@descope/node-sdk 1.0.5 → 1.1.0

package/README.md

@@ -219,6 +219,70 @@ const jwtResponse = await descopeClient.totp.verify(loginId, 'code');
 
 The session and refresh JWTs should be returned to the caller, and passed with every request in the session. Read more on [session validation](#session-validation)
 
+### Passwords
+
+The user can also authenticate with a password, though it's recommended to
+prefer passwordless authentication methods if possible. Sign up requires the
+caller to provide a valid password that meets all the requirements configured
+for the [password authentication method](https://app.descope.com/settings/authentication/password) in the Descope console.
+
+```js
+// Every user must have a loginId. All other user information is optional
+const loginId = 'desmond@descope.com';
+const password = 'qYlvi65KaX';
+const user = {
+  name: 'Desmond Copeland',
+  email: loginId,
+};
+const jwtResponse = await descopeClient.password.signUp(loginId, password, user);
+// jwtResponse.data.sessionJwt;
+// jwtResponse.data.refreshJwt;
+```
+
+The user can later sign in using the same loginId and password.
+
+```js
+const jwtResponse = await descopeClient.password.signIn(loginId, password);
+// jwtResponse.data.sessionJwt;
+// jwtResponse.data.refreshJwt;
+```
+
+The session and refresh JWTs should be returned to the caller, and passed with every request in the session. Read more on [session validation](#session-validation)
+
+In case the user needs to update their password, one of two methods are available: Resetting their password or replacing their password
+
+**Changing Passwords**
+
+_NOTE: sendReset will only work if the user has a validated email address. Otherwise password reset prompts cannot be sent._
+
+In the [password authentication method](https://app.descope.com/settings/authentication/password) in the Descope console, it is possible to define which alternative authentication method can be used in order to authenticate the user, in order to reset and update their password.
+
+```js
+// Start the reset process by sending a password reset prompt. In this example we'll assume
+// that magic link is configured as the reset method. The optional redirect URL is used in the
+// same way as in regular magic link authentication.
+const loginId = 'desmond@descope.com';
+const redirectURL = 'https://myapp.com/password-reset';
+const passwordResetResponse = await descopeClient.password.sendReset(loginId, redirectURL);
+```
+
+The magic link, in this case, must then be verified like any other magic link (see the [magic link section](#magic-link) for more details). However, after verifying the user, it is expected
+to allow them to provide a new password instead of the old one. Since the user is now authenticated, this is possible via:
+
+```js
+// The refresh token is required to make sure the user is authenticated.
+await descopeClient.password.update(loginId, newPassword, token);
+```
+
+`update()` can always be called when the user is authenticated and has a valid session.
+
+Alternatively, it is also possible to replace an existing active password with a new one.
+
+```js
+// Replaces the user's current password with a new one
+await descopeClient.password.replace(loginId, oldPassword, newPassword);
+```
+
 ### Session Validation
 
 Every secure request performed between your client and server needs to be validated. The client sends
@@ -400,6 +464,18 @@ await descopeClient.management.user.create(
   [{ tenantId: 'tenant-ID1', roleNames: ['role-name1'] }],
 );
 
+// Alternatively, a user can be created and invited via an email message.
+// Make sure to configure the invite URL in the Descope console prior to using this function,
+// and that an email address is provided in the information.
+await descopeClient.management.user.invite(
+  'desmond@descope.com',
+  'desmond@descope.com',
+  null,
+  'Desmond Copeland',
+  null,
+  [{ tenantId: 'tenant-ID1', roleNames: ['role-name1'] }],
+);
+
 // Update will override all fields as is. Use carefully.
 await descopeClient.management.user.update(
   'desmond@descope.com',
@@ -428,6 +504,7 @@ const userRes = await descopeClient.management.user.load('desmond@descope.com');
 const userRes = await descopeClient.management.user.loadByUserId('<user-ID>');
 
 // Search all users, optionally according to tenant and/or role filter
+// Results can be paginated using the limit and page parameters
 const usersRes = await descopeClient.management.user.searchAll(['tenant-ID']);
 usersRes.data.forEach((user) => {
   // do something

package/dist/cjs/index.cjs.js

@@ -1,2 +1,2 @@
-"use strict";var e=require("tslib"),t=require("@descope/core-js-sdk"),s=require("jose"),a=require("node-fetch-commonjs");function n(e){return e&&"object"==typeof e&&"default"in e?e:{default:e}}var o=n(t),r=n(a);const i=t=>async(...s)=>{var a,n,o;const r=await t(...s);if(!r.data)return r;let i=r.data,{refreshJwt:l}=i,d=e.__rest(i,["refreshJwt"]);const p=[];var m;return l?p.push(`${"DSR"}=${l}; Domain=${(null==(m=d)?void 0:m.cookieDomain)||""}; Max-Age=${(null==m?void 0:m.cookieMaxAge)||""}; Path=${(null==m?void 0:m.cookiePath)||"/"}; HttpOnly; SameSite=Strict`):(null===(a=r.response)||void 0===a?void 0:a.headers.get("set-cookie"))&&(l=((e,t)=>{const s=null==e?void 0:e.match(RegExp(`(?:^|;\\s*)${t}=([^;]*)`));return s?s[1]:null})(null===(n=r.response)||void 0===n?void 0:n.headers.get("set-cookie"),"DSR"),p.push(null===(o=r.response)||void 0===o?void 0:o.headers.get("set-cookie"))),Object.assign(Object.assign({},r),{data:Object.assign(Object.assign({},r.data),{refreshJwt:l,cookies:p})})};function l(e,t,s){var a,n;const o=s?null===(n=null===(a=e.token.tenants)||void 0===a?void 0:a[s])||void 0===n?void 0:n[t]:e.token[t];return Array.isArray(o)?o:[]}var d={create:"/v1/mgmt/user/create",update:"/v1/mgmt/user/update",delete:"/v1/mgmt/user/delete",load:"/v1/mgmt/user",search:"/v1/mgmt/user/search",updateStatus:"/v1/mgmt/user/update/status",updateEmail:"/v1/mgmt/user/update/email",updatePhone:"/v1/mgmt/user/update/phone",updateDisplayName:"/v1/mgmt/user/update/name",addRole:"/v1/mgmt/user/update/role/add",removeRole:"/v1/mgmt/user/update/role/remove",addTenant:"/v1/mgmt/user/update/tenant/add",removeTenant:"/v1/mgmt/user/update/tenant/remove"},p={create:"/v1/mgmt/accesskey/create",load:"/v1/mgmt/accesskey",search:"/v1/mgmt/accesskey/search",update:"/v1/mgmt/accesskey/update",deactivate:"/v1/mgmt/accesskey/deactivate",activate:"/v1/mgmt/accesskey/activate",delete:"/v1/mgmt/accesskey/delete"},m={create:"/v1/mgmt/tenant/create",update:"/v1/mgmt/tenant/update",delete:"/v1/mgmt/tenant/delete",loadAll:"/v1/mgmt/tenant/all"},c={configure:"/v1/mgmt/sso/settings",metadata:"/v1/mgmt/sso/metadata",mapping:"/v1/mgmt/sso/mapping"},u={update:"/v1/mgmt/jwt/update"},h={create:"/v1/mgmt/permission/create",update:"/v1/mgmt/permission/update",delete:"/v1/mgmt/permission/delete",loadAll:"/v1/mgmt/permission/all"},v={create:"/v1/mgmt/role/create",update:"/v1/mgmt/role/update",delete:"/v1/mgmt/role/delete",loadAll:"/v1/mgmt/role/all"},g={loadAllGroups:"/v1/mgmt/group/all",loadAllGroupsForMember:"/v1/mgmt/group/member/all",loadAllGroupMembers:"/v1/mgmt/group/members"};const f=(e,s)=>({create:(a,n,o,r,i,l)=>t.transformResponse(e.httpClient.post(d.create,{loginId:a,email:n,phone:o,displayName:r,roleNames:i,userTenants:l},{token:s}),(e=>e.user)),update:(a,n,o,r,i,l)=>t.transformResponse(e.httpClient.post(d.update,{loginId:a,email:n,phone:o,displayName:r,roleNames:i,userTenants:l},{token:s}),(e=>e.user)),delete:a=>t.transformResponse(e.httpClient.post(d.delete,{loginId:a},{token:s})),load:a=>t.transformResponse(e.httpClient.get(d.load,{queryParams:{loginId:a},token:s}),(e=>e.user)),loadByUserId:a=>t.transformResponse(e.httpClient.get(d.load,{queryParams:{userId:a},token:s}),(e=>e.user)),searchAll:(a,n,o)=>t.transformResponse(e.httpClient.post(d.search,{tenantIds:a,roleNames:n,limit:o},{token:s}),(e=>e.users)),activate:a=>t.transformResponse(e.httpClient.post(d.updateStatus,{loginId:a,status:"enabled"},{token:s}),(e=>e.user)),deactivate:a=>t.transformResponse(e.httpClient.post(d.updateStatus,{loginId:a,status:"disabled"},{token:s}),(e=>e.user)),updateEmail:(a,n,o)=>t.transformResponse(e.httpClient.post(d.updateEmail,{loginId:a,email:n,verified:o},{token:s}),(e=>e.user)),updatePhone:(a,n,o)=>t.transformResponse(e.httpClient.post(d.updatePhone,{loginId:a,phone:n,verified:o},{token:s}),(e=>e.user)),updateDisplayName:(a,n)=>t.transformResponse(e.httpClient.post(d.updateDisplayName,{loginId:a,displayName:n},{token:s}),(e=>e.user)),addRoles:(a,n)=>t.transformResponse(e.httpClient.post(d.addRole,{loginId:a,roleNames:n},{token:s}),(e=>e.user)),removeRoles:(a,n)=>t.transformResponse(e.httpClient.post(d.removeRole,{loginId:a,roleNames:n},{token:s}),(e=>e.user)),addTenant:(a,n)=>t.transformResponse(e.httpClient.post(d.addTenant,{loginId:a,tenantId:n},{token:s}),(e=>e.user)),removeTenant:(a,n)=>t.transformResponse(e.httpClient.post(d.removeTenant,{loginId:a,tenantId:n},{token:s}),(e=>e.user)),addTenantRoles:(a,n,o)=>t.transformResponse(e.httpClient.post(d.addRole,{loginId:a,tenantId:n,roleNames:o},{token:s}),(e=>e.user)),removeTenantRoles:(a,n,o)=>t.transformResponse(e.httpClient.post(d.removeRole,{loginId:a,tenantId:n,roleNames:o},{token:s}),(e=>e.user))}),k=(e,s)=>({create:(a,n)=>t.transformResponse(e.httpClient.post(m.create,{name:a,selfProvisioningDomains:n},{token:s})),createWithId:(a,n,o)=>t.transformResponse(e.httpClient.post(m.create,{id:a,name:n,selfProvisioningDomains:o},{token:s})),update:(a,n,o)=>t.transformResponse(e.httpClient.post(m.update,{id:a,name:n,selfProvisioningDomains:o},{token:s})),delete:a=>t.transformResponse(e.httpClient.post(m.delete,{id:a},{token:s})),loadAll:()=>t.transformResponse(e.httpClient.get(m.loadAll,{token:s}),(e=>e.tenants))}),y=(e,s)=>({update:(a,n)=>t.transformResponse(e.httpClient.post(u.update,{jwt:a,customClaims:n},{token:s}))}),R=(e,s)=>({create:(a,n)=>t.transformResponse(e.httpClient.post(h.create,{name:a,description:n},{token:s})),update:(a,n,o)=>t.transformResponse(e.httpClient.post(h.update,{name:a,newName:n,description:o},{token:s})),delete:a=>t.transformResponse(e.httpClient.post(h.delete,{name:a},{token:s})),loadAll:()=>t.transformResponse(e.httpClient.get(h.loadAll,{token:s}),(e=>e.permissions))}),C=(e,s)=>({create:(a,n,o)=>t.transformResponse(e.httpClient.post(v.create,{name:a,description:n,permissionNames:o},{token:s})),update:(a,n,o,r)=>t.transformResponse(e.httpClient.post(v.update,{name:a,newName:n,description:o,permissionNames:r},{token:s})),delete:a=>t.transformResponse(e.httpClient.post(v.delete,{name:a},{token:s})),loadAll:()=>t.transformResponse(e.httpClient.get(v.loadAll,{token:s}),(e=>e.roles))}),w=(e,s)=>({loadAllGroups:a=>t.transformResponse(e.httpClient.post(g.loadAllGroups,{tenantId:a},{token:s})),loadAllGroupsForMember:(a,n,o)=>t.transformResponse(e.httpClient.post(g.loadAllGroupsForMember,{tenantId:a,loginIds:o,userIds:n},{token:s})),loadAllGroupMembers:(a,n)=>t.transformResponse(e.httpClient.post(g.loadAllGroupMembers,{tenantId:a,groupId:n},{token:s}))}),I=(e,s)=>({configureSettings:(a,n,o,r,i,l)=>t.transformResponse(e.httpClient.post(c.configure,{tenantId:a,idpURL:n,entityId:r,idpCert:o,redirectURL:i,domain:l},{token:s})),configureMetadata:(a,n)=>t.transformResponse(e.httpClient.post(c.metadata,{tenantId:a,idpMetadataURL:n},{token:s})),configureMapping:(a,n,o)=>t.transformResponse(e.httpClient.post(c.mapping,{tenantId:a,roleMapping:n,attributeMapping:o},{token:s}))}),b=(e,s)=>({create:(a,n,o,r)=>t.transformResponse(e.httpClient.post(p.create,{name:a,expireTime:n,roleNames:o,keyTenants:r},{token:s})),load:a=>t.transformResponse(e.httpClient.get(p.load,{queryParams:{id:a},token:s}),(e=>e.key)),searchAll:a=>t.transformResponse(e.httpClient.post(p.search,{tenantIds:a},{token:s}),(e=>e.keys)),update:(a,n)=>t.transformResponse(e.httpClient.post(p.update,{id:a,name:n},{token:s}),(e=>e.key)),deactivate:a=>t.transformResponse(e.httpClient.post(p.deactivate,{id:a},{token:s})),activate:a=>t.transformResponse(e.httpClient.post(p.activate,{id:a},{token:s})),delete:a=>t.transformResponse(e.httpClient.post(p.delete,{id:a},{token:s}))});var A;null!==(A=globalThis.Headers)&&void 0!==A||(globalThis.Headers=a.Headers);const j=(...e)=>(e.forEach((e=>{var t,s;e&&(null!==(t=(s=e).highWaterMark)&&void 0!==t||(s.highWaterMark=32212254720))})),r.default(...e)),T=a=>{var n,{managementKey:r}=a,d=e.__rest(a,["managementKey"]);const p=o.default(Object.assign(Object.assign({},d),{fetch:j,baseHeaders:Object.assign(Object.assign({},d.baseHeaders),{"x-descope-sdk-name":"nodejs","x-descope-sdk-node-version":(null===(n=null===process||void 0===process?void 0:process.versions)||void 0===n?void 0:n.node)||"","x-descope-sdk-version":"1.0.5"})})),{projectId:m,logger:c}=d,u={},h=((e,t)=>({user:f(e,t),accessKey:b(e,t),tenant:k(e,t),sso:I(e,t),jwt:y(e,t),permission:R(e,t),role:C(e,t),group:w(e,t)}))(p,r),v=Object.assign(Object.assign({},p),{management:h,async getKey(e){if(!(null==e?void 0:e.kid))throw Error("header.kid must not be empty");if(u[e.kid])return u[e.kid];if(Object.assign(u,await(async()=>{const e=(await p.httpClient.get(`v2/keys/${m}`).then((e=>e.json()))).keys;return Array.isArray(e)?(await Promise.all(e.map((async e=>[e.kid,await s.importJWK(e)])))).reduce(((e,[t,s])=>t?Object.assign(Object.assign({},e),{[t.toString()]:s}):e),{}):{}})()),!u[e.kid])throw Error("failed to fetch matching key");return u[e.kid]},async validateJwt(e){var t;const a=(await s.jwtVerify(e,v.getKey,{clockTolerance:5})).payload;if(a&&(a.iss=null===(t=a.iss)||void 0===t?void 0:t.split("/").pop(),a.iss!==m))throw new s.errors.JWTClaimValidationFailed('unexpected "iss" claim value',"iss","check_failed");return{jwt:e,token:a}},async validateSession(e){if(!e)throw Error("session token is required for validation");try{return await v.validateJwt(e)}catch(e){throw null==c||c.error("session validation failed",e),Error("session validation failed")}},async refreshSession(e){var t,s;if(!e)throw Error("refresh token is required to refresh a session");try{await v.validateJwt(e);const a=await v.refresh(e);if(a.ok){return await v.validateJwt(null===(t=a.data)||void 0===t?void 0:t.sessionJwt)}throw Error(null===(s=a.error)||void 0===s?void 0:s.errorMessage)}catch(e){throw null==c||c.error("refresh token validation failed",e),Error("refresh token validation failed")}},async validateAndRefreshSession(e,t){if(!e&&!t)throw Error("both session and refresh tokens are empty");try{return await v.validateSession(e)}catch(e){null==c||c.log("session validation failed - trying to refresh it")}return v.refreshSession(t)},async exchangeAccessKey(e){if(!e)throw Error("access key must not be empty");let t;try{t=await v.accessKey.exchange(e)}catch(e){throw null==c||c.error("failed to exchange access key",e),Error("could not exchange access key")}const{sessionJwt:s}=t.data;if(!s)throw null==c||c.error("failed to parse exchange access key response"),Error("could not exchange access key");try{return await v.validateJwt(s)}catch(e){throw null==c||c.error("failed to parse jwt from access key",e),Error("could not exchange access key")}},validatePermissions:(e,t)=>v.validateTenantPermissions(e,null,t),validateTenantPermissions(e,t,s){const a=l(e,"permissions",t);return s.every((e=>a.includes(e)))},validateRoles:(e,t)=>v.validateTenantRoles(e,null,t),validateTenantRoles(e,t,s){const a=l(e,"roles",t);return s.every((e=>a.includes(e)))}});return t.wrapWith(v,["otp.verify.email","otp.verify.sms","otp.verify.whatsapp","magicLink.verify","enchantedLink.signUp","enchantedLink.signIn","oauth.exchange","saml.exchange","totp.verify","webauthn.signIn.finish","webauthn.signUp.finish","refresh"],i)};T.RefreshTokenCookieName="DSR",T.SessionTokenCookieName="DS",module.exports=T;
+"use strict";var e=require("tslib"),t=require("@descope/core-js-sdk"),s=require("jose"),o=require("node-fetch-commonjs");function a(e){return e&&"object"==typeof e&&"default"in e?e:{default:e}}var n=a(t),r=a(o);const i=t=>async(...s)=>{var o,a,n;const r=await t(...s);if(!r.data)return r;let i=r.data,{refreshJwt:l}=i,p=e.__rest(i,["refreshJwt"]);const d=[];var m;return l?d.push(`${"DSR"}=${l}; Domain=${(null==(m=p)?void 0:m.cookieDomain)||""}; Max-Age=${(null==m?void 0:m.cookieMaxAge)||""}; Path=${(null==m?void 0:m.cookiePath)||"/"}; HttpOnly; SameSite=Strict`):(null===(o=r.response)||void 0===o?void 0:o.headers.get("set-cookie"))&&(l=((e,t)=>{const s=null==e?void 0:e.match(RegExp(`(?:^|;\\s*)${t}=([^;]*)`));return s?s[1]:null})(null===(a=r.response)||void 0===a?void 0:a.headers.get("set-cookie"),"DSR"),d.push(null===(n=r.response)||void 0===n?void 0:n.headers.get("set-cookie"))),Object.assign(Object.assign({},r),{data:Object.assign(Object.assign({},r.data),{refreshJwt:l,cookies:d})})};function l(e,t,s){var o,a;const n=s?null===(a=null===(o=e.token.tenants)||void 0===o?void 0:o[s])||void 0===a?void 0:a[t]:e.token[t];return Array.isArray(n)?n:[]}var p={create:"/v1/mgmt/user/create",update:"/v1/mgmt/user/update",delete:"/v1/mgmt/user/delete",load:"/v1/mgmt/user",search:"/v1/mgmt/user/search",updateStatus:"/v1/mgmt/user/update/status",updateEmail:"/v1/mgmt/user/update/email",updatePhone:"/v1/mgmt/user/update/phone",updateDisplayName:"/v1/mgmt/user/update/name",addRole:"/v1/mgmt/user/update/role/add",removeRole:"/v1/mgmt/user/update/role/remove",addTenant:"/v1/mgmt/user/update/tenant/add",removeTenant:"/v1/mgmt/user/update/tenant/remove"},d={create:"/v1/mgmt/accesskey/create",load:"/v1/mgmt/accesskey",search:"/v1/mgmt/accesskey/search",update:"/v1/mgmt/accesskey/update",deactivate:"/v1/mgmt/accesskey/deactivate",activate:"/v1/mgmt/accesskey/activate",delete:"/v1/mgmt/accesskey/delete"},m={create:"/v1/mgmt/tenant/create",update:"/v1/mgmt/tenant/update",delete:"/v1/mgmt/tenant/delete",loadAll:"/v1/mgmt/tenant/all"},c={configure:"/v1/mgmt/sso/settings",metadata:"/v1/mgmt/sso/metadata",mapping:"/v1/mgmt/sso/mapping"},u={update:"/v1/mgmt/jwt/update"},h={create:"/v1/mgmt/permission/create",update:"/v1/mgmt/permission/update",delete:"/v1/mgmt/permission/delete",loadAll:"/v1/mgmt/permission/all"},v={create:"/v1/mgmt/role/create",update:"/v1/mgmt/role/update",delete:"/v1/mgmt/role/delete",loadAll:"/v1/mgmt/role/all"},g={export:"/v1/mgmt/flow/export",import:"/v1/mgmt/flow/import"},f={export:"/v1/mgmt/theme/export",import:"/v1/mgmt/theme/import"},k={loadAllGroups:"/v1/mgmt/group/all",loadAllGroupsForMember:"/v1/mgmt/group/member/all",loadAllGroupMembers:"/v1/mgmt/group/members"};const y=(e,s)=>({create:(o,a,n,r,i,l)=>t.transformResponse(e.httpClient.post(p.create,{loginId:o,email:a,phone:n,displayName:r,roleNames:i,userTenants:l},{token:s}),(e=>e.user)),invite:(o,a,n,r,i,l)=>t.transformResponse(e.httpClient.post(p.create,{loginId:o,email:a,phone:n,displayName:r,roleNames:i,userTenants:l,invite:!0},{token:s}),(e=>e.user)),update:(o,a,n,r,i,l)=>t.transformResponse(e.httpClient.post(p.update,{loginId:o,email:a,phone:n,displayName:r,roleNames:i,userTenants:l},{token:s}),(e=>e.user)),delete:o=>t.transformResponse(e.httpClient.post(p.delete,{loginId:o},{token:s})),load:o=>t.transformResponse(e.httpClient.get(p.load,{queryParams:{loginId:o},token:s}),(e=>e.user)),loadByUserId:o=>t.transformResponse(e.httpClient.get(p.load,{queryParams:{userId:o},token:s}),(e=>e.user)),searchAll:(o,a,n,r)=>t.transformResponse(e.httpClient.post(p.search,{tenantIds:o,roleNames:a,limit:n,page:r},{token:s}),(e=>e.users)),activate:o=>t.transformResponse(e.httpClient.post(p.updateStatus,{loginId:o,status:"enabled"},{token:s}),(e=>e.user)),deactivate:o=>t.transformResponse(e.httpClient.post(p.updateStatus,{loginId:o,status:"disabled"},{token:s}),(e=>e.user)),updateEmail:(o,a,n)=>t.transformResponse(e.httpClient.post(p.updateEmail,{loginId:o,email:a,verified:n},{token:s}),(e=>e.user)),updatePhone:(o,a,n)=>t.transformResponse(e.httpClient.post(p.updatePhone,{loginId:o,phone:a,verified:n},{token:s}),(e=>e.user)),updateDisplayName:(o,a)=>t.transformResponse(e.httpClient.post(p.updateDisplayName,{loginId:o,displayName:a},{token:s}),(e=>e.user)),addRoles:(o,a)=>t.transformResponse(e.httpClient.post(p.addRole,{loginId:o,roleNames:a},{token:s}),(e=>e.user)),removeRoles:(o,a)=>t.transformResponse(e.httpClient.post(p.removeRole,{loginId:o,roleNames:a},{token:s}),(e=>e.user)),addTenant:(o,a)=>t.transformResponse(e.httpClient.post(p.addTenant,{loginId:o,tenantId:a},{token:s}),(e=>e.user)),removeTenant:(o,a)=>t.transformResponse(e.httpClient.post(p.removeTenant,{loginId:o,tenantId:a},{token:s}),(e=>e.user)),addTenantRoles:(o,a,n)=>t.transformResponse(e.httpClient.post(p.addRole,{loginId:o,tenantId:a,roleNames:n},{token:s}),(e=>e.user)),removeTenantRoles:(o,a,n)=>t.transformResponse(e.httpClient.post(p.removeRole,{loginId:o,tenantId:a,roleNames:n},{token:s}),(e=>e.user))}),R=(e,s)=>({create:(o,a)=>t.transformResponse(e.httpClient.post(m.create,{name:o,selfProvisioningDomains:a},{token:s})),createWithId:(o,a,n)=>t.transformResponse(e.httpClient.post(m.create,{id:o,name:a,selfProvisioningDomains:n},{token:s})),update:(o,a,n)=>t.transformResponse(e.httpClient.post(m.update,{id:o,name:a,selfProvisioningDomains:n},{token:s})),delete:o=>t.transformResponse(e.httpClient.post(m.delete,{id:o},{token:s})),loadAll:()=>t.transformResponse(e.httpClient.get(m.loadAll,{token:s}),(e=>e.tenants))}),w=(e,s)=>({update:(o,a)=>t.transformResponse(e.httpClient.post(u.update,{jwt:o,customClaims:a},{token:s}))}),C=(e,s)=>({create:(o,a)=>t.transformResponse(e.httpClient.post(h.create,{name:o,description:a},{token:s})),update:(o,a,n)=>t.transformResponse(e.httpClient.post(h.update,{name:o,newName:a,description:n},{token:s})),delete:o=>t.transformResponse(e.httpClient.post(h.delete,{name:o},{token:s})),loadAll:()=>t.transformResponse(e.httpClient.get(h.loadAll,{token:s}),(e=>e.permissions))}),I=(e,s)=>({create:(o,a,n)=>t.transformResponse(e.httpClient.post(v.create,{name:o,description:a,permissionNames:n},{token:s})),update:(o,a,n,r)=>t.transformResponse(e.httpClient.post(v.update,{name:o,newName:a,description:n,permissionNames:r},{token:s})),delete:o=>t.transformResponse(e.httpClient.post(v.delete,{name:o},{token:s})),loadAll:()=>t.transformResponse(e.httpClient.get(v.loadAll,{token:s}),(e=>e.roles))}),b=(e,s)=>({loadAllGroups:o=>t.transformResponse(e.httpClient.post(k.loadAllGroups,{tenantId:o},{token:s})),loadAllGroupsForMember:(o,a,n)=>t.transformResponse(e.httpClient.post(k.loadAllGroupsForMember,{tenantId:o,loginIds:n,userIds:a},{token:s})),loadAllGroupMembers:(o,a)=>t.transformResponse(e.httpClient.post(k.loadAllGroupMembers,{tenantId:o,groupId:a},{token:s}))}),A=(e,s)=>({configureSettings:(o,a,n,r,i,l)=>t.transformResponse(e.httpClient.post(c.configure,{tenantId:o,idpURL:a,entityId:r,idpCert:n,redirectURL:i,domain:l},{token:s})),configureMetadata:(o,a)=>t.transformResponse(e.httpClient.post(c.metadata,{tenantId:o,idpMetadataURL:a},{token:s})),configureMapping:(o,a,n)=>t.transformResponse(e.httpClient.post(c.mapping,{tenantId:o,roleMapping:a,attributeMapping:n},{token:s}))}),j=(e,s)=>({create:(o,a,n,r)=>t.transformResponse(e.httpClient.post(d.create,{name:o,expireTime:a,roleNames:n,keyTenants:r},{token:s})),load:o=>t.transformResponse(e.httpClient.get(d.load,{queryParams:{id:o},token:s}),(e=>e.key)),searchAll:o=>t.transformResponse(e.httpClient.post(d.search,{tenantIds:o},{token:s}),(e=>e.keys)),update:(o,a)=>t.transformResponse(e.httpClient.post(d.update,{id:o,name:a},{token:s}),(e=>e.key)),deactivate:o=>t.transformResponse(e.httpClient.post(d.deactivate,{id:o},{token:s})),activate:o=>t.transformResponse(e.httpClient.post(d.activate,{id:o},{token:s})),delete:o=>t.transformResponse(e.httpClient.post(d.delete,{id:o},{token:s}))}),x=(e,s)=>({export:o=>t.transformResponse(e.httpClient.post(g.export,{flowId:o},{token:s})),import:(o,a,n)=>t.transformResponse(e.httpClient.post(g.import,{flowId:o,flow:a,screens:n},{token:s}))}),T=(e,s)=>({export:()=>t.transformResponse(e.httpClient.post(f.export,{},{token:s})),import:o=>t.transformResponse(e.httpClient.post(f.import,{theme:o},{token:s}))});var N;null!==(N=globalThis.Headers)&&void 0!==N||(globalThis.Headers=o.Headers);const S=(...e)=>(e.forEach((e=>{var t,s;e&&(null!==(t=(s=e).highWaterMark)&&void 0!==t||(s.highWaterMark=32212254720))})),r.default(...e)),E=o=>{var a,{managementKey:r}=o,p=e.__rest(o,["managementKey"]);const d=n.default(Object.assign(Object.assign({},p),{fetch:S,baseHeaders:Object.assign(Object.assign({},p.baseHeaders),{"x-descope-sdk-name":"nodejs","x-descope-sdk-node-version":(null===(a=null===process||void 0===process?void 0:process.versions)||void 0===a?void 0:a.node)||"","x-descope-sdk-version":"1.1.0"})})),{projectId:m,logger:c}=p,u={},h=((e,t)=>({user:y(e,t),accessKey:j(e,t),tenant:R(e,t),sso:A(e,t),jwt:w(e,t),permission:C(e,t),role:I(e,t),group:b(e,t),flow:x(e,t),theme:T(e,t)}))(d,r),v=Object.assign(Object.assign({},d),{management:h,async getKey(e){if(!(null==e?void 0:e.kid))throw Error("header.kid must not be empty");if(u[e.kid])return u[e.kid];if(Object.assign(u,await(async()=>{const e=(await d.httpClient.get(`v2/keys/${m}`).then((e=>e.json()))).keys;return Array.isArray(e)?(await Promise.all(e.map((async e=>[e.kid,await s.importJWK(e)])))).reduce(((e,[t,s])=>t?Object.assign(Object.assign({},e),{[t.toString()]:s}):e),{}):{}})()),!u[e.kid])throw Error("failed to fetch matching key");return u[e.kid]},async validateJwt(e){var t;const o=(await s.jwtVerify(e,v.getKey,{clockTolerance:5})).payload;if(o&&(o.iss=null===(t=o.iss)||void 0===t?void 0:t.split("/").pop(),o.iss!==m))throw new s.errors.JWTClaimValidationFailed('unexpected "iss" claim value',"iss","check_failed");return{jwt:e,token:o}},async validateSession(e){if(!e)throw Error("session token is required for validation");try{return await v.validateJwt(e)}catch(e){throw null==c||c.error("session validation failed",e),Error("session validation failed")}},async refreshSession(e){var t,s;if(!e)throw Error("refresh token is required to refresh a session");try{await v.validateJwt(e);const o=await v.refresh(e);if(o.ok){return await v.validateJwt(null===(t=o.data)||void 0===t?void 0:t.sessionJwt)}throw Error(null===(s=o.error)||void 0===s?void 0:s.errorMessage)}catch(e){throw null==c||c.error("refresh token validation failed",e),Error("refresh token validation failed")}},async validateAndRefreshSession(e,t){if(!e&&!t)throw Error("both session and refresh tokens are empty");try{return await v.validateSession(e)}catch(e){null==c||c.log("session validation failed - trying to refresh it")}return v.refreshSession(t)},async exchangeAccessKey(e){if(!e)throw Error("access key must not be empty");let t;try{t=await v.accessKey.exchange(e)}catch(e){throw null==c||c.error("failed to exchange access key",e),Error("could not exchange access key")}const{sessionJwt:s}=t.data;if(!s)throw null==c||c.error("failed to parse exchange access key response"),Error("could not exchange access key");try{return await v.validateJwt(s)}catch(e){throw null==c||c.error("failed to parse jwt from access key",e),Error("could not exchange access key")}},validatePermissions:(e,t)=>v.validateTenantPermissions(e,null,t),validateTenantPermissions(e,t,s){const o=l(e,"permissions",t);return s.every((e=>o.includes(e)))},validateRoles:(e,t)=>v.validateTenantRoles(e,null,t),validateTenantRoles(e,t,s){const o=l(e,"roles",t);return s.every((e=>o.includes(e)))}});return t.wrapWith(v,["otp.verify.email","otp.verify.sms","otp.verify.whatsapp","magicLink.verify","enchantedLink.signUp","enchantedLink.signIn","oauth.exchange","saml.exchange","totp.verify","webauthn.signIn.finish","webauthn.signUp.finish","refresh"],i)};E.RefreshTokenCookieName="DSR",E.SessionTokenCookieName="DS",module.exports=E;
 //# sourceMappingURL=index.cjs.js.map

