@asgardeo/javascript 0.22.0 → 0.23.1

package/dist/AsgardeoJavaScriptClient.d.ts

@@ -23,17 +23,49 @@ import { Config, SignInOptions, SignOutOptions, SignUpOptions } from './models/c
 import { Crypto } from './models/crypto';
 import { EmbeddedFlowExecuteRequestPayload, EmbeddedFlowExecuteResponse } from './models/embedded-flow';
 import { OIDCDiscoveryApiResponse } from './models/oidc-discovery';
-import { AllOrganizationsApiResponse, Organization } from './models/organization';
+import { AllOrganizationsApiResponse, Organization, OrgDiscoveryType } from './models/organization';
 import { Storage } from './models/store';
 import { TokenExchangeRequestConfig, TokenResponse } from './models/token';
 import { User, UserProfile } from './models/user';
+/**
+ * Options accepted by {@link AsgardeoJavaScriptClient.getOrgAuthorizationUrl}.
+ */
+export interface OrgAuthorizationUrlOptions {
+    /**
+     * Additional query parameters to append to the authorization URL.
+     */
+    additionalParams?: Record<string, string>;
+    /**
+     * Optional agent configuration. When provided, the resulting URL is
+     * decorated with `requested_actor=<agentID>` so the issued user token is
+     * delegated on-behalf-of the agent.
+     */
+    agentConfig?: AgentConfig;
+    /**
+     * When `true`, the `fidp=OrganizationSSO` query parameter is omitted so the
+     * enhanced organization authentication flow can take over discovery.
+     * Defaults to `false`.
+     */
+    isEnhancedOrgAuth?: boolean;
+    /**
+     * Optional `resource` query parameter to forward to the authorize endpoint.
+     */
+    resource?: string;
+    /**
+     * Optional `state` value to seed request correlation with. If omitted, the
+     * underlying SDK generates one.
+     */
+    state?: string;
+}
 declare class AsgardeoJavaScriptClient<T = Config> implements AsgardeoClient<T> {
     private cacheStore;
     private cryptoUtils;
     private auth;
     private storageManager;
     private baseURL;
+    private initPromise;
     constructor(config?: AuthClientConfig<T>, cacheStore?: Storage, cryptoUtils?: Crypto);
+    protected ensureInitialized(): Promise<void>;
     getDiscoveryResponse(): Promise<OIDCDiscoveryApiResponse | null>;
     switchOrganization(_organization: Organization, _sessionId?: string): Promise<TokenResponse | Response>;
     initialize(_config: T, _storage?: Storage): Promise<boolean>;
@@ -61,6 +93,58 @@ declare class AsgardeoJavaScriptClient<T = Config> implements AsgardeoClient<T>
     getAgentToken(agentConfig: AgentConfig): Promise<TokenResponse>;
     getOBOSignInURL(agentConfig: AgentConfig): Promise<string>;
     getOBOToken(agentConfig: AgentConfig, authCodeResponse: AuthCodeResponse): Promise<TokenResponse>;
+    /**
+     * Builds a `/oauth2/authorize` URL targeting a specific child organization.
+     *
+     * The target organization can be identified by its UUID (`orgID`), handle
+     * (`orgHandle`), display name (`org`) or via email-domain based discovery
+     * (`emailDomain`).
+     *
+     * @param orgDiscoveryType - The organization discovery strategy to use.
+     * @param discoveryInput   - The identifier whose meaning depends on
+     *                            `orgDiscoveryType` (UUID, handle, name or email).
+     * @param options          - Optional state, resource, agent delegation and
+     *                            additional query parameters.
+     * @returns The fully-built authorization URL.
+     */
+    getOrgAuthorizationUrl(orgDiscoveryType: OrgDiscoveryType, discoveryInput: string, options?: OrgAuthorizationUrlOptions): Promise<string>;
+    /**
+     * Exchanges an existing access token for one scoped to a target organization,
+     * using the `organization_switch` grant type.
+     *
+     * Unlike {@link AsgardeoJavaScriptClient.exchangeToken} this method does
+     * not require an active SDK session — the caller supplies the source
+     * access token directly. This makes it safe to use from server-side agent
+     * flows where there is no user session yet.
+     *
+     * @param token                  - The current access token to be switched.
+     * @param switchingOrganization  - The ID/UUID of the target organization.
