackAction.js","names":["getClient","cookieStore: RequestCookies","sessionId: string | undefined","tempSessionToken: string | undefined","SessionManager","signInResult: Record<string, unknown>","config: ThunderIDNextConfig","idToken: IdToken","accessToken: string","refreshToken: string","userIdFromToken: string","scopes: string","organizationId: string | undefined","expiresIn: number","sessionCookieExpiryTime: number","sessionToken: string"],"sources":["../../../../src/server/actions/auth/handleOAuthCallbackAction.ts"],"sourcesContent":["// Copyright 2025 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\n'use server';\n\nimport {IdToken} from '@thunderid/node';\nimport {cookies} from 'next/headers';\nimport {ThunderIDNextConfig} from '../../../models/config';\nimport {setChunkedCookie} from '../../../utils/chunkedCookie';\nimport logger from '../../../utils/logger';\nimport SessionManager from '../../../utils/SessionManager';\nimport getClient from '../../getClient';\n\ntype RequestCookies = Awaited<ReturnType<typeof cookies>>;\n\n/**\n * Server action to handle OAuth callback with authorization code.\n * This action processes the authorization code received from the OAuth provider\n * and exchanges it for tokens to complete the authentication flow.\n *\n * @param code - Authorization code from OAuth provider\n * @param state - State parameter from OAuth provider for CSRF protection\n * @returns Promise that resolves with success status and optional error message\n */\nconst handleOAuthCallbackAction = async (\n  code: string,\n  state: string,\n): Promise<{\n  error?: string;\n  redirectUrl?: string;\n  success: boolean;\n}> => {\n  try {\n    if (!code || !state) {\n      return {\n        error: 'Missing required OAuth parameters: code and state are required',\n        success: false,\n      };\n    }\n\n    const thunderIDClient = getClient();\n\n    // A server action can run in a module context that no provider render has initialized, for\n    // example after the dev server recompiles, so initialize from the environment first.\n    if (!thunderIDClient.isInitialized) {\n      await thunderIDClient.initialize({} as ThunderIDNextConfig);\n    }\n\n    if (!thunderIDClient.isInitialized) {\n      return {\n        error: 'ThunderID client is not initialized',\n        success: false,\n      };\n    }\n\n    const cookieStore: RequestCookies = await cookies();\n    let sessionId: string | undefined;\n\n    const tempSessionToken: string | undefined = cookieStore.get(SessionManager.getTempSessionCookieName())?.value;\n\n    if (tempSessionToken) {\n      try {\n        const tempSession: {sessionId: string} = await SessionManager.verifyTempSession(tempSessionToken);\n        sessionId = tempSession.sessionId;\n      } catch {\n        logger.error(\n          '[handleOAuthCallbackAction] Invalid temporary session token, falling back to session ID from cookies.',\n        );\n      }\n    }\n\n    if (!sessionId) {\n      logger.error('[handleOAuthCallbackAction] No session ID found in cookies or temporary session token.');\n\n      return {\n        error: 'No session found. Please start the authentication flow again.',\n        success: false,\n      };\n    }\n\n    // Exchange the authorization code for tokens\n    const signInResult: Record<string, unknown> = await thunderIDClient.signIn(\n      {\n        code,\n        state,\n      } as any,\n      {},\n      sessionId,\n    );\n\n    const config: ThunderIDNextConfig = await thunderIDClient.getConfiguration();\n\n    if (signInResult) {\n      try {\n        const idToken: IdToken = await thunderIDClient.getDecodedIdToken(\n          sessionId,\n          (signInResult['id_token'] || signInResult['idToken']) as string,\n        );\n        const accessToken: string = (signInResult['accessToken'] || signInResult['access_token']) as string;\n        const refreshToken: string = (signInResult['refreshToken'] as string | undefined) ?? '';\n        const userIdFromToken: string = (idToken.sub || signInResult['sub'] || sessionId) as string;\n        const scopes: string = signInResult['scope'] as string;\n        const organizationId: string | undefined = (idToken['user_org'] || idToken['organization_id']) as\n          | string\n          | undefined;\n        const expiresIn: number = signInResult['expiresIn'] as number;\n        const sessionCookieExpiryTime: number = SessionManager.resolveSessionCookieExpiry(\n          config.sessionCookie?.expiryTime,\n        );\n\n        const sessionToken: string = await SessionManager.createSessionToken(\n          accessToken,\n          userIdFromToken,\n          sessionId,\n          scopes,\n          expiresIn,\n          refreshToken,\n          organizationId,\n          {sid: typeof idToken['sid'] === 'string' ? idToken['sid'] : undefined},\n        );\n\n        setChunkedCookie(\n          cookieStore,\n          SessionManager.getSessionCookieName(),\n          sessionToken,\n          SessionManager.getSessionCookieOptions(sessionCookieExpiryTime),\n        );\n\n        cookieStore.delete(SessionManager.getTempSessionCookieName());\n      } catch (error) {\n        logger.error(\n          `[handleOAuthCallbackAction] Failed to create JWT session, continuing with legacy session:\n          ${typeof error === 'string' ? error : JSON.stringify(error)}`,\n        );\n      }\n    }\n\n    const afterSignInUrl: string = config.afterSignInUrl || '/';\n\n    return {\n      redirectUrl: afterSignInUrl,\n      success: true,\n    };\n  } catch (error) {\n    let errorMessage = 'Authentication failed';\n\n    if (error instanceof Error) {\n      errorMessage = error.message;\n    } else if (error && typeof error === 'object' && 'message' in error) {\n      errorMessage = String((error as {message: unknown}).message);\n    } else if (typeof error === 'string') {\n      errorMessage = error;\n    }\n\n    return {\n      error: errorMessage,\n      success: false,\n    };\n  }\n};\n\nexport default handleOAuthCallbackAction;\n"],"mappings":";;;;;;;;;;;;;;;;;;;AAwBA,MAAM,4BAA4B,OAChC,MACA,UAKI;AACJ,KAAI;AACF,MAAI,CAAC,QAAQ,CAAC,MACZ,QAAO;GACL,OAAO;GACP,SAAS;GACV;EAGH,MAAM,kBAAkBA,mBAAW;AAInC,MAAI,CAAC,gBAAgB,cACnB,OAAM,gBAAgB,WAAW,EAAE,CAAwB;AAG7D,MAAI,CAAC,gBAAgB,cACnB,QAAO;GACL,OAAO;GACP,SAAS;GACV;EAGH,MAAMC,cAA8B,MAAM,SAAS;EACnD,IAAIC;EAEJ,MAAMC,mBAAuC,YAAY,IAAIC,uBAAe,0BAA0B,CAAC,EAAE;AAEzG,MAAI,iBACF,KAAI;AAEF,gBADyC,MAAMA,uBAAe,kBAAkB,iBAAiB,EACzE;UAClB;AACN,kBAAO,MACL,wGACD;;AAIL,MAAI,CAAC,WAAW;AACd,kBAAO,MAAM,yFAAyF;AAEtG,UAAO;IACL,OAAO;IACP,SAAS;IACV;;EAIH,MAAMC,eAAwC,MAAM,gBAAgB,OAClE;GACE;GACA;GACD,EACD,EAAE,EACF,UACD;EAED,MAAMC,SAA8B,MAAM,gBAAgB,kBAAkB;AAE5E,MAAI,aACF,KAAI;GACF,MAAMC,UAAmB,MAAM,gBAAgB,kBAC7C,WACC,aAAa,eAAe,aAAa,WAC3C;GACD,MAAMC,cAAuB,aAAa,kBAAkB,aAAa;GACzE,MAAMC,eAAwB,aAAa,mBAA0C;GACrF,MAAMC,kBAA2B,QAAQ,OAAO,aAAa,UAAU;GACvE,MAAMC,SAAiB,aAAa;GACpC,MAAMC,iBAAsC,QAAQ,eAAe,QAAQ;GAG3E,MAAMC,YAAoB,aAAa;GACvC,MAAMC,0BAAkCV,uBAAe,2BACrD,OAAO,eAAe,WACvB;GAED,MAAMW,eAAuB,MAAMX,uBAAe,mBAChD,aACA,iBACA,WACA,QACA,WACA,cACA,gBACA,EAAC,KAAK,OAAO,QAAQ,WAAW,WAAW,QAAQ,SAAS,QAAU,CACvE;AAED,oBACE,aACAA,uBAAe,sBAAsB,EACrC,cACAA,uBAAe,wBAAwB,wBAAwB,CAChE;AAED,eAAY,OAAOA,uBAAe,0BAA0B,CAAC;WACtD,OAAO;AACd,kBAAO,MACL;YACE,OAAO,UAAU,WAAW,QAAQ,KAAK,UAAU,MAAM,GAC5D;;AAML,SAAO;GACL,aAH6B,OAAO,kBAAkB;GAItD,SAAS;GACV;UACM,OAAO;EACd,IAAI,eAAe;AAEnB,MAAI,iBAAiB,MACnB,gBAAe,MAAM;WACZ,SAAS,OAAO,UAAU,YAAY,aAAa,MAC5D,gBAAe,OAAQ,MAA6B,QAAQ;WACnD,OAAO,UAAU,SAC1B,gBAAe;AAGjB,SAAO;GACL,OAAO;GACP,SAAS;GACV;;;AAIL,wCAAe"}

package/dist/server/actions/auth/signInAction.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"signInAction.d.ts","sourceRoot":"","sources":["../../../../src/server/actions/auth/signInAction.ts"],"names":[],"mappings":"AAKA,OAAO,EAGL,gCAAgC,EAGjC,MAAM,iBAAiB,CAAC;AAUzB;;;;;;;GAOG;AACH,QAAA,MAAM,YAAY,GAChB,UAAU,GAAG,EACb,UAAU,gCAAgC,KACzC,OAAO,CAAC;IACT,IAAI,CAAC,EACD;QACE,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,GACD,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC5B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,OAAO,CAAC;CAClB,CAkHA,CAAC;AAEF,eAAe,YAAY,CAAC"}

package/dist/server/actions/{signInAction.js → auth/signInAction.js}

@@ -1,14 +1,14 @@
 'use server';
 
 
-import { getChunkedCookie, setChunkedCookie } from "../../utils/chunkedCookie.js";
-import SessionManager_default from "../../utils/SessionManager.js";
-import getClient_default from "../getClient.js";
-import logger_default from "../../utils/logger.js";
+import { getChunkedCookie, setChunkedCookie } from "../../../utils/chunkedCookie.js";
+import SessionManager_default from "../../../utils/SessionManager.js";
+import getClient_default from "../../getClient.js";
+import logger_default from "../../../utils/logger.js";
 import { EmbeddedSignInFlowStatus, generateSessionId, isEmpty } from "@thunderid/node";
 import { cookies } from "next/headers";
 