package/dist/cjs/index.cjs.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.cjs.js","sources":["../../lib/constants.ts","../../lib/helpers.ts","../../lib/management/paths.ts","../../lib/management/user.ts","../../lib/management/tenant.ts","../../lib/management/jwt.ts","../../lib/management/permission.ts","../../lib/management/role.ts","../../lib/management/group.ts","../../lib/management/sso.ts","../../lib/management/accesskey.ts","../../lib/fetch-polyfill.ts","../../lib/index.ts","../../lib/management/index.ts"],"sourcesContent":["// eslint-disable-next-line import/prefer-default-export\n/** Refresh JWT cookie name */\nexport const refreshTokenCookieName = 'DSR';\n/** Session JWT cookie name */\nexport const sessionTokenCookieName = 'DS';\n/** The key of the tenants claims in the claims map */\nexport const authorizedTenantsClaimName = 'tenants';\n/** The key of the permissions claims in the claims map either under tenant or top level */\nexport const permissionsClaimName = 'permissions';\n/** The key of the roles claims in the claims map either under tenant or top level */\nexport const rolesClaimName = 'roles';\n","import type { SdkFnWrapper } from '@descope/core-js-sdk';\nimport { authorizedTenantsClaimName, refreshTokenCookieName } from './constants';\nimport { AuthenticationInfo } from './types';\n\n/**\n * Generate a cookie string from given parameters\n * @param name name of the cookie\n * @param value value of cookie that must be already encoded\n * @param options any options to put on the cookie like cookieDomain, cookieMaxAge, cookiePath\n * @returns Cookie string with all options on the string\n */\nconst generateCookie = (name: string, value: string, options?: Record<string, string | number>) =>\n  `${name}=${value}; Domain=${options?.cookieDomain || ''}; Max-Age=${\n    options?.cookieMaxAge || ''\n  }; Path=${options?.cookiePath || '/'}; HttpOnly; SameSite=Strict`;\n\n/**\n * Parse the cookie string and return the value of the cookie\n * @param cookie the raw cookie string\n * @param name the name of the cookie to get value for\n * @returns the value of the given cookie\n */\nconst getCookieValue = (cookie: string | null | undefined, name: string) => {\n  const match = cookie?.match(RegExp(`(?:^|;\\\\s*)${name}=([^;]*)`));\n  return match ? match[1] : null;\n};\n\n// eslint-disable-next-line import/prefer-default-export\n/**\n * Add cookie generation to core-js functions.\n * @param fn the function we are wrapping\n * @returns Wrapped function with cookie generation\n */\nexport const withCookie: SdkFnWrapper<{ refreshJwt?: string; cookies?: string[] }> =\n  (fn) =>\n  async (...args) => {\n    const resp = await fn(...args);\n\n    // istanbul ignore next\n    if (!resp.data) {\n      return resp;\n    }\n\n    // eslint-disable-next-line prefer-const\n    let { refreshJwt, ...rest } = resp.data;\n    const cookies: string[] = [];\n\n    if (!refreshJwt) {\n      if (resp.response?.headers.get('set-cookie')) {\n        refreshJwt = getCookieValue(\n          resp.response?.headers.get('set-cookie'),\n          refreshTokenCookieName,\n        );\n        cookies.push(resp.response?.headers.get('set-cookie')!);\n      }\n    } else {\n      cookies.push(generateCookie(refreshTokenCookieName, refreshJwt, rest));\n    }\n\n    return { ...resp, data: { ...resp.data, refreshJwt, cookies } };\n  };\n\n/**\n * Get the claim (used for permissions or roles) for a given tenant or top level if tenant is empty\n * @param authInfo The parsed authentication info from the JWT\n * @param claim name of the claim\n * @param tenant tenant to retrieve the claim for\n * @returns\n */\nexport function getAuthorizationClaimItems(\n  authInfo: AuthenticationInfo,\n  claim: string,\n  tenant?: string,\n): string[] {\n  const value = tenant\n    ? authInfo.token[authorizedTenantsClaimName]?.[tenant]?.[claim]\n    : authInfo.token[claim];\n  return Array.isArray(value) ? value : [];\n}\n","/** API paths for the Descope service Management APIs */\nexport default {\n  user: {\n    create: '/v1/mgmt/user/create',\n    update: '/v1/mgmt/user/update',\n    delete: '/v1/mgmt/user/delete',\n    load: '/v1/mgmt/user',\n    search: '/v1/mgmt/user/search',\n    updateStatus: '/v1/mgmt/user/update/status',\n    updateEmail: '/v1/mgmt/user/update/email',\n    updatePhone: '/v1/mgmt/user/update/phone',\n    updateDisplayName: '/v1/mgmt/user/update/name',\n    addRole: '/v1/mgmt/user/update/role/add',\n    removeRole: '/v1/mgmt/user/update/role/remove',\n    addTenant: '/v1/mgmt/user/update/tenant/add',\n    removeTenant: '/v1/mgmt/user/update/tenant/remove',\n  },\n  accessKey: {\n    create: '/v1/mgmt/accesskey/create',\n    load: '/v1/mgmt/accesskey',\n    search: '/v1/mgmt/accesskey/search',\n    update: '/v1/mgmt/accesskey/update',\n    deactivate: '/v1/mgmt/accesskey/deactivate',\n    activate: '/v1/mgmt/accesskey/activate',\n    delete: '/v1/mgmt/accesskey/delete',\n  },\n  tenant: {\n    create: '/v1/mgmt/tenant/create',\n    update: '/v1/mgmt/tenant/update',\n    delete: '/v1/mgmt/tenant/delete',\n    loadAll: '/v1/mgmt/tenant/all',\n  },\n  sso: {\n    configure: '/v1/mgmt/sso/settings',\n    metadata: '/v1/mgmt/sso/metadata',\n    mapping: '/v1/mgmt/sso/mapping',\n  },\n  jwt: {\n    update: '/v1/mgmt/jwt/update',\n  },\n  permission: {\n    create: '/v1/mgmt/permission/create',\n    update: '/v1/mgmt/permission/update',\n    delete: '/v1/mgmt/permission/delete',\n    loadAll: '/v1/mgmt/permission/all',\n  },\n  role: {\n    create: '/v1/mgmt/role/create',\n    update: '/v1/mgmt/role/update',\n    delete: '/v1/mgmt/role/delete',\n    loadAll: '/v1/mgmt/role/all',\n  },\n  group: {\n    loadAllGroups: '/v1/mgmt/group/all',\n    loadAllGroupsForMember: '/v1/mgmt/group/member/all',\n    loadAllGroupMembers: '/v1/mgmt/group/members',\n  },\n};\n","import { SdkResponse, transformResponse, UserResponse } from '@descope/core-js-sdk';\nimport { CoreSdk } from '../types';\nimport apiPaths from './paths';\nimport { AssociatedTenant } from './types';\n\ntype SingleUserResponse = {\n  user: UserResponse;\n};\n\ntype MultipleUsersResponse = {\n  users: UserResponse[];\n};\n\nconst withUser = (sdk: CoreSdk, managementKey?: string) => ({\n  create: (\n    loginId: string,\n    email?: string,\n    phone?: string,\n    displayName?: string,\n    roles?: string[],\n    userTenants?: AssociatedTenant[],\n  ): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.create,\n        { loginId, email, phone, displayName, roleNames: roles, userTenants },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  update: (\n    loginId: string,\n    email?: string,\n    phone?: string,\n    displayName?: string,\n    roles?: string[],\n    userTenants?: AssociatedTenant[],\n  ): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.update,\n        { loginId, email, phone, displayName, roleNames: roles, userTenants },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  delete: (loginId: string): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(apiPaths.user.delete, { loginId }, { token: managementKey }),\n    ),\n  load: (loginId: string): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.get(apiPaths.user.load, {\n        queryParams: { loginId },\n        token: managementKey,\n      }),\n      (data) => data.user,\n    ),\n  /**\n   * Load an existing user by user ID. The ID can be found\n   * on the user's JWT.\n   * @param userId load a user by this user ID field\n   * @returns The UserResponse if found, throws otherwise.\n   */\n  loadByUserId: (userId: string): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.get(apiPaths.user.load, {\n        queryParams: { userId },\n        token: managementKey,\n      }),\n      (data) => data.user,\n    ),\n  searchAll: (\n    tenantIds?: string[],\n    roles?: string[],\n    limit?: number,\n  ): Promise<SdkResponse<UserResponse[]>> =>\n    transformResponse<MultipleUsersResponse, UserResponse[]>(\n      sdk.httpClient.post(\n        apiPaths.user.search,\n        { tenantIds, roleNames: roles, limit },\n        { token: managementKey },\n      ),\n      (data) => data.users,\n    ),\n  activate: (loginId: string): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.updateStatus,\n        { loginId, status: 'enabled' },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  deactivate: (loginId: string): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.updateStatus,\n        { loginId, status: 'disabled' },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  updateEmail: (\n    loginId: string,\n    email: string,\n    isVerified: boolean,\n  ): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.updateEmail,\n        { loginId, email, verified: isVerified },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  updatePhone: (\n    loginId: string,\n    phone: string,\n    isVerified: boolean,\n  ): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.updatePhone,\n        { loginId, phone, verified: isVerified },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  updateDisplayName: (loginId: string, displayName: string): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.updateDisplayName,\n        { loginId, displayName },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  addRoles: (loginId: string, roles: string[]): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.addRole,\n        { loginId, roleNames: roles },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  removeRoles: (loginId: string, roles: string[]): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.removeRole,\n        { loginId, roleNames: roles },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  addTenant: (loginId: string, tenantId: string): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(apiPaths.user.addTenant, { loginId, tenantId }, { token: managementKey }),\n      (data) => data.user,\n    ),\n  removeTenant: (loginId: string, tenantId: string): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.removeTenant,\n        { loginId, tenantId },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  addTenantRoles: (\n    loginId: string,\n    tenantId: string,\n    roles: string[],\n  ): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.addRole,\n        { loginId, tenantId, roleNames: roles },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  removeTenantRoles: (\n    loginId: string,\n    tenantId: string,\n    roles: string[],\n  ): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.removeRole,\n        { loginId, tenantId, roleNames: roles },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n});\n\nexport default withUser;\n","import { SdkResponse, transformResponse } from '@descope/core-js-sdk';\nimport { CoreSdk } from '../types';\nimport apiPaths from './paths';\nimport { CreateTenantResponse, Tenant } from './types';\n\ntype MultipleTenantResponse = {\n  tenants: Tenant[];\n};\n\nconst withTenant = (sdk: CoreSdk, managementKey?: string) => ({\n  create: (\n    name: string,\n    selfProvisioningDomains?: string[],\n  ): Promise<SdkResponse<CreateTenantResponse>> =>\n    transformResponse(\n      sdk.httpClient.post(\n        apiPaths.tenant.create,\n        { name, selfProvisioningDomains },\n        { token: managementKey },\n      ),\n    ),\n  createWithId: (\n    id: string,\n    name: string,\n    selfProvisioningDomains?: string[],\n  ): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(\n        apiPaths.tenant.create,\n        { id, name, selfProvisioningDomains },\n        { token: managementKey },\n      ),\n    ),\n  update: (\n    id: string,\n    name: string,\n    selfProvisioningDomains?: string[],\n  ): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(\n        apiPaths.tenant.update,\n        { id, name, selfProvisioningDomains },\n        { token: managementKey },\n      ),\n    ),\n  delete: (id: string): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(apiPaths.tenant.delete, { id }, { token: managementKey }),\n    ),\n  loadAll: (): Promise<SdkResponse<Tenant[]>> =>\n    transformResponse<MultipleTenantResponse, Tenant[]>(\n      sdk.httpClient.get(apiPaths.tenant.loadAll, {\n        token: managementKey,\n      }),\n      (data) => data.tenants,\n    ),\n});\n\nexport default withTenant;\n","import { SdkResponse, transformResponse } from '@descope/core-js-sdk';\nimport { CoreSdk } from '../types';\nimport apiPaths from './paths';\nimport { UpdateJWTResponse } from './types';\n\nconst withJWT = (sdk: CoreSdk, managementKey?: string) => ({\n  update: (\n    jwt: string,\n    customClaims?: Record<string, any>,\n  ): Promise<SdkResponse<UpdateJWTResponse>> =>\n    transformResponse(\n      sdk.httpClient.post(apiPaths.jwt.update, { jwt, customClaims }, { token: managementKey }),\n    ),\n});\n\nexport default withJWT;\n","import { SdkResponse, transformResponse } from '@descope/core-js-sdk';\nimport { CoreSdk } from '../types';\nimport apiPaths from './paths';\nimport { Permission } from './types';\n\ntype MultiplePermissionResponse = {\n  permissions: Permission[];\n};\n\nconst withPermission = (sdk: CoreSdk, managementKey?: string) => ({\n  create: (name: string, description?: string): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(\n        apiPaths.permission.create,\n        { name, description },\n        { token: managementKey },\n      ),\n    ),\n  update: (name: string, newName: string, description?: string): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(\n        apiPaths.permission.update,\n        { name, newName, description },\n        { token: managementKey },\n      ),\n    ),\n  delete: (name: string): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(apiPaths.permission.delete, { name }, { token: managementKey }),\n    ),\n  loadAll: (): Promise<SdkResponse<Permission[]>> =>\n    transformResponse<MultiplePermissionResponse, Permission[]>(\n      sdk.httpClient.get(apiPaths.permission.loadAll, {\n        token: managementKey,\n      }),\n      (data) => data.permissions,\n    ),\n});\n\nexport default withPermission;\n","import { SdkResponse, transformResponse } from '@descope/core-js-sdk';\nimport { CoreSdk } from '../types';\nimport apiPaths from './paths';\nimport { Role } from './types';\n\ntype MultipleRoleResponse = {\n  roles: Role[];\n};\n\nconst withRole = (sdk: CoreSdk, managementKey?: string) => ({\n  create: (\n    name: string,\n    description?: string,\n    permissionNames?: string[],\n  ): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(\n        apiPaths.role.create,\n        { name, description, permissionNames },\n        { token: managementKey },\n      ),\n    ),\n  update: (\n    name: string,\n    newName: string,\n    description?: string,\n    permissionNames?: string[],\n  ): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(\n        apiPaths.role.update,\n        { name, newName, description, permissionNames },\n        { token: managementKey },\n      ),\n    ),\n  delete: (name: string): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(apiPaths.role.delete, { name }, { token: managementKey }),\n    ),\n  loadAll: (): Promise<SdkResponse<Role[]>> =>\n    transformResponse<MultipleRoleResponse, Role[]>(\n      sdk.httpClient.get(apiPaths.role.loadAll, {\n        token: managementKey,\n      }),\n      (data) => data.roles,\n    ),\n});\n\nexport default withRole;\n","import { SdkResponse, transformResponse } from '@descope/core-js-sdk';\nimport { CoreSdk } from '../types';\nimport apiPaths from './paths';\nimport { Group } from './types';\n\nconst withGroup = (sdk: CoreSdk, managementKey?: string) => ({\n  /**\n   * Load all groups for a specific tenant id.\n   * @param tenantId Tenant ID to load groups from.\n   * @returns Group[] list of groups\n   */\n  loadAllGroups: (tenantId: string): Promise<SdkResponse<Group[]>> =>\n    transformResponse<Group[]>(\n      sdk.httpClient.post(apiPaths.group.loadAllGroups, { tenantId }, { token: managementKey }),\n    ),\n\n  /**\n   * Load all groups for the provided user IDs or login IDs.\n   * @param tenantId Tenant ID to load groups from.\n   * @param userIds Optional List of user IDs, with the format of \"U2J5ES9S8TkvCgOvcrkpzUgVTEBM\" (example), which can be found on the user's JWT.\n   * @param loginIds Optional List of login IDs, how the user identifies when logging in.\n   * @returns Group[] list of groups\n   */\n  loadAllGroupsForMember: (\n    tenantId: string,\n    userIds: string[],\n    loginIds: string[],\n  ): Promise<SdkResponse<Group[]>> =>\n    transformResponse<Group[]>(\n      sdk.httpClient.post(\n        apiPaths.group.loadAllGroupsForMember,\n        { tenantId, loginIds, userIds },\n        { token: managementKey },\n      ),\n    ),\n\n  /**\n   * Load all members of the provided group id.\n   * @param tenantId Tenant ID to load groups from.\n   * @param groupId Group ID to load members for.\n   * @returns Group[] list of groups\n   */\n  loadAllGroupMembers: (tenantId: string, groupId: string): Promise<SdkResponse<Group[]>> =>\n    transformResponse<Group[]>(\n      sdk.httpClient.post(\n        apiPaths.group.loadAllGroupMembers,\n        { tenantId, groupId },\n        { token: managementKey },\n      ),\n    ),\n});\n\nexport default withGroup;\n","import { SdkResponse, transformResponse } from '@descope/core-js-sdk';\nimport { CoreSdk } from '../types';\nimport apiPaths from './paths';\nimport { RoleMapping, AttributeMapping } from './types';\n\nconst withSSOSettings = (sdk: CoreSdk, managementKey?: string) => ({\n  configureSettings: (\n    tenantId: string,\n    idpURL: string,\n    idpCert: string,\n    entityId: string,\n    redirectURL?: string,\n    domain?: string,\n  ): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(\n        apiPaths.sso.configure,\n        { tenantId, idpURL, entityId, idpCert, redirectURL, domain },\n        { token: managementKey },\n      ),\n    ),\n  configureMetadata: (tenantId: string, idpMetadataURL: string): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(\n        apiPaths.sso.metadata,\n        { tenantId, idpMetadataURL },\n        { token: managementKey },\n      ),\n    ),\n  configureMapping: (\n    tenantId: string,\n    roleMapping?: RoleMapping,\n    attributeMapping?: AttributeMapping,\n  ): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(\n        apiPaths.sso.mapping,\n        { tenantId, roleMapping, attributeMapping },\n        { token: managementKey },\n      ),\n    ),\n});\n\nexport default withSSOSettings;\n","import { SdkResponse, transformResponse } from '@descope/core-js-sdk';\nimport { CoreSdk } from '../types';\nimport apiPaths from './paths';\nimport { AccessKey, AssociatedTenant, CreatedAccessKeyResponse } from './types';\n\ntype SingleKeyResponse = {\n  key: AccessKey;\n};\n\ntype MultipleKeysResponse = {\n  keys: AccessKey[];\n};\n\nconst withAccessKey = (sdk: CoreSdk, managementKey?: string) => ({\n  /**\n   * Create a new access key for a project.\n   * @param name Access key name\n   * @param expireTime When the access key expires. Keep at 0 to make it indefinite.\n   * @param roles Optional roles in the project. Does not apply for multi-tenants\n   * @param keyTenants Optional associated tenants for this key and its roles for each.\n   * @returns A newly created key and its cleartext. Make sure to save the cleartext securely.