+     * @param scopes                 - Optional list of scopes to request for the switched token.
+     * @returns A normalized {@link TokenResponse} for the switched organization.
+     */
+    switchTokenToOrganization(token: string, switchingOrganization: string, scopes?: string[]): Promise<TokenResponse>;
+    /**
+     * Resolves the OAuth2 token endpoint URL.
+     *
+     * Prefers the value advertised by the OIDC well-known document (when it
+     * has already been loaded into the storage manager) and falls back to
+     * `${baseURL}/oauth2/token` derived from the SDK configuration.
+     */
+    private resolveTokenEndpoint;
+    /**
+     * Authenticates as the agent and switches the issued agent token into a
+     * target child organization in a single call.
+     *
+     * @param agentConfig            - Agent credentials used to obtain the parent-org agent token.
+     * @param switchingOrganization  - The ID/UUID of the target organization.
+     * @param orgScopes              - Optional scopes to request for the organization-scoped token.
+     * @returns A normalized {@link TokenResponse} scoped to the target organization.
+     */
+    getOrganizationAgentToken(agentConfig: AgentConfig, switchingOrganization: string, orgScopes?: string[]): Promise<TokenResponse>;
+    /**
+     * Builds the custom query-parameter map for an organization-scoped authorization request.
+     */
+    private static buildOrgAuthorizationParams;
 }
 export default AsgardeoJavaScriptClient;
 //# sourceMappingURL=AsgardeoJavaScriptClient.d.ts.map

package/dist/AsgardeoJavaScriptClient.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"AsgardeoJavaScriptClient.d.ts","sourceRoot":"","sources":["../src/AsgardeoJavaScriptClient.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAGH,OAAO,EAAC,gBAAgB,EAAC,MAAM,mCAAmC,CAAC;AAKnE,OAAO,EAAC,WAAW,EAAC,MAAM,gBAAgB,CAAC;AAC3C,OAAO,EAAC,gBAAgB,EAAC,MAAM,6BAA6B,CAAC;AAC7D,OAAO,EAAC,cAAc,EAAC,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAC,MAAM,EAAE,aAAa,EAAE,cAAc,EAAE,aAAa,EAAC,MAAM,iBAAiB,CAAC;AACrF,OAAO,EAAC,MAAM,EAAC,MAAM,iBAAiB,CAAC;AACvC,OAAO,EAEL,iCAAiC,EACjC,2BAA2B,EAC5B,MAAM,wBAAwB,CAAC;AAOhC,OAAO,EAAC,wBAAwB,EAAC,MAAM,yBAAyB,CAAC;AACjE,OAAO,EAAC,2BAA2B,EAAE,YAAY,EAAC,MAAM,uBAAuB,CAAC;AAChF,OAAO,EAAC,OAAO,EAAC,MAAM,gBAAgB,CAAC;AACvC,OAAO,EAAC,0BAA0B,EAAE,aAAa,EAAC,MAAM,gBAAgB,CAAC;AACzE,OAAO,EAAC,IAAI,EAAE,WAAW,EAAC,MAAM,eAAe,CAAC;AAGhD,cAAM,wBAAwB,CAAC,CAAC,GAAG,MAAM,CAAE,YAAW,cAAc,CAAC,CAAC,CAAC;IACrE,OAAO,CAAC,UAAU,CAAU;IAE5B,OAAO,CAAC,WAAW,CAAS;IAE5B,OAAO,CAAC,IAAI,CAAwB;IAEpC,OAAO,CAAC,cAAc,CAAoB;IAE1C,OAAO,CAAC,OAAO,CAAS;gBAEZ,MAAM,CAAC,EAAE,gBAAgB,CAAC,CAAC,CAAC,EAAE,UAAU,CAAC,EAAE,OAAO,EAAE,WAAW,CAAC,EAAE,MAAM;IAavE,oBAAoB,IAAI,OAAO,CAAC,wBAAwB,GAAG,IAAI,CAAC;IAS7E,kBAAkB,CAAC,aAAa,EAAE,YAAY,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,QAAQ,CAAC;IAIvG,UAAU,CAAC,OAAO,EAAE,CAAC,EAAE,QAAQ,