-//#region src/server/actions/signInAction.ts
+//#region src/server/actions/auth/signInAction.ts
 /**
 * Server action for signing in a user.
 * Handles the embedded sign-in flow and manages session cookies.

package/dist/server/actions/auth/signInAction.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"signInAction.js","names":["getClient","cookieStore: RequestCookies","sessionId: string | undefined","existingSessionToken: string | undefined","SessionManager","tempSessionToken: string | undefined","tempSessionToken: string","defaultSignInUrl: string","response: any","idToken: IdToken","userIdFromToken: string","organizationId: string | undefined","scopes: string","iat: number","exp: number","expiresIn: number","config: ThunderIDNextConfig","sessionCookieExpiryTime: number","sessionToken: string","afterSignInUrl: string"],"sources":["../../../../src/server/actions/auth/signInAction.ts"],"sourcesContent":["// Copyright 2025 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\n'use server';\n\nimport {\n  generateSessionId,\n  EmbeddedSignInFlowStatus,\n  EmbeddedFlowExecuteRequestConfig,\n  IdToken,\n  isEmpty,\n} from '@thunderid/node';\nimport {cookies} from 'next/headers';\nimport {ThunderIDNextConfig} from '../../../models/config';\nimport {getChunkedCookie, setChunkedCookie} from '../../../utils/chunkedCookie';\nimport logger from '../../../utils/logger';\nimport SessionManager, {SessionTokenPayload} from '../../../utils/SessionManager';\nimport getClient from '../../getClient';\n\ntype RequestCookies = Awaited<ReturnType<typeof cookies>>;\n\n/**\n * Server action for signing in a user.\n * Handles the embedded sign-in flow and manages session cookies.\n *\n * @param payload - The embedded sign-in flow payload\n * @param request - The embedded flow execute request config\n * @returns Promise that resolves when sign-in is complete\n */\nconst signInAction = async (\n  payload?: any,\n  request?: EmbeddedFlowExecuteRequestConfig,\n): Promise<{\n  data?:\n    | {\n        afterSignInUrl?: string;\n        signInUrl?: string;\n      }\n    | Record<string, unknown>;\n  error?: string;\n  success: boolean;\n}> => {\n  try {\n    const client = getClient();\n    const cookieStore: RequestCookies = await cookies();\n\n    let sessionId: string | undefined;\n\n    const existingSessionToken: string | undefined = getChunkedCookie(\n      cookieStore,\n      SessionManager.getSessionCookieName(),\n    );\n\n    if (existingSessionToken) {\n      try {\n        const sessionPayload: SessionTokenPayload = await SessionManager.verifySessionToken(existingSessionToken);\n        sessionId = sessionPayload.sessionId;\n      } catch {\n        // Invalid session token, will create new temp session\n      }\n    }\n\n    if (!sessionId) {\n      const tempSessionToken: string | undefined = cookieStore.get(SessionManager.getTempSessionCookieName())?.value;\n\n      if (tempSessionToken) {\n        try {\n          const tempSession: {sessionId: string} = await SessionManager.verifyTempSession(tempSessionToken);\n          sessionId = tempSession.sessionId;\n        } catch {\n          // Invalid temp session, will create new one\n        }\n      }\n    }\n\n    if (!sessionId) {\n      sessionId = generateSessionId();\n\n      const tempSessionToken: string = await SessionManager.createTempSession(sessionId);\n\n      cookieStore.set(\n        SessionManager.getTempSessionCookieName(),\n        tempSessionToken,\n        SessionManager.getTempSessionCookieOptions(),\n      );\n    }\n\n    // If no payload provided, redirect to sign-in URL for redirect-based sign-in.\n    if (!payload || isEmpty(payload)) {\n      const defaultSignInUrl: string = await client.getAuthorizeRequestUrl({}, sessionId);\n      return {data: {signInUrl: String(defaultSignInUrl)}, success: true};\n    }\n\n    // Handle embedded sign-in flow\n    const response: any = await client.signIn(payload, request!, sessionId);\n\n    if (response.flowStatus === EmbeddedSignInFlowStatus.Complete) {\n      // On the V2 platform, a completed embedded flow (without a preceding `/authorize` redirect,\n      // i.e. no `authId`) returns a self-contained JWT `assertion` rather than an authorization\n      // code to exchange. This mirrors how @thunderid/react and @thunderid/vue treat it: the\n      // assertion is used directly as the bearer session token.\n      if (!response.assertion) {\n        throw new Error('[signInAction] Flow completed without an assertion.');\n      }\n\n      const idToken: IdToken = await client.getDecodedIdToken(sessionId, response.assertion);\n      const userIdFromToken: string = (idToken.sub as string | undefined) ?? sessionId;\n      const organizationId: string | undefined = (idToken['user_org'] || idToken['organization_id']) as\n        | string\n        | undefined;\n      const scopes: string = (idToken['scope'] as string | undefined) ?? '';\n      const iat: number = (idToken['iat'] as number | undefined) ?? Math.floor(Date.now() / 1000);\n      const exp: number = (idToken['exp'] as number | undefined) ?? iat + 3600;\n      const expiresIn: number = Math.max(exp - iat, 0);\n\n      const config: ThunderIDNextConfig = await client.getConfiguration();\n      const sessionCookieExpiryTime: number = SessionManager.resolveSessionCookieExpiry(\n        config.sessionCookie?.expiryTime,\n      );\n\n      const sessionToken: string = await SessionManager.createSessionToken(\n        response.assertion,\n        userIdFromToken,\n        sessionId,\n        scopes,\n        expiresIn,\n        '',\n        organizationId,\n        {sid: typeof idToken['sid'] === 'string' ? idToken['sid'] : undefined},\n      );\n\n      setChunkedCookie(\n        cookieStore,\n        SessionManager.getSessionCookieName(),\n        sessionToken,\n        SessionManager.getSessionCookieOptions(sessionCookieExpiryTime),\n      );\n\n      cookieStore.delete(SessionManager.getTempSessionCookieName());\n\n      const afterSignInUrl: string = await (await client.getStorageManager()).getConfigDataParameter('afterSignInUrl');\n      return {data: {afterSignInUrl: String(afterSignInUrl)}, success: true};\n    }\n\n    return {data: response as Record<string, unknown>, success: true};\n  } catch (error) {\n    const message =\n      error instanceof Error\n        ? error.message\n        : typeof (error as any)?.message === 'string'\n          ? (error as any).message\n          : String(error);\n    logger.error(`[signInAction] Error during sign-in: ${message}`);\n    return {error: message, success: false};\n  }\n};\n\nexport default signInAction;\n"],"mappings":";;;;;;;;;;;;;;;;;;;AA6BA,MAAM,eAAe,OACnB,SACA,YAUI;AACJ,KAAI;EACF,MAAM,SAASA,mBAAW;EAC1B,MAAMC,cAA8B,MAAM,SAAS;EAEnD,IAAIC;EAEJ,MAAMC,uBAA2C,iBAC/C,aACAC,uBAAe,sBAAsB,CACtC;AAED,MAAI,qBACF,KAAI;AAEF,gBAD4C,MAAMA,uBAAe,mBAAmB,qBAAqB,EAC9E;UACrB;AAKV,MAAI,CAAC,WAAW;GACd,MAAMC,mBAAuC,YAAY,IAAID,uBAAe,0BAA0B,CAAC,EAAE;AAEzG,OAAI,iBACF,KAAI;AAEF,iBADyC,MAAMA,uBAAe,kBAAkB,iBAAiB,EACzE;WAClB;;AAMZ,MAAI,CAAC,WAAW;AACd,eAAY,mBAAmB;GAE/B,MAAME,mBAA2B,MAAMF,uBAAe,kBAAkB,UAAU;AAElF,eAAY,IACVA,uBAAe,0BAA0B,EACzC,kBACAA,uBAAe,6BAA6B,CAC7C;;AAIH,MAAI,CAAC,WAAW,QAAQ,QAAQ,EAAE;GAChC,MAAMG,mBAA2B,MAAM,OAAO,uBAAuB,EAAE,EAAE,UAAU;AACnF,UAAO;IAAC,MAAM,EAAC,WAAW,OAAO,iBAAiB,EAAC;IAAE,SAAS;IAAK;;EAIrE,MAAMC,WAAgB,MAAM,OAAO,OAAO,SAAS,SAAU,UAAU;AAEvE,MAAI,SAAS,eAAe,yBAAyB,UAAU;AAK7D,OAAI,CAAC,SAAS,UACZ,OAAM,IAAI,MAAM,sDAAsD;GAGxE,MAAMC,UAAmB,MAAM,OAAO,kBAAkB,WAAW,SAAS,UAAU;GACtF,MAAMC,kBAA2B,QAAQ,OAA8B;GACvE,MAAMC,iBAAsC,QAAQ,eAAe,QAAQ;GAG3E,MAAMC,SAAkB,QAAQ,YAAmC;GACnE,MAAMC,MAAe,QAAQ,UAAiC,KAAK,MAAM,KAAK,KAAK,GAAG,IAAK;GAC3F,MAAMC,MAAe,QAAQ,UAAiC,MAAM;GACpE,MAAMC,YAAoB,KAAK,IAAI,MAAM,KAAK,EAAE;GAEhD,MAAMC,SAA8B,MAAM,OAAO,kBAAkB;GACnE,MAAMC,0BAAkCb,uBAAe,2BACrD,OAAO,eAAe,WACvB;GAED,MAAMc,eAAuB,MAAMd,uBAAe,mBAChD,SAAS,WACT,iBACA,WACA,QACA,WACA,IACA,gBACA,EAAC,KAAK,OAAO,QAAQ,WAAW,WAAW,QAAQ,SAAS,QAAU,CACvE;AAED,oBACE,aACAA,uBAAe,sBAAsB,EACrC,cACAA,uBAAe,wBAAwB,wBAAwB,CAChE;AAED,eAAY,OAAOA,uBAAe,0BAA0B,CAAC;GAE7D,MAAMe,iBAAyB,OAAO,MAAM,OAAO,mBAAmB,EAAE,uBAAuB,iBAAiB;AAChH,UAAO;IAAC,MAAM,EAAC,gBAAgB,OAAO,eAAe,EAAC;IAAE,SAAS;IAAK;;AAGxE,SAAO;GAAC,MAAM;GAAqC,SAAS;GAAK;UAC1D,OAAO;EACd,MAAM,UACJ,iBAAiB,QACb,MAAM,UACN,OAAQ,OAAe,YAAY,WAChC,MAAc,UACf,OAAO,MAAM;AACrB,iBAAO,MAAM,wCAAwC,UAAU;AAC/D,SAAO;GAAC,OAAO;GAAS,SAAS;GAAM;;;AAI3C,2BAAe"}

package/dist/server/actions/auth/signOutAction.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"signOutAction.d.ts","sourceRoot":"","sources":["../../../../src/server/actions/auth/signOutAction.ts"],"names":[],"mappings":"AAcA;;;;;GAKG;AACH,QAAA,MAAM,aAAa,QAAa,OAAO,CAAC;IAAC,IAAI,CAAC,EAAE;QAAC,eAAe,CAAC,EAAE,MAAM,CAAA;KAAC,CAAC;IAAC,KAAK,CAAC,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAC,CA8C7G,CAAC;AAEF,eAAe,aAAa,CAAC"}

package/dist/server/actions/{signOutAction.js → auth/signOutAction.js}

@@ -1,14 +1,14 @@
 'use server';
 