\n   */\n  create: (\n    name: string,\n    expireTime: number,\n    roles?: string[],\n    keyTenants?: AssociatedTenant[],\n  ): Promise<SdkResponse<CreatedAccessKeyResponse>> =>\n    transformResponse(\n      sdk.httpClient.post(\n        apiPaths.accessKey.create,\n        { name, expireTime, roleNames: roles, keyTenants },\n        { token: managementKey },\n      ),\n    ),\n  /**\n   * Load an access key.\n   * @param id Access key ID to load\n   * @returns The loaded access key.\n   */\n  load: (id: string): Promise<SdkResponse<AccessKey>> =>\n    transformResponse<SingleKeyResponse, AccessKey>(\n      sdk.httpClient.get(apiPaths.accessKey.load, {\n        queryParams: { id },\n        token: managementKey,\n      }),\n      (data) => data.key,\n    ),\n  /**\n   * Search all access keys\n   * @param tenantIds Optional tenant ID filter to apply on the search results\n   * @returns An array of found access keys\n   */\n  searchAll: (tenantIds?: string[]): Promise<SdkResponse<AccessKey[]>> =>\n    transformResponse<MultipleKeysResponse, AccessKey[]>(\n      sdk.httpClient.post(apiPaths.accessKey.search, { tenantIds }, { token: managementKey }),\n      (data) => data.keys,\n    ),\n  /**\n   * Update an access key.\n   * @param id Access key ID to load\n   * @param name The updated access key name\n   * @returns The updated access key\n   */\n  update: (id: string, name: string): Promise<SdkResponse<AccessKey>> =>\n    transformResponse<SingleKeyResponse, AccessKey>(\n      sdk.httpClient.post(apiPaths.accessKey.update, { id, name }, { token: managementKey }),\n      (data) => data.key,\n    ),\n  /**\n   * Deactivate an access key. Deactivated access keys cannot be used until they are\n   * activated again.\n   * @param id Access key ID to deactivate\n   */\n  deactivate: (id: string): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(apiPaths.accessKey.deactivate, { id }, { token: managementKey }),\n    ),\n  /**\n   * Activate an access key. Only deactivated access keys can be activated again.\n   * @param id Access key ID to activate\n   */\n  activate: (id: string): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(apiPaths.accessKey.activate, { id }, { token: managementKey }),\n    ),\n  /**\n   * Delete an access key. IMPORTANT: This cannot be undone. Use carefully.\n   * @param id Access key ID to delete\n   */\n  delete: (id: string): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(apiPaths.accessKey.delete, { id }, { token: managementKey }),\n    ),\n});\n\nexport default withAccessKey;\n","import nodeFetch, { Headers } from 'node-fetch-commonjs';\n\nglobalThis.Headers ??= Headers;\n\nconst highWaterMarkMb = 1024 * 1024 * 1024 * 30; // 30MB\n\n// we are increasing the response buffer size due to an issue where node-fetch hangs when response is too big\nconst patchedFetch = (...args: Parameters<typeof nodeFetch>) => {\n  // we can get Request on the first arg, or RequestInfo on the second arg\n  // we want to make sure we are setting the \"highWaterMark\" so we are doing it on both args\n  args.forEach((arg) => {\n    // eslint-disable-next-line no-param-reassign, @typescript-eslint/no-unused-expressions\n    arg && ((arg as any).highWaterMark ??= highWaterMarkMb);\n  });\n\n  return nodeFetch(...args);\n};\n\nexport default patchedFetch as unknown as typeof fetch;\n","import createSdk, { ExchangeAccessKeyResponse, SdkResponse, wrapWith } from '@descope/core-js-sdk';\nimport { JWK, JWTHeaderParameters, KeyLike, errors, importJWK, jwtVerify } from 'jose';\nimport {\n  permissionsClaimName,\n  refreshTokenCookieName,\n  rolesClaimName,\n  sessionTokenCookieName,\n} from './constants';\nimport { getAuthorizationClaimItems, withCookie } from './helpers';\nimport withManagement from './management';\nimport { AuthenticationInfo } from './types';\nimport fetch from './fetch-polyfill';\n\ndeclare const BUILD_VERSION: string;\n\n/** Configuration arguments which include the Descope core SDK args and an optional management key */\ntype NodeSdkArgs = Parameters<typeof createSdk>[0] & {\n  managementKey?: string;\n};\n\nconst nodeSdk = ({ managementKey, ...config }: NodeSdkArgs) => {\n  const coreSdk = createSdk({\n    ...config,\n    fetch,\n    baseHeaders: {\n      ...config.baseHeaders,\n      'x-descope-sdk-name': 'nodejs',\n      'x-descope-sdk-node-version': process?.versions?.node || '',\n      'x-descope-sdk-version': BUILD_VERSION,\n    },\n  });\n\n  const { projectId, logger } = config;\n\n  const keys: Record<string, KeyLike | Uint8Array> = {};\n\n  /** Fetch the public keys (JWKs) from Descope for the configured project */\n  const fetchKeys = async () => {\n    const keysWrapper = await coreSdk.httpClient\n      .get(`v2/keys/${projectId}`)\n      .then((resp) => resp.json());\n    const publicKeys: JWK[] = keysWrapper.keys;\n    if (!Array.isArray(publicKeys)) return {};\n    const kidJwksPairs = await Promise.all(\n      publicKeys.map(async (key) => [key.kid, await importJWK(key)]),\n    );\n\n    return kidJwksPairs.reduce(\n      (acc, [kid, jwk]) => (kid ? { ...acc, [kid.toString()]: jwk } : acc),\n      {},\n    );\n  };\n\n  const management = withManagement(coreSdk, managementKey);\n\n  const sdk = {\n    ...coreSdk,\n\n    /**\n     * Provides various APIs for managing a Descope project programmatically. A management key must\n     * be provided as an argument when initializing the SDK to use these APIs. Management keys can be\n     * generated in the Descope console.\n     */\n    management,\n\n    /** Get the key that can validate the given JWT KID in the header. Can retrieve the public key from local cache or from Descope. */\n    async getKey(header: JWTHeaderParameters): Promise<KeyLike | Uint8Array> {\n      if (!header?.kid) throw Error('header.kid must not be empty');\n\n      if (keys[header.kid]) return keys[header.kid];\n\n      // do we need to fetch once or every time?\n      Object.assign(keys, await fetchKeys());\n\n      if (!keys[header.kid]) throw Error('failed to fetch matching key');\n\n      return keys[header.kid];\n    },\n\n    /**\n     * Validate the given JWT with the right key and make sure the issuer is correct\n     * @param jwt the JWT string to parse and validate\n     * @returns AuthenticationInfo with the parsed token and JWT. Will throw an error if validation fails.\n     */\n    async validateJwt(jwt: string): Promise<AuthenticationInfo> {\n      // Do not hard-code the algo because library does not support `None` so all are valid\n      const res = await jwtVerify(jwt, sdk.getKey, { clockTolerance: 5 });\n      const token = res.payload;\n\n      if (token) {\n        token.iss = token.iss?.split('/').pop(); // support both url and project id as issuer\n        if (token.iss !== projectId) {\n          // We must do the verification here, since issuer can be either project ID or URL\n          throw new errors.JWTClaimValidationFailed(\n            'unexpected \"iss\" claim value',\n            'iss',\n            'check_failed',\n          );\n        }\n      }\n\n      return { jwt, token };\n    },\n\n    /**\n     * Validate an active session\n     * @param sessionToken session JWT to validate\n     * @returns AuthenticationInfo promise or throws Error if there is an issue with JWTs\n     */\n    async validateSession(sessionToken: string): Promise<AuthenticationInfo> {\n      if (!sessionToken) throw Error('session token is required for validation');\n\n      try {\n        const token = await sdk.validateJwt(sessionToken);\n        return token;\n      } catch (error) {\n        /* istanbul ignore next */\n        logger?.error('session validation failed', error);\n        throw Error('session validation failed');\n      }\n    },\n\n    /**\n     * Refresh the session using a refresh token\n     * @param refreshToken refresh JWT to refresh the session with\n     * @returns AuthenticationInfo promise or throws Error if there is an issue with JWTs\n     */\n    async refreshSession(refreshToken: string): Promise<AuthenticationInfo> {\n      if (!refreshToken) throw Error('refresh token is required to refresh a session');\n\n      try {\n        await sdk.validateJwt(refreshToken);\n        const jwtResp = await sdk.refresh(refreshToken);\n        if (jwtResp.ok) {\n          const token = await sdk.validateJwt(jwtResp.data?.sessionJwt);\n          return token;\n        }\n        /* istanbul ignore next */\n        throw Error(jwtResp.error?.errorMessage);\n      } catch (refreshTokenErr) {\n        /* istanbul ignore next */\n        logger?.error('refresh token validation failed', refreshTokenErr);\n        throw Error('refresh token validation failed');\n      }\n    },\n\n    /**\n     * Validate session and refresh it if it expired\n     * @param sessionToken session JWT\n     * @param refreshToken refresh JWT\n     * @returns AuthenticationInfo promise or throws Error if there is an issue with JWTs\n     */\n    async validateAndRefreshSession(\n      sessionToken?: string,\n      refreshToken?: string,\n    ): Promise<AuthenticationInfo> {\n      if (!sessionToken && !refreshToken) throw Error('both session and refresh tokens are empty');\n\n      try {\n        const token = await sdk.validateSession(sessionToken);\n        return token;\n      } catch (error) {\n        /* istanbul ignore next */\n        logger?.log('session validation failed - trying to refresh it');\n      }\n\n      return sdk.refreshSession(refreshToken);\n    },\n\n    /**\n     * Exchange API key (access key) for a session key\n     * @param accessKey access key to exchange for a session JWT\n     * @returns AuthneticationInfo with session JWT data\n     */\n    async exchangeAccessKey(accessKey: string): Promise<AuthenticationInfo> {\n      if (!accessKey) throw Error('access key must not be empty');\n\n      let resp: SdkResponse<ExchangeAccessKeyResponse>;\n      try {\n        resp = await sdk.accessKey.exchange(accessKey);\n      } catch (error) {\n        logger?.error('failed to exchange access key', error);\n        throw Error('could not exchange access key');\n      }\n\n      const { sessionJwt } = resp.data;\n      if (!sessionJwt) {\n        logger?.error('failed to parse exchange access key response');\n        throw Error('could not exchange access key');\n      }\n\n      try {\n        const token = await sdk.validateJwt(sessionJwt);\n        return token;\n      } catch (error) {\n        logger?.error('failed to parse jwt from access key', error);\n        throw Error('could not exchange access key');\n      }\n    },\n\n    /**\n     * Make sure that all given permissions exist on the parsed JWT top level claims\n     * @param authInfo JWT parsed info\n     * @param permissions list of permissions to make sure they exist on te JWT claims\n     * @returns true if all permissions exist, false otherwise\n     */\n    validatePermissions(authInfo: AuthenticationInfo, permissions: string[]): boolean {\n      return sdk.validateTenantPermissions(authInfo, null, permissions);\n    },\n\n    /**\n     * Make sure that all given permissions exist on the parsed JWT tenant claims\n     * @param authInfo JWT parsed info\n     * @param permissions list of permissions to make sure they exist on te JWT claims\n     * @returns true if all permissions exist, false otherwise\n     */\n    validateTenantPermissions(\n      authInfo: AuthenticationInfo,\n      tenant: string,\n      permissions: string[],\n    ): boolean {\n      const granted = getAuthorizationClaimItems(authInfo, permissionsClaimName, tenant);\n      return permissions.every((perm) => granted.includes(perm));\n    },\n\n    /**\n     * Make sure that all given roles exist on the parsed JWT top level claims\n     * @param authInfo JWT parsed info\n     * @param roles list of roles to make sure they exist on te JWT claims\n     * @returns true if all roles exist, false otherwise\n     */\n    validateRoles(authInfo: AuthenticationInfo, roles: string[]): boolean {\n      return sdk.validateTenantRoles(authInfo, null, roles);\n    },\n\n    /**\n     * Make sure that all given roles exist on the parsed JWT tenant claims\n     * @param authInfo JWT parsed info\n     * @param roles list of roles to make sure they exist on te JWT claims\n     * @returns true if all roles exist, false otherwise\n     */\n    validateTenantRoles(authInfo: AuthenticationInfo, tenant: string, roles: string[]): boolean {\n      const membership = getAuthorizationClaimItems(authInfo, rolesClaimName, tenant);\n      return roles.every((role) => membership.includes(role));\n    },\n  };\n\n  return wrapWith(\n    sdk,\n    [\n      'otp.verify.email',\n      'otp.verify.sms',\n      'otp.verify.whatsapp',\n      'magicLink.verify',\n      'enchantedLink.signUp',\n      'enchantedLink.signIn',\n      'oauth.exchange',\n      'saml.exchange',\n      'totp.verify',\n      'webauthn.signIn.finish',\n      'webauthn.signUp.finish',\n      'refresh',\n    ] as const,\n    withCookie,\n  );\n};\n\n/** Descope SDK client with delivery methods enum.\n *\n * Please see full documentation at {@link https://docs.descope.com/guides Descope Docs}\n * @example Usage\n *\n * ```js\n * import descopeSdk from '@descope/node-sdk';\n *\n * const myProjectId = 'xxx';\n * const sdk = descopeSdk({ projectId: myProjectId });\n *\n * const userLoginId = 'loginId';\n * sdk.otp.signIn.email(userLoginId);\n * const jwtResponse = sdk.otp.verify.email(userLoginId, codeFromEmail);\n * ```\n */\n\nnodeSdk.RefreshTokenCookieName = refreshTokenCookieName;\nnodeSdk.SessionTokenCookieName = sessionTokenCookieName;\n\nexport default nodeSdk;\nexport type { DeliveryMethod, OAuthProvider } from '@descope/core-js-sdk';\n","import { CoreSdk } from '../types';\nimport withUser from './user';\nimport withTenant from './tenant';\nimport withJWT from './jwt';\nimport withPermission from './permission';\nimport withRole from './role';\nimport withGroup from './group';\nimport withSSOSettings from './sso';\nimport withAccessKey from './accesskey';\n\n/** Constructs a higher level Management API that wraps the functions from code-js-sdk */\nconst withManagement = (sdk: CoreSdk, managementKey?: string) => ({\n  user: withUser(sdk, managementKey),\n  accessKey: withAccessKey(sdk, managementKey),\n  tenant: withTenant(sdk, managementKey),\n  sso: withSSOSettings(sdk, managementKey),\n  jwt: withJWT(sdk, managementKey),\n  permission: withPermission(sdk, managementKey),\n  role: withRole(sdk, managementKey),\n  group: withGroup(sdk, managementKey),\n});\n\nexport default withManagement;\n"],"names":["withCookie","fn","async","args","resp","data","_d","refreshJwt","rest","__rest","cookies","options","push","cookieDomain","cookieMaxAge","cookiePath","_a","response","headers","get","cookie","name","match","RegExp","getCookieValue","_b","_c","Object","assign","getAuthorizationClaimItems","authInfo","claim","tenant","value","token","Array","isArray","apiPaths","create","update","delete","load","search","updateStatus","updateEmail","updatePhone","updateDisplayName","addRole","removeRole","addTenant","removeTenant","deactivate","activate","loadAll","configure","metadata","mapping","loadAllGroups","loadAllGroupsForMember","loadAllGroupMembers","withUser","sdk","managementKey","loginId","email","phone","displayName","roles","userTenants","transformResponse","httpClient","post","roleNames","user","queryParams","loadByUserId","userId","searchAll","tenantIds","limit","users","status","isVerified","verified","addRoles","removeRoles","tenantId","addTenantRoles","removeTenantRoles","withTenant","selfProvisioningDomains","createWithId","id","tenants","withJWT","jwt","customClaims","withPermission","description","newName","permissions","withRole","permissionNames","withGroup","userIds","loginIds","groupId","withSSOSettings","configureSettings","idpURL","idpCert","entityId","redirectURL","domain","configureMetadata","idpMetadataURL","configureMapping","roleMapping","attributeMapping","withAccessKey","expireTime","keyTenants","key","keys","globalThis","Headers","patchedFetch","forEach","arg","highWaterMark","nodeFetch","nodeSdk","config","coreSdk","createSdk","fetch","baseHeaders","process","versions","node","projectId","logger","management","accessKey","sso","permission","role","group","withManagement","header","kid","Error","publicKeys","then","json","Promise","all","map","importJWK","reduce","acc","jwk","toString","fetchKeys","jwtVerify","getKey","clockTolerance","payload","iss","split","pop","errors","JWTClaimValidationFailed","sessionToken","validateJwt","error","refreshToken","jwtResp","refresh","ok","sessionJwt","errorMessage","refreshTokenErr","validateSession","log","refreshSession","exchange","validatePermissions","validateTenantPermissions","granted","every","perm","includes","validateRoles","validateTenantRoles","membership","wrapWith","RefreshTokenCookieName","SessionTokenCookieName"],"mappings":"mNAEO,MC+BMA,EACVC,GACDC,SAAUC,eACR,MAAMC,QAAaH,KAAME,GAGzB,IAAKC,EAAKC,KACR,OAAOD,EAIT,IAAIE,EAA0BF,EAAKC,MAA/BE,WAAEA,GAAUD,EAAKE,EAAjBC,EAAAA,OAAAH,EAAA,CAAA,eACJ,MAAMI,EAAoB,GAlCP,IAA8BC,EAgDjD,OAZKJ,EASHG,EAAQE,KA5CZ,GDVoC,SCsDoBL,cA5C5BI,OADuBA,EA6CiBH,QA5CxC,EAAAG,EAASE,eAAgB,gBACnDF,aAAA,EAAAA,EAASG,eAAgB,aACjBH,aAAA,EAAAA,EAASI,aAAc,mCAkCZ,QAAbC,EAAAZ,EAAKa,gBAAQ,IAAAD,OAAA,EAAAA,EAAEE,QAAQC,IAAI,iBAC7BZ,EA3Be,EAACa,EAAmCC,KACzD,MAAMC,EAAQF,eAAAA,EAAQE,MAAMC,OAAO,cAAcF,cACjD,OAAOC,EAAQA,EAAM,GAAK,IAAI,EAyBXE,CACE,QAAbC,EAAArB,EAAKa,gBAAQ,IAAAQ,OAAA,EAAAA,EAAEP,QAAQC,IAAI,cDhDC,OCmD9BT,EAAQE,KAAoB,QAAfc,EAAAtB,EAAKa,gBAAU,IAAAS,OAAA,EAAAA,EAAAR,QAAQC,IAAI,gBAMhCQ,OAAAC,OAAAD,OAAAC,OAAA,CAAA,EAAAxB,GAAM,CAAAC,KAAWsB,OAAAC,OAAAD,OAAAC,OAAA,GAAAxB,EAAKC,MAAM,CAAAE,aAAYG,aAAY,WAUpDmB,EACdC,EACAC,EACAC,WAEA,MAAMC,EAAQD,EAC0C,QAApDP,EAA6C,QAA7CT,EAAAc,EAASI,MAAgC,eAAI,IAAAlB,OAAA,EAAAA,EAAAgB,UAAO,IAAAP,OAAA,EAAAA,EAAGM,GACvDD,EAASI,MAAMH,GACnB,OAAOI,MAAMC,QAAQH,GAASA,EAAQ,EACxC,CC7EA,IAAeI,EACP,CACJC,OAAQ,uBACRC,OAAQ,uBACRC,OAAQ,uBACRC,KAAM,gBACNC,OAAQ,uBACRC,aAAc,8BACdC,YAAa,6BACbC,YAAa,6BACbC,kBAAmB,4BACnBC,QAAS,gCACTC,WAAY,mCACZC,UAAW,kCACXC,aAAc,sCAdHb,EAgBF,CACTC,OAAQ,4BACRG,KAAM,qBACNC,OAAQ,4BACRH,OAAQ,4BACRY,WAAY,gCACZC,SAAU,8BACVZ,OAAQ,6BAvBGH,EAyBL,CACNC,OAAQ,yBACRC,OAAQ,yBACRC,OAAQ,yBACRa,QAAS,uBA7BEhB,EA+BR,CACHiB,UAAW,wBACXC,SAAU,wBACVC,QAAS,wBAlCEnB,EAoCR,CACHE,OAAQ,uBArCGF,EAuCD,CACVC,OAAQ,6BACRC,OAAQ,6BACRC,OAAQ,6BACRa,QAAS,2BA3CEhB,EA6CP,CACJC,OAAQ,uBACRC,OAAQ,uBACRC,OAAQ,uBACRa,QAAS,qBAjDEhB,EAmDN,CACLoB,cAAe,qBACfC,uBAAwB,4BACxBC,oBAAqB,0BC1CzB,MAAMC,EAAW,CAACC,EAAcC,KAA4B,CAC1DxB,OAAQ,CACNyB,EACAC,EACAC,EACAC,EACAC,EACAC,IAEAC,EAAiBA,kBACfR,EAAIS,WAAWC,KACblC,EAAcC,OACd,CAAEyB,UAASC,QAAOC,QAAOC,cAAaM,UAAWL,EAAOC,eACxD,CAAElC,MAAO4B,KAEVzD,GAASA,EAAKoE,OAEnBlC,OAAQ,CACNwB,EACAC,EACAC,EACAC,EACAC,EACAC,IAEAC,EAAiBA,kBACfR,EAAIS,WAAWC,KACblC,EAAcE,OACd,CAAEwB,UAASC,QAAOC,QAAOC,cAAaM,UAAWL,EAAOC,eACxD,CAAElC,MAAO4B,KAEVzD,GAASA,EAAKoE,OAEnBjC,OAASuB,GACPM,EAAAA,kBACER,EAAIS,WAAWC,KAAKlC,EAAcG,OAAQ,CAAEuB,WAAW,CAAE7B,MAAO4B,KAEpErB,KAAOsB,GACLM,EAAAA,kBACER,EAAIS,WAAWnD,IAAIkB,EAAcI,KAAM,CACrCiC,YAAa,CAAEX,WACf7B,MAAO4B,KAERzD,GAASA,EAAKoE,OAQnBE,aAAeC,GACbP,EAAAA,kBACER,EAAIS,WAAWnD,IAAIkB,EAAcI,KAAM,CACrCiC,YAAa,CAAEE,UACf1C,MAAO4B,KAERzD,GAASA,EAAKoE,OAEnBI,UAAW,CACTC,EACAX,EACAY,IAEAV,EAAAA,kBACER,EAAIS,WAAWC,KACblC,EAAcK,OACd,CAAEoC,YAAWN,UAAWL,EAAOY,SAC/B,CAAE7C,MAAO4B,KAEVzD,GAASA,EAAK2E,QAEnB5B,SAAWW,GACTM,EAAAA,kBACER,EAAIS,WAAWC,KACblC,EAAcM,aACd,CAAEoB,UAASkB,OAAQ,WACnB,CAAE/C,MAAO4B,KAEVzD,GAASA,EAAKoE,OAEnBtB,WAAaY,GACXM,EAAAA,kBACER,EAAIS,WAAWC,KACblC,EAAcM,aACd,CAAEoB,UAASkB,OAAQ,YACnB,CAAE/C,MAAO4B,KAEVzD,GAASA,EAAKoE,OAEnB7B,YAAa,CACXmB,EACAC,EACAkB,IAEAb,EAAAA,kBACER,EAAIS,WAAWC,KACblC,EAAcO,YACd,CAAEmB,UAASC,QAAOmB,SAAUD,GAC5B,CAAEhD,MAAO4B,KAEVzD,GAASA,EAAKoE,OAEnB5B,YAAa,CACXkB,EACAE,EACAiB,IAEAb,EAAAA,kBACER,EAAIS,WAAWC,KACblC,EAAcQ,YACd,CAAEkB,UAASE,QAAOkB,SAAUD,GAC5B,CAAEhD,MAAO4B,KAEVzD,GAASA,EAAKoE,OAEnB3B,kBAAmB,CAACiB,EAAiBG,IACnCG,EAAiBA,kBACfR,EAAIS,WAAWC,KACblC,EAAcS,kBACd,CAAEiB,UAASG,eACX,CAAEhC,MAAO4B,KAEVzD,GAASA,EAAKoE,OAEnBW,SAAU,CAACrB,EAAiBI,IAC1BE,EAAiBA,kBACfR,EAAIS,WAAWC,KACblC,EAAcU,QACd,CAAEgB,UAASS,UAAWL,GACtB,CAAEjC,MAAO4B,KAEVzD,GAASA,EAAKoE,OAEnBY,YAAa,CAACtB,EAAiBI,IAC7BE,EAAiBA,kBACfR,EAAIS,WAAWC,KACblC,EAAcW,WACd,CAAEe,UAASS,UAAWL,GACtB,CAAEjC,MAAO4B,KAEVzD,GAASA,EAAKoE,OAEnBxB,UAAW,CAACc,EAAiBuB,IAC3BjB,EAAiBA,kBACfR,EAAIS,WAAWC,KAAKlC,EAAcY,UAAW,CAAEc,UAASuB,YAAY,CAAEpD,MAAO4B,KAC5EzD,GAASA,EAAKoE,OAEnBvB,aAAc,CAACa,EAAiBuB,IAC9BjB,EAAiBA,kBACfR,EAAIS,WAAWC,KACblC,EAAca,aACd,CAAEa,UAASuB,YACX,CAAEpD,MAAO4B,KAEVzD,GAASA,EAAKoE,OAEnBc,eAAgB,CACdxB,EACAuB,EACAnB,IAEAE,EAAAA,kBACER,EAAIS,WAAWC,KACblC,EAAcU,QACd,CAAEgB,UAASuB,WAAUd,UAAWL,GAChC,CAAEjC,MAAO4B,KAEVzD,GAASA,EAAKoE,OAEnBe,kBAAmB,CACjBzB,EACAuB,EACAnB,IAEAE,EAAAA,kBACER,EAAIS,WAAWC,KACblC,EAAcW,WACd,CAAEe,UAASuB,WAAUd,UAAWL,GAChC,CAAEjC,MAAO4B,KAEVzD,GAASA,EAAKoE,SCzLfgB,EAAa,CAAC5B,EAAcC,KAA4B,CAC5DxB,OAAQ,CACNjB,EACAqE,IAEArB,EAAiBA,kBACfR,EAAIS,WAAWC,KACblC,EAAgBC,OAChB,CAAEjB,OAAMqE,2BACR,CAAExD,MAAO4B,KAGf6B,aAAc,CACZC,EACAvE,EACAqE,IAEArB,EAAAA,kBACER,EAAIS,WAAWC,KACblC,EAAgBC,OAChB,CAAEsD,KAAIvE,OAAMqE,2BACZ,CAAExD,MAAO4B,KAGfvB,OAAQ,CACNqD,EACAvE,EACAqE,IAEArB,EAAAA,kBACER,EAAIS,WAAWC,KACblC,EAAgBE,OAChB,CAAEqD,KAAIvE,OAAMqE,2BACZ,CAAExD,MAAO4B,KAGftB,OAASoD,GACPvB,EAAAA,kBACER,EAAIS,WAAWC,KAAKlC,EAAgBG,OAAQ,CAAEoD,MAAM,CAAE1D,MAAO4B,KAEjET,QAAS,IACPgB,EAAiBA,kBACfR,EAAIS,WAAWnD,IAAIkB,EAAgBgB,QAAS,CAC1CnB,MAAO4B,KAERzD,GAASA,EAAKwF,YCjDfC,EAAU,CAACjC,EAAcC,KAA4B,CACzDvB,OAAQ,CACNwD,EACAC,IAEA3B,EAAiBA,kBACfR,EAAIS,WAAWC,KAAKlC,EAAaE,OAAQ,CAAEwD,MAAKC,gBAAgB,CAAE9D,MAAO4B,OCFzEmC,EAAiB,CAACpC,EAAcC,KAA4B,CAChExB,OAAQ,CAACjB,EAAc6E,IACrB7B,EAAiBA,kBACfR,EAAIS,WAAWC,KACblC,EAAoBC,OACpB,CAAEjB,OAAM6E,eACR,CAAEhE,MAAO4B,KAGfvB,OAAQ,CAAClB,EAAc8E,EAAiBD,IACtC7B,EAAAA,kBACER,EAAIS,WAAWC,KACblC,EAAoBE,OACpB,CAAElB,OAAM8E,UAASD,eACjB,CAAEhE,MAAO4B,KAGftB,OAASnB,GACPgD,EAAAA,kBACER,EAAIS,WAAWC,KAAKlC,EAAoBG,OAAQ,CAAEnB,QAAQ,CAAEa,MAAO4B,KAEvET,QAAS,IACPgB,EAAiBA,kBACfR,EAAIS,WAAWnD,IAAIkB,EAAoBgB,QAAS,CAC9CnB,MAAO4B,KAERzD,GAASA,EAAK+F,gBC1BfC,EAAW,CAACxC,EAAcC,KAA4B,CAC1DxB,OAAQ,CACNjB,EACA6E,EACAI,IAEAjC,EAAAA,kBACER,EAAIS,WAAWC,KACblC,EAAcC,OACd,CAAEjB,OAAM6E,cAAaI,mBACrB,CAAEpE,MAAO4B,KAGfvB,OAAQ,CACNlB,EACA8E,EACAD,EACAI,IAEAjC,oBACER,EAAIS,WAAWC,KACblC,EAAcE,OACd,CAAElB,OAAM8E,UAASD,cAAaI,mBAC9B,CAAEpE,MAAO4B,KAGftB,OAASnB,GACPgD,EAAAA,kBACER,EAAIS,WAAWC,KAAKlC,EAAcG,OAAQ,CAAEnB,QAAQ,CAAEa,MAAO4B,KAEjET,QAAS,IACPgB,EAAiBA,kBACfR,EAAIS,WAAWnD,IAAIkB,EAAcgB,QAAS,CACxCnB,MAAO4B,KAERzD,GAASA,EAAK8D,UCvCfoC,EAAY,CAAC1C,EAAcC,KAA4B,CAM3DL,cAAgB6B,GACdjB,EAAAA,kBACER,EAAIS,WAAWC,KAAKlC,EAAeoB,cAAe,CAAE6B,YAAY,CAAEpD,MAAO4B,KAU7EJ,uBAAwB,CACtB4B,EACAkB,EACAC,IAEApC,EAAAA,kBACER,EAAIS,WAAWC,KACblC,EAAeqB,uBACf,CAAE4B,WAAUmB,WAAUD,WACtB,CAAEtE,MAAO4B,KAUfH,oBAAqB,CAAC2B,EAAkBoB,IACtCrC,EAAiBA,kBACfR,EAAIS,WAAWC,KACblC,EAAesB,oBACf,CAAE2B,WAAUoB,WACZ,CAAExE,MAAO4B,OC1CX6C,EAAkB,CAAC9C,EAAcC,KAA4B,CACjE8C,kBAAmB,CACjBtB,EACAuB,EACAC,EACAC,EACAC,EACAC,IAEA5C,EAAiBA,kBACfR,EAAIS,WAAWC,KACblC,EAAaiB,UACb,CAAEgC,WAAUuB,SAAQE,WAAUD,UAASE,cAAaC,UACpD,CAAE/E,MAAO4B,KAGfoD,kBAAmB,CAAC5B,EAAkB6B,IACpC9C,EAAiBA,kBACfR,EAAIS,WAAWC,KACblC,EAAakB,SACb,CAAE+B,WAAU6B,kBACZ,CAAEjF,MAAO4B,KAGfsD,iBAAkB,CAChB9B,EACA+B,EACAC,IAEAjD,EAAAA,kBACER,EAAIS,WAAWC,KACblC,EAAamB,QACb,CAAE8B,WAAU+B,cAAaC,oBACzB,CAAEpF,MAAO4B,OCzBXyD,EAAgB,CAAC1D,EAAcC,KAA4B,CAS/DxB,OAAQ,CACNjB,EACAmG,EACArD,EACAsD,IAEApD,EAAAA,kBACER,EAAIS,WAAWC,KACblC,EAAmBC,OACnB,CAAEjB,OAAMmG,aAAYhD,UAAWL,EAAOsD,cACtC,CAAEvF,MAAO4B,KAQfrB,KAAOmD,GACLvB,EAAAA,kBACER,EAAIS,WAAWnD,IAAIkB,EAAmBI,KAAM,CAC1CiC,YAAa,CAAEkB,MACf1D,MAAO4B,KAERzD,GAASA,EAAKqH,MAOnB7C,UAAYC,GACVT,oBACER,EAAIS,WAAWC,KAAKlC,EAAmBK,OAAQ,CAAEoC,aAAa,CAAE5C,MAAO4B,KACtEzD,GAASA,EAAKsH,OAQnBpF,OAAQ,CAACqD,EAAYvE,IACnBgD,EAAiBA,kBACfR,EAAIS,WAAWC,KAAKlC,EAAmBE,OAAQ,CAAEqD,KAAIvE,QAAQ,CAAEa,MAAO4B,KACrEzD,GAASA,EAAKqH,MAOnBvE,WAAayC,GACXvB,EAAAA,kBACER,EAAIS,WAAWC,KAAKlC,EAAmBc,WAAY,CAAEyC,MAAM,CAAE1D,MAAO4B,KAMxEV,SAAWwC,GACTvB,EAAAA,kBACER,EAAIS,WAAWC,KAAKlC,EAAmBe,SAAU,CAAEwC,MAAM,CAAE1D,MAAO4B,KAMtEtB,OAASoD,GACPvB,EAAAA,kBACER,EAAIS,WAAWC,KAAKlC,EAAmBG,OAAQ,CAAEoD,MAAM,CAAE1D,MAAO4B,aC1FpD,QAAlB9C,EAAA4G,WAAWC,eAAO,IAAA7G,IAAlB4G,WAAWC,QAAYA,EAAOA,SAE9B,MAGMC,EAAe,IAAI3H,KAGvBA,EAAK4H,SAASC,YAEZA,YAAShH,GAAAS,EAAAuG,GAAYC,+BAAAA,cARD,aAQmC,IAGlDC,EAAS,WAAI/H,ICKhBgI,EAAWnH,WAAA8C,cAAEA,GAAuC9C,EAArBoH,EAAM3H,EAAAA,OAAAO,EAA1B,mBACf,MAAMqH,EAAUC,UACX3G,OAAAC,OAAAD,OAAAC,OAAA,CAAA,EAAAwG,UACHG,EACAC,YAAW7G,OAAAC,OAAAD,OAAAC,OAAA,CAAA,EACNwG,EAAOI,cACV,qBAAsB,SACtB,8BAAiD,UAAZ,OAAPC,cAAO,IAAPA,aAAO,EAAPA,QAASC,gBAAU,IAAAjH,OAAA,EAAAA,EAAAkH,OAAQ,GACzD,wBAAyB,cAIvBC,UAAEA,EAASC,OAAEA,GAAWT,EAExBT,EAA6C,CAAA,EAmB7CmB,EC1Ce,EAACjF,EAAcC,KAA4B,CAChEW,KAAMb,EAASC,EAAKC,GACpBiF,UAAWxB,EAAc1D,EAAKC,GAC9B9B,OAAQyD,EAAW5B,EAAKC,GACxBkF,IAAKrC,EAAgB9C,EAAKC,GAC1BiC,IAAKD,EAAQjC,EAAKC,GAClBmF,WAAYhD,EAAepC,EAAKC,GAChCoF,KAAM7C,EAASxC,EAAKC,GACpBqF,MAAO5C,EAAU1C,EAAKC,KDkCHsF,CAAef,EAASvE,GAErCD,iCACDwE,GAAO,CAOVS,aAGA5I,aAAamJ,GACX,KAAKA,aAAA,EAAAA,EAAQC,KAAK,MAAMC,MAAM,gCAE9B,GAAI5B,EAAK0B,EAAOC,KAAM,OAAO3B,EAAK0B,EAAOC,KAKzC,GAFA3H,OAAOC,OAAO+F,OAnCAzH,WAChB,MAGMsJ,SAHoBnB,EAAQ/D,WAC/BnD,IAAI,WAAWyH,KACfa,MAAMrJ,GAASA,EAAKsJ,UACe/B,KACtC,OAAKxF,MAAMC,QAAQoH,UACQG,QAAQC,IACjCJ,EAAWK,KAAI3J,MAAOwH,GAAQ,CAACA,EAAI4B,UAAWQ,EAAAA,UAAUpC,QAGtCqC,QAClB,CAACC,GAAMV,EAAKW,KAAUX,EAAW3H,OAAAC,OAAAD,OAAAC,OAAA,CAAA,EAAAoI,IAAK,CAACV,EAAIY,YAAaD,IAAQD,GAChE,CAAE,GAPmC,EAQtC,EAsB2BG,KAErBxC,EAAK0B,EAAOC,KAAM,MAAMC,MAAM,gCAEnC,OAAO5B,EAAK0B,EAAOC,IACpB,EAODpJ,kBAAkB6F,SAEhB,MACM7D,SADYkI,EAASA,UAACrE,EAAKlC,EAAIwG,OAAQ,CAAEC,eAAgB,KAC7CC,QAElB,GAAIrI,IACFA,EAAMsI,IAAe,QAATxJ,EAAAkB,EAAMsI,WAAG,IAAAxJ,OAAA,EAAAA,EAAEyJ,MAAM,KAAKC,MAC9BxI,EAAMsI,MAAQ5B,GAEhB,MAAM,IAAI+B,EAAMA,OAACC,yBACf,+BACA,MACA,gBAKN,MAAO,CAAE7E,MAAK7D,QACf,EAODhC,sBAAsB2K,GACpB,IAAKA,EAAc,MAAMtB,MAAM,4CAE/B,IAEE,aADoB1F,EAAIiH,YAAYD,EAMrC,CAJC,MAAOE,GAGP,MADAlC,SAAAA,EAAQkC,MAAM,4BAA6BA,GACrCxB,MAAM,4BACb,CACF,EAODrJ,qBAAqB8K,WACnB,IAAKA,EAAc,MAAMzB,MAAM,kDAE/B,UACQ1F,EAAIiH,YAAYE,GACtB,MAAMC,QAAgBpH,EAAIqH,QAAQF,GAClC,GAAIC,EAAQE,GAAI,CAEd,aADoBtH,EAAIiH,YAA0B,QAAd9J,EAAAiK,EAAQ5K,YAAM,IAAAW,OAAA,EAAAA,EAAAoK,WAEnD,CAED,MAAM7B,MAAmB,QAAb9H,EAAAwJ,EAAQF,aAAK,IAAAtJ,OAAA,EAAAA,EAAE4J,aAK5B,CAJC,MAAOC,GAGP,MADAzC,SAAAA,EAAQkC,MAAM,kCAAmCO,GAC3C/B,MAAM,kCACb,CACF,EAQDrJ,gCACE2K,EACAG,GAEA,IAAKH,IAAiBG,EAAc,MAAMzB,MAAM,6CAEhD,IAEE,aADoB1F,EAAI0H,gBAAgBV,EAKzC,CAHC,MAAOE,GAEPlC,SAAAA,EAAQ2C,IAAI,mDACb,CAED,OAAO3H,EAAI4H,eAAeT,EAC3B,EAOD9K,wBAAwB6I,GACtB,IAAKA,EAAW,MAAMQ,MAAM,gCAE5B,IAAInJ,EACJ,IACEA,QAAayD,EAAIkF,UAAU2C,SAAS3C,EAIrC,CAHC,MAAOgC,GAEP,MADAlC,SAAAA,EAAQkC,MAAM,gCAAiCA,GACzCxB,MAAM,gCACb,CAED,MAAM6B,WAAEA,GAAehL,EAAKC,KAC5B,IAAK+K,EAEH,MADAvC,SAAAA,EAAQkC,MAAM,gDACRxB,MAAM,iCAGd,IAEE,aADoB1F,EAAIiH,YAAYM,EAKrC,CAHC,MAAOL,GAEP,MADAlC,SAAAA,EAAQkC,MAAM,sCAAuCA,GAC/CxB,MAAM,gCACb,CACF,EAQDoC,oBAAmB,CAAC7J,EAA8BsE,IACzCvC,EAAI+H,0BAA0B9J,EAAU,KAAMsE,GASvDwF,0BACE9J,EACAE,EACAoE,GAEA,MAAMyF,EAAUhK,EAA2BC,EZrNb,cYqN6CE,GAC3E,OAAOoE,EAAY0F,OAAOC,GAASF,EAAQG,SAASD,IACrD,EAQDE,cAAa,CAACnK,EAA8BqC,IACnCN,EAAIqI,oBAAoBpK,EAAU,KAAMqC,GASjD+H,oBAAoBpK,EAA8BE,EAAgBmC,GAChE,MAAMgI,EAAatK,EAA2BC,EZxOtB,QYwOgDE,GACxE,OAAOmC,EAAM2H,OAAO5C,GAASiD,EAAWH,SAAS9C,IAClD,IAGH,OAAOkD,EAAAA,SACLvI,EACA,CACE,mBACA,iBACA,sBACA,mBACA,uBACA,uBACA,iBACA,gBACA,cACA,yBACA,yBACA,WAEF7D,EACD,EAoBHmI,EAAQkE,uBZ1R8B,MY2RtClE,EAAQmE,uBZzR8B"}
+{"version":3,"file":"index.cjs.js","sources":["../../lib/constants.ts","../../lib/helpers.ts","../../lib/management/paths.ts","../../lib/management/user.ts","../../lib/management/tenant.ts","../../lib/management/jwt.ts","../../lib/management/permission.ts","../../lib/management/role.ts","../../lib/management/group.ts","../../lib/management/sso.ts","../../lib/management/accesskey.ts","../../lib/management/flow.ts","../../lib/management/theme.ts","../../lib/fetch-polyfill.ts","../../lib/index.ts","../../lib/management/index.ts"],"sourcesContent":["// eslint-disable-next-line import/prefer-default-export\n/** Refresh JWT cookie name */\nexport const refreshTokenCookieName = 'DSR';\n/** Session JWT cookie name */\nexport const sessionTokenCookieName = 'DS';\n/** The key of the tenants claims in the claims map */\nexport const authorizedTenantsClaimName = 'tenants';\n/** The key of the permissions claims in the claims map either under tenant or top level */\nexport const permissionsClaimName = 'permissions';\n/** The key of the roles claims in the claims map either under tenant or top level */\nexport const rolesClaimName = 'roles';\n","import type { SdkFnWrapper } from '@descope/core-js-sdk';\nimport { authorizedTenantsClaimName, refreshTokenCookieName } from './constants';\nimport { AuthenticationInfo } from './types';\n\n/**\n * Generate a cookie string from given parameters\n * @param name name of the cookie\n * @param value value of cookie that must be already encoded\n * @param options any options to put on the cookie like cookieDomain, cookieMaxAge, cookiePath\n * @returns Cookie string with all options on the string\n */\nconst generateCookie = (name: string, value: string, options?: Record<string, string | number>) =>\n  `${name}=${value}; Domain=${options?.cookieDomain || ''}; Max-Age=${\n    options?.cookieMaxAge || ''\n  }; Path=${options?.cookiePath || '/'}; HttpOnly; SameSite=Strict`;\n\n/**\n * Parse the cookie string and return the value of the cookie\n * @param cookie the raw cookie string\n * @param name the name of the cookie to get value for\n * @returns the value of the given cookie\n */\nconst getCookieValue = (cookie: string | null | undefined, name: string) => {\n  const match = cookie?.match(RegExp(`(?:^|;\\\\s*)${name}=([^;]*)`));\n  return match ? match[1] : null;\n};\n\n// eslint-disable-next-line import/prefer-default-export\n/**\n * Add cookie generation to core-js functions.\n * @param fn the function we are wrapping\n * @returns Wrapped function with cookie generation\n */\nexport const withCookie: SdkFnWrapper<{ refreshJwt?: string; cookies?: string[] }> =\n  (fn) =>\n  async (...args) => {\n    const resp = await fn(...args);\n\n    // istanbul ignore next\n    if (!resp.data) {\n      return resp;\n    }\n\n    // eslint-disable-next-line prefer-const\n    let { refreshJwt, ...rest } = resp.data;\n    const cookies: string[] = [];\n\n    if (!refreshJwt) {\n      if (resp.response?.headers.get('set-cookie')) {\n        refreshJwt = getCookieValue(\n          resp.response?.headers.get('set-cookie'),\n          refreshTokenCookieName,\n        );\n        cookies.push(resp.response?.headers.get('set-cookie')!);\n      }\n    } else {\n      cookies.push(generateCookie(refreshTokenCookieName, refreshJwt, rest));\n    }\n\n    return { ...resp, data: { ...resp.data, refreshJwt, cookies } };\n  };\n\n/**\n * Get the claim (used for permissions or roles) for a given tenant or top level if tenant is empty\n * @param authInfo The parsed authentication info from the JWT\n * @param claim name of the claim\n * @param tenant tenant to retrieve the claim for\n * @returns\n */\nexport function getAuthorizationClaimItems(\n  authInfo: AuthenticationInfo,\n  claim: string,\n  tenant?: string,\n): string[] {\n  const value = tenant\n    ? authInfo.token[authorizedTenantsClaimName]?.[tenant]?.[claim]\n    : authInfo.token[claim];\n  return Array.isArray(value) ? value : [];\n}\n","/** API paths for the Descope service Management APIs */\nexport default {\n  user: {\n    create: '/v1/mgmt/user/create',\n    update: '/v1/mgmt/user/update',\n    delete: '/v1/mgmt/user/delete',\n    load: '/v1/mgmt/user',\n    search: '/v1/mgmt/user/search',\n    updateStatus: '/v1/mgmt/user/update/status',\n    updateEmail: '/v1/mgmt/user/update/email',\n    updatePhone: '/v1/mgmt/user/update/phone',\n    updateDisplayName: '/v1/mgmt/user/update/name',\n    addRole: '/v1/mgmt/user/update/role/add',\n    removeRole: '/v1/mgmt/user/update/role/remove',\n    addTenant: '/v1/mgmt/user/update/tenant/add',\n    removeTenant: '/v1/mgmt/user/update/tenant/remove',\n  },\n  accessKey: {\n    create: '/v1/mgmt/accesskey/create',\n    load: '/v1/mgmt/accesskey',\n    search: '/v1/mgmt/accesskey/search',\n    update: '/v1/mgmt/accesskey/update',\n    deactivate: '/v1/mgmt/accesskey/deactivate',\n    activate: '/v1/mgmt/accesskey/activate',\n    delete: '/v1/mgmt/accesskey/delete',\n  },\n  tenant: {\n    create: '/v1/mgmt/tenant/create',\n    update: '/v1/mgmt/tenant/update',\n    delete: '/v1/mgmt/tenant/delete',\n    loadAll: '/v1/mgmt/tenant/all',\n  },\n  sso: {\n    configure: '/v1/mgmt/sso/settings',\n    metadata: '/v1/mgmt/sso/metadata',\n    mapping: '/v1/mgmt/sso/mapping',\n  },\n  jwt: {\n    update: '/v1/mgmt/jwt/update',\n  },\n  permission: {\n    create: '/v1/mgmt/permission/create',\n    update: '/v1/mgmt/permission/update',\n    delete: '/v1/mgmt/permission/delete',\n    loadAll: '/v1/mgmt/permission/all',\n  },\n  role: {\n    create: '/v1/mgmt/role/create',\n    update: '/v1/mgmt/role/update',\n    delete: '/v1/mgmt/role/delete',\n    loadAll: '/v1/mgmt/role/all',\n  },\n  flow: {\n    export: '/v1/mgmt/flow/export',\n    import: '/v1/mgmt/flow/import',\n  },\n  theme: {\n    export: '/v1/mgmt/theme/export',\n    import: '/v1/mgmt/theme/import',\n  },\n  group: {\n    loadAllGroups: '/v1/mgmt/group/all',\n    loadAllGroupsForMember: '/v1/mgmt/group/member/all',\n    loadAllGroupMembers: '/v1/mgmt/group/members',\n  },\n};\n","import { SdkResponse, transformResponse, UserResponse } from '@descope/core-js-sdk';\nimport { CoreSdk } from '../types';\nimport apiPaths from './paths';\nimport { AssociatedTenant } from './types';\n\ntype SingleUserResponse = {\n  user: UserResponse;\n};\n\ntype MultipleUsersResponse = {\n  users: UserResponse[];\n};\n\nconst withUser = (sdk: CoreSdk, managementKey?: string) => ({\n  create: (\n    loginId: string,\n    email?: string,\n    phone?: string,\n    displayName?: string,\n    roles?: string[],\n    userTenants?: AssociatedTenant[],\n  ): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.create,\n        { loginId, email, phone, displayName, roleNames: roles, userTenants },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  invite: (\n    loginId: string,\n    email?: string,\n    phone?: string,\n    displayName?: string,\n    roles?: string[],\n    userTenants?: AssociatedTenant[],\n  ): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.create,\n        { loginId, email, phone, displayName, roleNames: roles, userTenants, invite: true },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  update: (\n    loginId: string,\n    email?: string,\n    phone?: string,\n    displayName?: string,\n    roles?: string[],\n    userTenants?: AssociatedTenant[],\n  ): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.update,\n        { loginId, email, phone, displayName, roleNames: roles, userTenants },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  delete: (loginId: string): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(apiPaths.user.delete, { loginId }, { token: managementKey }),\n    ),\n  load: (loginId: string): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.get(apiPaths.user.load, {\n        queryParams: { loginId },\n        token: managementKey,\n      }),\n      (data) => data.user,\n    ),\n  /**\n   * Load an existing user by user ID. The ID can be found\n   * on the user's JWT.\n   * @param userId load a user by this user ID field\n   * @returns The UserResponse if found, throws otherwise.\n   */\n  loadByUserId: (userId: string): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.get(apiPaths.user.load, {\n        queryParams: { userId },\n        token: managementKey,\n      }),\n      (data) => data.user,\n    ),\n  /**\n   * Search all users. Results can be filtered according to tenants and/or\n   * roles, and also paginated used the limit and page parameters.\n   * @param tenantIds optional list of tenant IDs to filter by\n   * @param roles optional list of roles to filter by\n   * @param limit optionally limit the response, leave out for default limit\n   * @param page optionally paginate over the response\n   * @returns An array of UserResponse found by the query\n   */\n  searchAll: (\n    tenantIds?: string[],\n    roles?: string[],\n    limit?: number,\n    page?: number,\n  ): Promise<SdkResponse<UserResponse[]>> =>\n    transformResponse<MultipleUsersResponse, UserResponse[]>(\n      sdk.httpClient.post(\n        apiPaths.user.search,\n        { tenantIds, roleNames: roles, limit, page },\n        { token: managementKey },\n      ),\n      (data) => data.users,\n    ),\n  activate: (loginId: string): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.updateStatus,\n        { loginId, status: 'enabled' },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  deactivate: (loginId: string): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.updateStatus,\n        { loginId, status: 'disabled' },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  updateEmail: (\n    loginId: string,\n    email: string,\n    isVerified: boolean,\n  ): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.updateEmail,\n        { loginId, email, verified: isVerified },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  updatePhone: (\n    loginId: string,\n    phone: string,\n    isVerified: boolean,\n  ): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.updatePhone,\n        { loginId, phone, verified: isVerified },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  updateDisplayName: (loginId: string, displayName: string): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.updateDisplayName,\n        { loginId, displayName },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  addRoles: (loginId: string, roles: string[]): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.addRole,\n        { loginId, roleNames: roles },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  removeRoles: (loginId: string, roles: string[]): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.removeRole,\n        { loginId, roleNames: roles },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  addTenant: (loginId: string, tenantId: string): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(apiPaths.user.addTenant, { loginId, tenantId }, { token: managementKey }),\n      (data) => data.user,\n    ),\n  removeTenant: (loginId: string, tenantId: string): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.removeTenant,\n        { loginId, tenantId },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  addTenantRoles: (\n    loginId: string,\n    tenantId: string,\n    roles: string[],\n  ): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.addRole,\n        { loginId, tenantId, roleNames: roles },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  removeTenantRoles: (\n    loginId: string,\n    tenantId: string,\n    roles: string[],\n  ): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.removeRole,\n        { loginId, tenantId, roleNames: roles },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n});\n\nexport default withUser;\n","import { SdkResponse, transformResponse } from '@descope/core-js-sdk';\nimport { CoreSdk } from '../types';\nimport apiPaths from './paths';\nimport { CreateTenantResponse, Tenant } from './types';\n\ntype MultipleTenantResponse = {\n  tenants: Tenant[];\n};\n\nconst withTenant = (sdk: CoreSdk, managementKey?: string) => ({\n  create: (\n    name: string,\n    selfProvisioningDomains?: string[],\n  ): Promise<SdkResponse<CreateTenantResponse>> =>\n    transformResponse(\n      sdk.httpClient.post(\n        apiPaths.tenant.create,\n        { name, selfProvisioningDomains },\n        { token: managementKey },\n      ),\n    ),\n  createWithId: (\n    id: string,\n    name: string,\n    selfProvisioningDomains?: string[],\n  ): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(\n        apiPaths.tenant.create,\n        { id, name, selfProvisioningDomains },\n        { token: managementKey },\n      ),\n    ),\n  update: (\n    id: string,\n    name: string,\n    selfProvisioningDomains?: string[],\n  ): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(\n        apiPaths.tenant.update,\n        { id, name, selfProvisioningDomains },\n        { token: managementKey },\n      ),\n    ),\n  delete: (id: string): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(apiPaths.tenant.delete, { id }, { token: managementKey }),\n    ),\n  loadAll: (): Promise<SdkResponse<Tenant[]>> =>\n    transformResponse<MultipleTenantResponse, Tenant[]>(\n      sdk.httpClient.get(apiPaths.tenant.loadAll, {\n        token: managementKey,\n      }),\n      (data) => data.tenants,\n    ),\n});\n\nexport default withTenant;\n","import { SdkResponse, transformResponse } from '@descope/core-js-sdk';\nimport { CoreSdk } from '../types';\nimport apiPaths from './paths';\nimport { UpdateJWTResponse } from './types';\n\nconst withJWT = (sdk: CoreSdk, managementKey?: string) => ({\n  update: (\n    jwt: string,\n    customClaims?: Record<string, any>,\n  ): Promise<SdkResponse<UpdateJWTResponse>> =>\n    transformResponse(\n      sdk.httpClient.post(apiPaths.jwt.update, { jwt, customClaims }, { token: managementKey }),\n    ),\n});\n\nexport default withJWT;\n","import { SdkResponse, transformResponse } from '@descope/core-js-sdk';\nimport { CoreSdk } from '../types';\nimport apiPaths from './paths';\nimport { Permission } from './types';\n\ntype MultiplePermissionResponse = {\n  permissions: Permission[];\n};\n\nconst withPermission = (sdk: CoreSdk, managementKey?: string) => ({\n  create: (name: string, description?: string): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(\n        apiPaths.permission.create,\n        { name, description },\n        { token: managementKey },\n      ),\n    ),\n  update: (name: string, newName: string, description?: string): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(\n        apiPaths.permission.update,\n        { name, newName, description },\n        { token: managementKey },\n      ),\n    ),\n  delete: (name: string): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(apiPaths.permission.delete, { name }, { token: managementKey }),\n    ),\n  loadAll: (): Promise<SdkResponse<Permission[]>> =>\n    transformResponse<MultiplePermissionResponse, Permission[]>(\n      sdk.httpClient.get(apiPaths.permission.loadAll, {\n        token: managementKey,\n      }),\n      (data) => data.permissions,\n    ),\n});\n\nexport default withPermission;\n","import { SdkResponse, transformResponse } from '@descope/core-js-sdk';\nimport { CoreSdk } from '../types';\nimport apiPaths from './paths';\nimport { Role } from './types';\n\ntype MultipleRoleResponse = {\n  roles: Role[];\n};\n\nconst withRole = (sdk: CoreSdk, managementKey?: string) => ({\n  create: (\n    name: string,\n    description?: string,\n    permissionNames?: string[],\n  ): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(\n        apiPaths.role.create,\n        { name, description, permissionNames },\n        { token: managementKey },\n      ),\n    ),\n  update: (\n    name: string,\n    newName: string,\n    description?: string,\n    permissionNames?: string[],\n  ): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(\n        apiPaths.role.update,\n        { name, newName, description, permissionNames },\n        { token: managementKey },\n      ),\n    ),\n  delete: (name: string): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(apiPaths.role.delete, { name }, { token: managementKey }),\n    ),\n  loadAll: (): Promise<SdkResponse<Role[]>> =>\n    transformResponse<MultipleRoleResponse, Role[]>(\n      sdk.httpClient.get(apiPaths.role.loadAll, {\n        token: managementKey,\n      }),\n      (data) => data.roles,\n    ),\n});\n\nexport default withRole;\n","import { SdkResponse, transformResponse } from '@descope/core-js-sdk';\nimport { CoreSdk } from '../types';\nimport apiPaths from './paths';\nimport { Group } from './types';\n\nconst withGroup = (sdk: CoreSdk, managementKey?: string) => ({\n  /**\n   * Load all groups for a specific tenant id.\n   * @param tenantId Tenant ID to load groups from.\n   * @returns Group[] list of groups\n   */\n  loadAllGroups: (tenantId: string): Promise<SdkResponse<Group[]>> =>\n    transformResponse<Group[]>(\n      sdk.httpClient.post(apiPaths.group.loadAllGroups, { tenantId }, { token: managementKey }),\n    ),\n\n  /**\n   * Load all groups for the provided user IDs or login IDs.\n   * @param tenantId Tenant ID to load groups from.\n   * @param userIds Optional List of user IDs, with the format of \"U2J5ES9S8TkvCgOvcrkpzUgVTEBM\" (example), which can be found on the user's JWT.\n   * @param loginIds Optional List of login IDs, how the user identifies when logging in.\n   * @returns Group[] list of groups\n   */\n  loadAllGroupsForMember: (\n    tenantId: string,\n    userIds: string[],\n    loginIds: string[],\n  ): Promise<SdkResponse<Group[]>> =>\n    transformResponse<Group[]>(\n      sdk.httpClient.post(\n        apiPaths.group.loadAllGroupsForMember,\n        { tenantId, loginIds, userIds },\n        { token: managementKey },\n      ),\n    ),\n\n  /**\n   * Load all members of the provided group id.\n   * @param tenantId Tenant ID to load groups from.\n   * @param groupId Group ID to load members for.\n   * @returns Group[] list of groups\n   */\n  loadAllGroupMembers: (tenantId: string, groupId: string): Promise<SdkResponse<Group[]>> =>\n    transformResponse<Group[]>(\n      sdk.httpClient.post(\n        apiPaths.group.loadAllGroupMembers,\n        { tenantId, groupId },\n        { token: managementKey },\n      ),\n    ),\n});\n\nexport default withGroup;\n","import { SdkResponse, transformResponse } from '@descope/core-js-sdk';\nimport { CoreSdk } from '../types';\nimport apiPaths from './paths';\nimport { RoleMapping, AttributeMapping } from './types';\n\nconst withSSOSettings = (sdk: CoreSdk, managementKey?: string) => ({\n  configureSettings: (\n    tenantId: string,\n    idpURL: string,\n    idpCert: string,\n    entityId: string,\n    redirectURL?: string,\n    domain?: string,\n  ): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(\n        apiPaths.sso.configure,\n        { tenantId, idpURL, entityId, idpCert, redirectURL, domain },\n        { token: managementKey },\n      ),\n    ),\n  configureMetadata: (tenantId: string, idpMetadataURL: string): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(\n        apiPaths.sso.metadata,\n        { tenantId, idpMetadataURL },\n        { token: managementKey },\n      ),\n    ),\n  configureMapping: (\n    tenantId: string,\n    roleMapping?: RoleMapping,\n    attributeMapping?: AttributeMapping,\n  ): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(\n        apiPaths.sso.mapping,\n        { tenantId, roleMapping, attributeMapping },\n        { token: managementKey },\n      ),\n    ),\n});\n\nexport default withSSOSettings;\n","import { SdkResponse, transformResponse } from '@descope/core-js-sdk';\nimport { CoreSdk } from '../types';\nimport apiPaths from './paths';\nimport { AccessKey, AssociatedTenant, CreatedAccessKeyResponse } from './types';\n\ntype SingleKeyResponse = {\n  key: AccessKey;\n};\n\ntype MultipleKeysResponse = {\n  keys: AccessKey[];\n};\n\nconst withAccessKey = (sdk: CoreSdk, managementKey?: string) => ({\n  /**\n   * Create a new access key for a project.\n   * @param name Access key name\n   * @param expireTime When the access key expires. Keep at 0 to make it indefinite.\n   * @param roles Optional roles in the project. Does not apply for multi-tenants\n   * @param keyTenants Optional associated tenants for this key and its roles for each.\n   * @returns A newly created key and its cleartext. Make sure to save the cleartext securely.\n   */\n  create: (\n    name: string,\n    expireTime: number,\n    roles?: string[],\n    keyTenants?: AssociatedTenant[],\n  ): Promise<SdkResponse<CreatedAccessKeyResponse>> =>\n    transformResponse(\n      sdk.httpClient.post(\n        apiPaths.accessKey.create,\n        { name, expireTime, roleNames: roles, keyTenants },\n        { token: managementKey },\n      ),\n    ),\n  /**\n   * Load an access key.\n   * @param id Access key ID to load\n   * @returns The loaded access key.\n   */\n  load: (id: string): Promise<SdkResponse<AccessKey>> =>\n    transformResponse<SingleKeyResponse, AccessKey>(\n      sdk.httpClient.get(apiPaths.accessKey.load, {\n        queryParams: { id },\n        token: managementKey,\n      }),\n      (data) => data.key,\n    ),\n  /**\n   * Search all access keys\n   * @param tenantIds Optional tenant ID filter to apply on the search results\n   * @returns An array of found access keys\n   */\n  searchAll: (tenantIds?: string[]): Promise<SdkResponse<AccessKey[]>> =>\n    transformResponse<MultipleKeysResponse, AccessKey[]>(\n      sdk.httpClient.post(apiPaths.accessKey.search, { tenantIds }, { token: managementKey }),\n      (data) => data.keys,\n    ),\n  /**\n   * Update an access key.\n   * @param id Access key ID to load\n   * @param name The updated access key name\n   * @returns The updated access key\n   */\n  update: (id: string, name: string): Promise<SdkResponse<AccessKey>> =>\n    transformResponse<SingleKeyResponse, AccessKey>(\n      sdk.httpClient.post(apiPaths.accessKey.update, { id, name }, { token: managementKey }),\n      (data) => data.key,\n    ),\n  /**\n   * Deactivate an access key. Deactivated access keys cannot be used until they are\n   * activated again.\n   * @param id Access key ID to deactivate\n   */\n  deactivate: (id: string): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(apiPaths.accessKey.deactivate, { id }, { token: managementKey }),\n    ),\n  /**\n   * Activate an access key. Only deactivated access keys can be activated again.\n   * @param id Access key ID to activate\n   */\n  activate: (id: string): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(apiPaths.accessKey.activate, { id }, { token: managementKey }),\n    ),\n  /**\n   * Delete an access key. IMPORTANT: This cannot be undone. Use carefully.\n   * @param id Access key ID to delete\n   */\n  delete: (id: string): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(apiPaths.accessKey.delete, { id }, { token: managementKey }),\n    ),\n});\n\nexport default withAccessKey;\n","import { SdkResponse, transformResponse } from '@descope/core-js-sdk';\nimport { CoreSdk } from '../types';\nimport apiPaths from './paths';\nimport { FlowResponse, Screen, Flow } from './types';\n\nconst WithFlow = (sdk: CoreSdk, managementKey?: string) => ({\n  export: (flowId: string): Promise<SdkResponse<FlowResponse>> =>\n    transformResponse(\n      sdk.httpClient.post(apiPaths.flow.export, { flowId }, { token: managementKey }),\n    ),\n  import: (flowId: string, flow: Flow, screens?: Screen[]): Promise<SdkResponse<FlowResponse>> =>\n    transformResponse(\n      sdk.httpClient.post(\n        apiPaths.flow.import,\n        { flowId, flow, screens },\n        { token: managementKey },\n      ),\n    ),\n});\n\nexport default WithFlow;\n","import { SdkResponse, transformResponse } from '@descope/core-js-sdk';\nimport { CoreSdk } from '../types';\nimport apiPaths from './paths';\nimport { Theme, ThemeResponse } from './types';\n\nconst WithTheme = (sdk: CoreSdk, managementKey?: string) => ({\n  export: (): Promise<SdkResponse<ThemeResponse>> =>\n    transformResponse(sdk.httpClient.post(apiPaths.theme.export, {}, { token: managementKey })),\n  import: (theme: Theme): Promise<SdkResponse<ThemeResponse>> =>\n    transformResponse(\n      sdk.httpClient.post(apiPaths.theme.import, { theme }, { token: managementKey }),\n    ),\n});\n\nexport default WithTheme;\n","import nodeFetch, { Headers } from 'node-fetch-commonjs';\n\nglobalThis.Headers ??= Headers;\n\nconst highWaterMarkMb = 1024 * 1024 * 1024 * 30; // 30MB\n\n// we are increasing the response buffer size due to an issue where node-fetch hangs when response is too big\nconst patchedFetch = (...args: Parameters<typeof nodeFetch>) => {\n  // we can get Request on the first arg, or RequestInfo on the second arg\n  // we want to make sure we are setting the \"highWaterMark\" so we are doing it on both args\n  args.forEach((arg) => {\n    // eslint-disable-next-line no-param-reassign, @typescript-eslint/no-unused-expressions\n    arg && ((arg as any).highWaterMark ??= highWaterMarkMb);\n  });\n\n  return nodeFetch(...args);\n};\n\nexport default patchedFetch as unknown as typeof fetch;\n","import createSdk, { ExchangeAccessKeyResponse, SdkResponse, wrapWith } from '@descope/core-js-sdk';\nimport { JWK, JWTHeaderParameters, KeyLike, errors, importJWK, jwtVerify } from 'jose';\nimport {\n  permissionsClaimName,\n  refreshTokenCookieName,\n  rolesClaimName,\n  sessionTokenCookieName,\n} from './constants';\nimport { getAuthorizationClaimItems, withCookie } from './helpers';\nimport withManagement from './management';\nimport { AuthenticationInfo } from './types';\nimport fetch from './fetch-polyfill';\n\ndeclare const BUILD_VERSION: string;\n\n/** Configuration arguments which include the Descope core SDK args and an optional management key */\ntype NodeSdkArgs = Parameters<typeof createSdk>[0] & {\n  managementKey?: string;\n};\n\nconst nodeSdk = ({ managementKey, ...config }: NodeSdkArgs) => {\n  const coreSdk = createSdk({\n    ...config,\n    fetch,\n    baseHeaders: {\n      ...config.baseHeaders,\n      'x-descope-sdk-name': 'nodejs',\n      'x-descope-sdk-node-version': process?.versions?.node || '',\n      'x-descope-sdk-version': BUILD_VERSION,\n    },\n  });\n\n  const { projectId, logger } = config;\n\n  const keys: Record<string, KeyLike | Uint8Array> = {};\n\n  /** Fetch the public keys (JWKs) from Descope for the configured project */\n  const fetchKeys = async () => {\n    const keysWrapper = await coreSdk.httpClient\n      .get(`v2/keys/${projectId}`)\n      .then((resp) => resp.json());\n    const publicKeys: JWK[] = keysWrapper.keys;\n    if (!Array.isArray(publicKeys)) return {};\n    const kidJwksPairs = await Promise.all(\n      publicKeys.map(async (key) => [key.kid, await importJWK(key)]),\n    );\n\n    return kidJwksPairs.reduce(\n      (acc, [kid, jwk]) => (kid ? { ...acc, [kid.toString()]: jwk } : acc),\n      {},\n    );\n  };\n\n  const management = withManagement(coreSdk, managementKey);\n\n  const sdk = {\n    ...coreSdk,\n\n    /**\n     * Provides various APIs for managing a Descope project programmatically. A management key must\n     * be provided as an argument when initializing the SDK to use these APIs. Management keys can be\n     * generated in the Descope console.\n     */\n    management,\n\n    /** Get the key that can validate the given JWT KID in the header. Can retrieve the public key from local cache or from Descope. */\n    async getKey(header: JWTHeaderParameters): Promise<KeyLike | Uint8Array> {\n      if (!header?.kid) throw Error('header.kid must not be empty');\n\n      if (keys[header.kid]) return keys[header.kid];\n\n      // do we need to fetch once or every time?\n      Object.assign(keys, await fetchKeys());\n\n      if (!keys[header.kid]) throw Error('failed to fetch matching key');\n\n      return keys[header.kid];\n    },\n\n    /**\n     * Validate the given JWT with the right key and make sure the issuer is correct\n     * @param jwt the JWT string to parse and validate\n     * @returns AuthenticationInfo with the parsed token and JWT. Will throw an error if validation fails.\n     */\n    async validateJwt(jwt: string): Promise<AuthenticationInfo> {\n      // Do not hard-code the algo because library does not support `None` so all are valid\n      const res = await jwtVerify(jwt, sdk.getKey, { clockTolerance: 5 });\n      const token = res.payload;\n\n      if (token) {\n        token.iss = token.iss?.split('/').pop(); // support both url and project id as issuer\n        if (token.iss !