@descope/node-sdk 1.0.4-alpha.9 → 1.0.4

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (12) hide show
  1. package/LICENSE +1 -1
  2. package/README.md +605 -23
  3. package/dist/cjs/index.cjs.js +1 -1
  4. package/dist/cjs/index.cjs.js.map +1 -1
  5. package/dist/index.d.ts +428 -346
  6. package/dist/index.esm.js +1 -1
  7. package/dist/index.esm.js.map +1 -1
  8. package/package.json +8 -8
  9. package/dist/cjs/examples/es6/src/index.d.ts +0 -1
  10. package/dist/examples/es6/src/index.d.ts +0 -1
  11. package/dist/index.umd.js +0 -2
  12. package/dist/index.umd.js.map +0 -1
package/dist/cjs/index.cjs.js CHANGED
@@ -1,2 +1,2 @@
1
- "use strict";var e=require("@descope/core-js-sdk"),t=require("jose"),s=require("node-fetch"),o=require("tslib");function n(e){return e&&"object"==typeof e&&"default"in e?e:{default:e}}var a=n(e),r=n(s);const i=(e,t,s)=>`${e}=${t}; Domain=${(null==s?void 0:s.cookieDomain)||""}; Max-Age=${(null==s?void 0:s.cookieMaxAge)||""}; Path=${(null==s?void 0:s.cookiePath)||"/"}; HttpOnly; SameSite=Strict`,l=e=>async(...t)=>{var s,n,a;const r=await e(...t);if(!r.data)return r;let l=r.data,{sessionJwt:d,refreshJwt:c}=l,p=o.__rest(l,["sessionJwt","refreshJwt"]);const m=[i("DS",d,p)];return c?m.push(i("DSR",c,p)):(null===(s=r.response)||void 0===s?void 0:s.headers.get("set-cookie"))&&(c=((e,t)=>{const s=null==e?void 0:e.match(RegExp(`(?:^|;\\s*)${t}=([^;]*)`));return s?s[1]:null})(null===(n=r.response)||void 0===n?void 0:n.headers.get("set-cookie"),"DSR"),m.push(null===(a=r.response)||void 0===a?void 0:a.headers.get("set-cookie"))),Object.assign(Object.assign({},r),{data:Object.assign(Object.assign({},r.data),{refreshJwt:c,cookies:m})})},d=(e,t,s)=>{if(!e)return;const o="string"==typeof t?t.split("."):t,n=o.shift()||"";if(0===o.length||"*"===n){const t=t=>{if(!t||"function"!=typeof e[t])throw Error(`cannot wrap value at key "${t.toString()}"`);e[t]=s(e[t])};"*"===n?Object.keys(e).forEach(t):t(n)}else d(e[n],o,s)};function c(e,t,s){var o,n;const a=s?null===(n=null===(o=e.token.tenants)||void 0===o?void 0:o[s])||void 0===n?void 0:n[t]:e.token[t];return Array.isArray(a)?a:[]}var p={create:"/v1/mgmt/user/create",update:"/v1/mgmt/user/update",delete:"/v1/mgmt/user/delete",load:"/v1/mgmt/user/load",search:"/v1/mgmt/user/search"},m={create:"/v1/mgmt/tenant/create",update:"/v1/mgmt/tenant/update",delete:"/v1/mgmt/tenant/delete"},u={update:"/v1/mgmt/jwt/update"},h={create:"/v1/mgmt/permission/create",update:"/v1/mgmt/permission/update",delete:"/v1/mgmt/permission/delete",loadAll:"/v1/mgmt/permission/all"},v={create:"/v1/mgmt/role/create",update:"/v1/mgmt/role/update",delete:"/v1/mgmt/role/delete",loadAll:"/v1/mgmt/role/all"};const f=(t,s)=>({create:(o,n,a,r,i,l)=>e.transformResponse(t.httpClient.post(p.create,{identifier:o,email:n,phone:a,displayName:r,roleNames:i,userTenants:l},{token:s}),(e=>e.user)),update:(o,n,a,r,i,l)=>e.transformResponse(t.httpClient.post(p.update,{identifier:o,email:n,phone:a,displayName:r,roleNames:i,userTenants:l},{token:s}),(e=>e.user)),delete:o=>e.transformResponse(t.httpClient.post(p.delete,{identifier:o},{token:s})),load:o=>e.transformResponse(t.httpClient.get(p.load,{queryParams:{identifier:o},token:s}),(e=>e.user)),searchAll:(o,n,a)=>e.transformResponse(t.httpClient.post(p.search,{tenantIds:o,roleNames:n,limit:a},{token:s}),(e=>e.users))}),k=(t,s)=>({create:(o,n)=>e.transformResponse(t.httpClient.post(m.create,{name:o,selfProvisioningDomains:n},{token:s})),createWithId:(o,n,a)=>e.transformResponse(t.httpClient.post(m.create,{tenantId:o,name:n,selfProvisioningDomains:a},{token:s})),update:(o,n,a)=>e.transformResponse(t.httpClient.post(m.update,{tenantId:o,name:n,selfProvisioningDomains:a},{token:s})),delete:o=>e.transformResponse(t.httpClient.post(m.delete,{tenantId:o},{token:s}))}),g=(t,s)=>({update:(o,n)=>e.transformResponse(t.httpClient.post(u.update,{jwt:o,customClaims:n},{token:s}))}),y=(t,s)=>({create:(o,n)=>e.transformResponse(t.httpClient.post(h.create,{name:o,description:n},{token:s})),update:(o,n,a)=>e.transformResponse(t.httpClient.post(h.update,{name:o,newName:n,description:a},{token:s})),delete:o=>e.transformResponse(t.httpClient.post(h.delete,{name:o},{token:s})),loadAll:()=>e.transformResponse(t.httpClient.get(h.loadAll,{token:s}),(e=>e.permissions))}),w=(t,s)=>({create:(o,n,a)=>e.transformResponse(t.httpClient.post(v.create,{name:o,description:n,permissionNames:a},{token:s})),update:(o,n,a,r)=>e.transformResponse(t.httpClient.post(v.update,{name:o,newName:n,description:a,permissionNames:r},{token:s})),delete:o=>e.transformResponse(t.httpClient.post(v.delete,{name:o},{token:s})),loadAll:()=>e.transformResponse(t.httpClient.get(v.loadAll,{token:s}),(e=>e.roles))});globalThis.fetch||(globalThis.fetch=r.default,globalThis.Headers=s.Headers,globalThis.Request=s.Request,globalThis.Response=s.Response);const R=e=>{e.hooks=e.hooks||{};const s=e.hooks.beforeRequest;e.hooks.beforeRequest=e=>{var t;const o=e;return o.headers=Object.assign(Object.assign({},o.headers),{"x-descope-sdk-name":"nodejs","x-descope-sdk-node-version":(null===(t=null===process||void 0===process?void 0:process.versions)||void 0===t?void 0:t.node)||"","x-descope-sdk-version":"1.0.4-alpha.9"}),(null==s?void 0:s(o))||o};const o=a.default(e);var n,r;n=o,r=l,["otp.verify.*","magicLink.verify","enchantedLink.signUp.*","enchantedLink.signIn.*","oauth.exchange","saml.exchange","totp.verify","webauthn.signIn.finish","webauthn.signUp.finish","refresh"].forEach((e=>d(n,e,r)));const{projectId:i,logger:p}=e,m={},u=((e,t)=>({user:f(e,t),tenant:k(e,t),jwt:g(e,t),permission:y(e,t),role:w(e,t)}))(o,e.managementKey),h=Object.assign(Object.assign({},o),{management:u,async getKey(e){if(!(null==e?void 0:e.kid))throw Error("header.kid must not be empty");if(m[e.kid])return m[e.kid];if(Object.assign(m,await(async()=>{const e=(await o.httpClient.get(`v2/keys/${i}`).then((e=>e.json()))).keys;return Array.isArray(e)?(await Promise.all(e.map((async e=>[e.kid,await t.importJWK(e)])))).reduce(((e,[t,s])=>t?Object.assign(Object.assign({},e),{[t.toString()]:s}):e),{}):{}})()),!m[e.kid])throw Error("failed to fetch matching key");return m[e.kid]},async validateJwt(e){var s;const o=(await t.jwtVerify(e,h.getKey,{clockTolerance:5})).payload;if(o&&(o.iss=null===(s=o.iss)||void 0===s?void 0:s.split("/").pop(),o.iss!==i))throw new t.errors.JWTClaimValidationFailed('unexpected "iss" claim value',"iss","check_failed");return{jwt:e,token:o}},async validateSession(e,t){var s,o;if(!e&&!t)throw Error("both refresh token and session token are empty");if(e)try{return await h.validateJwt(e)}catch(e){if(!t)throw null==p||p.error("failed to validate session token and no refresh token provided",e),Error("could not validate tokens")}if(t)try{await h.validateJwt(t);const e=await h.refresh(t);if(e.ok){return await h.validateJwt(null===(s=e.data)||void 0===s?void 0:s.sessionJwt)}throw Error(null===(o=e.error)||void 0===o?void 0:o.message)}catch(e){throw null==p||p.error("failed to validate refresh token",e),Error("could not validate tokens")}throw Error("could not validate token")},async exchangeAccessKey(e){if(!e)throw Error("access key must not be empty");let t;try{t=await h.accessKey.exchange(e)}catch(e){throw null==p||p.error("failed to exchange access key",e),Error("could not exchange access key")}const{sessionJwt:s}=t.data;if(!s)throw null==p||p.error("failed to parse exchange access key response"),Error("could not exchange access key");try{return await h.validateJwt(s)}catch(e){throw null==p||p.error("failed to parse jwt from access key",e),Error("could not exchange access key")}},validatePermissions:(e,t)=>h.validateTenantPermissions(e,null,t),validateTenantPermissions(e,t,s){const o=c(e,"permissions",t);return s.every((e=>o.includes(e)))},validateRoles:(e,t)=>h.validateTenantRoles(e,null,t),validateTenantRoles(e,t,s){const o=c(e,"roles",t);return s.every((e=>o.includes(e)))}});return h};R.DeliveryMethods=a.default.DeliveryMethods,R.RefreshTokenCookieName="DSR",R.SessionTokenCookieName="DS",module.exports=R;
1
+ "use strict";var e=require("tslib"),t=require("@descope/core-js-sdk"),s=require("jose"),a=require("node-fetch");function n(e){return e&&"object"==typeof e&&"default"in e?e:{default:e}}var o=n(t),r=n(a);const i=t=>async(...s)=>{var a,n,o;const r=await t(...s);if(!r.data)return r;let i=r.data,{refreshJwt:l}=i,d=e.__rest(i,["refreshJwt"]);const p=[];var m;return l?p.push(`${"DSR"}=${l}; Domain=${(null==(m=d)?void 0:m.cookieDomain)||""}; Max-Age=${(null==m?void 0:m.cookieMaxAge)||""}; Path=${(null==m?void 0:m.cookiePath)||"/"}; HttpOnly; SameSite=Strict`):(null===(a=r.response)||void 0===a?void 0:a.headers.get("set-cookie"))&&(l=((e,t)=>{const s=null==e?void 0:e.match(RegExp(`(?:^|;\\s*)${t}=([^;]*)`));return s?s[1]:null})(null===(n=r.response)||void 0===n?void 0:n.headers.get("set-cookie"),"DSR"),p.push(null===(o=r.response)||void 0===o?void 0:o.headers.get("set-cookie"))),Object.assign(Object.assign({},r),{data:Object.assign(Object.assign({},r.data),{refreshJwt:l,cookies:p})})};function l(e,t,s){var a,n;const o=s?null===(n=null===(a=e.token.tenants)||void 0===a?void 0:a[s])||void 0===n?void 0:n[t]:e.token[t];return Array.isArray(o)?o:[]}var d={create:"/v1/mgmt/user/create",update:"/v1/mgmt/user/update",delete:"/v1/mgmt/user/delete",load:"/v1/mgmt/user",search:"/v1/mgmt/user/search",updateStatus:"/v1/mgmt/user/update/status",updateEmail:"/v1/mgmt/user/update/email",updatePhone:"/v1/mgmt/user/update/phone",updateDisplayName:"/v1/mgmt/user/update/name",addRole:"/v1/mgmt/user/update/role/add",removeRole:"/v1/mgmt/user/update/role/remove",addTenant:"/v1/mgmt/user/update/tenant/add",removeTenant:"/v1/mgmt/user/update/tenant/remove"},p={create:"/v1/mgmt/accesskey/create",load:"/v1/mgmt/accesskey",search:"/v1/mgmt/accesskey/search",update:"/v1/mgmt/accesskey/update",deactivate:"/v1/mgmt/accesskey/deactivate",activate:"/v1/mgmt/accesskey/activate",delete:"/v1/mgmt/accesskey/delete"},m={create:"/v1/mgmt/tenant/create",update:"/v1/mgmt/tenant/update",delete:"/v1/mgmt/tenant/delete",loadAll:"/v1/mgmt/tenant/all"},c={configure:"/v1/mgmt/sso/settings",metadata:"/v1/mgmt/sso/metadata",mapping:"/v1/mgmt/sso/mapping"},u={update:"/v1/mgmt/jwt/update"},g={create:"/v1/mgmt/permission/create",update:"/v1/mgmt/permission/update",delete:"/v1/mgmt/permission/delete",loadAll:"/v1/mgmt/permission/all"},h={create:"/v1/mgmt/role/create",update:"/v1/mgmt/role/update",delete:"/v1/mgmt/role/delete",loadAll:"/v1/mgmt/role/all"},v={loadAllGroups:"/v1/mgmt/group/all",loadAllGroupsForMember:"/v1/mgmt/group/member/all",loadAllGroupMembers:"/v1/mgmt/group/members"};const