 
-import { deleteChunkedCookie } from "../../utils/chunkedCookie.js";
-import SessionManager_default from "../../utils/SessionManager.js";
-import getSessionId_default from "./getSessionId.js";
-import getClient_default from "../getClient.js";
-import logger_default from "../../utils/logger.js";
+import { deleteChunkedCookie } from "../../../utils/chunkedCookie.js";
+import SessionManager_default from "../../../utils/SessionManager.js";
+import getSessionId_default from "../getSessionId.js";
+import getClient_default from "../../getClient.js";
+import logger_default from "../../../utils/logger.js";
 import { cookies } from "next/headers";
 
-//#region src/server/actions/signOutAction.ts
+//#region src/server/actions/auth/signOutAction.ts
 /**
 * Server action for signing out a user.
 * Clears both JWT and legacy session cookies.

package/dist/server/actions/auth/signOutAction.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"signOutAction.js","names":["cookieStore: RequestCookies","SessionManager","getClient","sessionId: string | undefined","getSessionId","errorMessage: unknown"],"sources":["../../../../src/server/actions/auth/signOutAction.ts"],"sourcesContent":["// Copyright 2025 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\n'use server';\n\nimport {cookies} from 'next/headers';\nimport {deleteChunkedCookie} from '../../../utils/chunkedCookie';\nimport logger from '../../../utils/logger';\nimport SessionManager from '../../../utils/SessionManager';\nimport getClient from '../../getClient';\nimport getSessionId from '../getSessionId';\n\ntype RequestCookies = Awaited<ReturnType<typeof cookies>>;\n\n/**\n * Server action for signing out a user.\n * Clears both JWT and legacy session cookies.\n *\n * @returns Promise that resolves with success status and optional after sign-out URL\n */\nconst signOutAction = async (): Promise<{data?: {afterSignOutUrl?: string}; error?: unknown; success: boolean}> => {\n  logger.debug('[signOutAction] Initiating sign out process from the server action.');\n\n  const clearSessionCookies = async (): Promise<void> => {\n    const cookieStore: RequestCookies = await cookies();\n\n    deleteChunkedCookie(cookieStore, SessionManager.getSessionCookieName());\n    cookieStore.delete(SessionManager.getTempSessionCookieName());\n  };\n\n  try {\n    const client = getClient();\n    const sessionId: string | undefined = await getSessionId();\n\n    let afterSignOutUrl = '/';\n\n    if (sessionId) {\n      logger.debug('[signOutAction] Session ID found, invoking the `signOut` to obtain the `afterSignOutUrl`.');\n\n      afterSignOutUrl = await client.signOut({}, sessionId);\n    }\n\n    await clearSessionCookies();\n\n    return {data: {afterSignOutUrl}, success: true};\n  } catch (error) {\n    logger.error('[signOutAction] Error during sign out from the server action:', error);\n\n    logger.debug('[signOutAction] Clearing session cookies due to error as a fallback.');\n\n    await clearSessionCookies();\n\n    let errorMessage: unknown;\n    if (typeof error === 'string') {\n      errorMessage = error;\n    } else if (error instanceof Error) {\n      errorMessage = error.message;\n    } else {\n      errorMessage = JSON.stringify(error);\n    }\n\n    return {\n      error: errorMessage,\n      success: false,\n    };\n  }\n};\n\nexport default signOutAction;\n"],"mappings":";;;;;;;;;;;;;;;;;AAoBA,MAAM,gBAAgB,YAA6F;AACjH,gBAAO,MAAM,sEAAsE;CAEnF,MAAM,sBAAsB,YAA2B;EACrD,MAAMA,cAA8B,MAAM,SAAS;AAEnD,sBAAoB,aAAaC,uBAAe,sBAAsB,CAAC;AACvE,cAAY,OAAOA,uBAAe,0BAA0B,CAAC;;AAG/D,KAAI;EACF,MAAM,SAASC,mBAAW;EAC1B,MAAMC,YAAgC,MAAMC,sBAAc;EAE1D,IAAI,kBAAkB;AAEtB,MAAI,WAAW;AACb,kBAAO,MAAM,4FAA4F;AAEzG,qBAAkB,MAAM,OAAO,QAAQ,EAAE,EAAE,UAAU;;AAGvD,QAAM,qBAAqB;AAE3B,SAAO;GAAC,MAAM,EAAC,iBAAgB;GAAE,SAAS;GAAK;UACxC,OAAO;AACd,iBAAO,MAAM,iEAAiE,MAAM;AAEpF,iBAAO,MAAM,uEAAuE;AAEpF,QAAM,qBAAqB;EAE3B,IAAIC;AACJ,MAAI,OAAO,UAAU,SACnB,gBAAe;WACN,iBAAiB,MAC1B,gBAAe,MAAM;MAErB,gBAAe,KAAK,UAAU,MAAM;AAGtC,SAAO;GACL,OAAO;GACP,SAAS;GACV;;;AAIL,4BAAe"}

package/dist/server/actions/auth/signUpAction.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"signUpAction.d.ts","sourceRoot":"","sources":["../../../../src/server/actions/auth/signUpAction.ts"],"names":[],"mappings":"AAOA;;GAEG;AACH,QAAA,MAAM,YAAY,QAAa,OAAO,CAAC;IACrC,IAAI,CAAC,EAAE;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAC,CAAC;IAC5B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,OAAO,CAAC;CAClB,CAUA,CAAC;AAEF,eAAe,YAAY,CAAC"}

package/dist/server/actions/{signUpAction.js → auth/signUpAction.js}

@@ -1,9 +1,9 @@
 'use server';
 
 
-import getClient_default from "../getClient.js";
+import getClient_default from "../../getClient.js";
 
-//#region src/server/actions/signUpAction.ts
+//#region src/server/actions/auth/signUpAction.ts
 /**
 * Server action for initiating the sign-up redirect flow.
 */

package/dist/server/actions/auth/signUpAction.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"signUpAction.js","names":["getClient"],"sources":["../../../../src/server/actions/auth/signUpAction.ts"],"sourcesContent":["// Copyright 2025 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\n'use server';\n\nimport getClient from '../../getClient';\n\n/**\n * Server action for initiating the sign-up redirect flow.\n */\nconst signUpAction = async (): Promise<{\n  data?: {signUpUrl?: string};\n  error?: string;\n  success: boolean;\n}> => {\n  try {\n    const client = getClient();\n    const config = client.getConfiguration() as any;\n    const signUpUrl: string = config?.signUpUrl ?? '';\n\n    return {data: {signUpUrl}, success: true};\n  } catch (error) {\n    return {error: String(error), success: false};\n  }\n};\n\nexport default signUpAction;\n"],"mappings":";;;;;;;;;AAUA,MAAM,eAAe,YAIf;AACJ,KAAI;AAKF,SAAO;GAAC,MAAM,EAAC,WAJAA,mBAAW,CACJ,kBAAkB,EACN,aAAa,IAEtB;GAAE,SAAS;GAAK;UAClC,OAAO;AACd,SAAO;GAAC,OAAO,OAAO,MAAM;GAAE,SAAS;GAAM;;;AAIjD,2BAAe"}

package/dist/server/actions/management/getGrantedPermissionsAction.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Reads the permissions the signed-in user's access token grants, on the server, so only the list of
+ * permissions reaches the browser and the token itself never does. Use the result only to decide what
+ * to show; the server still checks every request.
+ *
+ * Never throws across the server action boundary: without a session or a readable token it returns
+ * an empty list.
+ */
+declare const getGrantedPermissionsAction: () => Promise<string[]>;
+export default getGrantedPermissionsAction;
+//# sourceMappingURL=getGrantedPermissionsAction.d.ts.map

package/dist/server/actions/management/getGrantedPermissionsAction.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"getGrantedPermissionsAction.d.ts","sourceRoot":"","sources":["../../../../src/server/actions/management/getGrantedPermissionsAction.ts"],"names":[],"mappings":"AASA;;;;;;;GAOG;AACH,QAAA,MAAM,2BAA2B,QAAa,OAAO,CAAC,MAAM,EAAE,CAY7D,CAAC;AAEF,eAAe,2BAA2B,CAAC"}

package/dist/server/actions/management/getGrantedPermissionsAction.js

@@ -0,0 +1,30 @@
+'use server';
+
+
+import getSessionId_default from "../getSessionId.js";
+import getClient_default from "../../getClient.js";
+import { getTokenPermissions } from "@thunderid/node";
+
+//#region src/server/actions/management/getGrantedPermissionsAction.ts
+/**
+* Reads the permissions the signed-in user's access token grants, on the server, so only the list of
+* permissions reaches the browser and the token itself never does. Use the result only to decide what
+* to show; the server still checks every request.
+*
+* Never throws across the server action boundary: without a session or a readable token it returns
+* an empty list.
+*/
+const getGrantedPermissionsAction = async () => {
+	const sessionId = await getSessionId_default();
+	if (!sessionId) return [];
+	try {
+		return getTokenPermissions(await getClient_default().getAccessToken(sessionId));
+	} catch {
+		return [];
+	}
+};
+var getGrantedPermissionsAction_default = getGrantedPermissionsAction;
+
+//#endregion
+export { getGrantedPermissionsAction_default as default };
+//# sourceMappingURL=getGrantedPermissionsAction.js.map

package/dist/server/actions/management/getGrantedPermissionsAction.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"getGrantedPermissionsAction.js","names":["sessionId: string | undefined","getSessionId","getClient"],"sources":["../../../../src/server/actions/management/getGrantedPermissionsAction.ts"],"sourcesContent":["// Copyright 2026 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\n'use server';\n\nimport {getTokenPermissions} from '@thunderid/node';\nimport getClient from '../../getClient';\nimport getSessionId from '../getSessionId';\n\n/**\n * Reads the permissions the signed-in user's access token grants, on the server, so only the list of\n * permissions reaches the browser and the token itself never does. Use the result only to decide what\n * to show; the server still checks every request.\n *\n * Never throws across the server action boundary: without a session or a readable token it returns\n * an empty list.\n */\nconst getGrantedPermissionsAction = async (): Promise<string[]> => {\n  const sessionId: string | undefined = await getSessionId();\n\n  if (!sessionId) {\n    return [];\n  }\n\n  try {\n    return getTokenPermissions(await getClient().getAccessToken(sessionId));\n  } catch {\n    return [];\n  }\n};\n\nexport default getGrantedPermissionsAction;\n"],"mappings":";;;;;;;;;;;;;;;;AAiBA,MAAM,8BAA8B,YAA+B;CACjE,MAAMA,YAAgC,MAAMC,sBAAc;AAE1D,KAAI,CAAC,UACH,QAAO,EAAE;AAGX,KAAI;AACF,SAAO,oBAAoB,MAAMC,mBAAW,CAAC,eAAe,UAAU,CAAC;SACjE;AACN,SAAO,EAAE;;;AAIb,0CAAe"}

package/dist/server/actions/{getUserTypesAction.d.ts → management/getUserTypesAction.d.ts}