== projectId) {\n          // We must do the verification here, since issuer can be either project ID or URL\n          throw new errors.JWTClaimValidationFailed(\n            'unexpected \"iss\" claim value',\n            'iss',\n            'check_failed',\n          );\n        }\n      }\n\n      return { jwt, token };\n    },\n\n    /**\n     * Validate an active session\n     * @param sessionToken session JWT to validate\n     * @returns AuthenticationInfo promise or throws Error if there is an issue with JWTs\n     */\n    async validateSession(sessionToken: string): Promise<AuthenticationInfo> {\n      if (!sessionToken) throw Error('session token is required for validation');\n\n      try {\n        const token = await sdk.validateJwt(sessionToken);\n        return token;\n      } catch (error) {\n        /* istanbul ignore next */\n        logger?.error('session validation failed', error);\n        throw Error('session validation failed');\n      }\n    },\n\n    /**\n     * Refresh the session using a refresh token\n     * @param refreshToken refresh JWT to refresh the session with\n     * @returns AuthenticationInfo promise or throws Error if there is an issue with JWTs\n     */\n    async refreshSession(refreshToken: string): Promise<AuthenticationInfo> {\n      if (!refreshToken) throw Error('refresh token is required to refresh a session');\n\n      try {\n        await sdk.validateJwt(refreshToken);\n        const jwtResp = await sdk.refresh(refreshToken);\n        if (jwtResp.ok) {\n          const token = await sdk.validateJwt(jwtResp.data?.sessionJwt);\n          return token;\n        }\n        /* istanbul ignore next */\n        throw Error(jwtResp.error?.errorMessage);\n      } catch (refreshTokenErr) {\n        /* istanbul ignore next */\n        logger?.error('refresh token validation failed', refreshTokenErr);\n        throw Error('refresh token validation failed');\n      }\n    },\n\n    /**\n     * Validate session and refresh it if it expired\n     * @param sessionToken session JWT\n     * @param refreshToken refresh JWT\n     * @returns AuthenticationInfo promise or throws Error if there is an issue with JWTs\n     */\n    async validateAndRefreshSession(\n      sessionToken?: string,\n      refreshToken?: string,\n    ): Promise<AuthenticationInfo> {\n      if (!sessionToken && !refreshToken) throw Error('both session and refresh tokens are empty');\n\n      try {\n        const token = await sdk.validateSession(sessionToken);\n        return token;\n      } catch (error) {\n        /* istanbul ignore next */\n        logger?.log('session validation failed - trying to refresh it');\n      }\n\n      return sdk.refreshSession(refreshToken);\n    },\n\n    /**\n     * Exchange API key (access key) for a session key\n     * @param accessKey access key to exchange for a session JWT\n     * @returns AuthneticationInfo with session JWT data\n     */\n    async exchangeAccessKey(accessKey: string): Promise<AuthenticationInfo> {\n      if (!accessKey) throw Error('access key must not be empty');\n\n      let resp: SdkResponse<ExchangeAccessKeyResponse>;\n      try {\n        resp = await sdk.accessKey.exchange(accessKey);\n      } catch (error) {\n        logger?.error('failed to exchange access key', error);\n        throw Error('could not exchange access key');\n      }\n\n      const { sessionJwt } = resp.data;\n      if (!sessionJwt) {\n        logger?.error('failed to parse exchange access key response');\n        throw Error('could not exchange access key');\n      }\n\n      try {\n        const token = await sdk.validateJwt(sessionJwt);\n        return token;\n      } catch (error) {\n        logger?.error('failed to parse jwt from access key', error);\n        throw Error('could not exchange access key');\n      }\n    },\n\n    /**\n     * Make sure that all given permissions exist on the parsed JWT top level claims\n     * @param authInfo JWT parsed info\n     * @param permissions list of permissions to make sure they exist on te JWT claims\n     * @returns true if all permissions exist, false otherwise\n     */\n    validatePermissions(authInfo: AuthenticationInfo, permissions: string[]): boolean {\n      return sdk.validateTenantPermissions(authInfo, null, permissions);\n    },\n\n    /**\n     * Make sure that all given permissions exist on the parsed JWT tenant claims\n     * @param authInfo JWT parsed info\n     * @param permissions list of permissions to make sure they exist on te JWT claims\n     * @returns true if all permissions exist, false otherwise\n     */\n    validateTenantPermissions(\n      authInfo: AuthenticationInfo,\n      tenant: string,\n      permissions: string[],\n    ): boolean {\n      const granted = getAuthorizationClaimItems(authInfo, permissionsClaimName, tenant);\n      return permissions.every((perm) => granted.includes(perm));\n    },\n\n    /**\n     * Make sure that all given roles exist on the parsed JWT top level claims\n     * @param authInfo JWT parsed info\n     * @param roles list of roles to make sure they exist on te JWT claims\n     * @returns true if all roles exist, false otherwise\n     */\n    validateRoles(authInfo: AuthenticationInfo, roles: string[]): boolean {\n      return sdk.validateTenantRoles(authInfo, null, roles);\n    },\n\n    /**\n     * Make sure that all given roles exist on the parsed JWT tenant claims\n     * @param authInfo JWT parsed info\n     * @param roles list of roles to make sure they exist on te JWT claims\n     * @returns true if all roles exist, false otherwise\n     */\n    validateTenantRoles(authInfo: AuthenticationInfo, tenant: string, roles: string[]): boolean {\n      const membership = getAuthorizationClaimItems(authInfo, rolesClaimName, tenant);\n      return roles.every((role) => membership.includes(role));\n    },\n  };\n\n  return wrapWith(\n    sdk,\n    [\n      'otp.verify.email',\n      'otp.verify.sms',\n      'otp.verify.whatsapp',\n      'magicLink.verify',\n      'enchantedLink.signUp',\n      'enchantedLink.signIn',\n      'oauth.exchange',\n      'saml.exchange',\n      'totp.verify',\n      'webauthn.signIn.finish',\n      'webauthn.signUp.finish',\n      'refresh',\n    ] as const,\n    withCookie,\n  );\n};\n\n/** Descope SDK client with delivery methods enum.\n *\n * Please see full documentation at {@link https://docs.descope.com/guides Descope Docs}\n * @example Usage\n *\n * ```js\n * import descopeSdk from '@descope/node-sdk';\n *\n * const myProjectId = 'xxx';\n * const sdk = descopeSdk({ projectId: myProjectId });\n *\n * const userLoginId = 'loginId';\n * sdk.otp.signIn.email(userLoginId);\n * const jwtResponse = sdk.otp.verify.email(userLoginId, codeFromEmail);\n * ```\n */\n\nnodeSdk.RefreshTokenCookieName = refreshTokenCookieName;\nnodeSdk.SessionTokenCookieName = sessionTokenCookieName;\n\nexport default nodeSdk;\nexport type { DeliveryMethod, OAuthProvider } from '@descope/core-js-sdk';\n","import { CoreSdk } from '../types';\nimport withUser from './user';\nimport withTenant from './tenant';\nimport withJWT from './jwt';\nimport withPermission from './permission';\nimport withRole from './role';\nimport withGroup from './group';\nimport withSSOSettings from './sso';\nimport withAccessKey from './accesskey';\nimport WithFlow from './flow';\nimport WithTheme from './theme';\n\n/** Constructs a higher level Management API that wraps the functions from code-js-sdk */\nconst withManagement = (sdk: CoreSdk, managementKey?: string) => ({\n  user: withUser(sdk, managementKey),\n  accessKey: withAccessKey(sdk, managementKey),\n  tenant: withTenant(sdk, managementKey),\n  sso: withSSOSettings(sdk, managementKey),\n  jwt: withJWT(sdk, managementKey),\n  permission: withPermission(sdk, managementKey),\n  role: withRole(sdk, managementKey),\n  group: withGroup(sdk, managementKey),\n  flow: WithFlow(sdk, managementKey),\n  theme: WithTheme(sdk, managementKey),\n});\n\nexport default withManagement;\n"],"names":["withCookie","fn","async","args","resp","data","_d","refreshJwt","rest","__rest","cookies","options","push","cookieDomain","cookieMaxAge","cookiePath","_a","response","headers","get","cookie","name","match","RegExp","getCookieValue","_b","_c","Object","assign","getAuthorizationClaimItems","authInfo","claim","tenant","value","token","Array","isArray","apiPaths","create","update","delete","load","search","updateStatus","updateEmail","updatePhone","updateDisplayName","addRole","removeRole","addTenant","removeTenant","deactivate","activate","loadAll","configure","metadata","mapping","export","import","loadAllGroups","loadAllGroupsForMember","loadAllGroupMembers","withUser","sdk","managementKey","loginId","email","phone","displayName","roles","userTenants","transformResponse","httpClient","post","roleNames","user","invite","queryParams","loadByUserId","userId","searchAll","tenantIds","limit","page","users","status","isVerified","verified","addRoles","removeRoles","tenantId","addTenantRoles","removeTenantRoles","withTenant","selfProvisioningDomains","createWithId","id","tenants","withJWT","jwt","customClaims","withPermission","description","newName","permissions","withRole","permissionNames","withGroup","userIds","loginIds","groupId","withSSOSettings","configureSettings","idpURL","idpCert","entityId","redirectURL","domain","configureMetadata","idpMetadataURL","configureMapping","roleMapping","attributeMapping","withAccessKey","expireTime","keyTenants","key","keys","WithFlow","flowId","flow","screens","WithTheme","theme","globalThis","Headers","patchedFetch","forEach","arg","highWaterMark","nodeFetch","nodeSdk","config","coreSdk","createSdk","fetch","baseHeaders","process","versions","node","projectId","logger","management","accessKey","sso","permission","role","group","withManagement","header","kid","Error","publicKeys","then","json","Promise","all","map","importJWK","reduce","acc","jwk","toString","fetchKeys","jwtVerify","getKey","clockTolerance","payload","iss","split","pop","errors","JWTClaimValidationFailed","sessionToken","validateJwt","error","refreshToken","jwtResp","refresh","ok","sessionJwt","errorMessage","refreshTokenErr","validateSession","log","refreshSession","exchange","validatePermissions","validateTenantPermissions","granted","every","perm","includes","validateRoles","validateTenantRoles","membership","wrapWith","RefreshTokenCookieName","SessionTokenCookieName"],"mappings":"mNAEO,MC+BMA,EACVC,GACDC,SAAUC,eACR,MAAMC,QAAaH,KAAME,GAGzB,IAAKC,EAAKC,KACR,OAAOD,EAIT,IAAIE,EAA0BF,EAAKC,MAA/BE,WAAEA,GAAUD,EAAKE,EAAjBC,EAAAA,OAAAH,EAAA,CAAA,eACJ,MAAMI,EAAoB,GAlCP,IAA8BC,EAgDjD,OAZKJ,EASHG,EAAQE,KA5CZ,GDVoC,SCsDoBL,cA5C5BI,OADuBA,EA6CiBH,QA5CxC,EAAAG,EAASE,eAAgB,gBACnDF,aAAA,EAAAA,EAASG,eAAgB,aACjBH,aAAA,EAAAA,EAASI,aAAc,mCAkCZ,QAAbC,EAAAZ,EAAKa,gBAAQ,IAAAD,OAAA,EAAAA,EAAEE,QAAQC,IAAI,iBAC7BZ,EA3Be,EAACa,EAAmCC,KACzD,MAAMC,EAAQF,eAAAA,EAAQE,MAAMC,OAAO,cAAcF,cACjD,OAAOC,EAAQA,EAAM,GAAK,IAAI,EAyBXE,CACE,QAAbC,EAAArB,EAAKa,gBAAQ,IAAAQ,OAAA,EAAAA,EAAEP,QAAQC,IAAI,cDhDC,OCmD9BT,EAAQE,KAAoB,QAAfc,EAAAtB,EAAKa,gBAAU,IAAAS,OAAA,EAAAA,EAAAR,QAAQC,IAAI,gBAMhCQ,OAAAC,OAAAD,OAAAC,OAAA,CAAA,EAAAxB,GAAM,CAAAC,KAAWsB,OAAAC,OAAAD,OAAAC,OAAA,GAAAxB,EAAKC,MAAM,CAAAE,aAAYG,aAAY,WAUpDmB,EACdC,EACAC,EACAC,WAEA,MAAMC,EAAQD,EAC0C,QAApDP,EAA6C,QAA7CT,EAAAc,EAASI,MAAgC,eAAI,IAAAlB,OAAA,EAAAA,EAAAgB,UAAO,IAAAP,OAAA,EAAAA,EAAGM,GACvDD,EAASI,MAAMH,GACnB,OAAOI,MAAMC,QAAQH,GAASA,EAAQ,EACxC,CC7EA,IAAeI,EACP,CACJC,OAAQ,uBACRC,OAAQ,uBACRC,OAAQ,uBACRC,KAAM,gBACNC,OAAQ,uBACRC,aAAc,8BACdC,YAAa,6BACbC,YAAa,6BACbC,kBAAmB,4BACnBC,QAAS,gCACTC,WAAY,mCACZC,UAAW,kCACXC,aAAc,sCAdHb,EAgBF,CACTC,OAAQ,4BACRG,KAAM,qBACNC,OAAQ,4BACRH,OAAQ,4BACRY,WAAY,gCACZC,SAAU,8BACVZ,OAAQ,6BAvBGH,EAyBL,CACNC,OAAQ,yBACRC,OAAQ,yBACRC,OAAQ,yBACRa,QAAS,uBA7BEhB,EA+BR,CACHiB,UAAW,wBACXC,SAAU,wBACVC,QAAS,wBAlCEnB,EAoCR,CACHE,OAAQ,uBArCGF,EAuCD,CACVC,OAAQ,6BACRC,OAAQ,6BACRC,OAAQ,6BACRa,QAAS,2BA3CEhB,EA6CP,CACJC,OAAQ,uBACRC,OAAQ,uBACRC,OAAQ,uBACRa,QAAS,qBAjDEhB,EAmDP,CACJoB,OAAQ,uBACRC,OAAQ,wBArDGrB,EAuDN,CACLoB,OAAQ,wBACRC,OAAQ,yBAzDGrB,EA2DN,CACLsB,cAAe,qBACfC,uBAAwB,4BACxBC,oBAAqB,0BClDzB,MAAMC,EAAW,CAACC,EAAcC,KAA4B,CAC1D1B,OAAQ,CACN2B,EACAC,EACAC,EACAC,EACAC,EACAC,IAEAC,EAAiBA,kBACfR,EAAIS,WAAWC,KACbpC,EAAcC,OACd,CAAE2B,UAASC,QAAOC,QAAOC,cAAaM,UAAWL,EAAOC,eACxD,CAAEpC,MAAO8B,KAEV3D,GAASA,EAAKsE,OAEnBC,OAAQ,CACNX,EACAC,EACAC,EACAC,EACAC,EACAC,IAEAC,EAAAA,kBACER,EAAIS,WAAWC,KACbpC,EAAcC,OACd,CAAE2B,UAASC,QAAOC,QAAOC,cAAaM,UAAWL,EAAOC,cAAaM,QAAQ,GAC7E,CAAE1C,MAAO8B,KAEV3D,GAASA,EAAKsE,OAEnBpC,OAAQ,CACN0B,EACAC,EACAC,EACAC,EACAC,EACAC,IAEAC,EAAiBA,kBACfR,EAAIS,WAAWC,KACbpC,EAAcE,OACd,CAAE0B,UAASC,QAAOC,QAAOC,cAAaM,UAAWL,EAAOC,eACxD,CAAEpC,MAAO8B,KAEV3D,GAASA,EAAKsE,OAEnBnC,OAASyB,GACPM,EAAAA,kBACER,EAAIS,WAAWC,KAAKpC,EAAcG,OAAQ,CAAEyB,WAAW,CAAE/B,MAAO8B,KAEpEvB,KAAOwB,GACLM,EAAAA,kBACER,EAAIS,WAAWrD,IAAIkB,EAAcI,KAAM,CACrCoC,YAAa,CAAEZ,WACf/B,MAAO8B,KAER3D,GAASA,EAAKsE,OAQnBG,aAAeC,GACbR,EAAAA,kBACER,EAAIS,WAAWrD,IAAIkB,EAAcI,KAAM,CACrCoC,YAAa,CAAEE,UACf7C,MAAO8B,KAER3D,GAASA,EAAKsE,OAWnBK,UAAW,CACTC,EACAZ,EACAa,EACAC,IAEAZ,oBACER,EAAIS,WAAWC,KACbpC,EAAcK,OACd,CAAEuC,YAAWP,UAAWL,EAAOa,QAAOC,QACtC,CAAEjD,MAAO8B,KAEV3D,GAASA,EAAK+E,QAEnBhC,SAAWa,GACTM,EAAAA,kBACER,EAAIS,WAAWC,KACbpC,EAAcM,aACd,CAAEsB,UAASoB,OAAQ,WACnB,CAAEnD,MAAO8B,KAEV3D,GAASA,EAAKsE,OAEnBxB,WAAac,GACXM,EAAAA,kBACER,EAAIS,WAAWC,KACbpC,EAAcM,aACd,CAAEsB,UAASoB,OAAQ,YACnB,CAAEnD,MAAO8B,KAEV3D,GAASA,EAAKsE,OAEnB/B,YAAa,CACXqB,EACAC,EACAoB,IAEAf,EAAAA,kBACER,EAAIS,WAAWC,KACbpC,EAAcO,YACd,CAAEqB,UAASC,QAAOqB,SAAUD,GAC5B,CAAEpD,MAAO8B,KAEV3D,GAASA,EAAKsE,OAEnB9B,YAAa,CACXoB,EACAE,EACAmB,IAEAf,EAAAA,kBACER,EAAIS,WAAWC,KACbpC,EAAcQ,YACd,CAAEoB,UAASE,QAAOoB,SAAUD,GAC5B,CAAEpD,MAAO8B,KAEV3D,GAASA,EAAKsE,OAEnB7B,kBAAmB,CAACmB,EAAiBG,IACnCG,EAAiBA,kBACfR,EAAIS,WAAWC,KACbpC,EAAcS,kBACd,CAAEmB,UAASG,eACX,CAAElC,MAAO8B,KAEV3D,GAASA,EAAKsE,OAEnBa,SAAU,CAACvB,EAAiBI,IAC1BE,EAAiBA,kBACfR,EAAIS,WAAWC,KACbpC,EAAcU,QACd,CAAEkB,UAASS,UAAWL,GACtB,CAAEnC,MAAO8B,KAEV3D,GAASA,EAAKsE,OAEnBc,YAAa,CAACxB,EAAiBI,IAC7BE,EAAiBA,kBACfR,EAAIS,WAAWC,KACbpC,EAAcW,WACd,CAAEiB,UAASS,UAAWL,GACtB,CAAEnC,MAAO8B,KAEV3D,GAASA,EAAKsE,OAEnB1B,UAAW,CAACgB,EAAiByB,IAC3BnB,EAAiBA,kBACfR,EAAIS,WAAWC,KAAKpC,EAAcY,UAAW,CAAEgB,UAASyB,YAAY,CAAExD,MAAO8B,KAC5E3D,GAASA,EAAKsE,OAEnBzB,aAAc,CAACe,EAAiByB,IAC9BnB,EAAiBA,kBACfR,EAAIS,WAAWC,KACbpC,EAAca,aACd,CAAEe,UAASyB,YACX,CAAExD,MAAO8B,KAEV3D,GAASA,EAAKsE,OAEnBgB,eAAgB,CACd1B,EACAyB,EACArB,IAEAE,EAAAA,kBACER,EAAIS,WAAWC,KACbpC,EAAcU,QACd,CAAEkB,UAASyB,WAAUhB,UAAWL,GAChC,CAAEnC,MAAO8B,KAEV3D,GAASA,EAAKsE,OAEnBiB,kBAAmB,CACjB3B,EACAyB,EACArB,IAEAE,EAAAA,kBACER,EAAIS,WAAWC,KACbpC,EAAcW,WACd,CAAEiB,UAASyB,WAAUhB,UAAWL,GAChC,CAAEnC,MAAO8B,KAEV3D,GAASA,EAAKsE,SCnNfkB,EAAa,CAAC9B,EAAcC,KAA4B,CAC5D1B,OAAQ,CACNjB,EACAyE,IAEAvB,EAAiBA,kBACfR,EAAIS,WAAWC,KACbpC,EAAgBC,OAChB,CAAEjB,OAAMyE,2BACR,CAAE5D,MAAO8B,KAGf+B,aAAc,CACZC,EACA3E,EACAyE,IAEAvB,EAAAA,kBACER,EAAIS,WAAWC,KACbpC,EAAgBC,OAChB,CAAE0D,KAAI3E,OAAMyE,2BACZ,CAAE5D,MAAO8B,KAGfzB,OAAQ,CACNyD,EACA3E,EACAyE,IAEAvB,EAAAA,kBACER,EAAIS,WAAWC,KACbpC,EAAgBE,OAChB,CAAEyD,KAAI3E,OAAMyE,2BACZ,CAAE5D,MAAO8B,KAGfxB,OAASwD,GACPzB,EAAAA,kBACER,EAAIS,WAAWC,KAAKpC,EAAgBG,OAAQ,CAAEwD,MAAM,CAAE9D,MAAO8B,KAEjEX,QAAS,IACPkB,EAAiBA,kBACfR,EAAIS,WAAWrD,IAAIkB,EAAgBgB,QAAS,CAC1CnB,MAAO8B,KAER3D,GAASA,EAAK4F,YCjDfC,EAAU,CAACnC,EAAcC,KAA4B,CACzDzB,OAAQ,CACN4D,EACAC,IAEA7B,EAAiBA,kBACfR,EAAIS,WAAWC,KAAKpC,EAAaE,OAAQ,CAAE4D,MAAKC,gBAAgB,CAAElE,MAAO8B,OCFzEqC,EAAiB,CAACtC,EAAcC,KAA4B,CAChE1B,OAAQ,CAACjB,EAAciF,IACrB/B,EAAiBA,kBACfR,EAAIS,WAAWC,KACbpC,EAAoBC,OACpB,CAAEjB,OAAMiF,eACR,CAAEpE,MAAO8B,KAGfzB,OAAQ,CAAClB,EAAckF,EAAiBD,IACtC/B,EAAAA,kBACER,EAAIS,WAAWC,KACbpC,EAAoBE,OACpB,CAAElB,OAAMkF,UAASD,eACjB,CAAEpE,MAAO8B,KAGfxB,OAASnB,GACPkD,EAAAA,kBACER,EAAIS,WAAWC,KAAKpC,EAAoBG,OAAQ,CAAEnB,QAAQ,CAAEa,MAAO8B,KAEvEX,QAAS,IACPkB,EAAiBA,kBACfR,EAAIS,WAAWrD,IAAIkB,EAAoBgB,QAAS,CAC9CnB,MAAO8B,KAER3D,GAASA,EAAKmG,gBC1BfC,EAAW,CAAC1C,EAAcC,KAA4B,CAC1D1B,OAAQ,CACNjB,EACAiF,EACAI,IAEAnC,EAAAA,kBACER,EAAIS,WAAWC,KACbpC,EAAcC,OACd,CAAEjB,OAAMiF,cAAaI,mBACrB,CAAExE,MAAO8B,KAGfzB,OAAQ,CACNlB,EACAkF,EACAD,EACAI,IAEAnC,oBACER,EAAIS,WAAWC,KACbpC,EAAcE,OACd,CAAElB,OAAMkF,UAASD,cAAaI,mBAC9B,CAAExE,MAAO8B,KAGfxB,OAASnB,GACPkD,EAAAA,kBACER,EAAIS,WAAWC,KAAKpC,EAAcG,OAAQ,CAAEnB,QAAQ,CAAEa,MAAO8B,KAEjEX,QAAS,IACPkB,EAAiBA,kBACfR,EAAIS,WAAWrD,IAAIkB,EAAcgB,QAAS,CACxCnB,MAAO8B,KAER3D,GAASA,EAAKgE,UCvCfsC,EAAY,CAAC5C,EAAcC,KAA4B,CAM3DL,cAAgB+B,GACdnB,EAAAA,kBACER,EAAIS,WAAWC,KAAKpC,EAAesB,cAAe,CAAE+B,YAAY,CAAExD,MAAO8B,KAU7EJ,uBAAwB,CACtB8B,EACAkB,EACAC,IAEAtC,EAAAA,kBACER,EAAIS,WAAWC,KACbpC,EAAeuB,uBACf,CAAE8B,WAAUmB,WAAUD,WACtB,CAAE1E,MAAO8B,KAUfH,oBAAqB,CAAC6B,EAAkBoB,IACtCvC,EAAiBA,kBACfR,EAAIS,WAAWC,KACbpC,EAAewB,oBACf,CAAE6B,WAAUoB,WACZ,CAAE5E,MAAO8B,OC1CX+C,EAAkB,CAAChD,EAAcC,KAA4B,CACjEgD,kBAAmB,CACjBtB,EACAuB,EACAC,EACAC,EACAC,EACAC,IAEA9C,EAAiBA,kBACfR,EAAIS,WAAWC,KACbpC,EAAaiB,UACb,CAAEoC,WAAUuB,SAAQE,WAAUD,UAASE,cAAaC,UACpD,CAAEnF,MAAO8B,KAGfsD,kBAAmB,CAAC5B,EAAkB6B,IACpChD,EAAiBA,kBACfR,EAAIS,WAAWC,KACbpC,EAAakB,SACb,CAAEmC,WAAU6B,kBACZ,CAAErF,MAAO8B,KAGfwD,iBAAkB,CAChB9B,EACA+B,EACAC,IAEAnD,EAAAA,kBACER,EAAIS,WAAWC,KACbpC,EAAamB,QACb,CAAEkC,WAAU+B,cAAaC,oBACzB,CAAExF,MAAO8B,OCzBX2D,EAAgB,CAAC5D,EAAcC,KAA4B,CAS/D1B,OAAQ,CACNjB,EACAuG,EACAvD,EACAwD,IAEAtD,EAAAA,kBACER,EAAIS,WAAWC,KACbpC,EAAmBC,OACnB,CAAEjB,OAAMuG,aAAYlD,UAAWL,EAAOwD,cACtC,CAAE3F,MAAO8B,KAQfvB,KAAOuD,GACLzB,EAAAA,kBACER,EAAIS,WAAWrD,IAAIkB,EAAmBI,KAAM,CAC1CoC,YAAa,CAAEmB,MACf9D,MAAO8B,KAER3D,GAASA,EAAKyH,MAOnB9C,UAAYC,GACVV,oBACER,EAAIS,WAAWC,KAAKpC,EAAmBK,OAAQ,CAAEuC,aAAa,CAAE/C,MAAO8B,KACtE3D,GAASA,EAAK0H,OAQnBxF,OAAQ,CAACyD,EAAY3E,IACnBkD,EAAiBA,kBACfR,EAAIS,WAAWC,KAAKpC,EAAmBE,OAAQ,CAAEyD,KAAI3E,QAAQ,CAAEa,MAAO8B,KACrE3D,GAASA,EAAKyH,MAOnB3E,WAAa6C,GACXzB,EAAAA,kBACER,EAAIS,WAAWC,KAAKpC,EAAmBc,WAAY,CAAE6C,MAAM,CAAE9D,MAAO8B,KAMxEZ,SAAW4C,GACTzB,EAAAA,kBACER,EAAIS,WAAWC,KAAKpC,EAAmBe,SAAU,CAAE4C,MAAM,CAAE9D,MAAO8B,KAMtExB,OAASwD,GACPzB,EAAAA,kBACER,EAAIS,WAAWC,KAAKpC,EAAmBG,OAAQ,CAAEwD,MAAM,CAAE9D,MAAO8B,OCvFhEgE,EAAW,CAACjE,EAAcC,KAA4B,CAC1DP,OAASwE,GACP1D,EAAAA,kBACER,EAAIS,WAAWC,KAAKpC,EAAcoB,OAAQ,CAAEwE,UAAU,CAAE/F,MAAO8B,KAEnEN,OAAQ,CAACuE,EAAgBC,EAAYC,IACnC5D,EAAAA,kBACER,EAAIS,WAAWC,KACbpC,EAAcqB,OACd,CAAEuE,SAAQC,OAAMC,WAChB,CAAEjG,MAAO8B,OCVXoE,EAAY,CAACrE,EAAcC,KAA4B,CAC3DP,OAAQ,IACNc,EAAiBA,kBAACR,EAAIS,WAAWC,KAAKpC,EAAeoB,OAAQ,CAAE,EAAE,CAAEvB,MAAO8B,KAC5EN,OAAS2E,GACP9D,EAAAA,kBACER,EAAIS,WAAWC,KAAKpC,EAAeqB,OAAQ,CAAE2E,SAAS,CAAEnG,MAAO8B,aCRnD,QAAlBhD,EAAAsH,WAAWC,eAAO,IAAAvH,IAAlBsH,WAAWC,QAAYA,EAAOA,SAE9B,MAGMC,EAAe,IAAIrI,KAGvBA,EAAKsI,SAASC,YAEZA,YAAS1H,GAAAS,EAAAiH,GAAYC,+BAAAA,cARD,aAQmC,IAGlDC,EAAS,WAAIzI,ICKhB0I,EAAW7H,WAAAgD,cAAEA,GAAuChD,EAArB8H,EAAMrI,EAAAA,OAAAO,EAA1B,mBACf,MAAM+H,EAAUC,UACXrH,OAAAC,OAAAD,OAAAC,OAAA,CAAA,EAAAkH,UACHG,EACAC,YAAWvH,OAAAC,OAAAD,OAAAC,OAAA,CAAA,EACNkH,EAAOI,cACV,qBAAsB,SACtB,8BAAiD,UAAZ,OAAPC,cAAO,IAAPA,aAAO,EAAPA,QAASC,gBAAU,IAAA3H,OAAA,EAAAA,EAAA4H,OAAQ,GACzD,wBAAyB,cAIvBC,UAAEA,EAASC,OAAEA,GAAWT,EAExBf,EAA6C,CAAA,EAmB7CyB,ECxCe,EAACzF,EAAcC,KAA4B,CAChEW,KAAMb,EAASC,EAAKC,GACpByF,UAAW9B,EAAc5D,EAAKC,GAC9BhC,OAAQ6D,EAAW9B,EAAKC,GACxB0F,IAAK3C,EAAgBhD,EAAKC,GAC1BmC,IAAKD,EAAQnC,EAAKC,GAClB2F,WAAYtD,EAAetC,EAAKC,GAChC4F,KAAMnD,EAAS1C,EAAKC,GACpB6F,MAAOlD,EAAU5C,EAAKC,GACtBkE,KAAMF,EAASjE,EAAKC,GACpBqE,MAAOD,EAAUrE,EAAKC,KD8BH8F,CAAef,EAAS/E,GAErCD,iCACDgF,GAAO,CAOVS,aAGAtJ,aAAa6J,GACX,KAAKA,aAAA,EAAAA,EAAQC,KAAK,MAAMC,MAAM,gCAE9B,GAAIlC,EAAKgC,EAAOC,KAAM,OAAOjC,EAAKgC,EAAOC,KAKzC,GAFArI,OAAOC,OAAOmG,OAnCA7H,WAChB,MAGMgK,SAHoBnB,EAAQvE,WAC/BrD,IAAI,WAAWmI,KACfa,MAAM/J,GAASA,EAAKgK,UACerC,KACtC,OAAK5F,MAAMC,QAAQ8H,UACQG,QAAQC,IACjCJ,EAAWK,KAAIrK,MAAO4H,GAAQ,CAACA,EAAIkC,UAAWQ,EAAAA,UAAU1C,QAGtC2C,QAClB,CAACC,GAAMV,EAAKW,KAAUX,EAAWrI,OAAAC,OAAAD,OAAAC,OAAA,CAAA,EAAA8I,IAAK,CAACV,EAAIY,YAAaD,IAAQD,GAChE,CAAE,GAPmC,EAQtC,EAsB2BG,KAErB9C,EAAKgC,EAAOC,KAAM,MAAMC,MAAM,gCAEnC,OAAOlC,EAAKgC,EAAOC,IACpB,EAOD9J,kBAAkBiG,SAEhB,MACMjE,SADY4I,EAASA,UAAC3E,EAAKpC,EAAIgH,OAAQ,CAAEC,eAAgB,KAC7CC,QAElB,GAAI/I,IACFA,EAAMgJ,IAAe,QAATlK,EAAAkB,EAAMgJ,WAAG,IAAAlK,OAAA,EAAAA,EAAEmK,MAAM,KAAKC,MAC9BlJ,EAAMgJ,MAAQ5B,GAEhB,MAAM,IAAI+B,EAAMA,OAACC,yBACf,+BACA,MACA,gBAKN,MAAO,CAAEnF,MAAKjE,QACf,EAODhC,sBAAsBqL,GACpB,IAAKA,EAAc,MAAMtB,MAAM,4CAE/B,IAEE,aADoBlG,EAAIyH,YAAYD,EAMrC,CAJC,MAAOE,GAGP,MADAlC,SAAAA,EAAQkC,MAAM,4BAA6BA,GACrCxB,MAAM,4BACb,CACF,EAOD/J,qBAAqBwL,WACnB,IAAKA,EAAc,MAAMzB,MAAM,kDAE/B,UACQlG,EAAIyH,YAAYE,GACtB,MAAMC,QAAgB5H,EAAI6H,QAAQF,GAClC,GAAIC,EAAQE,GAAI,CAEd,aADoB9H,EAAIyH,YAA0B,QAAdxK,EAAA2K,EAAQtL,YAAM,IAAAW,OAAA,EAAAA,EAAA8K,WAEnD,CAED,MAAM7B,MAAmB,QAAbxI,EAAAkK,EAAQF,aAAK,IAAAhK,OAAA,EAAAA,EAAEsK,aAK5B,CAJC,MAAOC,GAGP,MADAzC,SAAAA,EAAQkC,MAAM,kCAAmCO,GAC3C/B,MAAM,kCACb,CACF,EAQD/J,gCACEqL,EACAG,GAEA,IAAKH,IAAiBG,EAAc,MAAMzB,MAAM,6CAEhD,IAEE,aADoBlG,EAAIkI,gBAAgBV,EAKzC,CAHC,MAAOE,GAEPlC,SAAAA,EAAQ2C,IAAI,mDACb,CAED,OAAOnI,EAAIoI,eAAeT,EAC3B,EAODxL,wBAAwBuJ,GACtB,IAAKA,EAAW,MAAMQ,MAAM,gCAE5B,IAAI7J,EACJ,IACEA,QAAa2D,EAAI0F,UAAU2C,SAAS3C,EAIrC,CAHC,MAAOgC,GAEP,MADAlC,SAAAA,EAAQkC,MAAM,gCAAiCA,GACzCxB,MAAM,gCACb,CAED,MAAM6B,WAAEA,GAAe1L,EAAKC,KAC5B,IAAKyL,EAEH,MADAvC,SAAAA,EAAQkC,MAAM,gDACRxB,MAAM,iCAGd,IAEE,aADoBlG,EAAIyH,YAAYM,EAKrC,CAHC,MAAOL,GAEP,MADAlC,SAAAA,EAAQkC,MAAM,sCAAuCA,GAC/CxB,MAAM,gCACb,CACF,EAQDoC,oBAAmB,CAACvK,EAA8B0E,IACzCzC,EAAIuI,0BAA0BxK,EAAU,KAAM0E,GASvD8F,0BACExK,EACAE,EACAwE,GAEA,MAAM+F,EAAU1K,EAA2BC,EdrNb,ccqN6CE,GAC3E,OAAOwE,EAAYgG,OAAOC,GAASF,EAAQG,SAASD,IACrD,EAQDE,cAAa,CAAC7K,EAA8BuC,IACnCN,EAAI6I,oBAAoB9K,EAAU,KAAMuC,GASjDuI,oBAAoB9K,EAA8BE,EAAgBqC,GAChE,MAAMwI,EAAahL,EAA2BC,EdxOtB,QcwOgDE,GACxE,OAAOqC,EAAMmI,OAAO5C,GAASiD,EAAWH,SAAS9C,IAClD,IAGH,OAAOkD,EAAAA,SACL/I,EACA,CACE,mBACA,iBACA,sBACA,mBACA,uBACA,uBACA,iBACA,gBACA,cACA,yBACA,yBACA,WAEF/D,EACD,EAoBH6I,EAAQkE,uBd1R8B,Mc2RtClE,EAAQmE,uBdzR8B"}