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IAI5D,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC;IAInD,OAAO,CAAC,QAAQ,CAAC,EAAE,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC;IAItC,mBAAmB,CAAC,QAAQ,CAAC,EAAE,GAAG,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,2BAA2B,CAAC;IAI9F,kBAAkB,CAAC,QAAQ,CAAC,EAAE,GAAG,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC;IAIhF,sBAAsB,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC;IAIzE,cAAc,CAAC,QAAQ,CAAC,EAAE,GAAG,GAAG,OAAO,CAAC,WAAW,CAAC;IAIpD,SAAS,IAAI,OAAO;IAIpB,UAAU,IAAI,OAAO,CAAC,OAAO,CAAC;IAI9B,iBAAiB,CAAC,QAAQ,EAAE,GAAG,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIjE,gBAAgB,IAAI,CAAC;IAIrB,aAAa,CAAC,OAAO,EAAE,0BAA0B,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,QAAQ,CAAC;IAI1G,cAAc,CAAC,QAAQ,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,GAAG,OAAO,CAAC;IAIjE,cAAc,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAIpD,YAAY,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI;IAIvC,UAAU,CAAC,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIrF,cAAc,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC;IAIvE,MAAM,CAAC,QAAQ,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC;IAI/C,OAAO,CACL,QAAQ,CAAC,EAAE,cAAc,EACzB,wBAAwB,CAAC,EAAE,MAAM,GAAG,CAAC,CAAC,eAAe,EAAE,MAAM,KAAK,IAAI,CAAC,EACvE,aAAa,CAAC,EAAE,CAAC,eAAe,EAAE,MAAM,KAAK,IAAI,GAChD,OAAO,CAAC,MAAM,CAAC;IAIlB,OAAO,CAAC,QAAQ,EAAE,iCAAiC,GAAG,OAAO,CAAC,2BAA2B,CAAC;IAI1F,MAAM,CAAC,OAAO,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC;IAE9C,MAAM,CAAC,OAAO,EAAE,iCAAiC,GAAG,OAAO,CAAC,2BAA2B,CAAC;IAS3E,aAAa,CAAC,WAAW,EAAE,WAAW,GAAG,OAAO,CAAC,aAAa,CAAC;IAkD/D,eAAe,CAAC,WAAW,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC;IAc1D,WAAW,CAAC,WAAW,EAAE,WAAW,EAAE,gBAAgB,EAAE,gBAAgB,GAAG,OAAO,CAAC,aAAa,CAAC;CAiB/G;AAED,eAAe,wBAAwB,CAAC"}
+{"version":3,"file":"AsgardeoJavaScriptClient.d.ts","sourceRoot":"","sources":["../src/AsgardeoJavaScriptClient.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAGH,OAAO,EAAC,gBAAgB,EAAC,MAAM,mCAAmC,CAAC;AAKnE,OAAO,EAAC,WAAW,EAAC,MAAM,gBAAgB,CAAC;AAC3C,OAAO,EAAC,gBAAgB,EAAC,MAAM,6BAA6B,CAAC;AAC7D,OAAO,EAAC,cAAc,EAAC,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAC,MAAM,EAAE,aAAa,EAAE,cAAc,EAAE,aAAa,EAAC,MAAM,iBAAiB,CAAC;AACrF,OAAO,EAAC,MAAM,EAAC,MAAM,iBAAiB,CAAC;AACvC,OAAO,EAEL,iCAAiC,EACjC,2BAA2B,EAC5B,MAAM,wBAAwB,CAAC;AAOhC,OAAO,EAAC,wBAAwB,EAAC,MAAM,yBAAyB,CAAC;AACjE,OAAO,EAAC,2BAA2B,EAAE,YAAY,EAAE,gBAAgB,EAAC,MAAM,uBAAuB,CAAC;AAClG,OAAO,EAAC,OAAO,EAAC,MAAM,gBAAgB,CAAC;AACvC,OAAO,EAAC,0BAA0B,EAAE,aAAa,EAAC,MAAM,gBAAgB,CAAC;AACzE,OAAO,EAAC,IAAI,EAAE,WAAW,EAAC,MAAM,eAAe,CAAC;AAwBhD;;GAEG;AACH,MAAM,WAAW,0BAA0B;IACzC;;OAEG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC1C;;;;OAIG;IACH,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B;;OAEG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,cAAM,wBAAwB,CAAC,CAAC,GAAG,MAAM,CAAE,YAAW,cAAc,CAAC,CAAC,CAAC;IACrE,OAAO,CAAC,UAAU,