@descope/node-sdk 1.0.5 → 1.0.6

package/README.md

@@ -400,6 +400,18 @@ await descopeClient.management.user.create(
   [{ tenantId: 'tenant-ID1', roleNames: ['role-name1'] }],
 );
 
+// Alternatively, a user can be created and invited via an email message.
+// Make sure to configure the invite URL in the Descope console prior to using this function,
+// and that an email address is provided in the information.
+await descopeClient.management.user.invite(
+  'desmond@descope.com',
+  'desmond@descope.com',
+  null,
+  'Desmond Copeland',
+  null,
+  [{ tenantId: 'tenant-ID1', roleNames: ['role-name1'] }],
+);
+
 // Update will override all fields as is. Use carefully.
 await descopeClient.management.user.update(
   'desmond@descope.com',
@@ -428,6 +440,7 @@ const userRes = await descopeClient.management.user.load('desmond@descope.com');
 const userRes = await descopeClient.management.user.loadByUserId('<user-ID>');
 
 // Search all users, optionally according to tenant and/or role filter
+// Results can be paginated using the limit and page parameters
 const usersRes = await descopeClient.management.user.searchAll(['tenant-ID']);
 usersRes.data.forEach((user) => {
   // do something

package/dist/cjs/index.cjs.js

@@ -1,2 +1,2 @@
-"use strict";var e=require("tslib"),t=require("@descope/core-js-sdk"),s=require("jose"),a=require("node-fetch-commonjs");function n(e){return e&&"object"==typeof e&&"default"in e?e:{default:e}}var o=n(t),r=n(a);const i=t=>async(...s)=>{var a,n,o;const r=await t(...s);if(!r.data)return r;let i=r.data,{refreshJwt:l}=i,d=e.__rest(i,["refreshJwt"]);const p=[];var m;return l?p.push(`${"DSR"}=${l}; Domain=${(null==(m=d)?void 0:m.cookieDomain)||""}; Max-Age=${(null==m?void 0:m.cookieMaxAge)||""}; Path=${(null==m?void 0:m.cookiePath)||"/"}; HttpOnly; SameSite=Strict`):(null===(a=r.response)||void 0===a?void 0:a.headers.get("set-cookie"))&&(l=((e,t)=>{const s=null==e?void 0:e.match(RegExp(`(?:^|;\\s*)${t}=([^;]*)`));return s?s[1]:null})(null===(n=r.response)||void 0===n?void 0:n.headers.get("set-cookie"),"DSR"),p.push(null===(o=r.response)||void 0===o?void 0:o.headers.get("set-cookie"))),Object.assign(Object.assign({},r),{data:Object.assign(Object.assign({},r.data),{refreshJwt:l,cookies:p})})};function l(e,t,s){var a,n;const o=s?null===(n=null===(a=e.token.tenants)||void 0===a?void 0:a[s])||void 0===n?void 0:n[t]:e.token[t];return Array.isArray(o)?o:[]}var d={create:"/v1/mgmt/user/create",update:"/v1/mgmt/user/update",delete:"/v1/mgmt/user/delete",load:"/v1/mgmt/user",search:"/v1/mgmt/user/search",updateStatus:"/v1/mgmt/user/update/status",updateEmail:"/v1/mgmt/user/update/email",updatePhone:"/v1/mgmt/user/update/phone",updateDisplayName:"/v1/mgmt/user/update/name",addRole:"/v1/mgmt/user/update/role/add",removeRole:"/v1/mgmt/user/update/role/remove",addTenant:"/v1/mgmt/user/update/tenant/add",removeTenant:"/v1/mgmt/user/update/tenant/remove"},p={create:"/v1/mgmt/accesskey/create",load:"/v1/mgmt/accesskey",search:"/v1/mgmt/accesskey/search",update:"/v1/mgmt/accesskey/update",deactivate:"/v1/mgmt/accesskey/deactivate",activate:"/v1/mgmt/accesskey/activate",delete:"/v1/mgmt/accesskey/delete"},m={create:"/v1/mgmt/tenant/create",update:"/v1/mgmt/tenant/update",delete:"/v1/mgmt/tenant/delete",loadAll:"/v1/mgmt/tenant/all"},c={configure:"/v1/mgmt/sso/settings",metadata:"/v1/mgmt/sso/metadata",mapping:"/v1/mgmt/sso/mapping"},u={update:"/v1/mgmt/jwt/update"},h={create:"/v1/mgmt/permission/create",update:"/v1/mgmt/permission/update",delete:"/v1/mgmt/permission/delete",loadAll:"/v1/mgmt/permission/all"},v={create:"/v1/mgmt/role/create",update:"/v1/mgmt/role/update",delete:"/v1/mgmt/role/delete",loadAll:"/v1/mgmt/role/all"},g={loadAllGroups:"/v1/mgmt/group/all",loadAllGroupsForMember:"/v1/mgmt/group/member/all",loadAllGroupMembers:"/v1/mgmt/group/members"};const f=(e,s)=>({create:(a,n,o,r,i,l)=>t.transformResponse(e.httpClient.post(d.create,{loginId:a,email:n,phone:o,displayName:r,roleNames:i,userTenants:l},{token:s}),(e=>e.user)),update:(a,n,o,r,i,l)=>t.transformResponse(e.httpClient.post(d.update,{loginId:a,email:n,phone:o,displayName:r,roleNames:i,userTenants:l},{token:s}),(e=>e.user)),delete:a=>t.transformResponse(e.httpClient.post(d.delete,{loginId:a},{token:s})),load:a=>t.transformResponse(e.httpClient.get(d.load,{queryParams:{loginId:a},token:s}),(e=>e.user)),loadByUserId:a=>t.transformResponse(e.httpClient.get(d.load,{queryParams:{userId:a},token:s}),(e=>e.user)),searchAll:(a,n,o)=>t.transformResponse(e.httpClient.post(d.search,{tenantIds:a,roleNames:n,limit:o},{token:s}),(e=>e.users)),activate:a=>t.transformResponse(e.httpClient.post(d.updateStatus,{loginId:a,status:"enabled"},{token:s}),(e=>e.user)),deactivate:a=>t.transformResponse(e.httpClient.post(d.updateStatus,{loginId:a,status:"disabled"},{token:s}),(e=>e.user)),updateEmail:(a,n,o)=>t.transformResponse(e.httpClient.post(d.updateEmail,{loginId:a,email:n,verified:o},{token:s}),(e=>e.user)),updatePhone:(a,n,o)=>t.transformResponse(e.httpClient.post(d.updatePhone,{loginId:a,phone:n,verified:o},{token:s}),(e=>e.user)),updateDisplayName:(a,n)=>t.transformResponse(e.httpClient.post(d.updateDisplayName,{loginId:a,displayName:n},{token:s}),(e=>e.user)),addRoles:(a,n)=>t.transformResponse(e.httpClient.post(d.addRole,{loginId:a,roleNames:n},{token:s}),(e=>e.user)),removeRoles:(a,n)=>t.transformResponse(e.httpClient.post(d.removeRole,{loginId:a,roleNames:n},{token:s}),(e=>e.user)),addTenant:(a,n)=>t.transformResponse(e.httpClient.post(d.addTenant,{loginId:a,tenantId:n},{token:s}),(e=>e.user)),removeTenant:(a,n)=>t.transformResponse(e.httpClient.post(d.removeTenant,{loginId:a,tenantId:n},{token:s}),(e=>e.user)),addTenantRoles:(a,n,o)=>t.transformResponse(e.httpClient.post(d.addRole,{loginId:a,tenantId:n,roleNames:o},{token:s}),(e=>e.user)),removeTenantRoles:(a,n,o)=>t.transformResponse(e.httpClient.post(d.removeRole,{loginId:a,tenantId:n,roleNames:o},{token:s}),(e=>e.user))}),k=(e,s)=>({create:(a,n)=>t.transformResponse(e.httpClient.post(m.create,{name:a,selfProvisioningDomains:n},{token:s})),createWithId:(a,n,o)=>t.transformResponse(e.httpClient.post(m.create,{id:a,name:n,selfProvisioningDomains:o},{token:s})),update:(a,n,o)=>t.transformResponse(e.httpClient.post(m.update,{id:a,name:n,selfProvisioningDomains:o},{token:s})),delete:a=>t.transformResponse(e.httpClient.post(m.delete,{id:a},{token:s})),loadAll:()=>t.transformResponse(e.httpClient.get(m.loadAll,{token:s}),(e=>e.tenants))}),y=(e,s)=>({update:(a,n)=>t.transformResponse(e.httpClient.post(u.update,{jwt:a,customClaims:n},{token:s}))}),R=(e,s)=>({create:(a,n)=>t.transformResponse(e.httpClient.post(h.create,{name:a,description:n},{token:s})),update:(a,n,o)=>t.transformResponse(e.httpClient.post(h.update,{name:a,newName:n,description:o},{token:s})),delete:a=>t.transformResponse(e.httpClient.post(h.delete,{name:a},{token:s})),loadAll:()=>t.transformResponse(e.httpClient.get(h.loadAll,{token:s}),(e=>e.permissions))}),C=(e,s)=>({create:(a,n,o)=>t.transformResponse(e.httpClient.post(v.create,{name:a,description:n,permissionNames:o},{token:s})),update:(a,n,o,r)=>t.transformResponse(e.httpClient.post(v.update,{name:a,newName:n,description:o,permissionNames:r},{token:s})),delete:a=>t.transformResponse(e.httpClient.post(v.delete,{name:a},{token:s})),loadAll:()=>t.transformResponse(e.httpClient.get(v.loadAll,{token:s}),(e=>e.roles))}),w=(e,s)=>({loadAllGroups:a=>t.transformResponse(e.httpClient.post(g.loadAllGroups,{tenantId:a},{token:s})),loadAllGroupsForMember:(a,n,o)=>t.transformResponse(e.httpClient.post(g.loadAllGroupsForMember,{tenantId:a,loginIds:o,userIds:n},{token:s})),loadAllGroupMembers:(a,n)=>t.transformResponse(e.httpClient.post(g.loadAllGroupMembers,{tenantId:a,groupId:n},{token:s}))}),I=(e,s)=>({configureSettings:(a,n,o,r,i,l)=>t.transformResponse(e.httpClient.post(c.configure,{tenantId:a,idpURL:n,entityId:r,idpCert:o,redirectURL:i,domain:l},{token:s})),configureMetadata:(a,n)=>t.transformResponse(e.httpClient.post(c.metadata,{tenantId:a,idpMetadataURL:n},{token:s})),configureMapping:(a,n,o)=>t.transformResponse(e.httpClient.post(c.mapping,{tenantId:a,roleMapping:n,attributeMapping:o},{token:s}))}),b=(e,s)=>({create:(a,n,o,r)=>t.transformResponse(e.httpClient.post(p.create,{name:a,expireTime:n,roleNames:o,keyTenants:r},{token:s})),load:a=>t.transformResponse(e.httpClient.get(p.load,{queryParams:{id:a},token:s}),(e=>e.key)),searchAll:a=>t.transformResponse(e.httpClient.post(p.search,{tenantIds:a},{token:s}),(e=>e.keys)),update:(a,n)=>t.transformResponse(e.httpClient.post(p.update,{id:a,name:n},{token:s}),(e=>e.key)),deactivate:a=>t.transformResponse(e.httpClient.post(p.deactivate,{id:a},{token:s})),activate:a=>t.transformResponse(e.httpClient.post(p.activate,{id:a},{token:s})),delete:a=>t.transformResponse(e.httpClient.post(p.delete,{id:a},{token:s}))});var A;null!==(A=globalThis.Headers)&&void 0!==A||(globalThis.Headers=a.Headers);const j=(...e)=>(e.forEach((e=>{var t,s;e&&(null!==(t=(s=e).highWaterMark)&&void 0!==t||(s.highWaterMark=32212254720))})),r.default(...e)),T=a=>{var n,{managementKey:r}=a,d=e.__rest(a,["managementKey"]);const p=o.default(Object.assign(Object.assign({},d),{fetch:j,baseHeaders:Object.assign(Object.assign({},d.baseHeaders),{"x-descope-sdk-name":"nodejs","x-descope-sdk-node-version":(null===(n=null===process||void 0===process?void 0:process.versions)||void 0===n?void 0:n.node)||"","x-descope-sdk-version":"1.0.5"})})),{projectId:m,logger:c}=d,u={},h=((e,t)=>({user:f(e,t),accessKey:b(e,t),tenant:k(e,t),sso:I(e,t),jwt:y(e,t),permission:R(e,t),role:C(e,t),group:w(e,t)}))(p,r),v=Object.assign(Object.assign({},p),{management:h,async getKey(e){if(!(null==e?void 0:e.kid))throw Error("header.kid must not be empty");if(u[e.kid])return u[e.kid];if(Object.assign(u,await(async()=>{const e=(await p.httpClient.get(`v2/keys/${m}`).then((e=>e.json()))).keys;return Array.isArray(e)?(await Promise.all(e.map((async e=>[e.kid,await s.importJWK(e)])))).reduce(((e,[t,s])=>t?Object.assign(Object.assign({},e),{[t.toString()]:s}):e),{}):{}})()),!u[e.kid])throw Error("failed to fetch matching key");return u[e.kid]},async validateJwt(e){var t;const a=(await s.jwtVerify(e,v.getKey,{clockTolerance:5})).payload;if(a&&(a.iss=null===(t=a.iss)||void 0===t?void 0:t.split("/").pop(),a.iss!==m))throw new s.errors.JWTClaimValidationFailed('unexpected "iss" claim value',"iss","check_failed");return{jwt:e,token:a}},async validateSession(e){if(!e)throw Error("session token is required for validation");try{return await v.validateJwt(e)}catch(e){throw null==c||c.error("session validation failed",e),Error("session validation failed")}},async refreshSession(e){var t,s;if(!e)throw Error("refresh token is required to refresh a session");try{await v.validateJwt(e);const a=await v.refresh(e);if(a.ok){return await v.validateJwt(null===(t=a.data)||void 0===t?void 0:t.sessionJwt)}throw Error(null===(s=a.error)||void 0===s?void 0:s.errorMessage)}catch(e){throw null==c||c.error("refresh token validation failed",e),Error("refresh token validation failed")}},async validateAndRefreshSession(e,t){if(!e&&!t)throw Error("both session and refresh tokens are empty");try{return await v.validateSession(e)}catch(e){null==c||c.log("session validation failed - trying to refresh it")}return v.refreshSession(t)},async exchangeAccessKey(e){if(!e)throw Error("access key must not be empty");let t;try{t=await v.accessKey.exchange(e)}catch(e){throw null==c||c.error("failed to exchange access key",e),Error("could not exchange access key")}const{sessionJwt:s}=t.data;if(!s)throw null==c||c.error("failed to parse exchange access key response"),Error("could not exchange access key");try{return await v.validateJwt(s)}catch(e){throw null==c||c.error("failed to parse jwt from access key",e),Error("could not exchange access key")}},validatePermissions:(e,t)=>v.validateTenantPermissions(e,null,t),validateTenantPermissions(e,t,s){const a=l(e,"permissions",t);return s.every((e=>a.includes(e)))},validateRoles:(e,t)=>v.validateTenantRoles(e,null,t),validateTenantRoles(e,t,s){const a=l(e,"roles",t);return s.every((e=>a.includes(e)))}});return t.wrapWith(v,["otp.verify.email","otp.verify.sms","otp.verify.whatsapp","magicLink.verify","enchantedLink.signUp","enchantedLink.signIn","oauth.exchange","saml.exchange","totp.verify","webauthn.signIn.finish","webauthn.signUp.finish","refresh"],i)};T.RefreshTokenCookieName="DSR",T.SessionTokenCookieName="DS",module.exports=T;
+"use strict";var e=require("tslib"),t=require("@descope/core-js-sdk"),s=require("jose"),a=require("node-fetch-commonjs");function n(e){return e&&"object"==typeof e&&"default"in e?e:{default:e}}var o=n(t),r=n(a);const i=t=>async(...s)=>{var a,n,o;const r=await t(...s);if(!r.data)return r;let i=r.data,{refreshJwt:l}=i,d=e.__rest(i,["refreshJwt"]);const p=[];var m;return l?p.push(`${"DSR"}=${l}; Domain=${(null==(m=d)?void 0:m.cookieDomain)||""}; Max-Age=${(null==m?void 0:m.cookieMaxAge)||""}; Path=${(null==m?void 0:m.cookiePath)||"/"}; HttpOnly; SameSite=Strict`):(null===(a=r.response)||void 0===a?void 0:a.headers.get("set-cookie"))&&(l=((e,t)=>{const s=null==e?void 0:e.match(RegExp(`(?:^|;\\s*)${t}=([^;]*)`));return s?s[1]:null})(null===(n=r.response)||void 0===n?void 0:n.headers.get("set-cookie"),"DSR"),p.push(null===(o=r.response)||void 0===o?void 0:o.headers.get("set-cookie"))),Object.assign(Object.assign({},r),{data:Object.assign(Object.assign({},r.data),{refreshJwt:l,cookies:p})})};function l(e,t,s){var a,n;const o=s?null===(n=null===(a=e.token.tenants)||void 0===a?void 0:a[s])||void 0===n?void 0:n[t]:e.token[t];return Array.isArray(o)?o:[]}var d={create:"/v1/mgmt/user/create",update:"/v1/mgmt/user/update",delete:"/v1/mgmt/user/delete",load:"/v1/mgmt/user",search:"/v1/mgmt/user/search",updateStatus:"/v1/mgmt/user/update/status",updateEmail:"/v1/mgmt/user/update/email",updatePhone:"/v1/mgmt/user/update/phone",updateDisplayName:"/v1/mgmt/user/update/name",addRole:"/v1/mgmt/user/update/role/add",removeRole:"/v1/mgmt/user/update/role/remove",addTenant:"/v1/mgmt/user/update/tenant/add",removeTenant:"/v1/mgmt/user/update/tenant/remove"},p={create:"/v1/mgmt/accesskey/create",load:"/v1/mgmt/accesskey",search:"/v1/mgmt/accesskey/search",update:"/v1/mgmt/accesskey/update",deactivate:"/v1/mgmt/accesskey/deactivate",activate:"/v1/mgmt/accesskey/activate",delete:"/v1/mgmt/accesskey/delete"},m={create:"/v1/mgmt/tenant/create",update:"/v1/mgmt/tenant/update",delete:"/v1/mgmt/tenant/delete",loadAll:"/v1/mgmt/tenant/all"},c={configure:"/v1/mgmt/sso/settings",metadata:"/v1/mgmt/sso/metadata",mapping:"/v1/mgmt/sso/mapping"},u={update:"/v1/mgmt/jwt/update"},h={create:"/v1/mgmt/permission/create",update:"/v1/mgmt/permission/update",delete:"/v1/mgmt/permission/delete",loadAll:"/v1/mgmt/permission/all"},v={create:"/v1/mgmt/role/create",update:"/v1/mgmt/role/update",delete:"/v1/mgmt/role/delete",loadAll:"/v1/mgmt/role/all"},g={loadAllGroups:"/v1/mgmt/group/all",loadAllGroupsForMember:"/v1/mgmt/group/member/all",loadAllGroupMembers:"/v1/mgmt/group/members"};const f=(e,s)=>({create:(a,n,o,r,i,l)=>t.transformResponse(e.httpClient.post(d.create,{loginId:a,email:n,phone:o,displayName:r,roleNames:i,userTenants:l},{token:s}),(e=>e.user)),invite:(a,n,o,r,i,l)=>t.transformResponse(e.httpClient.post(d.create,{loginId:a,email:n,phone:o,displayName:r,roleNames:i,userTenants:l,invite:!0},{token:s}),(e=>e.user)),update:(a,n,o,r,i,l)=>t.transformResponse(e.httpClient.post(d.update,{loginId:a,email:n,phone:o,displayName:r,roleNames:i,userTenants:l},{token:s}),(e=>e.user)),delete:a=>t.transformResponse(e.httpClient.post(d.delete,{loginId:a},{token:s})),load:a=>t.transformResponse(e.httpClient.get(d.load,{queryParams:{loginId:a},token:s}),(e=>e.user)),loadByUserId:a=>t.transformResponse(e.httpClient.get(d.load,{queryParams:{userId:a},token:s}),(e=>e.user)),searchAll:(a,n,o,r)=>t.transformResponse(e.httpClient.post(d.search,{tenantIds:a,roleNames:n,limit:o,page:r},{token:s}),(e=>e.users)),activate:a=>t.transformResponse(e.httpClient.post(d.updateStatus,{loginId:a,status:"enabled"},{token:s}),(e=>e.user)),deactivate:a=>t.transformResponse(e.httpClient.post(d.updateStatus,{loginId:a,status:"disabled"},{token:s}),(e=>e.user)),updateEmail:(a,n,o)=>t.transformResponse(e.httpClient.post(d.updateEmail,{loginId:a,email:n,verified:o},{token:s}),(e=>e.user)),updatePhone:(a,n,o)=>t.transformResponse(e.httpClient.post(d.updatePhone,{loginId:a,phone:n,verified:o},{token:s}),(e=>e.user)),updateDisplayName:(a,n)=>t.transformResponse(e.httpClient.post(d.updateDisplayName,{loginId:a,displayName:n},{token:s}),(e=>e.user)),addRoles:(a,n)=>t.transformResponse(e.httpClient.post(d.addRole,{loginId:a,roleNames:n},{token:s}),(e=>e.user)),removeRoles:(a,n)=>t.transformResponse(e.httpClient.post(d.removeRole,{loginId:a,roleNames:n},{token:s}),(e=>e.user)),addTenant:(a,n)=>t.transformResponse(e.httpClient.post(d.addTenant,{loginId:a,tenantId:n},{token:s}),(e=>e.user)),removeTenant:(a,n)=>t.transformResponse(e.httpClient.post(d.removeTenant,{loginId:a,tenantId:n},{token:s}),(e=>e.user)),addTenantRoles:(a,n,o)=>t.transformResponse(e.httpClient.post(d.addRole,{loginId:a,tenantId:n,roleNames:o},{token:s}),(e=>e.user)),removeTenantRoles:(a,n,o)=>t.transformResponse(e.httpClient.post(d.removeRole,{loginId:a,tenantId:n,roleNames:o},{token:s}),(e=>e.user))}),k=(e,s)=>({create:(a,n)=>t.transformResponse(e.httpClient.post(m.create,{name:a,selfProvisioningDomains:n},{token:s})),createWithId:(a,n,o)=>t.transformResponse(e.httpClient.post(m.create,{id:a,name:n,selfProvisioningDomains:o},{token:s})),update:(a,n,o)=>t.transformResponse(e.httpClient.post(m.update,{id:a,name:n,selfProvisioningDomains:o},{token:s})),delete:a=>t.transformResponse(e.httpClient.post(m.delete,{id:a},{token:s})),loadAll:()=>t.transformResponse(e.httpClient.get(m.loadAll,{token:s}),(e=>e.tenants))}),y=(e,s)=>({update:(a,n)=>t.transformResponse(e.httpClient.post(u.update,{jwt:a,customClaims:n},{token:s}))}),R=(e,s)=>({create:(a,n)=>t.transformResponse(e.httpClient.post(h.create,{name:a,description:n},{token:s})),update:(a,n,o)=>t.transformResponse(e.httpClient.post(h.update,{name:a,newName:n,description:o},{token:s})),delete:a=>t.transformResponse(e.httpClient.post(h.delete,{name:a},{token:s})),loadAll:()=>t.transformResponse(e.httpClient.get(h.loadAll,{token:s}),(e=>e.permissions))}),C=(e,s)=>({create:(a,n,o)=>t.transformResponse(e.httpClient.post(v.create,{name:a,description:n,permissionNames:o},{token:s})),update:(a,n,o,r)=>t.transformResponse(e.httpClient.post(v.update,{name:a,newName:n,description:o,permissionNames:r},{token:s})),delete:a=>t.transformResponse(e.httpClient.post(v.delete,{name:a},{token:s})),loadAll:()=>t.transformResponse(e.httpClient.get(v.loadAll,{token:s}),(e=>e.roles))}),w=(e,s)=>({loadAllGroups:a=>t.transformResponse(e.httpClient.post(g.loadAllGroups,{tenantId:a},{token:s})),loadAllGroupsForMember:(a,n,o)=>t.transformResponse(e.httpClient.post(g.loadAllGroupsForMember,{tenantId:a,loginIds:o,userIds:n},{token:s})),loadAllGroupMembers:(a,n)=>t.transformResponse(e.httpClient.post(g.loadAllGroupMembers,{tenantId:a,groupId:n},{token:s}))}),I=(e,s)=>({configureSettings:(a,n,o,r,i,l)=>t.transformResponse(e.httpClient.post(c.configure,{tenantId:a,idpURL:n,entityId:r,idpCert:o,redirectURL:i,domain:l},{token:s})),configureMetadata:(a,n)=>t.transformResponse(e.httpClient.post(c.metadata,{tenantId:a,idpMetadataURL:n},{token:s})),configureMapping:(a,n,o)=>t.transformResponse(e.httpClient.post(c.mapping,{tenantId:a,roleMapping:n,attributeMapping:o},{token:s}))}),b=(e,s)=>({create:(a,n,o,r)=>t.transformResponse(e.httpClient.post(p.create,{name:a,expireTime:n,roleNames:o,keyTenants:r},{token:s})),load:a=>t.transformResponse(e.httpClient.get(p.load,{queryParams:{id:a},token:s}),(e=>e.key)),searchAll:a=>t.transformResponse(e.httpClient.post(p.search,{tenantIds:a},{token:s}),(e=>e.keys)),update:(a,n)=>t.transformResponse(e.httpClient.post(p.update,{id:a,name:n},{token:s}),(e=>e.key)),deactivate:a=>t.transformResponse(e.httpClient.post(p.deactivate,{id:a},{token:s})),activate:a=>t.transformResponse(e.httpClient.post(p.activate,{id:a},{token:s})),delete:a=>t.transformResponse(e.httpClient.post(p.delete,{id:a},{token:s}))});var A;null!==(A=globalThis.Headers)&&void 0!==A||(globalThis.Headers=a.Headers);const j=(...e)=>(e.forEach((e=>{var t,s;e&&(null!==(t=(s=e).highWaterMark)&&void 0!==t||(s.highWaterMark=32212254720))})),r.default(...e)),T=a=>{var n,{managementKey:r}=a,d=e.__rest(a,["managementKey"]);const p=o.default(Object.assign(Object.assign({},d),{fetch:j,baseHeaders:Object.assign(Object.assign({},d.baseHeaders),{"x-descope-sdk-name":"nodejs","x-descope-sdk-node-version":(null===(n=null===process||void 0===process?void 0:process.versions)||void 0===n?void 0:n.node)||"","x-descope-sdk-version":"1.0.6"})})),{projectId:m,logger:c}=d,u={},h=((e,t)=>({user:f(e,t),accessKey:b(e,t),tenant:k(e,t),sso:I(e,t),jwt:y(e,t),permission:R(e,t),role:C(e,t),group:w(e,t)}))(p,r),v=Object.assign(Object.assign({},p),{management:h,async getKey(e){if(!(null==e?void 0:e.kid))throw Error("header.kid must not be empty");if(u[e.kid])return u[e.kid];if(Object.assign(u,await(async()=>{const e=(await p.httpClient.get(`v2/keys/${m}`).then((e=>e.json()))).keys;return Array.isArray(e)?(await Promise.all(e.map((async e=>[e.kid,await s.importJWK(e)])))).reduce(((e,[t,s])=>t?Object.assign(Object.assign({},e),{[t.toString()]:s}):e),{}):{}})()),!u[e.kid])throw Error("failed to fetch matching key");return u[e.kid]},async validateJwt(e){var t;const a=(await s.jwtVerify(e,v.getKey,{clockTolerance:5})).payload;if(a&&(a.iss=null===(t=a.iss)||void 0===t?void 0:t.split("/").pop(),a.iss!==m))throw new s.errors.JWTClaimValidationFailed('unexpected "iss" claim value',"iss","check_failed");return{jwt:e,token:a}},async validateSession(e){if(!e)throw Error("session token is required for validation");try{return await v.validateJwt(e)}catch(e){throw null==c||c.error("session validation failed",e),Error("session validation failed")}},async refreshSession(e){var t,s;if(!e)throw Error("refresh token is required to refresh a session");try{await v.validateJwt(e);const a=await v.refresh(e);if(a.ok){return await v.validateJwt(null===(t=a.data)||void 0===t?void 0:t.sessionJwt)}throw Error(null===(s=a.error)||void 0===s?void 0:s.errorMessage)}catch(e){throw null==c||c.error("refresh token validation failed",e),Error("refresh token validation failed")}},async validateAndRefreshSession(e,t){if(!e&&!t)throw Error("both session and refresh tokens are empty");try{return await v.validateSession(e)}catch(e){null==c||c.log("session validation failed - trying to refresh it")}return v.refreshSession(t)},async exchangeAccessKey(e){if(!e)throw Error("access key must not be empty");let t;try{t=await v.accessKey.exchange(e)}catch(e){throw null==c||c.error("failed to exchange access key",e),Error("could not exchange access key")}const{sessionJwt:s}=t.data;if(!s)throw null==c||c.error("failed to parse exchange access key response"),Error("could not exchange access key");try{return await v.validateJwt(s)}catch(e){throw null==c||c.error("failed to parse jwt from access key",e),Error("could not exchange access key")}},validatePermissions:(e,t)=>v.validateTenantPermissions(e,null,t),validateTenantPermissions(e,t,s){const a=l(e,"permissions",t);return s.every((e=>a.includes(e)))},validateRoles:(e,t)=>v.validateTenantRoles(e,null,t),validateTenantRoles(e,t,s){const a=l(e,"roles",t);return s.every((e=>a.includes(e)))}});return t.wrapWith(v,["otp.verify.email","otp.verify.sms","otp.verify.whatsapp","magicLink.verify","enchantedLink.signUp","enchantedLink.signIn","oauth.exchange","saml.exchange","totp.verify","webauthn.signIn.finish","webauthn.signUp.finish","refresh"],i)};T.RefreshTokenCookieName="DSR",T.SessionTokenCookieName="DS",module.exports=T;
 //# sourceMappingURL=index.cjs.js.map

package/dist/cjs/index.cjs.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.cjs.js","sources":["../../lib/constants.ts","../../lib/helpers.ts","../../lib/management/paths.ts","../../lib/management/user.ts","../../lib/management/tenant.ts","../../lib/management/jwt.ts","../../lib/management/permission.ts","../../lib/management/role.ts","../../lib/management/group.ts","../../lib/management/sso.ts","../../lib/management/accesskey.ts","../../lib/fetch-polyfill.ts","../../lib/index.ts","../../lib/management/index.ts"],"sourcesContent":["// eslint-disable-next-line import/prefer-default-export\n/** Refresh JWT cookie name */\nexport const refreshTokenCookieName = 'DSR';\n/** Session JWT cookie name */\nexport const sessionTokenCookieName = 'DS';\n/** The key of the tenants claims in the claims map */\nexport const authorizedTenantsClaimName = 'tenants';\n/** The key of the permissions claims in the claims map either under tenant or top level */\nexport const permissionsClaimName = 'permissions';\n/** The key of the roles claims in the claims map either under tenant or top level */\nexport const rolesClaimName = 'roles';\n","import type { SdkFnWrapper } from '@descope/core-js-sdk';\nimport { authorizedTenantsClaimName, refreshTokenCookieName } from './constants';\nimport { AuthenticationInfo } from './types';\n\n/**\n * Generate a cookie string from given parameters\n * @param name name of the cookie\n * @param value value of cookie that must be already encoded\n * @param options any options to put on the cookie like cookieDomain, cookieMaxAge, cookiePath\n * @returns Cookie string with all options on the string\n */\nconst generateCookie = (name: string, value: string, options?: Record<string, string | number>) =>\n  `${name}=${value}; Domain=${options?.cookieDomain || ''}; Max-Age=${\n    options?.cookieMaxAge || ''\n  }; Path=${options?.cookiePath || '/'}; HttpOnly; SameSite=Strict`;\n\n/**\n * Parse the cookie string and return the value of the cookie\n * @param cookie the raw cookie string\n * @param name the name of the cookie to get value for\n * @returns the value of the given cookie\n */\nconst getCookieValue = (cookie: string | null | undefined, name: string) => {\n  const match = cookie?.match(RegExp(`(?:^|;\\\\s*)${name}=([^;]*)`));\n  return match ? match[1] : null;\n};\n\n// eslint-disable-next-line import/prefer-default-export\n/**\n * Add cookie generation to core-js functions.\n * @param fn the function we are wrapping\n * @returns Wrapped function with cookie generation\n */\nexport const withCookie: SdkFnWrapper<{ refreshJwt?: string; cookies?: string[] }> =\n  (fn) =>\n  async (...args) => {\n    const resp = await fn(...args);\n\n    // istanbul ignore next\n    if (!resp.data) {\n      return resp;\n    }\n\n    // eslint-disable-next-line prefer-const\n    let { refreshJwt, ...rest } = resp.data;\n    const cookies: string[] = [];\n\n    if (!refreshJwt) {\n      if (resp.response?.headers.get('set-cookie')) {\n        refreshJwt = getCookieValue(\n          resp.response?.headers.get('set-cookie'),\n          refreshTokenCookieName,\n        );\n        cookies.push(resp.response?.headers.get('set-cookie')!);\n      }\n    } else {\n      cookies.push(generateCookie(refreshTokenCookieName, refreshJwt, rest));\n    }\n\n    return { ...resp, data: { ...resp.data, refreshJwt, cookies } };\n  };\n\n/**\n * Get the claim (used for permissions or roles) for a given tenant or top level if tenant is empty\n * @param authInfo The parsed authentication info from the JWT\n * @param claim name of the claim\n * @param tenant tenant to retrieve the claim for\n * @returns\n */\nexport function getAuthorizationClaimItems(\n  authInfo: AuthenticationInfo,\n  claim: string,\n  tenant?: string,\n): string[] {\n  const value = tenant\n    ? authInfo.token[authorizedTenantsClaimName]?.[tenant]?.