f=(e,s)=>({create:(a,n,o,r,i,l)=>t.transformResponse(e.httpClient.post(d.create,{loginId:a,email:n,phone:o,displayName:r,roleNames:i,userTenants:l},{token:s}),(e=>e.user)),update:(a,n,o,r,i,l)=>t.transformResponse(e.httpClient.post(d.update,{loginId:a,email:n,phone:o,displayName:r,roleNames:i,userTenants:l},{token:s}),(e=>e.user)),delete:a=>t.transformResponse(e.httpClient.post(d.delete,{loginId:a},{token:s})),load:a=>t.transformResponse(e.httpClient.get(d.load,{queryParams:{loginId:a},token:s}),(e=>e.user)),loadByUserId:a=>t.transformResponse(e.httpClient.get(d.load,{queryParams:{userId:a},token:s}),(e=>e.user)),searchAll:(a,n,o)=>t.transformResponse(e.httpClient.post(d.search,{tenantIds:a,roleNames:n,limit:o},{token:s}),(e=>e.users)),activate:a=>t.transformResponse(e.httpClient.post(d.updateStatus,{loginId:a,status:"enabled"},{token:s}),(e=>e.user)),deactivate:a=>t.transformResponse(e.httpClient.post(d.updateStatus,{loginId:a,status:"disabled"},{token:s}),(e=>e.user)),updateEmail:(a,n,o)=>t.transformResponse(e.httpClient.post(d.updateEmail,{loginId:a,email:n,verified:o},{token:s}),(e=>e.user)),updatePhone:(a,n,o)=>t.transformResponse(e.httpClient.post(d.updatePhone,{loginId:a,phone:n,verified:o},{token:s}),(e=>e.user)),updateDisplayName:(a,n)=>t.transformResponse(e.httpClient.post(d.updateDisplayName,{loginId:a,displayName:n},{token:s}),(e=>e.user)),addRoles:(a,n)=>t.transformResponse(e.httpClient.post(d.addRole,{loginId:a,roleNames:n},{token:s}),(e=>e.user)),removeRoles:(a,n)=>t.transformResponse(e.httpClient.post(d.removeRole,{loginId:a,roleNames:n},{token:s}),(e=>e.user)),addTenant:(a,n)=>t.transformResponse(e.httpClient.post(d.addTenant,{loginId:a,tenantId:n},{token:s}),(e=>e.user)),removeTenant:(a,n)=>t.transformResponse(e.httpClient.post(d.removeTenant,{loginId:a,tenantId:n},{token:s}),(e=>e.user)),addTenantRoles:(a,n,o)=>t.transformResponse(e.httpClient.post(d.addRole,{loginId:a,tenantId:n,roleNames:o},{token:s}),(e=>e.user)),removeTenantRoles:(a,n,o)=>t.transformResponse(e.httpClient.post(d.removeRole,{loginId:a,tenantId:n,roleNames:o},{token:s}),(e=>e.user))}),k=(e,s)=>({create:(a,n)=>t.transformResponse(e.httpClient.post(m.create,{name:a,selfProvisioningDomains:n},{token:s})),createWithId:(a,n,o)=>t.transformResponse(e.httpClient.post(m.create,{id:a,name:n,selfProvisioningDomains:o},{token:s})),update:(a,n,o)=>t.transformResponse(e.httpClient.post(m.update,{id:a,name:n,selfProvisioningDomains:o},{token:s})),delete:a=>t.transformResponse(e.httpClient.post(m.delete,{id:a},{token:s})),loadAll:()=>t.transformResponse(e.httpClient.get(m.loadAll,{token:s}),(e=>e.tenants))}),y=(e,s)=>({update:(a,n)=>t.transformResponse(e.httpClient.post(u.update,{jwt:a,customClaims:n},{token:s}))}),R=(e,s)=>({create:(a,n)=>t.transformResponse(e.httpClient.post(g.create,{name:a,description:n},{token:s})),update:(a,n,o)=>t.transformResponse(e.httpClient.post(g.update,{name:a,newName:n,description:o},{token:s})),delete:a=>t.transformResponse(e.httpClient.post(g.delete,{name:a},{token:s})),loadAll:()=>t.transformResponse(e.httpClient.get(g.loadAll,{token:s}),(e=>e.permissions))}),C=(e,s)=>({create:(a,n,o)=>t.transformResponse(e.httpClient.post(h.create,{name:a,description:n,permissionNames:o},{token:s})),update:(a,n,o,r)=>t.transformResponse(e.httpClient.post(h.update,{name:a,newName:n,description:o,permissionNames:r},{token:s})),delete:a=>t.transformResponse(e.httpClient.post(h.delete,{name:a},{token:s})),loadAll:()=>t.transformResponse(e.httpClient.get(h.loadAll,{token:s}),(e=>e.roles))}),w=(e,s)=>({loadAllGroups:a=>t.transformResponse(e.httpClient.post(v.loadAllGroups,{tenantId:a},{token:s})),loadAllGroupsForMember:(a,n,o)=>t.transformResponse(e.httpClient.post(v.loadAllGroupsForMember,{tenantId:a,loginIds:o,userIds:n},{token:s})),loadAllGroupMembers:(a,n)=>t.transformResponse(e.httpClient.post(v.loadAllGroupMembers,{tenantId:a,groupId:n},{token:s}))}),b=(e,s)=>({configureSettings:(a,n,o,r,i)=>t.transformResponse(e.httpClient.post(c.configure,{tenantId:a,idpURL:n,entityId:r,idpCert:o,redirectURL:i},{token:s})),configureMetadata:(a,n)=>t.transformResponse(e.httpClient.post(c.metadata,{tenantId:a,idpMetadataURL:n},{token:s})),configureMapping:(a,n,o)=>t.transformResponse(e.httpClient.post(c.mapping,{tenantId:a,roleMapping:n,attributeMapping:o},{token:s}))}),I=(e,s)=>({create:(a,n,o,r)=>t.transformResponse(e.httpClient.post(p.create,{name:a,expireTime:n,roleNames:o,keyTenants:r},{token:s})),load:a=>t.transformResponse(e.httpClient.get(p.load,{queryParams:{id:a},token:s}),(e=>e.key)),searchAll:a=>t.transformResponse(e.httpClient.post(p.search,{tenantIds:a},{token:s}),(e=>e.keys)),update:(a,n)=>t.transformResponse(e.httpClient.post(p.update,{id:a,name:n},{token:s}),(e=>e.key)),deactivate:a=>t.transformResponse(e.httpClient.post(p.deactivate,{id:a},{token:s})),activate:a=>t.transformResponse(e.httpClient.post(p.activate,{id:a},{token:s})),delete:a=>t.transformResponse(e.httpClient.post(p.delete,{id:a},{token:s}))});globalThis.fetch=r.default,globalThis.Headers=a.Headers,globalThis.Request=a.Request,globalThis.Response=a.Response;const A=a=>{var n,{managementKey:r}=a,d=e.__rest(a,["managementKey"]);const p=o.default(Object.assign(Object.assign({},d),{baseHeaders:Object.assign(Object.assign({},d.baseHeaders),{"x-descope-sdk-name":"nodejs","x-descope-sdk-node-version":(null===(n=null===process||void 0===process?void 0:process.versions)||void 0===n?void 0:n.node)||"","x-descope-sdk-version":"1.0.4"})})),{projectId:m,logger:c}=d,u={},g=((e,t)=>({user:f(e,t),accessKey:I(e,t),tenant:k(e,t),sso:b(e,t),jwt:y(e,t),permission:R(e,t),role:C(e,t),group:w(e,t)}))(p,r),h=Object.assign(Object.assign({},p),{management:g,async getKey(e){if(!(null==e?void 0:e.kid))throw Error("header.kid must not be empty");if(u[e.kid])return u[e.kid];if(Object.assign(u,await(async()=>{const e=(await p.httpClient.get(`v2/keys/${m}`).then((e=>e.json()))).keys;return Array.isArray(e)?(await Promise.all(e.map((async e=>[e.kid,await s.importJWK(e)])))).reduce(((e,[t,s])=>t?Object.assign(Object.assign({},e),{[t.toString()]:s}):e),{}):{}})()),!u[e.kid])throw Error("failed to fetch matching key");return u[e.kid]},async validateJwt(e){var t;const a=(await s.jwtVerify(e,h.getKey,{clockTolerance:5})).payload;if(a&&(a.iss=null===(t=a.iss)||void 0===t?void 0:t.split("/").pop(),a.iss!==m))throw new s.errors.JWTClaimValidationFailed('unexpected "iss" claim value',"iss","check_failed");return{jwt:e,token:a}},async validateSession(e){if(!e)throw Error("session token is required for validation");try{return await h.validateJwt(e)}catch(e){throw null==c||c.error("session validation failed",e),Error("session validation failed")}},async refreshSession(e){var t,s;if(!e)throw Error("refresh token is required to refresh a session");try{await h.validateJwt(e);const a=await h.refresh(e);if(a.ok){return await h.validateJwt(null===(t=a.data)||void 0===t?void 0:t.sessionJwt)}throw Error(null===(s=a.error)||void 0===s?void 0:s.errorMessage)}catch(e){throw null==c||c.error("refresh token validation failed",e),Error("refresh token validation failed")}},async validateAndRefreshSession(e,t){if(!e&&!t)throw Error("both session and refresh tokens are empty");try{return await h.validateSession(e)}catch(e){null==c||c.log("session validation failed - trying to refresh it")}return h.refreshSession(t)},async exchangeAccessKey(e){if(!e)throw Error("access key must not be empty");let t;try{t=await h.accessKey.exchange(e)}catch(e){throw null==c||c.error("failed to exchange access key",e),Error("could not exchange access key")}const{sessionJwt:s}=t.data;if(!s)throw null==c||c.error("failed to parse exchange access key response"),Error("could not exchange access key");try{return await h.validateJwt(s)}catch(e){throw null==c||c.error("failed to parse jwt from access key",e),Error("could not exchange access key")}},validatePermissions:(e,t)=>h.validateTenantPermissions(e,null,t),validateTenantPermissions(e,t,s){const a=l(e,"permissions",t);return s.every((e=>a.includes(e)))},validateRoles:(e,t)=>h.validateTenantRoles(e,null,t),validateTenantRoles(e,t,s){const a=l(e,"roles",t);return s.every((e=>a.includes(e)))}});return t.wrapWith(h,["otp.verify.email","otp.verify.sms","otp.verify.whatsapp","magicLink.verify","enchantedLink.signUp","enchantedLink.signIn","oauth.exchange","saml.exchange","totp.verify","webauthn.signIn.finish","webauthn.signUp.finish","refresh"],i)};A.RefreshTokenCookieName="DSR",A.SessionTokenCookieName="DS",module.exports=A;
2
2
  //# sourceMappingURL=index.cjs.js.map
package/dist/cjs/index.cjs.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"index.cjs.js","sources":["../../lib/constants.ts","../../lib/helpers.ts","../../lib/management/paths.ts","../../lib/management/user.ts","../../lib/management/tenant.ts","../../lib/management/jwt.ts","../../lib/management/permission.ts","../../lib/management/role.ts","../../lib/index.ts","../../lib/management/index.ts"],"sourcesContent":["// eslint-disable-next-line import/prefer-default-export\n/** Refresh JWT cookie name */\nexport const refreshTokenCookieName = 'DSR';\n/** Session JWT cookie name */\nexport const sessionTokenCookieName = 'DS';\n/** The key of the tenants claims in the claims map */\nexport const authorizedTenantsClaimName = 'tenants';\n/** The key of the permissions claims in the claims map either under tenant or top level */\nexport const permissionsClaimName = 'permissions';\n/** The key of the roles claims in the claims map either under tenant or top level */\nexport const rolesClaimName = 'roles';\n","import type { ResponseData, SdkResponse } from '@descope/core-js-sdk';\nimport { AuthenticationInfo } from './types';\nimport {\n refreshTokenCookieName,\n sessionTokenCookieName,\n authorizedTenantsClaimName,\n} from './constants';\n\n/**\n * Generate a cookie string from given parameters\n * @param name name of the cookie\n * @param value value of cookie that must be already encoded\n * @param options any options to put on the cookie like cookieDomain, cookieMaxAge, cookiePath\n * @returns Cookie string with all options on the string\n */\nconst generateCookie = (name: string, value: string, options?: Record<string, string | number>) =>\n `${name}=${value}; Domain=${options?.cookieDomain || ''}; Max-Age=${\n options?.cookieMaxAge || ''\n }; Path=${options?.cookiePath || '/'}; HttpOnly; SameSite=Strict`;\n\n/**\n * Parse the cookie string and return the value of the cookie\n * @param cookie the raw cookie string\n * @param name the name of the cookie to get value for\n * @returns the value of the given cookie\n */\nconst getCookieValue = (cookie: string | null | undefined, name: string) => {\n const match = cookie?.match(RegExp(`(?:^|;\\\\s*)${name}=([^;]*)`));\n return match ? match[1] : null;\n};\n\n// eslint-disable-next-line import/prefer-default-export\n/**\n * Add cookie generation to core-js functions.\n * @param fn the function we are wrapping\n * @returns Wrapped function with cookie generation\n */\nexport const withCookie =\n <T extends Array<any>, U extends Promise<SdkResponse<ResponseData>>>(fn: (...args: T) => U) =>\n async (...args: T): Promise<SdkResponse<ResponseData>> => {\n const resp = await fn(...args);\n\n // istanbul ignore next\n if (!resp.data) {\n return resp;\n }\n\n // eslint-disable-next-line prefer-const\n let { sessionJwt, refreshJwt, ...rest } = resp.data;\n const cookies = [generateCookie(sessionTokenCookieName, sessionJwt, rest)];\n\n if (!refreshJwt) {\n if (resp.response?.headers.get('set-cookie')) {\n refreshJwt = getCookieValue(\n resp.response?.headers.get('set-cookie'),\n refreshTokenCookieName,\n );\n cookies.push(resp.response?.headers.get('set-cookie')!);\n }\n } else {\n cookies.push(generateCookie(refreshTokenCookieName, refreshJwt, rest));\n }\n\n return { ...resp, data: { ...resp.data, refreshJwt, cookies } };\n };\n\n/**\n * Wrap given object internal functions (can be deep inside the object) with the given wrapping function\n * @param obj we will deep wrap functions inside this object based on the given path\n * @param path the path of internal objects to walk before wrapping the final result. Path is collection of parts separated by '.' that support '*' to say all of the keys for the part.\n * @param wrappingFn function to wrap with\n * @returns void, we update the functions in place\n */\nexport const wrapWith = <T extends Record<string, any>>(\n obj: T,\n path: string | string[],\n wrappingFn: Function,\n // eslint-disable-next-line consistent-return\n): void => {\n if (!obj) return;\n\n const pathSections = typeof path === 'string' ? path.split('.') : path;\n const section = pathSections.shift() || ('' as keyof T);\n\n if (pathSections.length === 0 || section === '*') {\n const wrap = (key: keyof T) => {\n if (key && typeof obj[key] === 'function') {\n // eslint-disable-next-line no-param-reassign\n obj[key] = wrappingFn(obj[key]);\n } else {\n // istanbul ignore next\n throw Error(`cannot wrap value at key \"${key.toString()}\"`);\n }\n };\n if (section === '*') {\n Object.keys(obj).forEach(wrap);\n } else {\n wrap(section);\n }\n } else {\n wrapWith(obj[section], pathSections, wrappingFn);\n }\n};\n\n/**\n * Wrap given object internal functions (can be deep inside the object) with the given wrapping function based on multiple paths.\n * @param obj we will deep wrap functions inside this object based on the given paths\n * @param paths multiple paths of internal objects to walk before wrapping the final result. Path is collection of parts separated by '.' that support '*' to say all of the keys for the part.