@@ -1,4 +1,4 @@
-import { SelectPageActionResult } from './runSelectPageAction';
+import { SelectPageActionResult } from '../runSelectPageAction';
 /**
  * Request from the browser. Carries only paging; the session comes from the request cookie.
  */

package/dist/server/actions/management/getUserTypesAction.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"getUserTypesAction.d.ts","sourceRoot":"","sources":["../../../../src/server/actions/management/getUserTypesAction.ts"],"names":[],"mappings":"AAMA,OAA4B,EAAC,sBAAsB,EAAC,MAAM,wBAAwB,CAAC;AAEnF;;GAEG;AACH,MAAM,WAAW,yBAAyB;IACxC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,MAAM,wBAAwB,GAAG,sBAAsB,CAAC;AAE9D;;;;;GAKG;AACH,QAAA,MAAM,kBAAkB,GAAU,oBAAiB,yBAA8B,KAAG,OAAO,CAAC,wBAAwB,CAMjH,CAAC;AAEJ,eAAe,kBAAkB,CAAC"}

package/dist/server/actions/{getUserTypesAction.js → management/getUserTypesAction.js}

@@ -1,10 +1,10 @@
 'use server';
 
 
-import runSelectPageAction_default from "./runSelectPageAction.js";
+import runSelectPageAction_default from "../runSelectPageAction.js";
 import { capPageSize, toUserTypeSelectPage } from "@thunderid/node";
 
-//#region src/server/actions/getUserTypesAction.ts
+//#region src/server/actions/management/getUserTypesAction.ts
 /**
 * Loads one page of user types for a `USER_TYPE_SELECT` picker using the signed-in user's server-held
 * session.

package/dist/server/actions/management/getUserTypesAction.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"getUserTypesAction.js","names":["runSelectPageAction"],"sources":["../../../../src/server/actions/management/getUserTypesAction.ts"],"sourcesContent":["// Copyright 2026 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\n'use server';\n\nimport {capPageSize, toUserTypeSelectPage} from '@thunderid/node';\nimport runSelectPageAction, {SelectPageActionResult} from '../runSelectPageAction';\n\n/**\n * Request from the browser. Carries only paging; the session comes from the request cookie.\n */\nexport interface GetUserTypesActionRequest {\n  limit?: number;\n  offset?: number;\n}\n\nexport type GetUserTypesActionResult = SelectPageActionResult;\n\n/**\n * Loads one page of user types for a `USER_TYPE_SELECT` picker using the signed-in user's server-held\n * session.\n *\n * Never throws across the server action boundary; failures are mapped to a plain result.\n */\nconst getUserTypesAction = async ({limit, offset}: GetUserTypesActionRequest = {}): Promise<GetUserTypesActionResult> =>\n  runSelectPageAction('user types', {limit, offset}, async (client, sessionId, query) =>\n    toUserTypeSelectPage(\n      await client.getUserTypes({limit: capPageSize(query.limit), offset: query.offset}, sessionId),\n      query.offset ?? 0,\n    ),\n  );\n\nexport default getUserTypesAction;\n"],"mappings":";;;;;;;;;;;;;AAwBA,MAAM,qBAAqB,OAAO,EAAC,OAAO,WAAqC,EAAE,KAC/EA,4BAAoB,cAAc;CAAC;CAAO;CAAO,EAAE,OAAO,QAAQ,WAAW,UAC3E,qBACE,MAAM,OAAO,aAAa;CAAC,OAAO,YAAY,MAAM,MAAM;CAAE,QAAQ,MAAM;CAAO,EAAE,UAAU,EAC7F,MAAM,UAAU,EACjB,CACF;AAEH,iCAAe"}

package/dist/server/actions/{getUsersAction.d.ts → management/getUsersAction.d.ts}

@@ -1,4 +1,4 @@
-import { SelectPageActionResult } from './runSelectPageAction';
+import { SelectPageActionResult } from '../runSelectPageAction';
 /**
  * Request from the browser. Carries no session ID, token, or URL; the session comes from the request cookie.
  */

package/dist/server/actions/management/getUsersAction.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"getUsersAction.d.ts","sourceRoot":"","sources":["../../../../src/server/actions/management/getUsersAction.ts"],"names":[],"mappings":"AAMA,OAA4B,EAAC,sBAAsB,EAAC,MAAM,wBAAwB,CAAC;AAEnF;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,MAAM,oBAAoB,GAAG,sBAAsB,CAAC;AAE1D;;;;GAIG;AACH,QAAA,MAAM,cAAc,GAAU,4BAAyB,qBAA0B,KAAG,OAAO,CAAC,oBAAoB,CAU7G,CAAC;AAEJ,eAAe,cAAc,CAAC"}

package/dist/server/actions/{getUsersAction.js → management/getUsersAction.js}

@@ -1,10 +1,10 @@
 'use server';
 
 
-import runSelectPageAction_default from "./runSelectPageAction.js";
+import runSelectPageAction_default from "../runSelectPageAction.js";
 import { toUserSelectPage } from "@thunderid/node";
 
-//#region src/server/actions/getUsersAction.ts
+//#region src/server/actions/management/getUsersAction.ts
 /**
 * Loads one page of users for a `USER_SELECT` picker using the signed-in user's server-held session.
 *

package/dist/server/actions/management/getUsersAction.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"getUsersAction.js","names":["runSelectPageAction"],"sources":["../../../../src/server/actions/management/getUsersAction.ts"],"sourcesContent":["// Copyright 2026 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\n'use server';\n\nimport {toUserSelectPage} from '@thunderid/node';\nimport runSelectPageAction, {SelectPageActionResult} from '../runSelectPageAction';\n\n/**\n * Request from the browser. Carries no session ID, token, or URL; the session comes from the request cookie.\n */\nexport interface GetUsersActionRequest {\n  filter?: string;\n  limit?: number;\n  offset?: number;\n}\n\nexport type GetUsersActionResult = SelectPageActionResult;\n\n/**\n * Loads one page of users for a `USER_SELECT` picker using the signed-in user's server-held session.\n *\n * Never throws across the server action boundary; failures are mapped to a plain result.\n */\nconst getUsersAction = async ({filter, limit, offset}: GetUsersActionRequest = {}): Promise<GetUsersActionResult> =>\n  runSelectPageAction(\n    'users',\n    {filter, limit, offset},\n    async (client, sessionId, query) =>\n      toUserSelectPage(\n        await client.getUsers({filter: query.filter, limit: query.limit, offset: query.offset}, sessionId),\n        query.offset ?? 0,\n      ),\n    {allowFilter: true},\n  );\n\nexport default getUsersAction;\n"],"mappings":";;;;;;;;;;;;AAwBA,MAAM,iBAAiB,OAAO,EAAC,QAAQ,OAAO,WAAiC,EAAE,KAC/EA,4BACE,SACA;CAAC;CAAQ;CAAO;CAAO,EACvB,OAAO,QAAQ,WAAW,UACxB,iBACE,MAAM,OAAO,SAAS;CAAC,QAAQ,MAAM;CAAQ,OAAO,MAAM;CAAO,QAAQ,MAAM;CAAO,EAAE,UAAU,EAClG,MAAM,UAAU,EACjB,EACH,EAAC,aAAa,MAAK,CACpB;AAEH,6BAAe"}

package/dist/server/actions/management/managementRequestAction.d.ts

@@ -0,0 +1,36 @@
+/**
+ * Request from the browser: one management API request as the core API function built it. It carries
+ * no token or session; the session comes from the request cookie, and the URL must address one of
+ * the configured management collections.
+ */
+export interface ManagementRequestActionRequest {
+    /**
+     * JSON request body, already serialized.
+     */
+    body?: string;
+    method?: string;
+    url: string;
+}
+/**
+ * The upstream reply, as plain data that can cross the server action boundary. A failure carries a
+ * message built on the server and the status, never the text of the upstream reply.
+ */
+export interface ManagementRequestActionResult {
+    body: string;
+    status: number;
+    statusText: string;
+}
+/**
+ * Performs one management API request with the signed-in user's server-held session, so the access
+ * token never reaches the browser. Used as the `http.fetcher` of the admin components and hooks.
+ *
+ * A server action is a public endpoint, so everything the caller sends is checked here rather than
+ * trusted from its TypeScript type: the method must be one the management API uses, the body must be
+ * a bounded string, and the URL must address a configured management collection on the configured
+ * host, so the bearer token is only ever sent where the SDK would have sent it.
+ *
+ * Never throws across the server action boundary; failures are mapped to a plain result.
+ */
+declare const managementRequestAction: (request: ManagementRequestActionRequest) => Promise<ManagementRequestActionResult>;
+export default managementRequestAction;
+//# sourceMappingURL=managementRequestAction.d.ts.map

package/dist/server/actions/management/managementRequestAction.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"managementRequestAction.d.ts","sourceRoot":"","sources":["../../../../src/server/actions/management/managementRequestAction.ts"],"names":[],"mappings":"AAUA;;;;GAIG;AACH,MAAM,WAAW,8BAA8B;IAC7C;;OAEG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,MAAM,CAAC;CACb;AAED;;;GAGG;AACH,MAAM,WAAW,6BAA6B;IAC5C,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;CACpB;AAaD;;;;;;;;;;GAUG;AACH,QAAA,MAAM,uBAAuB,GAC3B,SAAS,8BAA8B,KACtC,OAAO,CAAC,6BAA6B,CAiEvC,CAAC;AAEF,eAAe,uBAAuB,CAAC"}