[claim]\n    : authInfo.token[claim];\n  return Array.isArray(value) ? value : [];\n}\n","/** API paths for the Descope service Management APIs */\nexport default {\n  user: {\n    create: '/v1/mgmt/user/create',\n    update: '/v1/mgmt/user/update',\n    delete: '/v1/mgmt/user/delete',\n    load: '/v1/mgmt/user',\n    search: '/v1/mgmt/user/search',\n    updateStatus: '/v1/mgmt/user/update/status',\n    updateEmail: '/v1/mgmt/user/update/email',\n    updatePhone: '/v1/mgmt/user/update/phone',\n    updateDisplayName: '/v1/mgmt/user/update/name',\n    addRole: '/v1/mgmt/user/update/role/add',\n    removeRole: '/v1/mgmt/user/update/role/remove',\n    addTenant: '/v1/mgmt/user/update/tenant/add',\n    removeTenant: '/v1/mgmt/user/update/tenant/remove',\n  },\n  accessKey: {\n    create: '/v1/mgmt/accesskey/create',\n    load: '/v1/mgmt/accesskey',\n    search: '/v1/mgmt/accesskey/search',\n    update: '/v1/mgmt/accesskey/update',\n    deactivate: '/v1/mgmt/accesskey/deactivate',\n    activate: '/v1/mgmt/accesskey/activate',\n    delete: '/v1/mgmt/accesskey/delete',\n  },\n  tenant: {\n    create: '/v1/mgmt/tenant/create',\n    update: '/v1/mgmt/tenant/update',\n    delete: '/v1/mgmt/tenant/delete',\n    loadAll: '/v1/mgmt/tenant/all',\n  },\n  sso: {\n    configure: '/v1/mgmt/sso/settings',\n    metadata: '/v1/mgmt/sso/metadata',\n    mapping: '/v1/mgmt/sso/mapping',\n  },\n  jwt: {\n    update: '/v1/mgmt/jwt/update',\n  },\n  permission: {\n    create: '/v1/mgmt/permission/create',\n    update: '/v1/mgmt/permission/update',\n    delete: '/v1/mgmt/permission/delete',\n    loadAll: '/v1/mgmt/permission/all',\n  },\n  role: {\n    create: '/v1/mgmt/role/create',\n    update: '/v1/mgmt/role/update',\n    delete: '/v1/mgmt/role/delete',\n    loadAll: '/v1/mgmt/role/all',\n  },\n  group: {\n    loadAllGroups: '/v1/mgmt/group/all',\n    loadAllGroupsForMember: '/v1/mgmt/group/member/all',\n    loadAllGroupMembers: '/v1/mgmt/group/members',\n  },\n};\n","import { SdkResponse, transformResponse, UserResponse } from '@descope/core-js-sdk';\nimport { CoreSdk } from '../types';\nimport apiPaths from './paths';\nimport { AssociatedTenant } from './types';\n\ntype SingleUserResponse = {\n  user: UserResponse;\n};\n\ntype MultipleUsersResponse = {\n  users: UserResponse[];\n};\n\nconst withUser = (sdk: CoreSdk, managementKey?: string) => ({\n  create: (\n    loginId: string,\n    email?: string,\n    phone?: string,\n    displayName?: string,\n    roles?: string[],\n    userTenants?: AssociatedTenant[],\n  ): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.create,\n        { loginId, email, phone, displayName, roleNames: roles, userTenants },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  update: (\n    loginId: string,\n    email?: string,\n    phone?: string,\n    displayName?: string,\n    roles?: string[],\n    userTenants?: AssociatedTenant[],\n  ): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.update,\n        { loginId, email, phone, displayName, roleNames: roles, userTenants },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  delete: (loginId: string): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(apiPaths.user.delete, { loginId }, { token: managementKey }),\n    ),\n  load: (loginId: string): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.get(apiPaths.user.load, {\n        queryParams: { loginId },\n        token: managementKey,\n      }),\n      (data) => data.user,\n    ),\n  /**\n   * Load an existing user by user ID. The ID can be found\n   * on the user's JWT.\n   * @param userId load a user by this user ID field\n   * @returns The UserResponse if found, throws otherwise.\n   */\n  loadByUserId: (userId: string): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.get(apiPaths.user.load, {\n        queryParams: { userId },\n        token: managementKey,\n      }),\n      (data) => data.user,\n    ),\n  searchAll: (\n    tenantIds?: string[],\n    roles?: string[],\n    limit?: number,\n  ): Promise<SdkResponse<UserResponse[]>> =>\n    transformResponse<MultipleUsersResponse, UserResponse[]>(\n      sdk.httpClient.post(\n        apiPaths.user.search,\n        { tenantIds, roleNames: roles, limit },\n        { token: managementKey },\n      ),\n      (data) => data.users,\n    ),\n  activate: (loginId: string): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.updateStatus,\n        { loginId, status: 'enabled' },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  deactivate: (loginId: string): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.updateStatus,\n        { loginId, status: 'disabled' },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  updateEmail: (\n    loginId: string,\n    email: string,\n    isVerified: boolean,\n  ): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.updateEmail,\n        { loginId, email, verified: isVerified },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  updatePhone: (\n    loginId: string,\n    phone: string,\n    isVerified: boolean,\n  ): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.updatePhone,\n        { loginId, phone, verified: isVerified },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  updateDisplayName: (loginId: string, displayName: string): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.updateDisplayName,\n        { loginId, displayName },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  addRoles: (loginId: string, roles: string[]): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.addRole,\n        { loginId, roleNames: roles },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  removeRoles: (loginId: string, roles: string[]): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.removeRole,\n        { loginId, roleNames: roles },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  addTenant: (loginId: string, tenantId: string): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(apiPaths.user.addTenant, { loginId, tenantId }, { token: managementKey }),\n      (data) => data.user,\n    ),\n  removeTenant: (loginId: string, tenantId: string): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.removeTenant,\n        { loginId, tenantId },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  addTenantRoles: (\n    loginId: string,\n    tenantId: string,\n    roles: string[],\n  ): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.addRole,\n        { loginId, tenantId, roleNames: roles },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  removeTenantRoles: (\n    loginId: string,\n    tenantId: string,\n    roles: string[],\n  ): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.removeRole,\n        { loginId, tenantId, roleNames: roles },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n});\n\nexport default withUser;\n","import { SdkResponse, transformResponse } from '@descope/core-js-sdk';\nimport { CoreSdk } from '../types';\nimport apiPaths from './paths';\nimport { CreateTenantResponse, Tenant } from './types';\n\ntype MultipleTenantResponse = {\n  tenants: Tenant[];\n};\n\nconst withTenant = (sdk: CoreSdk, managementKey?: string) => ({\n  create: (\n    name: string,\n    selfProvisioningDomains?: string[],\n  ): Promise<SdkResponse<CreateTenantResponse>> =>\n    transformResponse(\n      sdk.httpClient.post(\n        apiPaths.tenant.create,\n        { name, selfProvisioningDomains },\n        { token: managementKey },\n      ),\n    ),\n  createWithId: (\n    id: string,\n    name: string,\n    selfProvisioningDomains?: string[],\n  ): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(\n        apiPaths.tenant.create,\n        { id, name, selfProvisioningDomains },\n        { token: managementKey },\n      ),\n    ),\n  update: (\n    id: string,\n    name: string,\n    selfProvisioningDomains?: string[],\n  ): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(\n        apiPaths.tenant.update,\n        { id, name, selfProvisioningDomains },\n        { token: managementKey },\n      ),\n    ),\n  delete: (id: string): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(apiPaths.tenant.delete, { id }, { token: managementKey }),\n    ),\n  loadAll: (): Promise<SdkResponse<Tenant[]>> =>\n    transformResponse<MultipleTenantResponse, Tenant[]>(\n      sdk.httpClient.get(apiPaths.tenant.loadAll, {\n        token: managementKey,\n      }),\n      (data) => data.tenants,\n    ),\n});\n\nexport default withTenant;\n","import { SdkResponse, transformResponse } from '@descope/core-js-sdk';\nimport { CoreSdk } from '../types';\nimport apiPaths from './paths';\nimport { UpdateJWTResponse } from './types';\n\nconst withJWT = (sdk: CoreSdk, managementKey?: string) => ({\n  update: (\n    jwt: string,\n    customClaims?: Record<string, any>,\n  ): Promise<SdkResponse<UpdateJWTResponse>> =>\n    transformResponse(\n      sdk.httpClient.post(apiPaths.jwt.update, { jwt, customClaims }, { token: managementKey }),\n    ),\n});\n\nexport default withJWT;\n","import { SdkResponse, transformResponse } from '@descope/core-js-sdk';\nimport { CoreSdk } from '../types';\nimport apiPaths from './paths';\nimport { Permission } from './types';\n\ntype MultiplePermissionResponse = {\n  permissions: Permission[];\n};\n\nconst withPermission = (sdk: CoreSdk, managementKey?: string) => ({\n  create: (name: string, description?: string): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(\n        apiPaths.permission.create,\n        { name, description },\n        { token: managementKey },\n      ),\n    ),\n  update: (name: string, newName: string, description?: string): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(\n        apiPaths.permission.update,\n        { name, newName, description },\n        { token: managementKey },\n      ),\n    ),\n  delete: (name: string): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(apiPaths.permission.delete, { name }, { token: managementKey }),\n    ),\n  loadAll: (): Promise<SdkResponse<Permission[]>> =>\n    transformResponse<MultiplePermissionResponse, Permission[]>(\n      sdk.httpClient.get(apiPaths.permission.loadAll, {\n        token: managementKey,\n      }),\n      (data) => data.permissions,\n    ),\n});\n\nexport default withPermission;\n","import { SdkResponse, transformResponse } from '@descope/core-js-sdk';\nimport { CoreSdk } from '../types';\nimport apiPaths from './paths';\nimport { Role } from './types';\n\ntype MultipleRoleResponse = {\n  roles: Role[];\n};\n\nconst withRole = (sdk: CoreSdk, managementKey?: string) => ({\n  create: (\n    name: string,\n    description?: string,\n    permissionNames?: string[],\n  ): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(\n        apiPaths.role.create,\n        { name, description, permissionNames },\n        { token: managementKey },\n      ),\n    ),\n  update: (\n    name: string,\n    newName: string,\n    description?: string,\n    permissionNames?: string[],\n  ): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(\n        apiPaths.role.update,\n        { name, newName, description, permissionNames },\n        { token: managementKey },\n      ),\n    ),\n  delete: (name: string): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(apiPaths.role.delete, { name }, { token: managementKey }),\n    ),\n  loadAll: (): Promise<SdkResponse<Role[]>> =>\n    transformResponse<MultipleRoleResponse, Role[]>(\n      sdk.httpClient.get(apiPaths.role.loadAll, {\n        token: managementKey,\n      }),\n      (data) => data.roles,\n    ),\n});\n\nexport default withRole;\n","import { SdkResponse, transformResponse } from '@descope/core-js-sdk';\nimport { CoreSdk } from '../types';\nimport apiPaths from './paths';\nimport { Group } from './types';\n\nconst withGroup = (sdk: CoreSdk, managementKey?: string) => ({\n  /**\n   * Load all groups for a specific tenant id.\n   * @param tenantId Tenant ID to load groups from.\n   * @returns Group[] list of groups\n   */\n  loadAllGroups: (tenantId: string): Promise<SdkResponse<Group[]>> =>\n    transformResponse<Group[]>(\n      sdk.httpClient.post(apiPaths.group.loadAllGroups, { tenantId }, { token: managementKey }),\n    ),\n\n  /**\n   * Load all groups for the provided user IDs or login IDs.\n   * @param tenantId Tenant ID to load groups from.\n   * @param userIds Optional List of user IDs, with the format of \"U2J5ES9S8TkvCgOvcrkpzUgVTEBM\" (example), which can be found on the user's JWT.\n   * @param loginIds Optional List of login IDs, how the user identifies when logging in.\n   * @returns Group[] list of groups\n   */\n  loadAllGroupsForMember: (\n    tenantId: string,\n    userIds: string[],\n    loginIds: string[],\n  ): Promise<SdkResponse<Group[]>> =>\n    transformResponse<Group[]>(\n      sdk.httpClient.post(\n        apiPaths.group.loadAllGroupsForMember,\n        { tenantId, loginIds, userIds },\n        { token: managementKey },\n      ),\n    ),\n\n  /**\n   * Load all members of the provided group id.\n   * @param tenantId Tenant ID to load groups from.\n   * @param groupId Group ID to load members for.\n   * @returns Group[] list of groups\n   */\n  loadAllGroupMembers: (tenantId: string, groupId: string): Promise<SdkResponse<Group[]>> =>\n    transformResponse<Group[]>(\n      sdk.httpClient.post(\n        apiPaths.group.loadAllGroupMembers,\n        { tenantId, groupId },\n        { token: managementKey },\n      ),\n    ),\n});\n\nexport default withGroup;\n","import { SdkResponse, transformResponse } from '@descope/core-js-sdk';\nimport { CoreSdk } from '../types';\nimport apiPaths from './paths';\nimport { RoleMapping, AttributeMapping } from './types';\n\nconst withSSOSettings = (sdk: CoreSdk, managementKey?: string) => ({\n  configureSettings: (\n    tenantId: string,\n    idpURL: string,\n    idpCert: string,\n    entityId: string,\n    redirectURL?: string,\n    domain?: string,\n  ): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(\n        apiPaths.sso.configure,\n        { tenantId, idpURL, entityId, idpCert, redirectURL, domain },\n        { token: managementKey },\n      ),\n    ),\n  configureMetadata: (tenantId: string, idpMetadataURL: string): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(\n        apiPaths.sso.metadata,\n        { tenantId, idpMetadataURL },\n        { token: managementKey },\n      ),\n    ),\n  configureMapping: (\n    tenantId: string,\n    roleMapping?: RoleMapping,\n    attributeMapping?: AttributeMapping,\n  ): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(\n        apiPaths.sso.mapping,\n        { tenantId, roleMapping, attributeMapping },\n        { token: managementKey },\n      ),\n    ),\n});\n\nexport default withSSOSettings;\n","import { SdkResponse, transformResponse } from '@descope/core-js-sdk';\nimport { CoreSdk } from '../types';\nimport apiPaths from './paths';\nimport { AccessKey, AssociatedTenant, CreatedAccessKeyResponse } from './types';\n\ntype SingleKeyResponse = {\n  key: AccessKey;\n};\n\ntype MultipleKeysResponse = {\n  keys: AccessKey[];\n};\n\nconst withAccessKey = (sdk: CoreSdk, managementKey?: string) => ({\n  /**\n   * Create a new access key for a project.\n   * @param name Access key name\n   * @param expireTime When the access key expires. Keep at 0 to make it indefinite.\n   * @param roles Optional roles in the project. Does not apply for multi-tenants\n   * @param keyTenants Optional associated tenants for this key and its roles for each.\n   * @returns A newly created key and its cleartext. Make sure to save the cleartext securely.\n   */\n  create: (\n    name: string,\n    expireTime: number,\n    roles?: string[],\n    keyTenants?: AssociatedTenant[],\n  ): Promise<SdkResponse<CreatedAccessKeyResponse>> =>\n    transformResponse(\n      sdk.httpClient.post(\n        apiPaths.accessKey.create,\n        { name, expireTime, roleNames: roles, keyTenants },\n        { token: managementKey },\n      ),\n    ),\n  /**\n   * Load an access key.\n   * @param id Access key ID to load\n   * @returns The loaded access key.\n   */\n  load: (id: string): Promise<SdkResponse<AccessKey>> =>\n    transformResponse<SingleKeyResponse, AccessKey>(\n      sdk.httpClient.get(apiPaths.accessKey.load, {\n        queryParams: { id },\n        token: managementKey,\n      }),\n      (data) => data.key,\n    ),\n  /**\n   * Search all access keys\n   * @param tenantIds Optional tenant ID filter to apply on the search results\n   * @returns An array of found access keys\n   */\n  searchAll: (tenantIds?: string[]): Promise<SdkResponse<AccessKey[]>> =>\n    transformResponse<MultipleKeysResponse, AccessKey[]>(\n      sdk.httpClient.post(apiPaths.accessKey.search, { tenantIds }, { token: managementKey }),\n      (data) => data.keys,\n    ),\n  /**\n   * Update an access key.\n   * @param id Access key ID to load\n   * @param name The updated access key name\n   * @returns The updated access key\n   */\n  update: (id: string, name: string): Promise<SdkResponse<AccessKey>> =>\n    transformResponse<SingleKeyResponse, AccessKey>(\n      sdk.httpClient.post(apiPaths.accessKey.update, { id, name }, { token: managementKey }),\n      (data) => data.key,\n    ),\n  /**\n   * Deactivate an access key. Deactivated access keys cannot be used until they are\n   * activated again.\n   * @param id Access key ID to deactivate\n   */\n  deactivate: (id: string): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(apiPaths.accessKey.deactivate, { id }, { token: managementKey }),\n    ),\n  /**\n   * Activate an access key. Only deactivated access keys can be activated again.\n   * @param id Access key ID to activate\n   */\n  activate: (id: string): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(apiPaths.accessKey.activate, { id }, { token: managementKey }),\n    ),\n  /**\n   * Delete an access key. IMPORTANT: This cannot be undone. Use carefully.\n   * @param id Access key ID to delete\n   */\n  delete: (id: string): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(apiPaths.accessKey.delete, { id }, { token: managementKey }),\n    ),\n});\n\nexport default withAccessKey;\n","import nodeFetch, { Headers } from 'node-fetch-commonjs';\n\nglobalThis.Headers ??= Headers;\n\nconst highWaterMarkMb = 1024 * 1024 * 1024 * 30; // 30MB\n\n// we are increasing the response buffer size due to an issue where node-fetch hangs when response is too big\nconst patchedFetch = (...args: Parameters<typeof nodeFetch>) => {\n  // we can get Request on the first arg, or RequestInfo on the second arg\n  // we want to make sure we are setting the \"highWaterMark\" so we are doing it on both args\n  args.forEach((arg) => {\n    // eslint-disable-next-line no-param-reassign, @typescript-eslint/no-unused-expressions\n    arg && ((arg as any).highWaterMark ??= highWaterMarkMb);\n  });\n\n  return nodeFetch(...args);\n};\n\nexport default patchedFetch as unknown as typeof fetch;\n","import createSdk, { ExchangeAccessKeyResponse, SdkResponse, wrapWith } from '@descope/core-js-sdk';\nimport { JWK, JWTHeaderParameters, KeyLike, errors, importJWK, jwtVerify } from 'jose';\nimport {\n  permissionsClaimName,\n  refreshTokenCookieName,\n  rolesClaimName,\n  sessionTokenCookieName,\n} from './constants';\nimport { getAuthorizationClaimItems, withCookie } from './helpers';\nimport withManagement from './management';\nimport { AuthenticationInfo } from './types';\nimport fetch from './fetch-polyfill';\n\ndeclare const BUILD_VERSION: string;\n\n/** Configuration arguments which include the Descope core SDK args and an optional management key */\ntype NodeSdkArgs = Parameters<typeof createSdk>[0] & {\n  managementKey?: string;\n};\n\nconst nodeSdk = ({ managementKey, ...config }: NodeSdkArgs) => {\n  const coreSdk = createSdk({\n    ...config,\n    fetch,\n    baseHeaders: {\n      ...config.baseHeaders,\n      'x-descope-sdk-name': 'nodejs',\n      'x-descope-sdk-node-version': process?.versions?.node || '',\n      'x-descope-sdk-version': BUILD_VERSION,\n    },\n  });\n\n  const { projectId, logger } = config;\n\n  const keys: Record<string, KeyLike | Uint8Array> = {};\n\n  /** Fetch the public keys (JWKs) from Descope for the configured project */\n  const fetchKeys = async () => {\n    const keysWrapper = await coreSdk.httpClient\n      .get(`v2/keys/${projectId}`)\n      .then((resp) => resp.json());\n    const publicKeys: JWK[] = keysWrapper.keys;\n    if (!Array.isArray(publicKeys)) return {};\n    const kidJwksPairs = await Promise.all(\n      publicKeys.map(async (key) => [key.kid, await importJWK(key)]),\n    );\n\n    return kidJwksPairs.reduce(\n      (acc, [kid, jwk]) => (kid ? { ...acc, [kid.toString()]: jwk } : acc),\n      {},\n    );\n  };\n\n  const management = withManagement(coreSdk, managementKey);\n\n  const sdk = {\n    ...coreSdk,\n\n    /**\n     * Provides various APIs for managing a Descope project programmatically. A management key must\n     * be provided as an argument when initializing the SDK to use these APIs. Management keys can be\n     * generated in the Descope console.\n     */\n    management,\n\n    /** Get the key that can validate the given JWT KID in the header. Can retrieve the public key from local cache or from Descope. */\n    async getKey(header: JWTHeaderParameters): Promise<KeyLike | Uint8Array> {\n      if (!header?.kid) throw Error('header.kid must not be empty');\n\n      if (keys[header.kid]) return keys[header.kid];\n\n      // do we need to fetch once or every time?\n      Object.assign(keys, await fetchKeys());\n\n      if (!keys[header.kid]) throw Error('failed to fetch matching key');\n\n      return keys[header.kid];\n    },\n\n    /**\n     * Validate the given JWT with the right key and make sure the issuer is correct\n     * @param jwt the JWT string to parse and validate\n     * @returns AuthenticationInfo with the parsed token and JWT. Will throw an error if validation fails.\n     */\n    async validateJwt(jwt: string): Promise<AuthenticationInfo> {\n      // Do not hard-code the algo because library does not support `None` so all are valid\n      const res = await jwtVerify(jwt, sdk.getKey, { clockTolerance: 5 });\n      const token = res.payload;\n\n      if (token) {\n        token.iss = token.iss?.split('/').pop(); // support both url and project id as issuer\n        if (token.iss !== projectId) {\n          // We must do the verification here, since issuer can be either project ID or URL\n          throw new errors.JWTClaimValidationFailed(\n            'unexpected \"iss\" claim value',\n            'iss',\n            'check_failed',\n          );\n        }\n      }\n\n      return { jwt, token };\n    },\n\n    /**\n     * Validate an active session\n     * @param sessionToken session JWT to validate\n     * @returns AuthenticationInfo promise or throws Error if there is an issue with JWTs\n     */\n    async validateSession(sessionToken: string): Promise<AuthenticationInfo> {\n      if (!sessionToken) throw Error('session token is required for validation');\n\n      try {\n        const token = await sdk.validateJwt(sessionToken);\n        return token;\n      } catch (error) {\n        /* istanbul ignore next */\n        logger?.error('session validation failed', error);\n        throw Error('session validation failed');\n      }\n    },\n\n    /**\n     * Refresh the session using a refresh token\n     * @param refreshToken refresh JWT to refresh the session with\n     * @returns AuthenticationInfo promise or throws Error if there is an issue with JWTs\n     */\n    async refreshSession(refreshToken: string): Promise<AuthenticationInfo> {\n      if (!refreshToken) throw Error('refresh token is required to refresh a session');\n\n      try {\n        await sdk.validateJwt(refreshToken);\n        const jwtResp = await sdk.refresh(refreshToken);\n        if (jwtResp.ok) {\n          const token = await sdk.validateJwt(jwtResp.data?.sessionJwt);\n          return token;\n        }\n        /* istanbul ignore next */\n        throw Error(jwtResp.error?.errorMessage);\n      } catch (refreshTokenErr) {\n        /* istanbul ignore next */\n        logger?.error('refresh token validation failed', refreshTokenErr);\n        throw Error('refresh token validation failed');\n      }\n    },\n\n    /**\n     * Validate session and refresh it if it expired\n     * @param sessionToken session JWT\n     * @param refreshToken refresh JWT\n     * @returns AuthenticationInfo promise or throws Error if there is an issue with JWTs\n     */\n    async validateAndRefreshSession(\n      sessionToken?: string,\n      refreshToken?: string,\n    ): Promise<AuthenticationInfo> {\n      if (!sessionToken && !refreshToken) throw Error('both session and refresh tokens are empty');\n\n      try {\n        const token = await sdk.validateSession(sessionToken);\n        return token;\n      } catch (error) {\n        /* istanbul ignore next */\n        logger?.log('session validation failed - trying to refresh it');\n      }\n\n      return sdk.refreshSession(refreshToken);\n    },\n\n    /**\n     * Exchange API key (access key) for a session key\n     * @param accessKey access key to exchange for a session JWT\n     * @returns AuthneticationInfo with session JWT data\n     */\n    async exchangeAccessKey(accessKey: string): Promise<AuthenticationInfo> {\n      if (!accessKey) throw Error('access key must not be empty');\n\n      let resp: SdkResponse<ExchangeAccessKeyResponse>;\n      try {\n        resp = await sdk.accessKey.exchange(accessKey);\n      } catch (error) {\n        logger?.error('failed to exchange access key', error);\n        throw Error('could not exchange access key');\n      }\n\n      const { sessionJwt } = resp.data;\n      if (!sessionJwt) {\n        logger?.error('failed to parse exchange access key response');\n        throw Error('could not exchange access key');\n      }\n\n      try {\n        const token = await sdk.validateJwt(sessionJwt);\n        return token;\n      } catch (error) {\n        logger?.error('failed to parse jwt from access key', error);\n        throw Error('could not exchange access key');\n      }\n    },\n\n    /**\n     * Make sure that all given permissions exist on the parsed JWT top level claims\n     * @param authInfo JWT parsed info\n     * @param permissions list of permissions to make sure they exist on te JWT claims\n     * @returns true if all permissions exist, false otherwise\n     */\n    validatePermissions(authInfo: AuthenticationInfo, permissions: string[]): boolean {\n      return sdk.validateTenantPermissions(authInfo, null, permissions);\n    },\n\n    /**\n     * Make sure that all given permissions exist on the parsed JWT tenant claims\n     * @param authInfo JWT parsed info\n     * @param permissions list of permissions to make sure they exist on te JWT claims\n     * @returns true if all permissions exist, false otherwise\n     */\n    validateTenantPermissions(\n      authInfo: AuthenticationInfo,\n      tenant: string,\n      permissions: string[],\n    ): boolean {\n      const granted = getAuthorizationClaimItems(authInfo, permissionsClaimName, tenant);\n      return permissions.every((perm) => granted.includes(perm));\n    },\n\n    /**\n     * Make sure that all given roles exist on the parsed JWT top level claims\n     * @param authInfo JWT parsed info\n     * @param roles list of roles to make sure they exist on te JWT claims\n     * @returns true if all roles exist, false otherwise\n     */\n    validateRoles(authInfo: AuthenticationInfo, roles: string[]): boolean {\n      return sdk.validateTenantRoles(authInfo, null, roles);\n    },\n\n    /**\n     * Make sure that all given roles exist on the parsed JWT tenant claims\n     * @param authInfo JWT parsed info\n     * @param roles list of roles to make sure they exist on te JWT claims\n     * @returns true if all roles exist, false otherwise\n     */\n    validateTenantRoles(authInfo: AuthenticationInfo, tenant: string, roles: string[]): boolean {\n      const membership = getAuthorizationClaimItems(authInfo, rolesClaimName, tenant);\n      return roles.every((role) => membership.includes(role));\n    },\n  };\n\n  return wrapWith(\n    sdk,\n    [\n      'otp.verify.email',\n      'otp.verify.sms',\n      'otp.verify.whatsapp',\n      'magicLink.verify',\n      'enchantedLink.signUp',\n      'enchantedLink.signIn',\n      'oauth.exchange',\n      'saml.exchange',\n      'totp.verify',\n      'webauthn.signIn.finish',\n      'webauthn.signUp.finish',\n      'refresh',\n    ] as const,\n    withCookie,\n  );\n};\n\n/** Descope SDK client with delivery methods enum.\n *\n * Please see full documentation at {@link https://docs.descope.com/guides Descope Docs}\n * @example Usage\n *\n * ```js\n * import descopeSdk from '@descope/node-sdk';\n *\n * const myProjectId = 'xxx';\n * const sdk = descopeSdk({ projectId: myProjectId });\n *\n * const userLoginId = 'loginId';\n * sdk.otp.signIn.email(userLoginId);\n * const jwtResponse = sdk.otp.verify.email(userLoginId, codeFromEmail);\n * ```\n */\n\nnodeSdk.RefreshTokenCookieName = refreshTokenCookieName;\nnodeSdk.SessionTokenCookieName = sessionTokenCookieName;\n\nexport default nodeSdk;\nexport type { DeliveryMethod, OAuthProvider } from '@descope/core-js-sdk';\n","import { CoreSdk } from '../types';\nimport withUser from './user';\nimport withTenant from './tenant';\nimport withJWT from './jwt';\nimport withPermission from './permission';\nimport withRole from './role';\nimport withGroup from './group';\nimport withSSOSettings from './sso';\nimport withAccessKey from './accesskey';\n\n/** Constructs a higher level Management API that wraps the functions from code-js-sdk */\nconst withManagement = (sdk: CoreSdk, managementKey?: string) => ({\n  user: withUser(sdk, managementKey),\n  accessKey: withAccessKey(sdk, managementKey),\n  tenant: withTenant(sdk, managementKey),\n  sso: withSSOSettings(sdk, managementKey),\n  jwt: withJWT(sdk, managementKey),\n  permission: withPermission(sdk, managementKey),\n  role: withRole(sdk, managementKey),\n  group: withGroup(sdk, managementKey),\n});\n\nexport default withManagement;\n"],"names":["withCookie","fn","async","args","resp","data","_d","refreshJwt","rest","__rest","cookies","options","push","cookieDomain","cookieMaxAge","cookiePath","_a","response","headers","get","cookie","name","match","RegExp","getCookieValue","_b","_c","Object","assign","getAuthorizationClaimItems","authInfo","claim","tenant","value","token","Array","isArray","apiPaths","create","update","delete","load","search","updateStatus","updateEmail","updatePhone","updateDisplayName","addRole","removeRole","addTenant","removeTenant","deactivate","activate","loadAll","configure","metadata","mapping","loadAllGroups","loadAllGroupsForMember","loadAllGroupMembers","withUser","sdk","managementKey","loginId","email","phone","displayName","roles","userTenants","transformResponse","httpClient","post","roleNames","user","queryParams","loadByUserId","userId","searchAll","tenantIds","limit","users","status","isVerified","verified","addRoles","removeRoles","tenantId","addTenantRoles","removeTenantRoles","withTenant","selfProvisioningDomains","createWithId","id","tenants","withJWT","jwt","customClaims","withPermission","description","newName","permissions","withRole","permissionNames","withGroup","userIds","loginIds","groupId","withSSOSettings","configureSettings","idpURL","idpCert","entityId","redirectURL","domain","configureMetadata","idpMetadataURL","configureMapping","roleMapping","attributeMapping","withAccessKey","expireTime","keyTenants","key","keys","globalThis","Headers","patchedFetch","forEach","arg","highWaterMark","nodeFetch","nodeSdk","config","coreSdk","createSdk","fetch","baseHeaders","process","versions","node","projectId","logger","management","accessKey","sso","permission","role","group","withManagement","header","kid","Error","publicKeys","then","json","Promise","all","map","importJWK","reduce","acc","jwk","toString","fetchKeys","jwtVerify","getKey","clockTolerance","payload","iss","split","pop","errors","JWTClaimValidationFailed","sessionToken","validateJwt","error","refreshToken","jwtResp","refresh","ok","sessionJwt","errorMessage","refreshTokenErr","validateSession","log","refreshSession","exchange","validatePermissions","validateTenantPermissions","granted","every","perm","includes","validateRoles","validateTenantRoles","membership","wrapWith","RefreshTokenCookieName","SessionTokenCookieName"],"mappings":"mNAEO,MC+BMA,EACVC,GACDC,SAAUC,eACR,MAAMC,QAAaH,KAAME,GAGzB,IAAKC,EAAKC,KACR,OAAOD,EAIT,IAAIE,EAA0BF,EAAKC,MAA/BE,WAAEA,GAAUD,EAAKE,EAAjBC,EAAAA,OAAAH,EAAA,CAAA,eACJ,MAAMI,EAAoB,GAlCP,IAA8BC,EAgDjD,OAZKJ,EASHG,EAAQE,KA5CZ,GDVoC,SCsDoBL,cA5C5BI,OADuBA,EA6CiBH,QA5CxC,EAAAG,EAASE,eAAgB,gBACnDF,aAAA,EAAAA,EAASG,eAAgB,aACjBH,aAAA,EAAAA,EAASI,aAAc,mCAkCZ,QAAbC,EAAAZ,EAAKa,gBAAQ,IAAAD,OAAA,EAAAA,EAAEE,QAAQC,IAAI,iBAC7BZ,EA3Be,EAACa,EAAmCC,KACzD,MAAMC,EAAQF,eAAAA,EAAQE,MAAMC,OAAO,cAAcF,cACjD,OAAOC,EAAQA,EAAM,GAAK,IAAI,EAyBXE,CACE,QAAbC,EAAArB,EAAKa,gBAAQ,IAAAQ,OAAA,EAAAA,EAAEP,QAAQC,IAAI,cDhDC,OCmD9BT,EAAQE,KAAoB,QAAfc,EAAAtB,EAAKa,gBAAU,IAAAS,OAAA,EAAAA,EAAAR,QAAQC,IAAI,gBAMhCQ,OAAAC,OAAAD,OAAAC,OAAA,CAAA,EAAAxB,GAAM,CAAAC,KAAWsB,OAAAC,OAAAD,OAAAC,OAAA,GAAAxB,EAAKC,MAAM,CAAAE,aAAYG,aAAY,WAUpDmB,EACdC,EACAC,EACAC,WAEA,MAAMC,EAAQD,EAC0C,QAApDP,EAA6C,QAA7CT,EAAAc,EAASI,MAAgC,eAAI,IAAAlB,OAAA,EAAAA,EAAAgB,UAAO,IAAAP,OAAA,EAAAA,EAAGM,GACvDD,EAASI,MAAMH,GACnB,OAAOI,MAAMC,QAAQH,GAASA,EAAQ,EACxC,CC7EA,IAAeI,EACP,CACJC,OAAQ,uBACRC,OAAQ,uBACRC,OAAQ,uBACRC,KAAM,gBACNC,OAAQ,uBACRC,aAAc,8BACdC,YAAa,6BACbC,YAAa,6BACbC,kBAAmB,4BACnBC,QAAS,gCACTC,WAAY,mCACZC,UAAW,kCACXC,aAAc,sCAdHb,EAgBF,CACTC,OAAQ,4BACRG,KAAM,qBACNC,OAAQ,4BACRH,OAAQ,4BACRY,WAAY,gCACZC,SAAU,8BACVZ,OAAQ,6BAvBGH,EAyBL,CACNC,OAAQ,yBACRC,OAAQ,yBACRC,OAAQ,yBACRa,QAAS,uBA7BEhB,EA+BR,CACHiB,UAAW,wBACXC,SAAU,wBACVC,QAAS,wBAlCEnB,EAoCR,CACHE,OAAQ,uBArCGF,EAuCD,CACVC,OAAQ,6BACRC,OAAQ,6BACRC,OAAQ,6BACRa,QAAS,2BA3CEhB,EA6CP,CACJC,OAAQ,uBACRC,OAAQ,uBACRC,OAAQ,uBACRa,QAAS,qBAjDEhB,EAmDN,CACLoB,cAAe,qBACfC,uBAAwB,4BACxBC,oBAAqB,0BC1CzB,MAAMC,EAAW,CAACC,EAAcC,KAA4B,CAC1DxB,OAAQ,CACNyB,EACAC,EACAC,EACAC,EACAC,EACAC,IAEAC,EAAiBA,kBACfR,EAAIS,WAAWC,KACblC,EAAcC,OACd,CAAEyB,UAASC,QAAOC,QAAOC,cAAaM,UAAWL,EAAOC,eACxD,CAAElC,MAAO4B,KAEVzD,GAASA,EAAKoE,OAEnBlC,OAAQ,CACNwB,EACAC,EACAC,EACAC,EACAC,EACAC,IAEAC,EAAiBA,kBACfR,EAAIS,WAAWC,KACblC,EAAcE,OACd,CAAEwB,UAASC,QAAOC,QAAOC,cAAaM,UAAWL,EAAOC,eACxD,CAAElC,MAAO4B,KAEVzD,GAASA,EAAKoE,OAEnBjC,OAASuB,GACPM,EAAAA,kBACER,EAAIS,WAAWC,KAAKlC,EAAcG,OAAQ,CAAEuB,WAAW,CAAE7B,MAAO4B,KAEpErB,KAAOsB,GACLM,EAAAA,kBACER,EAAIS,WAAWnD,IAAIkB,EAAcI,KAAM,CACrCiC,YAAa,CAAEX,WACf7B,MAAO4B,KAERzD,GAASA,EAAKoE,OAQnBE,aAAeC,GACbP,EAAAA,kBACER,EAAIS,WAAWnD,IAAIkB,EAAcI,KAAM,CACrCiC,YAAa,CAAEE,UACf1C,MAAO4B,KAERzD,GAASA,EAAKoE,OAEnBI,UAAW,CACTC,EACAX,EACAY,IAEAV,EAAAA,kBACER,EAAIS,WAAWC,KACblC,EAAcK,OACd,CAAEoC,YAAWN,UAAWL,EAAOY,SAC/B,CAAE7C,MAAO4B,KAEVzD,GAASA,EAAK2E,QAEnB5B,SAAWW,GACTM,EAAAA,kBACER,EAAIS,WAAWC,KACblC,EAAcM,aACd,CAAEoB,UAASkB,OAAQ,WACnB,CAAE/C,MAAO4B,KAEVzD,GAASA,EAAKoE,OAEnBtB,WAAaY,GACXM,EAAAA,kBACER,EAAIS,WAAWC,KACblC,EAAcM,aACd,CAAEoB,UAASkB,OAAQ,YACnB,CAAE/C,MAAO4B,KAEVzD,GAASA,EAAKoE,OAEnB7B,YAAa,CACXmB,EACAC,EACAkB,IAEAb,EAAAA,kBACER,EAAIS,WAAWC,KACblC,EAAcO,YACd,CAAEmB,UAASC,QAAOmB,SAAUD,GAC5B,CAAEhD,MAAO4B,KAEVzD,GAASA,EAAKoE,OAEnB5B,YAAa,CACXkB,EACAE,EACAiB,IAEAb,EAAAA,kBACER,EAAIS,WAAWC,KACblC,EAAcQ,YACd,CAAEkB,UAASE,QAAOkB,SAAUD,GAC5B,CAAEhD,MAAO4B,KAEVzD,GAASA,EAAKoE,OAEnB3B,kBAAmB,CAACiB,EAAiBG,IACnCG,EAAiBA,kBACfR,EAAIS,WAAWC,KACblC,EAAcS,kBACd,CAAEiB,UAASG,eACX,CAAEhC,MAAO4B,KAEVzD,GAASA,EAAKoE,OAEnBW,SAAU,CAACrB,EAAiBI,IAC1BE,EAAiBA,kBACfR,EAAIS,WAAWC,KACblC,EAAcU,QACd,CAAEgB,UAASS,UAAWL,GACtB,CAAEjC,MAAO4B,KAEVzD,GAASA,EAAKoE,OAEnBY,YAAa,CAACtB,EAAiBI,IAC7BE,EAAiBA,kBACfR,EAAIS,WAAWC,KACblC,EAAcW,WACd,CAAEe,UAASS,UAAWL,GACtB,CAAEjC,MAAO4B,KAEVzD,GAASA,EAAKoE,OAEnBxB,UAAW,CAACc,EAAiBuB,IAC3BjB,EAAiBA,kBACfR,EAAIS,WAAWC,KAAKlC,EAAcY,UAAW,CAAEc,UAASuB,YAAY,CAAEpD,MAAO4B,KAC5EzD,GAASA,EAAKoE,OAEnBvB,aAAc,CAACa,EAAiBuB,IAC9BjB,EAAiBA,kBACfR,EAAIS,WAAWC,KACblC,EAAca,aACd,CAAEa,UAASuB,YACX,CAAEpD,MAAO4B,KAEVzD,GAASA,EAAKoE,OAEnBc,eAAgB,CACdxB,EACAuB,EACAnB,IAEAE,EAAAA,kBACER,EAAIS,WAAWC,KACblC,EAAcU,QACd,CAAEgB,UAASuB,WAAUd,UAAWL,GAChC,CAAEjC,MAAO4B,KAEVzD,GAASA,EAAKoE,OAEnBe,kBAAmB,CACjBzB,EACAuB,EACAnB,IAEAE,EAAAA,kBACER,EAAIS,WAAWC,KACblC,EAAcW,WACd,CAAEe,UAASuB,WAAUd,UAAWL,GAChC,CAAEjC,MAAO4B,KAEVzD,GAASA,EAAKoE,SCzLfgB,EAAa,CAAC5B,EAAcC,KAA4B,CAC5DxB,OAAQ,CACNjB,EACAqE,IAEArB,EAAiBA,kBACfR,EAAIS,WAAWC,KACblC,EAAgBC,OAChB,CAAEjB,OAAMqE,2BACR,CAAExD,MAAO4B,KAGf6B,aAAc,CACZC,EACAvE,EACAqE,IAEArB,EAAAA,kBACER,EAAIS,WAAWC,KACblC,EAAgBC,OAChB,CAAEsD,KAAIvE,OAAMqE,2BACZ,CAAExD,MAAO4B,KAGfvB,OAAQ,CACNqD,EACAvE,EACAqE,IAEArB,EAAAA,kBACER,EAAIS,WAAWC,KACblC,EAAgBE,OAChB,CAAEqD,KAAIvE,OAAMqE,2BACZ,CAAExD,MAAO4B,KAGftB,OAASoD,GACPvB,EAAAA,kBACER,EAAIS,WAAWC,KAAKlC,EAAgBG,OAAQ,CAAEoD,MAAM,CAAE1D,MAAO4B,KAEjET,QAAS,IACPgB,EAAiBA,kBACfR,EAAIS,WAAWnD,IAAIkB,EAAgBgB,QAAS,CAC1CnB,MAAO4B,KAERzD,GAASA,EAAKwF,YCjDfC,EAAU,CAACjC,EAAcC,KAA4B,CACzDvB,OAAQ,CACNwD,EACAC,IAEA3B,EAAiBA,kBACfR,EAAIS,WAAWC,KAAKlC,EAAaE,OAAQ,CAAEwD,MAAKC,gBAAgB,CAAE9D,MAAO4B,OCFzEmC,EAAiB,CAACpC,EAAcC,KAA4B,CAChExB,OAAQ,CAACjB,EAAc6E,IACrB7B,EAAiBA,kBACfR,EAAIS,WAAWC,KACblC,EAAoBC,OACpB,CAAEjB,OAAM6E,eACR,CAAEhE,MAAO4B,KAGfvB,OAAQ,CAAClB,EAAc8E,EAAiBD,IACtC7B,EAAAA,kBACER,EAAIS,WAAWC,KACblC,EAAoBE,OACpB,CAAElB,OAAM8E,UAASD,eACjB,CAAEhE,MAAO4B,KAGftB,OAASnB,GACPgD,EAAAA,kBACER,EAAIS,WAAWC,KAAKlC,EAAoBG,OAAQ,CAAEnB,QAAQ,CAAEa,MAAO4B,KAEvET,QAAS,IACPgB,EAAiBA,kBACfR,EAAIS,WAAWnD,IAAIkB,EAAoBgB,QAAS,CAC9CnB,MAAO4B,KAERzD,GAASA,EAAK+F,gBC1BfC,EAAW,CAACxC,EAAcC,KAA4B,CAC1DxB,OAAQ,CACNjB,EACA6E,EACAI,IAEAjC,EAAAA,kBACER,EAAIS,WAAWC,KACblC,EAAcC,OACd,CAAEjB,OAAM6E,cAAaI,mBACrB,CAAEpE,MAAO4B,KAGfvB,OAAQ,CACNlB,EACA8E,EACAD,EACAI,IAEAjC,oBACER,EAAIS,WAAWC,KACblC,EAAcE,OACd,CAAElB,OAAM8E,UAASD,cAAaI,mBAC9B,CAAEpE,MAAO4B,KAGftB,OAASnB,GACPgD,EAAAA,kBACER,EAAIS,WAAWC,KAAKlC,EAAcG,OAAQ,CAAEnB,QAAQ,CAAEa,MAAO4B,KAEjET,QAAS,IACPgB,EAAiBA,kBACfR,EAAIS,WAAWnD,IAAIkB,EAAcgB,QAAS,CACxCnB,MAAO4B,KAERzD,GAASA,EAAK8D,UCvCfoC,EAAY,CAAC1C,EAAcC,KAA4B,CAM3DL,cAAgB6B,GACdjB,EAAAA,kBACER,EAAIS,WAAWC,KAAKlC,EAAeoB,cAAe,CAAE6B,YAAY,CAAEpD,MAAO4B,KAU7EJ,uBAAwB,CACtB4B,EACAkB,EACAC,IAEApC,EAAAA,kBACER,EAAIS,WAAWC,KACblC,EAAeqB,uBACf,CAAE4B,WAAUmB,WAAUD,WACtB,CAAEtE,MAAO4B,KAUfH,oBAAqB,CAAC2B,EAAkBoB,IACtCrC,EAAiBA,kBACfR,EAAIS,WAAWC,KACblC,EAAesB,oBACf,CAAE2B,WAAUoB,WACZ,CAAExE,MAAO4B,OC1CX6C,EAAkB,CAAC9C,EAAcC,KAA4B,CACjE8C,kBAAmB,CACjBtB,EACAuB,EACAC,EACAC,EACAC,EACAC,IAEA5C,EAAiBA,kBACfR,EAAIS,WAAWC,KACblC,EAAaiB,UACb,CAAEgC,WAAUuB,SAAQE,WAAUD,UAASE,cAAaC,UACpD,CAAE/E,MAAO4B,KAGfoD,kBAAmB,CAAC5B,EAAkB6B,IACpC9C,EAAiBA,kBACfR,EAAIS,WAAWC,KACblC,EAAakB,SACb,CAAE+B,WAAU6B,kBACZ,CAAEjF,MAAO4B,KAGfsD,iBAAkB,CAChB9B,EACA+B,EACAC,IAEAjD,EAAAA,kBACER,EAAIS,WAAWC,KACblC,EAAamB,QACb,CAAE8B,WAAU+B,cAAaC,oBACzB,CAAEpF,MAAO4B,OCzBXyD,EAAgB,CAAC1D,EAAcC,KAA4B,CAS/DxB,OAAQ,CACNjB,EACAmG,EACArD,EACAsD,IAEApD,EAAAA,kBACER,EAAIS,WAAWC,KACblC,EAAmBC,OACnB,CAAEjB,OAAMmG,aAAYhD,UAAWL,EAAOsD,cACtC,CAAEvF,MAAO4B,KAQfrB,KAAOmD,GACLvB,EAAAA,kBACER,EAAIS,WAAWnD,IAAIkB,EAAmBI,KAAM,CAC1CiC,YAAa,CAAEkB,MACf1D,MAAO4B,KAERzD,GAASA,EAAKqH,MAOnB7C,UAAYC,GACVT,oBACER,EAAIS,WAAWC,KAAKlC,EAAmBK,OAAQ,CAAEoC,aAAa,CAAE5C,MAAO4B,KACtEzD,GAASA,EAAKsH,OAQnBpF,OAAQ,CAACqD,EAAYvE,IACnBgD,EAAiBA,kBACfR,EAAIS,WAAWC,KAAKlC,EAAmBE,OAAQ,CAAEqD,KAAIvE,QAAQ,CAAEa,MAAO4B,KACrEzD,GAASA,EAAKqH,MAOnBvE,WAAayC,GACXvB,EAAAA,kBACER,EAAIS,WAAWC,KAAKlC,EAAmBc,WAAY,CAAEyC,MAAM,CAAE1D,MAAO4B,KAMxEV,SAAWwC,GACTvB,EAAAA,kBACER,EAAIS,WAAWC,KAAKlC,EAAmBe,SAAU,CAAEwC,MAAM,CAAE1D,MAAO4B,KAMtEtB,OAASoD,GACPvB,EAAAA,kBACER,EAAIS,WAAWC,KAAKlC,EAAmBG,OAAQ,CAAEoD,MAAM,CAAE1D,MAAO4B,aC1FpD,QAAlB9C,EAAA4G,WAAWC,eAAO,IAAA7G,IAAlB4G,WAAWC,QAAYA,EAAOA,SAE9B,MAGMC,EAAe,IAAI3H,KAGvBA,EAAK4H,SAASC,YAEZA,YAAShH,GAAAS,EAAAuG,GAAYC,+BAAAA,cARD,aAQmC,IAGlDC,EAAS,WAAI/H,ICKhBgI,EAAWnH,WAAA8C,cAAEA,GAAuC9C,EAArBoH,EAAM3H,EAAAA,OAAAO,EAA1B,mBACf,MAAMqH,EAAUC,UACX3G,OAAAC,OAAAD,OAAAC,OAAA,CAAA,EAAAwG,UACHG,EACAC,YAAW7G,OAAAC,OAAAD,OAAAC,OAAA,CAAA,EACNwG,EAAOI,cACV,qBAAsB,SACtB,8BAAiD,UAAZ,OAAPC,cAAO,IAAPA,aAAO,EAAPA,QAASC,gBAAU,IAAAjH,OAAA,EAAAA,EAAAkH,OAAQ,GACzD,wBAAyB,cAIvBC,UAAEA,EAASC,OAAEA,GAAWT,EAExBT,EAA6C,CAAA,EAmB7CmB,EC1Ce,EAACjF,EAAcC,KAA4B,CAChEW,KAAMb,EAASC,EAAKC,GACpBiF,UAAWxB,EAAc1D,EAAKC,GAC9B9B,OAAQyD,EAAW5B,EAAKC,GACxBkF,IAAKrC,EAAgB9C,EAAKC,GAC1BiC,IAAKD,EAAQjC,EAAKC,GAClBmF,WAAYhD,EAAepC,EAAKC,GAChCoF,KAAM7C,EAASxC,EAAKC,GACpBqF,MAAO5C,EAAU1C,EAAKC,KDkCHsF,CAAef,EAASvE,GAErCD,iCACDwE,GAAO,CAOVS,aAGA5I,aAAamJ,GACX,KAAKA,aAAA,EAAAA,EAAQC,KAAK,MAAMC,MAAM,gCAE9B,GAAI5B,EAAK0B,EAAOC,KAAM,OAAO3B,EAAK0B,EAAOC,KAKzC,GAFA3H,OAAOC,OAAO+F,OAnCAzH,WAChB,MAGMsJ,SAHoBnB,EAAQ/D,WAC/BnD,IAAI,WAAWyH,KACfa,MAAMrJ,GAASA,EAAKsJ,UACe/B,KACtC,OAAKxF,MAAMC,QAAQoH,UACQG,QAAQC,IACjCJ,EAAWK,KAAI3J,MAAOwH,GAAQ,CAACA,EAAI4B,UAAWQ,EAAAA,UAAUpC,QAGtCqC,QAClB,CAACC,GAAMV,EAAKW,KAAUX,EAAW3H,OAAAC,OAAAD,OAAAC,OAAA,CAAA,EAAAoI,IAAK,CAACV,EAAIY,YAAaD,IAAQD,GAChE,CAAE,GAPmC,EAQtC,EAsB2BG,KAErBxC,EAAK0B,EAAOC,KAAM,MAAMC,MAAM,gCAEnC,OAAO5B,EAAK0B,EAAOC,IACpB,EAODpJ,kBAAkB6F,SAEhB,MACM7D,SADYkI,EAASA,UAACrE,EAAKlC,EAAIwG,OAAQ,CAAEC,eAAgB,KAC7CC,QAElB,GAAIrI,IACFA,EAAMsI,IAAe,QAATxJ,EAAAkB,EAAMsI,WAAG,IAAAxJ,OAAA,EAAAA,EAAEyJ,MAAM,KAAKC,MAC9BxI,EAAMsI,MAAQ5B,GAEhB,MAAM,IAAI+B,EAAMA,OAACC,yBACf,+BACA,MACA,gBAKN,MAAO,CAAE7E,MAAK7D,QACf,EAODhC,sBAAsB2K,GACpB,IAAKA,EAAc,MAAMtB,MAAM,4CAE/B,IAEE,aADoB1F,EAAIiH,YAAYD,EAMrC,CAJC,MAAOE,GAGP,MADAlC,SAAAA,EAAQkC,MAAM,4BAA6BA,GACrCxB,MAAM,4BACb,CACF,EAODrJ,qBAAqB8K,WACnB,IAAKA,EAAc,MAAMzB,MAAM,kDAE/B,UACQ1F,EAAIiH,YAAYE,GACtB,MAAMC,QAAgBpH,EAAIqH,QAAQF,GAClC,GAAIC,EAAQE,GAAI,CAEd,aADoBtH,EAAIiH,YAA0B,QAAd9J,EAAAiK,EAAQ5K,YAAM,IAAAW,OAAA,EAAAA,EAAAoK,WAEnD,CAED,MAAM7B,MAAmB,QAAb9H,EAAAwJ,EAAQF,aAAK,IAAAtJ,OAAA,EAAAA,EAAE4J,aAK5B,CAJC,MAAOC,GAGP,MADAzC,SAAAA,EAAQkC,MAAM,kCAAmCO,GAC3C/B,MAAM,kCACb,CACF,EAQDrJ,gCACE2K,EACAG,GAEA,IAAKH,IAAiBG,EAAc,MAAMzB,MAAM,6CAEhD,IAEE,aADoB1F,EAAI0H,gBAAgBV,EAKzC,CAHC,MAAOE,GAEPlC,SAAAA,EAAQ2C,IAAI,mDACb,CAED,OAAO3H,EAAI4H,eAAeT,EAC3B,EAOD9K,wBAAwB6I,GACtB,IAAKA,EAAW,MAAMQ,MAAM,gCAE5B,IAAInJ,EACJ,IACEA,QAAayD,EAAIkF,UAAU2C,SAAS3C,EAIrC,CAHC,MAAOgC,GAEP,MADAlC,SAAAA,EAAQkC,MAAM,gCAAiCA,GACzCxB,MAAM,gCACb,CAED,MAAM6B,WAAEA,GAAehL,EAAKC,KAC5B,IAAK+K,EAEH,MADAvC,SAAAA,EAAQkC,MAAM,gDACRxB,MAAM,iCAGd,IAEE,aADoB1F,EAAIiH,YAAYM,EAKrC,CAHC,MAAOL,GAEP,MADAlC,SAAAA,EAAQkC,MAAM,sCAAuCA,GAC/CxB,MAAM,gCACb,CACF,EAQDoC,oBAAmB,CAAC7J,EAA8BsE,IACzCvC,EAAI+H,0BAA0B9J,EAAU,KAAMsE,GASvDwF,0BACE9J,EACAE,EACAoE,GAEA,MAAMyF,EAAUhK,EAA2BC,EZrNb,cYqN6CE,GAC3E,OAAOoE,EAAY0F,OAAOC,GAASF,EAAQG,SAASD,IACrD,EAQDE,cAAa,CAACnK,EAA8BqC,IACnCN,EAAIqI,oBAAoBpK,EAAU,KAAMqC,GASjD+H,oBAAoBpK,EAA8BE,EAAgBmC,GAChE,MAAMgI,EAAatK,EAA2BC,EZxOtB,QYwOgDE,GACxE,OAAOmC,EAAM2H,OAAO5C,GAASiD,EAAWH,SAAS9C,IAClD,IAGH,OAAOkD,EAAAA,SACLvI,EACA,CACE,mBACA,iBACA,sBACA,mBACA,uBACA,uBACA,iBACA,gBACA,cACA,yBACA,yBACA,WAEF7D,EACD,EAoBHmI,EAAQkE,uBZ1R8B,MY2RtClE,EAAQmE,uBZzR8B"}
+{"version":3,"file":"index.cjs.js","sources":["../../lib/constants.ts","../../lib/helpers.ts","../../lib/management/paths.ts","../../lib/management/user.ts","../../lib/management/tenant.ts","../../lib/management/jwt.ts","../../lib/management/permission.ts","../../lib/management/role.ts","../../lib/management/group.ts","../../lib/management/sso.ts","../../lib/management/accesskey.ts","../../lib/fetch-polyfill.ts","../../lib/index.ts","../../lib/management/index.ts"],"sourcesContent":["// eslint-disable-next-line import/prefer-default-export\n/** Refresh JWT cookie name */\nexport const refreshTokenCookieName = 'DSR';\n/** Session JWT cookie name */\nexport const sessionTokenCookieName = 'DS';\n/** The key of the tenants claims in the claims map */\nexport const authorizedTenantsClaimName = 'tenants';\n/** The key of the permissions claims in the claims map either under tenant or top level */\nexport const permissionsClaimName = 'permissions';\n/** The key of the roles claims in the claims map either under tenant or top level */\nexport const rolesClaimName = 'roles';\n","import type { SdkFnWrapper } from '@descope/core-js-sdk';\nimport { authorizedTenantsClaimName, refreshTokenCookieName } from './constants';\nimport { AuthenticationInfo } from './types';\n\n/**\n * Generate a cookie string from given parameters\n * @param name name of the cookie\n * @param value value of cookie that must be already encoded\n * @param options any options to put on the cookie like cookieDomain, cookieMaxAge, cookiePath\n * @returns Cookie string with all options on the string\n */\nconst generateCookie = (name: string, value: string, options?: Record<string, string | number>) =>\n  `${name}=${value}; Domain=${options?.cookieDomain || ''}; Max-Age=${\n    options?.cookieMaxAge || ''\n  }; Path=${options?.cookiePath || '/'}; HttpOnly; SameSite=Strict`;\n\n/**\n * Parse the cookie string and return the value of the cookie\n * @param cookie the raw cookie string\n * @param name the name of the cookie to get value for\n * @returns the value of the given cookie\n */\nconst getCookieValue = (cookie: string | null | undefined, name: string) => {\n  const match = cookie?.match(RegExp(`(?:^|;\\\\s*)${name}=([^;]*)`));\n  return match ? match[1] : null;\n};\n\n// eslint-disable-next-line import/prefer-default-export\n/**\n * Add cookie generation to core-js functions.\n * @param fn the function we are wrapping\n * @returns Wrapped function with cookie generation\n */\nexport const withCookie: SdkFnWrapper<{ refreshJwt?: string; cookies?: string[] }> =\n  (fn) =>\n  async (...args) => {\n    const resp = await fn(...args);\n\n    // istanbul ignore next\n    if (!resp.data) {\n      return resp;\n    }\n\n    // eslint-disable-next-line prefer-const\n    let { refreshJwt, ...rest } = resp.data;\n    const cookies: string[] = [];\n\n    if (!refreshJwt) {\n      if (resp.response?.headers.get('set-cookie')) {\n        refreshJwt = getCookieValue(\n          resp.response?.headers.get('set-cookie'),\n          refreshTokenCookieName,\n        );\n        cookies.push(resp.response?.headers.get('set-cookie')!);\n      }\n    } else {\n      cookies.push(generateCookie(refreshTokenCookieName, refreshJwt, rest));\n    }\n\n    return { ...resp, data: { ...resp.data, refreshJwt, cookies } };\n  };\n\n/**\n * Get the claim (used for permissions or roles) for a given tenant or top level if tenant is empty\n * @param authInfo The parsed authentication info from the JWT\n * @param claim name of the claim\n * @param tenant tenant to retrieve the claim for\n * @returns\n */\nexport function getAuthorizationClaimItems(\n  authInfo: AuthenticationInfo,\n  claim: string,\n  tenant?: string,\n): string[] {\n  const value = tenant\n    ? authInfo.token[authorizedTenantsClaimName]?.[tenant]?.[claim]\n    : authInfo.token[claim];\n  return Array.isArray(value) ? value : [];\n}\n","/** API paths for the Descope service Management APIs */\nexport default {\n  user: {\n    create: '/v1/mgmt/user/create',\n    update: '/v1/mgmt/user/update',\n    delete: '/v1/mgmt/user/delete',\n    load: '/v1/mgmt/user',\n    search: '/v1/mgmt/user/search',\n    updateStatus: '/v1/mgmt/user/update/status',\n    updateEmail: '/v1/mgmt/user/update/email',\n    updatePhone: '/v1/mgmt/user/update/phone',\n    updateDisplayName: '/v1/mgmt/user/update/name',\n    addRole: '/v1/mgmt/user/update/role/add',\n    removeRole: '/v1/mgmt/user/update/role/remove',\n    addTenant: '/v1/mgmt/user/update/tenant/add',\n    removeTenant: '/v1/mgmt/user/update/tenant/remove',\n  },\n  accessKey: {\n    create: '/v1/mgmt/accesskey/create',\n    load: '/v1/mgmt/accesskey',\n    search: '/v1/mgmt/accesskey/search',\n    update: '/v1/mgmt/accesskey/update',\n    deactivate: '/v1/mgmt/accesskey/deactivate',\n    activate: '/v1/mgmt/accesskey/activate',\n    delete: '/v1/mgmt/accesskey/delete',\n  },\n  tenant: {\n    create: '/v1/mgmt/tenant/create',\n    update: '/v1/mgmt/tenant/update',\n    delete: '/v1/mgmt/tenant/delete',\n    loadAll: '/v1/mgmt/tenant/all',\n  },\n  sso: {\n    configure: '/v1/mgmt/sso/settings',\n    metadata: '/v1/mgmt/sso/metadata',\n    mapping: '/v1/mgmt/sso/mapping',\n  },\n  jwt: {\n    update: '/v1/mgmt/jwt/update',\n  },\n  permission: {\n    create: '/v1/mgmt/permission/create',\n    update: '/v1/mgmt/permission/update',\n    delete: '/v1/mgmt/permission/delete',\n    loadAll: '/v1/mgmt/permission/all',\n  },\n  role: {\n    create: '/v1/mgmt/role/create',\n    update: '/v1/mgmt/role/update',\n    delete: '/v1/mgmt/role/delete',\n    loadAll: '/v1/mgmt/role/all',\n  },\n  group: {\n    loadAllGroups: '/v1/mgmt/group/all',\n    loadAllGroupsForMember: '/v1/mgmt/group/member/all',\n    loadAllGroupMembers: '/v1/mgmt/group/members',\n  },\n};\n","import { SdkResponse, transformResponse, UserResponse } from '@descope/core-js-sdk';\nimport { CoreSdk } from '../types';\nimport apiPaths from './paths';\nimport { AssociatedTenant } from './types';\n\ntype SingleUserResponse = {\n  user: UserResponse;\n};\n\ntype MultipleUsersResponse = {\n  users: UserResponse[];\n};\n\nconst withUser = (sdk: CoreSdk, managementKey?: string) => ({\n  create: (\n    loginId: string,\n    email?: string,\n    phone?: string,\n    displayName?: string,\n    roles?: string[],\n    userTenants?: AssociatedTenant[],\n  ): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.create,\n        { loginId, email, phone, displayName, roleNames: roles, userTenants },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  invite: (\n    loginId: string,\n    email?: string,\n    phone?: string,\n    displayName?: string,\n    roles?: string[],\n    userTenants?: AssociatedTenant[],\n  ): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.create,\n        { loginId, email, phone, displayName, roleNames: roles, userTenants, invite: true },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  update: (\n    loginId: string,\n    email?: string,\n    phone?: string,\n    displayName?: string,\n    roles?: string[],\n    userTenants?: AssociatedTenant[],\n  ): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.update,\n        { loginId, email, phone, displayName, roleNames: roles, userTenants },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  delete: (loginId: string): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(apiPaths.user.delete, { loginId }, { token: managementKey }),\n    ),\n  load: (loginId: string): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.get(apiPaths.user.load, {\n        queryParams: { loginId },\n        token: managementKey,\n      }),\n      (data) => data.user,\n    ),\n  /**\n   * Load an existing user by user ID. The ID can be found\n   * on the user's JWT.\n   * @param userId load a user by this user ID field\n   * @returns The UserResponse if found, throws otherwise.\n   */\n  loadByUserId: (userId: string): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.get(apiPaths.user.load, {\n        queryParams: { userId },\n        token: managementKey,\n      }),\n      (data) => data.user,\n    ),\n  /**\n   * Search all users. Results can be filtered according to tenants and/or\n   * roles, and also paginated used the limit and page parameters.\n   * @param tenantIds optional list of tenant IDs to filter by\n   * @param roles optional list of roles to filter by\n   * @param limit optionally limit the response, leave out for default limit\n   * @param page optionally paginate over the response\n   * @returns An array of UserResponse found by the query\n   */\n  searchAll: (\n    tenantIds?: string[],\n    roles?: string[],\n    limit?: number,\n    page?: number,\n  ): Promise<SdkResponse<UserResponse[]>> =>\n    transformResponse<MultipleUsersResponse, UserResponse[]>(\n      sdk.httpClient.post(\n        apiPaths.user.search,\n        { tenantIds, roleNames: roles, limit, page },\n        { token: managementKey },\n      ),\n      (data) => data.users,\n    ),\n  activate: (loginId: string): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.updateStatus,\n        { loginId, status: 'enabled' },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  deactivate: (loginId: string): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.updateStatus,\n        { loginId, status: 'disabled' },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  updateEmail: (\n    loginId: string,\n    email: string,\n    isVerified: boolean,\n  ): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.updateEmail,\n        { loginId, email, verified: isVerified },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  updatePhone: (\n    loginId: string,\n    phone: string,\n    isVerified: boolean,\n  ): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.updatePhone,\n        { loginId, phone, verified: isVerified },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  updateDisplayName: (loginId: string, displayName: string): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.updateDisplayName,\n        { loginId, displayName },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  addRoles: (loginId: string, roles: string[]): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.addRole,\n        { loginId, roleNames: roles },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  removeRoles: (loginId: string, roles: string[]): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.removeRole,\n        { loginId, roleNames: roles },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  addTenant: (loginId: string, tenantId: string): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(apiPaths.user.addTenant, { loginId, tenantId }, { token: managementKey }),\n      (data) => data.user,\n    ),\n  removeTenant: (loginId: string, tenantId: string): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.removeTenant,\n        { loginId, tenantId },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  addTenantRoles: (\n    loginId: string,\n    tenantId: string,\n    roles: string[],\n  ): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.addRole,\n        { loginId, tenantId, roleNames: roles },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  removeTenantRoles: (\n    loginId: string,\n    tenantId: string,\n    roles: string[],\n  ): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.removeRole,\n        { loginId, tenantId, roleNames: roles },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n});\n\nexport default withUser;\n","import { SdkResponse, transformResponse } from '@descope/core-js-sdk';\nimport { CoreSdk } from '../types';\nimport apiPaths from './paths';\nimport { CreateTenantResponse, Tenant } from './types';\n\ntype MultipleTenantResponse = {\n  tenants: Tenant[];\n};\n\nconst withTenant = (sdk: CoreSdk, managementKey?: string) => ({\n  create: (\n    name: string,\n    selfProvisioningDomains?: string[],\n  ): Promise<SdkResponse<CreateTenantResponse>> =>\n    transformResponse(\n      sdk.httpClient.post(\n        apiPaths.tenant.create,\n        { name, selfProvisioningDomains },\n        { token: managementKey },\n      ),\n    ),\n  createWithId: (\n    id: string,\n    name: string,\n    selfProvisioningDomains?: string[],\n  ): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(\n        apiPaths.tenant.create,\n        { id, name, selfProvisioningDomains },\n        { token: managementKey },\n      ),\n    ),\n  update: (\n    id: string,\n    name: string,\n    selfProvisioningDomains?: string[],\n  ): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(\n        apiPaths.tenant.update,\n        { id, name, selfProvisioningDomains },\n        { token: managementKey },\n      ),\n    ),\n  delete: (id: string): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(apiPaths.tenant.delete, { id }, { token: managementKey }),\n    ),\n  loadAll: (): Promise<SdkResponse<Tenant[]>> =>\n    transformResponse<MultipleTenantResponse, Tenant[]>(\n      sdk.httpClient.get(apiPaths.tenant.loadAll, {\n        token: managementKey,\n      }),\n      (data) => data.tenants,\n    ),\n});\n\nexport default withTenant;\n","import { SdkResponse, transformResponse } from '@descope/core-js-sdk';\nimport { CoreSdk } from '../types';\nimport apiPaths from './paths';\nimport { UpdateJWTResponse } from './types';\n\nconst withJWT = (sdk: CoreSdk, managementKey?: string) => ({\n  update: (\n    jwt: string,\n    customClaims?: Record<string, any>,\n  ): Promise<SdkResponse<UpdateJWTResponse>> =>\n    transformResponse(\n      sdk.httpClient.post(apiPaths.jwt.update, { jwt, customClaims }, { token: managementKey }),\n    ),\n});\n\nexport default withJWT;\n","import { SdkResponse, transformResponse } from '@descope/core-js-sdk';\nimport { CoreSdk } from '../types';\nimport apiPaths from './paths';\nimport { Permission } from './types';\n\ntype MultiplePermissionResponse = {\n  permissions: Permission[];\n};\n\nconst withPermission = (sdk: CoreSdk, managementKey?: string) => ({\n  create: (name: string, description?: string): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(\n        apiPaths.permission.create,\n        { name, description },\n        { token: managementKey },\n      ),\n    ),\n  update: (name: string, newName: string, description?: string): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(\n        apiPaths.permission.update,\n        { name, newName, description },\n        { token: managementKey },\n      ),\n    ),\n  delete: (name: string): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(apiPaths.permission.delete, { name }, { token: managementKey }),\n    ),\n  loadAll: (): Promise<SdkResponse<Permission[]>> =>\n    transformResponse<MultiplePermissionResponse, Permission[]>(\n      sdk.httpClient.get(apiPaths.permission.loadAll, {\n        token: managementKey,\n      }),\n      (data) => data.permissions,\n    ),\n});\n\nexport default withPermission;\n","import { SdkResponse, transformResponse } from '@descope/core-js-sdk';\nimport { CoreSdk } from '../types';\nimport apiPaths from './paths';\nimport { Role } from './types';\n\ntype MultipleRoleResponse = {\n  roles: Role[];\n};\n\nconst withRole = (sdk: CoreSdk, managementKey?: string) => ({\n  create: (\n    name: string,\n    description?: string,\n    permissionNames?: string[],\n  ): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(\n        apiPaths.role.create,\n        { name, description, permissionNames },\n        { token: managementKey },\n      ),\n    ),\n  update: (\n    name: string,\n    newName: string,\n    description?: string,\n    permissionNames?: string[],\n  ): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(\n        apiPaths.role.update,\n        { name, newName, description, permissionNames },\n        { token: managementKey },\n      ),\n    ),\n  delete: (name: string): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(apiPaths.role.delete, { name }, { token: managementKey }),\n    ),\n  loadAll: (): Promise<SdkResponse<Role[]>> =>\n    transformResponse<MultipleRoleResponse, Role[]>(\n      sdk.httpClient.get(apiPaths.role.loadAll, {\n        token: managementKey,\n      }),\n      (data) => data.roles,\n    ),\n});\n\nexport default withRole;\n","import { SdkResponse, transformResponse } from '@descope/core-js-sdk';\nimport { CoreSdk } from '../types';\nimport apiPaths from './paths';\nimport { Group } from './types';\n\nconst withGroup = (sdk: CoreSdk, managementKey?: string) => ({\n  /**\n   * Load all groups for a specific tenant id.\n   * @param tenantId Tenant ID to load groups from.\n   * @returns Group[] list of groups\n   */\n  loadAllGroups: (tenantId: string): Promise<SdkResponse<Group[]>> =>\n    transformResponse<Group[]>(\n      sdk.httpClient.post(apiPaths.group.loadAllGroups, { tenantId }, { token: managementKey }),\n    ),\n\n  /**\n   * Load all groups for the provided user IDs or login IDs.\n   * @param tenantId Tenant ID to load groups from.\n   * @param userIds Optional List of user IDs, with the format of \"U2J5ES9S8TkvCgOvcrkpzUgVTEBM\" (example), which can be found on the user's JWT.\n   * @param loginIds Optional List of login IDs, how the user identifies when logging in.\n   * @returns Group[] list of groups\n   */\n  loadAllGroupsForMember: (\n    tenantId: string,\n    userIds: string[],\n    loginIds: string[],\n  ): Promise<SdkResponse<Group[]>> =>\n    transformResponse<Group[]>(\n      sdk.httpClient.post(\n        apiPaths.group.loadAllGroupsForMember,\n        { tenantId, loginIds, userIds },\n        { token: managementKey },\n      ),\n    ),\n\n  /**\n   * Load all members of the provided group id.