\n * @param wrappingFn function to wrap with\n * @returns void, we update the functions in place\n */\nexport const bulkWrapWith = (\n obj: Parameters<typeof wrapWith>[0],\n paths: string[],\n wrappingFn: Parameters<typeof wrapWith>[2],\n) => paths.forEach((path: string) => wrapWith(obj, path, wrappingFn));\n\n/**\n * Get the claim (used for permissions or roles) for a given tenant or top level if tenant is empty\n * @param authInfo The parsed authentication info from the JWT\n * @param claim name of the claim\n * @param tenant tenant to retrieve the claim for\n * @returns\n */\nexport function getAuthorizationClaimItems(\n authInfo: AuthenticationInfo,\n claim: string,\n tenant?: string,\n): string[] {\n const value = tenant\n ? authInfo.token[authorizedTenantsClaimName]?.[tenant]?.[claim]\n : authInfo.token[claim];\n return Array.isArray(value) ? value : [];\n}\n","/** API paths for the Descope service Management APIs */\nexport default {\n user: {\n create: '/v1/mgmt/user/create',\n update: '/v1/mgmt/user/update',\n delete: '/v1/mgmt/user/delete',\n load: '/v1/mgmt/user/load',\n search: '/v1/mgmt/user/search',\n },\n tenant: {\n create: '/v1/mgmt/tenant/create',\n update: '/v1/mgmt/tenant/update',\n delete: '/v1/mgmt/tenant/delete',\n },\n jwt: {\n update: '/v1/mgmt/jwt/update',\n },\n permission: {\n create: '/v1/mgmt/permission/create',\n update: '/v1/mgmt/permission/update',\n delete: '/v1/mgmt/permission/delete',\n loadAll: '/v1/mgmt/permission/all',\n },\n role: {\n create: '/v1/mgmt/role/create',\n update: '/v1/mgmt/role/update',\n delete: '/v1/mgmt/role/delete',\n loadAll: '/v1/mgmt/role/all',\n },\n};\n","import { SdkResponse, transformResponse, UserResponse } from '@descope/core-js-sdk';\nimport { CoreSdk } from '../types';\nimport apiPaths from './paths';\nimport { UserTenant } from './types';\n\ntype SingleUserResponse = {\n user: UserResponse;\n};\n\ntype MultipleUsersResponse = {\n users: UserResponse[];\n};\n\nconst withUser = (sdk: CoreSdk, managementKey?: string) => ({\n create: (\n identifier: string,\n email?: string,\n phone?: string,\n displayName?: string,\n roleNames?: string[],\n userTenants?: UserTenant[],\n ): Promise<SdkResponse<UserResponse>> =>\n transformResponse<SingleUserResponse, UserResponse>(\n sdk.httpClient.post(\n apiPaths.user.create,\n { identifier, email, phone, displayName, roleNames, userTenants },\n { token: managementKey },\n ),\n (data) => data.user,\n ),\n update: (\n identifier: string,\n email?: string,\n phone?: string,\n displayName?: string,\n roleNames?: string[],\n userTenants?: UserTenant[],\n ): Promise<SdkResponse<UserResponse>> =>\n transformResponse<SingleUserResponse, UserResponse>(\n sdk.httpClient.post(\n apiPaths.user.update,\n { identifier, email, phone, displayName, roleNames, userTenants },\n { token: managementKey },\n ),\n (data) => data.user,\n ),\n delete: (identifier: string): Promise<SdkResponse<never>> =>\n transformResponse(\n sdk.httpClient.post(apiPaths.user.delete, { identifier }, { token: managementKey }),\n ),\n load: (identifier: string): Promise<SdkResponse<UserResponse>> =>\n transformResponse<SingleUserResponse, UserResponse>(\n sdk.httpClient.get(apiPaths.user.load, {\n queryParams: { identifier },\n token: managementKey,\n }),\n (data) => data.user,\n ),\n searchAll: (\n tenantIds?: string[],\n roleNames?: string[],\n limit?: number,\n ): Promise<SdkResponse<UserResponse[]>> =>\n transformResponse<MultipleUsersResponse, UserResponse[]>(\n sdk.httpClient.post(\n apiPaths.user.search,\n { tenantIds, roleNames, limit },\n { token: managementKey },\n ),\n (data) => data.users,\n ),\n});\n\nexport default withUser;\n","import { SdkResponse, transformResponse } from '@descope/core-js-sdk';\nimport { CoreSdk } from '../types';\nimport apiPaths from './paths';\nimport { CreateTenantResponse } from './types';\n\nconst withTenant = (sdk: CoreSdk, managementKey?: string) => ({\n create: (\n name: string,\n selfProvisioningDomains?: string[],\n ): Promise<SdkResponse<CreateTenantResponse>> =>\n transformResponse(\n sdk.httpClient.post(\n apiPaths.tenant.create,\n { name, selfProvisioningDomains },\n { token: managementKey },\n ),\n ),\n createWithId: (\n tenantId: string,\n name: string,\n selfProvisioningDomains?: string[],\n ): Promise<SdkResponse<never>> =>\n transformResponse(\n sdk.httpClient.post(\n apiPaths.tenant.create,\n { tenantId, name, selfProvisioningDomains },\n { token: managementKey },\n ),\n ),\n update: (\n tenantId: string,\n name: string,\n selfProvisioningDomains?: string[],\n ): Promise<SdkResponse<never>> =>\n transformResponse(\n sdk.httpClient.post(\n apiPaths.tenant.update,\n { tenantId, name, selfProvisioningDomains },\n { token: managementKey },\n ),\n ),\n delete: (tenantId: string): Promise<SdkResponse<never>> =>\n transformResponse(\n sdk.httpClient.post(apiPaths.tenant.delete, { tenantId }, { token: managementKey }),\n ),\n});\n\nexport default withTenant;\n","import { SdkResponse, transformResponse } from '@descope/core-js-sdk';\nimport { CoreSdk } from '../types';\nimport apiPaths from './paths';\nimport { UpdateJWTResponse } from './types';\n\nconst withJWT = (sdk: CoreSdk, managementKey?: string) => ({\n update: (\n jwt: string,\n customClaims?: Record<string, any>,\n ): Promise<SdkResponse<UpdateJWTResponse>> =>\n transformResponse(\n sdk.httpClient.post(apiPaths.jwt.update, { jwt, customClaims }, { token: managementKey }),\n ),\n});\n\nexport default withJWT;\n","import { SdkResponse, transformResponse } from '@descope/core-js-sdk';\nimport { CoreSdk } from '../types';\nimport apiPaths from './paths';\nimport { Permission } from './types';\n\ntype MultiplePermissionResponse = {\n permissions: Permission[];\n};\n\nconst withPermission = (sdk: CoreSdk, managementKey?: string) => ({\n create: (name: string, description?: string): Promise<SdkResponse<never>> =>\n transformResponse(\n sdk.httpClient.post(\n apiPaths.permission.create,\n { name, description },\n { token: managementKey },\n ),\n ),\n update: (name: string, newName: string, description?: string): Promise<SdkResponse<never>> =>\n transformResponse(\n sdk.httpClient.post(\n apiPaths.permission.update,\n { name, newName, description },\n { token: managementKey },\n ),\n ),\n delete: (name: string): Promise<SdkResponse<never>> =>\n transformResponse(\n sdk.httpClient.post(apiPaths.permission.delete, { name }, { token: managementKey }),\n ),\n loadAll: (): Promise<SdkResponse<Permission[]>> =>\n transformResponse<MultiplePermissionResponse, Permission[]>(\n sdk.httpClient.get(apiPaths.permission.loadAll, {\n token: managementKey,\n }),\n (data) => data.permissions,\n ),\n});\n\nexport default withPermission;\n","import { SdkResponse, transformResponse } from '@descope/core-js-sdk';\nimport { CoreSdk } from '../types';\nimport apiPaths from './paths';\nimport { Role } from './types';\n\ntype MultipleRoleResponse = {\n roles: Role[];\n};\n\nconst withRole = (sdk: CoreSdk, managementKey?: string) => ({\n create: (\n name: string,\n description?: string,\n permissionNames?: string[],\n ): Promise<SdkResponse<never>> =>\n transformResponse(\n sdk.httpClient.post(\n apiPaths.role.create,\n { name, description, permissionNames },\n { token: managementKey },\n ),\n ),\n update: (\n name: string,\n newName: string,\n description?: string,\n permissionNames?: string[],\n ): Promise<SdkResponse<never>> =>\n transformResponse(\n sdk.httpClient.post(\n apiPaths.role.update,\n { name, newName, description, permissionNames },\n { token: managementKey },\n ),\n ),\n delete: (name: string): Promise<SdkResponse<never>> =>\n transformResponse(\n sdk.httpClient.post(apiPaths.role.delete, { name }, { token: managementKey }),\n ),\n loadAll: (): Promise<SdkResponse<Role[]>> =>\n transformResponse<MultipleRoleResponse, Role[]>(\n sdk.httpClient.get(apiPaths.role.loadAll, {\n token: managementKey,\n }),\n (data) => data.roles,\n ),\n});\n\nexport default withRole;\n","import createSdk, {\n SdkResponse,\n ExchangeAccessKeyResponse,\n RequestConfig,\n} from '@descope/core-js-sdk';\nimport { KeyLike, jwtVerify, JWK, JWTHeaderParameters, importJWK, errors } from 'jose';\nimport fetch, { Headers, Response, Request } from 'node-fetch';\nimport { bulkWrapWith, withCookie, getAuthorizationClaimItems } from './helpers';\nimport withManagement from './management';\nimport { AuthenticationInfo } from './types';\nimport {\n refreshTokenCookieName,\n sessionTokenCookieName,\n permissionsClaimName,\n rolesClaimName,\n} from './constants';\n\ndeclare const BUILD_VERSION: string;\n\n/* istanbul ignore next */\nif (!globalThis.fetch) {\n // @ts-ignore\n globalThis.fetch = fetch;\n // @ts-ignore\n globalThis.Headers = Headers;\n // @ts-ignore\n globalThis.Request = Request;\n // @ts-ignore\n globalThis.Response = Response;\n}\n\n/** Configuration arguments which include the Descope core SDK args and an optional management key */\ntype NodeSdkArgs = Parameters<typeof createSdk>[0] & {\n managementKey?: string;\n};\n\nconst nodeSdk = (args: NodeSdkArgs) => {\n // eslint-disable-next-line no-param-reassign\n args.hooks = args.hooks || {};\n\n const origBeforeRequest = args.hooks.beforeRequest;\n // eslint-disable-next-line no-param-reassign\n args.hooks.beforeRequest = (config: RequestConfig) => {\n const conf = config;\n conf.headers = {\n ...conf.headers,\n 'x-descope-sdk-name': 'nodejs',\n 'x-descope-sdk-node-version': process?.versions?.node || '',\n 'x-descope-sdk-version': BUILD_VERSION,\n };\n return origBeforeRequest?.(conf) || conf;\n };\n\n const coreSdk = createSdk(args);\n\n bulkWrapWith(\n coreSdk,\n [\n 'otp.verify.*',\n 'magicLink.verify',\n 'enchantedLink.signUp.*',\n 'enchantedLink.signIn.*',\n 'oauth.exchange',\n 'saml.exchange',\n 'totp.verify',\n 'webauthn.signIn.finish',\n 'webauthn.signUp.finish',\n 'refresh',\n ],\n withCookie,\n );\n\n const { projectId, logger } = args;\n\n const keys: Record<string, KeyLike | Uint8Array> = {};\n\n /** Fetch the public keys (JWKs) from Descope for the configured project */\n const fetchKeys = async () => {\n const keysWrapper = await coreSdk.httpClient\n .get(`v2/keys/${projectId}`)\n .then((resp) => resp.json());\n const publicKeys: JWK[] = keysWrapper.keys;\n if (!Array.isArray(publicKeys)) return {};\n const kidJwksPairs = await Promise.all(\n publicKeys.map(async (key) => [key.kid, await importJWK(key)]),\n );\n\n return kidJwksPairs.reduce(\n (acc, [kid, jwk]) => (kid ? { ...acc, [kid.toString()]: jwk } : acc),\n {},\n );\n };\n\n const management = withManagement(coreSdk, args.managementKey);\n\n const sdk = {\n ...coreSdk,\n\n /**\n * Provides various APIs for managing a Descope project programmatically. A management key must\n * be provided as an argument when initializing the SDK to use these APIs. Management keys can be\n * generated in the Descope console.\n */\n management,\n\n /** Get the key that can validate the given JWT KID in the header. Can retrieve the public key from local cache or from Descope. */\n async getKey(header: JWTHeaderParameters): Promise<KeyLike | Uint8Array> {\n if (!header?.kid) throw Error('header.kid must not be empty');\n\n if (keys[header.kid]) return keys[header.kid];\n\n // do we need to fetch once or every time?\n Object.assign(keys, await fetchKeys());\n\n if (!keys[header.kid]) throw Error('failed to fetch matching key');\n\n return keys[header.kid];\n },\n\n /**\n * Validate the given JWT with the right key and make sure the issuer is correct\n * @param jwt the JWT string to parse and validate\n * @returns AuthenticationInfo with the parsed token and JWT. Will throw an error if validation fails.\n */\n async validateJwt(jwt: string): Promise<AuthenticationInfo> {\n // Do not hard-code the algo because library does not support `None` so all are valid\n const res = await jwtVerify(jwt, sdk.getKey, { clockTolerance: 5 });\n const token = res.payload;\n\n if (token) {\n token.iss = token.iss?.split('/').pop(); // support both url and project id as issuer\n if (token.iss !