CAAU;IAE5B,OAAO,CAAC,WAAW,CAAS;IAE5B,OAAO,CAAC,IAAI,CAAwB;IAEpC,OAAO,CAAC,cAAc,CAAoB;IAE1C,OAAO,CAAC,OAAO,CAAS;IAExB,OAAO,CAAC,WAAW,CAA4B;gBAEnC,MAAM,CAAC,EAAE,gBAAgB,CAAC,CAAC,CAAC,EAAE,UAAU,CAAC,EAAE,OAAO,EAAE,WAAW,CAAC,EAAE,MAAM;cAapE,iBAAiB,IAAI,OAAO,CAAC,IAAI,CAAC;IAMrC,oBAAoB,IAAI,OAAO,CAAC,wBAAwB,GAAG,IAAI,CAAC;IAU7E,kBAAkB,CAAC,aAAa,EAAE,YAAY,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,QAAQ,CAAC;IAIvG,UAAU,CAAC,OAAO,EAAE,CAAC,EAAE,QAAQ,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IAI5D,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC;IAInD,OAAO,CAAC,QAAQ,CAAC,EAAE,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC;IAItC,mBAAmB,CAAC,QAAQ,CAAC,EAAE,GAAG,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,2BAA2B,CAAC;IAI9F,kBAAkB,CAAC,QAAQ,CAAC,EAAE,GAAG,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC;IAIhF,sBAAsB,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC;IAIzE,cAAc,CAAC,QAAQ,CAAC,EAAE,GAAG,GAAG,OAAO,CAAC,WAAW,CAAC;IAIpD,SAAS,IAAI,OAAO;IAIpB,UAAU,IAAI,OAAO,CAAC,OAAO,CAAC;IAI9B,iBAAiB,CAAC,QAAQ,EAAE,GAAG,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIjE,gBAAgB,IAAI,CAAC;IAIrB,aAAa,CAAC,OAAO,EAAE,0BAA0B,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,QAAQ,CAAC;IAI1G,cAAc,CAAC,QAAQ,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,GAAG,OAAO,CAAC;IAIjE,cAAc,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAIpD,YAAY,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI;IAIvC,UAAU,CAAC,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIrF,cAAc,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC;IAIvE,MAAM,CAAC,QAAQ,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC;IAI/C,OAAO,CACL,QAAQ,CAAC,EAAE,cAAc,EACzB,wBAAwB,CAAC,EAAE,MAAM,GAAG,CAAC,CAAC,eAAe,EAAE,MAAM,KAAK,IAAI,CAAC,EACvE,aAAa,CAAC,EAAE,CAAC,eAAe,EAAE,MAAM,KAAK,IAAI,GAChD,OAAO,CAAC,MAAM,CAAC;IAIlB,OAAO,CAAC,QAAQ,EAAE,iCAAiC,GAAG,OAAO,CAAC,2BAA2B,CAAC;IAI1F,MAAM,CAAC,OAAO,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC;IAE9C,MAAM,CAAC,OAAO,EAAE,iCAAiC,GAAG,OAAO,CAAC,2BAA2B,CAAC;IAS3E,aAAa,CAAC,WAAW,EAAE,WAAW,GAAG,OAAO,CAAC,aAAa,CAAC;IA8D/D,eAAe,CAAC,WAAW,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC;IAe1D,WAAW,CAAC,WAAW,EAAE,WAAW,EAAE,gBAAgB,EAAE,gBAAgB,GAAG,OAAO,CAAC,aAAa,CAAC;IAkB9G;;;;;;;;;;;;;OAaG;IACU,sBAAsB,CACjC,gBAAgB,EAAE,gBAAgB,EAClC,cAAc,EAAE,MAAM,EACtB,OAAO,GAAE,0BAA+B,GACvC,OAAO,CAAC,MAAM,CAAC;IAiBlB;;;;;;;;;;;;;OAaG;IACU,yBAAyB,CACpC,KAAK,EAAE,MAAM,EACb,qBAAqB,EAAE,MAAM,EAC7B,MAAM,CAAC,EAAE,MAAM,EAAE,GAChB,OAAO,CAAC,aAAa,CAAC;IAsFzB;;;;;;OAMG;YACW,oBAAoB;IAmBlC;;;;;;;;OAQG;IACU,yBAAyB,CACpC,WAAW,EAAE,WAAW,EACxB,qBAAqB,EAAE,MAAM,EAC7B,SAAS,CAAC,EAAE,MAAM,EAAE,GACnB,OAAO,CAAC,aAAa,CAAC;IAUzB;;OAEG;IACH,OAAO,CAAC,MAAM,CAAC,2BAA2B;CAgE3C;AAED,eAAe,wBAAwB,CAAC"}

package/dist/cjs/index.js

@@ -31,7 +31,6 @@ var __publicField = (obj, key, value) => __defNormalProp(obj, typeof key !== "sy
 // src/index.ts
 var index_exports = {};