\n   * @param tenantId Tenant ID to load groups from.\n   * @param groupId Group ID to load members for.\n   * @returns Group[] list of groups\n   */\n  loadAllGroupMembers: (tenantId: string, groupId: string): Promise<SdkResponse<Group[]>> =>\n    transformResponse<Group[]>(\n      sdk.httpClient.post(\n        apiPaths.group.loadAllGroupMembers,\n        { tenantId, groupId },\n        { token: managementKey },\n      ),\n    ),\n});\n\nexport default withGroup;\n","import { SdkResponse, transformResponse } from '@descope/core-js-sdk';\nimport { CoreSdk } from '../types';\nimport apiPaths from './paths';\nimport { RoleMapping, AttributeMapping } from './types';\n\nconst withSSOSettings = (sdk: CoreSdk, managementKey?: string) => ({\n  configureSettings: (\n    tenantId: string,\n    idpURL: string,\n    idpCert: string,\n    entityId: string,\n    redirectURL?: string,\n    domain?: string,\n  ): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(\n        apiPaths.sso.configure,\n        { tenantId, idpURL, entityId, idpCert, redirectURL, domain },\n        { token: managementKey },\n      ),\n    ),\n  configureMetadata: (tenantId: string, idpMetadataURL: string): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(\n        apiPaths.sso.metadata,\n        { tenantId, idpMetadataURL },\n        { token: managementKey },\n      ),\n    ),\n  configureMapping: (\n    tenantId: string,\n    roleMapping?: RoleMapping,\n    attributeMapping?: AttributeMapping,\n  ): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(\n        apiPaths.sso.mapping,\n        { tenantId, roleMapping, attributeMapping },\n        { token: managementKey },\n      ),\n    ),\n});\n\nexport default withSSOSettings;\n","import { SdkResponse, transformResponse } from '@descope/core-js-sdk';\nimport { CoreSdk } from '../types';\nimport apiPaths from './paths';\nimport { AccessKey, AssociatedTenant, CreatedAccessKeyResponse } from './types';\n\ntype SingleKeyResponse = {\n  key: AccessKey;\n};\n\ntype MultipleKeysResponse = {\n  keys: AccessKey[];\n};\n\nconst withAccessKey = (sdk: CoreSdk, managementKey?: string) => ({\n  /**\n   * Create a new access key for a project.\n   * @param name Access key name\n   * @param expireTime When the access key expires. Keep at 0 to make it indefinite.\n   * @param roles Optional roles in the project. Does not apply for multi-tenants\n   * @param keyTenants Optional associated tenants for this key and its roles for each.\n   * @returns A newly created key and its cleartext. Make sure to save the cleartext securely.\n   */\n  create: (\n    name: string,\n    expireTime: number,\n    roles?: string[],\n    keyTenants?: AssociatedTenant[],\n  ): Promise<SdkResponse<CreatedAccessKeyResponse>> =>\n    transformResponse(\n      sdk.httpClient.post(\n        apiPaths.accessKey.create,\n        { name, expireTime, roleNames: roles, keyTenants },\n        { token: managementKey },\n      ),\n    ),\n  /**\n   * Load an access key.\n   * @param id Access key ID to load\n   * @returns The loaded access key.\n   */\n  load: (id: string): Promise<SdkResponse<AccessKey>> =>\n    transformResponse<SingleKeyResponse, AccessKey>(\n      sdk.httpClient.get(apiPaths.accessKey.load, {\n        queryParams: { id },\n        token: managementKey,\n      }),\n      (data) => data.key,\n    ),\n  /**\n   * Search all access keys\n   * @param tenantIds Optional tenant ID filter to apply on the search results\n   * @returns An array of found access keys\n   */\n  searchAll: (tenantIds?: string[]): Promise<SdkResponse<AccessKey[]>> =>\n    transformResponse<MultipleKeysResponse, AccessKey[]>(\n      sdk.httpClient.post(apiPaths.accessKey.search, { tenantIds }, { token: managementKey }),\n      (data) => data.keys,\n    ),\n  /**\n   * Update an access key.\n   * @param id Access key ID to load\n   * @param name The updated access key name\n   * @returns The updated access key\n   */\n  update: (id: string, name: string): Promise<SdkResponse<AccessKey>> =>\n    transformResponse<SingleKeyResponse, AccessKey>(\n      sdk.httpClient.post(apiPaths.accessKey.update, { id, name }, { token: managementKey }),\n      (data) => data.key,\n    ),\n  /**\n   * Deactivate an access key. Deactivated access keys cannot be used until they are\n   * activated again.\n   * @param id Access key ID to deactivate\n   */\n  deactivate: (id: string): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(apiPaths.accessKey.deactivate, { id }, { token: managementKey }),\n    ),\n  /**\n   * Activate an access key. Only deactivated access keys can be activated again.\n   * @param id Access key ID to activate\n   */\n  activate: (id: string): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(apiPaths.accessKey.activate, { id }, { token: managementKey }),\n    ),\n  /**\n   * Delete an access key. IMPORTANT: This cannot be undone. Use carefully.\n   * @param id Access key ID to delete\n   */\n  delete: (id: string): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(apiPaths.accessKey.delete, { id }, { token: managementKey }),\n    ),\n});\n\nexport default withAccessKey;\n","import nodeFetch, { Headers } from 'node-fetch-commonjs';\n\nglobalThis.Headers ??= Headers;\n\nconst highWaterMarkMb = 1024 * 1024 * 1024 * 30; // 30MB\n\n// we are increasing the response buffer size due to an issue where node-fetch hangs when response is too big\nconst patchedFetch = (...args: Parameters<typeof nodeFetch>) => {\n  // we can get Request on the first arg, or RequestInfo on the second arg\n  // we want to make sure we are setting the \"highWaterMark\" so we are doing it on both args\n  args.forEach((arg) => {\n    // eslint-disable-next-line no-param-reassign, @typescript-eslint/no-unused-expressions\n    arg && ((arg as any).highWaterMark ??= highWaterMarkMb);\n  });\n\n  return nodeFetch(...args);\n};\n\nexport default patchedFetch as unknown as typeof fetch;\n","import createSdk, { ExchangeAccessKeyResponse, SdkResponse, wrapWith } from '@descope/core-js-sdk';\nimport { JWK, JWTHeaderParameters, KeyLike, errors, importJWK, jwtVerify } from 'jose';\nimport {\n  permissionsClaimName,\n  refreshTokenCookieName,\n  rolesClaimName,\n  sessionTokenCookieName,\n} from './constants';\nimport { getAuthorizationClaimItems, withCookie } from './helpers';\nimport withManagement from './management';\nimport { AuthenticationInfo } from './types';\nimport fetch from './fetch-polyfill';\n\ndeclare const BUILD_VERSION: string;\n\n/** Configuration arguments which include the Descope core SDK args and an optional management key */\ntype NodeSdkArgs = Parameters<typeof createSdk>[0] & {\n  managementKey?: string;\n};\n\nconst nodeSdk = ({ managementKey, ...config }: NodeSdkArgs) => {\n  const coreSdk = createSdk({\n    ...config,\n    fetch,\n    baseHeaders: {\n      ...config.baseHeaders,\n      'x-descope-sdk-name': 'nodejs',\n      'x-descope-sdk-node-version': process?.versions?.node || '',\n      'x-descope-sdk-version': BUILD_VERSION,\n    },\n  });\n\n  const { projectId, logger } = config;\n\n  const keys: Record<string, KeyLike | Uint8Array> = {};\n\n  /** Fetch the public keys (JWKs) from Descope for the configured project */\n  const fetchKeys = async () => {\n    const keysWrapper = await coreSdk.httpClient\n      .get(`v2/keys/${projectId}`)\n      .then((resp) => resp.json());\n    const publicKeys: JWK[] = keysWrapper.keys;\n    if (!Array.isArray(publicKeys)) return {};\n    const kidJwksPairs = await Promise.all(\n      publicKeys.map(async (key) => [key.kid, await importJWK(key)]),\n    );\n\n    return kidJwksPairs.reduce(\n      (acc, [kid, jwk]) => (kid ? { ...acc, [kid.toString()]: jwk } : acc),\n      {},\n    );\n  };\n\n  const management = withManagement(coreSdk, managementKey);\n\n  const sdk = {\n    ...coreSdk,\n\n    /**\n     * Provides various APIs for managing a Descope project programmatically. A management key must\n     * be provided as an argument when initializing the SDK to use these APIs. Management keys can be\n     * generated in the Descope console.\n     */\n    management,\n\n    /** Get the key that can validate the given JWT KID in the header. Can retrieve the public key from local cache or from Descope. */\n    async getKey(header: JWTHeaderParameters): Promise<KeyLike | Uint8Array> {\n      if (!header?.kid) throw Error('header.kid must not be empty');\n\n      if (keys[header.kid]) return keys[header.kid];\n\n      // do we need to fetch once or every time?\n      Object.assign(keys, await fetchKeys());\n\n      if (!keys[header.kid]) throw Error('failed to fetch matching key');\n\n      return keys[header.kid];\n    },\n\n    /**\n     * Validate the given JWT with the right key and make sure the issuer is correct\n     * @param jwt the JWT string to parse and validate\n     * @returns AuthenticationInfo with the parsed token and JWT. Will throw an error if validation fails.\n     */\n    async validateJwt(jwt: string): Promise<AuthenticationInfo> {\n      // Do not hard-code the algo because library does not support `None` so all are valid\n      const res = await jwtVerify(jwt, sdk.getKey, { clockTolerance: 5 });\n      const token = res.payload;\n\n      if (token) {\n        token.iss = token.iss?.split('/').pop(); // support both url and project id as issuer\n        if (token.iss !== projectId) {\n          // We must do the verification here, since issuer can be either project ID or URL\n          throw new errors.JWTClaimValidationFailed(\n            'unexpected \"iss\" claim value',\n            'iss',\n            'check_failed',\n          );\n        }\n      }\n\n      return { jwt, token };\n    },\n\n    /**\n     * Validate an active session\n     * @param sessionToken session JWT to validate\n     * @returns AuthenticationInfo promise or throws Error if there is an issue with JWTs\n     */\n    async validateSession(sessionToken: string): Promise<AuthenticationInfo> {\n      if (!sessionToken) throw Error('session token is required for validation');\n\n      try {\n        const token = await sdk.validateJwt(sessionToken);\n        return token;\n      } catch (error) {\n        /* istanbul ignore next */\n        logger?.error('session validation failed', error);\n        throw Error('session validation failed');\n      }\n    },\n\n    /**\n     * Refresh the session using a refresh token\n     * @param refreshToken refresh JWT to refresh the session with\n     * @returns AuthenticationInfo promise or throws Error if there is an issue with JWTs\n     */\n    async refreshSession(refreshToken: string): Promise<AuthenticationInfo> {\n      if (!refreshToken) throw Error('refresh token is required to refresh a session');\n\n      try {\n        await sdk.validateJwt(refreshToken);\n        const jwtResp = await sdk.refresh(refreshToken);\n        if (jwtResp.ok) {\n          const token = await sdk.validateJwt(jwtResp.data?.sessionJwt);\n          return token;\n        }\n        /* istanbul ignore next */\n        throw Error(jwtResp.error?.errorMessage);\n      } catch (refreshTokenErr) {\n        /* istanbul ignore next */\n        logger?.error('refresh token validation failed', refreshTokenErr);\n        throw Error('refresh token validation failed');\n      }\n    },\n\n    /**\n     * Validate session and refresh it if it expired\n     * @param sessionToken session JWT\n     * @param refreshToken refresh JWT\n     * @returns AuthenticationInfo promise or throws Error if there is an issue with JWTs\n     */\n    async validateAndRefreshSession(\n      sessionToken?: string,\n      refreshToken?: string,\n    ): Promise<AuthenticationInfo> {\n      if (!sessionToken && !refreshToken) throw Error('both session and refresh tokens are empty');\n\n      try {\n        const token = await sdk.validateSession(sessionToken);\n        return token;\n      } catch (error) {\n        /* istanbul ignore next */\n        logger?.log('session validation failed - trying to refresh it');\n      }\n\n      return sdk.refreshSession(refreshToken);\n    },\n\n    /**\n     * Exchange API key (access key) for a session key\n     * @param accessKey access key to exchange for a session JWT\n     * @returns AuthneticationInfo with session JWT data\n     */\n    async exchangeAccessKey(accessKey: string): Promise<AuthenticationInfo> {\n      if (!accessKey) throw Error('access key must not be empty');\n\n      let resp: SdkResponse<ExchangeAccessKeyResponse>;\n      try {\n        resp = await sdk.accessKey.exchange(accessKey);\n      } catch (error) {\n        logger?.error('failed to exchange access key', error);\n        throw Error('could not exchange access key');\n      }\n\n      const { sessionJwt } = resp.data;\n      if (!sessionJwt) {\n        logger?.error('failed to parse exchange access key response');\n        throw Error('could not exchange access key');\n      }\n\n      try {\n        const token = await sdk.validateJwt(sessionJwt);\n        return token;\n      } catch (error) {\n        logger?.error('failed to parse jwt from access key', error);\n        throw Error('could not exchange access key');\n      }\n    },\n\n    /**\n     * Make sure that all given permissions exist on the parsed JWT top level claims\n     * @param authInfo JWT parsed info\n     * @param permissions list of permissions to make sure they exist on te JWT claims\n     * @returns true if all permissions exist, false otherwise\n     */\n    validatePermissions(authInfo: AuthenticationInfo, permissions: string[]): boolean {\n      return sdk.validateTenantPermissions(authInfo, null, permissions);\n    },\n\n    /**\n     * Make sure that all given permissions exist on the parsed JWT tenant claims\n     * @param authInfo JWT parsed info\n     * @param permissions list of permissions to make sure they exist on te JWT claims\n     * @returns true if all permissions exist, false otherwise\n     */\n    validateTenantPermissions(\n      authInfo: AuthenticationInfo,\n      tenant: string,\n      permissions: string[],\n    ): boolean {\n      const granted = getAuthorizationClaimItems(authInfo, permissionsClaimName, tenant);\n      return permissions.every((perm) => granted.includes(perm));\n    },\n\n    /**\n     * Make sure that all given roles exist on the parsed JWT top level claims\n     * @param authInfo JWT parsed info\n     * @param roles list of roles to make sure they exist on te JWT claims\n     * @returns true if all roles exist, false otherwise\n     */\n    validateRoles(authInfo: AuthenticationInfo, roles: string[]): boolean {\n      return sdk.validateTenantRoles(authInfo, null, roles);\n    },\n\n    /**\n     * Make sure that all given roles exist on the parsed JWT tenant claims\n     * @param authInfo JWT parsed info\n     * @param roles list of roles to make sure they exist on te JWT claims\n     * @returns true if all roles exist, false otherwise\n     */\n    validateTenantRoles(authInfo: AuthenticationInfo, tenant: string, roles: string[]): boolean {\n      const membership = getAuthorizationClaimItems(authInfo, rolesClaimName, tenant);\n      return roles.every((role) => membership.includes(role));\n    },\n  };\n\n  return wrapWith(\n    sdk,\n    [\n      'otp.verify.email',\n      'otp.verify.sms',\n      'otp.verify.whatsapp',\n      'magicLink.verify',\n      'enchantedLink.signUp',\n      'enchantedLink.signIn',\n      'oauth.exchange',\n      'saml.exchange',\n      'totp.verify',\n      'webauthn.signIn.finish',\n      'webauthn.signUp.finish',\n      'refresh',\n    ] as const,\n    withCookie,\n  );\n};\n\n/** Descope SDK client with delivery methods enum.\n *\n * Please see full documentation at {@link https://docs.descope.com/guides Descope Docs}\n * @example Usage\n *\n * ```js\n * import descopeSdk from '@descope/node-sdk';\n *\n * const myProjectId = 'xxx';\n * const sdk = descopeSdk({ projectId: myProjectId });\n *\n * const userLoginId = 'loginId';\n * sdk.otp.signIn.email(userLoginId);\n * const jwtResponse = sdk.otp.verify.email(userLoginId, codeFromEmail);\n * ```\n */\n\nnodeSdk.RefreshTokenCookieName = refreshTokenCookieName;\nnodeSdk.SessionTokenCookieName = sessionTokenCookieName;\n\nexport default nodeSdk;\nexport type { DeliveryMethod, OAuthProvider } from '@descope/core-js-sdk';\n","import { CoreSdk } from '../types';\nimport withUser from './user';\nimport withTenant from './tenant';\nimport withJWT from './jwt';\nimport withPermission from './permission';\nimport withRole from './role';\nimport withGroup from './group';\nimport withSSOSettings from './sso';\nimport withAccessKey from './accesskey';\n\n/** Constructs a higher level Management API that wraps the functions from code-js-sdk */\nconst withManagement = (sdk: CoreSdk, managementKey?: string) => ({\n  user: withUser(sdk, managementKey),\n  accessKey: withAccessKey(sdk, managementKey),\n  tenant: withTenant(sdk, managementKey),\n  sso: withSSOSettings(sdk, managementKey),\n  jwt: withJWT(sdk, managementKey),\n  permission: withPermission(sdk, managementKey),\n  role: withRole(sdk, managementKey),\n  group: withGroup(sdk, managementKey),\n});\n\nexport default withManagement;\n"],"names":["withCookie","fn","async","args","resp","data","_d","refreshJwt","rest","__rest","cookies","options","push","cookieDomain","cookieMaxAge","cookiePath","_a","response","headers","get","cookie","name","match","RegExp","getCookieValue","_b","_c","Object","assign","getAuthorizationClaimItems","authInfo","claim","tenant","value","token","Array","isArray","apiPaths","create","update","delete","load","search","updateStatus","updateEmail","updatePhone","updateDisplayName","addRole","removeRole","addTenant","removeTenant","deactivate","activate","loadAll","configure","metadata","mapping","loadAllGroups","loadAllGroupsForMember","loadAllGroupMembers","withUser","sdk","managementKey","loginId","email","phone","displayName","roles","userTenants","transformResponse","httpClient","post","roleNames","user","invite","queryParams","loadByUserId","userId","searchAll","tenantIds","limit","page","users","status","isVerified","verified","addRoles","removeRoles","tenantId","addTenantRoles","removeTenantRoles","withTenant","selfProvisioningDomains","createWithId","id","tenants","withJWT","jwt","customClaims","withPermission","description","newName","permissions","withRole","permissionNames","withGroup","userIds","loginIds","groupId","withSSOSettings","configureSettings","idpURL","idpCert","entityId","redirectURL","domain","configureMetadata","idpMetadataURL","configureMapping","roleMapping","attributeMapping","withAccessKey","expireTime","keyTenants","key","keys","globalThis","Headers","patchedFetch","forEach","arg","highWaterMark","nodeFetch","nodeSdk","config","coreSdk","createSdk","fetch","baseHeaders","process","versions","node","projectId","logger","management","accessKey","sso","permission","role","group","withManagement","header","kid","Error","publicKeys","then","json","Promise","all","map","importJWK","reduce","acc","jwk","toString","fetchKeys","jwtVerify","getKey","clockTolerance","payload","iss","split","pop","errors","JWTClaimValidationFailed","sessionToken","validateJwt","error","refreshToken","jwtResp","refresh","ok","sessionJwt","errorMessage","refreshTokenErr","validateSession","log","refreshSession","exchange","validatePermissions","validateTenantPermissions","granted","every","perm","includes","validateRoles","validateTenantRoles","membership","wrapWith","RefreshTokenCookieName","SessionTokenCookieName"],"mappings":"mNAEO,MC+BMA,EACVC,GACDC,SAAUC,eACR,MAAMC,QAAaH,KAAME,GAGzB,IAAKC,EAAKC,KACR,OAAOD,EAIT,IAAIE,EAA0BF,EAAKC,MAA/BE,WAAEA,GAAUD,EAAKE,EAAjBC,EAAAA,OAAAH,EAAA,CAAA,eACJ,MAAMI,EAAoB,GAlCP,IAA8BC,EAgDjD,OAZKJ,EASHG,EAAQE,KA5CZ,GDVoC,SCsDoBL,cA5C5BI,OADuBA,EA6CiBH,QA5CxC,EAAAG,EAASE,eAAgB,gBACnDF,aAAA,EAAAA,EAASG,eAAgB,aACjBH,aAAA,EAAAA,EAASI,aAAc,mCAkCZ,QAAbC,EAAAZ,EAAKa,gBAAQ,IAAAD,OAAA,EAAAA,EAAEE,QAAQC,IAAI,iBAC7BZ,EA3Be,EAACa,EAAmCC,KACzD,MAAMC,EAAQF,eAAAA,EAAQE,MAAMC,OAAO,cAAcF,cACjD,OAAOC,EAAQA,EAAM,GAAK,IAAI,EAyBXE,CACE,QAAbC,EAAArB,EAAKa,gBAAQ,IAAAQ,OAAA,EAAAA,EAAEP,QAAQC,IAAI,cDhDC,OCmD9BT,EAAQE,KAAoB,QAAfc,EAAAtB,EAAKa,gBAAU,IAAAS,OAAA,EAAAA,EAAAR,QAAQC,IAAI,gBAMhCQ,OAAAC,OAAAD,OAAAC,OAAA,CAAA,EAAAxB,GAAM,CAAAC,KAAWsB,OAAAC,OAAAD,OAAAC,OAAA,GAAAxB,EAAKC,MAAM,CAAAE,aAAYG,aAAY,WAUpDmB,EACdC,EACAC,EACAC,WAEA,MAAMC,EAAQD,EAC0C,QAApDP,EAA6C,QAA7CT,EAAAc,EAASI,MAAgC,eAAI,IAAAlB,OAAA,EAAAA,EAAAgB,UAAO,IAAAP,OAAA,EAAAA,EAAGM,GACvDD,EAASI,MAAMH,GACnB,OAAOI,MAAMC,QAAQH,GAASA,EAAQ,EACxC,CC7EA,IAAeI,EACP,CACJC,OAAQ,uBACRC,OAAQ,uBACRC,OAAQ,uBACRC,KAAM,gBACNC,OAAQ,uBACRC,aAAc,8BACdC,YAAa,6BACbC,YAAa,6BACbC,kBAAmB,4BACnBC,QAAS,gCACTC,WAAY,mCACZC,UAAW,kCACXC,aAAc,sCAdHb,EAgBF,CACTC,OAAQ,4BACRG,KAAM,qBACNC,OAAQ,4BACRH,OAAQ,4BACRY,WAAY,gCACZC,SAAU,8BACVZ,OAAQ,6BAvBGH,EAyBL,CACNC,OAAQ,yBACRC,OAAQ,yBACRC,OAAQ,yBACRa,QAAS,uBA7BEhB,EA+BR,CACHiB,UAAW,wBACXC,SAAU,wBACVC,QAAS,wBAlCEnB,EAoCR,CACHE,OAAQ,uBArCGF,EAuCD,CACVC,OAAQ,6BACRC,OAAQ,6BACRC,OAAQ,6BACRa,QAAS,2BA3CEhB,EA6CP,CACJC,OAAQ,uBACRC,OAAQ,uBACRC,OAAQ,uBACRa,QAAS,qBAjDEhB,EAmDN,CACLoB,cAAe,qBACfC,uBAAwB,4BACxBC,oBAAqB,0BC1CzB,MAAMC,EAAW,CAACC,EAAcC,KAA4B,CAC1DxB,OAAQ,CACNyB,EACAC,EACAC,EACAC,EACAC,EACAC,IAEAC,EAAiBA,kBACfR,EAAIS,WAAWC,KACblC,EAAcC,OACd,CAAEyB,UAASC,QAAOC,QAAOC,cAAaM,UAAWL,EAAOC,eACxD,CAAElC,MAAO4B,KAEVzD,GAASA,EAAKoE,OAEnBC,OAAQ,CACNX,EACAC,EACAC,EACAC,EACAC,EACAC,IAEAC,EAAAA,kBACER,EAAIS,WAAWC,KACblC,EAAcC,OACd,CAAEyB,UAASC,QAAOC,QAAOC,cAAaM,UAAWL,EAAOC,cAAaM,QAAQ,GAC7E,CAAExC,MAAO4B,KAEVzD,GAASA,EAAKoE,OAEnBlC,OAAQ,CACNwB,EACAC,EACAC,EACAC,EACAC,EACAC,IAEAC,EAAiBA,kBACfR,EAAIS,WAAWC,KACblC,EAAcE,OACd,CAAEwB,UAASC,QAAOC,QAAOC,cAAaM,UAAWL,EAAOC,eACxD,CAAElC,MAAO4B,KAEVzD,GAASA,EAAKoE,OAEnBjC,OAASuB,GACPM,EAAAA,kBACER,EAAIS,WAAWC,KAAKlC,EAAcG,OAAQ,CAAEuB,WAAW,CAAE7B,MAAO4B,KAEpErB,KAAOsB,GACLM,EAAAA,kBACER,EAAIS,WAAWnD,IAAIkB,EAAcI,KAAM,CACrCkC,YAAa,CAAEZ,WACf7B,MAAO4B,KAERzD,GAASA,EAAKoE,OAQnBG,aAAeC,GACbR,EAAAA,kBACER,EAAIS,WAAWnD,IAAIkB,EAAcI,KAAM,CACrCkC,YAAa,CAAEE,UACf3C,MAAO4B,KAERzD,GAASA,EAAKoE,OAWnBK,UAAW,CACTC,EACAZ,EACAa,EACAC,IAEAZ,oBACER,EAAIS,WAAWC,KACblC,EAAcK,OACd,CAAEqC,YAAWP,UAAWL,EAAOa,QAAOC,QACtC,CAAE/C,MAAO4B,KAEVzD,GAASA,EAAK6E,QAEnB9B,SAAWW,GACTM,EAAAA,kBACER,EAAIS,WAAWC,KACblC,EAAcM,aACd,CAAEoB,UAASoB,OAAQ,WACnB,CAAEjD,MAAO4B,KAEVzD,GAASA,EAAKoE,OAEnBtB,WAAaY,GACXM,EAAAA,kBACER,EAAIS,WAAWC,KACblC,EAAcM,aACd,CAAEoB,UAASoB,OAAQ,YACnB,CAAEjD,MAAO4B,KAEVzD,GAASA,EAAKoE,OAEnB7B,YAAa,CACXmB,EACAC,EACAoB,IAEAf,EAAAA,kBACER,EAAIS,WAAWC,KACblC,EAAcO,YACd,CAAEmB,UAASC,QAAOqB,SAAUD,GAC5B,CAAElD,MAAO4B,KAEVzD,GAASA,EAAKoE,OAEnB5B,YAAa,CACXkB,EACAE,EACAmB,IAEAf,EAAAA,kBACER,EAAIS,WAAWC,KACblC,EAAcQ,YACd,CAAEkB,UAASE,QAAOoB,SAAUD,GAC5B,CAAElD,MAAO4B,KAEVzD,GAASA,EAAKoE,OAEnB3B,kBAAmB,CAACiB,EAAiBG,IACnCG,EAAiBA,kBACfR,EAAIS,WAAWC,KACblC,EAAcS,kBACd,CAAEiB,UAASG,eACX,CAAEhC,MAAO4B,KAEVzD,GAASA,EAAKoE,OAEnBa,SAAU,CAACvB,EAAiBI,IAC1BE,EAAiBA,kBACfR,EAAIS,WAAWC,KACblC,EAAcU,QACd,CAAEgB,UAASS,UAAWL,GACtB,CAAEjC,MAAO4B,KAEVzD,GAASA,EAAKoE,OAEnBc,YAAa,CAACxB,EAAiBI,IAC7BE,EAAiBA,kBACfR,EAAIS,WAAWC,KACblC,EAAcW,WACd,CAAEe,UAASS,UAAWL,GACtB,CAAEjC,MAAO4B,KAEVzD,GAASA,EAAKoE,OAEnBxB,UAAW,CAACc,EAAiByB,IAC3BnB,EAAiBA,kBACfR,EAAIS,WAAWC,KAAKlC,EAAcY,UAAW,CAAEc,UAASyB,YAAY,CAAEtD,MAAO4B,KAC5EzD,GAASA,EAAKoE,OAEnBvB,aAAc,CAACa,EAAiByB,IAC9BnB,EAAiBA,kBACfR,EAAIS,WAAWC,KACblC,EAAca,aACd,CAAEa,UAASyB,YACX,CAAEtD,MAAO4B,KAEVzD,GAASA,EAAKoE,OAEnBgB,eAAgB,CACd1B,EACAyB,EACArB,IAEAE,EAAAA,kBACER,EAAIS,WAAWC,KACblC,EAAcU,QACd,CAAEgB,UAASyB,WAAUhB,UAAWL,GAChC,CAAEjC,MAAO4B,KAEVzD,GAASA,EAAKoE,OAEnBiB,kBAAmB,CACjB3B,EACAyB,EACArB,IAEAE,EAAAA,kBACER,EAAIS,WAAWC,KACblC,EAAcW,WACd,CAAEe,UAASyB,WAAUhB,UAAWL,GAChC,CAAEjC,MAAO4B,KAEVzD,GAASA,EAAKoE,SCnNfkB,EAAa,CAAC9B,EAAcC,KAA4B,CAC5DxB,OAAQ,CACNjB,EACAuE,IAEAvB,EAAiBA,kBACfR,EAAIS,WAAWC,KACblC,EAAgBC,OAChB,CAAEjB,OAAMuE,2BACR,CAAE1D,MAAO4B,KAGf+B,aAAc,CACZC,EACAzE,EACAuE,IAEAvB,EAAAA,kBACER,EAAIS,WAAWC,KACblC,EAAgBC,OAChB,CAAEwD,KAAIzE,OAAMuE,2BACZ,CAAE1D,MAAO4B,KAGfvB,OAAQ,CACNuD,EACAzE,EACAuE,IAEAvB,EAAAA,kBACER,EAAIS,WAAWC,KACblC,EAAgBE,OAChB,CAAEuD,KAAIzE,OAAMuE,2BACZ,CAAE1D,MAAO4B,KAGftB,OAASsD,GACPzB,EAAAA,kBACER,EAAIS,WAAWC,KAAKlC,EAAgBG,OAAQ,CAAEsD,MAAM,CAAE5D,MAAO4B,KAEjET,QAAS,IACPgB,EAAiBA,kBACfR,EAAIS,WAAWnD,IAAIkB,EAAgBgB,QAAS,CAC1CnB,MAAO4B,KAERzD,GAASA,EAAK0F,YCjDfC,EAAU,CAACnC,EAAcC,KAA4B,CACzDvB,OAAQ,CACN0D,EACAC,IAEA7B,EAAiBA,kBACfR,EAAIS,WAAWC,KAAKlC,EAAaE,OAAQ,CAAE0D,MAAKC,gBAAgB,CAAEhE,MAAO4B,OCFzEqC,EAAiB,CAACtC,EAAcC,KAA4B,CAChExB,OAAQ,CAACjB,EAAc+E,IACrB/B,EAAiBA,kBACfR,EAAIS,WAAWC,KACblC,EAAoBC,OACpB,CAAEjB,OAAM+E,eACR,CAAElE,MAAO4B,KAGfvB,OAAQ,CAAClB,EAAcgF,EAAiBD,IACtC/B,EAAAA,kBACER,EAAIS,WAAWC,KACblC,EAAoBE,OACpB,CAAElB,OAAMgF,UAASD,eACjB,CAAElE,MAAO4B,KAGftB,OAASnB,GACPgD,EAAAA,kBACER,EAAIS,WAAWC,KAAKlC,EAAoBG,OAAQ,CAAEnB,QAAQ,CAAEa,MAAO4B,KAEvET,QAAS,IACPgB,EAAiBA,kBACfR,EAAIS,WAAWnD,IAAIkB,EAAoBgB,QAAS,CAC9CnB,MAAO4B,KAERzD,GAASA,EAAKiG,gBC1BfC,EAAW,CAAC1C,EAAcC,KAA4B,CAC1DxB,OAAQ,CACNjB,EACA+E,EACAI,IAEAnC,EAAAA,kBACER,EAAIS,WAAWC,KACblC,EAAcC,OACd,CAAEjB,OAAM+E,cAAaI,mBACrB,CAAEtE,MAAO4B,KAGfvB,OAAQ,CACNlB,EACAgF,EACAD,EACAI,IAEAnC,oBACER,EAAIS,WAAWC,KACblC,EAAcE,OACd,CAAElB,OAAMgF,UAASD,cAAaI,mBAC9B,CAAEtE,MAAO4B,KAGftB,OAASnB,GACPgD,EAAAA,kBACER,EAAIS,WAAWC,KAAKlC,EAAcG,OAAQ,CAAEnB,QAAQ,CAAEa,MAAO4B,KAEjET,QAAS,IACPgB,EAAiBA,kBACfR,EAAIS,WAAWnD,IAAIkB,EAAcgB,QAAS,CACxCnB,MAAO4B,KAERzD,GAASA,EAAK8D,UCvCfsC,EAAY,CAAC5C,EAAcC,KAA4B,CAM3DL,cAAgB+B,GACdnB,EAAAA,kBACER,EAAIS,WAAWC,KAAKlC,EAAeoB,cAAe,CAAE+B,YAAY,CAAEtD,MAAO4B,KAU7EJ,uBAAwB,CACtB8B,EACAkB,EACAC,IAEAtC,EAAAA,kBACER,EAAIS,WAAWC,KACblC,EAAeqB,uBACf,CAAE8B,WAAUmB,WAAUD,WACtB,CAAExE,MAAO4B,KAUfH,oBAAqB,CAAC6B,EAAkBoB,IACtCvC,EAAiBA,kBACfR,EAAIS,WAAWC,KACblC,EAAesB,oBACf,CAAE6B,WAAUoB,WACZ,CAAE1E,MAAO4B,OC1CX+C,EAAkB,CAAChD,EAAcC,KAA4B,CACjEgD,kBAAmB,CACjBtB,EACAuB,EACAC,EACAC,EACAC,EACAC,IAEA9C,EAAiBA,kBACfR,EAAIS,WAAWC,KACblC,EAAaiB,UACb,CAAEkC,WAAUuB,SAAQE,WAAUD,UAASE,cAAaC,UACpD,CAAEjF,MAAO4B,KAGfsD,kBAAmB,CAAC5B,EAAkB6B,IACpChD,EAAiBA,kBACfR,EAAIS,WAAWC,KACblC,EAAakB,SACb,CAAEiC,WAAU6B,kBACZ,CAAEnF,MAAO4B,KAGfwD,iBAAkB,CAChB9B,EACA+B,EACAC,IAEAnD,EAAAA,kBACER,EAAIS,WAAWC,KACblC,EAAamB,QACb,CAAEgC,WAAU+B,cAAaC,oBACzB,CAAEtF,MAAO4B,OCzBX2D,EAAgB,CAAC5D,EAAcC,KAA4B,CAS/DxB,OAAQ,CACNjB,EACAqG,EACAvD,EACAwD,IAEAtD,EAAAA,kBACER,EAAIS,WAAWC,KACblC,EAAmBC,OACnB,CAAEjB,OAAMqG,aAAYlD,UAAWL,EAAOwD,cACtC,CAAEzF,MAAO4B,KAQfrB,KAAOqD,GACLzB,EAAAA,kBACER,EAAIS,WAAWnD,IAAIkB,EAAmBI,KAAM,CAC1CkC,YAAa,CAAEmB,MACf5D,MAAO4B,KAERzD,GAASA,EAAKuH,MAOnB9C,UAAYC,GACVV,oBACER,EAAIS,WAAWC,KAAKlC,EAAmBK,OAAQ,CAAEqC,aAAa,CAAE7C,MAAO4B,KACtEzD,GAASA,EAAKwH,OAQnBtF,OAAQ,CAACuD,EAAYzE,IACnBgD,EAAiBA,kBACfR,EAAIS,WAAWC,KAAKlC,EAAmBE,OAAQ,CAAEuD,KAAIzE,QAAQ,CAAEa,MAAO4B,KACrEzD,GAASA,EAAKuH,MAOnBzE,WAAa2C,GACXzB,EAAAA,kBACER,EAAIS,WAAWC,KAAKlC,EAAmBc,WAAY,CAAE2C,MAAM,CAAE5D,MAAO4B,KAMxEV,SAAW0C,GACTzB,EAAAA,kBACER,EAAIS,WAAWC,KAAKlC,EAAmBe,SAAU,CAAE0C,MAAM,CAAE5D,MAAO4B,KAMtEtB,OAASsD,GACPzB,EAAAA,kBACER,EAAIS,WAAWC,KAAKlC,EAAmBG,OAAQ,CAAEsD,MAAM,CAAE5D,MAAO4B,aC1FpD,QAAlB9C,EAAA8G,WAAWC,eAAO,IAAA/G,IAAlB8G,WAAWC,QAAYA,EAAOA,SAE9B,MAGMC,EAAe,IAAI7H,KAGvBA,EAAK8H,SAASC,YAEZA,YAASlH,GAAAS,EAAAyG,GAAYC,+BAAAA,cARD,aAQmC,IAGlDC,EAAS,WAAIjI,ICKhBkI,EAAWrH,WAAA8C,cAAEA,GAAuC9C,EAArBsH,EAAM7H,EAAAA,OAAAO,EAA1B,mBACf,MAAMuH,EAAUC,UACX7G,OAAAC,OAAAD,OAAAC,OAAA,CAAA,EAAA0G,UACHG,EACAC,YAAW/G,OAAAC,OAAAD,OAAAC,OAAA,CAAA,EACN0G,EAAOI,cACV,qBAAsB,SACtB,8BAAiD,UAAZ,OAAPC,cAAO,IAAPA,aAAO,EAAPA,QAASC,gBAAU,IAAAnH,OAAA,EAAAA,EAAAoH,OAAQ,GACzD,wBAAyB,cAIvBC,UAAEA,EAASC,OAAEA,GAAWT,EAExBT,EAA6C,CAAA,EAmB7CmB,EC1Ce,EAACnF,EAAcC,KAA4B,CAChEW,KAAMb,EAASC,EAAKC,GACpBmF,UAAWxB,EAAc5D,EAAKC,GAC9B9B,OAAQ2D,EAAW9B,EAAKC,GACxBoF,IAAKrC,EAAgBhD,EAAKC,GAC1BmC,IAAKD,EAAQnC,EAAKC,GAClBqF,WAAYhD,EAAetC,EAAKC,GAChCsF,KAAM7C,EAAS1C,EAAKC,GACpBuF,MAAO5C,EAAU5C,EAAKC,KDkCHwF,CAAef,EAASzE,GAErCD,iCACD0E,GAAO,CAOVS,aAGA9I,aAAaqJ,GACX,KAAKA,aAAA,EAAAA,EAAQC,KAAK,MAAMC,MAAM,gCAE9B,GAAI5B,EAAK0B,EAAOC,KAAM,OAAO3B,EAAK0B,EAAOC,KAKzC,GAFA7H,OAAOC,OAAOiG,OAnCA3H,WAChB,MAGMwJ,SAHoBnB,EAAQjE,WAC/BnD,IAAI,WAAW2H,KACfa,MAAMvJ,GAASA,EAAKwJ,UACe/B,KACtC,OAAK1F,MAAMC,QAAQsH,UACQG,QAAQC,IACjCJ,EAAWK,KAAI7J,MAAO0H,GAAQ,CAACA,EAAI4B,UAAWQ,EAAAA,UAAUpC,QAGtCqC,QAClB,CAACC,GAAMV,EAAKW,KAAUX,EAAW7H,OAAAC,OAAAD,OAAAC,OAAA,CAAA,EAAAsI,IAAK,CAACV,EAAIY,YAAaD,IAAQD,GAChE,CAAE,GAPmC,EAQtC,EAsB2BG,KAErBxC,EAAK0B,EAAOC,KAAM,MAAMC,MAAM,gCAEnC,OAAO5B,EAAK0B,EAAOC,IACpB,EAODtJ,kBAAkB+F,SAEhB,MACM/D,SADYoI,EAASA,UAACrE,EAAKpC,EAAI0G,OAAQ,CAAEC,eAAgB,KAC7CC,QAElB,GAAIvI,IACFA,EAAMwI,IAAe,QAAT1J,EAAAkB,EAAMwI,WAAG,IAAA1J,OAAA,EAAAA,EAAE2J,MAAM,KAAKC,MAC9B1I,EAAMwI,MAAQ5B,GAEhB,MAAM,IAAI+B,EAAMA,OAACC,yBACf,+BACA,MACA,gBAKN,MAAO,CAAE7E,MAAK/D,QACf,EAODhC,sBAAsB6K,GACpB,IAAKA,EAAc,MAAMtB,MAAM,4CAE/B,IAEE,aADoB5F,EAAImH,YAAYD,EAMrC,CAJC,MAAOE,GAGP,MADAlC,SAAAA,EAAQkC,MAAM,4BAA6BA,GACrCxB,MAAM,4BACb,CACF,EAODvJ,qBAAqBgL,WACnB,IAAKA,EAAc,MAAMzB,MAAM,kDAE/B,UACQ5F,EAAImH,YAAYE,GACtB,MAAMC,QAAgBtH,EAAIuH,QAAQF,GAClC,GAAIC,EAAQE,GAAI,CAEd,aADoBxH,EAAImH,YAA0B,QAAdhK,EAAAmK,EAAQ9K,YAAM,IAAAW,OAAA,EAAAA,EAAAsK,WAEnD,CAED,MAAM7B,MAAmB,QAAbhI,EAAA0J,EAAQF,aAAK,IAAAxJ,OAAA,EAAAA,EAAE8J,aAK5B,CAJC,MAAOC,GAGP,MADAzC,SAAAA,EAAQkC,MAAM,kCAAmCO,GAC3C/B,MAAM,kCACb,CACF,EAQDvJ,gCACE6K,EACAG,GAEA,IAAKH,IAAiBG,EAAc,MAAMzB,MAAM,6CAEhD,IAEE,aADoB5F,EAAI4H,gBAAgBV,EAKzC,CAHC,MAAOE,GAEPlC,SAAAA,EAAQ2C,IAAI,mDACb,CAED,OAAO7H,EAAI8H,eAAeT,EAC3B,EAODhL,wBAAwB+I,GACtB,IAAKA,EAAW,MAAMQ,MAAM,gCAE5B,IAAIrJ,EACJ,IACEA,QAAayD,EAAIoF,UAAU2C,SAAS3C,EAIrC,CAHC,MAAOgC,GAEP,MADAlC,SAAAA,EAAQkC,MAAM,gCAAiCA,GACzCxB,MAAM,gCACb,CAED,MAAM6B,WAAEA,GAAelL,EAAKC,KAC5B,IAAKiL,EAEH,MADAvC,SAAAA,EAAQkC,MAAM,gDACRxB,MAAM,iCAGd,IAEE,aADoB5F,EAAImH,YAAYM,EAKrC,CAHC,MAAOL,GAEP,MADAlC,SAAAA,EAAQkC,MAAM,sCAAuCA,GAC/CxB,MAAM,gCACb,CACF,EAQDoC,oBAAmB,CAAC/J,EAA8BwE,IACzCzC,EAAIiI,0BAA0BhK,EAAU,KAAMwE,GASvDwF,0BACEhK,EACAE,EACAsE,GAEA,MAAMyF,EAAUlK,EAA2BC,EZrNb,cYqN6CE,GAC3E,OAAOsE,EAAY0F,OAAOC,GAASF,EAAQG,SAASD,IACrD,EAQDE,cAAa,CAACrK,EAA8BqC,IACnCN,EAAIuI,oBAAoBtK,EAAU,KAAMqC,GASjDiI,oBAAoBtK,EAA8BE,EAAgBmC,GAChE,MAAMkI,EAAaxK,EAA2BC,EZxOtB,QYwOgDE,GACxE,OAAOmC,EAAM6H,OAAO5C,GAASiD,EAAWH,SAAS9C,IAClD,IAGH,OAAOkD,EAAAA,SACLzI,EACA,CACE,mBACA,iBACA,sBACA,mBACA,uBACA,uBACA,iBACA,gBACA,cACA,yBACA,yBACA,WAEF7D,EACD,EAoBHqI,EAAQkE,uBZ1R8B,MY2RtClE,EAAQmE,uBZzR8B"}