package/dist/server/actions/management/managementRequestAction.js

@@ -0,0 +1,77 @@
+'use server';
+
+
+import getSessionId_default from "../getSessionId.js";
+import getClient_default from "../../getClient.js";
+import { getManagementCollectionUrls, matchManagementUrl } from "@thunderid/node";
+
+//#region src/server/actions/management/managementRequestAction.ts
+const ALLOWED_METHODS = [
+	"DELETE",
+	"GET",
+	"POST",
+	"PUT"
+];
+/** Large enough for any management payload, small enough that the action cannot be used to stream data. */
+const MAX_BODY_LENGTH = 1024 * 1024;
+const failure = (status) => ({
+	body: `Management request failed (HTTP ${status}).`,
+	status,
+	statusText: ""
+});
+/**
+* Performs one management API request with the signed-in user's server-held session, so the access
+* token never reaches the browser. Used as the `http.fetcher` of the admin components and hooks.
+*
+* A server action is a public endpoint, so everything the caller sends is checked here rather than
+* trusted from its TypeScript type: the method must be one the management API uses, the body must be
+* a bounded string, and the URL must address a configured management collection on the configured
+* host, so the bearer token is only ever sent where the SDK would have sent it.
+*
+* Never throws across the server action boundary; failures are mapped to a plain result.
+*/
+const managementRequestAction = async (request) => {
+	const { body, method: rawMethod, url: rawUrl } = request ?? {};
+	const method = typeof rawMethod === "string" ? rawMethod.toUpperCase() : "GET";
+	if (!ALLOWED_METHODS.includes(method) || body !== void 0 && (typeof body !== "string" || body.length > MAX_BODY_LENGTH)) return failure(400);
+	const sessionId = await getSessionId_default();
+	if (!sessionId) return failure(401);
+	try {
+		const client = getClient_default();
+		if (!client.isInitialized) await client.initialize({});
+		const url = matchManagementUrl(rawUrl, getManagementCollectionUrls(await Promise.resolve(client.getConfiguration())));
+		if (!url) return failure(400);
+		let accessToken;
+		try {
+			accessToken = await client.getAccessToken(sessionId);
+		} catch {
+			return failure(401);
+		}
+		const response = await fetch(url.toString(), {
+			headers: {
+				Accept: "application/json",
+				Authorization: `Bearer ${accessToken}`,
+				...body !== void 0 ? { "Content-Type": "application/json" } : {}
+			},
+			method,
+			redirect: "error",
+			...body !== void 0 ? { body } : {}
+		});
+		if (!response.ok) return {
+			...failure(response.status),
+			statusText: response.statusText ?? ""
+		};
+		return {
+			body: await response.text(),
+			status: response.status,
+			statusText: response.statusText ?? ""
+		};
+	} catch {
+		return failure(502);
+	}
+};
+var managementRequestAction_default = managementRequestAction;
+
+//#endregion
+export { managementRequestAction_default as default };
+//# sourceMappingURL=managementRequestAction.js.map

package/dist/server/actions/management/managementRequestAction.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"managementRequestAction.js","names":["ALLOWED_METHODS: readonly string[]","MAX_BODY_LENGTH: number","method: string","sessionId: string | undefined","getSessionId","getClient","url: URL | undefined","accessToken: string","response: Response"],"sources":["../../../../src/server/actions/management/managementRequestAction.ts"],"sourcesContent":["// Copyright 2026 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\n'use server';\n\nimport {getManagementCollectionUrls, matchManagementUrl} from '@thunderid/node';\nimport {ThunderIDNextConfig} from '../../../models/config';\nimport getClient from '../../getClient';\nimport getSessionId from '../getSessionId';\n\n/**\n * Request from the browser: one management API request as the core API function built it. It carries\n * no token or session; the session comes from the request cookie, and the URL must address one of\n * the configured management collections.\n */\nexport interface ManagementRequestActionRequest {\n  /**\n   * JSON request body, already serialized.\n   */\n  body?: string;\n  method?: string;\n  url: string;\n}\n\n/**\n * The upstream reply, as plain data that can cross the server action boundary. A failure carries a\n * message built on the server and the status, never the text of the upstream reply.\n */\nexport interface ManagementRequestActionResult {\n  body: string;\n  status: number;\n  statusText: string;\n}\n\nconst ALLOWED_METHODS: readonly string[] = ['DELETE', 'GET', 'POST', 'PUT'];\n\n/** Large enough for any management payload, small enough that the action cannot be used to stream data. */\nconst MAX_BODY_LENGTH: number = 1024 * 1024;\n\nconst failure = (status: number): ManagementRequestActionResult => ({\n  body: `Management request failed (HTTP ${status}).`,\n  status,\n  statusText: '',\n});\n\n/**\n * Performs one management API request with the signed-in user's server-held session, so the access\n * token never reaches the browser. Used as the `http.fetcher` of the admin components and hooks.\n *\n * A server action is a public endpoint, so everything the caller sends is checked here rather than\n * trusted from its TypeScript type: the method must be one the management API uses, the body must be\n * a bounded string, and the URL must address a configured management collection on the configured\n * host, so the bearer token is only ever sent where the SDK would have sent it.\n *\n * Never throws across the server action boundary; failures are mapped to a plain result.\n */\nconst managementRequestAction = async (\n  request: ManagementRequestActionRequest,\n): Promise<ManagementRequestActionResult> => {\n  const {\n    body,\n    method: rawMethod,\n    url: rawUrl,\n  } = (request ?? {}) as Partial<Record<keyof ManagementRequestActionRequest, unknown>>;\n  const method: string = typeof rawMethod === 'string' ? rawMethod.toUpperCase() : 'GET';\n\n  if (\n    !ALLOWED_METHODS.includes(method) ||\n    (body !== undefined && (typeof body !== 'string' || body.length > MAX_BODY_LENGTH))\n  ) {\n    return failure(400);\n  }\n\n  const sessionId: string | undefined = await getSessionId();\n\n  if (!sessionId) {\n    return failure(401);\n  }\n\n  try {\n    const client = getClient();\n\n    if (!client.isInitialized) {\n      await client.initialize({} as ThunderIDNextConfig);\n    }\n\n    // The storage manager may hand the configuration back as a promise.\n    const config: ThunderIDNextConfig = await Promise.resolve(client.getConfiguration());\n    const url: URL | undefined = matchManagementUrl(rawUrl, getManagementCollectionUrls(config));\n\n    if (!url) {\n      return failure(400);\n    }\n\n    let accessToken: string;\n\n    try {\n      accessToken = await client.getAccessToken(sessionId);\n    } catch {\n      return failure(401);\n    }\n\n    const response: Response = await fetch(url.toString(), {\n      headers: {\n        Accept: 'application/json',\n        Authorization: `Bearer ${accessToken}`,\n        ...(body !== undefined ? {'Content-Type': 'application/json'} : {}),\n      },\n      method,\n      // A redirect could carry the request to a host the URL check never saw.\n      redirect: 'error',\n      ...(body !== undefined ? {body} : {}),\n    });\n\n    if (!response.ok) {\n      return {...failure(response.status), statusText: response.statusText ?? ''};\n    }\n\n    return {body: await response.text(), status: response.status, statusText: response.statusText ?? ''};\n  } catch {\n    // Not logged: a management operation reports failure to its caller and leaves logging to the application.\n    return failure(502);\n  }\n};\n\nexport default managementRequestAction;\n"],"mappings":";;;;;;;;AAkCA,MAAMA,kBAAqC;CAAC;CAAU;CAAO;CAAQ;CAAM;;AAG3E,MAAMC,kBAA0B,OAAO;AAEvC,MAAM,WAAW,YAAmD;CAClE,MAAM,mCAAmC,OAAO;CAChD;CACA,YAAY;CACb;;;;;;;;;;;;AAaD,MAAM,0BAA0B,OAC9B,YAC2C;CAC3C,MAAM,EACJ,MACA,QAAQ,WACR,KAAK,WACF,WAAW,EAAE;CAClB,MAAMC,SAAiB,OAAO,cAAc,WAAW,UAAU,aAAa,GAAG;AAEjF,KACE,CAAC,gBAAgB,SAAS,OAAO,IAChC,SAAS,WAAc,OAAO,SAAS,YAAY,KAAK,SAAS,iBAElE,QAAO,QAAQ,IAAI;CAGrB,MAAMC,YAAgC,MAAMC,sBAAc;AAE1D,KAAI,CAAC,UACH,QAAO,QAAQ,IAAI;AAGrB,KAAI;EACF,MAAM,SAASC,mBAAW;AAE1B,MAAI,CAAC,OAAO,cACV,OAAM,OAAO,WAAW,EAAE,CAAwB;EAKpD,MAAMC,MAAuB,mBAAmB,QAAQ,4BADpB,MAAM,QAAQ,QAAQ,OAAO,kBAAkB,CAAC,CACO,CAAC;AAE5F,MAAI,CAAC,IACH,QAAO,QAAQ,IAAI;EAGrB,IAAIC;AAEJ,MAAI;AACF,iBAAc,MAAM,OAAO,eAAe,UAAU;UAC9C;AACN,UAAO,QAAQ,IAAI;;EAGrB,MAAMC,WAAqB,MAAM,MAAM,IAAI,UAAU,EAAE;GACrD,SAAS;IACP,QAAQ;IACR,eAAe,UAAU;IACzB,GAAI,SAAS,SAAY,EAAC,gBAAgB,oBAAmB,GAAG,EAAE;IACnE;GACD;GAEA,UAAU;GACV,GAAI,SAAS,SAAY,EAAC,MAAK,GAAG,EAAE;GACrC,CAAC;AAEF,MAAI,CAAC,SAAS,GACZ,QAAO;GAAC,GAAG,QAAQ,SAAS,OAAO;GAAE,YAAY,SAAS,cAAc;GAAG;AAG7E,SAAO;GAAC,MAAM,MAAM,SAAS,MAAM;GAAE,QAAQ,SAAS;GAAQ,YAAY,SAAS,cAAc;GAAG;SAC9F;AAEN,SAAO,QAAQ,IAAI;;;AAIvB,sCAAe"}

package/dist/utils/managementCollections.d.ts

@@ -0,0 +1,8 @@
+import type { ManagementCollectionKey } from '@thunderid/node';
+import type { ThunderIDNextConfig } from '../models/config';
+/**
+ * Picks the management collection overrides out of `config.endpoints`, so the browser builds the
+ * same URLs the server will accept, without receiving the other endpoint overrides.
+ */
+export declare const pickManagementEndpoints: (endpoints: ThunderIDNextConfig["endpoints"] | undefined) => Partial<Record<ManagementCollectionKey, string>> | undefined;
+//# sourceMappingURL=managementCollections.d.ts.map