 __export(index_exports, {
-  AgentConfig: () => AgentConfig,
   ApplicationNativeAuthenticationConstants: () => ApplicationNativeAuthenticationConstants_default,
   AsgardeoAPIError: () => AsgardeoAPIError,
   AsgardeoAuthClient: () => AsgardeoAuthClient,
@@ -4086,12 +4085,6 @@ var FlowMode = /* @__PURE__ */ ((FlowMode2) => {
   return FlowMode2;
 })(FlowMode || {});
 
-// src/models/agent.ts
-var AgentConfig;
-((AgentConfig2) => {
-  AgentConfig2.DEFAULT_AUTHENTICATOR_NAME = "Username & Password";
-})(AgentConfig || (AgentConfig = {}));
-
 // src/models/scim2-schema.ts
 var WellKnownSchemaIds = /* @__PURE__ */ ((WellKnownSchemaIds2) => {
   WellKnownSchemaIds2["Core"] = "urn:ietf:params:scim:schemas:core:2.0";
@@ -4192,24 +4185,54 @@ var DefaultCrypto = class {
   }
 };
 
+// src/models/agent.ts
+var AgentConfig;
+((AgentConfig2) => {
+  AgentConfig2.DEFAULT_AUTHENTICATOR_NAME = "Username & Password";
+})(AgentConfig || (AgentConfig = {}));
+
 // src/AsgardeoJavaScriptClient.ts
-var AsgardeoJavaScriptClient = class {
+var RESERVED_AUTH_KEYS = /* @__PURE__ */ new Set([
+  "client_id",
+  "redirect_uri",
+  "scope",
+  "state",
+  "response_type",
+  "resource",
+  "fidp",
+  "requested_actor",
+  "orgId",
+  "orgHandle",
+  "org",
+  "login_hint",
+  "orgDiscoveryType",
+  "code_challenge",
+  "code_challenge_method"
+]);
+var AsgardeoJavaScriptClient = class _AsgardeoJavaScriptClient {
   constructor(config, cacheStore, cryptoUtils) {
     __publicField(this, "cacheStore");
     __publicField(this, "cryptoUtils");
     __publicField(this, "auth");
     __publicField(this, "storageManager");
     __publicField(this, "baseURL");
+    __publicField(this, "initPromise");
     this.cacheStore = cacheStore ?? new DefaultCacheStore();
     this.cryptoUtils = cryptoUtils ?? new DefaultCrypto();
     this.auth = new AsgardeoAuthClient();
     if (config) {
-      this.auth.initialize(config, this.cacheStore, this.cryptoUtils);
+      this.initPromise = this.auth.initialize(config, this.cacheStore, this.cryptoUtils);
       this.storageManager = this.auth.getStorageManager();
     }
     this.baseURL = config?.baseUrl ?? "";
   }
+  async ensureInitialized() {
+    if (this.initPromise) {
+      await this.initPromise;
+    }
+  }
   async getDiscoveryResponse() {
+    await this.ensureInitialized();
     if (!this.storageManager) {
       return null;
     }
@@ -4284,6 +4307,15 @@ var AsgardeoJavaScriptClient = class {
   }
   /* eslint-enable class-methods-use-this, @typescript-eslint/no-unused-vars */
   async getAgentToken(agentConfig) {
+    await this.ensureInitialized();
+    if (!agentConfig?.agentID) {
+      throw new Error("agentConfig.agentID is required for getAgentToken().");
+    }
+    if (!agentConfig.agentSecret) {
+      throw new Error(
+        "agentConfig.agentSecret is required for getAgentToken(). The agent must authenticate against the token endpoint."