package/dist/index.d.ts

@@ -108,11 +108,12 @@ declare const nodeSdk: {
         management: {
             user: {
                 create: (loginId: string, email?: string, phone?: string, displayName?: string, roles?: string[], userTenants?: AssociatedTenant[]) => Promise<SdkResponse<_descope_core_js_sdk.UserResponse>>;
+                invite: (loginId: string, email?: string, phone?: string, displayName?: string, roles?: string[], userTenants?: AssociatedTenant[]) => Promise<SdkResponse<_descope_core_js_sdk.UserResponse>>;
                 update: (loginId: string, email?: string, phone?: string, displayName?: string, roles?: string[], userTenants?: AssociatedTenant[]) => Promise<SdkResponse<_descope_core_js_sdk.UserResponse>>;
                 delete: (loginId: string) => Promise<SdkResponse<never>>;
                 load: (loginId: string) => Promise<SdkResponse<_descope_core_js_sdk.UserResponse>>;
                 loadByUserId: (userId: string) => Promise<SdkResponse<_descope_core_js_sdk.UserResponse>>;
-                searchAll: (tenantIds?: string[], roles?: string[], limit?: number) => Promise<SdkResponse<_descope_core_js_sdk.UserResponse[]>>;
+                searchAll: (tenantIds?: string[], roles?: string[], limit?: number, page?: number) => Promise<SdkResponse<_descope_core_js_sdk.UserResponse[]>>;
                 activate: (loginId: string) => Promise<SdkResponse<_descope_core_js_sdk.UserResponse>>;
                 deactivate: (loginId: string) => Promise<SdkResponse<_descope_core_js_sdk.UserResponse>>;
                 updateEmail: (loginId: string, email: string, isVerified: boolean) => Promise<SdkResponse<_descope_core_js_sdk.UserResponse>>;

package/dist/index.esm.js

@@ -1,2 +1,2 @@
-import{__rest as e}from"tslib";import t,{transformResponse as a,wrapWith as o}from"@descope/core-js-sdk";import{jwtVerify as s,errors as n,importJWK as r}from"jose";import i,{Headers as l}from"node-fetch-commonjs";const d=t=>async(...a)=>{var o,s,n;const r=await t(...a);if(!r.data)return r;let i=r.data,{refreshJwt:l}=i,d=e(i,["refreshJwt"]);const p=[];var m;return l?p.push(`${"DSR"}=${l}; Domain=${(null==(m=d)?void 0:m.cookieDomain)||""}; Max-Age=${(null==m?void 0:m.cookieMaxAge)||""}; Path=${(null==m?void 0:m.cookiePath)||"/"}; HttpOnly; SameSite=Strict`):(null===(o=r.response)||void 0===o?void 0:o.headers.get("set-cookie"))&&(l=((e,t)=>{const a=null==e?void 0:e.match(RegExp(`(?:^|;\\s*)${t}=([^;]*)`));return a?a[1]:null})(null===(s=r.response)||void 0===s?void 0:s.headers.get("set-cookie"),"DSR"),p.push(null===(n=r.response)||void 0===n?void 0:n.headers.get("set-cookie"))),Object.assign(Object.assign({},r),{data:Object.assign(Object.assign({},r.data),{refreshJwt:l,cookies:p})})};function p(e,t,a){var o,s;const n=a?null===(s=null===(o=e.token.tenants)||void 0===o?void 0:o[a])||void 0===s?void 0:s[t]:e.token[t];return Array.isArray(n)?n:[]}var m={create:"/v1/mgmt/user/create",update:"/v1/mgmt/user/update",delete:"/v1/mgmt/user/delete",load:"/v1/mgmt/user",search:"/v1/mgmt/user/search",updateStatus:"/v1/mgmt/user/update/status",updateEmail:"/v1/mgmt/user/update/email",updatePhone:"/v1/mgmt/user/update/phone",updateDisplayName:"/v1/mgmt/user/update/name",addRole:"/v1/mgmt/user/update/role/add",removeRole:"/v1/mgmt/user/update/role/remove",addTenant:"/v1/mgmt/user/update/tenant/add",removeTenant:"/v1/mgmt/user/update/tenant/remove"},c={create:"/v1/mgmt/accesskey/create",load:"/v1/mgmt/accesskey",search:"/v1/mgmt/accesskey/search",update:"/v1/mgmt/accesskey/update",deactivate:"/v1/mgmt/accesskey/deactivate",activate:"/v1/mgmt/accesskey/activate",delete:"/v1/mgmt/accesskey/delete"},u={create:"/v1/mgmt/tenant/create",update:"/v1/mgmt/tenant/update",delete:"/v1/mgmt/tenant/delete",loadAll:"/v1/mgmt/tenant/all"},h={configure:"/v1/mgmt/sso/settings",metadata:"/v1/mgmt/sso/metadata",mapping:"/v1/mgmt/sso/mapping"},g={update:"/v1/mgmt/jwt/update"},v={create:"/v1/mgmt/permission/create",update:"/v1/mgmt/permission/update",delete:"/v1/mgmt/permission/delete",loadAll:"/v1/mgmt/permission/all"},k={create:"/v1/mgmt/role/create",update:"/v1/mgmt/role/update",delete:"/v1/mgmt/role/delete",loadAll:"/v1/mgmt/role/all"},y={loadAllGroups:"/v1/mgmt/group/all",loadAllGroupsForMember:"/v1/mgmt/group/member/all",loadAllGroupMembers:"/v1/mgmt/group/members"};const f=(e,t)=>({create:(o,s,n,r,i,l)=>a(e.httpClient.post(m.create,{loginId:o,email:s,phone:n,displayName:r,roleNames:i,userTenants:l},{token:t}),(e=>e.user)),update:(o,s,n,r,i,l)=>a(e.httpClient.post(m.update,{loginId:o,email:s,phone:n,displayName:r,roleNames:i,userTenants:l},{token:t}),(e=>e.user)),delete:o=>a(e.httpClient.post(m.delete,{loginId:o},{token:t})),load:o=>a(e.httpClient.get(m.load,{queryParams:{loginId:o},token:t}),(e=>e.user)),loadByUserId:o=>a(e.httpClient.get(m.load,{queryParams:{userId:o},token:t}),(e=>e.user)),searchAll:(o,s,n)=>a(e.httpClient.post(m.search,{tenantIds:o,roleNames:s,limit:n},{token:t}),(e=>e.users)),activate:o=>a(e.httpClient.post(m.updateStatus,{loginId:o,status:"enabled"},{token:t}),(e=>e.user)),deactivate:o=>a(e.httpClient.post(m.updateStatus,{loginId:o,status:"disabled"},{token:t}),(e=>e.user)),updateEmail:(o,s,n)=>a(e.httpClient.post(m.updateEmail,{loginId:o,email:s,verified:n},{token:t}),(e=>e.user)),updatePhone:(o,s,n)=>a(e.httpClient.post(m.updatePhone,{loginId:o,phone:s,verified:n},{token:t}),(e=>e.user)),updateDisplayName:(o,s)=>a(e.httpClient.post(m.updateDisplayName,{loginId:o,displayName:s},{token:t}),(e=>e.user)),addRoles:(o,s)=>a(e.httpClient.post(m.addRole,{loginId:o,roleNames:s},{token:t}),(e=>e.user)),removeRoles:(o,s)=>a(e.httpClient.post(m.removeRole,{loginId:o,roleNames:s},{token:t}),(e=>e.user)),addTenant:(o,s)=>a(e.httpClient.post(m.addTenant,{loginId:o,tenantId:s},{token:t}),(e=>e.user)),removeTenant:(o,s)=>a(e.httpClient.post(m.removeTenant,{loginId:o,tenantId:s},{token:t}),(e=>e.user)),addTenantRoles:(o,s,n)=>a(e.httpClient.post(m.addRole,{loginId:o,tenantId:s,roleNames:n},{token:t}),(e=>e.user)),removeTenantRoles:(o,s,n)=>a(e.httpClient.post(m.removeRole,{loginId:o,tenantId:s,roleNames:n},{token:t}),(e=>e.user))}),C=(e,t)=>({create:(o,s)=>a(e.httpClient.post(u.create,{name:o,selfProvisioningDomains:s},{token:t})),createWithId:(o,s,n)=>a(e.httpClient.post(u.create,{id:o,name:s,selfProvisioningDomains:n},{token:t})),update:(o,s,n)=>a(e.httpClient.post(u.update,{id:o,name:s,selfProvisioningDomains:n},{token:t})),delete:o=>a(e.httpClient.post(u.delete,{id:o},{token:t})),loadAll:()=>a(e.httpClient.get(u.loadAll,{token:t}),(e=>e.tenants))}),w=(e,t)=>({update:(o,s)=>a(e.httpClient.post(g.update,{jwt:o,customClaims:s},{token:t}))}),I=(e,t)=>({create:(o,s)=>a(e.httpClient.post(v.create,{name:o,description:s},{token:t})),update:(o,s,n)=>a(e.httpClient.post(v.update,{name:o,newName:s,description:n},{token:t})),delete:o=>a(e.httpClient.post(v.delete,{name:o},{token:t})),loadAll:()=>a(e.httpClient.get(v.loadAll,{token:t}),(e=>e.permissions))}),b=(e,t)=>({create:(o,s,n)=>a(e.httpClient.post(k.create,{name:o,description:s,permissionNames:n},{token:t})),update:(o,s,n,r)=>a(e.httpClient.post(k.update,{name:o,newName:s,description:n,permissionNames:r},{token:t})),delete:o=>a(e.httpClient.post(k.delete,{name:o},{token:t})),loadAll:()=>a(e.httpClient.get(k.loadAll,{token:t}),(e=>e.roles))}),A=(e,t)=>({loadAllGroups:o=>a(e.httpClient.post(y.loadAllGroups,{tenantId:o},{token:t})),loadAllGroupsForMember:(o,s,n)=>a(e.httpClient.post(y.loadAllGroupsForMember,{tenantId:o,loginIds:n,userIds:s},{token:t})),loadAllGroupMembers:(o,s)=>a(e.httpClient.post(y.loadAllGroupMembers,{tenantId:o,groupId:s},{token:t}))}),j=(e,t)=>({configureSettings:(o,s,n,r,i,l)=>a(e.httpClient.post(h.configure,{tenantId:o,idpURL:s,entityId:r,idpCert:n,redirectURL:i,domain:l},{token:t})),configureMetadata:(o,s)=>a(e.httpClient.post(h.metadata,{tenantId:o,idpMetadataURL:s},{token:t})),configureMapping:(o,s,n)=>a(e.httpClient.post(h.mapping,{tenantId:o,roleMapping:s,attributeMapping:n},{token:t}))}),R=(e,t)=>({create:(o,s,n,r)=>a(e.httpClient.post(c.create,{name:o,expireTime:s,roleNames:n,keyTenants:r},{token:t})),load:o=>a(e.httpClient.get(c.load,{queryParams:{id:o},token:t}),(e=>e.key)),searchAll:o=>a(e.httpClient.post(c.search,{tenantIds:o},{token:t}),(e=>e.keys)),update:(o,s)=>a(e.httpClient.post(c.update,{id:o,name:s},{token:t}),(e=>e.key)),deactivate:o=>a(e.httpClient.post(c.deactivate,{id:o},{token:t})),activate:o=>a(e.httpClient.post(c.activate,{id:o},{token:t})),delete:o=>a(e.httpClient.post(c.delete,{id:o},{token:t}))});var T;null!==(T=globalThis.Headers)&&void 0!==T||(globalThis.Headers=l);const N=(...e)=>(e.forEach((e=>{var t,a;e&&(null!==(t=(a=e).highWaterMark)&&void 0!==t||(a.highWaterMark=32212254720))})),i(...e)),x=a=>{var i,{managementKey:l}=a,m=e(a,["managementKey"]);const c=t(Object.assign(Object.assign({},m),{fetch:N,baseHeaders:Object.assign(Object.assign({},m.baseHeaders),{"x-descope-sdk-name":"nodejs","x-descope-sdk-node-version":(null===(i=null===process||void 0===process?void 0:process.versions)||void 0===i?void 0:i.node)||"","x-descope-sdk-version":"1.0.5"})})),{projectId:u,logger:h}=m,g={},v=((e,t)=>({user:f(e,t),accessKey:R(e,t),tenant:C(e,t),sso:j(e,t),jwt:w(e,t),permission:I(e,t),role:b(e,t),group:A(e,t)}))(c,l),k=Object.assign(Object.assign({},c),{management:v,async getKey(e){if(!(null==e?void 0:e.kid))throw Error("header.kid must not be empty");if(g[e.kid])return g[e.kid];if(Object.assign(g,await(async()=>{const e=(await c.httpClient.get(`v2/keys/${u}`).then((e=>e.json()))).keys;return Array.isArray(e)?(await Promise.all(e.map((async e=>[e.kid,await r(e)])))).reduce(((e,[t,a])=>t?Object.assign(Object.assign({},e),{[t.toString()]:a}):e),{}):{}})()),!g[e.kid])throw Error("failed to fetch matching key");return g[e.kid]},async validateJwt(e){var t;const a=(await s(e,k.getKey,{clockTolerance:5})).payload;if(a&&(a.iss=null===(t=a.iss)||void 0===t?void 0:t.split("/").pop(),a.iss!==u))throw new n.JWTClaimValidationFailed('unexpected "iss" claim value',"iss","check_failed");return{jwt:e,token:a}},async validateSession(e){if(!e)throw Error("session token is required for validation");try{return await k.validateJwt(e)}catch(e){throw null==h||h.error("session validation failed",e),Error("session validation failed")}},async refreshSession(e){var t,a;if(!e)throw Error("refresh token is required to refresh a session");try{await k.validateJwt(e);const o=await k.refresh(e);if(o.ok){return await k.validateJwt(null===(t=o.data)||void 0===t?void 0:t.sessionJwt)}throw Error(null===(a=o.error)||void 0===a?void 0:a.errorMessage)}catch(e){throw null==h||h.error("refresh token validation failed",e),Error("refresh token validation failed")}},async validateAndRefreshSession(e,t){if(!e&&!t)throw Error("both session and refresh tokens are empty");try{return await k.validateSession(e)}catch(e){null==h||h.log("session validation failed - trying to refresh it")}return k.refreshSession(t)},async exchangeAccessKey(e){if(!e)throw Error("access key must not be empty");let t;try{t=await k.accessKey.exchange(e)}catch(e){throw null==h||h.error("failed to exchange access key",e),Error("could not exchange access key")}const{sessionJwt:a}=t.data;if(!a)throw null==h||h.error("failed to parse exchange access key response"),Error("could not exchange access key");try{return await k.validateJwt(a)}catch(e){throw null==h||h.error("failed to parse jwt from access key",e),Error("could not exchange access key")}},validatePermissions:(e,t)=>k.validateTenantPermissions(e,null,t),validateTenantPermissions(e,t,a){const o=p(e,"permissions",t);return a.every((e=>o.includes(e)))},validateRoles:(e,t)=>k.validateTenantRoles(e,null,t),validateTenantRoles(e,t,a){const o=p(e,"roles",t);return a.every((e=>o.includes(e)))}});return o(k,["otp.verify.email","otp.verify.sms","otp.verify.whatsapp","magicLink.verify","enchantedLink.signUp","enchantedLink.signIn","oauth.exchange","saml.exchange","totp.verify","webauthn.signIn.finish","webauthn.signUp.finish","refresh"],d)};x.RefreshTokenCookieName="DSR",x.SessionTokenCookieName="DS";export{x as default};
+import{__rest as e}from"tslib";import t,{transformResponse as a,wrapWith as n}from"@descope/core-js-sdk";import{jwtVerify as s,errors as o,importJWK as r}from"jose";import i,{Headers as l}from"node-fetch-commonjs";const d=t=>async(...a)=>{var n,s,o;const r=await t(...a);if(!r.data)return r;let i=r.data,{refreshJwt:l}=i,d=e(i,["refreshJwt"]);const p=[];var m;return l?p.push(`${"DSR"}=${l}; Domain=${(null==(m=d)?void 0:m.cookieDomain)||""}; Max-Age=${(null==m?void 0:m.cookieMaxAge)||""}; Path=${(null==m?void 0:m.cookiePath)||"/"}; HttpOnly; SameSite=Strict`):(null===(n=r.response)||void 0===n?void 0:n.headers.get("set-cookie"))&&(l=((e,t)=>{const a=null==e?void 0:e.match(RegExp(`(?:^|;\\s*)${t}=([^;]*)`));return a?a[1]:null})(null===(s=r.response)||void 0===s?void 0:s.headers.get("set-cookie"),"DSR"),p.push(null===(o=r.response)||void 0===o?void 0:o.headers.get("set-cookie"))),Object.assign(Object.assign({},r),{data:Object.assign(Object.assign({},r.data),{refreshJwt:l,cookies:p})})};function p(e,t,a){var n,s;const o=a?null===(s=null===(n=e.token.tenants)||void 0===n?void 0:n[a])||void 0===s?void 0:s[t]:e.token[t];return Array.isArray(o)?o:[]}var m={create:"/v1/mgmt/user/create",update:"/v1/mgmt/user/update",delete:"/v1/mgmt/user/delete",load:"/v1/mgmt/user",search:"/v1/mgmt/user/search",updateStatus:"/v1/mgmt/user/update/status",updateEmail:"/v1/mgmt/user/update/email",updatePhone:"/v1/mgmt/user/update/phone",updateDisplayName:"/v1/mgmt/user/update/name",addRole:"/v1/mgmt/user/update/role/add",removeRole:"/v1/mgmt/user/update/role/remove",addTenant:"/v1/mgmt/user/update/tenant/add",removeTenant:"/v1/mgmt/user/update/tenant/remove"},c={create:"/v1/mgmt/accesskey/create",load:"/v1/mgmt/accesskey",search:"/v1/mgmt/accesskey/search",update:"/v1/mgmt/accesskey/update",deactivate:"/v1/mgmt/accesskey/deactivate",activate:"/v1/mgmt/accesskey/activate",delete:"/v1/mgmt/accesskey/delete"},u={create:"/v1/mgmt/tenant/create",update:"/v1/mgmt/tenant/update",delete:"/v1/mgmt/tenant/delete",loadAll:"/v1/mgmt/tenant/all"},h={configure:"/v1/mgmt/sso/settings",metadata:"/v1/mgmt/sso/metadata",mapping:"/v1/mgmt/sso/mapping"},g={update:"/v1/mgmt/jwt/update"},v={create:"/v1/mgmt/permission/create",update:"/v1/mgmt/permission/update",delete:"/v1/mgmt/permission/delete",loadAll:"/v1/mgmt/permission/all"},k={create:"/v1/mgmt/role/create",update:"/v1/mgmt/role/update",delete:"/v1/mgmt/role/delete",loadAll:"/v1/mgmt/role/all"},y={loadAllGroups:"/v1/mgmt/group/all",loadAllGroupsForMember:"/v1/mgmt/group/member/all",loadAllGroupMembers:"/v1/mgmt/group/members"};const f=(e,t)=>({create:(n,s,o,r,i,l)=>a(e.httpClient.post(m.create,{loginId:n,email:s,phone:o,displayName:r,roleNames:i,userTenants:l},{token:t}),(e=>e.user)),invite:(n,s,o,r,i,l)=>a(e.httpClient.post(m.create,{loginId:n,email:s,phone:o,displayName:r,roleNames:i,userTenants:l,invite:!0},{token:t}),(e=>e.user)),update:(n,s,o,r,i,l)=>a(e.httpClient.post(m.update,{loginId:n,email:s,phone:o,displayName:r,roleNames:i,userTenants:l},{token:t}),(e=>e.user)),delete:n=>a(e.httpClient.post(m.delete,{loginId:n},{token:t})),load:n=>a(e.httpClient.get(m.load,{queryParams:{loginId:n},token:t}),(e=>e.user)),loadByUserId:n=>a(e.httpClient.get(m.load,{queryParams:{userId:n},token:t}),(e=>e.user)),searchAll:(n,s,o,r)=>a(e.httpClient.post(m.search,{tenantIds:n,roleNames:s,limit:o,page:r},{token:t}),(e=>e.users)),activate:n=>a(e.httpClient.post(m.updateStatus,{loginId:n,status:"enabled"},{token:t}),(e=>e.user)),deactivate:n=>a(e.httpClient.post(m.updateStatus,{loginId:n,status:"disabled"},{token:t}),(e=>e.user)),updateEmail:(n,s,o)=>a(e.httpClient.post(m.updateEmail,{loginId:n,email:s,verified:o},{token:t}),(e=>e.user)),updatePhone:(n,s,o)=>a(e.httpClient.post(m.updatePhone,{loginId:n,phone:s,verified:o},{token:t}),(e=>e.user)),updateDisplayName:(n,s)=>a(e.httpClient.post(m.updateDisplayName,{loginId:n,displayName:s},{token:t}),(e=>e.user)),addRoles:(n,s)=>a(e.httpClient.post(m.addRole,{loginId:n,roleNames:s},{token:t}),(e=>e.user)),removeRoles:(n,s)=>a(e.httpClient.post(m.removeRole,{loginId:n,roleNames:s},{token:t}),(e=>e.user)),addTenant:(n,s)=>a(e.httpClient.post(m.addTenant,{loginId:n,tenantId:s},{token:t}),(e=>e.user)),removeTenant:(n,s)=>a(e.httpClient.post(m.removeTenant,{loginId:n,tenantId:s},{token:t}),(e=>e.user)),addTenantRoles:(n,s,o)=>a(e.httpClient.post(m.addRole,{loginId:n,tenantId:s,roleNames:o},{token:t}),(e=>e.user)),removeTenantRoles:(n,s,o)=>a(e.httpClient.post(m.removeRole,{loginId:n,tenantId:s,roleNames:o},{token:t}),(e=>e.user))}),C=(e,t)=>({create:(n,s)=>a(e.httpClient.post(u.create,{name:n,selfProvisioningDomains:s},{token:t})),createWithId:(n,s,o)=>a(e.httpClient.post(u.create,{id:n,name:s,selfProvisioningDomains:o},{token:t})),update:(n,s,o)=>a(e.httpClient.post(u.update,{id:n,name:s,selfProvisioningDomains:o},{token:t})),delete:n=>a(e.httpClient.post(u.delete,{id:n},{token:t})),loadAll:()=>a(e.httpClient.get(u.loadAll,{token:t}),(e=>e.tenants))}),w=(e,t)=>({update:(n,s)=>a(e.httpClient.post(g.update,{jwt:n,customClaims:s},{token:t}))}),I=(e,t)=>({create:(n,s)=>a(e.httpClient.post(v.create,{name:n,description:s},{token:t})),update:(n,s,o)=>a(e.httpClient.post(v.update,{name:n,newName:s,description:o},{token:t})),delete:n=>a(e.httpClient.post(v.delete,{name:n},{token:t})),loadAll:()=>a(e.httpClient.get(v.loadAll,{token:t}),(e=>e.permissions))}),b=(e,t)=>({create:(n,s,o)=>a(e.httpClient.post(k.create,{name:n,description:s,permissionNames:o},{token:t})),update:(n,s,o,r)=>a(e.httpClient.post(k.update,{name:n,newName:s,description:o,permissionNames:r},{token:t})),delete:n=>a(e.httpClient.post(k.delete,{name:n},{token:t})),loadAll:()=>a(e.httpClient.get(k.loadAll,{token:t}),(e=>e.roles))}),A=(e,t)=>({loadAllGroups:n=>a(e.httpClient.post(y.loadAllGroups,{tenantId:n},{token:t})),loadAllGroupsForMember:(n,s,o)=>a(e.httpClient.post(y.loadAllGroupsForMember,{tenantId:n,loginIds:o,userIds:s},{token:t})),loadAllGroupMembers:(n,s)=>a(e.httpClient.post(y.loadAllGroupMembers,{tenantId:n,groupId:s},{token:t}))}),j=(e,t)=>({configureSettings:(n,s,o,r,i,l)=>a(e.httpClient.post(h.configure,{tenantId:n,idpURL:s,entityId:r,idpCert:o,redirectURL:i,domain:l},{token:t})),configureMetadata:(n,s)=>a(e.httpClient.post(h.metadata,{tenantId:n,idpMetadataURL:s},{token:t})),configureMapping:(n,s,o)=>a(e.httpClient.post(h.mapping,{tenantId:n,roleMapping:s,attributeMapping:o},{token:t}))}),T=(e,t)=>({create:(n,s,o,r)=>a(e.httpClient.post(c.create,{name:n,expireTime:s,roleNames:o,keyTenants:r},{token:t})),load:n=>a(e.httpClient.get(c.load,{queryParams:{id:n},token:t}),(e=>e.key)),searchAll:n=>a(e.httpClient.post(c.search,{tenantIds:n},{token:t}),(e=>e.keys)),update:(n,s)=>a(e.httpClient.post(c.update,{id:n,name:s},{token:t}),(e=>e.key)),deactivate:n=>a(e.httpClient.post(c.deactivate,{id:n},{token:t})),activate:n=>a(e.httpClient.post(c.activate,{id:n},{token:t})),delete:n=>a(e.httpClient.post(c.delete,{id:n},{token:t}))});var N;null!==(N=globalThis.Headers)&&void 0!==N||(globalThis.Headers=l);const R=(...e)=>(e.forEach((e=>{var t,a;e&&(null!==(t=(a=e).highWaterMark)&&void 0!==t||(a.highWaterMark=32212254720))})),i(...e)),x=a=>{var i,{managementKey:l}=a,m=e(a,["managementKey"]);const c=t(Object.assign(Object.assign({},m),{fetch:R,baseHeaders:Object.assign(Object.assign({},m.baseHeaders),{"x-descope-sdk-name":"nodejs","x-descope-sdk-node-version":(null===(i=null===process||void 0===process?void 0:process.versions)||void 0===i?void 0:i.node)||"","x-descope-sdk-version":"1.0.6"})})),{projectId:u,logger:h}=m,g={},v=((e,t)=>({user:f(e,t),accessKey:T(e,t),tenant:C(e,t),sso:j(e,t),jwt:w(e,t),permission:I(e,t),role:b(e,t),group:A(e,t)}))(c,l),k=Object.assign(Object.assign({},c),{management:v,async getKey(e){if(!(null==e?void 0:e.kid))throw Error("header.kid must not be empty");if(g[e.kid])return g[e.kid];if(Object.assign(g,await(async()=>{const e=(await c.httpClient.get(`v2/keys/${u}`).then((e=>e.json()))).keys;return Array.isArray(e)?(await Promise.all(e.map((async e=>[e.kid,await r(e)])))).reduce(((e,[t,a])=>t?Object.assign(Object.assign({},e),{[t.toString()]:a}):e),{}):{}})()),!g[e.kid])throw Error("failed to fetch matching key");return g[e.kid]},async validateJwt(e){var t;const a=(await s(e,k.getKey,{clockTolerance:5})).payload;if(a&&(a.iss=null===(t=a.iss)||void 0===t?void 0:t.split("/").pop(),a.iss!==u))throw new o.JWTClaimValidationFailed('unexpected "iss" claim value',"iss","check_failed");return{jwt:e,token:a}},async validateSession(e){if(!e)throw Error("session token is required for validation");try{return await k.validateJwt(e)}catch(e){throw null==h||h.error("session validation failed",e),Error("session validation failed")}},async refreshSession(e){var t,a;if(!e)throw Error("refresh token is required to refresh a session");try{await k.validateJwt(e);const n=await k.refresh(e);if(n.ok){return await k.validateJwt(null===(t=n.data)||void 0===t?void 0:t.sessionJwt)}throw Error(null===(a=n.error)||void 0===a?void 0:a.errorMessage)}catch(e){throw null==h||h.error("refresh token validation failed",e),Error("refresh token validation failed")}},async validateAndRefreshSession(e,t){if(!e&&!t)throw Error("both session and refresh tokens are empty");try{return await k.validateSession(e)}catch(e){null==h||h.log("session validation failed - trying to refresh it")}return k.refreshSession(t)},async exchangeAccessKey(e){if(!e)throw Error("access key must not be empty");let t;try{t=await k.accessKey.exchange(e)}catch(e){throw null==h||h.error("failed to exchange access key",e),Error("could not exchange access key")}const{sessionJwt:a}=t.data;if(!a)throw null==h||h.error("failed to parse exchange access key response"),Error("could not exchange access key");try{return await k.validateJwt(a)}catch(e){throw null==h||h.error("failed to parse jwt from access key",e),Error("could not exchange access key")}},validatePermissions:(e,t)=>k.validateTenantPermissions(e,null,t),validateTenantPermissions(e,t,a){const n=p(e,"permissions",t);return a.every((e=>n.includes(e)))},validateRoles:(e,t)=>k.validateTenantRoles(e,null,t),validateTenantRoles(e,t,a){const n=p(e,"roles",t);return a.every((e=>n.includes(e)))}});return n(k,["otp.verify.email","otp.verify.sms","otp.verify.whatsapp","magicLink.verify","enchantedLink.signUp","enchantedLink.signIn","oauth.exchange","saml.exchange","totp.verify","webauthn.signIn.finish","webauthn.signUp.finish","refresh"],d)};x.RefreshTokenCookieName="DSR",x.SessionTokenCookieName="DS";export{x as default};
 //# sourceMappingURL=index.esm.js.map

package/dist/index.esm.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.esm.js","sources":["../lib/constants.ts","../lib/helpers.ts","../lib/management/paths.ts","../lib/management/user.ts","../lib/management/tenant.ts","../lib/management/jwt.ts","../lib/management/permission.ts","../lib/management/role.ts","../lib/management/group.ts","../lib/management/sso.ts","../lib/management/accesskey.ts","../lib/fetch-polyfill.ts","../lib/index.ts","../lib/management/index.ts"],"sourcesContent":["// eslint-disable-next-line import/prefer-default-export\n/** Refresh JWT cookie name */\nexport const refreshTokenCookieName = 'DSR';\n/** Session JWT cookie name */\nexport const sessionTokenCookieName = 'DS';\n/** The key of the tenants claims in the claims map */\nexport const authorizedTenantsClaimName = 'tenants';\n/** The key of the permissions claims in the claims map either under tenant or top level */\nexport const permissionsClaimName = 'permissions';\n/** The key of the roles claims in the claims map either under tenant or top level */\nexport const rolesClaimName = 'roles';\n","import type { SdkFnWrapper } from '@descope/core-js-sdk';\nimport { authorizedTenantsClaimName, refreshTokenCookieName } from './constants';\nimport { AuthenticationInfo } from './types';\n\n/**\n * Generate a cookie string from given parameters\n * @param name name of the cookie\n * @param value value of cookie that must be already encoded\n * @param options any options to put on the cookie like cookieDomain, cookieMaxAge, cookiePath\n * @returns Cookie string with all options on the string\n */\nconst generateCookie = (name: string, value: string, options?: Record<string, string | number>) =>\n  `${name}=${value}; Domain=${options?.cookieDomain || ''}; Max-Age=${\n    options?.cookieMaxAge || ''\n  }; Path=${options?.cookiePath || '/'}; HttpOnly; SameSite=Strict`;\n\n/**\n * Parse the cookie string and return the value of the cookie\n * @param cookie the raw cookie string\n * @param name the name of the cookie to get value for\n * @returns the value of the given cookie\n */\nconst getCookieValue = (cookie: string | null | undefined, name: string) => {\n  const match = cookie?.match(RegExp(`(?:^|;\\\\s*)${name}=([^;]*)`));\n  return match ? match[1] : null;\n};\n\n// eslint-disable-next-line import/prefer-default-export\n/**\n * Add cookie generation to core-js functions.\n * @param fn the function we are wrapping\n * @returns Wrapped function with cookie generation\n */\nexport const withCookie: SdkFnWrapper<{ refreshJwt?: string; cookies?: string[] }> =\n  (fn) =>\n  async (...args) => {\n    const resp = await fn(...args);\n\n    // istanbul ignore next\n    if (!resp.data) {\n      return resp;\n    }\n\n    // eslint-disable-next-line prefer-const\n    let { refreshJwt, ...rest } = resp.data;\n    const cookies: string[] = [];\n\n    if (!refreshJwt) {\n      if (resp.response?.headers.get('set-cookie')) {\n        refreshJwt = getCookieValue(\n          resp.response?.headers.get('set-cookie'),\n          refreshTokenCookieName,\n        );\n        cookies.push(resp.response?.headers.get('set-cookie')!);\n      }\n    } else {\n      cookies.push(generateCookie(refreshTokenCookieName, refreshJwt, rest));\n    }\n\n    return { ...resp, data: { ...resp.data, refreshJwt, cookies } };\n  };\n\n/**\n * Get the claim (used for permissions or roles) for a given tenant or top level if tenant is empty\n * @param authInfo The parsed authentication info from the JWT\n * @param claim name of the claim\n * @param tenant tenant to retrieve the claim for\n * @returns\n */\nexport function getAuthorizationClaimItems(\n  authInfo: AuthenticationInfo,\n  claim: string,\n  tenant?: string,\n): string[] {\n  const value = tenant\n    ? authInfo.token[authorizedTenantsClaimName]?.[tenant]?.[claim]\n    : authInfo.token[claim];\n  return Array.isArray(value) ? value : [];\n}\n","/** API paths for the Descope service Management APIs */\nexport default {\n  user: {\n    create: '/v1/mgmt/user/create',\n    update: '/v1/mgmt/user/update',\n    delete: '/v1/mgmt/user/delete',\n    load: '/v1/mgmt/user',\n    search: '/v1/mgmt/user/search',\n    updateStatus: '/v1/mgmt/user/update/status',\n    updateEmail: '/v1/mgmt/user/update/email',\n    updatePhone: '/v1/mgmt/user/update/phone',\n    updateDisplayName: '/v1/mgmt/user/update/name',\n    addRole: '/v1/mgmt/user/update/role/add',\n    removeRole: '/v1/mgmt/user/update/role/remove',\n    addTenant: '/v1/mgmt/user/update/tenant/add',\n    removeTenant: '/v1/mgmt/user/update/tenant/remove',\n  },\n  accessKey: {\n    create: '/v1/mgmt/accesskey/create',\n    load: '/v1/mgmt/accesskey',\n    search: '/v1/mgmt/accesskey/search',\n    update: '/v1/mgmt/accesskey/update',\n    deactivate: '/v1/mgmt/accesskey/deactivate',\n    activate: '/v1/mgmt/accesskey/activate',\n    delete: '/v1/mgmt/accesskey/delete',\n  },\n  tenant: {\n    create: '/v1/mgmt/tenant/create',\n    update: '/v1/mgmt/tenant/update',\n    delete: '/v1/mgmt/tenant/delete',\n    loadAll: '/v1/mgmt/tenant/all',\n  },\n  sso: {\n    configure: '/v1/mgmt/sso/settings',\n    metadata: '/v1/mgmt/sso/metadata',\n    mapping: '/v1/mgmt/sso/mapping',\n  },\n  jwt: {\n    update: '/v1/mgmt/jwt/update',\n  },\n  permission: {\n    create: '/v1/mgmt/permission/create',\n    update: '/v1/mgmt/permission/update',\n    delete: '/v1/mgmt/permission/delete',\n    loadAll: '/v1/mgmt/permission/all',\n  },\n  role: {\n    create: '/v1/mgmt/role/create',\n    update: '/v1/mgmt/role/update',\n    delete: '/v1/mgmt/role/delete',\n    loadAll: '/v1/mgmt/role/all',\n  },\n  group: {\n    loadAllGroups: '/v1/mgmt/group/all',\n    loadAllGroupsForMember: '/v1/mgmt/group/member/all',\n    loadAllGroupMembers: '/v1/mgmt/group/members',\n  },\n};\n","import { SdkResponse, transformResponse, UserResponse } from '@descope/core-js-sdk';\nimport { CoreSdk } from '../types';\nimport apiPaths from './paths';\nimport { AssociatedTenant } from './types';\n\ntype SingleUserResponse = {\n  user: UserResponse;\n};\n\ntype MultipleUsersResponse = {\n  users: UserResponse[];\n};\n\nconst withUser = (sdk: CoreSdk, managementKey?: string) => ({\n  create: (\n    loginId: string,\n    email?: string,\n    phone?: string,\n    displayName?: string,\n    roles?: string[],\n    userTenants?: AssociatedTenant[],\n  ): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.create,\n        { loginId, email, phone, displayName, roleNames: roles, userTenants },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  update: (\n    loginId: string,\n    email?: string,\n    phone?: string,\n    displayName?: string,\n    roles?: string[],\n    userTenants?: AssociatedTenant[],\n  ): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.update,\n        { loginId, email, phone, displayName, roleNames: roles, userTenants },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  delete: (loginId: string): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(apiPaths.user.delete, { loginId }, { token: managementKey }),\n    ),\n  load: (loginId: string): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.get(apiPaths.user.load, {\n        queryParams: { loginId },\n        token: managementKey,\n      }),\n      (data) => data.user,\n    ),\n  /**\n   * Load an existing user by user ID. The ID can be found\n   * on the user's JWT.