package/dist/utils/managementCollections.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"managementCollections.d.ts","sourceRoot":"","sources":["../../src/utils/managementCollections.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAC,uBAAuB,EAAC,MAAM,iBAAiB,CAAC;AAC7D,OAAO,KAAK,EAAC,mBAAmB,EAAC,MAAM,kBAAkB,CAAC;AAE1D;;;GAGG;AACH,eAAO,MAAM,uBAAuB,GAClC,WAAW,mBAAmB,CAAC,WAAW,CAAC,GAAG,SAAS,KACtD,OAAO,CAAC,MAAM,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAC,GAAG,SAgBrD,CAAC"}

package/dist/utils/managementCollections.js

@@ -0,0 +1,20 @@
+import { MANAGEMENT_COLLECTION_KEYS } from "@thunderid/node";
+
+//#region src/utils/managementCollections.ts
+/**
+* Picks the management collection overrides out of `config.endpoints`, so the browser builds the
+* same URLs the server will accept, without receiving the other endpoint overrides.
+*/
+const pickManagementEndpoints = (endpoints) => {
+	if (!endpoints) return;
+	const picked = {};
+	MANAGEMENT_COLLECTION_KEYS.forEach((key) => {
+		const value = endpoints[key];
+		if (typeof value === "string" && value) picked[key] = value;
+	});
+	return Object.keys(picked).length > 0 ? picked : void 0;
+};
+
+//#endregion
+export { pickManagementEndpoints };
+//# sourceMappingURL=managementCollections.js.map

package/dist/utils/managementCollections.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"managementCollections.js","names":["picked: Partial<Record<ManagementCollectionKey, string>>","value: unknown"],"sources":["../../src/utils/managementCollections.ts"],"sourcesContent":["// Copyright 2026 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\nimport {MANAGEMENT_COLLECTION_KEYS} from '@thunderid/node';\nimport type {ManagementCollectionKey} from '@thunderid/node';\nimport type {ThunderIDNextConfig} from '../models/config';\n\n/**\n * Picks the management collection overrides out of `config.endpoints`, so the browser builds the\n * same URLs the server will accept, without receiving the other endpoint overrides.\n */\nexport const pickManagementEndpoints = (\n  endpoints: ThunderIDNextConfig['endpoints'] | undefined,\n): Partial<Record<ManagementCollectionKey, string>> | undefined => {\n  if (!endpoints) {\n    return undefined;\n  }\n\n  const picked: Partial<Record<ManagementCollectionKey, string>> = {};\n\n  MANAGEMENT_COLLECTION_KEYS.forEach((key: ManagementCollectionKey) => {\n    const value: unknown = (endpoints as Record<string, unknown>)[key];\n\n    if (typeof value === 'string' && value) {\n      picked[key] = value;\n    }\n  });\n\n  return Object.keys(picked).length > 0 ? picked : undefined;\n};\n"],"mappings":";;;;;;;AAWA,MAAa,2BACX,cACiE;AACjE,KAAI,CAAC,UACH;CAGF,MAAMA,SAA2D,EAAE;AAEnE,4BAA2B,SAAS,QAAiC;EACnE,MAAMC,QAAkB,UAAsC;AAE9D,MAAI,OAAO,UAAU,YAAY,MAC/B,QAAO,OAAO;GAEhB;AAEF,QAAO,OAAO,KAAK,OAAO,CAAC,SAAS,IAAI,SAAS"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@thunderid/nextjs",
-  "version": "1.3.1",
+  "version": "1.5.0",
   "description": "Next.js SDK for ThunderID",
   "keywords": [
     "thunderid",
@@ -37,8 +37,8 @@
     "directory": "packages/nextjs"
   },
   "dependencies": {
-    "@thunderid/node": "^1.3.1",
-    "@thunderid/react": "^1.4.1",
+    "@thunderid/node": "^1.5.0",
+    "@thunderid/react": "^1.6.0",
     "@types/react": "19.2.14",
     "jose": "6.2.3",
     "tslib": "2.8.1"

package/dist/cjs/client/components/actions/SignInButton/SignInButton.cjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"SignInButton.cjs","names":["SignInButton: ForwardRefExoticComponent<SignInButtonProps & RefAttributes<HTMLButtonElement>>","useThunderID","router: AppRouterInstance","ThunderIDRuntimeError","BaseSignInButton"],"sources":["../../../../../../src/client/components/actions/SignInButton/SignInButton.tsx"],"sourcesContent":["// Copyright 2025 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\n'use client';\n\nimport {ThunderIDRuntimeError} from '@thunderid/node';\nimport {BaseSignInButton, BaseSignInButtonProps, useTranslation} from '@thunderid/react';\nimport {AppRouterInstance} from 'next/dist/shared/lib/app-router-context.shared-runtime';\nimport {useRouter} from 'next/navigation';\nimport {forwardRef, ForwardRefExoticComponent, ReactElement, Ref, RefAttributes, MouseEvent, useState} from 'react';\nimport useThunderID from '../../../contexts/ThunderID/useThunderID';\n\n/**\n * Props interface of {@link SignInButton}\n */\nexport type SignInButtonProps = BaseSignInButtonProps & {\n  /**\n   * Additional parameters to pass to the `authorize` request.\n   */\n  signInOptions?: Record<string, any>;\n};\n\n/**\n * SignInButton component that uses server actions for authentication in Next.js.\n *\n * @example Using render props\n * ```tsx\n * <SignInButton>\n *   {({isLoading}) => (\n *     <button type=\"submit\" disabled={isLoading}>\n *       {isLoading ? 'Signing in...' : 'Sign In'}\n *     </button>\n *   )}\n * </SignInButton>\n * ```\n *\n * @example Using traditional props\n * ```tsx\n * <SignInButton className=\"custom-button\">Sign In</SignInButton>\n * ```\n *\n * @remarks\n * In Next.js with server actions, the sign-in is handled via the server action.\n * When using render props, the custom button should use `type=\"submit\"` instead of `onClick={signIn}`.\n * The `signIn` function in render props is provided for API consistency but should not be used directly.\n */\nconst SignInButton: ForwardRefExoticComponent<SignInButtonProps & RefAttributes<HTMLButtonElement>> = forwardRef<\n  HTMLButtonElement,\n  SignInButtonProps\n>(\n  (\n    {className, style, children, preferences, onClick, signInOptions = {}, ...rest}: SignInButtonProps,\n    ref: Ref<HTMLButtonElement>,\n  ): ReactElement => {\n    const {signIn, signInUrl} = useThunderID();\n    const router: AppRouterInstance = useRouter();\n    const {t} = useTranslation(preferences?.i18n);\n\n    const [isLoading, setIsLoading] = useState(false);\n\n    const handleSignIn = async (): Promise<void> => {\n      try {\n        setIsLoading(true);\n\n        // If a custom `signInUrl` is provided, use it for navigation.\n        if (signInUrl) {\n          router.push(signInUrl);\n        } else if (signIn) {\n          await signIn(signInOptions);\n        }\n      } catch (error) {\n        throw new ThunderIDRuntimeError(\n          `Sign in failed: ${error instanceof Error ? error.message : String(error)}`,\n          'SignInButton-handleSignIn-RuntimeError-001',\n          'nextjs',\n          'Something went wrong while trying to sign in. Please try again later.',\n        );\n      } finally {\n        setIsLoading(false);\n      }\n    };\n\n    const handleOnClick = async (e: MouseEvent<HTMLButtonElement>): Promise<void> => {\n      await handleSignIn();\n      if (onClick) {\n        onClick(e);\n      }\n    };\n\n    return (\n      <BaseSignInButton\n        className={className}\n        style={style}\n        ref={ref}\n        preferences={preferences}\n        isLoading={isLoading}\n        signIn={handleSignIn}\n        onClick={handleOnClick}\n        {...rest}\n      >\n        {children ?? t('elements.buttons.signin.text')}\n      </BaseSignInButton>\n    );\n  },\n);\n\nSignInButton.displayName = 'SignInButton';\n\nexport default SignInButton;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA8CA,MAAMA,sCAKF,EAAC,WAAW,OAAO,UAAU,aAAa,SAAS,gBAAgB,EAAE,CAAE,GAAG,QAC1E,QACiB;CACjB,MAAM,EAAC,QAAQ,cAAaC,8BAAc;CAC1C,MAAMC,yCAAuC;CAC7C,MAAM,EAAC,4CAAoB,aAAa,KAAK;CAE7C,MAAM,CAAC,WAAW,oCAAyB,MAAM;CAEjD,MAAM,eAAe,YAA2B;AAC9C,MAAI;AACF,gBAAa,KAAK;AAGlB,OAAI,UACF,QAAO,KAAK,UAAU;YACb,OACT,OAAM,OAAO,cAAc;WAEtB,OAAO;AACd,SAAM,IAAIC,uCACR,mBAAmB,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM,IACzE,8CACA,UACA,wEACD;YACO;AACR,gBAAa,MAAM;;;CAIvB,MAAM,gBAAgB,OAAO,MAAoD;AAC/E,QAAM,cAAc;AACpB,MAAI,QACF,SAAQ,EAAE;;AAId,QACE,2CAACC;EACY;EACJ;EACF;EACQ;EACF;EACX,QAAQ;EACR,SAAS;EACT,GAAI;YAEH,YAAY,EAAE,+BAA+B;GAC7B;EAGxB;AAED,aAAa,cAAc;AAE3B,2BAAe"}