package/dist/index.d.ts

@@ -84,6 +84,32 @@ declare type GroupMember = {
     userId: string;
     display: string;
 };
+declare type Flow = {
+    id: string;
+    name: string;
+    description?: string;
+    dsl: any;
+    disabled: boolean;
+    etag?: string;
+};
+declare type Screen = {
+    id: string;
+    flowId: string;
+    inputs?: any;
+    interactions?: any;
+    htmlTemplate: any;
+};
+declare type FlowResponse = {
+    flow: Flow;
+    screens: Screen[];
+};
+declare type Theme = {
+    id: string;
+    cssTemplate?: any;
+};
+declare type ThemeResponse = {
+    theme: Theme;
+};
 
 /** Parsed JWT token */
 interface Token {
@@ -108,11 +134,12 @@ declare const nodeSdk: {
         management: {
             user: {
                 create: (loginId: string, email?: string, phone?: string, displayName?: string, roles?: string[], userTenants?: AssociatedTenant[]) => Promise<SdkResponse<_descope_core_js_sdk.UserResponse>>;
+                invite: (loginId: string, email?: string, phone?: string, displayName?: string, roles?: string[], userTenants?: AssociatedTenant[]) => Promise<SdkResponse<_descope_core_js_sdk.UserResponse>>;
                 update: (loginId: string, email?: string, phone?: string, displayName?: string, roles?: string[], userTenants?: AssociatedTenant[]) => Promise<SdkResponse<_descope_core_js_sdk.UserResponse>>;
                 delete: (loginId: string) => Promise<SdkResponse<never>>;
                 load: (loginId: string) => Promise<SdkResponse<_descope_core_js_sdk.UserResponse>>;
                 loadByUserId: (userId: string) => Promise<SdkResponse<_descope_core_js_sdk.UserResponse>>;
-                searchAll: (tenantIds?: string[], roles?: string[], limit?: number) => Promise<SdkResponse<_descope_core_js_sdk.UserResponse[]>>;
+                searchAll: (tenantIds?: string[], roles?: string[], limit?: number, page?: number) => Promise<SdkResponse<_descope_core_js_sdk.UserResponse[]>>;
                 activate: (loginId: string) => Promise<SdkResponse<_descope_core_js_sdk.UserResponse>>;
                 deactivate: (loginId: string) => Promise<SdkResponse<_descope_core_js_sdk.UserResponse>>;
                 updateEmail: (loginId: string, email: string, isVerified: boolean) => Promise<SdkResponse<_descope_core_js_sdk.UserResponse>>;
@@ -166,6 +193,14 @@ declare const nodeSdk: {
                 loadAllGroupsForMember: (tenantId: string, userIds: string[], loginIds: string[]) => Promise<SdkResponse<Group[]>>;
                 loadAllGroupMembers: (tenantId: string, groupId: string) => Promise<SdkResponse<Group[]>>;
             };
+            flow: {
+                export: (flowId: string) => Promise<SdkResponse<FlowResponse>>;
+                import: (flowId: string, flow: Flow, screens?: Screen[]) => Promise<SdkResponse<FlowResponse>>;
+            };
+            theme: {
+                export: () => Promise<SdkResponse<ThemeResponse>>;
+                import: (theme: Theme) => Promise<SdkResponse<ThemeResponse>>;
+            };
         };
         getKey: (header: JWTHeaderParameters) => Promise<KeyLike | Uint8Array>;
         validateJwt: (jwt: string) => Promise<AuthenticationInfo>;
@@ -196,38 +231,64 @@ declare const nodeSdk: {
                 }>>;
             };
             signIn: {
-                email: (loginId: string) => Promise<SdkResponse<never>>;
-                sms: (loginId: string) => Promise<SdkResponse<never>>;
-                whatsapp: (loginId: string) => Promise<SdkResponse<never>>;
+                email: (loginId: string) => Promise<SdkResponse<{
+                    maskedEmail: string;
+                }>>;
+                sms: (loginId: string) => Promise<SdkResponse<{
+                    maskedPhone: string;
+                }>>;
+                whatsapp: (loginId: string) => Promise<SdkResponse<{
+                    maskedPhone: string;
+                }>>;
             };
             signUp: {
                 email: (loginId: string, user?: {
                     email?: string;
                     name?: string;
                     phone?: string;
-                }) => Promise<SdkResponse<never>>;
+                }) => Promise<SdkResponse<{
+                    maskedEmail: string;
+                }>>;
                 sms: (loginId: string, user?: {
                     email?: string;
                     name?: string;
                     phone?: string;
-                }) => Promise<SdkResponse<never>>;
+                }) => Promise<SdkResponse<{
+                    maskedPhone: string;
+                }>>;
                 whatsapp: (loginId: string, user?: {
                     email?: string;
                     name?: string;
                     phone?: string;
-                }) => Promise<SdkResponse<never>>;
+                }) => Promise<SdkResponse<{
+                    maskedPhone: string;
+                }>>;
             };
             signUpOrIn: {
-                email: (loginId: string) => Promise<SdkResponse<never>>;
-                sms: (loginId: string) => Promise<SdkResponse<never>>;
-                whatsapp: (loginId: string) => Promise<SdkResponse<never>>;
+                email: (loginId: string) => Promise<SdkResponse<{
+                    maskedEmail: string;
+                }>>;
+                sms: (loginId: string) => Promise<SdkResponse<{
+                    maskedPhone: string;
+                }>>;
+                whatsapp: (loginId: string) => Promise<SdkResponse<{
+                    maskedPhone: string;
+                }>>;
             };
             update: {
-                email: (loginId: string, email: string, token?: string) => Promise<SdkResponse<never>>;
+                email: (loginId: string, email: string, token?: string) => Promise<SdkResponse<{
+                    maskedEmail: string;
+                }>>;
                 phone: {
-                    email: (loginId: string, phone: string) => Promise<SdkResponse<never>>;
-                    sms: (loginId: string, phone: string) => Promise<SdkResponse<never>>;
-                    whatsapp: (loginId: string, phone: string) => Promise<SdkResponse<never>>;
+                    email: (loginId: string, phone: string) => Promise<SdkResponse<{
+                        maskedPhone: string;
+                    }>>;
+                    sms: (loginId: string, phone: string) => Promise<SdkResponse<{
+                        maskedPhone: string;
+                    }>>;
+                    whatsapp: (loginId: string, phone: string) => Promise<SdkResponse<{
+                        maskedPhone: string;
+                    }>>;
                 };
             };
         };
@@ -237,38 +298,62 @@ declare const nodeSdk: {
                 cookies?: string[];
             }>>;
             signIn: {
-                email: (loginId: string, uri: string) => Promise<SdkResponse<never>>;
-                sms: (loginId: string, uri: string) => Promise<SdkResponse<never>>;
-                whatsapp: (loginId: string, uri: string) => Promise<SdkResponse<never>>;
+                email: (loginId: string, uri: string) => Promise<SdkResponse<{
+                    maskedEmail: string;
+                }>>;
+                sms: (loginId: string, uri: string) => Promise<SdkResponse<{
+                    maskedPhone: string;
+                }>>;
+                whatsapp: (loginId: string, uri: string) => Promise<SdkResponse<{
+                    maskedPhone: string;
+                }>>;
             };
             signUp: {
                 email: (loginId: string, uri: string, user?: {
                     email?: string;
                     name?: string;
                     phone?: string;
-                }) => Promise<SdkResponse<never>>;
+                }) => Promise<SdkResponse<{
+                    maskedEmail: string;
+                }>>;
                 sms: (loginId: string, uri: string, user?: {
                     email?: string;
                     name?: string;
                     phone?: string;
-                }) => Promise<SdkResponse<never>>;
+                }) => Promise<SdkResponse<{
+                    maskedPhone: string;
+                }>>;
                 whatsapp: (loginId: string, uri: string, user?: {
                     email?: string;
                     name?: string;
                     phone?: string;
-                }) => Promise<SdkResponse<never>>;
+                }) => Promise<SdkResponse<{
+                    maskedPhone: string;
+                }>>;
             };
             signUpOrIn: {
-                email: (loginId: string, uri: string) => Promise<SdkResponse<never>>;
-                sms: (loginId: string, uri: string) => Promise<SdkResponse<never>>;
-                whatsapp: (loginId: string, uri: string) => Promise<SdkResponse<never>>;
+                email: (loginId: string, uri: string) => Promise<SdkResponse<{
+                    maskedEmail: string;
+                }>>;
+                sms: (loginId: string, uri: string) => Promise<SdkResponse<{
+                    maskedPhone: string;
+                }>>;
+                whatsapp: (loginId: string, uri: string) => Promise<SdkResponse<{
+                    maskedPhone: string;
+                }>>;
             };
             update: {
                 email: (loginId: string, email: string, URI?: string, token?: string) => Promise<SdkResponse<never>>;
                 phone: {
-                    email: (loginId: string, phone: string) => Promise<SdkResponse<never>>;
-                    sms: (loginId: string, phone: string) => Promise<SdkResponse<never>>;
-                    whatsapp: (loginId: string, phone: string) => Promise<SdkResponse<never>>;
+                    email: (loginId: string, phone: string) => Promise<SdkResponse<{
+                        maskedPhone: string;
+                    }>>;
+                    sms: (loginId: string, phone: string) => Promise<SdkResponse<{
+                        maskedPhone: string;
+                    }>>;
+                    whatsapp: (loginId: string, phone: string) => Promise<SdkResponse<{
+                        maskedPhone: string;
+                    }>>;
                 };
             };
         };
@@ -413,6 +498,29 @@ declare const nodeSdk: {
                 finish: (transactionId: string, response: string) => Promise<SdkResponse<_descope_core_js_sdk.ResponseData>>;
             };
         };
+        password: {
+            signUp: (loginId: string, password: string, user?: {
+                email?: string;
+                name?: string;
+                phone?: string;
+            }) => Promise<SdkResponse<_descope_core_js_sdk.JWTResponse>>;
+            signIn: (loginId: string, password: string) => Promise<SdkResponse<_descope_core_js_sdk.JWTResponse>>;
+            sendReset: (loginId: string, redirectUrl?: string) => Promise<SdkResponse<{
+                resetMethod: string;
+                pendingRef?: string;
+                linkId?: string;
+                maskedEmail: string;
+            }>>;
+            update: (loginId: string, newPassword: string, token?: string) => Promise<SdkResponse<never>>;
+            replace: (loginId: string, oldPassword: string, newPassword: string) => Promise<SdkResponse<never>>;
+            policy: () => Promise<SdkResponse<{
+                minLength: number;
+                lowercase: boolean;
+                uppercase: boolean;
+                number: boolean;
+                nonAlphanumeric: boolean;
+            }>>;
+        };
         flow: {
             start: (flowId: string, options?: {
                 redirectUrl?: string;