\n   * @param userId load a user by this user ID field\n   * @returns The UserResponse if found, throws otherwise.\n   */\n  loadByUserId: (userId: string): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.get(apiPaths.user.load, {\n        queryParams: { userId },\n        token: managementKey,\n      }),\n      (data) => data.user,\n    ),\n  searchAll: (\n    tenantIds?: string[],\n    roles?: string[],\n    limit?: number,\n  ): Promise<SdkResponse<UserResponse[]>> =>\n    transformResponse<MultipleUsersResponse, UserResponse[]>(\n      sdk.httpClient.post(\n        apiPaths.user.search,\n        { tenantIds, roleNames: roles, limit },\n        { token: managementKey },\n      ),\n      (data) => data.users,\n    ),\n  activate: (loginId: string): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.updateStatus,\n        { loginId, status: 'enabled' },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  deactivate: (loginId: string): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.updateStatus,\n        { loginId, status: 'disabled' },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  updateEmail: (\n    loginId: string,\n    email: string,\n    isVerified: boolean,\n  ): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.updateEmail,\n        { loginId, email, verified: isVerified },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  updatePhone: (\n    loginId: string,\n    phone: string,\n    isVerified: boolean,\n  ): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.updatePhone,\n        { loginId, phone, verified: isVerified },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  updateDisplayName: (loginId: string, displayName: string): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.updateDisplayName,\n        { loginId, displayName },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  addRoles: (loginId: string, roles: string[]): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.addRole,\n        { loginId, roleNames: roles },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  removeRoles: (loginId: string, roles: string[]): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.removeRole,\n        { loginId, roleNames: roles },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  addTenant: (loginId: string, tenantId: string): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(apiPaths.user.addTenant, { loginId, tenantId }, { token: managementKey }),\n      (data) => data.user,\n    ),\n  removeTenant: (loginId: string, tenantId: string): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.removeTenant,\n        { loginId, tenantId },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  addTenantRoles: (\n    loginId: string,\n    tenantId: string,\n    roles: string[],\n  ): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.addRole,\n        { loginId, tenantId, roleNames: roles },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  removeTenantRoles: (\n    loginId: string,\n    tenantId: string,\n    roles: string[],\n  ): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.removeRole,\n        { loginId, tenantId, roleNames: roles },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n});\n\nexport default withUser;\n","import { SdkResponse, transformResponse } from '@descope/core-js-sdk';\nimport { CoreSdk } from '../types';\nimport apiPaths from './paths';\nimport { CreateTenantResponse, Tenant } from './types';\n\ntype MultipleTenantResponse = {\n  tenants: Tenant[];\n};\n\nconst withTenant = (sdk: CoreSdk, managementKey?: string) => ({\n  create: (\n    name: string,\n    selfProvisioningDomains?: string[],\n  ): Promise<SdkResponse<CreateTenantResponse>> =>\n    transformResponse(\n      sdk.httpClient.post(\n        apiPaths.tenant.create,\n        { name, selfProvisioningDomains },\n        { token: managementKey },\n      ),\n    ),\n  createWithId: (\n    id: string,\n    name: string,\n    selfProvisioningDomains?: string[],\n  ): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(\n        apiPaths.tenant.create,\n        { id, name, selfProvisioningDomains },\n        { token: managementKey },\n      ),\n    ),\n  update: (\n    id: string,\n    name: string,\n    selfProvisioningDomains?: string[],\n  ): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(\n        apiPaths.tenant.update,\n        { id, name, selfProvisioningDomains },\n        { token: managementKey },\n      ),\n    ),\n  delete: (id: string): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(apiPaths.tenant.delete, { id }, { token: managementKey }),\n    ),\n  loadAll: (): Promise<SdkResponse<Tenant[]>> =>\n    transformResponse<MultipleTenantResponse, Tenant[]>(\n      sdk.httpClient.get(apiPaths.tenant.loadAll, {\n        token: managementKey,\n      }),\n      (data) => data.tenants,\n    ),\n});\n\nexport default withTenant;\n","import { SdkResponse, transformResponse } from '@descope/core-js-sdk';\nimport { CoreSdk } from '../types';\nimport apiPaths from './paths';\nimport { UpdateJWTResponse } from './types';\n\nconst withJWT = (sdk: CoreSdk, managementKey?: string) => ({\n  update: (\n    jwt: string,\n    customClaims?: Record<string, any>,\n  ): Promise<SdkResponse<UpdateJWTResponse>> =>\n    transformResponse(\n      sdk.httpClient.post(apiPaths.jwt.update, { jwt, customClaims }, { token: managementKey }),\n    ),\n});\n\nexport default withJWT;\n","import { SdkResponse, transformResponse } from '@descope/core-js-sdk';\nimport { CoreSdk } from '../types';\nimport apiPaths from './paths';\nimport { Permission } from './types';\n\ntype MultiplePermissionResponse = {\n  permissions: Permission[];\n};\n\nconst withPermission = (sdk: CoreSdk, managementKey?: string) => ({\n  create: (name: string, description?: string): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(\n        apiPaths.permission.create,\n        { name, description },\n        { token: managementKey },\n      ),\n    ),\n  update: (name: string, newName: string, description?: string): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(\n        apiPaths.permission.update,\n        { name, newName, description },\n        { token: managementKey },\n      ),\n    ),\n  delete: (name: string): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(apiPaths.permission.delete, { name }, { token: managementKey }),\n    ),\n  loadAll: (): Promise<SdkResponse<Permission[]>> =>\n    transformResponse<MultiplePermissionResponse, Permission[]>(\n      sdk.httpClient.get(apiPaths.permission.loadAll, {\n        token: managementKey,\n      }),\n      (data) => data.permissions,\n    ),\n});\n\nexport default withPermission;\n","import { SdkResponse, transformResponse } from '@descope/core-js-sdk';\nimport { CoreSdk } from '../types';\nimport apiPaths from './paths';\nimport { Role } from './types';\n\ntype MultipleRoleResponse = {\n  roles: Role[];\n};\n\nconst withRole = (sdk: CoreSdk, managementKey?: string) => ({\n  create: (\n    name: string,\n    description?: string,\n    permissionNames?: string[],\n  ): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(\n        apiPaths.role.create,\n        { name, description, permissionNames },\n        { token: managementKey },\n      ),\n    ),\n  update: (\n    name: string,\n    newName: string,\n    description?: string,\n    permissionNames?: string[],\n  ): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(\n        apiPaths.role.update,\n        { name, newName, description, permissionNames },\n        { token: managementKey },\n      ),\n    ),\n  delete: (name: string): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(apiPaths.role.delete, { name }, { token: managementKey }),\n    ),\n  loadAll: (): Promise<SdkResponse<Role[]>> =>\n    transformResponse<MultipleRoleResponse, Role[]>(\n      sdk.httpClient.get(apiPaths.role.loadAll, {\n        token: managementKey,\n      }),\n      (data) => data.roles,\n    ),\n});\n\nexport default withRole;\n","import { SdkResponse, transformResponse } from '@descope/core-js-sdk';\nimport { CoreSdk } from '../types';\nimport apiPaths from './paths';\nimport { Group } from './types';\n\nconst withGroup = (sdk: CoreSdk, managementKey?: string) => ({\n  /**\n   * Load all groups for a specific tenant id.\n   * @param tenantId Tenant ID to load groups from.\n   * @returns Group[] list of groups\n   */\n  loadAllGroups: (tenantId: string): Promise<SdkResponse<Group[]>> =>\n    transformResponse<Group[]>(\n      sdk.httpClient.post(apiPaths.group.loadAllGroups, { tenantId }, { token: managementKey }),\n    ),\n\n  /**\n   * Load all groups for the provided user IDs or login IDs.\n   * @param tenantId Tenant ID to load groups from.\n   * @param userIds Optional List of user IDs, with the format of \"U2J5ES9S8TkvCgOvcrkpzUgVTEBM\" (example), which can be found on the user's JWT.\n   * @param loginIds Optional List of login IDs, how the user identifies when logging in.\n   * @returns Group[] list of groups\n   */\n  loadAllGroupsForMember: (\n    tenantId: string,\n    userIds: string[],\n    loginIds: string[],\n  ): Promise<SdkResponse<Group[]>> =>\n    transformResponse<Group[]>(\n      sdk.httpClient.post(\n        apiPaths.group.loadAllGroupsForMember,\n        { tenantId, loginIds, userIds },\n        { token: managementKey },\n      ),\n    ),\n\n  /**\n   * Load all members of the provided group id.\n   * @param tenantId Tenant ID to load groups from.\n   * @param groupId Group ID to load members for.\n   * @returns Group[] list of groups\n   */\n  loadAllGroupMembers: (tenantId: string, groupId: string): Promise<SdkResponse<Group[]>> =>\n    transformResponse<Group[]>(\n      sdk.httpClient.post(\n        apiPaths.group.loadAllGroupMembers,\n        { tenantId, groupId },\n        { token: managementKey },\n      ),\n    ),\n});\n\nexport default withGroup;\n","import { SdkResponse, transformResponse } from '@descope/core-js-sdk';\nimport { CoreSdk } from '../types';\nimport apiPaths from './paths';\nimport { RoleMapping, AttributeMapping } from './types';\n\nconst withSSOSettings = (sdk: CoreSdk, managementKey?: string) => ({\n  configureSettings: (\n    tenantId: string,\n    idpURL: string,\n    idpCert: string,\n    entityId: string,\n    redirectURL?: string,\n    domain?: string,\n  ): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(\n        apiPaths.sso.configure,\n        { tenantId, idpURL, entityId, idpCert, redirectURL, domain },\n        { token: managementKey },\n      ),\n    ),\n  configureMetadata: (tenantId: string, idpMetadataURL: string): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(\n        apiPaths.sso.metadata,\n        { tenantId, idpMetadataURL },\n        { token: managementKey },\n      ),\n    ),\n  configureMapping: (\n    tenantId: string,\n    roleMapping?: RoleMapping,\n    attributeMapping?: AttributeMapping,\n  ): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(\n        apiPaths.sso.mapping,\n        { tenantId, roleMapping, attributeMapping },\n        { token: managementKey },\n      ),\n    ),\n});\n\nexport default withSSOSettings;\n","import { SdkResponse, transformResponse } from '@descope/core-js-sdk';\nimport { CoreSdk } from '../types';\nimport apiPaths from './paths';\nimport { AccessKey, AssociatedTenant, CreatedAccessKeyResponse } from './types';\n\ntype SingleKeyResponse = {\n  key: AccessKey;\n};\n\ntype MultipleKeysResponse = {\n  keys: AccessKey[];\n};\n\nconst withAccessKey = (sdk: CoreSdk, managementKey?: string) => ({\n  /**\n   * Create a new access key for a project.\n   * @param name Access key name\n   * @param expireTime When the access key expires. Keep at 0 to make it indefinite.\n   * @param roles Optional roles in the project. Does not apply for multi-tenants\n   * @param keyTenants Optional associated tenants for this key and its roles for each.\n   * @returns A newly created key and its cleartext. Make sure to save the cleartext securely.\n   */\n  create: (\n    name: string,\n    expireTime: number,\n    roles?: string[],\n    keyTenants?: AssociatedTenant[],\n  ): Promise<SdkResponse<CreatedAccessKeyResponse>> =>\n    transformResponse(\n      sdk.httpClient.post(\n        apiPaths.accessKey.create,\n        { name, expireTime, roleNames: roles, keyTenants },\n        { token: managementKey },\n      ),\n    ),\n  /**\n   * Load an access key.\n   * @param id Access key ID to load\n   * @returns The loaded access key.\n   */\n  load: (id: string): Promise<SdkResponse<AccessKey>> =>\n    transformResponse<SingleKeyResponse, AccessKey>(\n      sdk.httpClient.get(apiPaths.accessKey.load, {\n        queryParams: { id },\n        token: managementKey,\n      }),\n      (data) => data.key,\n    ),\n  /**\n   * Search all access keys\n   * @param tenantIds Optional tenant ID filter to apply on the search results\n   * @returns An array of found access keys\n   */\n  searchAll: (tenantIds?: string[]): Promise<SdkResponse<AccessKey[]>> =>\n    transformResponse<MultipleKeysResponse, AccessKey[]>(\n      sdk.httpClient.post(apiPaths.accessKey.search, { tenantIds }, { token: managementKey }),\n      (data) => data.keys,\n    ),\n  /**\n   * Update an access key.\n   * @param id Access key ID to load\n   * @param name The updated access key name\n   * @returns The updated access key\n   */\n  update: (id: string, name: string): Promise<SdkResponse<AccessKey>> =>\n    transformResponse<SingleKeyResponse, AccessKey>(\n      sdk.httpClient.post(apiPaths.accessKey.update, { id, name }, { token: managementKey }),\n      (data) => data.key,\n    ),\n  /**\n   * Deactivate an access key. Deactivated access keys cannot be used until they are\n   * activated again.\n   * @param id Access key ID to deactivate\n   */\n  deactivate: (id: string): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(apiPaths.accessKey.deactivate, { id }, { token: managementKey }),\n    ),\n  /**\n   * Activate an access key. Only deactivated access keys can be activated again.\n   * @param id Access key ID to activate\n   */\n  activate: (id: string): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(apiPaths.accessKey.activate, { id }, { token: managementKey }),\n    ),\n  /**\n   * Delete an access key. IMPORTANT: This cannot be undone. Use carefully.\n   * @param id Access key ID to delete\n   */\n  delete: (id: string): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(apiPaths.accessKey.delete, { id }, { token: managementKey }),\n    ),\n});\n\nexport default withAccessKey;\n","import nodeFetch, { Headers } from 'node-fetch-commonjs';\n\nglobalThis.Headers ??= Headers;\n\nconst highWaterMarkMb = 1024 * 1024 * 1024 * 30; // 30MB\n\n// we are increasing the response buffer size due to an issue where node-fetch hangs when response is too big\nconst patchedFetch = (...args: Parameters<typeof nodeFetch>) => {\n  // we can get Request on the first arg, or RequestInfo on the second arg\n  // we want to make sure we are setting the \"highWaterMark\" so we are doing it on both args\n  args.forEach((arg) => {\n    // eslint-disable-next-line no-param-reassign, @typescript-eslint/no-unused-expressions\n    arg && ((arg as any).highWaterMark ??= highWaterMarkMb);\n  });\n\n  return nodeFetch(...args);\n};\n\nexport default patchedFetch as unknown as typeof fetch;\n","import createSdk, { ExchangeAccessKeyResponse, SdkResponse, wrapWith } from '@descope/core-js-sdk';\nimport { JWK, JWTHeaderParameters, KeyLike, errors, importJWK, jwtVerify } from 'jose';\nimport {\n  permissionsClaimName,\n  refreshTokenCookieName,\n  rolesClaimName,\n  sessionTokenCookieName,\n} from './constants';\nimport { getAuthorizationClaimItems, withCookie } from './helpers';\nimport withManagement from './management';\nimport { AuthenticationInfo } from './types';\nimport fetch from './fetch-polyfill';\n\ndeclare const BUILD_VERSION: string;\n\n/** Configuration arguments which include the Descope core SDK args and an optional management key */\ntype NodeSdkArgs = Parameters<typeof createSdk>[0] & {\n  managementKey?: string;\n};\n\nconst nodeSdk = ({ managementKey, ...config }: NodeSdkArgs) => {\n  const coreSdk = createSdk({\n    ...config,\n    fetch,\n    baseHeaders: {\n      ...config.baseHeaders,\n      'x-descope-sdk-name': 'nodejs',\n      'x-descope-sdk-node-version': process?.versions?.node || '',\n      'x-descope-sdk-version': BUILD_VERSION,\n    },\n  });\n\n  const { projectId, logger } = config;\n\n  const keys: Record<string, KeyLike | Uint8Array> = {};\n\n  /** Fetch the public keys (JWKs) from Descope for the configured project */\n  const fetchKeys = async () => {\n    const keysWrapper = await coreSdk.httpClient\n      .get(`v2/keys/${projectId}`)\n      .then((resp) => resp.json());\n    const publicKeys: JWK[] = keysWrapper.keys;\n    if (!Array.isArray(publicKeys)) return {};\n    const kidJwksPairs = await Promise.all(\n      publicKeys.map(async (key) => [key.kid, await importJWK(key)]),\n    );\n\n    return kidJwksPairs.reduce(\n      (acc, [kid, jwk]) => (kid ? { ...acc, [kid.toString()]: jwk } : acc),\n      {},\n    );\n  };\n\n  const management = withManagement(coreSdk, managementKey);\n\n  const sdk = {\n    ...coreSdk,\n\n    /**\n     * Provides various APIs for managing a Descope project programmatically. A management key must\n     * be provided as an argument when initializing the SDK to use these APIs. Management keys can be\n     * generated in the Descope console.\n     */\n    management,\n\n    /** Get the key that can validate the given JWT KID in the header. Can retrieve the public key from local cache or from Descope. */\n    async getKey(header: JWTHeaderParameters): Promise<KeyLike | Uint8Array> {\n      if (!header?.kid) throw Error('header.kid must not be empty');\n\n      if (keys[header.kid]) return keys[header.kid];\n\n      // do we need to fetch once or every time?\n      Object.assign(keys, await fetchKeys());\n\n      if (!keys[header.kid]) throw Error('failed to fetch matching key');\n\n      return keys[header.kid];\n    },\n\n    /**\n     * Validate the given JWT with the right key and make sure the issuer is correct\n     * @param jwt the JWT string to parse and validate\n     * @returns AuthenticationInfo with the parsed token and JWT. Will throw an error if validation fails.\n     */\n    async validateJwt(jwt: string): Promise<AuthenticationInfo> {\n      // Do not hard-code the algo because library does not support `None` so all are valid\n      const res = await jwtVerify(jwt, sdk.getKey, { clockTolerance: 5 });\n      const token = res.payload;\n\n      if (token) {\n        token.iss = token.iss?.split('/').pop(); // support both url and project id as issuer\n        if (token.iss !== projectId) {\n          // We must do the verification here, since issuer can be either project ID or URL\n          throw new errors.JWTClaimValidationFailed(\n            'unexpected \"iss\" claim value',\n            'iss',\n            'check_failed',\n          );\n        }\n      }\n\n      return { jwt, token };\n    },\n\n    /**\n     * Validate an active session\n     * @param sessionToken session JWT to validate\n     * @returns AuthenticationInfo promise or throws Error if there is an issue with JWTs\n     */\n    async validateSession(sessionToken: string): Promise<AuthenticationInfo> {\n      if (!sessionToken) throw Error('session token is required for validation');\n\n      try {\n        const token = await sdk.validateJwt(sessionToken);\n        return token;\n      } catch (error) {\n        /* istanbul ignore next */\n        logger?.error('session validation failed', error);\n        throw Error('session validation failed');\n      }\n    },\n\n    /**\n     * Refresh the session using a refresh token\n     * @param refreshToken refresh JWT to refresh the session with\n     * @returns AuthenticationInfo promise or throws Error if there is an issue with JWTs\n     */\n    async refreshSession(refreshToken: string): Promise<AuthenticationInfo> {\n      if (!refreshToken) throw Error('refresh token is required to refresh a session');\n\n      try {\n        await sdk.validateJwt(refreshToken);\n        const jwtResp = await sdk.refresh(refreshToken);\n        if (jwtResp.ok) {\n          const token = await sdk.validateJwt(jwtResp.data?.sessionJwt);\n          return token;\n        }\n        /* istanbul ignore next */\n        throw Error(jwtResp.error?.errorMessage);\n      } catch (refreshTokenErr) {\n        /* istanbul ignore next */\n        logger?.error('refresh token validation failed', refreshTokenErr);\n        throw Error('refresh token validation failed');\n      }\n    },\n\n    /**\n     * Validate session and refresh it if it expired\n     * @param sessionToken session JWT\n     * @param refreshToken refresh JWT\n     * @returns AuthenticationInfo promise or throws Error if there is an issue with JWTs\n     */\n    async validateAndRefreshSession(\n      sessionToken?: string,\n      refreshToken?: string,\n    ): Promise<AuthenticationInfo> {\n      if (!sessionToken && !refreshToken) throw Error('both session and refresh tokens are empty');\n\n      try {\n        const token = await sdk.validateSession(sessionToken);\n        return token;\n      } catch (error) {\n        /* istanbul ignore next */\n        logger?.log('session validation failed - trying to refresh it');\n      }\n\n      return sdk.refreshSession(refreshToken);\n    },\n\n    /**\n     * Exchange API key (access key) for a session key\n     * @param accessKey access key to exchange for a session JWT\n     * @returns AuthneticationInfo with session JWT data\n     */\n    async exchangeAccessKey(accessKey: string): Promise<AuthenticationInfo> {\n      if (!accessKey) throw Error('access key must not be empty');\n\n      let resp: SdkResponse<ExchangeAccessKeyResponse>;\n      try {\n        resp = await sdk.accessKey.exchange(accessKey);\n      } catch (error) {\n        logger?.error('failed to exchange access key', error);\n        throw Error('could not exchange access key');\n      }\n\n      const { sessionJwt } = resp.data;\n      if (!sessionJwt) {\n        logger?.error('failed to parse exchange access key response');\n        throw Error('could not exchange access key');\n      }\n\n      try {\n        const token = await sdk.validateJwt(sessionJwt);\n        return token;\n      } catch (error) {\n        logger?.error('failed to parse jwt from access key', error);\n        throw Error('could not exchange access key');\n      }\n    },\n\n    /**\n     * Make sure that all given permissions exist on the parsed JWT top level claims\n     * @param authInfo JWT parsed info\n     * @param permissions list of permissions to make sure they exist on te JWT claims\n     * @returns true if all permissions exist, false otherwise\n     */\n    validatePermissions(authInfo: AuthenticationInfo, permissions: string[]): boolean {\n      return sdk.validateTenantPermissions(authInfo, null, permissions);\n    },\n\n    /**\n     * Make sure that all given permissions exist on the parsed JWT tenant claims\n     * @param authInfo JWT parsed info\n     * @param permissions list of permissions to make sure they exist on te JWT claims\n     * @returns true if all permissions exist, false otherwise\n     */\n    validateTenantPermissions(\n      authInfo: AuthenticationInfo,\n      tenant: string,\n      permissions: string[],\n    ): boolean {\n      const granted = getAuthorizationClaimItems(authInfo, permissionsClaimName, tenant);\n      return permissions.every((perm) => granted.includes(perm));\n    },\n\n    /**\n     * Make sure that all given roles exist on the parsed JWT top level claims\n     * @param authInfo JWT parsed info\n     * @param roles list of roles to make sure they exist on te JWT claims\n     * @returns true if all roles exist, false otherwise\n     */\n    validateRoles(authInfo: AuthenticationInfo, roles: string[]): boolean {\n      return sdk.validateTenantRoles(authInfo, null, roles);\n    },\n\n    /**\n     * Make sure that all given roles exist on the parsed JWT tenant claims\n     * @param authInfo JWT parsed info\n     * @param roles list of roles to make sure they exist on te JWT claims\n     * @returns true if all roles exist, false otherwise\n     */\n    validateTenantRoles(authInfo: AuthenticationInfo, tenant: string, roles: string[]): boolean {\n      const membership = getAuthorizationClaimItems(authInfo, rolesClaimName, tenant);\n      return roles.every((role) => membership.includes(role));\n    },\n  };\n\n  return wrapWith(\n    sdk,\n    [\n      'otp.verify.email',\n      'otp.verify.sms',\n      'otp.verify.whatsapp',\n      'magicLink.verify',\n      'enchantedLink.signUp',\n      'enchantedLink.signIn',\n      'oauth.exchange',\n      'saml.exchange',\n      'totp.verify',\n      'webauthn.signIn.finish',\n      'webauthn.signUp.finish',\n      'refresh',\n    ] as const,\n    withCookie,\n  );\n};\n\n/** Descope SDK client with delivery methods enum.