+      );
+    }
     const customParam = {
       response_mode: "direct"
     };
@@ -4323,6 +4355,7 @@ var AsgardeoJavaScriptClient = class {
     );
   }
   async getOBOSignInURL(agentConfig) {
+    await this.ensureInitialized();
     const customParam = {
       requested_actor: agentConfig.agentID
     };
@@ -4347,6 +4380,200 @@ var AsgardeoJavaScriptClient = class {
       tokenRequestConfig
     );
   }
+  /**
+   * Builds a `/oauth2/authorize` URL targeting a specific child organization.
+   *
+   * The target organization can be identified by its UUID (`orgID`), handle
+   * (`orgHandle`), display name (`org`) or via email-domain based discovery
+   * (`emailDomain`).
+   *
+   * @param orgDiscoveryType - The organization discovery strategy to use.
+   * @param discoveryInput   - The identifier whose meaning depends on
+   *                            `orgDiscoveryType` (UUID, handle, name or email).
+   * @param options          - Optional state, resource, agent delegation and
+   *                            additional query parameters.
+   * @returns The fully-built authorization URL.
+   */
+  async getOrgAuthorizationUrl(orgDiscoveryType, discoveryInput, options = {}) {
+    await this.ensureInitialized();
+    const customParam = _AsgardeoJavaScriptClient.buildOrgAuthorizationParams(
+      orgDiscoveryType,
+      discoveryInput,
+      options
+    );
+    const authURL = await this.auth.getSignInUrl(customParam);
+    if (!authURL) {
+      throw new Error("Could not build organization authorization URL");
+    }
+    return authURL.toString();
+  }
+  /**
+   * Exchanges an existing access token for one scoped to a target organization,
+   * using the `organization_switch` grant type.
+   *
+   * Unlike {@link AsgardeoJavaScriptClient.exchangeToken} this method does
+   * not require an active SDK session — the caller supplies the source
+   * access token directly. This makes it safe to use from server-side agent
+   * flows where there is no user session yet.
+   *
+   * @param token                  - The current access token to be switched.
+   * @param switchingOrganization  - The ID/UUID of the target organization.
+   * @param scopes                 - Optional list of scopes to request for the switched token.
+   * @returns A normalized {@link TokenResponse} for the switched organization.
+   */
+  async switchTokenToOrganization(token, switchingOrganization, scopes) {
+    await this.ensureInitialized();
+    if (!token) {
+      throw new Error("Token is required for organization switch.");
+    }
+    if (!switchingOrganization) {
+      throw new Error("switchingOrganization is required.");
+    }
+    if (!this.storageManager) {
+      throw new Error("Client is not initialized. Call initialize() before switching organizations.");
+    }
+    const configData = await this.storageManager.getConfigData();
+    if (!configData) {
+      throw new Error("Client configuration is unavailable. Initialize the client before switching organizations.");
+    }
+    const tokenEndpoint = await this.resolveTokenEndpoint();
+    const body = new URLSearchParams();
+    const { clientId, clientSecret } = configData;
+    if (!clientId || clientId.trim().length === 0) {
+      throw new Error("clientId is required in the client configuration for organization switch.");
+    }
+    const hasSecret = Boolean(clientSecret && clientSecret.trim().length > 0);
+    body.set("grant_type", "organization_switch");
+    body.set("token", token);
+    body.set("switching_organization", switchingOrganization);
+    body.set("client_id", clientId);
+    if (hasSecret) {
+      body.set("client_secret", clientSecret);
+    }
+    if (scopes && scopes.length > 0) {
+      body.set("scope", scopes.join(" "));
+    }
+    let response;
+    try {
+      response = await fetch(tokenEndpoint, {
+        body,
+        headers: {
+          Accept: "application/json",
+          "Content-Type": "application/x-www-form-urlencoded"
+        },
+        method: "POST"
+      });
+    } catch (error2) {
+      throw new Error(`Organization switch request failed: ${error2?.message ?? String(error2)}`);
+    }
+    if (!response.ok) {
+      let errorBody;
+      try {
+        errorBody = JSON.stringify(await response.json());
+      } catch {
+        errorBody = response.statusText;
+      }
+      throw new Error(`Organization switch failed (${response.status}): ${errorBody}`);
+    }
+    const parsed = await response.json();
+    return {
+      accessToken: parsed.access_token,
+      createdAt: parsed.created_at ?? Date.now(),
+      expiresIn: parsed.expires_in,
+      idToken: parsed.id_token,
+      refreshToken: parsed.refresh_token,
+      scope: parsed.scope,
+      tokenType: parsed.token_type
+    };
+  }
+  /**
+   * Resolves the OAuth2 token endpoint URL.