== projectId) {\n // We must do the verification here, since issuer can be either project ID or URL\n throw new errors.JWTClaimValidationFailed(\n 'unexpected \"iss\" claim value',\n 'iss',\n 'check_failed',\n );\n }\n }\n\n return { jwt, token };\n },\n\n /**\n * Validate session based on at least one of session and refresh JWTs. You must provide at least one of them.\n *\n * @param sessionToken session JWT\n * @param refreshToken refresh JWT\n * @returns AuthenticationInfo promise or throws Error if there is an issue with JWTs\n */\n async validateSession(\n sessionToken?: string,\n refreshToken?: string,\n ): Promise<AuthenticationInfo> {\n if (!sessionToken && !refreshToken)\n throw Error('both refresh token and session token are empty');\n\n if (sessionToken) {\n try {\n const token = await sdk.validateJwt(sessionToken);\n return token;\n } catch (error) {\n if (!refreshToken) {\n logger?.error('failed to validate session token and no refresh token provided', error);\n throw Error('could not validate tokens');\n }\n }\n }\n if (refreshToken) {\n try {\n await sdk.validateJwt(refreshToken);\n const jwtResp = await sdk.refresh(refreshToken);\n if (jwtResp.ok) {\n const token = await sdk.validateJwt(jwtResp.data?.sessionJwt);\n return token;\n }\n throw Error(jwtResp.error?.message);\n } catch (refreshTokenErr) {\n logger?.error('failed to validate refresh token', refreshTokenErr);\n throw Error('could not validate tokens');\n }\n }\n /* istanbul ignore next */\n throw Error('could not validate token');\n },\n\n /**\n * Exchange API key (access key) for a session key\n * @param accessKey access key to exchange for a session JWT\n * @returns AuthneticationInfo with session JWT data\n */\n async exchangeAccessKey(accessKey: string): Promise<AuthenticationInfo> {\n if (!accessKey) throw Error('access key must not be empty');\n\n let resp: SdkResponse<ExchangeAccessKeyResponse>;\n try {\n resp = await sdk.accessKey.exchange(accessKey);\n } catch (error) {\n logger?.error('failed to exchange access key', error);\n throw Error('could not exchange access key');\n }\n\n const { sessionJwt } = resp.data;\n if (!sessionJwt) {\n logger?.error('failed to parse exchange access key response');\n throw Error('could not exchange access key');\n }\n\n try {\n const token = await sdk.validateJwt(sessionJwt);\n return token;\n } catch (error) {\n logger?.error('failed to parse jwt from access key', error);\n throw Error('could not exchange access key');\n }\n },\n\n /**\n * Make sure that all given permissions exist on the parsed JWT top level claims\n * @param authInfo JWT parsed info\n * @param permissions list of permissions to make sure they exist on te JWT claims\n * @returns true if all permissions exist, false otherwise\n */\n validatePermissions(authInfo: AuthenticationInfo, permissions: string[]): boolean {\n return sdk.validateTenantPermissions(authInfo, null, permissions);\n },\n\n /**\n * Make sure that all given permissions exist on the parsed JWT tenant claims\n * @param authInfo JWT parsed info\n * @param permissions list of permissions to make sure they exist on te JWT claims\n * @returns true if all permissions exist, false otherwise\n */\n validateTenantPermissions(\n authInfo: AuthenticationInfo,\n tenant: string,\n permissions: string[],\n ): boolean {\n const granted = getAuthorizationClaimItems(authInfo, permissionsClaimName, tenant);\n return permissions.every((perm) => granted.includes(perm));\n },\n\n /**\n * Make sure that all given roles exist on the parsed JWT top level claims\n * @param authInfo JWT parsed info\n * @param roles list of roles to make sure they exist on te JWT claims\n * @returns true if all roles exist, false otherwise\n */\n validateRoles(authInfo: AuthenticationInfo, roles: string[]): boolean {\n return sdk.validateTenantRoles(authInfo, null, roles);\n },\n\n /**\n * Make sure that all given roles exist on the parsed JWT tenant claims\n * @param authInfo JWT parsed info\n * @param roles list of roles to make sure they exist on te JWT claims\n * @returns true if all roles exist, false otherwise\n */\n validateTenantRoles(authInfo: AuthenticationInfo, tenant: string, roles: string[]): boolean {\n const membership = getAuthorizationClaimItems(authInfo, rolesClaimName, tenant);\n return roles.every((role) => membership.includes(role));\n },\n };\n\n return sdk;\n};\n\n/** Descope SDK client with delivery methods enum.\n *\n * Please see full documentation at {@link https://docs.descope.com/guides Descope Docs}\n * @example Usage\n *\n * ```js\n * import descopeSdk from '@descope/node-sdk';\n *\n * const myProjectId = 'xxx';\n * const sdk = descopeSdk({ projectId: myProjectId });\n *\n * const userIdentifier = 'identifier';\n * sdk.otp.signIn.email(userIdentifier);\n * const jwtResponse = sdk.otp.verify.email(userIdentifier, codeFromEmail);\n * ```\n */\nconst sdkWithAttributes = nodeSdk as typeof nodeSdk & {\n DeliveryMethods: typeof createSdk.DeliveryMethods;\n RefreshTokenCookieName: typeof refreshTokenCookieName;\n SessionTokenCookieName: typeof sessionTokenCookieName;\n};\n\nsdkWithAttributes.DeliveryMethods = createSdk.DeliveryMethods;\nsdkWithAttributes.RefreshTokenCookieName = refreshTokenCookieName;\nsdkWithAttributes.SessionTokenCookieName = sessionTokenCookieName;\n\nexport default sdkWithAttributes;\n\nexport type { NodeSdkArgs };\n\nexport type { DeliveryMethod, OAuthProvider } from '@descope/core-js-sdk';\n","import { CoreSdk } from '../types';\nimport withUser from './user';\nimport withTenant from './tenant';\nimport withJWT from './jwt';\nimport withPermission from './permission';\nimport withRole from './role';\n\n/** Constructs a higher level Management API that wraps the functions from code-js-sdk */\nconst withManagement = (sdk: CoreSdk, managementKey?: string) => ({\n user: withUser(sdk, managementKey),\n tenant: withTenant(sdk, managementKey),\n jwt: withJWT(sdk, managementKey),\n permission: withPermission(sdk, managementKey),\n role: withRole(sdk, managementKey),\n});\n\nexport default withManagement;\n"],"names":["generateCookie","name","value","options","cookieDomain","cookieMaxAge","cookiePath","withCookie","fn","async","args","resp","data","_d","sessionJwt","refreshJwt","rest","__rest","cookies","push","_a","response","headers","get","cookie","match","RegExp","getCookieValue","_b","_c","Object","assign","wrapWith","obj","path","wrappingFn","pathSections","split","section","shift","length","wrap","key","Error","toString","keys","forEach","getAuthorizationClaimItems","authInfo","claim","tenant","token","Array","isArray","apiPaths","create","update","delete","load","search","loadAll","withUser","sdk","managementKey","identifier","email","phone","displayName","roleNames","userTenants","transformResponse","httpClient","post","user","queryParams","searchAll","tenantIds","limit","users","withTenant","selfProvisioningDomains","createWithId","tenantId","withJWT","jwt","customClaims","withPermission","description","newName","permissions","withRole","permissionNames","roles","globalThis","fetch","Headers","Request","Response","sdkWithAttributes","hooks","origBeforeRequest","beforeRequest","config","conf","process","versions","node","coreSdk","createSdk","projectId","logger","management","permission","role","withManagement","header","kid","publicKeys","then","json","Promise","all","map","importJWK","reduce","acc","jwk","fetchKeys","jwtVerify","getKey","clockTolerance","payload","iss","pop","errors","JWTClaimValidationFailed","sessionToken","refreshToken","validateJwt","error","jwtResp","refresh","ok","message","refreshTokenErr","accessKey","exchange","validatePermissions","validateTenantPermissions","granted","every","perm","includes","validateRoles","validateTenantRoles","membership","DeliveryMethods","RefreshTokenCookieName","SessionTokenCookieName"],"mappings":"0MAEO,MCaDA,EAAiB,CAACC,EAAcC,EAAeC,IACnD,GAAGF,KAAQC,cAAiBC,aAAA,EAAAA,EAASC,eAAgB,gBACnDD,aAAA,EAAAA,EAASE,eAAgB,aACjBF,aAAA,EAAAA,EAASG,aAAc,iCAmBtBC,EAC0DC,GACrEC,SAAUC,eACR,MAAMC,QAAaH,KAAME,GAGzB,IAAKC,EAAKC,KACR,OAAOD,EAIT,IAAIE,EAAsCF,EAAKC,MAA3CE,WAAEA,EAAUC,WAAEA,KAAeC,EAA7BC,EAAAA,OAAAJ,EAAA,CAAA,aAAA,eACJ,MAAMK,EAAU,CAAClB,ED7CiB,KC6CsBc,EAAYE,IAcpE,OAZKD,EASHG,EAAQC,KAAKnB,ED1DmB,MC0DoBe,EAAYC,KAR/C,QAAbI,EAAAT,EAAKU,gBAAQ,IAAAD,OAAA,EAAAA,EAAEE,QAAQC,IAAI,iBAC7BR,EA3Be,EAACS,EAAmCvB,KACzD,MAAMwB,EAAQD,eAAAA,EAAQC,MAAMC,OAAO,cAAczB,cACjD,OAAOwB,EAAQA,EAAM,GAAK,IAAI,EAyBXE,CACE,QAAbC,EAAAjB,EAAKU,gBAAQ,IAAAO,OAAA,EAAAA,EAAEN,QAAQC,IAAI,cDpDC,OCuD9BL,EAAQC,KAAoB,QAAfU,EAAAlB,EAAKU,gBAAU,IAAAQ,OAAA,EAAAA,EAAAP,QAAQC,IAAI,gBAMhCO,OAAAC,OAAAD,OAAAC,OAAA,CAAA,EAAApB,GAAM,CAAAC,KAAWkB,OAAAC,OAAAD,OAAAC,OAAA,GAAApB,EAAKC,MAAM,CAAAG,aAAYG,aAAY,EAUvDc,EAAW,CACtBC,EACAC,EACAC,KAGA,IAAKF,EAAK,OAEV,MAAMG,EAA+B,iBAATF,EAAoBA,EAAKG,MAAM,KAAOH,EAC5DI,EAAUF,EAAaG,SAAY,GAEzC,GAA4B,IAAxBH,EAAaI,QAA4B,MAAZF,EAAiB,CAChD,MAAMG,EAAQC,IACZ,IAAIA,GAA2B,mBAAbT,EAAIS,GAKpB,MAAMC,MAAM,6BAA6BD,EAAIE,eAH7CX,EAAIS,GAAOP,EAAWF,EAAIS,GAI3B,EAEa,MAAZJ,EACFR,OAAOe,KAAKZ,GAAKa,QAAQL,GAEzBA,EAAKH,EAER,MACCN,EAASC,EAAIK,GAAUF,EAAcD,EACtC,WAuBaY,EACdC,EACAC,EACAC,WAEA,MAAMhD,EAAQgD,EAC0C,QAApDtB,EAA6C,QAA7CR,EAAA4B,EAASG,MAAgC,eAAI,IAAA/B,OAAA,EAAAA,EAAA8B,UAAO,IAAAtB,OAAA,EAAAA,EAAGqB,GACvDD,EAASG,MAAMF,GACnB,OAAOG,MAAMC,QAAQnD,GAASA,EAAQ,EACxC,CCpIA,IAAeoD,EACP,CACJC,OAAQ,uBACRC,OAAQ,uBACRC,OAAQ,uBACRC,KAAM,qBACNC,OAAQ,wBANGL,EAQL,CACNC,OAAQ,yBACRC,OAAQ,yBACRC,OAAQ,0BAXGH,EAaR,CACHE,OAAQ,uBAdGF,EAgBD,CACVC,OAAQ,6BACRC,OAAQ,6BACRC,OAAQ,6BACRG,QAAS,2BApBEN,EAsBP,CACJC,OAAQ,uBACRC,OAAQ,uBACRC,OAAQ,uBACRG,QAAS,qBCdb,MAAMC,EAAW,CAACC,EAAcC,KAA4B,CAC1DR,OAAQ,CACNS,EACAC,EACAC,EACAC,EACAC,EACAC,IAEAC,EAAAA,kBACER,EAAIS,WAAWC,KACblB,EAAcC,OACd,CAAES,aAAYC,QAAOC,QAAOC,cAAaC,YAAWC,eACpD,CAAElB,MAAOY,KAEVnD,GAASA,EAAK6D,OAEnBjB,OAAQ,CACNQ,EACAC,EACAC,EACAC,EACAC,EACAC,IAEAC,EAAAA,kBACER,EAAIS,WAAWC,KACblB,EAAcE,OACd,CAAEQ,aAAYC,QAAOC,QAAOC,cAAaC,YAAWC,eACpD,CAAElB,MAAOY,KAEVnD,GAASA,EAAK6D,OAEnBhB,OAASO,GACPM,EAAAA,kBACER,EAAIS,WAAWC,KAAKlB,EAAcG,OAAQ,CAAEO,cAAc,CAAEb,MAAOY,KAEvEL,KAAOM,GACLM,EAAAA,kBACER,EAAIS,WAAWhD,IAAI+B,EAAcI,KAAM,CACrCgB,YAAa,CAAEV,cACfb,MAAOY,KAERnD,GAASA,EAAK6D,OAEnBE,UAAW,CACTC,EACAR,EACAS,IAEAP,EAAAA,kBACER,EAAIS,WAAWC,KACblB,EAAcK,OACd,CAAEiB,YAAWR,YAAWS,SACxB,CAAE1B,MAAOY,KAEVnD,GAASA,EAAKkE,UChEfC,EAAa,CAACjB,EAAcC,KAA4B,CAC5DR,OAAQ,CACNtD,EACA+E,IAEAV,EAAiBA,kBACfR,EAAIS,WAAWC,KACblB,EAAgBC,OAChB,CAAEtD,OAAM+E,2BACR,CAAE7B,MAAOY,KAGfkB,aAAc,CACZC,EACAjF,EACA+E,IAEAV,EAAAA,kBACER,EAAIS,WAAWC,KACblB,EAAgBC,OAChB,CAAE2B,WAAUjF,OAAM+E,2BAClB,CAAE7B,MAAOY,KAGfP,OAAQ,CACN0B,EACAjF,EACA+E,IAEAV,EAAAA,kBACER,EAAIS,WAAWC,KACblB,EAAgBE,OAChB,CAAE0B,WAAUjF,OAAM+E,2BAClB,CAAE7B,MAAOY,KAGfN,OAASyB,GACPZ,EAAAA,kBACER,EAAIS,WAAWC,KAAKlB,EAAgBG,OAAQ,CAAEyB,YAAY,CAAE/B,MAAOY,OCtCnEoB,EAAU,CAACrB,EAAcC,KAA4B,CACzDP,OAAQ,CACN4B,EACAC,IAEAf,EAAiBA,kBACfR,EAAIS,WAAWC,KAAKlB,EAAaE,OAAQ,CAAE4B,MAAKC,gBAAgB,CAAElC,MAAOY,OCFzEuB,EAAiB,CAACxB,EAAcC,KAA4B,CAChER,OAAQ,CAACtD,EAAcsF,IACrBjB,EAAiBA,kBACfR,EAAIS,WAAWC,KACblB,EAAoBC,OACpB,CAAEtD,OAAMsF,eACR,CAAEpC,MAAOY,KAGfP,OAAQ,CAACvD,EAAcuF,EAAiBD,IACtCjB,EAAAA,kBACER,EAAIS,WAAWC,KACblB,EAAoBE,OACpB,CAAEvD,OAAMuF,UAASD,eACjB,CAAEpC,MAAOY,KAGfN,OAASxD,GACPqE,EAAAA,kBACER,EAAIS,WAAWC,KAAKlB,EAAoBG,OAAQ,CAAExD,QAAQ,CAAEkD,MAAOY,KAEvEH,QAAS,IACPU,EAAiBA,kBACfR,EAAIS,WAAWhD,IAAI+B,EAAoBM,QAAS,CAC9CT,MAAOY,KAERnD,GAASA,EAAK6E,gBC1BfC,EAAW,CAAC5B,EAAcC,KAA4B,CAC1DR,OAAQ,CACNtD,EACAsF,EACAI,IAEArB,EAAAA,kBACER,EAAIS,WAAWC,KACblB,EAAcC,OACd,CAAEtD,OAAMsF,cAAaI,mBACrB,CAAExC,MAAOY,KAGfP,OAAQ,CACNvD,EACAuF,EACAD,EACAI,IAEArB,oBACER,EAAIS,WAAWC,KACblB,EAAcE,OACd,CAAEvD,OAAMuF,UAASD,cAAaI,mBAC9B,CAAExC,MAAOY,KAGfN,OAASxD,GACPqE,EAAAA,kBACER,EAAIS,WAAWC,KAAKlB,EAAcG,OAAQ,CAAExD,QAAQ,CAAEkD,MAAOY,KAEjEH,QAAS,IACPU,EAAiBA,kBACfR,EAAIS,WAAWhD,IAAI+B,EAAcM,QAAS,CACxCT,MAAOY,KAERnD,GAASA,EAAKgF,UCxBhBC,WAAWC,QAEdD,WAAWC,MAAQA,UAEnBD,WAAWE,QAAUA,UAErBF,WAAWG,QAAUA,UAErBH,WAAWI,SAAWA,YAQxB,MAwPMC,EAxPWxF,IAEfA,EAAKyF,MAAQzF,EAAKyF,OAAS,CAAA,EAE3B,MAAMC,EAAoB1F,EAAKyF,MAAME,cAErC3F,EAAKyF,MAAME,cAAiBC,UAC1B,MAAMC,EAAOD,EAOb,OANAC,EAAKjF,QACAQ,OAAAC,OAAAD,OAAAC,OAAA,GAAAwE,EAAKjF,SACR,CAAA,qBAAsB,SACtB,8BAAiD,QAAnBF,EAAO,OAAPoF,cAAO,IAAPA,aAAO,EAAPA,QAASC,gBAAU,IAAArF,OAAA,EAAAA,EAAAsF,OAAQ,GACzD,wBAAyB,mBAEpBN,aAAiB,EAAjBA,EAAoBG,KAASA,CAAI,EAG1C,MAAMI,EAAUC,UAAUlG,GP0DA,IAC1BuB,EAEAE,EAFAF,EOxDE0E,EP0DFxE,EO7CE5B,EAZA,CACE,eACA,mBACA,yBACA,yBACA,iBACA,gBACA,cACA,yBACA,yBACA,WPgDKuC,SAASZ,GAAiBF,EAASC,EAAKC,EAAMC,KO3CvD,MAAM0E,UAAEA,EAASC,OAAEA,GAAWpG,EAExBmC,EAA6C,CAAA,EAmB7CkE,ECrFe,EAACjD,EAAcC,KAA4B,CAChEU,KAAMZ,EAASC,EAAKC,GACpBb,OAAQ6B,EAAWjB,EAAKC,GACxBqB,IAAKD,EAAQrB,EAAKC,GAClBiD,WAAY1B,EAAexB,EAAKC,GAChCkD,KAAMvB,EAAS5B,EAAKC,KDgFDmD,CAAeP,EAASjG,EAAKqD,eAE1CD,iCACD6C,GAAO,CAOVI,aAGAtG,aAAa0G,GACX,KAAKA,aAAA,EAAAA,EAAQC,KAAK,MAAMzE,MAAM,gCAE9B,GAAIE,EAAKsE,EAAOC,KAAM,OAAOvE,EAAKsE,EAAOC,KAKzC,GAFAtF,OAAOC,OAAOc,OAnCApC,WAChB,MAGM4G,SAHoBV,EAAQpC,WAC/BhD,IAAI,WAAWsF,KACfS,MAAM3G,GAASA,EAAK4G,UACe1E,KACtC,OAAKO,MAAMC,QAAQgE,UACQG,QAAQC,IACjCJ,EAAWK,KAAIjH,MAAOiC,GAAQ,CAACA,EAAI0E,UAAWO,EAAAA,UAAUjF,QAGtCkF,QAClB,CAACC,GAAMT,EAAKU,KAAUV,EAAWtF,OAAAC,OAAAD,OAAAC,OAAA,CAAA,EAAA8F,IAAK,CAACT,EAAIxE,YAAakF,IAAQD,GAChE,CAAE,GAPmC,EAQtC,EAsB2BE,KAErBlF,EAAKsE,EAAOC,KAAM,MAAMzE,MAAM,gCAEnC,OAAOE,EAAKsE,EAAOC,IACpB,EAOD3G,kBAAkB2E,SAEhB,MACMjC,SADY6E,EAASA,UAAC5C,EAAKtB,EAAImE,OAAQ,CAAEC,eAAgB,KAC7CC,QAElB,GAAIhF,IACFA,EAAMiF,IAAe,QAAThH,EAAA+B,EAAMiF,WAAG,IAAAhH,OAAA,EAAAA,EAAEiB,MAAM,KAAKgG,MAC9BlF,EAAMiF,MAAQvB,GAEhB,MAAM,IAAIyB,EAAMA,OAACC,yBACf,+BACA,MACA,gBAKN,MAAO,CAAEnD,MAAKjC,QACf,EASD1C,sBACE+H,EACAC,WAEA,IAAKD,IAAiBC,EACpB,MAAM9F,MAAM,kDAEd,GAAI6F,EACF,IAEE,aADoB1E,EAAI4E,YAAYF,EAOrC,CALC,MAAOG,GACP,IAAKF,EAEH,MADA3B,SAAAA,EAAQ6B,MAAM,iEAAkEA,GAC1EhG,MAAM,4BAEf,CAEH,GAAI8F,EACF,UACQ3E,EAAI4E,YAAYD,GACtB,MAAMG,QAAgB9E,EAAI+E,QAAQJ,GAClC,GAAIG,EAAQE,GAAI,CAEd,aADoBhF,EAAI4E,YAA0B,QAAdtH,EAAAwH,EAAQhI,YAAM,IAAAQ,OAAA,EAAAA,EAAAN,WAEnD,CACD,MAAM6B,MAAmB,QAAbf,EAAAgH,EAAQD,aAAK,IAAA/G,OAAA,EAAAA,EAAEmH,QAI5B,CAHC,MAAOC,GAEP,MADAlC,SAAAA,EAAQ6B,MAAM,mCAAoCK,GAC5CrG,MAAM,4BACb,CAGH,MAAMA,MAAM,2BACb,EAODlC,wBAAwBwI,GACtB,IAAKA,EAAW,MAAMtG,MAAM,gCAE5B,IAAIhC,EACJ,IACEA,QAAamD,EAAImF,UAAUC,SAASD,EAIrC,CAHC,MAAON,GAEP,MADA7B,SAAAA,EAAQ6B,MAAM,gCAAiCA,GACzChG,MAAM,gCACb,CAED,MAAM7B,WAAEA,GAAeH,EAAKC,KAC5B,IAAKE,EAEH,MADAgG,SAAAA,EAAQ6B,MAAM,gDACRhG,MAAM,iCAGd,IAEE,aADoBmB,EAAI4E,YAAY5H,EAKrC,CAHC,MAAO6H,GAEP,MADA7B,SAAAA,EAAQ6B,MAAM,sCAAuCA,GAC/ChG,MAAM,gCACb,CACF,EAQDwG,oBAAmB,CAACnG,EAA8ByC,IACzC3B,EAAIsF,0BAA0BpG,EAAU,KAAMyC,GASvD2D,0BACEpG,EACAE,EACAuC,GAEA,MAAM4D,EAAUtG,EAA2BC,ERvOb,cQuO6CE,GAC3E,OAAOuC,EAAY6D,OAAOC,GAASF,EAAQG,SAASD,IACrD,EAQDE,cAAa,CAACzG,EAA8B4C,IACnC9B,EAAI4F,oBAAoB1G,EAAU,KAAM4C,GASjD8D,oBAAoB1G,EAA8BE,EAAgB0C,GAChE,MAAM+D,EAAa5G,EAA2BC,ER1PtB,QQ0PgDE,GACxE,OAAO0C,EAAM0D,OAAOrC,GAAS0C,EAAWH,SAASvC,IAClD,IAGH,OAAOnD,CAAG,EAyBZoC,EAAkB0D,gBAAkBhD,EAAS,QAACgD,gBAC9C1D,EAAkB2D,uBRjSoB,MQkStC3D,EAAkB4D,uBRhSoB"}
1
+ {"version":3,"file":"index.cjs.js","sources":["../../lib/constants.ts","../../lib/helpers.ts","../../lib/management/paths.ts","../../lib/management/user.ts","../../lib/management/tenant.ts","../../lib/management/jwt.ts","../../lib/management/permission.ts","../../lib/management/role.ts","../../lib/management/group.ts","../../lib/management/sso.ts","../../lib/management/accesskey.ts","../../lib/fetch-polyfill.ts","../../lib/index.ts","../../lib/management/index.ts"],"sourcesContent":["// eslint-disable-next-line import/prefer-default-export\n/** Refresh JWT cookie name */\nexport const refreshTokenCookieName = 'DSR';\n/** Session JWT cookie name */\nexport const sessionTokenCookieName = 'DS';\n/** The key of the tenants claims in the claims map */\nexport const authorizedTenantsClaimName = 'tenants';\n/** The key of the permissions claims in the claims map either under tenant or top level */\nexport const permissionsClaimName = 'permissions';\n/** The key of the roles claims in the claims map either under tenant or top level */\nexport const rolesClaimName = 'roles';\n","import type { SdkFnWrapper } from '@descope/core-js-sdk';\nimport { authorizedTenantsClaimName, refreshTokenCookieName } from './constants';\nimport { AuthenticationInfo } from './types';\n\n/**\n * Generate a cookie string from given parameters\n * @param name name of the cookie\n * @param value value of cookie that must be already encoded\n * @param options any options to put on the cookie like cookieDomain, cookieMaxAge, cookiePath\n * @returns Cookie string with all options on the string\n */\nconst generateCookie = (name: string, value: string, options?: Record<string, string | number>) =>\n `${name}=${value}; Domain=${options?.cookieDomain || ''}; Max-Age=${\n options?.cookieMaxAge || ''\n }; Path=${options?.cookiePath || '/'}; HttpOnly; SameSite=Strict`;\n\n/**\n * Parse the cookie string and return the value of the cookie\n * @param cookie the raw cookie string\n * @param name the name of the cookie to get value for\n * @returns the value of the given cookie\n */\nconst getCookieValue = (cookie: string | null | undefined, name: string) => {\n const match = cookie?.match(RegExp(`(?:^|;\\\\s*)${name}=([^;]*)`));\n return match ? match[1] : null;\n};\n\n// eslint-disable-next-line import/prefer-default-export\n/**\n * Add cookie generation to core-js functions.\n * @param fn the function we are wrapping\n * @returns Wrapped function with cookie generation\n */\nexport const withCookie: SdkFnWrapper<{ refreshJwt?: string; cookies?: string[] }> =\n (fn) =>\n async (...args) => {\n const resp = await fn(...args);\n\n // istanbul ignore next\n if (!resp.data) {\n return resp;\n }\n\n // eslint-disable-next-line prefer-const\n let { refreshJwt, ...rest } = resp.data;\n const cookies: string[] = [];\n\n if (!refreshJwt) {\n if (resp.response?.headers.get('set-cookie')) {\n refreshJwt = getCookieValue(\n resp.response?.headers.get('set-cookie'),\n refreshTokenCookieName,\n );\n cookies.push(resp.response?.headers.get('set-cookie')!);\n }\n } else {\n cookies.push(generateCookie(refreshTokenCookieName, refreshJwt, rest));\n }\n\n return { ...resp, data: { ...resp.data, refreshJwt, cookies } };\n };\n\n/**\n * Get the claim (used for permissions or roles) for a given tenant or top level if tenant is empty\n * @param authInfo The parsed authentication info from the JWT\n * @param claim name of the claim\n * @param tenant tenant to retrieve the claim for\n * @returns\n */\nexport function getAuthorizationClaimItems(\n authInfo: AuthenticationInfo,\n claim: string,\n tenant?: string,\n): string[] {\n const value = tenant\n ? authInfo.token[authorizedTenantsClaimName]?.[tenant]?.[claim]\n : authInfo.token[claim];\n return Array.isArray(value) ? value : [];\n}\n","/** API paths for the Descope service Management APIs */\nexport default {\n user: {\n create: '/v1/mgmt/user/create',\n update: '/v1/mgmt/user/update',\n delete: '/v1/mgmt/user/delete',\n load: '/v1/mgmt/user',\n search: '/v1/mgmt/user/search',\n updateStatus: '/v1/mgmt/user/update/status',\n updateEmail: '/v1/mgmt/user/update/email',\n updatePhone: '/v1/mgmt/user/update/phone',\n updateDisplayName: '/v1/mgmt/user/update/name',\n addRole: '/v1/mgmt/user/update/role/add',\n removeRole: '/v1/mgmt/user/update/role/remove',\n addTenant: '/v1/mgmt/user/update/tenant/add',\n removeTenant: '/v1/mgmt/user/update/tenant/remove',\n },\n accessKey: {\n create: '/v1/mgmt/accesskey/create',\n load: '/v1/mgmt/accesskey',\n search: '/v1/mgmt/accesskey/search',\n update: '/v1/mgmt/accesskey/update',\n deactivate: '/v1/mgmt/accesskey/deactivate',\n activate: '/v1/mgmt/accesskey/activate',\n delete: '/v1/mgmt/accesskey/delete',\n },\n tenant: {\n create: '/v1/mgmt/tenant/create',\n update: '/v1/mgmt/tenant/update',\n delete: '/v1/mgmt/tenant/delete',\n loadAll: '/v1/mgmt/tenant/all',\n },\n sso: {\n configure: '/v1/mgmt/sso/settings',\n metadata: '/v1/mgmt/sso/metadata',\n mapping: '/v1/mgmt/sso/mapping',\n },\n jwt: {\n update: '/v1/mgmt/jwt/update',\n },\n permission: {\n create: '/v1/mgmt/permission/create',\n update: '/v1/mgmt/permission/update',\n delete: '/v1/mgmt/permission/delete',\n loadAll: '/v1/mgmt/permission/all',\n },\n role: {\n create: '/v1/mgmt/role/create',\n update: '/v1/mgmt/role/update',\n delete: '/v1/mgmt/role/delete',\n loadAll: '/v1/mgmt/role/all',\n },\n group: {\n loadAllGroups: '/v1/mgmt/group/all',\n loadAllGroupsForMember: '/v1/mgmt/group/member/all',\n loadAllGroupMembers: '/v1/mgmt/group/members',\n },\n};\n","import { SdkResponse, transformResponse, UserResponse } from '@descope/core-js-sdk';\nimport { CoreSdk } from '../types';\nimport apiPaths from './paths';\nimport { AssociatedTenant } from './types';\n\ntype SingleUserResponse = {\n user: UserResponse;\n};\n\ntype MultipleUsersResponse = {\n users: UserResponse[];\n};\n\nconst withUser = (sdk: CoreSdk, managementKey?: string) => ({\n create: (\n loginId: string,\n email?: string,\n phone?: string,\n displayName?: string,\n roles?: string[],\n userTenants?: AssociatedTenant[],\n ): Promise<SdkResponse<UserResponse>> =>\n transformResponse<SingleUserResponse, UserResponse>(\n sdk.httpClient.post(\n apiPaths.user.create,\n { loginId, email, phone, displayName, roleNames: roles, userTenants },\n { token: managementKey },\n ),\n (data) => data.user,\n ),\n update: (\n loginId: string,\n email?: string,\n phone?: string,\n displayName?: string,\n roles?: string[],\n userTenants?: AssociatedTenant[],\n ): Promise<SdkResponse<UserResponse>> =>\n transformResponse<SingleUserResponse, UserResponse>(\n sdk.httpClient.post(\n apiPaths.user.update,\n { loginId, email, phone, displayName, roleNames: roles, userTenants },\n { token: managementKey },\n ),\n (data) => data.user,\n ),\n delete: (loginId: string): Promise<SdkResponse<never>> =>\n transformResponse(\n sdk.httpClient.post(apiPaths.user.delete, { loginId }, { token: managementKey }),\n ),\n load: (loginId: string): Promise<SdkResponse<UserResponse>> =>\n transformResponse<SingleUserResponse, UserResponse>(\n sdk.httpClient.get(apiPaths.user.load, {\n queryParams: { loginId },\n token: managementKey,\n }),\n (data) => data.user,\n ),\n /**\n * Load an existing user by user ID. The ID can be found\n * on the user's JWT.\n * @param userId load a user by this user ID field\n * @returns The UserResponse if found, throws otherwise.\n */\n loadByUserId: (userId: string): Promise<SdkResponse<UserResponse>> =>\n transformResponse<SingleUserResponse, UserResponse>(\n sdk.httpClient.get(apiPaths.user.load, {\n queryParams: { userId },\n token: managementKey,\n }),\n (data) => data.user,\n ),\n searchAll: (\n tenantIds?: string[],\n roles?: string[],\n limit?: number,\n ): Promise<SdkResponse<UserResponse[]>> =>\n transformResponse<MultipleUsersResponse, UserResponse[]>(\n sdk.httpClient.post(\n apiPaths.user.search,\n { tenantIds, roleNames: roles, limit },\n { token: managementKey },\n ),\n (data) => data.users,\n ),\n activate: (loginId: string): Promise<SdkResponse<UserResponse>> =>\n transformResponse<SingleUserResponse, UserResponse>(\n sdk.httpClient.post(\n apiPaths.user.updateStatus,\n { loginId, status: 'enabled' },\n { token: managementKey },\n ),\n (data) => data.user,\n ),\n deactivate: (loginId: string): Promise<SdkResponse<UserResponse>> =>\n transformResponse<SingleUserResponse, UserResponse>(\n sdk.httpClient.post(\n apiPaths.user.updateStatus,\n { loginId, status: 'disabled' },\n { token: managementKey },\n ),\n (data) => data.user,\n ),\n updateEmail: (\n loginId: string,\n email: string,\n isVerified: boolean,\n ): Promise<SdkResponse<UserResponse>> =>\n transformResponse<SingleUserResponse, UserResponse>(\n sdk.httpClient.post(\n apiPaths.user.updateEmail,\n { loginId, email, verified: isVerified },\n { token: managementKey },\n ),\n (data) => data.user,\n ),\n updatePhone: (\n loginId: string,\n phone: string,\n isVerified: boolean,\n ): Promise<SdkResponse<UserResponse>> =>\n transformResponse<SingleUserResponse, UserResponse>(\n sdk.httpClient.post(\n apiPaths.user.updatePhone,\n { loginId, phone, verified: isVerified },\n { token: managementKey },\n ),\n (data) => data.user,\n ),\n updateDisplayName: (loginId: string, displayName: string): Promise<SdkResponse<UserResponse>> =>\n transformResponse<SingleUserResponse, UserResponse>(\n sdk.httpClient.post(\n apiPaths.user.updateDisplayName,\n { loginId, displayName },\n { token: managementKey },\n ),\n (data) => data.user,\n ),\n addRoles: (loginId: string, roles: string[]): Promise<SdkResponse<UserResponse>> =>\n transformResponse<SingleUserResponse, UserResponse>(\n sdk.httpClient.post(\n apiPaths.user.addRole,\n { loginId, roleNames: roles },\n { token: managementKey },\n ),\n (data) => data.user,\n ),\n removeRoles: (loginId: string, roles: string[]): Promise<SdkResponse<UserResponse>> =>\n transformResponse<SingleUserResponse, UserResponse>(\n sdk.httpClient.post(\n apiPaths.user.removeRole,\n { loginId, roleNames: roles },\n { token: managementKey },\n ),\n (data) => data.user,\n ),\n addTenant: (loginId: string, tenantId: string): Promise<SdkResponse<UserResponse>> =>\n transformResponse<SingleUserResponse, UserResponse>(\n sdk.httpClient.post(apiPaths.user.addTenant, { loginId, tenantId }, { token: managementKey }),\n (data) => data.user,\n ),\n removeTenant: (loginId: string, tenantId: string): Promise<SdkResponse<UserResponse>> =>\n transformResponse<SingleUserResponse, UserResponse>(\n sdk.httpClient.post(\n apiPaths.user.removeTenant,\n { loginId, tenantId },\n { token: managementKey },\n ),\n (data) => data.user,\n ),\n addTenantRoles: (\n loginId: string,\n tenantId: string,\n roles: string[],\n ): Promise<SdkResponse<UserResponse>> =>\n transformResponse<SingleUserResponse, UserResponse>(\n sdk.httpClient.post(\n apiPaths.user.addRole,\n { loginId, tenantId, roleNames: roles },\n { token: managementKey },\n ),\n (data) => data.user,\n ),\n removeTenantRoles: (\n loginId: string,\n tenantId: string,\n roles: string[],\n ): Promise<SdkResponse<UserResponse>> =>\n transformResponse<SingleUserResponse, UserResponse>(\n sdk.httpClient.post(\n apiPaths.user.removeRole,\n { loginId, tenantId, roleNames: roles },\n { token: managementKey },\n ),\n (data) => data.user,\n ),\n});\n\nexport default withUser;\n","import { SdkResponse, transformResponse } from '@descope/core-js-sdk';\nimport { CoreSdk } from '../types';\nimport apiPaths from './paths';\nimport { CreateTenantResponse, Tenant } from './types';\n\ntype MultipleTenantResponse = {\n tenants: Tenant[];\n};\n\nconst withTenant = (sdk: CoreSdk, managementKey?: string) => ({\n create: (\n name: string,\n selfProvisioningDomains?: string[],\n ): Promise<SdkResponse<CreateTenantResponse>> =>\n transformResponse(\n sdk.httpClient.post(\n apiPaths.tenant.create,\n { name, selfProvisioningDomains },\n { token: managementKey },\n ),\n ),\n createWithId: (\n id: string,\n name: string,\n selfProvisioningDomains?: string[],\n ): Promise<SdkResponse<never>> =>\n transformResponse(\n sdk.httpClient.post(\n apiPaths.tenant.create,\n { id, name, selfProvisioningDomains },\n { token: managementKey },\n ),\n ),\n update: (\n id: string,\n name: string,\n selfProvisioningDomains?: string[],\n ): Promise<SdkResponse<never>> =>\n transformResponse(\n sdk.httpClient.post(\n apiPaths.tenant.update,\n { id, name, selfProvisioningDomains },\n { token: managementKey },\n ),\n ),\n delete: (id: string): Promise<SdkResponse<never>> =>\n transformResponse(\n sdk.httpClient.post(apiPaths.tenant.delete, { id }, { token: managementKey }),\n ),\n loadAll: (): Promise<SdkResponse<Tenant[]>> =>\n transformResponse<MultipleTenantResponse, Tenant[]>(\n sdk.httpClient.get(apiPaths.tenant.loadAll, {\n token: managementKey,\n }),\n (data) => data.tenants,\n ),\n});\n\nexport default withTenant;\n","import { SdkResponse, transformResponse } from '@descope/core-js-sdk';\nimport { CoreSdk } from '../types';\nimport apiPaths from './paths';\nimport { UpdateJWTResponse } from './types';\n\nconst withJWT = (sdk: CoreSdk, managementKey?: string) => ({\n update: (\n jwt: string,\n customClaims?: Record<string, any>,\n ): Promise<SdkResponse<UpdateJWTResponse>> =>\n transformResponse(\n sdk.httpClient.post(apiPaths.jwt.update, { jwt, customClaims }, { token: managementKey }),\n ),\n});\n\nexport default withJWT;\n","import { SdkResponse, transformResponse } from '@descope/core-js-sdk';\nimport { CoreSdk } from '../types';\nimport apiPaths from './paths';\nimport { Permission } from './types';\n\ntype MultiplePermissionResponse = {\n permissions: Permission[];\n};\n\nconst withPermission = (sdk: CoreSdk, managementKey?: string) => ({\n create: (name: string, description?: string): Promise<SdkResponse<never>> =>\n transformResponse(\n sdk.httpClient.post(\n apiPaths.permission.create,\n { name, description },\n { token: managementKey },\n ),\n ),\n update: (name: string, newName: string, description?: string): Promise<SdkResponse<never>> =>\n transformResponse(\n sdk.httpClient.post(\n apiPaths.permission.update,\n { name, newName, description },\n { token: managementKey },\n ),\n ),\n delete: (name: string): Promise<SdkResponse<never>> =>\n transformResponse(\n sdk.httpClient.post(apiPaths.permission.delete, { name }, { token: managementKey }),\n ),\n loadAll: (): Promise<SdkResponse<Permission[]>> =>\n transformResponse<MultiplePermissionResponse, Permission[]>(\n sdk.httpClient.get(apiPaths.permission.loadAll, {\n token: managementKey,\n }),\n (data) => data.permissions,\n ),\n});\n\nexport default withPermission;\n","import { SdkResponse, transformResponse } from '@descope/core-js-sdk';\nimport { CoreSdk } from '../types';\nimport apiPaths from './paths';\nimport { Role } from './types';\n\ntype MultipleRoleResponse = {\n roles: Role[];\n};\n\nconst withRole = (sdk: CoreSdk, managementKey?: string) => ({\n create: (\n name: string,\n description?: string,\n permissionNames?: string[],\n ): Promise<SdkResponse<never>> =>\n transformResponse(\n sdk.httpClient.post(\n apiPaths.role.create,\n { name, description, permissionNames },\n { token: managementKey },\n ),\n ),\n update: (\n name: string,\n newName: string,\n description?: string,\n permissionNames?: string[],\n ): Promise<SdkResponse<never>> =>\n transformResponse(\n sdk.httpClient.post(\n apiPaths.role.update,\n { name, newName, description, permissionNames },\n { token: managementKey },\n ),\n ),\n delete: (name: string): Promise<SdkResponse<never>> =>\n transformResponse(\n sdk.httpClient.post(apiPaths.role.delete, { name }, { token: managementKey }),\n ),\n loadAll: (): Promise<SdkResponse<Role[]>> =>\n transformResponse<MultipleRoleResponse, Role[]>(\n sdk.httpClient.get(apiPaths.role.loadAll, {\n token: managementKey,\n }),\n (data) => data.roles,\n ),\n});\n\nexport default withRole;\n","import { SdkResponse, transformResponse } from '@descope/core-js-sdk';\nimport { CoreSdk } from '../types';\nimport apiPaths from './paths';\nimport { Group } from './types';\n\nconst withGroup = (sdk: CoreSdk, managementKey?: string) => ({\n /**\n * Load all groups for a specific tenant id.\n * @param tenantId Tenant ID to load groups from.\n * @returns Group[] list of groups\n */\n loadAllGroups: (tenantId: string): Promise<SdkResponse<Group[]>> =>\n transformResponse<Group[]>(\n sdk.httpClient.post(apiPaths.group.loadAllGroups, { tenantId }, { token: managementKey }),\n ),\n\n /**\n * Load all groups for the provided user IDs or login IDs.\n * @param tenantId Tenant ID to load groups from.\n * @param userIds Optional List of user IDs, with the format of \"U2J5ES9S8TkvCgOvcrkpzUgVTEBM\" (example), which can be found on the user's JWT.\n * @param loginIds Optional List of login IDs, how the user identifies when logging in.\n * @returns Group[] list of groups\n */\n loadAllGroupsForMember: (\n tenantId: string,\n userIds: string[],\n loginIds: string[],\n ): Promise<SdkResponse<Group[]>> =>\n transformResponse<Group[]>(\n sdk.httpClient.post(\n apiPaths.group.loadAllGroupsForMember,\n { tenantId, loginIds, userIds },\n { token: managementKey },\n ),\n ),\n\n /**\n * Load all members of the provided group id.\n * @param tenantId Tenant ID to load groups from.\n * @param groupId Group ID to load members for.\n * @returns Group[] list of groups\n */\n loadAllGroupMembers: (tenantId: string, groupId: string): Promise<SdkResponse<Group[]>> =>\n transformResponse<Group[]>(\n sdk.httpClient.post(\n apiPaths.group.loadAllGroupMembers,\n { tenantId, groupId },\n { token: managementKey },\n ),\n ),\n});\n\nexport default withGroup;\n","import { SdkResponse, transformResponse } from '@descope/core-js-sdk';\nimport { CoreSdk } from '../types';\nimport apiPaths from './paths';\nimport { RoleMapping, AttributeMapping } from './types';\n\nconst withSSOSettings = (sdk: CoreSdk, managementKey?: string) => ({\n configureSettings: (\n tenantId: string,\n idpURL: string,\n idpCert: string,\n entityId: string,\n redirectURL?: string,\n ): Promise<SdkResponse<never>> =>\n transformResponse(\n sdk.httpClient.post(\n apiPaths.sso.configure,\n { tenantId, idpURL, entityId, idpCert, redirectURL },\n { token: managementKey },\n ),\n ),\n configureMetadata: (tenantId: string, idpMetadataURL: string): Promise<SdkResponse<never>> =>\n transformResponse(\n sdk.httpClient.post(\n apiPaths.sso.metadata,\n { tenantId, idpMetadataURL },\n { token: managementKey },\n ),\n ),\n configureMapping: (\n tenantId: string,\n roleMapping?: RoleMapping,\n attributeMapping?: AttributeMapping,\n ): Promise<SdkResponse<never>> =>\n transformResponse(\n sdk.httpClient.post(\n apiPaths.sso.mapping,\n { tenantId, roleMapping, attributeMapping },\n { token: managementKey },\n ),\n ),\n});\n\nexport default withSSOSettings;\n","import { SdkResponse, transformResponse } from '@descope/core-js-sdk';\nimport { CoreSdk } from '../types';\nimport apiPaths from './paths';\nimport { AccessKey, AssociatedTenant, CreatedAccessKeyResponse } from './types';\n\ntype SingleKeyResponse = {\n key: AccessKey;\n};\n\ntype MultipleKeysResponse = {\n keys: AccessKey[];\n};\n\nconst withAccessKey = (sdk: CoreSdk, managementKey?: string) => ({\n /**\n * Create a new access key for a project.\n * @param name Access key name\n * @param expireTime When the access key expires. Keep at 0 to make it indefinite.\n * @param roles Optional roles in the project. Does not apply for multi-tenants\n * @param keyTenants Optional associated tenants for this key and its roles for each.\n * @returns A newly created key and its cleartext. Make sure to save the cleartext securely.\n */\n create: (\n name: string,\n expireTime: number,\n roles?: string[],\n keyTenants?: AssociatedTenant[],\n ): Promise<SdkResponse<CreatedAccessKeyResponse>> =>\n transformResponse(\n sdk.httpClient.post(\n apiPaths.accessKey.create,\n { name, expireTime, roleNames: roles, keyTenants },\n { token: managementKey },\n ),\n ),\n /**\n * Load an access key.\n * @param id Access key ID to load\n * @returns The loaded access key.\n */\n load: (id: string): Promise<SdkResponse<AccessKey>> =>\n transformResponse<SingleKeyResponse, AccessKey>(\n sdk.httpClient.get(apiPaths.accessKey.load, {\n queryParams: { id },\n token: managementKey,\n }),\n (data) => data.key,\n ),\n /**\n * Search all access keys\n * @param tenantIds Optional tenant ID filter to apply on the search results\n * @returns An array of found access keys\n */\n searchAll: (tenantIds?: string[]): Promise<SdkResponse<AccessKey[]>> =>\n transformResponse<MultipleKeysResponse, AccessKey[]>(\n sdk.httpClient.post(apiPaths.accessKey.search, { tenantIds }, { token: managementKey }),\n (data) => data.keys,\n ),\n /**\n * Update an access key.\n * @param id Access key ID to load\n * @param name The updated access key name\n * @returns The updated access key\n */\n update: (id: string, name: string): Promise<SdkResponse<AccessKey>> =>\n transformResponse<SingleKeyResponse, AccessKey>(\n sdk.httpClient.post(apiPaths.accessKey.update, { id, name }, { token: managementKey }),\n (data) => data.key,\n ),\n /**\n * Deactivate an access key. Deactivated access keys cannot be used until they are\n * activated again.