\n *\n * Please see full documentation at {@link https://docs.descope.com/guides Descope Docs}\n * @example Usage\n *\n * ```js\n * import descopeSdk from '@descope/node-sdk';\n *\n * const myProjectId = 'xxx';\n * const sdk = descopeSdk({ projectId: myProjectId });\n *\n * const userLoginId = 'loginId';\n * sdk.otp.signIn.email(userLoginId);\n * const jwtResponse = sdk.otp.verify.email(userLoginId, codeFromEmail);\n * ```\n */\n\nnodeSdk.RefreshTokenCookieName = refreshTokenCookieName;\nnodeSdk.SessionTokenCookieName = sessionTokenCookieName;\n\nexport default nodeSdk;\nexport type { DeliveryMethod, OAuthProvider } from '@descope/core-js-sdk';\n","import { CoreSdk } from '../types';\nimport withUser from './user';\nimport withTenant from './tenant';\nimport withJWT from './jwt';\nimport withPermission from './permission';\nimport withRole from './role';\nimport withGroup from './group';\nimport withSSOSettings from './sso';\nimport withAccessKey from './accesskey';\n\n/** Constructs a higher level Management API that wraps the functions from code-js-sdk */\nconst withManagement = (sdk: CoreSdk, managementKey?: string) => ({\n  user: withUser(sdk, managementKey),\n  accessKey: withAccessKey(sdk, managementKey),\n  tenant: withTenant(sdk, managementKey),\n  sso: withSSOSettings(sdk, managementKey),\n  jwt: withJWT(sdk, managementKey),\n  permission: withPermission(sdk, managementKey),\n  role: withRole(sdk, managementKey),\n  group: withGroup(sdk, managementKey),\n});\n\nexport default withManagement;\n"],"names":["withCookie","fn","async","args","resp","data","_d","refreshJwt","rest","__rest","cookies","options","push","cookieDomain","cookieMaxAge","cookiePath","_a","response","headers","get","cookie","name","match","RegExp","getCookieValue","_b","_c","Object","assign","getAuthorizationClaimItems","authInfo","claim","tenant","value","token","Array","isArray","apiPaths","create","update","delete","load","search","updateStatus","updateEmail","updatePhone","updateDisplayName","addRole","removeRole","addTenant","removeTenant","deactivate","activate","loadAll","configure","metadata","mapping","loadAllGroups","loadAllGroupsForMember","loadAllGroupMembers","withUser","sdk","managementKey","loginId","email","phone","displayName","roles","userTenants","transformResponse","httpClient","post","roleNames","user","queryParams","loadByUserId","userId","searchAll","tenantIds","limit","users","status","isVerified","verified","addRoles","removeRoles","tenantId","addTenantRoles","removeTenantRoles","withTenant","selfProvisioningDomains","createWithId","id","tenants","withJWT","jwt","customClaims","withPermission","description","newName","permissions","withRole","permissionNames","withGroup","userIds","loginIds","groupId","withSSOSettings","configureSettings","idpURL","idpCert","entityId","redirectURL","domain","configureMetadata","idpMetadataURL","configureMapping","roleMapping","attributeMapping","withAccessKey","expireTime","keyTenants","key","keys","globalThis","Headers","patchedFetch","forEach","arg","highWaterMark","nodeFetch","nodeSdk","config","coreSdk","createSdk","fetch","baseHeaders","process","versions","node","projectId","logger","management","accessKey","sso","permission","role","group","withManagement","header","kid","Error","publicKeys","then","json","Promise","all","map","importJWK","reduce","acc","jwk","toString","fetchKeys","jwtVerify","getKey","clockTolerance","payload","iss","split","pop","errors","JWTClaimValidationFailed","sessionToken","validateJwt","error","refreshToken","jwtResp","refresh","ok","sessionJwt","errorMessage","refreshTokenErr","validateSession","log","refreshSession","exchange","validatePermissions","validateTenantPermissions","granted","every","perm","includes","validateRoles","validateTenantRoles","membership","wrapWith","RefreshTokenCookieName","SessionTokenCookieName"],"mappings":"sNAEO,MC+BMA,EACVC,GACDC,SAAUC,eACR,MAAMC,QAAaH,KAAME,GAGzB,IAAKC,EAAKC,KACR,OAAOD,EAIT,IAAIE,EAA0BF,EAAKC,MAA/BE,WAAEA,GAAUD,EAAKE,EAAjBC,EAAAH,EAAA,CAAA,eACJ,MAAMI,EAAoB,GAlCP,IAA8BC,EAgDjD,OAZKJ,EASHG,EAAQE,KA5CZ,GDVoC,SCsDoBL,cA5C5BI,OADuBA,EA6CiBH,QA5CxC,EAAAG,EAASE,eAAgB,gBACnDF,aAAA,EAAAA,EAASG,eAAgB,aACjBH,aAAA,EAAAA,EAASI,aAAc,mCAkCZ,QAAbC,EAAAZ,EAAKa,gBAAQ,IAAAD,OAAA,EAAAA,EAAEE,QAAQC,IAAI,iBAC7BZ,EA3Be,EAACa,EAAmCC,KACzD,MAAMC,EAAQF,eAAAA,EAAQE,MAAMC,OAAO,cAAcF,cACjD,OAAOC,EAAQA,EAAM,GAAK,IAAI,EAyBXE,CACE,QAAbC,EAAArB,EAAKa,gBAAQ,IAAAQ,OAAA,EAAAA,EAAEP,QAAQC,IAAI,cDhDC,OCmD9BT,EAAQE,KAAoB,QAAfc,EAAAtB,EAAKa,gBAAU,IAAAS,OAAA,EAAAA,EAAAR,QAAQC,IAAI,gBAMhCQ,OAAAC,OAAAD,OAAAC,OAAA,CAAA,EAAAxB,GAAM,CAAAC,KAAWsB,OAAAC,OAAAD,OAAAC,OAAA,GAAAxB,EAAKC,MAAM,CAAAE,aAAYG,aAAY,WAUpDmB,EACdC,EACAC,EACAC,WAEA,MAAMC,EAAQD,EAC0C,QAApDP,EAA6C,QAA7CT,EAAAc,EAASI,MAAgC,eAAI,IAAAlB,OAAA,EAAAA,EAAAgB,UAAO,IAAAP,OAAA,EAAAA,EAAGM,GACvDD,EAASI,MAAMH,GACnB,OAAOI,MAAMC,QAAQH,GAASA,EAAQ,EACxC,CC7EA,IAAeI,EACP,CACJC,OAAQ,uBACRC,OAAQ,uBACRC,OAAQ,uBACRC,KAAM,gBACNC,OAAQ,uBACRC,aAAc,8BACdC,YAAa,6BACbC,YAAa,6BACbC,kBAAmB,4BACnBC,QAAS,gCACTC,WAAY,mCACZC,UAAW,kCACXC,aAAc,sCAdHb,EAgBF,CACTC,OAAQ,4BACRG,KAAM,qBACNC,OAAQ,4BACRH,OAAQ,4BACRY,WAAY,gCACZC,SAAU,8BACVZ,OAAQ,6BAvBGH,EAyBL,CACNC,OAAQ,yBACRC,OAAQ,yBACRC,OAAQ,yBACRa,QAAS,uBA7BEhB,EA+BR,CACHiB,UAAW,wBACXC,SAAU,wBACVC,QAAS,wBAlCEnB,EAoCR,CACHE,OAAQ,uBArCGF,EAuCD,CACVC,OAAQ,6BACRC,OAAQ,6BACRC,OAAQ,6BACRa,QAAS,2BA3CEhB,EA6CP,CACJC,OAAQ,uBACRC,OAAQ,uBACRC,OAAQ,uBACRa,QAAS,qBAjDEhB,EAmDN,CACLoB,cAAe,qBACfC,uBAAwB,4BACxBC,oBAAqB,0BC1CzB,MAAMC,EAAW,CAACC,EAAcC,KAA4B,CAC1DxB,OAAQ,CACNyB,EACAC,EACAC,EACAC,EACAC,EACAC,IAEAC,EACER,EAAIS,WAAWC,KACblC,EAAcC,OACd,CAAEyB,UAASC,QAAOC,QAAOC,cAAaM,UAAWL,EAAOC,eACxD,CAAElC,MAAO4B,KAEVzD,GAASA,EAAKoE,OAEnBlC,OAAQ,CACNwB,EACAC,EACAC,EACAC,EACAC,EACAC,IAEAC,EACER,EAAIS,WAAWC,KACblC,EAAcE,OACd,CAAEwB,UAASC,QAAOC,QAAOC,cAAaM,UAAWL,EAAOC,eACxD,CAAElC,MAAO4B,KAEVzD,GAASA,EAAKoE,OAEnBjC,OAASuB,GACPM,EACER,EAAIS,WAAWC,KAAKlC,EAAcG,OAAQ,CAAEuB,WAAW,CAAE7B,MAAO4B,KAEpErB,KAAOsB,GACLM,EACER,EAAIS,WAAWnD,IAAIkB,EAAcI,KAAM,CACrCiC,YAAa,CAAEX,WACf7B,MAAO4B,KAERzD,GAASA,EAAKoE,OAQnBE,aAAeC,GACbP,EACER,EAAIS,WAAWnD,IAAIkB,EAAcI,KAAM,CACrCiC,YAAa,CAAEE,UACf1C,MAAO4B,KAERzD,GAASA,EAAKoE,OAEnBI,UAAW,CACTC,EACAX,EACAY,IAEAV,EACER,EAAIS,WAAWC,KACblC,EAAcK,OACd,CAAEoC,YAAWN,UAAWL,EAAOY,SAC/B,CAAE7C,MAAO4B,KAEVzD,GAASA,EAAK2E,QAEnB5B,SAAWW,GACTM,EACER,EAAIS,WAAWC,KACblC,EAAcM,aACd,CAAEoB,UAASkB,OAAQ,WACnB,CAAE/C,MAAO4B,KAEVzD,GAASA,EAAKoE,OAEnBtB,WAAaY,GACXM,EACER,EAAIS,WAAWC,KACblC,EAAcM,aACd,CAAEoB,UAASkB,OAAQ,YACnB,CAAE/C,MAAO4B,KAEVzD,GAASA,EAAKoE,OAEnB7B,YAAa,CACXmB,EACAC,EACAkB,IAEAb,EACER,EAAIS,WAAWC,KACblC,EAAcO,YACd,CAAEmB,UAASC,QAAOmB,SAAUD,GAC5B,CAAEhD,MAAO4B,KAEVzD,GAASA,EAAKoE,OAEnB5B,YAAa,CACXkB,EACAE,EACAiB,IAEAb,EACER,EAAIS,WAAWC,KACblC,EAAcQ,YACd,CAAEkB,UAASE,QAAOkB,SAAUD,GAC5B,CAAEhD,MAAO4B,KAEVzD,GAASA,EAAKoE,OAEnB3B,kBAAmB,CAACiB,EAAiBG,IACnCG,EACER,EAAIS,WAAWC,KACblC,EAAcS,kBACd,CAAEiB,UAASG,eACX,CAAEhC,MAAO4B,KAEVzD,GAASA,EAAKoE,OAEnBW,SAAU,CAACrB,EAAiBI,IAC1BE,EACER,EAAIS,WAAWC,KACblC,EAAcU,QACd,CAAEgB,UAASS,UAAWL,GACtB,CAAEjC,MAAO4B,KAEVzD,GAASA,EAAKoE,OAEnBY,YAAa,CAACtB,EAAiBI,IAC7BE,EACER,EAAIS,WAAWC,KACblC,EAAcW,WACd,CAAEe,UAASS,UAAWL,GACtB,CAAEjC,MAAO4B,KAEVzD,GAASA,EAAKoE,OAEnBxB,UAAW,CAACc,EAAiBuB,IAC3BjB,EACER,EAAIS,WAAWC,KAAKlC,EAAcY,UAAW,CAAEc,UAASuB,YAAY,CAAEpD,MAAO4B,KAC5EzD,GAASA,EAAKoE,OAEnBvB,aAAc,CAACa,EAAiBuB,IAC9BjB,EACER,EAAIS,WAAWC,KACblC,EAAca,aACd,CAAEa,UAASuB,YACX,CAAEpD,MAAO4B,KAEVzD,GAASA,EAAKoE,OAEnBc,eAAgB,CACdxB,EACAuB,EACAnB,IAEAE,EACER,EAAIS,WAAWC,KACblC,EAAcU,QACd,CAAEgB,UAASuB,WAAUd,UAAWL,GAChC,CAAEjC,MAAO4B,KAEVzD,GAASA,EAAKoE,OAEnBe,kBAAmB,CACjBzB,EACAuB,EACAnB,IAEAE,EACER,EAAIS,WAAWC,KACblC,EAAcW,WACd,CAAEe,UAASuB,WAAUd,UAAWL,GAChC,CAAEjC,MAAO4B,KAEVzD,GAASA,EAAKoE,SCzLfgB,EAAa,CAAC5B,EAAcC,KAA4B,CAC5DxB,OAAQ,CACNjB,EACAqE,IAEArB,EACER,EAAIS,WAAWC,KACblC,EAAgBC,OAChB,CAAEjB,OAAMqE,2BACR,CAAExD,MAAO4B,KAGf6B,aAAc,CACZC,EACAvE,EACAqE,IAEArB,EACER,EAAIS,WAAWC,KACblC,EAAgBC,OAChB,CAAEsD,KAAIvE,OAAMqE,2BACZ,CAAExD,MAAO4B,KAGfvB,OAAQ,CACNqD,EACAvE,EACAqE,IAEArB,EACER,EAAIS,WAAWC,KACblC,EAAgBE,OAChB,CAAEqD,KAAIvE,OAAMqE,2BACZ,CAAExD,MAAO4B,KAGftB,OAASoD,GACPvB,EACER,EAAIS,WAAWC,KAAKlC,EAAgBG,OAAQ,CAAEoD,MAAM,CAAE1D,MAAO4B,KAEjET,QAAS,IACPgB,EACER,EAAIS,WAAWnD,IAAIkB,EAAgBgB,QAAS,CAC1CnB,MAAO4B,KAERzD,GAASA,EAAKwF,YCjDfC,EAAU,CAACjC,EAAcC,KAA4B,CACzDvB,OAAQ,CACNwD,EACAC,IAEA3B,EACER,EAAIS,WAAWC,KAAKlC,EAAaE,OAAQ,CAAEwD,MAAKC,gBAAgB,CAAE9D,MAAO4B,OCFzEmC,EAAiB,CAACpC,EAAcC,KAA4B,CAChExB,OAAQ,CAACjB,EAAc6E,IACrB7B,EACER,EAAIS,WAAWC,KACblC,EAAoBC,OACpB,CAAEjB,OAAM6E,eACR,CAAEhE,MAAO4B,KAGfvB,OAAQ,CAAClB,EAAc8E,EAAiBD,IACtC7B,EACER,EAAIS,WAAWC,KACblC,EAAoBE,OACpB,CAAElB,OAAM8E,UAASD,eACjB,CAAEhE,MAAO4B,KAGftB,OAASnB,GACPgD,EACER,EAAIS,WAAWC,KAAKlC,EAAoBG,OAAQ,CAAEnB,QAAQ,CAAEa,MAAO4B,KAEvET,QAAS,IACPgB,EACER,EAAIS,WAAWnD,IAAIkB,EAAoBgB,QAAS,CAC9CnB,MAAO4B,KAERzD,GAASA,EAAK+F,gBC1BfC,EAAW,CAACxC,EAAcC,KAA4B,CAC1DxB,OAAQ,CACNjB,EACA6E,EACAI,IAEAjC,EACER,EAAIS,WAAWC,KACblC,EAAcC,OACd,CAAEjB,OAAM6E,cAAaI,mBACrB,CAAEpE,MAAO4B,KAGfvB,OAAQ,CACNlB,EACA8E,EACAD,EACAI,IAEAjC,EACER,EAAIS,WAAWC,KACblC,EAAcE,OACd,CAAElB,OAAM8E,UAASD,cAAaI,mBAC9B,CAAEpE,MAAO4B,KAGftB,OAASnB,GACPgD,EACER,EAAIS,WAAWC,KAAKlC,EAAcG,OAAQ,CAAEnB,QAAQ,CAAEa,MAAO4B,KAEjET,QAAS,IACPgB,EACER,EAAIS,WAAWnD,IAAIkB,EAAcgB,QAAS,CACxCnB,MAAO4B,KAERzD,GAASA,EAAK8D,UCvCfoC,EAAY,CAAC1C,EAAcC,KAA4B,CAM3DL,cAAgB6B,GACdjB,EACER,EAAIS,WAAWC,KAAKlC,EAAeoB,cAAe,CAAE6B,YAAY,CAAEpD,MAAO4B,KAU7EJ,uBAAwB,CACtB4B,EACAkB,EACAC,IAEApC,EACER,EAAIS,WAAWC,KACblC,EAAeqB,uBACf,CAAE4B,WAAUmB,WAAUD,WACtB,CAAEtE,MAAO4B,KAUfH,oBAAqB,CAAC2B,EAAkBoB,IACtCrC,EACER,EAAIS,WAAWC,KACblC,EAAesB,oBACf,CAAE2B,WAAUoB,WACZ,CAAExE,MAAO4B,OC1CX6C,EAAkB,CAAC9C,EAAcC,KAA4B,CACjE8C,kBAAmB,CACjBtB,EACAuB,EACAC,EACAC,EACAC,EACAC,IAEA5C,EACER,EAAIS,WAAWC,KACblC,EAAaiB,UACb,CAAEgC,WAAUuB,SAAQE,WAAUD,UAASE,cAAaC,UACpD,CAAE/E,MAAO4B,KAGfoD,kBAAmB,CAAC5B,EAAkB6B,IACpC9C,EACER,EAAIS,WAAWC,KACblC,EAAakB,SACb,CAAE+B,WAAU6B,kBACZ,CAAEjF,MAAO4B,KAGfsD,iBAAkB,CAChB9B,EACA+B,EACAC,IAEAjD,EACER,EAAIS,WAAWC,KACblC,EAAamB,QACb,CAAE8B,WAAU+B,cAAaC,oBACzB,CAAEpF,MAAO4B,OCzBXyD,EAAgB,CAAC1D,EAAcC,KAA4B,CAS/DxB,OAAQ,CACNjB,EACAmG,EACArD,EACAsD,IAEApD,EACER,EAAIS,WAAWC,KACblC,EAAmBC,OACnB,CAAEjB,OAAMmG,aAAYhD,UAAWL,EAAOsD,cACtC,CAAEvF,MAAO4B,KAQfrB,KAAOmD,GACLvB,EACER,EAAIS,WAAWnD,IAAIkB,EAAmBI,KAAM,CAC1CiC,YAAa,CAAEkB,MACf1D,MAAO4B,KAERzD,GAASA,EAAKqH,MAOnB7C,UAAYC,GACVT,EACER,EAAIS,WAAWC,KAAKlC,EAAmBK,OAAQ,CAAEoC,aAAa,CAAE5C,MAAO4B,KACtEzD,GAASA,EAAKsH,OAQnBpF,OAAQ,CAACqD,EAAYvE,IACnBgD,EACER,EAAIS,WAAWC,KAAKlC,EAAmBE,OAAQ,CAAEqD,KAAIvE,QAAQ,CAAEa,MAAO4B,KACrEzD,GAASA,EAAKqH,MAOnBvE,WAAayC,GACXvB,EACER,EAAIS,WAAWC,KAAKlC,EAAmBc,WAAY,CAAEyC,MAAM,CAAE1D,MAAO4B,KAMxEV,SAAWwC,GACTvB,EACER,EAAIS,WAAWC,KAAKlC,EAAmBe,SAAU,CAAEwC,MAAM,CAAE1D,MAAO4B,KAMtEtB,OAASoD,GACPvB,EACER,EAAIS,WAAWC,KAAKlC,EAAmBG,OAAQ,CAAEoD,MAAM,CAAE1D,MAAO4B,aC1FpD,QAAlB9C,EAAA4G,WAAWC,eAAO,IAAA7G,IAAlB4G,WAAWC,QAAYA,GAEvB,MAGMC,EAAe,IAAI3H,KAGvBA,EAAK4H,SAASC,YAEZA,YAAShH,GAAAS,EAAAuG,GAAYC,+BAAAA,cARD,aAQmC,IAGlDC,KAAa/H,ICKhBgI,EAAWnH,WAAA8C,cAAEA,GAAuC9C,EAArBoH,EAAM3H,EAAAO,EAA1B,mBACf,MAAMqH,EAAUC,EACX3G,OAAAC,OAAAD,OAAAC,OAAA,CAAA,EAAAwG,UACHG,EACAC,YAAW7G,OAAAC,OAAAD,OAAAC,OAAA,CAAA,EACNwG,EAAOI,cACV,qBAAsB,SACtB,8BAAiD,UAAZ,OAAPC,cAAO,IAAPA,aAAO,EAAPA,QAASC,gBAAU,IAAAjH,OAAA,EAAAA,EAAAkH,OAAQ,GACzD,wBAAyB,cAIvBC,UAAEA,EAASC,OAAEA,GAAWT,EAExBT,EAA6C,CAAA,EAmB7CmB,EC1Ce,EAACjF,EAAcC,KAA4B,CAChEW,KAAMb,EAASC,EAAKC,GACpBiF,UAAWxB,EAAc1D,EAAKC,GAC9B9B,OAAQyD,EAAW5B,EAAKC,GACxBkF,IAAKrC,EAAgB9C,EAAKC,GAC1BiC,IAAKD,EAAQjC,EAAKC,GAClBmF,WAAYhD,EAAepC,EAAKC,GAChCoF,KAAM7C,EAASxC,EAAKC,GACpBqF,MAAO5C,EAAU1C,EAAKC,KDkCHsF,CAAef,EAASvE,GAErCD,iCACDwE,GAAO,CAOVS,aAGA5I,aAAamJ,GACX,KAAKA,aAAA,EAAAA,EAAQC,KAAK,MAAMC,MAAM,gCAE9B,GAAI5B,EAAK0B,EAAOC,KAAM,OAAO3B,EAAK0B,EAAOC,KAKzC,GAFA3H,OAAOC,OAAO+F,OAnCAzH,WAChB,MAGMsJ,SAHoBnB,EAAQ/D,WAC/BnD,IAAI,WAAWyH,KACfa,MAAMrJ,GAASA,EAAKsJ,UACe/B,KACtC,OAAKxF,MAAMC,QAAQoH,UACQG,QAAQC,IACjCJ,EAAWK,KAAI3J,MAAOwH,GAAQ,CAACA,EAAI4B,UAAWQ,EAAUpC,QAGtCqC,QAClB,CAACC,GAAMV,EAAKW,KAAUX,EAAW3H,OAAAC,OAAAD,OAAAC,OAAA,CAAA,EAAAoI,IAAK,CAACV,EAAIY,YAAaD,IAAQD,GAChE,CAAE,GAPmC,EAQtC,EAsB2BG,KAErBxC,EAAK0B,EAAOC,KAAM,MAAMC,MAAM,gCAEnC,OAAO5B,EAAK0B,EAAOC,IACpB,EAODpJ,kBAAkB6F,SAEhB,MACM7D,SADYkI,EAAUrE,EAAKlC,EAAIwG,OAAQ,CAAEC,eAAgB,KAC7CC,QAElB,GAAIrI,IACFA,EAAMsI,IAAe,QAATxJ,EAAAkB,EAAMsI,WAAG,IAAAxJ,OAAA,EAAAA,EAAEyJ,MAAM,KAAKC,MAC9BxI,EAAMsI,MAAQ5B,GAEhB,MAAM,IAAI+B,EAAOC,yBACf,+BACA,MACA,gBAKN,MAAO,CAAE7E,MAAK7D,QACf,EAODhC,sBAAsB2K,GACpB,IAAKA,EAAc,MAAMtB,MAAM,4CAE/B,IAEE,aADoB1F,EAAIiH,YAAYD,EAMrC,CAJC,MAAOE,GAGP,MADAlC,SAAAA,EAAQkC,MAAM,4BAA6BA,GACrCxB,MAAM,4BACb,CACF,EAODrJ,qBAAqB8K,WACnB,IAAKA,EAAc,MAAMzB,MAAM,kDAE/B,UACQ1F,EAAIiH,YAAYE,GACtB,MAAMC,QAAgBpH,EAAIqH,QAAQF,GAClC,GAAIC,EAAQE,GAAI,CAEd,aADoBtH,EAAIiH,YAA0B,QAAd9J,EAAAiK,EAAQ5K,YAAM,IAAAW,OAAA,EAAAA,EAAAoK,WAEnD,CAED,MAAM7B,MAAmB,QAAb9H,EAAAwJ,EAAQF,aAAK,IAAAtJ,OAAA,EAAAA,EAAE4J,aAK5B,CAJC,MAAOC,GAGP,MADAzC,SAAAA,EAAQkC,MAAM,kCAAmCO,GAC3C/B,MAAM,kCACb,CACF,EAQDrJ,gCACE2K,EACAG,GAEA,IAAKH,IAAiBG,EAAc,MAAMzB,MAAM,6CAEhD,IAEE,aADoB1F,EAAI0H,gBAAgBV,EAKzC,CAHC,MAAOE,GAEPlC,SAAAA,EAAQ2C,IAAI,mDACb,CAED,OAAO3H,EAAI4H,eAAeT,EAC3B,EAOD9K,wBAAwB6I,GACtB,IAAKA,EAAW,MAAMQ,MAAM,gCAE5B,IAAInJ,EACJ,IACEA,QAAayD,EAAIkF,UAAU2C,SAAS3C,EAIrC,CAHC,MAAOgC,GAEP,MADAlC,SAAAA,EAAQkC,MAAM,gCAAiCA,GACzCxB,MAAM,gCACb,CAED,MAAM6B,WAAEA,GAAehL,EAAKC,KAC5B,IAAK+K,EAEH,MADAvC,SAAAA,EAAQkC,MAAM,gDACRxB,MAAM,iCAGd,IAEE,aADoB1F,EAAIiH,YAAYM,EAKrC,CAHC,MAAOL,GAEP,MADAlC,SAAAA,EAAQkC,MAAM,sCAAuCA,GAC/CxB,MAAM,gCACb,CACF,EAQDoC,oBAAmB,CAAC7J,EAA8BsE,IACzCvC,EAAI+H,0BAA0B9J,EAAU,KAAMsE,GASvDwF,0BACE9J,EACAE,EACAoE,GAEA,MAAMyF,EAAUhK,EAA2BC,EZrNb,cYqN6CE,GAC3E,OAAOoE,EAAY0F,OAAOC,GAASF,EAAQG,SAASD,IACrD,EAQDE,cAAa,CAACnK,EAA8BqC,IACnCN,EAAIqI,oBAAoBpK,EAAU,KAAMqC,GASjD+H,oBAAoBpK,EAA8BE,EAAgBmC,GAChE,MAAMgI,EAAatK,EAA2BC,EZxOtB,QYwOgDE,GACxE,OAAOmC,EAAM2H,OAAO5C,GAASiD,EAAWH,SAAS9C,IAClD,IAGH,OAAOkD,EACLvI,EACA,CACE,mBACA,iBACA,sBACA,mBACA,uBACA,uBACA,iBACA,gBACA,cACA,yBACA,yBACA,WAEF7D,EACD,EAoBHmI,EAAQkE,uBZ1R8B,MY2RtClE,EAAQmE,uBZzR8B"}
+{"version":3,"file":"index.esm.js","sources":["../lib/constants.ts","../lib/helpers.ts","../lib/management/paths.ts","../lib/management/user.ts","../lib/management/tenant.ts","../lib/management/jwt.ts","../lib/management/permission.ts","../lib/management/role.ts","../lib/management/group.ts","../lib/management/sso.ts","../lib/management/accesskey.ts","../lib/fetch-polyfill.ts","../lib/index.ts","../lib/management/index.ts"],"sourcesContent":["// eslint-disable-next-line import/prefer-default-export\n/** Refresh JWT cookie name */\nexport const refreshTokenCookieName = 'DSR';\n/** Session JWT cookie name */\nexport const sessionTokenCookieName = 'DS';\n/** The key of the tenants claims in the claims map */\nexport const authorizedTenantsClaimName = 'tenants';\n/** The key of the permissions claims in the claims map either under tenant or top level */\nexport const permissionsClaimName = 'permissions';\n/** The key of the roles claims in the claims map either under tenant or top level */\nexport const rolesClaimName = 'roles';\n","import type { SdkFnWrapper } from '@descope/core-js-sdk';\nimport { authorizedTenantsClaimName, refreshTokenCookieName } from './constants';\nimport { AuthenticationInfo } from './types';\n\n/**\n * Generate a cookie string from given parameters\n * @param name name of the cookie\n * @param value value of cookie that must be already encoded\n * @param options any options to put on the cookie like cookieDomain, cookieMaxAge, cookiePath\n * @returns Cookie string with all options on the string\n */\nconst generateCookie = (name: string, value: string, options?: Record<string, string | number>) =>\n  `${name}=${value}; Domain=${options?.cookieDomain || ''}; Max-Age=${\n    options?.cookieMaxAge || ''\n  }; Path=${options?.cookiePath || '/'}; HttpOnly; SameSite=Strict`;\n\n/**\n * Parse the cookie string and return the value of the cookie\n * @param cookie the raw cookie string\n * @param name the name of the cookie to get value for\n * @returns the value of the given cookie\n */\nconst getCookieValue = (cookie: string | null | undefined, name: string) => {\n  const match = cookie?.match(RegExp(`(?:^|;\\\\s*)${name}=([^;]*)`));\n  return match ? match[1] : null;\n};\n\n// eslint-disable-next-line import/prefer-default-export\n/**\n * Add cookie generation to core-js functions.\n * @param fn the function we are wrapping\n * @returns Wrapped function with cookie generation\n */\nexport const withCookie: SdkFnWrapper<{ refreshJwt?: string; cookies?: string[] }> =\n  (fn) =>\n  async (...args) => {\n    const resp = await fn(...args);\n\n    // istanbul ignore next\n    if (!resp.data) {\n      return resp;\n    }\n\n    // eslint-disable-next-line prefer-const\n    let { refreshJwt, ...rest } = resp.data;\n    const cookies: string[] = [];\n\n    if (!refreshJwt) {\n      if (resp.response?.headers.get('set-cookie')) {\n        refreshJwt = getCookieValue(\n          resp.response?.headers.get('set-cookie'),\n          refreshTokenCookieName,\n        );\n        cookies.push(resp.response?.headers.get('set-cookie')!);\n      }\n    } else {\n      cookies.push(generateCookie(refreshTokenCookieName, refreshJwt, rest));\n    }\n\n    return { ...resp, data: { ...resp.data, refreshJwt, cookies } };\n  };\n\n/**\n * Get the claim (used for permissions or roles) for a given tenant or top level if tenant is empty\n * @param authInfo The parsed authentication info from the JWT\n * @param claim name of the claim\n * @param tenant tenant to retrieve the claim for\n * @returns\n */\nexport function getAuthorizationClaimItems(\n  authInfo: AuthenticationInfo,\n  claim: string,\n  tenant?: string,\n): string[] {\n  const value = tenant\n    ? authInfo.token[authorizedTenantsClaimName]?.[tenant]?.[claim]\n    : authInfo.token[claim];\n  return Array.isArray(value) ? value : [];\n}\n","/** API paths for the Descope service Management APIs */\nexport default {\n  user: {\n    create: '/v1/mgmt/user/create',\n    update: '/v1/mgmt/user/update',\n    delete: '/v1/mgmt/user/delete',\n    load: '/v1/mgmt/user',\n    search: '/v1/mgmt/user/search',\n    updateStatus: '/v1/mgmt/user/update/status',\n    updateEmail: '/v1/mgmt/user/update/email',\n    updatePhone: '/v1/mgmt/user/update/phone',\n    updateDisplayName: '/v1/mgmt/user/update/name',\n    addRole: '/v1/mgmt/user/update/role/add',\n    removeRole: '/v1/mgmt/user/update/role/remove',\n    addTenant: '/v1/mgmt/user/update/tenant/add',\n    removeTenant: '/v1/mgmt/user/update/tenant/remove',\n  },\n  accessKey: {\n    create: '/v1/mgmt/accesskey/create',\n    load: '/v1/mgmt/accesskey',\n    search: '/v1/mgmt/accesskey/search',\n    update: '/v1/mgmt/accesskey/update',\n    deactivate: '/v1/mgmt/accesskey/deactivate',\n    activate: '/v1/mgmt/accesskey/activate',\n    delete: '/v1/mgmt/accesskey/delete',\n  },\n  tenant: {\n    create: '/v1/mgmt/tenant/create',\n    update: '/v1/mgmt/tenant/update',\n    delete: '/v1/mgmt/tenant/delete',\n    loadAll: '/v1/mgmt/tenant/all',\n  },\n  sso: {\n    configure: '/v1/mgmt/sso/settings',\n    metadata: '/v1/mgmt/sso/metadata',\n    mapping: '/v1/mgmt/sso/mapping',\n  },\n  jwt: {\n    update: '/v1/mgmt/jwt/update',\n  },\n  permission: {\n    create: '/v1/mgmt/permission/create',\n    update: '/v1/mgmt/permission/update',\n    delete: '/v1/mgmt/permission/delete',\n    loadAll: '/v1/mgmt/permission/all',\n  },\n  role: {\n    create: '/v1/mgmt/role/create',\n    update: '/v1/mgmt/role/update',\n    delete: '/v1/mgmt/role/delete',\n    loadAll: '/v1/mgmt/role/all',\n  },\n  group: {\n    loadAllGroups: '/v1/mgmt/group/all',\n    loadAllGroupsForMember: '/v1/mgmt/group/member/all',\n    loadAllGroupMembers: '/v1/mgmt/group/members',\n  },\n};\n","import { SdkResponse, transformResponse, UserResponse } from '@descope/core-js-sdk';\nimport { CoreSdk } from '../types';\nimport apiPaths from './paths';\nimport { AssociatedTenant } from './types';\n\ntype SingleUserResponse = {\n  user: UserResponse;\n};\n\ntype MultipleUsersResponse = {\n  users: UserResponse[];\n};\n\nconst withUser = (sdk: CoreSdk, managementKey?: string) => ({\n  create: (\n    loginId: string,\n    email?: string,\n    phone?: string,\n    displayName?: string,\n    roles?: string[],\n    userTenants?: AssociatedTenant[],\n  ): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.create,\n        { loginId, email, phone, displayName, roleNames: roles, userTenants },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  invite: (\n    loginId: string,\n    email?: string,\n    phone?: string,\n    displayName?: string,\n    roles?: string[],\n    userTenants?: AssociatedTenant[],\n  ): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.create,\n        { loginId, email, phone, displayName, roleNames: roles, userTenants, invite: true },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  update: (\n    loginId: string,\n    email?: string,\n    phone?: string,\n    displayName?: string,\n    roles?: string[],\n    userTenants?: AssociatedTenant[],\n  ): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.update,\n        { loginId, email, phone, displayName, roleNames: roles, userTenants },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  delete: (loginId: string): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(apiPaths.user.delete, { loginId }, { token: managementKey }),\n    ),\n  load: (loginId: string): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.get(apiPaths.user.load, {\n        queryParams: { loginId },\n        token: managementKey,\n      }),\n      (data) => data.user,\n    ),\n  /**\n   * Load an existing user by user ID. The ID can be found\n   * on the user's JWT.\n   * @param userId load a user by this user ID field\n   * @returns The UserResponse if found, throws otherwise.\n   */\n  loadByUserId: (userId: string): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.get(apiPaths.user.load, {\n        queryParams: { userId },\n        token: managementKey,\n      }),\n      (data) => data.user,\n    ),\n  /**\n   * Search all users. Results can be filtered according to tenants and/or\n   * roles, and also paginated used the limit and page parameters.\n   * @param tenantIds optional list of tenant IDs to filter by\n   * @param roles optional list of roles to filter by\n   * @param limit optionally limit the response, leave out for default limit\n   * @param page optionally paginate over the response\n   * @returns An array of UserResponse found by the query\n   */\n  searchAll: (\n    tenantIds?: string[],\n    roles?: string[],\n    limit?: number,\n    page?: number,\n  ): Promise<SdkResponse<UserResponse[]>> =>\n    transformResponse<MultipleUsersResponse, UserResponse[]>(\n      sdk.httpClient.post(\n        apiPaths.user.search,\n        { tenantIds, roleNames: roles, limit, page },\n        { token: managementKey },\n      ),\n      (data) => data.users,\n    ),\n  activate: (loginId: string): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.updateStatus,\n        { loginId, status: 'enabled' },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  deactivate: (loginId: string): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.updateStatus,\n        { loginId, status: 'disabled' },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  updateEmail: (\n    loginId: string,\n    email: string,\n    isVerified: boolean,\n  ): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.updateEmail,\n        { loginId, email, verified: isVerified },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  updatePhone: (\n    loginId: string,\n    phone: string,\n    isVerified: boolean,\n  ): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.updatePhone,\n        { loginId, phone, verified: isVerified },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  updateDisplayName: (loginId: string, displayName: string): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.updateDisplayName,\n        { loginId, displayName },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  addRoles: (loginId: string, roles: string[]): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.addRole,\n        { loginId, roleNames: roles },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  removeRoles: (loginId: string, roles: string[]): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.removeRole,\n        { loginId, roleNames: roles },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  addTenant: (loginId: string, tenantId: string): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(apiPaths.user.addTenant, { loginId, tenantId }, { token: managementKey }),\n      (data) => data.user,\n    ),\n  removeTenant: (loginId: string, tenantId: string): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.removeTenant,\n        { loginId, tenantId },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  addTenantRoles: (\n    loginId: string,\n    tenantId: string,\n    roles: string[],\n  ): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.addRole,\n        { loginId, tenantId, roleNames: roles },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  removeTenantRoles: (\n    loginId: string,\n    tenantId: string,\n    roles: string[],\n  ): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.removeRole,\n        { loginId, tenantId, roleNames: roles },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n});\n\nexport default withUser;\n","import { SdkResponse, transformResponse } from '@descope/core-js-sdk';\nimport { CoreSdk } from '../types';\nimport apiPaths from './paths';\nimport { CreateTenantResponse, Tenant } from './types';\n\ntype MultipleTenantResponse = {\n  tenants: Tenant[];\n};\n\nconst withTenant = (sdk: CoreSdk, managementKey?: string) => ({\n  create: (\n    name: string,\n    selfProvisioningDomains?: string[],\n  ): Promise<SdkResponse<CreateTenantResponse>> =>\n    transformResponse(\n      sdk.httpClient.post(\n        apiPaths.tenant.create,\n        { name, selfProvisioningDomains },\n        { token: managementKey },\n      ),\n    ),\n  createWithId: (\n    id: string,\n    name: string,\n    selfProvisioningDomains?: string[],\n  ): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(\n        apiPaths.tenant.create,\n        { id, name, selfProvisioningDomains },\n        { token: managementKey },\n      ),\n    ),\n  update: (\n    id: string,\n    name: string,\n    selfProvisioningDomains?: string[],\n  ): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(\n        apiPaths.tenant.update,\n        { id, name, selfProvisioningDomains },\n        { token: managementKey },\n      ),\n    ),\n  delete: (id: string): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(apiPaths.tenant.delete, { id }, { token: managementKey }),\n    ),\n  loadAll: (): Promise<SdkResponse<Tenant[]>> =>\n    transformResponse<MultipleTenantResponse, Tenant[]>(\n      sdk.httpClient.get(apiPaths.tenant.loadAll, {\n        token: managementKey,\n      }),\n      (data) => data.tenants,\n    ),\n});\n\nexport default withTenant;\n","import { SdkResponse, transformResponse } from '@descope/core-js-sdk';\nimport { CoreSdk } from '../types';\nimport apiPaths from './paths';\nimport { UpdateJWTResponse } from './types';\n\nconst withJWT = (sdk: CoreSdk, managementKey?: string) => ({\n  update: (\n    jwt: string,\n    customClaims?: Record<string, any>,\n  ): Promise<SdkResponse<UpdateJWTResponse>> =>\n    transformResponse(\n      sdk.httpClient.post(apiPaths.jwt.update, { jwt, customClaims }, { token: managementKey }),\n    ),\n});\n\nexport default withJWT;\n","import { SdkResponse, transformResponse } from '@descope/core-js-sdk';\nimport { CoreSdk } from '../types';\nimport apiPaths from './paths';\nimport { Permission } from './types';\n\ntype MultiplePermissionResponse = {\n  permissions: Permission[];\n};\n\nconst withPermission = (sdk: CoreSdk, managementKey?: string) => ({\n  create: (name: string, description?: string): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(\n        apiPaths.permission.create,\n        { name, description },\n        { token: managementKey },\n      ),\n    ),\n  update: (name: string, newName: string, description?: string): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(\n        apiPaths.permission.update,\n        { name, newName, description },\n        { token: managementKey },\n      ),\n    ),\n  delete: (name: string): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(apiPaths.permission.delete, { name }, { token: managementKey }),\n    ),\n  loadAll: (): Promise<SdkResponse<Permission[]>> =>\n    transformResponse<MultiplePermissionResponse, Permission[]>(\n      sdk.httpClient.get(apiPaths.permission.loadAll, {\n        token: managementKey,\n      }),\n      (data) => data.permissions,\n    ),\n});\n\nexport default withPermission;\n","import { SdkResponse, transformResponse } from '@descope/core-js-sdk';\nimport { CoreSdk } from '../types';\nimport apiPaths from './paths';\nimport { Role } from './types';\n\ntype MultipleRoleResponse = {\n  roles: Role[];\n};\n\nconst withRole = (sdk: CoreSdk, managementKey?: string) => ({\n  create: (\n    name: string,\n    description?: string,\n    permissionNames?: string[],\n  ): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(\n        apiPaths.role.create,\n        { name, description, permissionNames },\n        { token: managementKey },\n      ),\n    ),\n  update: (\n    name: string,\n    newName: string,\n    description?: string,\n    permissionNames?: string[],\n  ): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(\n        apiPaths.role.update,\n        { name, newName, description, permissionNames },\n        { token: managementKey },\n      ),\n    ),\n  delete: (name: string): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(apiPaths.role.delete, { name }, { token: managementKey }),\n    ),\n  loadAll: (): Promise<SdkResponse<Role[]>> =>\n    transformResponse<MultipleRoleResponse, Role[]>(\n      sdk.httpClient.get(apiPaths.role.loadAll, {\n        token: managementKey,\n      }),\n      (data) => data.roles,\n    ),\n});\n\nexport default withRole;\n","import { SdkResponse, transformResponse } from '@descope/core-js-sdk';\nimport { CoreSdk } from '../types';\nimport apiPaths from './paths';\nimport { Group } from './types';\n\nconst withGroup = (sdk: CoreSdk, managementKey?: string) => ({\n  /**\n   * Load all groups for a specific tenant id.\n   * @param tenantId Tenant ID to load groups from.\n   * @returns Group[] list of groups\n   */\n  loadAllGroups: (tenantId: string): Promise<SdkResponse<Group[]>> =>\n    transformResponse<Group[]>(\n      sdk.httpClient.post(apiPaths.group.loadAllGroups, { tenantId }, { token: managementKey }),\n    ),\n\n  /**\n   * Load all groups for the provided user IDs or login IDs.\n   * @param tenantId Tenant ID to load groups from.\n   * @param userIds Optional List of user IDs, with the format of \"U2J5ES9S8TkvCgOvcrkpzUgVTEBM\" (example), which can be found on the user's JWT.\n   * @param loginIds Optional List of login IDs, how the user identifies when logging in.\n   * @returns Group[] list of groups\n   */\n  loadAllGroupsForMember: (\n    tenantId: string,\n    userIds: string[],\n    loginIds: string[],\n  ): Promise<SdkResponse<Group[]>> =>\n    transformResponse<Group[]>(\n      sdk.httpClient.post(\n        apiPaths.group.loadAllGroupsForMember,\n        { tenantId, loginIds, userIds },\n        { token: managementKey },\n      ),\n    ),\n\n  /**\n   * Load all members of the provided group id.\n   * @param tenantId Tenant ID to load groups from.\n   * @param groupId Group ID to load members for.