+   *
+   * Prefers the value advertised by the OIDC well-known document (when it
+   * has already been loaded into the storage manager) and falls back to
+   * `${baseURL}/oauth2/token` derived from the SDK configuration.
+   */
+  async resolveTokenEndpoint() {
+    const discovery = this.storageManager ? await this.storageManager.loadOpenIDProviderConfiguration() : null;
+    const discovered = discovery?.token_endpoint;
+    if (discovered && discovered.trim().length > 0) {
+      return discovered;
+    }
+    if (this.baseURL && this.baseURL.trim().length > 0) {
+      return `${this.baseURL.replace(/\/$/, "")}/oauth2/token`;
+    }
+    throw new Error(
+      "Unable to resolve the token endpoint. Provide a baseUrl in the client configuration or ensure OIDC discovery has been performed."
+    );
+  }
+  /**
+   * Authenticates as the agent and switches the issued agent token into a
+   * target child organization in a single call.
+   *
+   * @param agentConfig            - Agent credentials used to obtain the parent-org agent token.
+   * @param switchingOrganization  - The ID/UUID of the target organization.
+   * @param orgScopes              - Optional scopes to request for the organization-scoped token.
+   * @returns A normalized {@link TokenResponse} scoped to the target organization.
+   */
+  async getOrganizationAgentToken(agentConfig, switchingOrganization, orgScopes) {
+    if (!switchingOrganization) {
+      throw new Error("switchingOrganization is required.");
+    }
+    const agentToken = await this.getAgentToken(agentConfig);
+    return this.switchTokenToOrganization(agentToken.accessToken, switchingOrganization, orgScopes);
+  }
+  /**
+   * Builds the custom query-parameter map for an organization-scoped authorization request.
+   */
+  static buildOrgAuthorizationParams(orgDiscoveryType, discoveryInput, options) {
+    const trimmedValue = (discoveryInput ?? "").trim();
+    if (!trimmedValue) {
+      throw new Error("discoveryInput is required.");
+    }
+    const customParam = {};
+    if (!options.isEnhancedOrgAuth) {
+      customParam["fidp"] = "OrganizationSSO";
+    }
+    switch (orgDiscoveryType) {
+      case "orgID":
+        customParam["orgId"] = trimmedValue;
+        break;
+      case "orgHandle":
+        customParam["orgHandle"] = trimmedValue;
+        break;
+      case "org":
+        customParam["org"] = trimmedValue;
+        break;
+      case "emailDomain":
+        customParam["login_hint"] = trimmedValue;
+        customParam["orgDiscoveryType"] = "emailDomain";
+        break;
+      default:
+        throw new Error(`Unsupported orgDiscoveryType: ${orgDiscoveryType}`);
+    }
+    if (options.resource) {
+      customParam["resource"] = options.resource;
+    }
+    if (options.state) {
+      customParam["state"] = options.state;
+    }
+    if (options.agentConfig) {
+      if (!options.agentConfig.agentID || options.agentConfig.agentID.trim().length === 0) {
+        throw new Error("agentConfig.agentID is required when agentConfig is provided.");
+      }
+      customParam["requested_actor"] = options.agentConfig.agentID;
+    }
+    if (options.additionalParams) {
+      const conflicts = Object.keys(options.additionalParams).filter(
+        (key) => RESERVED_AUTH_KEYS.has(key)
+      );
+      if (conflicts.length > 0) {
+        throw new Error(`Reserved authorization parameters cannot be overridden: ${conflicts.sort().join(", ")}`);
+      }
+      Object.assign(customParam, options.additionalParams);
+    }
+    return customParam;
+  }
 };
 var AsgardeoJavaScriptClient_default = AsgardeoJavaScriptClient;
 
@@ -5681,7 +5908,6 @@ __publicField(_HttpClient, "DEFAULT_HANDLER_DISABLE_TIMEOUT", 1e3);
 var HttpClient = _HttpClient;
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
-  AgentConfig,
   ApplicationNativeAuthenticationConstants,
   AsgardeoAPIError,
   AsgardeoAuthClient,