\n * @param id Access key ID to deactivate\n */\n deactivate: (id: string): Promise<SdkResponse<never>> =>\n transformResponse(\n sdk.httpClient.post(apiPaths.accessKey.deactivate, { id }, { token: managementKey }),\n ),\n /**\n * Activate an access key. Only deactivated access keys can be activated again.\n * @param id Access key ID to activate\n */\n activate: (id: string): Promise<SdkResponse<never>> =>\n transformResponse(\n sdk.httpClient.post(apiPaths.accessKey.activate, { id }, { token: managementKey }),\n ),\n /**\n * Delete an access key. IMPORTANT: This cannot be undone. Use carefully.\n * @param id Access key ID to delete\n */\n delete: (id: string): Promise<SdkResponse<never>> =>\n transformResponse(\n sdk.httpClient.post(apiPaths.accessKey.delete, { id }, { token: managementKey }),\n ),\n});\n\nexport default withAccessKey;\n","import fetch, { Headers, Request, Response } from 'node-fetch';\n\n// we are replacing the default fetch due to an issue with res.clone()\n// starting from NodeJs-v19.1.0 it hangs when calling it twice for the same response\n\n/* istanbul ignore next */\n// @ts-ignore\nglobalThis.fetch = fetch;\n// @ts-ignore\nglobalThis.Headers = Headers;\n// @ts-ignore\nglobalThis.Request = Request;\n// @ts-ignore\nglobalThis.Response = Response;\n","import createSdk, { ExchangeAccessKeyResponse, SdkResponse, wrapWith } from '@descope/core-js-sdk';\nimport { JWK, JWTHeaderParameters, KeyLike, errors, importJWK, jwtVerify } from 'jose';\nimport {\n permissionsClaimName,\n refreshTokenCookieName,\n rolesClaimName,\n sessionTokenCookieName,\n} from './constants';\nimport { getAuthorizationClaimItems, withCookie } from './helpers';\nimport withManagement from './management';\nimport { AuthenticationInfo } from './types';\nimport './fetch-polyfill';\n\ndeclare const BUILD_VERSION: string;\n\n/** Configuration arguments which include the Descope core SDK args and an optional management key */\ntype NodeSdkArgs = Parameters<typeof createSdk>[0] & {\n managementKey?: string;\n};\n\nconst nodeSdk = ({ managementKey, ...config }: NodeSdkArgs) => {\n const coreSdk = createSdk({\n ...config,\n baseHeaders: {\n ...config.baseHeaders,\n 'x-descope-sdk-name': 'nodejs',\n 'x-descope-sdk-node-version': process?.versions?.node || '',\n 'x-descope-sdk-version': BUILD_VERSION,\n },\n });\n\n const { projectId, logger } = config;\n\n const keys: Record<string, KeyLike | Uint8Array> = {};\n\n /** Fetch the public keys (JWKs) from Descope for the configured project */\n const fetchKeys = async () => {\n const keysWrapper = await coreSdk.httpClient\n .get(`v2/keys/${projectId}`)\n .then((resp) => resp.json());\n const publicKeys: JWK[] = keysWrapper.keys;\n if (!Array.isArray(publicKeys)) return {};\n const kidJwksPairs = await Promise.all(\n publicKeys.map(async (key) => [key.kid, await importJWK(key)]),\n );\n\n return kidJwksPairs.reduce(\n (acc, [kid, jwk]) => (kid ? { ...acc, [kid.toString()]: jwk } : acc),\n {},\n );\n };\n\n const management = withManagement(coreSdk, managementKey);\n\n const sdk = {\n ...coreSdk,\n\n /**\n * Provides various APIs for managing a Descope project programmatically. A management key must\n * be provided as an argument when initializing the SDK to use these APIs. Management keys can be\n * generated in the Descope console.\n */\n management,\n\n /** Get the key that can validate the given JWT KID in the header. Can retrieve the public key from local cache or from Descope. */\n async getKey(header: JWTHeaderParameters): Promise<KeyLike | Uint8Array> {\n if (!header?.kid) throw Error('header.kid must not be empty');\n\n if (keys[header.kid]) return keys[header.kid];\n\n // do we need to fetch once or every time?\n Object.assign(keys, await fetchKeys());\n\n if (!keys[header.kid]) throw Error('failed to fetch matching key');\n\n return keys[header.kid];\n },\n\n /**\n * Validate the given JWT with the right key and make sure the issuer is correct\n * @param jwt the JWT string to parse and validate\n * @returns AuthenticationInfo with the parsed token and JWT. Will throw an error if validation fails.\n */\n async validateJwt(jwt: string): Promise<AuthenticationInfo> {\n // Do not hard-code the algo because library does not support `None` so all are valid\n const res = await jwtVerify(jwt, sdk.getKey, { clockTolerance: 5 });\n const token = res.payload;\n\n if (token) {\n token.iss = token.iss?.split('/').pop(); // support both url and project id as issuer\n if (token.iss !== projectId) {\n // We must do the verification here, since issuer can be either project ID or URL\n throw new errors.JWTClaimValidationFailed(\n 'unexpected \"iss\" claim value',\n 'iss',\n 'check_failed',\n );\n }\n }\n\n return { jwt, token };\n },\n\n /**\n * Validate an active session\n * @param sessionToken session JWT to validate\n * @returns AuthenticationInfo promise or throws Error if there is an issue with JWTs\n */\n async validateSession(sessionToken: string): Promise<AuthenticationInfo> {\n if (!sessionToken) throw Error('session token is required for validation');\n\n try {\n const token = await sdk.validateJwt(sessionToken);\n return token;\n } catch (error) {\n /* istanbul ignore next */\n logger?.error('session validation failed', error);\n throw Error('session validation failed');\n }\n },\n\n /**\n * Refresh the session using a refresh token\n * @param refreshToken refresh JWT to refresh the session with\n * @returns AuthenticationInfo promise or throws Error if there is an issue with JWTs\n */\n async refreshSession(refreshToken: string): Promise<AuthenticationInfo> {\n if (!refreshToken) throw Error('refresh token is required to refresh a session');\n\n try {\n await sdk.validateJwt(refreshToken);\n const jwtResp = await sdk.refresh(refreshToken);\n if (jwtResp.ok) {\n const token = await sdk.validateJwt(jwtResp.data?.sessionJwt);\n return token;\n }\n /* istanbul ignore next */\n throw Error(jwtResp.error?.errorMessage);\n } catch (refreshTokenErr) {\n /* istanbul ignore next */\n logger?.error('refresh token validation failed', refreshTokenErr);\n throw Error('refresh token validation failed');\n }\n },\n\n /**\n * Validate session and refresh it if it expired\n * @param sessionToken session JWT\n * @param refreshToken refresh JWT\n * @returns AuthenticationInfo promise or throws Error if there is an issue with JWTs\n */\n async validateAndRefreshSession(\n sessionToken?: string,\n refreshToken?: string,\n ): Promise<AuthenticationInfo> {\n if (!sessionToken && !refreshToken) throw Error('both session and refresh tokens are empty');\n\n try {\n const token = await sdk.validateSession(sessionToken);\n return token;\n } catch (error) {\n /* istanbul ignore next */\n logger?.log('session validation failed - trying to refresh it');\n }\n\n return sdk.refreshSession(refreshToken);\n },\n\n /**\n * Exchange API key (access key) for a session key\n * @param accessKey access key to exchange for a session JWT\n * @returns AuthneticationInfo with session JWT data\n */\n async exchangeAccessKey(accessKey: string): Promise<AuthenticationInfo> {\n if (!accessKey) throw Error('access key must not be empty');\n\n let resp: SdkResponse<ExchangeAccessKeyResponse>;\n try {\n resp = await sdk.accessKey.exchange(accessKey);\n } catch (error) {\n logger?.error('failed to exchange access key', error);\n throw Error('could not exchange access key');\n }\n\n const { sessionJwt } = resp.data;\n if (!sessionJwt) {\n logger?.error('failed to parse exchange access key response');\n throw Error('could not exchange access key');\n }\n\n try {\n const token = await sdk.validateJwt(sessionJwt);\n return token;\n } catch (error) {\n logger?.error('failed to parse jwt from access key', error);\n throw Error('could not exchange access key');\n }\n },\n\n /**\n * Make sure that all given permissions exist on the parsed JWT top level claims\n * @param authInfo JWT parsed info\n * @param permissions list of permissions to make sure they exist on te JWT claims\n * @returns true if all permissions exist, false otherwise\n */\n validatePermissions(authInfo: AuthenticationInfo, permissions: string[]): boolean {\n return sdk.validateTenantPermissions(authInfo, null, permissions);\n },\n\n /**\n * Make sure that all given permissions exist on the parsed JWT tenant claims\n * @param authInfo JWT parsed info\n * @param permissions list of permissions to make sure they exist on te JWT claims\n * @returns true if all permissions exist, false otherwise\n */\n validateTenantPermissions(\n authInfo: AuthenticationInfo,\n tenant: string,\n permissions: string[],\n ): boolean {\n const granted = getAuthorizationClaimItems(authInfo, permissionsClaimName, tenant);\n return permissions.every((perm) => granted.includes(perm));\n },\n\n /**\n * Make sure that all given roles exist on the parsed JWT top level claims\n * @param authInfo JWT parsed info\n * @param roles list of roles to make sure they exist on te JWT claims\n * @returns true if all roles exist, false otherwise\n */\n validateRoles(authInfo: AuthenticationInfo, roles: string[]): boolean {\n return sdk.validateTenantRoles(authInfo, null, roles);\n },\n\n /**\n * Make sure that all given roles exist on the parsed JWT tenant claims\n * @param authInfo JWT parsed info\n * @param roles list of roles to make sure they exist on te JWT claims\n * @returns true if all roles exist, false otherwise\n */\n validateTenantRoles(authInfo: AuthenticationInfo, tenant: string, roles: string[]): boolean {\n const membership = getAuthorizationClaimItems(authInfo, rolesClaimName, tenant);\n return roles.every((role) => membership.includes(role));\n },\n };\n\n return wrapWith(\n sdk,\n [\n 'otp.verify.email',\n 'otp.verify.sms',\n 'otp.verify.whatsapp',\n 'magicLink.verify',\n 'enchantedLink.signUp',\n 'enchantedLink.signIn',\n 'oauth.exchange',\n 'saml.exchange',\n 'totp.verify',\n 'webauthn.signIn.finish',\n 'webauthn.signUp.finish',\n 'refresh',\n ] as const,\n withCookie,\n );\n};\n\n/** Descope SDK client with delivery methods enum.\n *\n * Please see full documentation at {@link https://docs.descope.com/guides Descope Docs}\n * @example Usage\n *\n * ```js\n * import descopeSdk from '@descope/node-sdk';\n *\n * const myProjectId = 'xxx';\n * const sdk = descopeSdk({ projectId: myProjectId });\n *\n * const userLoginId = 'loginId';\n * sdk.otp.signIn.email(userLoginId);\n * const jwtResponse = sdk.otp.verify.email(userLoginId, codeFromEmail);\n * ```\n */\n\nnodeSdk.RefreshTokenCookieName = refreshTokenCookieName;\nnodeSdk.SessionTokenCookieName = sessionTokenCookieName;\n\nexport default nodeSdk;\nexport type { DeliveryMethod, OAuthProvider } from '@descope/core-js-sdk';\n","import { CoreSdk } from '../types';\nimport withUser from './user';\nimport withTenant from './tenant';\nimport withJWT from './jwt';\nimport withPermission from './permission';\nimport withRole from './role';\nimport withGroup from './group';\nimport withSSOSettings from './sso';\nimport withAccessKey from './accesskey';\n\n/** Constructs a higher level Management API that wraps the functions from code-js-sdk */\nconst withManagement = (sdk: CoreSdk, managementKey?: string) => ({\n user: withUser(sdk, managementKey),\n accessKey: withAccessKey(sdk, managementKey),\n tenant: withTenant(sdk, managementKey),\n sso: withSSOSettings(sdk, managementKey),\n jwt: withJWT(sdk, managementKey),\n permission: withPermission(sdk, managementKey),\n role: withRole(sdk, managementKey),\n group: withGroup(sdk, managementKey),\n});\n\nexport default