\n   * @returns Group[] list of groups\n   */\n  loadAllGroupMembers: (tenantId: string, groupId: string): Promise<SdkResponse<Group[]>> =>\n    transformResponse<Group[]>(\n      sdk.httpClient.post(\n        apiPaths.group.loadAllGroupMembers,\n        { tenantId, groupId },\n        { token: managementKey },\n      ),\n    ),\n});\n\nexport default withGroup;\n","import { SdkResponse, transformResponse } from '@descope/core-js-sdk';\nimport { CoreSdk } from '../types';\nimport apiPaths from './paths';\nimport { RoleMapping, AttributeMapping } from './types';\n\nconst withSSOSettings = (sdk: CoreSdk, managementKey?: string) => ({\n  configureSettings: (\n    tenantId: string,\n    idpURL: string,\n    idpCert: string,\n    entityId: string,\n    redirectURL?: string,\n    domain?: string,\n  ): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(\n        apiPaths.sso.configure,\n        { tenantId, idpURL, entityId, idpCert, redirectURL, domain },\n        { token: managementKey },\n      ),\n    ),\n  configureMetadata: (tenantId: string, idpMetadataURL: string): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(\n        apiPaths.sso.metadata,\n        { tenantId, idpMetadataURL },\n        { token: managementKey },\n      ),\n    ),\n  configureMapping: (\n    tenantId: string,\n    roleMapping?: RoleMapping,\n    attributeMapping?: AttributeMapping,\n  ): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(\n        apiPaths.sso.mapping,\n        { tenantId, roleMapping, attributeMapping },\n        { token: managementKey },\n      ),\n    ),\n});\n\nexport default withSSOSettings;\n","import { SdkResponse, transformResponse } from '@descope/core-js-sdk';\nimport { CoreSdk } from '../types';\nimport apiPaths from './paths';\nimport { AccessKey, AssociatedTenant, CreatedAccessKeyResponse } from './types';\n\ntype SingleKeyResponse = {\n  key: AccessKey;\n};\n\ntype MultipleKeysResponse = {\n  keys: AccessKey[];\n};\n\nconst withAccessKey = (sdk: CoreSdk, managementKey?: string) => ({\n  /**\n   * Create a new access key for a project.\n   * @param name Access key name\n   * @param expireTime When the access key expires. Keep at 0 to make it indefinite.\n   * @param roles Optional roles in the project. Does not apply for multi-tenants\n   * @param keyTenants Optional associated tenants for this key and its roles for each.\n   * @returns A newly created key and its cleartext. Make sure to save the cleartext securely.\n   */\n  create: (\n    name: string,\n    expireTime: number,\n    roles?: string[],\n    keyTenants?: AssociatedTenant[],\n  ): Promise<SdkResponse<CreatedAccessKeyResponse>> =>\n    transformResponse(\n      sdk.httpClient.post(\n        apiPaths.accessKey.create,\n        { name, expireTime, roleNames: roles, keyTenants },\n        { token: managementKey },\n      ),\n    ),\n  /**\n   * Load an access key.\n   * @param id Access key ID to load\n   * @returns The loaded access key.\n   */\n  load: (id: string): Promise<SdkResponse<AccessKey>> =>\n    transformResponse<SingleKeyResponse, AccessKey>(\n      sdk.httpClient.get(apiPaths.accessKey.load, {\n        queryParams: { id },\n        token: managementKey,\n      }),\n      (data) => data.key,\n    ),\n  /**\n   * Search all access keys\n   * @param tenantIds Optional tenant ID filter to apply on the search results\n   * @returns An array of found access keys\n   */\n  searchAll: (tenantIds?: string[]): Promise<SdkResponse<AccessKey[]>> =>\n    transformResponse<MultipleKeysResponse, AccessKey[]>(\n      sdk.httpClient.post(apiPaths.accessKey.search, { tenantIds }, { token: managementKey }),\n      (data) => data.keys,\n    ),\n  /**\n   * Update an access key.\n   * @param id Access key ID to load\n   * @param name The updated access key name\n   * @returns The updated access key\n   */\n  update: (id: string, name: string): Promise<SdkResponse<AccessKey>> =>\n    transformResponse<SingleKeyResponse, AccessKey>(\n      sdk.httpClient.post(apiPaths.accessKey.update, { id, name }, { token: managementKey }),\n      (data) => data.key,\n    ),\n  /**\n   * Deactivate an access key. Deactivated access keys cannot be used until they are\n   * activated again.\n   * @param id Access key ID to deactivate\n   */\n  deactivate: (id: string): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(apiPaths.accessKey.deactivate, { id }, { token: managementKey }),\n    ),\n  /**\n   * Activate an access key. Only deactivated access keys can be activated again.\n   * @param id Access key ID to activate\n   */\n  activate: (id: string): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(apiPaths.accessKey.activate, { id }, { token: managementKey }),\n    ),\n  /**\n   * Delete an access key. IMPORTANT: This cannot be undone. Use carefully.\n   * @param id Access key ID to delete\n   */\n  delete: (id: string): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(apiPaths.accessKey.delete, { id }, { token: managementKey }),\n    ),\n});\n\nexport default withAccessKey;\n","import nodeFetch, { Headers } from 'node-fetch-commonjs';\n\nglobalThis.Headers ??= Headers;\n\nconst highWaterMarkMb = 1024 * 1024 * 1024 * 30; // 30MB\n\n// we are increasing the response buffer size due to an issue where node-fetch hangs when response is too big\nconst patchedFetch = (...args: Parameters<typeof nodeFetch>) => {\n  // we can get Request on the first arg, or RequestInfo on the second arg\n  // we want to make sure we are setting the \"highWaterMark\" so we are doing it on both args\n  args.forEach((arg) => {\n    // eslint-disable-next-line no-param-reassign, @typescript-eslint/no-unused-expressions\n    arg && ((arg as any).highWaterMark ??= highWaterMarkMb);\n  });\n\n  return nodeFetch(...args);\n};\n\nexport default patchedFetch as unknown as typeof fetch;\n","import createSdk, { ExchangeAccessKeyResponse, SdkResponse, wrapWith } from '@descope/core-js-sdk';\nimport { JWK, JWTHeaderParameters, KeyLike, errors, importJWK, jwtVerify } from 'jose';\nimport {\n  permissionsClaimName,\n  refreshTokenCookieName,\n  rolesClaimName,\n  sessionTokenCookieName,\n} from './constants';\nimport { getAuthorizationClaimItems, withCookie } from './helpers';\nimport withManagement from './management';\nimport { AuthenticationInfo } from './types';\nimport fetch from './fetch-polyfill';\n\ndeclare const BUILD_VERSION: string;\n\n/** Configuration arguments which include the Descope core SDK args and an optional management key */\ntype NodeSdkArgs = Parameters<typeof createSdk>[0] & {\n  managementKey?: string;\n};\n\nconst nodeSdk = ({ managementKey, ...config }: NodeSdkArgs) => {\n  const coreSdk = createSdk({\n    ...config,\n    fetch,\n    baseHeaders: {\n      ...config.baseHeaders,\n      'x-descope-sdk-name': 'nodejs',\n      'x-descope-sdk-node-version': process?.versions?.node || '',\n      'x-descope-sdk-version': BUILD_VERSION,\n    },\n  });\n\n  const { projectId, logger } = config;\n\n  const keys: Record<string, KeyLike | Uint8Array> = {};\n\n  /** Fetch the public keys (JWKs) from Descope for the configured project */\n  const fetchKeys = async () => {\n    const keysWrapper = await coreSdk.httpClient\n      .get(`v2/keys/${projectId}`)\n      .then((resp) => resp.json());\n    const publicKeys: JWK[] = keysWrapper.keys;\n    if (!Array.isArray(publicKeys)) return {};\n    const kidJwksPairs = await Promise.all(\n      publicKeys.map(async (key) => [key.kid, await importJWK(key)]),\n    );\n\n    return kidJwksPairs.reduce(\n      (acc, [kid, jwk]) => (kid ? { ...acc, [kid.toString()]: jwk } : acc),\n      {},\n    );\n  };\n\n  const management = withManagement(coreSdk, managementKey);\n\n  const sdk = {\n    ...coreSdk,\n\n    /**\n     * Provides various APIs for managing a Descope project programmatically. A management key must\n     * be provided as an argument when initializing the SDK to use these APIs. Management keys can be\n     * generated in the Descope console.\n     */\n    management,\n\n    /** Get the key that can validate the given JWT KID in the header. Can retrieve the public key from local cache or from Descope. */\n    async getKey(header: JWTHeaderParameters): Promise<KeyLike | Uint8Array> {\n      if (!header?.kid) throw Error('header.kid must not be empty');\n\n      if (keys[header.kid]) return keys[header.kid];\n\n      // do we need to fetch once or every time?\n      Object.assign(keys, await fetchKeys());\n\n      if (!keys[header.kid]) throw Error('failed to fetch matching key');\n\n      return keys[header.kid];\n    },\n\n    /**\n     * Validate the given JWT with the right key and make sure the issuer is correct\n     * @param jwt the JWT string to parse and validate\n     * @returns AuthenticationInfo with the parsed token and JWT. Will throw an error if validation fails.\n     */\n    async validateJwt(jwt: string): Promise<AuthenticationInfo> {\n      // Do not hard-code the algo because library does not support `None` so all are valid\n      const res = await jwtVerify(jwt, sdk.getKey, { clockTolerance: 5 });\n      const token = res.payload;\n\n      if (token) {\n        token.iss = token.iss?.split('/').pop(); // support both url and project id as issuer\n        if (token.iss !== projectId) {\n          // We must do the verification here, since issuer can be either project ID or URL\n          throw new errors.JWTClaimValidationFailed(\n            'unexpected \"iss\" claim value',\n            'iss',\n            'check_failed',\n          );\n        }\n      }\n\n      return { jwt, token };\n    },\n\n    /**\n     * Validate an active session\n     * @param sessionToken session JWT to validate\n     * @returns AuthenticationInfo promise or throws Error if there is an issue with JWTs\n     */\n    async validateSession(sessionToken: string): Promise<AuthenticationInfo> {\n      if (!sessionToken) throw Error('session token is required for validation');\n\n      try {\n        const token = await sdk.validateJwt(sessionToken);\n        return token;\n      } catch (error) {\n        /* istanbul ignore next */\n        logger?.error('session validation failed', error);\n        throw Error('session validation failed');\n      }\n    },\n\n    /**\n     * Refresh the session using a refresh token\n     * @param refreshToken refresh JWT to refresh the session with\n     * @returns AuthenticationInfo promise or throws Error if there is an issue with JWTs\n     */\n    async refreshSession(refreshToken: string): Promise<AuthenticationInfo> {\n      if (!refreshToken) throw Error('refresh token is required to refresh a session');\n\n      try {\n        await sdk.validateJwt(refreshToken);\n        const jwtResp = await sdk.refresh(refreshToken);\n        if (jwtResp.ok) {\n          const token = await sdk.validateJwt(jwtResp.data?.sessionJwt);\n          return token;\n        }\n        /* istanbul ignore next */\n        throw Error(jwtResp.error?.errorMessage);\n      } catch (refreshTokenErr) {\n        /* istanbul ignore next */\n        logger?.error('refresh token validation failed', refreshTokenErr);\n        throw Error('refresh token validation failed');\n      }\n    },\n\n    /**\n     * Validate session and refresh it if it expired\n     * @param sessionToken session JWT\n     * @param refreshToken refresh JWT\n     * @returns AuthenticationInfo promise or throws Error if there is an issue with JWTs\n     */\n    async validateAndRefreshSession(\n      sessionToken?: string,\n      refreshToken?: string,\n    ): Promise<AuthenticationInfo> {\n      if (!sessionToken && !refreshToken) throw Error('both session and refresh tokens are empty');\n\n      try {\n        const token = await sdk.validateSession(sessionToken);\n        return token;\n      } catch (error) {\n        /* istanbul ignore next */\n        logger?.log('session validation failed - trying to refresh it');\n      }\n\n      return sdk.refreshSession(refreshToken);\n    },\n\n    /**\n     * Exchange API key (access key) for a session key\n     * @param accessKey access key to exchange for a session JWT\n     * @returns AuthneticationInfo with session JWT data\n     */\n    async exchangeAccessKey(accessKey: string): Promise<AuthenticationInfo> {\n      if (!accessKey) throw Error('access key must not be empty');\n\n      let resp: SdkResponse<ExchangeAccessKeyResponse>;\n      try {\n        resp = await sdk.accessKey.exchange(accessKey);\n      } catch (error) {\n        logger?.error('failed to exchange access key', error);\n        throw Error('could not exchange access key');\n      }\n\n      const { sessionJwt } = resp.data;\n      if (!sessionJwt) {\n        logger?.error('failed to parse exchange access key response');\n        throw Error('could not exchange access key');\n      }\n\n      try {\n        const token = await sdk.validateJwt(sessionJwt);\n        return token;\n      } catch (error) {\n        logger?.error('failed to parse jwt from access key', error);\n        throw Error('could not exchange access key');\n      }\n    },\n\n    /**\n     * Make sure that all given permissions exist on the parsed JWT top level claims\n     * @param authInfo JWT parsed info\n     * @param permissions list of permissions to make sure they exist on te JWT claims\n     * @returns true if all permissions exist, false otherwise\n     */\n    validatePermissions(authInfo: AuthenticationInfo, permissions: string[]): boolean {\n      return sdk.validateTenantPermissions(authInfo, null, permissions);\n    },\n\n    /**\n     * Make sure that all given permissions exist on the parsed JWT tenant claims\n     * @param authInfo JWT parsed info\n     * @param permissions list of permissions to make sure they exist on te JWT claims\n     * @returns true if all permissions exist, false otherwise\n     */\n    validateTenantPermissions(\n      authInfo: AuthenticationInfo,\n      tenant: string,\n      permissions: string[],\n    ): boolean {\n      const granted = getAuthorizationClaimItems(authInfo, permissionsClaimName, tenant);\n      return permissions.every((perm) => granted.includes(perm));\n    },\n\n    /**\n     * Make sure that all given roles exist on the parsed JWT top level claims\n     * @param authInfo JWT parsed info\n     * @param roles list of roles to make sure they exist on te JWT claims\n     * @returns true if all roles exist, false otherwise\n     */\n    validateRoles(authInfo: AuthenticationInfo, roles: string[]): boolean {\n      return sdk.validateTenantRoles(authInfo, null, roles);\n    },\n\n    /**\n     * Make sure that all given roles exist on the parsed JWT tenant claims\n     * @param authInfo JWT parsed info\n     * @param roles list of roles to make sure they exist on te JWT claims\n     * @returns true if all roles exist, false otherwise\n     */\n    validateTenantRoles(authInfo: AuthenticationInfo, tenant: string, roles: string[]): boolean {\n      const membership = getAuthorizationClaimItems(authInfo, rolesClaimName, tenant);\n      return roles.every((role) => membership.includes(role));\n    },\n  };\n\n  return wrapWith(\n    sdk,\n    [\n      'otp.verify.email',\n      'otp.verify.sms',\n      'otp.verify.whatsapp',\n      'magicLink.verify',\n      'enchantedLink.signUp',\n      'enchantedLink.signIn',\n      'oauth.exchange',\n      'saml.exchange',\n      'totp.verify',\n      'webauthn.signIn.finish',\n      'webauthn.signUp.finish',\n      'refresh',\n    ] as const,\n    withCookie,\n  );\n};\n\n/** Descope SDK client with delivery methods enum.\n *\n * Please see full documentation at {@link https://docs.descope.com/guides Descope Docs}\n * @example Usage\n *\n * ```js\n * import descopeSdk from '@descope/node-sdk';\n *\n * const myProjectId = 'xxx';\n * const sdk = descopeSdk({ projectId: myProjectId });\n *\n * const userLoginId = 'loginId';\n * sdk.otp.signIn.email(userLoginId);\n * const jwtResponse = sdk.otp.verify.email(userLoginId, codeFromEmail);\n * ```\n */\n\nnodeSdk.RefreshTokenCookieName = refreshTokenCookieName;\nnodeSdk.SessionTokenCookieName = sessionTokenCookieName;\n\nexport default nodeSdk;\nexport type { DeliveryMethod, OAuthProvider } from '@descope/core-js-sdk';\n","import { CoreSdk } from '../types';\nimport withUser from './user';\nimport withTenant from './tenant';\nimport withJWT from './jwt';\nimport withPermission from './permission';\nimport withRole from './role';\nimport withGroup from './group';\nimport withSSOSettings from './sso';\nimport withAccessKey from './accesskey';\n\n/** Constructs a higher level Management API that wraps the functions from code-js-sdk */\nconst withManagement = (sdk: CoreSdk, managementKey?: string) => ({\n  user: withUser(sdk, managementKey),\n  accessKey: withAccessKey(sdk, managementKey),\n  tenant: withTenant(sdk, managementKey),\n  sso: withSSOSettings(sdk, managementKey),\n  jwt: withJWT(sdk, managementKey),\n  permission: withPermission(sdk, managementKey),\n  role: withRole(sdk, managementKey),\n  group: withGroup(sdk, managementKey),\n});\n\nexport default withManagement;\n"],"names":["withCookie","fn","async","args","resp","data","_d","refreshJwt","rest","__rest","cookies","options","push","cookieDomain","cookieMaxAge","cookiePath","_a","response","headers","get","cookie","name","match","RegExp","getCookieValue","_b","_c","Object","assign","getAuthorizationClaimItems","authInfo","claim","tenant","value","token","Array","isArray","apiPaths","create","update","delete","load","search","updateStatus","updateEmail","updatePhone","updateDisplayName","addRole","removeRole","addTenant","removeTenant","deactivate","activate","loadAll","configure","metadata","mapping","loadAllGroups","loadAllGroupsForMember","loadAllGroupMembers","withUser","sdk","managementKey","loginId","email","phone","displayName","roles","userTenants","transformResponse","httpClient","post","roleNames","user","invite","queryParams","loadByUserId","userId","searchAll","tenantIds","limit","page","users","status","isVerified","verified","addRoles","removeRoles","tenantId","addTenantRoles","removeTenantRoles","withTenant","selfProvisioningDomains","createWithId","id","tenants","withJWT","jwt","customClaims","withPermission","description","newName","permissions","withRole","permissionNames","withGroup","userIds","loginIds","groupId","withSSOSettings","configureSettings","idpURL","idpCert","entityId","redirectURL","domain","configureMetadata","idpMetadataURL","configureMapping","roleMapping","attributeMapping","withAccessKey","expireTime","keyTenants","key","keys","globalThis","Headers","patchedFetch","forEach","arg","highWaterMark","nodeFetch","nodeSdk","config","coreSdk","createSdk","fetch","baseHeaders","process","versions","node","projectId","logger","management","accessKey","sso","permission","role","group","withManagement","header","kid","Error","publicKeys","then","json","Promise","all","map","importJWK","reduce","acc","jwk","toString","fetchKeys","jwtVerify","getKey","clockTolerance","payload","iss","split","pop","errors","JWTClaimValidationFailed","sessionToken","validateJwt","error","refreshToken","jwtResp","refresh","ok","sessionJwt","errorMessage","refreshTokenErr","validateSession","log","refreshSession","exchange","validatePermissions","validateTenantPermissions","granted","every","perm","includes","validateRoles","validateTenantRoles","membership","wrapWith","RefreshTokenCookieName","SessionTokenCookieName"],"mappings":"sNAEO,MC+BMA,EACVC,GACDC,SAAUC,eACR,MAAMC,QAAaH,KAAME,GAGzB,IAAKC,EAAKC,KACR,OAAOD,EAIT,IAAIE,EAA0BF,EAAKC,MAA/BE,WAAEA,GAAUD,EAAKE,EAAjBC,EAAAH,EAAA,CAAA,eACJ,MAAMI,EAAoB,GAlCP,IAA8BC,EAgDjD,OAZKJ,EASHG,EAAQE,KA5CZ,GDVoC,SCsDoBL,cA5C5BI,OADuBA,EA6CiBH,QA5CxC,EAAAG,EAASE,eAAgB,gBACnDF,aAAA,EAAAA,EAASG,eAAgB,aACjBH,aAAA,EAAAA,EAASI,aAAc,mCAkCZ,QAAbC,EAAAZ,EAAKa,gBAAQ,IAAAD,OAAA,EAAAA,EAAEE,QAAQC,IAAI,iBAC7BZ,EA3Be,EAACa,EAAmCC,KACzD,MAAMC,EAAQF,eAAAA,EAAQE,MAAMC,OAAO,cAAcF,cACjD,OAAOC,EAAQA,EAAM,GAAK,IAAI,EAyBXE,CACE,QAAbC,EAAArB,EAAKa,gBAAQ,IAAAQ,OAAA,EAAAA,EAAEP,QAAQC,IAAI,cDhDC,OCmD9BT,EAAQE,KAAoB,QAAfc,EAAAtB,EAAKa,gBAAU,IAAAS,OAAA,EAAAA,EAAAR,QAAQC,IAAI,gBAMhCQ,OAAAC,OAAAD,OAAAC,OAAA,CAAA,EAAAxB,GAAM,CAAAC,KAAWsB,OAAAC,OAAAD,OAAAC,OAAA,GAAAxB,EAAKC,MAAM,CAAAE,aAAYG,aAAY,WAUpDmB,EACdC,EACAC,EACAC,WAEA,MAAMC,EAAQD,EAC0C,QAApDP,EAA6C,QAA7CT,EAAAc,EAASI,MAAgC,eAAI,IAAAlB,OAAA,EAAAA,EAAAgB,UAAO,IAAAP,OAAA,EAAAA,EAAGM,GACvDD,EAASI,MAAMH,GACnB,OAAOI,MAAMC,QAAQH,GAASA,EAAQ,EACxC,CC7EA,IAAeI,EACP,CACJC,OAAQ,uBACRC,OAAQ,uBACRC,OAAQ,uBACRC,KAAM,gBACNC,OAAQ,uBACRC,aAAc,8BACdC,YAAa,6BACbC,YAAa,6BACbC,kBAAmB,4BACnBC,QAAS,gCACTC,WAAY,mCACZC,UAAW,kCACXC,aAAc,sCAdHb,EAgBF,CACTC,OAAQ,4BACRG,KAAM,qBACNC,OAAQ,4BACRH,OAAQ,4BACRY,WAAY,gCACZC,SAAU,8BACVZ,OAAQ,6BAvBGH,EAyBL,CACNC,OAAQ,yBACRC,OAAQ,yBACRC,OAAQ,yBACRa,QAAS,uBA7BEhB,EA+BR,CACHiB,UAAW,wBACXC,SAAU,wBACVC,QAAS,wBAlCEnB,EAoCR,CACHE,OAAQ,uBArCGF,EAuCD,CACVC,OAAQ,6BACRC,OAAQ,6BACRC,OAAQ,6BACRa,QAAS,2BA3CEhB,EA6CP,CACJC,OAAQ,uBACRC,OAAQ,uBACRC,OAAQ,uBACRa,QAAS,qBAjDEhB,EAmDN,CACLoB,cAAe,qBACfC,uBAAwB,4BACxBC,oBAAqB,0BC1CzB,MAAMC,EAAW,CAACC,EAAcC,KAA4B,CAC1DxB,OAAQ,CACNyB,EACAC,EACAC,EACAC,EACAC,EACAC,IAEAC,EACER,EAAIS,WAAWC,KACblC,EAAcC,OACd,CAAEyB,UAASC,QAAOC,QAAOC,cAAaM,UAAWL,EAAOC,eACxD,CAAElC,MAAO4B,KAEVzD,GAASA,EAAKoE,OAEnBC,OAAQ,CACNX,EACAC,EACAC,EACAC,EACAC,EACAC,IAEAC,EACER,EAAIS,WAAWC,KACblC,EAAcC,OACd,CAAEyB,UAASC,QAAOC,QAAOC,cAAaM,UAAWL,EAAOC,cAAaM,QAAQ,GAC7E,CAAExC,MAAO4B,KAEVzD,GAASA,EAAKoE,OAEnBlC,OAAQ,CACNwB,EACAC,EACAC,EACAC,EACAC,EACAC,IAEAC,EACER,EAAIS,WAAWC,KACblC,EAAcE,OACd,CAAEwB,UAASC,QAAOC,QAAOC,cAAaM,UAAWL,EAAOC,eACxD,CAAElC,MAAO4B,KAEVzD,GAASA,EAAKoE,OAEnBjC,OAASuB,GACPM,EACER,EAAIS,WAAWC,KAAKlC,EAAcG,OAAQ,CAAEuB,WAAW,CAAE7B,MAAO4B,KAEpErB,KAAOsB,GACLM,EACER,EAAIS,WAAWnD,IAAIkB,EAAcI,KAAM,CACrCkC,YAAa,CAAEZ,WACf7B,MAAO4B,KAERzD,GAASA,EAAKoE,OAQnBG,aAAeC,GACbR,EACER,EAAIS,WAAWnD,IAAIkB,EAAcI,KAAM,CACrCkC,YAAa,CAAEE,UACf3C,MAAO4B,KAERzD,GAASA,EAAKoE,OAWnBK,UAAW,CACTC,EACAZ,EACAa,EACAC,IAEAZ,EACER,EAAIS,WAAWC,KACblC,EAAcK,OACd,CAAEqC,YAAWP,UAAWL,EAAOa,QAAOC,QACtC,CAAE/C,MAAO4B,KAEVzD,GAASA,EAAK6E,QAEnB9B,SAAWW,GACTM,EACER,EAAIS,WAAWC,KACblC,EAAcM,aACd,CAAEoB,UAASoB,OAAQ,WACnB,CAAEjD,MAAO4B,KAEVzD,GAASA,EAAKoE,OAEnBtB,WAAaY,GACXM,EACER,EAAIS,WAAWC,KACblC,EAAcM,aACd,CAAEoB,UAASoB,OAAQ,YACnB,CAAEjD,MAAO4B,KAEVzD,GAASA,EAAKoE,OAEnB7B,YAAa,CACXmB,EACAC,EACAoB,IAEAf,EACER,EAAIS,WAAWC,KACblC,EAAcO,YACd,CAAEmB,UAASC,QAAOqB,SAAUD,GAC5B,CAAElD,MAAO4B,KAEVzD,GAASA,EAAKoE,OAEnB5B,YAAa,CACXkB,EACAE,EACAmB,IAEAf,EACER,EAAIS,WAAWC,KACblC,EAAcQ,YACd,CAAEkB,UAASE,QAAOoB,SAAUD,GAC5B,CAAElD,MAAO4B,KAEVzD,GAASA,EAAKoE,OAEnB3B,kBAAmB,CAACiB,EAAiBG,IACnCG,EACER,EAAIS,WAAWC,KACblC,EAAcS,kBACd,CAAEiB,UAASG,eACX,CAAEhC,MAAO4B,KAEVzD,GAASA,EAAKoE,OAEnBa,SAAU,CAACvB,EAAiBI,IAC1BE,EACER,EAAIS,WAAWC,KACblC,EAAcU,QACd,CAAEgB,UAASS,UAAWL,GACtB,CAAEjC,MAAO4B,KAEVzD,GAASA,EAAKoE,OAEnBc,YAAa,CAACxB,EAAiBI,IAC7BE,EACER,EAAIS,WAAWC,KACblC,EAAcW,WACd,CAAEe,UAASS,UAAWL,GACtB,CAAEjC,MAAO4B,KAEVzD,GAASA,EAAKoE,OAEnBxB,UAAW,CAACc,EAAiByB,IAC3BnB,EACER,EAAIS,WAAWC,KAAKlC,EAAcY,UAAW,CAAEc,UAASyB,YAAY,CAAEtD,MAAO4B,KAC5EzD,GAASA,EAAKoE,OAEnBvB,aAAc,CAACa,EAAiByB,IAC9BnB,EACER,EAAIS,WAAWC,KACblC,EAAca,aACd,CAAEa,UAASyB,YACX,CAAEtD,MAAO4B,KAEVzD,GAASA,EAAKoE,OAEnBgB,eAAgB,CACd1B,EACAyB,EACArB,IAEAE,EACER,EAAIS,WAAWC,KACblC,EAAcU,QACd,CAAEgB,UAASyB,WAAUhB,UAAWL,GAChC,CAAEjC,MAAO4B,KAEVzD,GAASA,EAAKoE,OAEnBiB,kBAAmB,CACjB3B,EACAyB,EACArB,IAEAE,EACER,EAAIS,WAAWC,KACblC,EAAcW,WACd,CAAEe,UAASyB,WAAUhB,UAAWL,GAChC,CAAEjC,MAAO4B,KAEVzD,GAASA,EAAKoE,SCnNfkB,EAAa,CAAC9B,EAAcC,KAA4B,CAC5DxB,OAAQ,CACNjB,EACAuE,IAEAvB,EACER,EAAIS,WAAWC,KACblC,EAAgBC,OAChB,CAAEjB,OAAMuE,2BACR,CAAE1D,MAAO4B,KAGf+B,aAAc,CACZC,EACAzE,EACAuE,IAEAvB,EACER,EAAIS,WAAWC,KACblC,EAAgBC,OAChB,CAAEwD,KAAIzE,OAAMuE,2BACZ,CAAE1D,MAAO4B,KAGfvB,OAAQ,CACNuD,EACAzE,EACAuE,IAEAvB,EACER,EAAIS,WAAWC,KACblC,EAAgBE,OAChB,CAAEuD,KAAIzE,OAAMuE,2BACZ,CAAE1D,MAAO4B,KAGftB,OAASsD,GACPzB,EACER,EAAIS,WAAWC,KAAKlC,EAAgBG,OAAQ,CAAEsD,MAAM,CAAE5D,MAAO4B,KAEjET,QAAS,IACPgB,EACER,EAAIS,WAAWnD,IAAIkB,EAAgBgB,QAAS,CAC1CnB,MAAO4B,KAERzD,GAASA,EAAK0F,YCjDfC,EAAU,CAACnC,EAAcC,KAA4B,CACzDvB,OAAQ,CACN0D,EACAC,IAEA7B,EACER,EAAIS,WAAWC,KAAKlC,EAAaE,OAAQ,CAAE0D,MAAKC,gBAAgB,CAAEhE,MAAO4B,OCFzEqC,EAAiB,CAACtC,EAAcC,KAA4B,CAChExB,OAAQ,CAACjB,EAAc+E,IACrB/B,EACER,EAAIS,WAAWC,KACblC,EAAoBC,OACpB,CAAEjB,OAAM+E,eACR,CAAElE,MAAO4B,KAGfvB,OAAQ,CAAClB,EAAcgF,EAAiBD,IACtC/B,EACER,EAAIS,WAAWC,KACblC,EAAoBE,OACpB,CAAElB,OAAMgF,UAASD,eACjB,CAAElE,MAAO4B,KAGftB,OAASnB,GACPgD,EACER,EAAIS,WAAWC,KAAKlC,EAAoBG,OAAQ,CAAEnB,QAAQ,CAAEa,MAAO4B,KAEvET,QAAS,IACPgB,EACER,EAAIS,WAAWnD,IAAIkB,EAAoBgB,QAAS,CAC9CnB,MAAO4B,KAERzD,GAASA,EAAKiG,gBC1BfC,EAAW,CAAC1C,EAAcC,KAA4B,CAC1DxB,OAAQ,CACNjB,EACA+E,EACAI,IAEAnC,EACER,EAAIS,WAAWC,KACblC,EAAcC,OACd,CAAEjB,OAAM+E,cAAaI,mBACrB,CAAEtE,MAAO4B,KAGfvB,OAAQ,CACNlB,EACAgF,EACAD,EACAI,IAEAnC,EACER,EAAIS,WAAWC,KACblC,EAAcE,OACd,CAAElB,OAAMgF,UAASD,cAAaI,mBAC9B,CAAEtE,MAAO4B,KAGftB,OAASnB,GACPgD,EACER,EAAIS,WAAWC,KAAKlC,EAAcG,OAAQ,CAAEnB,QAAQ,CAAEa,MAAO4B,KAEjET,QAAS,IACPgB,EACER,EAAIS,WAAWnD,IAAIkB,EAAcgB,QAAS,CACxCnB,MAAO4B,KAERzD,GAASA,EAAK8D,UCvCfsC,EAAY,CAAC5C,EAAcC,KAA4B,CAM3DL,cAAgB+B,GACdnB,EACER,EAAIS,WAAWC,KAAKlC,EAAeoB,cAAe,CAAE+B,YAAY,CAAEtD,MAAO4B,KAU7EJ,uBAAwB,CACtB8B,EACAkB,EACAC,IAEAtC,EACER,EAAIS,WAAWC,KACblC,EAAeqB,uBACf,CAAE8B,WAAUmB,WAAUD,WACtB,CAAExE,MAAO4B,KAUfH,oBAAqB,CAAC6B,EAAkBoB,IACtCvC,EACER,EAAIS,WAAWC,KACblC,EAAesB,oBACf,CAAE6B,WAAUoB,WACZ,CAAE1E,MAAO4B,OC1CX+C,EAAkB,CAAChD,EAAcC,KAA4B,CACjEgD,kBAAmB,CACjBtB,EACAuB,EACAC,EACAC,EACAC,EACAC,IAEA9C,EACER,EAAIS,WAAWC,KACblC,EAAaiB,UACb,CAAEkC,WAAUuB,SAAQE,WAAUD,UAASE,cAAaC,UACpD,CAAEjF,MAAO4B,KAGfsD,kBAAmB,CAAC5B,EAAkB6B,IACpChD,EACER,EAAIS,WAAWC,KACblC,EAAakB,SACb,CAAEiC,WAAU6B,kBACZ,CAAEnF,MAAO4B,KAGfwD,iBAAkB,CAChB9B,EACA+B,EACAC,IAEAnD,EACER,EAAIS,WAAWC,KACblC,EAAamB,QACb,CAAEgC,WAAU+B,cAAaC,oBACzB,CAAEtF,MAAO4B,OCzBX2D,EAAgB,CAAC5D,EAAcC,KAA4B,CAS/DxB,OAAQ,CACNjB,EACAqG,EACAvD,EACAwD,IAEAtD,EACER,EAAIS,WAAWC,KACblC,EAAmBC,OACnB,CAAEjB,OAAMqG,aAAYlD,UAAWL,EAAOwD,cACtC,CAAEzF,MAAO4B,KAQfrB,KAAOqD,GACLzB,EACER,EAAIS,WAAWnD,IAAIkB,EAAmBI,KAAM,CAC1CkC,YAAa,CAAEmB,MACf5D,MAAO4B,KAERzD,GAASA,EAAKuH,MAOnB9C,UAAYC,GACVV,EACER,EAAIS,WAAWC,KAAKlC,EAAmBK,OAAQ,CAAEqC,aAAa,CAAE7C,MAAO4B,KACtEzD,GAASA,EAAKwH,OAQnBtF,OAAQ,CAACuD,EAAYzE,IACnBgD,EACER,EAAIS,WAAWC,KAAKlC,EAAmBE,OAAQ,CAAEuD,KAAIzE,QAAQ,CAAEa,MAAO4B,KACrEzD,GAASA,EAAKuH,MAOnBzE,WAAa2C,GACXzB,EACER,EAAIS,WAAWC,KAAKlC,EAAmBc,WAAY,CAAE2C,MAAM,CAAE5D,MAAO4B,KAMxEV,SAAW0C,GACTzB,EACER,EAAIS,WAAWC,KAAKlC,EAAmBe,SAAU,CAAE0C,MAAM,CAAE5D,MAAO4B,KAMtEtB,OAASsD,GACPzB,EACER,EAAIS,WAAWC,KAAKlC,EAAmBG,OAAQ,CAAEsD,MAAM,CAAE5D,MAAO4B,aC1FpD,QAAlB9C,EAAA8G,WAAWC,eAAO,IAAA/G,IAAlB8G,WAAWC,QAAYA,GAEvB,MAGMC,EAAe,IAAI7H,KAGvBA,EAAK8H,SAASC,YAEZA,YAASlH,GAAAS,EAAAyG,GAAYC,+BAAAA,cARD,aAQmC,IAGlDC,KAAajI,ICKhBkI,EAAWrH,WAAA8C,cAAEA,GAAuC9C,EAArBsH,EAAM7H,EAAAO,EAA1B,mBACf,MAAMuH,EAAUC,EACX7G,OAAAC,OAAAD,OAAAC,OAAA,CAAA,EAAA0G,UACHG,EACAC,YAAW/G,OAAAC,OAAAD,OAAAC,OAAA,CAAA,EACN0G,EAAOI,cACV,qBAAsB,SACtB,8BAAiD,UAAZ,OAAPC,cAAO,IAAPA,aAAO,EAAPA,QAASC,gBAAU,IAAAnH,OAAA,EAAAA,EAAAoH,OAAQ,GACzD,wBAAyB,cAIvBC,UAAEA,EAASC,OAAEA,GAAWT,EAExBT,EAA6C,CAAA,EAmB7CmB,EC1Ce,EAACnF,EAAcC,KAA4B,CAChEW,KAAMb,EAASC,EAAKC,GACpBmF,UAAWxB,EAAc5D,EAAKC,GAC9B9B,OAAQ2D,EAAW9B,EAAKC,GACxBoF,IAAKrC,EAAgBhD,EAAKC,GAC1BmC,IAAKD,EAAQnC,EAAKC,GAClBqF,WAAYhD,EAAetC,EAAKC,GAChCsF,KAAM7C,EAAS1C,EAAKC,GACpBuF,MAAO5C,EAAU5C,EAAKC,KDkCHwF,CAAef,EAASzE,GAErCD,iCACD0E,GAAO,CAOVS,aAGA9I,aAAaqJ,GACX,KAAKA,aAAA,EAAAA,EAAQC,KAAK,MAAMC,MAAM,gCAE9B,GAAI5B,EAAK0B,EAAOC,KAAM,OAAO3B,EAAK0B,EAAOC,KAKzC,GAFA7H,OAAOC,OAAOiG,OAnCA3H,WAChB,MAGMwJ,SAHoBnB,EAAQjE,WAC/BnD,IAAI,WAAW2H,KACfa,MAAMvJ,GAASA,EAAKwJ,UACe/B,KACtC,OAAK1F,MAAMC,QAAQsH,UACQG,QAAQC,IACjCJ,EAAWK,KAAI7J,MAAO0H,GAAQ,CAACA,EAAI4B,UAAWQ,EAAUpC,QAGtCqC,QAClB,CAACC,GAAMV,EAAKW,KAAUX,EAAW7H,OAAAC,OAAAD,OAAAC,OAAA,CAAA,EAAAsI,IAAK,CAACV,EAAIY,YAAaD,IAAQD,GAChE,CAAE,GAPmC,EAQtC,EAsB2BG,KAErBxC,EAAK0B,EAAOC,KAAM,MAAMC,MAAM,gCAEnC,OAAO5B,EAAK0B,EAAOC,IACpB,EAODtJ,kBAAkB+F,SAEhB,MACM/D,SADYoI,EAAUrE,EAAKpC,EAAI0G,OAAQ,CAAEC,eAAgB,KAC7CC,QAElB,GAAIvI,IACFA,EAAMwI,IAAe,QAAT1J,EAAAkB,EAAMwI,WAAG,IAAA1J,OAAA,EAAAA,EAAE2J,MAAM,KAAKC,MAC9B1I,EAAMwI,MAAQ5B,GAEhB,MAAM,IAAI+B,EAAOC,yBACf,+BACA,MACA,gBAKN,MAAO,CAAE7E,MAAK/D,QACf,EAODhC,sBAAsB6K,GACpB,IAAKA,EAAc,MAAMtB,MAAM,4CAE/B,IAEE,aADoB5F,EAAImH,YAAYD,EAMrC,CAJC,MAAOE,GAGP,MADAlC,SAAAA,EAAQkC,MAAM,4BAA6BA,GACrCxB,MAAM,4BACb,CACF,EAODvJ,qBAAqBgL,WACnB,IAAKA,EAAc,MAAMzB,MAAM,kDAE/B,UACQ5F,EAAImH,YAAYE,GACtB,MAAMC,QAAgBtH,EAAIuH,QAAQF,GAClC,GAAIC,EAAQE,GAAI,CAEd,aADoBxH,EAAImH,YAA0B,QAAdhK,EAAAmK,EAAQ9K,YAAM,IAAAW,OAAA,EAAAA,EAAAsK,WAEnD,CAED,MAAM7B,MAAmB,QAAbhI,EAAA0J,EAAQF,aAAK,IAAAxJ,OAAA,EAAAA,EAAE8J,aAK5B,CAJC,MAAOC,GAGP,MADAzC,SAAAA,EAAQkC,MAAM,kCAAmCO,GAC3C/B,MAAM,kCACb,CACF,EAQDvJ,gCACE6K,EACAG,GAEA,IAAKH,IAAiBG,EAAc,MAAMzB,MAAM,6CAEhD,IAEE,aADoB5F,EAAI4H,gBAAgBV,EAKzC,CAHC,MAAOE,GAEPlC,SAAAA,EAAQ2C,IAAI,mDACb,CAED,OAAO7H,EAAI8H,eAAeT,EAC3B,EAODhL,wBAAwB+I,GACtB,IAAKA,EAAW,MAAMQ,MAAM,gCAE5B,IAAIrJ,EACJ,IACEA,QAAayD,EAAIoF,UAAU2C,SAAS3C,EAIrC,CAHC,MAAOgC,GAEP,MADAlC,SAAAA,EAAQkC,MAAM,gCAAiCA,GACzCxB,MAAM,gCACb,CAED,MAAM6B,WAAEA,GAAelL,EAAKC,KAC5B,IAAKiL,EAEH,MADAvC,SAAAA,EAAQkC,MAAM,gDACRxB,MAAM,iCAGd,IAEE,aADoB5F,EAAImH,YAAYM,EAKrC,CAHC,MAAOL,GAEP,MADAlC,SAAAA,EAAQkC,MAAM,sCAAuCA,GAC/CxB,MAAM,gCACb,CACF,EAQDoC,oBAAmB,CAAC/J,EAA8BwE,IACzCzC,EAAIiI,0BAA0BhK,EAAU,KAAMwE,GASvDwF,0BACEhK,EACAE,EACAsE,GAEA,MAAMyF,EAAUlK,EAA2BC,EZrNb,cYqN6CE,GAC3E,OAAOsE,EAAY0F,OAAOC,GAASF,EAAQG,SAASD,IACrD,EAQDE,cAAa,CAACrK,EAA8BqC,IACnCN,EAAIuI,oBAAoBtK,EAAU,KAAMqC,GASjDiI,oBAAoBtK,EAA8BE,EAAgBmC,GAChE,MAAMkI,EAAaxK,EAA2BC,EZxOtB,QYwOgDE,GACxE,OAAOmC,EAAM6H,OAAO5C,GAASiD,EAAWH,SAAS9C,IAClD,IAGH,OAAOkD,EACLzI,EACA,CACE,mBACA,iBACA,sBACA,mBACA,uBACA,uBACA,iBACA,gBACA,cACA,yBACA,yBACA,WAEF7D,EACD,EAoBHqI,EAAQkE,uBZ1R8B,MY2RtClE,EAAQmE,uBZzR8B"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@descope/node-sdk",
-  "version": "1.0.5",
+  "version": "1.0.6",
   "description": "Node.js library used to integrate with Descope",
   "typings": "./dist/index.d.ts",
   "main": "dist/cjs/index.cjs.js",
@@ -96,7 +96,7 @@
   },
   "dependencies": {
     "@descope/core-js-sdk": "0.0.42",
-    "jose": "4.11.2",
+    "jose": "4.12.0",
     "node-fetch-commonjs": "3.2.4"
   },
   "peerDependencies": {