package/dist/cjs/client/components/actions/SignOutButton/SignOutButton.cjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"SignOutButton.cjs","names":["SignOutButton: ForwardRefExoticComponent<SignOutButtonProps & RefAttributes<HTMLButtonElement>>","useThunderID","BaseSignOutButton"],"sources":["../../../../../../src/client/components/actions/SignOutButton/SignOutButton.tsx"],"sourcesContent":["// Copyright 2025 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\n'use client';\n\nimport {BaseSignOutButton, BaseSignOutButtonProps, useTranslation} from '@thunderid/react';\nimport {forwardRef, ForwardRefExoticComponent, ReactElement, Ref, RefAttributes, useState, MouseEvent} from 'react';\nimport logger from '../../../../utils/logger';\nimport useThunderID from '../../../contexts/ThunderID/useThunderID';\n\n/**\n * Interface for SignInButton component props.\n */\nexport type SignOutButtonProps = BaseSignOutButtonProps;\n\n/**\n * SignInButton component. This button initiates the sign-in process when clicked.\n *\n * @example\n * ```tsx\n * import { SignInButton } from '@thunderid/auth-react';\n *\n * const App = () => {\n *   const buttonRef = useRef<HTMLButtonElement>(null);\n *   return (\n *     <SignInButton ref={buttonRef} className=\"custom-class\" style={{ backgroundColor: 'blue' }}>\n *       Sign In\n *     </SignInButton>\n *   );\n * }\n * ```\n */\nconst SignOutButton: ForwardRefExoticComponent<SignOutButtonProps & RefAttributes<HTMLButtonElement>> = forwardRef<\n  HTMLButtonElement,\n  SignOutButtonProps\n>(\n  (\n    {className, style, preferences, onClick, children, ...rest}: SignOutButtonProps,\n    ref: Ref<HTMLButtonElement>,\n  ): ReactElement => {\n    const {signOut} = useThunderID();\n    const {t} = useTranslation(preferences?.i18n);\n\n    const [isLoading, setIsLoading] = useState(false);\n\n    const handleOnClick = async (e: MouseEvent<HTMLButtonElement>): Promise<void> => {\n      try {\n        setIsLoading(true);\n\n        logger.debug('[SignOutButton] Initiating a sign-out from a button click');\n\n        await signOut();\n\n        if (onClick) {\n          onClick(e);\n        }\n      } catch (error) {\n        logger.error('[SignOutButton] Error occurred initiating sign-out from a button click:', error);\n      } finally {\n        setIsLoading(false);\n      }\n    };\n\n    return (\n      <BaseSignOutButton ref={ref} onClick={handleOnClick} isLoading={isLoading} preferences={preferences} {...rest}>\n        {children ?? t('elements.buttons.signout.text')}\n      </BaseSignOutButton>\n    );\n  },\n);\n\nexport default SignOutButton;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAgCA,MAAMA,uCAKF,EAAC,WAAW,OAAO,aAAa,SAAS,SAAU,GAAG,QACtD,QACiB;CACjB,MAAM,EAAC,YAAWC,8BAAc;CAChC,MAAM,EAAC,4CAAoB,aAAa,KAAK;CAE7C,MAAM,CAAC,WAAW,oCAAyB,MAAM;CAEjD,MAAM,gBAAgB,OAAO,MAAoD;AAC/E,MAAI;AACF,gBAAa,KAAK;AAElB,0BAAO,MAAM,4DAA4D;AAEzE,SAAM,SAAS;AAEf,OAAI,QACF,SAAQ,EAAE;WAEL,OAAO;AACd,0BAAO,MAAM,2EAA2E,MAAM;YACtF;AACR,gBAAa,MAAM;;;AAIvB,QACE,2CAACC;EAAuB;EAAK,SAAS;EAA0B;EAAwB;EAAa,GAAI;YACtG,YAAY,EAAE,gCAAgC;GAC7B;EAGzB;AAED,4BAAe"}

package/dist/cjs/client/components/actions/SignUpButton/SignUpButton.cjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"SignUpButton.cjs","names":["SignUpButton: ForwardRefExoticComponent<SignUpButtonProps & RefAttributes<HTMLButtonElement>>","useThunderID","router: AppRouterInstance","ThunderIDRuntimeError","BaseSignUpButton"],"sources":["../../../../../../src/client/components/actions/SignUpButton/SignUpButton.tsx"],"sourcesContent":["// Copyright 2025 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\n'use client';\n\nimport {ThunderIDRuntimeError} from '@thunderid/node';\nimport {BaseSignUpButton, BaseSignUpButtonProps, useTranslation} from '@thunderid/react';\nimport {AppRouterInstance} from 'next/dist/shared/lib/app-router-context.shared-runtime';\nimport {useRouter} from 'next/navigation';\nimport {forwardRef, ForwardRefExoticComponent, MouseEvent, ReactElement, Ref, RefAttributes, useState} from 'react';\nimport useThunderID from '../../../contexts/ThunderID/useThunderID';\n\n/**\n * Props interface of {@link SignUpButton}\n */\nexport type SignUpButtonProps = BaseSignUpButtonProps;\n\n/**\n * SignUpButton component that supports both render props and traditional props patterns.\n * It redirects the user to the ThunderID sign-up page configured for the application.\n *\n * @remarks This component is only supported in browser based React applications (CSR).\n *\n * @example Using render props pattern\n * ```tsx\n * <SignUpButton>\n *   {({ signUp, isLoading }) => (\n *     <button onClick={signUp} disabled={isLoading}>\n *       {isLoading ? 'Creating Account...' : 'Create Account'}\n *     </button>\n *   )}\n * </SignUpButton>\n * ```\n *\n * @example Using traditional props pattern\n * ```tsx\n * <SignUpButton className=\"custom-button\">Create Account</SignUpButton>\n * ```\n *\n * @example Using component-level preferences\n * ```tsx\n * <SignUpButton\n *   preferences={{\n *     i18n: {\n *       bundles: {\n *         'en-US': {\n *           translations: {\n *             'buttons.signUp': 'Custom Sign Up Text'\n *           }\n *         }\n *       }\n *     }\n *   }}\n * >\n *   Custom Sign Up\n * </SignUpButton>\n * ```\n */\nconst SignUpButton: ForwardRefExoticComponent<SignUpButtonProps & RefAttributes<HTMLButtonElement>> = forwardRef<\n  HTMLButtonElement,\n  SignUpButtonProps\n>(({children, onClick, preferences, ...rest}: SignUpButtonProps, ref: Ref<HTMLButtonElement>): ReactElement => {\n  const {signUp, signUpUrl} = useThunderID();\n  const router: AppRouterInstance = useRouter();\n  const {t} = useTranslation(preferences?.i18n);\n\n  const [isLoading, setIsLoading] = useState(false);\n\n  const handleSignUp = async (e?: MouseEvent<HTMLButtonElement>): Promise<void> => {\n    try {\n      setIsLoading(true);\n\n      // If a custom `signUpUrl` is provided, use it for navigation.\n      if (signUpUrl) {\n        router.push(signUpUrl);\n      } else if (signUp) {\n        await signUp();\n      }\n\n      if (onClick) {\n        onClick(e!);\n      }\n    } catch (error) {\n      throw new ThunderIDRuntimeError(\n        `Sign up failed: ${error instanceof Error ? error.message : String(error)}`,\n        'SignUpButton-handleSignUp-RuntimeError-001',\n        'nextjs',\n        'Something went wrong while trying to sign up. Please try again later.',\n      );\n    } finally {\n      setIsLoading(false);\n    }\n  };\n\n  return (\n    <BaseSignUpButton\n      ref={ref}\n      onClick={handleSignUp}\n      isLoading={isLoading}\n      signUp={handleSignUp}\n      preferences={preferences}\n      {...rest}\n    >\n      {children ?? t('elements.buttons.signup.text')}\n    </BaseSignUpButton>\n  );\n});\n\nSignUpButton.displayName = 'SignUpButton';\n\nexport default SignUpButton;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA0DA,MAAMA,sCAGH,EAAC,UAAU,SAAS,YAAa,GAAG,QAA0B,QAA8C;CAC7G,MAAM,EAAC,QAAQ,cAAaC,8BAAc;CAC1C,MAAMC,yCAAuC;CAC7C,MAAM,EAAC,4CAAoB,aAAa,KAAK;CAE7C,MAAM,CAAC,WAAW,oCAAyB,MAAM;CAEjD,MAAM,eAAe,OAAO,MAAqD;AAC/E,MAAI;AACF,gBAAa,KAAK;AAGlB,OAAI,UACF,QAAO,KAAK,UAAU;YACb,OACT,OAAM,QAAQ;AAGhB,OAAI,QACF,SAAQ,EAAG;WAEN,OAAO;AACd,SAAM,IAAIC,uCACR,mBAAmB,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM,IACzE,8CACA,UACA,wEACD;YACO;AACR,gBAAa,MAAM;;;AAIvB,QACE,2CAACC;EACM;EACL,SAAS;EACE;EACX,QAAQ;EACK;EACb,GAAI;YAEH,YAAY,EAAE,+BAA+B;GAC7B;EAErB;AAEF,aAAa,cAAc;AAE3B,2BAAe"}

package/dist/cjs/client/components/control/SignedIn/SignedIn.cjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"SignedIn.cjs","names":["SignedIn: FC<PropsWithChildren<SignedInProps>>","useThunderID"],"sources":["../../../../../../src/client/components/control/SignedIn/SignedIn.tsx"],"sourcesContent":["// Copyright 2025 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\n'use client';\n\nimport {FC, PropsWithChildren, ReactNode} from 'react';\nimport useThunderID from '../../../contexts/ThunderID/useThunderID';\n\n/**\n * Props interface of {@link SignedIn}\n */\nexport interface SignedInProps {\n  /**\n   * Content to show when the user is not signed in.\n   */\n  fallback?: ReactNode;\n}\n\n/**\n * A component that only renders its children when the user is signed in.\n *\n * @example\n * ```tsx\n * import { SignedIn } from '@thunderid/auth-next';\n *\n * const App = () => {\n *   return (\n *     <SignedIn fallback={<p>Please sign in to continue</p>}>\n *       <p>Welcome! You are signed in.</p>\n *     </SignedIn>\n *   );\n * }\n * ```\n */\nconst SignedIn: FC<PropsWithChildren<SignedInProps>> = ({\n  children,\n  fallback = null,\n}: PropsWithChildren<SignedInProps>) => {\n  const {isSignedIn} = useThunderID();\n\n  return <>{isSignedIn ? children : fallback}</>;\n};\n\nexport default SignedIn;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAkCA,MAAMA,YAAkD,EACtD,UACA,WAAW,WAC2B;CACtC,MAAM,EAAC,eAAcC,8BAAc;AAEnC,QAAO,mFAAG,aAAa,WAAW,WAAY;;AAGhD,uBAAe"}

package/dist/cjs/client/components/control/SignedOut/SignedOut.cjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"SignedOut.cjs","names":["SignedOut: FC<PropsWithChildren<SignedOutProps>>","useThunderID"],"sources":["../../../../../../src/client/components/control/SignedOut/SignedOut.tsx"],"sourcesContent":["// Copyright 2025 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\n'use client';\n\nimport {FC, PropsWithChildren, ReactNode} from 'react';\nimport useThunderID from '../../../contexts/ThunderID/useThunderID';\n\n/**\n * Props interface of {@link SignedOut}\n */\nexport interface SignedOutProps {\n  /**\n   * Content to show when the user is not signed-out.\n   */\n  fallback?: ReactNode;\n}\n\n/**\n * A component that only renders its children when the user is signed out.\n *\n * @example\n * ```tsx\n * import { SignedOut } from '@thunderid/auth-next';\n *\n * const App = () => {\n *   return (\n *     <SignedOut fallback={<p>Please sign out to continue</p>}>\n *       <p>Welcome! You are signed out.</p>\n *     </SignedOut>\n *   );\n * }\n * ```\n */\nconst SignedOut: FC<PropsWithChildren<SignedOutProps>> = ({\n  children,\n  fallback = null,\n}: PropsWithChildren<SignedOutProps>) => {\n  const {isSignedIn} = useThunderID();\n\n  return <>{!isSignedIn ? children : fallback}</>;\n};\n\nexport default SignedOut;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAkCA,MAAMA,aAAoD,EACxD,UACA,WAAW,WAC4B;CACvC,MAAM,EAAC,eAAcC,8BAAc;AAEnC,QAAO,mFAAG,CAAC,aAAa,WAAW,WAAY;;AAGjD,wBAAe"}