withManagement;\n"],"names":["withCookie","fn","async","args","resp","data","_d","refreshJwt","rest","__rest","cookies","options","push","cookieDomain","cookieMaxAge","cookiePath","_a","response","headers","get","cookie","name","match","RegExp","getCookieValue","_b","_c","Object","assign","getAuthorizationClaimItems","authInfo","claim","tenant","value","token","Array","isArray","apiPaths","create","update","delete","load","search","updateStatus","updateEmail","updatePhone","updateDisplayName","addRole","removeRole","addTenant","removeTenant","deactivate","activate","loadAll","configure","metadata","mapping","loadAllGroups","loadAllGroupsForMember","loadAllGroupMembers","withUser","sdk","managementKey","loginId","email","phone","displayName","roles","userTenants","transformResponse","httpClient","post","roleNames","user","queryParams","loadByUserId","userId","searchAll","tenantIds","limit","users","status","isVerified","verified","addRoles","removeRoles","tenantId","addTenantRoles","removeTenantRoles","withTenant","selfProvisioningDomains","createWithId","id","tenants","withJWT","jwt","customClaims","withPermission","description","newName","permissions","withRole","permissionNames","withGroup","userIds","loginIds","groupId","withSSOSettings","configureSettings","idpURL","idpCert","entityId","redirectURL","configureMetadata","idpMetadataURL","configureMapping","roleMapping","attributeMapping","withAccessKey","expireTime","keyTenants","key","keys","globalThis","fetch","Headers","Request","Response","nodeSdk","config","coreSdk","createSdk","baseHeaders","process","versions","node","projectId","logger","management","accessKey","sso","permission","role","group","withManagement","header","kid","Error","publicKeys","then","json","Promise","all","map","importJWK","reduce","acc","jwk","toString","fetchKeys","jwtVerify","getKey","clockTolerance","payload","iss","split","pop","errors","JWTClaimValidationFailed","sessionToken","validateJwt","error","refreshToken","jwtResp","refresh","ok","sessionJwt","errorMessage","refreshTokenErr","validateSession","log","refreshSession","exchange","validatePermissions","validateTenantPermissions","granted","every","perm","includes","validateRoles","validateTenantRoles","membership","wrapWith","RefreshTokenCookieName","SessionTokenCookieName"],"mappings":"0MAEO,MC+BMA,EACVC,GACDC,SAAUC,eACR,MAAMC,QAAaH,KAAME,GAGzB,IAAKC,EAAKC,KACR,OAAOD,EAIT,IAAIE,EAA0BF,EAAKC,MAA/BE,WAAEA,GAAUD,EAAKE,EAAjBC,EAAAA,OAAAH,EAAA,CAAA,eACJ,MAAMI,EAAoB,GAlCP,IAA8BC,EAgDjD,OAZKJ,EASHG,EAAQE,KA5CZ,GDVoC,SCsDoBL,cA5C5BI,OADuBA,EA6CiBH,QA5CxC,EAAAG,EAASE,eAAgB,gBACnDF,aAAA,EAAAA,EAASG,eAAgB,aACjBH,aAAA,EAAAA,EAASI,aAAc,mCAkCZ,QAAbC,EAAAZ,EAAKa,gBAAQ,IAAAD,OAAA,EAAAA,EAAEE,QAAQC,IAAI,iBAC7BZ,EA3Be,EAACa,EAAmCC,KACzD,MAAMC,EAAQF,eAAAA,EAAQE,MAAMC,OAAO,cAAcF,cACjD,OAAOC,EAAQA,EAAM,GAAK,IAAI,EAyBXE,CACE,QAAbC,EAAArB,EAAKa,gBAAQ,IAAAQ,OAAA,EAAAA,EAAEP,QAAQC,IAAI,cDhDC,OCmD9BT,EAAQE,KAAoB,QAAfc,EAAAtB,EAAKa,gBAAU,IAAAS,OAAA,EAAAA,EAAAR,QAAQC,IAAI,gBAMhCQ,OAAAC,OAAAD,OAAAC,OAAA,CAAA,EAAAxB,GAAM,CAAAC,KAAWsB,OAAAC,OAAAD,OAAAC,OAAA,GAAAxB,EAAKC,MAAM,CAAAE,aAAYG,aAAY,WAUpDmB,EACdC,EACAC,EACAC,WAEA,MAAMC,EAAQD,EAC0C,QAApDP,EAA6C,QAA7CT,EAAAc,EAASI,MAAgC,eAAI,IAAAlB,OAAA,EAAAA,EAAAgB,UAAO,IAAAP,OAAA,EAAAA,EAAGM,GACvDD,EAASI,MAAMH,GACnB,OAAOI,MAAMC,QAAQH,GAASA,EAAQ,EACxC,CC7EA,IAAeI,EACP,CACJC,OAAQ,uBACRC,OAAQ,uBACRC,OAAQ,uBACRC,KAAM,gBACNC,OAAQ,uBACRC,aAAc,8BACdC,YAAa,6BACbC,YAAa,6BACbC,kBAAmB,4BACnBC,QAAS,gCACTC,WAAY,mCACZC,UAAW,kCACXC,aAAc,sCAdHb,EAgBF,CACTC,OAAQ,4BACRG,KAAM,qBACNC,OAAQ,4BACRH,OAAQ,4BACRY,WAAY,gCACZC,SAAU,8BACVZ,OAAQ,6BAvBGH,EAyBL,CACNC,OAAQ,yBACRC,OAAQ,yBACRC,OAAQ,yBACRa,QAAS,uBA7BEhB,EA+BR,CACHiB,UAAW,wBACXC,SAAU,wBACVC,QAAS,wBAlCEnB,EAoCR,CACHE,OAAQ,uBArCGF,EAuCD,CACVC,OAAQ,6BACRC,OAAQ,6BACRC,OAAQ,6BACRa,QAAS,2BA3CEhB,EA6CP,CACJC,OAAQ,uBACRC,OAAQ,uBACRC,OAAQ,uBACRa,QAAS,qBAjDEhB,EAmDN,CACLoB,cAAe,qBACfC,uBAAwB,4BACxBC,oBAAqB,0BC1CzB,MAAMC,EAAW,CAACC,EAAcC,KAA4B,CAC1DxB,OAAQ,CACNyB,EACAC,EACAC,EACAC,EACAC,EACAC,IAEAC,EAAiBA,kBACfR,EAAIS,WAAWC,KACblC,EAAcC,OACd,CAAEyB,UAASC,QAAOC,QAAOC,cAAaM,UAAWL,EAAOC,eACxD,CAAElC,MAAO4B,KAEVzD,GAASA,EAAKoE,OAEnBlC,OAAQ,CACNwB,EACAC,EACAC,EACAC,EACAC,EACAC,IAEAC,EAAiBA,kBACfR,EAAIS,WAAWC,KACblC,EAAcE,OACd,CAAEwB,UAASC,QAAOC,QAAOC,cAAaM,UAAWL,EAAOC,eACxD,CAAElC,MAAO4B,KAEVzD,GAASA,EAAKoE,OAEnBjC,OAASuB,GACPM,EAAAA,kBACER,EAAIS,WAAWC,KAAKlC,EAAcG,OAAQ,CAAEuB,WAAW,CAAE7B,MAAO4B,KAEpErB,KAAOsB,GACLM,EAAAA,kBACER,EAAIS,WAAWnD,IAAIkB,EAAcI,KAAM,CACrCiC,YAAa,CAAEX,WACf7B,MAAO4B,KAERzD,GAASA,EAAKoE,OAQnBE,aAAeC,GACbP,EAAAA,kBACER,EAAIS,WAAWnD,IAAIkB,EAAcI,KAAM,CACrCiC,YAAa,CAAEE,UACf1C,MAAO4B,KAERzD,GAASA,EAAKoE,OAEnBI,UAAW,CACTC,EACAX,EACAY,IAEAV,EAAAA,kBACER,EAAIS,WAAWC,KACblC,EAAcK,OACd,CAAEoC,YAAWN,UAAWL,EAAOY,SAC/B,CAAE7C,MAAO4B,KAEVzD,GAASA,EAAK2E,QAEnB5B,SAAWW,GACTM,EAAAA,kBACER,EAAIS,WAAWC,KACblC,EAAcM,aACd,CAAEoB,UAASkB,OAAQ,WACnB,CAAE/C,MAAO4B,KAEVzD,GAASA,EAAKoE,OAEnBtB,WAAaY,GACXM,EAAAA,kBACER,EAAIS,WAAWC,KACblC,EAAcM,aACd,CAAEoB,UAASkB,OAAQ,YACnB,CAAE/C,MAAO4B,KAEVzD,GAASA,EAAKoE,OAEnB7B,YAAa,CACXmB,EACAC,EACAkB,IAEAb,EAAAA,kBACER,EAAIS,WAAWC,KACblC,EAAcO,YACd,CAAEmB,UAASC,QAAOmB,SAAUD,GAC5B,CAAEhD,MAAO4B,KAEVzD,GAASA,EAAKoE,OAEnB5B,YAAa,CACXkB,EACAE,EACAiB,IAEAb,EAAAA,kBACER,EAAIS,WAAWC,KACblC,EAAcQ,YACd,CAAEkB,UAASE,QAAOkB,SAAUD,GAC5B,CAAEhD,MAAO4B,KAEVzD,GAASA,EAAKoE,OAEnB3B,kBAAmB,CAACiB,EAAiBG,IACnCG,EAAiBA,kBACfR,EAAIS,WAAWC,KACblC,EAAcS,kBACd,CAAEiB,UAASG,eACX,CAAEhC,MAAO4B,KAEVzD,GAASA,EAAKoE,OAEnBW,SAAU,CAACrB,EAAiBI,IAC1BE,EAAiBA,kBACfR,EAAIS,WAAWC,KACblC,EAAcU,QACd,CAAEgB,UAASS,UAAWL,GACtB,CAAEjC,MAAO4B,KAEVzD,GAASA,EAAKoE,OAEnBY,YAAa,CAACtB,EAAiBI,IAC7BE,EAAiBA,kBACfR,EAAIS,WAAWC,KACblC,EAAcW,WACd,CAAEe,UAASS,UAAWL,GACtB,CAAEjC,MAAO4B,KAEVzD,GAASA,EAAKoE,OAEnBxB,UAAW,CAACc,EAAiBuB,IAC3BjB,EAAiBA,kBACfR,EAAIS,WAAWC,KAAKlC,EAAcY,UAAW,CAAEc,UAASuB,YAAY,CAAEpD,MAAO4B,KAC5EzD,GAASA,EAAKoE,OAEnBvB,aAAc,CAACa,EAAiBuB,IAC9BjB,EAAiBA,kBACfR,EAAIS,WAAWC,KACblC,EAAca,aACd,CAAEa,UAASuB,YACX,CAAEpD,MAAO4B,KAEVzD,GAASA,EAAKoE,OAEnBc,eAAgB,CACdxB,EACAuB,EACAnB,IAEAE,EAAAA,kBACER,EAAIS,WAAWC,KACblC,EAAcU,QACd,CAAEgB,UAASuB,WAAUd,UAAWL,GAChC,CAAEjC,MAAO4B,KAEVzD,GAASA,EAAKoE,OAEnBe,kBAAmB,CACjBzB,EACAuB,EACAnB,IAEAE,EAAAA,kBACER,EAAIS,WAAWC,KACblC,EAAcW,WACd,CAAEe,UAASuB,WAAUd,UAAWL,GAChC,CAAEjC,MAAO4B,KAEVzD,GAASA,EAAKoE,SCzLfgB,EAAa,CAAC5B,EAAcC,KAA4B,CAC5DxB,OAAQ,CACNjB,EACAqE,IAEArB,EAAiBA,kBACfR,EAAIS,WAAWC,KACblC,EAAgBC,OAChB,CAAEjB,OAAMqE,2BACR,CAAExD,MAAO4B,KAGf6B,aAAc,CACZC,EACAvE,EACAqE,IAEArB,EAAAA,kBACER,EAAIS,WAAWC,KACblC,EAAgBC,OAChB,CAAEsD,KAAIvE,OAAMqE,2BACZ,CAAExD,MAAO4B,KAGfvB,OAAQ,CACNqD,EACAvE,EACAqE,IAEArB,EAAAA,kBACER,EAAIS,WAAWC,KACblC,EAAgBE,OAChB,CAAEqD,KAAIvE,OAAMqE,2BACZ,CAAExD,MAAO4B,KAGftB,OAASoD,GACPvB,EAAAA,kBACER,EAAIS,WAAWC,KAAKlC,EAAgBG,OAAQ,CAAEoD,MAAM,CAAE1D,MAAO4B,KAEjET,QAAS,IACPgB,EAAiBA,kBACfR,EAAIS,WAAWnD,IAAIkB,EAAgBgB,QAAS,CAC1CnB,MAAO4B,KAERzD,GAASA,EAAKwF,YCjDfC,EAAU,CAACjC,EAAcC,KAA4B,CACzDvB,OAAQ,CACNwD,EACAC,IAEA3B,EAAiBA,kBACfR,EAAIS,WAAWC,KAAKlC,EAAaE,OAAQ,CAAEwD,MAAKC,gBAAgB,CAAE9D,MAAO4B,OCFzEmC,EAAiB,CAACpC,EAAcC,KAA4B,CAChExB,OAAQ,CAACjB,EAAc6E,IACrB7B,EAAiBA,kBACfR,EAAIS,WAAWC,KACblC,EAAoBC,OACpB,CAAEjB,OAAM6E,eACR,CAAEhE,MAAO4B,KAGfvB,OAAQ,CAAClB,EAAc8E,EAAiBD,IACtC7B,EAAAA,kBACER,EAAIS,WAAWC,KACblC,EAAoBE,OACpB,CAAElB,OAAM8E,UAASD,eACjB,CAAEhE,MAAO4B,KAGftB,OAASnB,GACPgD,EAAAA,kBACER,EAAIS,WAAWC,KAAKlC,EAAoBG,OAAQ,CAAEnB,QAAQ,CAAEa,MAAO4B,KAEvET,QAAS,IACPgB,EAAiBA,kBACfR,EAAIS,WAAWnD,IAAIkB,EAAoBgB,QAAS,CAC9CnB,MAAO4B,KAERzD,GAASA,EAAK+F,gBC1BfC,EAAW,CAACxC,EAAcC,KAA4B,CAC1DxB,OAAQ,CACNjB,EACA6E,EACAI,IAEAjC,EAAAA,kBACER,EAAIS,WAAWC,KACblC,EAAcC,OACd,CAAEjB,OAAM6E,cAAaI,mBACrB,CAAEpE,MAAO4B,KAGfvB,OAAQ,CACNlB,EACA8E,EACAD,EACAI,IAEAjC,oBACER,EAAIS,WAAWC,KACblC,EAAcE,OACd,CAAElB,OAAM8E,UAASD,cAAaI,mBAC9B,CAAEpE,MAAO4B,KAGftB,OAASnB,GACPgD,EAAAA,kBACER,EAAIS,WAAWC,KAAKlC,EAAcG,OAAQ,CAAEnB,QAAQ,CAAEa,MAAO4B,KAEjET,QAAS,IACPgB,EAAiBA,kBACfR,EAAIS,WAAWnD,IAAIkB,EAAcgB,QAAS,CACxCnB,MAAO4B,KAERzD,GAASA,EAAK8D,UCvCfoC,EAAY,CAAC1C,EAAcC,KAA4B,CAM3DL,cAAgB6B,GACdjB,EAAAA,kBACER,EAAIS,WAAWC,KAAKlC,EAAeoB,cAAe,CAAE6B,YAAY,CAAEpD,MAAO4B,KAU7EJ,uBAAwB,CACtB4B,EACAkB,EACAC,IAEApC,EAAAA,kBACER,EAAIS,WAAWC,KACblC,EAAeqB,uBACf,CAAE4B,WAAUmB,WAAUD,WACtB,CAAEtE,MAAO4B,KAUfH,oBAAqB,CAAC2B,EAAkBoB,IACtCrC,EAAiBA,kBACfR,EAAIS,WAAWC,KACblC,EAAesB,oBACf,CAAE2B,WAAUoB,WACZ,CAAExE,MAAO4B,OC1CX6C,EAAkB,CAAC9C,EAAcC,KAA4B,CACjE8C,kBAAmB,CACjBtB,EACAuB,EACAC,EACAC,EACAC,IAEA3C,oBACER,EAAIS,WAAWC,KACblC,EAAaiB,UACb,CAAEgC,WAAUuB,SAAQE,WAAUD,UAASE,eACvC,CAAE9E,MAAO4B,KAGfmD,kBAAmB,CAAC3B,EAAkB4B,IACpC7C,EAAiBA,kBACfR,EAAIS,WAAWC,KACblC,EAAakB,SACb,CAAE+B,WAAU4B,kBACZ,CAAEhF,MAAO4B,KAGfqD,iBAAkB,CAChB7B,EACA8B,EACAC,IAEAhD,EAAAA,kBACER,EAAIS,WAAWC,KACblC,EAAamB,QACb,CAAE8B,WAAU8B,cAAaC,oBACzB,CAAEnF,MAAO4B,OCxBXwD,EAAgB,CAACzD,EAAcC,KAA4B,CAS/DxB,OAAQ,CACNjB,EACAkG,EACApD,EACAqD,IAEAnD,EAAAA,kBACER,EAAIS,WAAWC,KACblC,EAAmBC,OACnB,CAAEjB,OAAMkG,aAAY/C,UAAWL,EAAOqD,cACtC,CAAEtF,MAAO4B,KAQfrB,KAAOmD,GACLvB,EAAAA,kBACER,EAAIS,WAAWnD,IAAIkB,EAAmBI,KAAM,CAC1CiC,YAAa,CAAEkB,MACf1D,MAAO4B,KAERzD,GAASA,EAAKoH,MAOnB5C,UAAYC,GACVT,oBACER,EAAIS,WAAWC,KAAKlC,EAAmBK,OAAQ,CAAEoC,aAAa,CAAE5C,MAAO4B,KACtEzD,GAASA,EAAKqH,OAQnBnF,OAAQ,CAACqD,EAAYvE,IACnBgD,EAAiBA,kBACfR,EAAIS,WAAWC,KAAKlC,EAAmBE,OAAQ,CAAEqD,KAAIvE,QAAQ,CAAEa,MAAO4B,KACrEzD,GAASA,EAAKoH,MAOnBtE,WAAayC,GACXvB,EAAAA,kBACER,EAAIS,WAAWC,KAAKlC,EAAmBc,WAAY,CAAEyC,MAAM,CAAE1D,MAAO4B,KAMxEV,SAAWwC,GACTvB,EAAAA,kBACER,EAAIS,WAAWC,KAAKlC,EAAmBe,SAAU,CAAEwC,MAAM,CAAE1D,MAAO4B,KAMtEtB,OAASoD,GACPvB,EAAAA,kBACER,EAAIS,WAAWC,KAAKlC,EAAmBG,OAAQ,CAAEoD,MAAM,CAAE1D,MAAO4B,OCrFtE6D,WAAWC,MAAQA,EAAAA,QAEnBD,WAAWE,QAAUA,EAAAA,QAErBF,WAAWG,QAAUA,EAAAA,QAErBH,WAAWI,SAAWA,EAAQA,SCO9B,MAAMC,EAAWhH,WAAA8C,cAAEA,GAAuC9C,EAArBiH,EAAMxH,EAAAA,OAAAO,EAA1B,mBACf,MAAMkH,EAAUC,UACXxG,OAAAC,OAAAD,OAAAC,OAAA,CAAA,EAAAqG,IACHG,YAAWzG,OAAAC,OAAAD,OAAAC,OAAA,CAAA,EACNqG,EAAOG,aACV,CAAA,qBAAsB,SACtB,8BAA+C,QAAjB3G,EAAA,OAAA4G,cAAA,IAAAA,aAAA,EAAAA,QAASC,gBAAQ,IAAA7G,OAAA,EAAAA,EAAE8G,OAAQ,GACzD,wBAAyB,cAIvBC,UAAEA,EAASC,OAAEA,GAAWR,EAExBP,EAA6C,CAAA,EAmB7CgB,ECzCe,EAAC7E,EAAcC,KAA4B,CAChEW,KAAMb,EAASC,EAAKC,GACpB6E,UAAWrB,EAAczD,EAAKC,GAC9B9B,OAAQyD,EAAW5B,EAAKC,GACxB8E,IAAKjC,EAAgB9C,EAAKC,GAC1BiC,IAAKD,EAAQjC,EAAKC,GAClB+E,WAAY5C,EAAepC,EAAKC,GAChCgF,KAAMzC,EAASxC,EAAKC,GACpBiF,MAAOxC,EAAU1C,EAAKC,KDiCHkF,CAAed,EAASpE,GAErCD,iCACDqE,GAAO,CAOVQ,aAGAxI,aAAa+I,GACX,KAAKA,aAAA,EAAAA,EAAQC,KAAK,MAAMC,MAAM,gCAE9B,GAAIzB,EAAKuB,EAAOC,KAAM,OAAOxB,EAAKuB,EAAOC,KAKzC,GAFAvH,OAAOC,OAAO8F,OAnCAxH,WAChB,MAGMkJ,SAHoBlB,EAAQ5D,WAC/BnD,IAAI,WAAWqH,KACfa,MAAMjJ,GAASA,EAAKkJ,UACe5B,KACtC,OAAKvF,MAAMC,QAAQgH,UACQG,QAAQC,IACjCJ,EAAWK,KAAIvJ,MAAOuH,GAAQ,CAACA,EAAIyB,UAAWQ,EAAAA,UAAUjC,QAGtCkC,QAClB,CAACC,GAAMV,EAAKW,KAAUX,EAAWvH,OAAAC,OAAAD,OAAAC,OAAA,CAAA,EAAAgI,IAAK,CAACV,EAAIY,YAAaD,IAAQD,GAChE,CAAE,GAPmC,EAQtC,EAsB2BG,KAErBrC,EAAKuB,EAAOC,KAAM,MAAMC,MAAM,gCAEnC,OAAOzB,EAAKuB,EAAOC,IACpB,EAODhJ,kBAAkB6F,SAEhB,MACM7D,SADY8H,EAASA,UAACjE,EAAKlC,EAAIoG,OAAQ,CAAEC,eAAgB,KAC7CC,QAElB,GAAIjI,IACFA,EAAMkI,IAAe,QAATpJ,EAAAkB,EAAMkI,WAAG,IAAApJ,OAAA,EAAAA,EAAEqJ,MAAM,KAAKC,MAC9BpI,EAAMkI,MAAQ5B,GAEhB,MAAM,IAAI+B,EAAMA,OAACC,yBACf,+BACA,MACA,gBAKN,MAAO,CAAEzE,MAAK7D,QACf,EAODhC,sBAAsBuK,GACpB,IAAKA,EAAc,MAAMtB,MAAM,4CAE/B,IAEE,aADoBtF,EAAI6G,YAAYD,EAMrC,CAJC,MAAOE,GAGP,MADAlC,SAAAA,EAAQkC,MAAM,4BAA6BA,GACrCxB,MAAM,4BACb,CACF,EAODjJ,qBAAqB0K,WACnB,IAAKA,EAAc,MAAMzB,MAAM,kDAE/B,UACQtF,EAAI6G,YAAYE,GACtB,MAAMC,QAAgBhH,EAAIiH,QAAQF,GAClC,GAAIC,EAAQE,GAAI,CAEd,aADoBlH,EAAI6G,YAA0B,QAAd1J,EAAA6J,EAAQxK,YAAM,IAAAW,OAAA,EAAAA,EAAAgK,WAEnD,CAED,MAAM7B,MAAmB,QAAb1H,EAAAoJ,EAAQF,aAAK,IAAAlJ,OAAA,EAAAA,EAAEwJ,aAK5B,CAJC,MAAOC,GAGP,MADAzC,SAAAA,EAAQkC,MAAM,kCAAmCO,GAC3C/B,MAAM,kCACb,CACF,EAQDjJ,gCACEuK,EACAG,GAEA,IAAKH,IAAiBG,EAAc,MAAMzB,MAAM,6CAEhD,IAEE,aADoBtF,EAAIsH,gBAAgBV,EAKzC,CAHC,MAAOE,GAEPlC,SAAAA,EAAQ2C,IAAI,mDACb,CAED,OAAOvH,EAAIwH,eAAeT,EAC3B,EAOD1K,wBAAwByI,GACtB,IAAKA,EAAW,MAAMQ,MAAM,gCAE5B,IAAI/I,EACJ,IACEA,QAAayD,EAAI8E,UAAU2C,SAAS3C,EAIrC,CAHC,MAAOgC,GAEP,MADAlC,SAAAA,EAAQkC,MAAM,gCAAiCA,GACzCxB,MAAM,gCACb,CAED,MAAM6B,WAAEA,GAAe5K,EAAKC,KAC5B,IAAK2K,EAEH,MADAvC,SAAAA,EAAQkC,MAAM,gDACRxB,MAAM,iCAGd,IAEE,aADoBtF,EAAI6G,YAAYM,EAKrC,CAHC,MAAOL,GAEP,MADAlC,SAAAA,EAAQkC,MAAM,sCAAuCA,GAC/CxB,MAAM,gCACb,CACF,EAQDoC,oBAAmB,CAACzJ,EAA8BsE,IACzCvC,EAAI2H,0BAA0B1J,EAAU,KAAMsE,GASvDoF,0BACE1J,EACAE,EACAoE,GAEA,MAAMqF,EAAU5J,EAA2BC,EZpNb,cYoN6CE,GAC3E,OAAOoE,EAAYsF,OAAOC,GAASF,EAAQG,SAASD,IACrD,EAQDE,cAAa,CAAC/J,EAA8BqC,IACnCN,EAAIiI,oBAAoBhK,EAAU,KAAMqC,GASjD2H,oBAAoBhK,EAA8BE,EAAgBmC,GAChE,MAAM4H,EAAalK,EAA2BC,EZvOtB,QYuOgDE,GACxE,OAAOmC,EAAMuH,OAAO5C,GAASiD,EAAWH,SAAS9C,IAClD,IAGH,OAAOkD,EAAAA,SACLnI,EACA,CACE,mBACA,iBACA,sBACA,mBACA,uBACA,uBACA,iBACA,gBACA,cACA,yBACA,yBACA,WAEF7D,EACD,EAoBHgI,EAAQiE,uBZzR8B,MY0RtCjE,EAAQkE,uBZxR8B"}