package/dist/cjs/client/components/presentation/AuthFlowSelect/AuthFlowSelect.cjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"AuthFlowSelect.cjs","names":["AuthFlowSelect: FC<AuthFlowSelectProps>","BaseAuthFlowSelect","fetchAuthFlowsFromServer"],"sources":["../../../../../../src/client/components/presentation/AuthFlowSelect/AuthFlowSelect.tsx"],"sourcesContent":["// Copyright 2026 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\n'use client';\n\nimport {BaseAuthFlowSelect, BaseAuthFlowSelectProps} from '@thunderid/react';\nimport {FC} from 'react';\nimport fetchAuthFlowsFromServer from '../../../fetchAuthFlowsFromServer';\n\nexport type AuthFlowSelectProps = Omit<BaseAuthFlowSelectProps, 'fetchAuthFlows'>;\n\n/**\n * Authentication-flow picker for signed-in screens. Flows load through a server action that uses the\n * signed-in user's server-held session, so the access token never reaches the browser. It takes no\n * data source; for a custom one use `Select` with `useInfiniteOptions`.\n */\nconst AuthFlowSelect: FC<AuthFlowSelectProps> = (props: AuthFlowSelectProps) => (\n  <BaseAuthFlowSelect {...props} fetchAuthFlows={fetchAuthFlowsFromServer} />\n);\n\nexport default AuthFlowSelect;\n"],"mappings":";;;;;;;;;;;;;;;;AAgBA,MAAMA,kBAA2C,UAC/C,2CAACC;CAAmB,GAAI;CAAO,gBAAgBC;EAA4B;AAG7E,6BAAe"}

package/dist/cjs/client/components/presentation/ChangeCredential/ChangeCredential.cjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"ChangeCredential.cjs","names":["ChangeCredential: FC<ChangeCredentialProps>","CredentialConstants","useThunderID","resolvedDisplayName: string","resolvedPolicy: PasswordPolicy","result: UpdateUserCredentialsActionResult","updateUserCredentialsAction","getSessionId","text: string","BaseChangeCredential"],"sources":["../../../../../../src/client/components/presentation/ChangeCredential/ChangeCredential.tsx"],"sourcesContent":["// Copyright 2026 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\n'use client';\n\nimport {CredentialConstants, PasswordPolicy, resolveChangeCredentialPolicy, supportsCredential} from '@thunderid/node';\nimport {\n  BaseChangeCredential,\n  BaseChangeCredentialProps,\n  ChangePasswordValues,\n  useTranslation,\n  useUser,\n} from '@thunderid/react';\nimport {FC, ReactElement, useMemo, useState} from 'react';\nimport getSessionId from '../../../../server/actions/getSessionId';\nimport updateUserCredentialsAction, {\n  UpdateUserCredentialsActionResult,\n} from '../../../../server/actions/updateUserCredentialsAction';\nimport useThunderID from '../../../contexts/ThunderID/useThunderID';\n\n/**\n * Title-cases a credential attribute name for use as a display-name fallback when the schema\n * declares no `displayName` for it, e.g. `pin` -> `Pin`.\n */\nconst defaultDisplayName = (attribute: string): string => attribute.charAt(0).toUpperCase() + attribute.slice(1);\n\n/**\n * Props for the ChangeCredential component.\n * Mirrors `@thunderid/react`'s `ChangeCredentialProps` exactly, so a consumer moving between\n * the React and Next.js SDKs doesn't need to change how they call it.\n */\nexport type ChangeCredentialProps = Omit<\n  BaseChangeCredentialProps,\n  'credentialDisplayName' | 'error' | 'fieldErrors' | 'loading' | 'onSubmit' | 'success'\n> & {\n  /**\n   * The credential attribute this instance manages, any attribute the user's entity type\n   * schema declares `credential: true` (for example `password` or `pin`). Defaults to\n   * `password`. Render the component once per credential to let a user manage more than one,\n   * for example `<ChangeCredential />` for the password and\n   * `<ChangeCredential attribute=\"pin\" />` for a PIN.\n   */\n  attribute?: string;\n  /**\n   * Called after the credential has been changed successfully.\n   */\n  onSuccess?: () => void;\n};\n\n/**\n * ChangeCredential lets the signed-in user set a new value for one of their own credentials.\n *\n * This is the Next.js-specific implementation: it uses `BaseChangeCredential` from\n * `@thunderid/react` for rendering, but routes the write through\n * `updateUserCredentialsAction` (a server action) instead of calling the ThunderID server\n * directly from the browser, matching how `UserProfile` reaches `updateUserProfileAction`.\n *\n * Defaults to managing the `password` credential. To manage a different one (for example a\n * PIN declared on the user type schema), set `attribute`; render the component once per\n * credential to let a user manage several.\n *\n * @example\n * ```tsx\n * // Basic usage, manages the password\n * <ChangeCredential onSuccess={() => toast('Password updated')} />\n *\n * // Managing a different credential declared on the schema\n * <ChangeCredential attribute=\"pin\" />\n * ```\n */\nconst ChangeCredential: FC<ChangeCredentialProps> = ({\n  attribute = CredentialConstants.PASSWORD,\n  onSuccess,\n  policy,\n  preferences,\n  ...rest\n}: ChangeCredentialProps): ReactElement => {\n  const {preferences: contextPreferences} = useThunderID();\n  const {userSchema} = useUser();\n  const resolvedDisplayName: string = userSchema?.[attribute]?.displayName ?? defaultDisplayName(attribute);\n\n  const resolvedPreferences = useMemo(\n    () => ({\n      ...contextPreferences,\n      ...preferences,\n      user: {...contextPreferences?.user, ...preferences?.user},\n    }),\n    [contextPreferences, preferences],\n  );\n  const {t} = useTranslation(resolvedPreferences?.i18n);\n\n  const [error, setError] = useState<string | null>(null);\n  const [fieldErrors, setFieldErrors] = useState<Record<string, string>>({});\n  const [loading, setLoading] = useState<boolean>(false);\n  const [success, setSuccess] = useState<boolean>(false);\n\n  const resolvedPolicy: PasswordPolicy = useMemo(\n    () => resolveChangeCredentialPolicy(userSchema, attribute, policy),\n    [userSchema, attribute, policy],\n  );\n\n  const handleSubmit = async ({newPassword}: ChangePasswordValues): Promise<void> => {\n    setError(null);\n    setFieldErrors({});\n    setSuccess(false);\n    setLoading(true);\n\n    const result: UpdateUserCredentialsActionResult = await updateUserCredentialsAction(\n      {[attribute]: newPassword},\n      await getSessionId(),\n    );\n\n    if (result.success) {\n      setSuccess(true);\n      onSuccess?.();\n    } else {\n      const text: string =\n        result.message ??\n        t(result.messageKey, {credential: resolvedDisplayName, credentialLower: resolvedDisplayName.toLowerCase()});\n\n      if (result.field) {\n        setFieldErrors({[result.field]: text});\n      } else {\n        setError(text);\n      }\n    }\n\n    setLoading(false);\n  };\n\n  return (\n    <BaseChangeCredential\n      {...rest}\n      credentialDisplayName={resolvedDisplayName}\n      error={error}\n      fieldErrors={fieldErrors}\n      loading={loading}\n      policy={resolvedPolicy}\n      preferences={resolvedPreferences}\n      success={success}\n      unavailable={!supportsCredential(userSchema, attribute)}\n      onSubmit={(values: ChangePasswordValues): void => {\n        void handleSubmit(values);\n      }}\n    />\n  );\n};\n\nexport default ChangeCredential;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;AAwBA,MAAM,sBAAsB,cAA8B,UAAU,OAAO,EAAE,CAAC,aAAa,GAAG,UAAU,MAAM,EAAE;;;;;;;;;;;;;;;;;;;;;;AA8ChH,MAAMA,oBAA+C,EACnD,YAAYC,qCAAoB,UAChC,WACA,QACA,YACA,GAAG,WACsC;CACzC,MAAM,EAAC,aAAa,uBAAsBC,8BAAc;CACxD,MAAM,EAAC,+CAAuB;CAC9B,MAAMC,sBAA8B,aAAa,YAAY,eAAe,mBAAmB,UAAU;CAEzG,MAAM,gDACG;EACL,GAAG;EACH,GAAG;EACH,MAAM;GAAC,GAAG,oBAAoB;GAAM,GAAG,aAAa;GAAK;EAC1D,GACD,CAAC,oBAAoB,YAAY,CAClC;CACD,MAAM,EAAC,4CAAoB,qBAAqB,KAAK;CAErD,MAAM,CAAC,OAAO,gCAAoC,KAAK;CACvD,MAAM,CAAC,aAAa,sCAAmD,EAAE,CAAC;CAC1E,MAAM,CAAC,SAAS,kCAAgC,MAAM;CACtD,MAAM,CAAC,SAAS,kCAAgC,MAAM;CAEtD,MAAMC,8FACgC,YAAY,WAAW,OAAO,EAClE;EAAC;EAAY;EAAW;EAAO,CAChC;CAED,MAAM,eAAe,OAAO,EAAC,kBAAsD;AACjF,WAAS,KAAK;AACd,iBAAe,EAAE,CAAC;AAClB,aAAW,MAAM;AACjB,aAAW,KAAK;EAEhB,MAAMC,SAA4C,MAAMC,4CACtD,GAAE,YAAY,aAAY,EAC1B,MAAMC,8BAAc,CACrB;AAED,MAAI,OAAO,SAAS;AAClB,cAAW,KAAK;AAChB,gBAAa;SACR;GACL,MAAMC,OACJ,OAAO,WACP,EAAE,OAAO,YAAY;IAAC,YAAY;IAAqB,iBAAiB,oBAAoB,aAAa;IAAC,CAAC;AAE7G,OAAI,OAAO,MACT,gBAAe,GAAE,OAAO,QAAQ,MAAK,CAAC;OAEtC,UAAS,KAAK;;AAIlB,aAAW,MAAM;;AAGnB,QACE,2CAACC;EACC,GAAI;EACJ,uBAAuB;EAChB;EACM;EACJ;EACT,QAAQ;EACR,aAAa;EACJ;EACT,aAAa,0CAAoB,YAAY,UAAU;EACvD,WAAW,WAAuC;AAChD,GAAK,aAAa,OAAO;;GAE3B;;AAIN,+BAAe"}