package/dist/index.esm.js

@@ -1,2 +1,2 @@
-import{__rest as e}from"tslib";import t,{transformResponse as a,wrapWith as o}from"@descope/core-js-sdk";import{jwtVerify as s,errors as n,importJWK as r}from"jose";import i,{Headers as l}from"node-fetch-commonjs";const d=t=>async(...a)=>{var o,s,n;const r=await t(...a);if(!r.data)return r;let i=r.data,{refreshJwt:l}=i,d=e(i,["refreshJwt"]);const p=[];var m;return l?p.push(`${"DSR"}=${l}; Domain=${(null==(m=d)?void 0:m.cookieDomain)||""}; Max-Age=${(null==m?void 0:m.cookieMaxAge)||""}; Path=${(null==m?void 0:m.cookiePath)||"/"}; HttpOnly; SameSite=Strict`):(null===(o=r.response)||void 0===o?void 0:o.headers.get("set-cookie"))&&(l=((e,t)=>{const a=null==e?void 0:e.match(RegExp(`(?:^|;\\s*)${t}=([^;]*)`));return a?a[1]:null})(null===(s=r.response)||void 0===s?void 0:s.headers.get("set-cookie"),"DSR"),p.push(null===(n=r.response)||void 0===n?void 0:n.headers.get("set-cookie"))),Object.assign(Object.assign({},r),{data:Object.assign(Object.assign({},r.data),{refreshJwt:l,cookies:p})})};function p(e,t,a){var o,s;const n=a?null===(s=null===(o=e.token.tenants)||void 0===o?void 0:o[a])||void 0===s?void 0:s[t]:e.token[t];return Array.isArray(n)?n:[]}var m={create:"/v1/mgmt/user/create",update:"/v1/mgmt/user/update",delete:"/v1/mgmt/user/delete",load:"/v1/mgmt/user",search:"/v1/mgmt/user/search",updateStatus:"/v1/mgmt/user/update/status",updateEmail:"/v1/mgmt/user/update/email",updatePhone:"/v1/mgmt/user/update/phone",updateDisplayName:"/v1/mgmt/user/update/name",addRole:"/v1/mgmt/user/update/role/add",removeRole:"/v1/mgmt/user/update/role/remove",addTenant:"/v1/mgmt/user/update/tenant/add",removeTenant:"/v1/mgmt/user/update/tenant/remove"},c={create:"/v1/mgmt/accesskey/create",load:"/v1/mgmt/accesskey",search:"/v1/mgmt/accesskey/search",update:"/v1/mgmt/accesskey/update",deactivate:"/v1/mgmt/accesskey/deactivate",activate:"/v1/mgmt/accesskey/activate",delete:"/v1/mgmt/accesskey/delete"},u={create:"/v1/mgmt/tenant/create",update:"/v1/mgmt/tenant/update",delete:"/v1/mgmt/tenant/delete",loadAll:"/v1/mgmt/tenant/all"},h={configure:"/v1/mgmt/sso/settings",metadata:"/v1/mgmt/sso/metadata",mapping:"/v1/mgmt/sso/mapping"},g={update:"/v1/mgmt/jwt/update"},v={create:"/v1/mgmt/permission/create",update:"/v1/mgmt/permission/update",delete:"/v1/mgmt/permission/delete",loadAll:"/v1/mgmt/permission/all"},k={create:"/v1/mgmt/role/create",update:"/v1/mgmt/role/update",delete:"/v1/mgmt/role/delete",loadAll:"/v1/mgmt/role/all"},y={loadAllGroups:"/v1/mgmt/group/all",loadAllGroupsForMember:"/v1/mgmt/group/member/all",loadAllGroupMembers:"/v1/mgmt/group/members"};const f=(e,t)=>({create:(o,s,n,r,i,l)=>a(e.httpClient.post(m.create,{loginId:o,email:s,phone:n,displayName:r,roleNames:i,userTenants:l},{token:t}),(e=>e.user)),update:(o,s,n,r,i,l)=>a(e.httpClient.post(m.update,{loginId:o,email:s,phone:n,displayName:r,roleNames:i,userTenants:l},{token:t}),(e=>e.user)),delete:o=>a(e.httpClient.post(m.delete,{loginId:o},{token:t})),load:o=>a(e.httpClient.get(m.load,{queryParams:{loginId:o},token:t}),(e=>e.user)),loadByUserId:o=>a(e.httpClient.get(m.load,{queryParams:{userId:o},token:t}),(e=>e.user)),searchAll:(o,s,n)=>a(e.httpClient.post(m.search,{tenantIds:o,roleNames:s,limit:n},{token:t}),(e=>e.users)),activate:o=>a(e.httpClient.post(m.updateStatus,{loginId:o,status:"enabled"},{token:t}),(e=>e.user)),deactivate:o=>a(e.httpClient.post(m.updateStatus,{loginId:o,status:"disabled"},{token:t}),(e=>e.user)),updateEmail:(o,s,n)=>a(e.httpClient.post(m.updateEmail,{loginId:o,email:s,verified:n},{token:t}),(e=>e.user)),updatePhone:(o,s,n)=>a(e.httpClient.post(m.updatePhone,{loginId:o,phone:s,verified:n},{token:t}),(e=>e.user)),updateDisplayName:(o,s)=>a(e.httpClient.post(m.updateDisplayName,{loginId:o,displayName:s},{token:t}),(e=>e.user)),addRoles:(o,s)=>a(e.httpClient.post(m.addRole,{loginId:o,roleNames:s},{token:t}),(e=>e.user)),removeRoles:(o,s)=>a(e.httpClient.post(m.removeRole,{loginId:o,roleNames:s},{token:t}),(e=>e.user)),addTenant:(o,s)=>a(e.httpClient.post(m.addTenant,{loginId:o,tenantId:s},{token:t}),(e=>e.user)),removeTenant:(o,s)=>a(e.httpClient.post(m.removeTenant,{loginId:o,tenantId:s},{token:t}),(e=>e.user)),addTenantRoles:(o,s,n)=>a(e.httpClient.post(m.addRole,{loginId:o,tenantId:s,roleNames:n},{token:t}),(e=>e.user)),removeTenantRoles:(o,s,n)=>a(e.httpClient.post(m.removeRole,{loginId:o,tenantId:s,roleNames:n},{token:t}),(e=>e.user))}),C=(e,t)=>({create:(o,s)=>a(e.httpClient.post(u.create,{name:o,selfProvisioningDomains:s},{token:t})),createWithId:(o,s,n)=>a(e.httpClient.post(u.create,{id:o,name:s,selfProvisioningDomains:n},{token:t})),update:(o,s,n)=>a(e.httpClient.post(u.update,{id:o,name:s,selfProvisioningDomains:n},{token:t})),delete:o=>a(e.httpClient.post(u.delete,{id:o},{token:t})),loadAll:()=>a(e.httpClient.get(u.loadAll,{token:t}),(e=>e.tenants))}),w=(e,t)=>({update:(o,s)=>a(e.httpClient.post(g.update,{jwt:o,customClaims:s},{token:t}))}),I=(e,t)=>({create:(o,s)=>a(e.httpClient.post(v.create,{name:o,description:s},{token:t})),update:(o,s,n)=>a(e.httpClient.post(v.update,{name:o,newName:s,description:n},{token:t})),delete:o=>a(e.httpClient.post(v.delete,{name:o},{token:t})),loadAll:()=>a(e.httpClient.get(v.loadAll,{token:t}),(e=>e.permissions))}),b=(e,t)=>({create:(o,s,n)=>a(e.httpClient.post(k.create,{name:o,description:s,permissionNames:n},{token:t})),update:(o,s,n,r)=>a(e.httpClient.post(k.update,{name:o,newName:s,description:n,permissionNames:r},{token:t})),delete:o=>a(e.httpClient.post(k.delete,{name:o},{token:t})),loadAll:()=>a(e.httpClient.get(k.loadAll,{token:t}),(e=>e.roles))}),A=(e,t)=>({loadAllGroups:o=>a(e.httpClient.post(y.loadAllGroups,{tenantId:o},{token:t})),loadAllGroupsForMember:(o,s,n)=>a(e.httpClient.post(y.loadAllGroupsForMember,{tenantId:o,loginIds:n,userIds:s},{token:t})),loadAllGroupMembers:(o,s)=>a(e.httpClient.post(y.loadAllGroupMembers,{tenantId:o,groupId:s},{token:t}))}),j=(e,t)=>({configureSettings:(o,s,n,r,i,l)=>a(e.httpClient.post(h.configure,{tenantId:o,idpURL:s,entityId:r,idpCert:n,redirectURL:i,domain:l},{token:t})),configureMetadata:(o,s)=>a(e.httpClient.post(h.metadata,{tenantId:o,idpMetadataURL:s},{token:t})),configureMapping:(o,s,n)=>a(e.httpClient.post(h.mapping,{tenantId:o,roleMapping:s,attributeMapping:n},{token:t}))}),R=(e,t)=>({create:(o,s,n,r)=>a(e.httpClient.post(c.create,{name:o,expireTime:s,roleNames:n,keyTenants:r},{token:t})),load:o=>a(e.httpClient.get(c.load,{queryParams:{id:o},token:t}),(e=>e.key)),searchAll:o=>a(e.httpClient.post(c.search,{tenantIds:o},{token:t}),(e=>e.keys)),update:(o,s)=>a(e.httpClient.post(c.update,{id:o,name:s},{token:t}),(e=>e.key)),deactivate:o=>a(e.httpClient.post(c.deactivate,{id:o},{token:t})),activate:o=>a(e.httpClient.post(c.activate,{id:o},{token:t})),delete:o=>a(e.httpClient.post(c.delete,{id:o},{token:t}))});var T;null!==(T=globalThis.Headers)&&void 0!==T||(globalThis.Headers=l);const N=(...e)=>(e.forEach((e=>{var t,a;e&&(null!==(t=(a=e).highWaterMark)&&void 0!==t||(a.highWaterMark=32212254720))})),i(...e)),x=a=>{var i,{managementKey:l}=a,m=e(a,["managementKey"]);const c=t(Object.assign(Object.assign({},m),{fetch:N,baseHeaders:Object.assign(Object.assign({},m.baseHeaders),{"x-descope-sdk-name":"nodejs","x-descope-sdk-node-version":(null===(i=null===process||void 0===process?void 0:process.versions)||void 0===i?void 0:i.node)||"","x-descope-sdk-version":"1.0.5"})})),{projectId:u,logger:h}=m,g={},v=((e,t)=>({user:f(e,t),accessKey:R(e,t),tenant:C(e,t),sso:j(e,t),jwt:w(e,t),permission:I(e,t),role:b(e,t),group:A(e,t)}))(c,l),k=Object.assign(Object.assign({},c),{management:v,async getKey(e){if(!(null==e?void 0:e.kid))throw Error("header.kid must not be empty");if(g[e.kid])return g[e.kid];if(Object.assign(g,await(async()=>{const e=(await c.httpClient.get(`v2/keys/${u}`).then((e=>e.json()))).keys;return Array.isArray(e)?(await Promise.all(e.map((async e=>[e.kid,await r(e)])))).reduce(((e,[t,a])=>t?Object.assign(Object.assign({},e),{[t.toString()]:a}):e),{}):{}})()),!g[e.kid])throw Error("failed to fetch matching key");return g[e.kid]},async validateJwt(e){var t;const a=(await s(e,k.getKey,{clockTolerance:5})).payload;if(a&&(a.iss=null===(t=a.iss)||void 0===t?void 0:t.split("/").pop(),a.iss!==u))throw new n.JWTClaimValidationFailed('unexpected "iss" claim value',"iss","check_failed");return{jwt:e,token:a}},async validateSession(e){if(!e)throw Error("session token is required for validation");try{return await k.validateJwt(e)}catch(e){throw null==h||h.error("session validation failed",e),Error("session validation failed")}},async refreshSession(e){var t,a;if(!e)throw Error("refresh token is required to refresh a session");try{await k.validateJwt(e);const o=await k.refresh(e);if(o.ok){return await k.validateJwt(null===(t=o.data)||void 0===t?void 0:t.sessionJwt)}throw Error(null===(a=o.error)||void 0===a?void 0:a.errorMessage)}catch(e){throw null==h||h.error("refresh token validation failed",e),Error("refresh token validation failed")}},async validateAndRefreshSession(e,t){if(!e&&!t)throw Error("both session and refresh tokens are empty");try{return await k.validateSession(e)}catch(e){null==h||h.log("session validation failed - trying to refresh it")}return k.refreshSession(t)},async exchangeAccessKey(e){if(!e)throw Error("access key must not be empty");let t;try{t=await k.accessKey.exchange(e)}catch(e){throw null==h||h.error("failed to exchange access key",e),Error("could not exchange access key")}const{sessionJwt:a}=t.data;if(!a)throw null==h||h.error("failed to parse exchange access key response"),Error("could not exchange access key");try{return await k.validateJwt(a)}catch(e){throw null==h||h.error("failed to parse jwt from access key",e),Error("could not exchange access key")}},validatePermissions:(e,t)=>k.validateTenantPermissions(e,null,t),validateTenantPermissions(e,t,a){const o=p(e,"permissions",t);return a.every((e=>o.includes(e)))},validateRoles:(e,t)=>k.validateTenantRoles(e,null,t),validateTenantRoles(e,t,a){const o=p(e,"roles",t);return a.every((e=>o.includes(e)))}});return o(k,["otp.verify.email","otp.verify.sms","otp.verify.whatsapp","magicLink.verify","enchantedLink.signUp","enchantedLink.signIn","oauth.exchange","saml.exchange","totp.verify","webauthn.signIn.finish","webauthn.signUp.finish","refresh"],d)};x.RefreshTokenCookieName="DSR",x.SessionTokenCookieName="DS";export{x as default};
+import{__rest as e}from"tslib";import t,{transformResponse as a,wrapWith as o}from"@descope/core-js-sdk";import{jwtVerify as n,errors as s,importJWK as r}from"jose";import i,{Headers as l}from"node-fetch-commonjs";const d=t=>async(...a)=>{var o,n,s;const r=await t(...a);if(!r.data)return r;let i=r.data,{refreshJwt:l}=i,d=e(i,["refreshJwt"]);const p=[];var m;return l?p.push(`${"DSR"}=${l}; Domain=${(null==(m=d)?void 0:m.cookieDomain)||""}; Max-Age=${(null==m?void 0:m.cookieMaxAge)||""}; Path=${(null==m?void 0:m.cookiePath)||"/"}; HttpOnly; SameSite=Strict`):(null===(o=r.response)||void 0===o?void 0:o.headers.get("set-cookie"))&&(l=((e,t)=>{const a=null==e?void 0:e.match(RegExp(`(?:^|;\\s*)${t}=([^;]*)`));return a?a[1]:null})(null===(n=r.response)||void 0===n?void 0:n.headers.get("set-cookie"),"DSR"),p.push(null===(s=r.response)||void 0===s?void 0:s.headers.get("set-cookie"))),Object.assign(Object.assign({},r),{data:Object.assign(Object.assign({},r.data),{refreshJwt:l,cookies:p})})};function p(e,t,a){var o,n;const s=a?null===(n=null===(o=e.token.tenants)||void 0===o?void 0:o[a])||void 0===n?void 0:n[t]:e.token[t];return Array.isArray(s)?s:[]}var m={create:"/v1/mgmt/user/create",update:"/v1/mgmt/user/update",delete:"/v1/mgmt/user/delete",load:"/v1/mgmt/user",search:"/v1/mgmt/user/search",updateStatus:"/v1/mgmt/user/update/status",updateEmail:"/v1/mgmt/user/update/email",updatePhone:"/v1/mgmt/user/update/phone",updateDisplayName:"/v1/mgmt/user/update/name",addRole:"/v1/mgmt/user/update/role/add",removeRole:"/v1/mgmt/user/update/role/remove",addTenant:"/v1/mgmt/user/update/tenant/add",removeTenant:"/v1/mgmt/user/update/tenant/remove"},c={create:"/v1/mgmt/accesskey/create",load:"/v1/mgmt/accesskey",search:"/v1/mgmt/accesskey/search",update:"/v1/mgmt/accesskey/update",deactivate:"/v1/mgmt/accesskey/deactivate",activate:"/v1/mgmt/accesskey/activate",delete:"/v1/mgmt/accesskey/delete"},u={create:"/v1/mgmt/tenant/create",update:"/v1/mgmt/tenant/update",delete:"/v1/mgmt/tenant/delete",loadAll:"/v1/mgmt/tenant/all"},h={configure:"/v1/mgmt/sso/settings",metadata:"/v1/mgmt/sso/metadata",mapping:"/v1/mgmt/sso/mapping"},g={update:"/v1/mgmt/jwt/update"},v={create:"/v1/mgmt/permission/create",update:"/v1/mgmt/permission/update",delete:"/v1/mgmt/permission/delete",loadAll:"/v1/mgmt/permission/all"},k={create:"/v1/mgmt/role/create",update:"/v1/mgmt/role/update",delete:"/v1/mgmt/role/delete",loadAll:"/v1/mgmt/role/all"},f={export:"/v1/mgmt/flow/export",import:"/v1/mgmt/flow/import"},y={export:"/v1/mgmt/theme/export",import:"/v1/mgmt/theme/import"},C={loadAllGroups:"/v1/mgmt/group/all",loadAllGroupsForMember:"/v1/mgmt/group/member/all",loadAllGroupMembers:"/v1/mgmt/group/members"};const w=(e,t)=>({create:(o,n,s,r,i,l)=>a(e.httpClient.post(m.create,{loginId:o,email:n,phone:s,displayName:r,roleNames:i,userTenants:l},{token:t}),(e=>e.user)),invite:(o,n,s,r,i,l)=>a(e.httpClient.post(m.create,{loginId:o,email:n,phone:s,displayName:r,roleNames:i,userTenants:l,invite:!0},{token:t}),(e=>e.user)),update:(o,n,s,r,i,l)=>a(e.httpClient.post(m.update,{loginId:o,email:n,phone:s,displayName:r,roleNames:i,userTenants:l},{token:t}),(e=>e.user)),delete:o=>a(e.httpClient.post(m.delete,{loginId:o},{token:t})),load:o=>a(e.httpClient.get(m.load,{queryParams:{loginId:o},token:t}),(e=>e.user)),loadByUserId:o=>a(e.httpClient.get(m.load,{queryParams:{userId:o},token:t}),(e=>e.user)),searchAll:(o,n,s,r)=>a(e.httpClient.post(m.search,{tenantIds:o,roleNames:n,limit:s,page:r},{token:t}),(e=>e.users)),activate:o=>a(e.httpClient.post(m.updateStatus,{loginId:o,status:"enabled"},{token:t}),(e=>e.user)),deactivate:o=>a(e.httpClient.post(m.updateStatus,{loginId:o,status:"disabled"},{token:t}),(e=>e.user)),updateEmail:(o,n,s)=>a(e.httpClient.post(m.updateEmail,{loginId:o,email:n,verified:s},{token:t}),(e=>e.user)),updatePhone:(o,n,s)=>a(e.httpClient.post(m.updatePhone,{loginId:o,phone:n,verified:s},{token:t}),(e=>e.user)),updateDisplayName:(o,n)=>a(e.httpClient.post(m.updateDisplayName,{loginId:o,displayName:n},{token:t}),(e=>e.user)),addRoles:(o,n)=>a(e.httpClient.post(m.addRole,{loginId:o,roleNames:n},{token:t}),(e=>e.user)),removeRoles:(o,n)=>a(e.httpClient.post(m.removeRole,{loginId:o,roleNames:n},{token:t}),(e=>e.user)),addTenant:(o,n)=>a(e.httpClient.post(m.addTenant,{loginId:o,tenantId:n},{token:t}),(e=>e.user)),removeTenant:(o,n)=>a(e.httpClient.post(m.removeTenant,{loginId:o,tenantId:n},{token:t}),(e=>e.user)),addTenantRoles:(o,n,s)=>a(e.httpClient.post(m.addRole,{loginId:o,tenantId:n,roleNames:s},{token:t}),(e=>e.user)),removeTenantRoles:(o,n,s)=>a(e.httpClient.post(m.removeRole,{loginId:o,tenantId:n,roleNames:s},{token:t}),(e=>e.user))}),I=(e,t)=>({create:(o,n)=>a(e.httpClient.post(u.create,{name:o,selfProvisioningDomains:n},{token:t})),createWithId:(o,n,s)=>a(e.httpClient.post(u.create,{id:o,name:n,selfProvisioningDomains:s},{token:t})),update:(o,n,s)=>a(e.httpClient.post(u.update,{id:o,name:n,selfProvisioningDomains:s},{token:t})),delete:o=>a(e.httpClient.post(u.delete,{id:o},{token:t})),loadAll:()=>a(e.httpClient.get(u.loadAll,{token:t}),(e=>e.tenants))}),b=(e,t)=>({update:(o,n)=>a(e.httpClient.post(g.update,{jwt:o,customClaims:n},{token:t}))}),A=(e,t)=>({create:(o,n)=>a(e.httpClient.post(v.create,{name:o,description:n},{token:t})),update:(o,n,s)=>a(e.httpClient.post(v.update,{name:o,newName:n,description:s},{token:t})),delete:o=>a(e.httpClient.post(v.delete,{name:o},{token:t})),loadAll:()=>a(e.httpClient.get(v.loadAll,{token:t}),(e=>e.permissions))}),x=(e,t)=>({create:(o,n,s)=>a(e.httpClient.post(k.create,{name:o,description:n,permissionNames:s},{token:t})),update:(o,n,s,r)=>a(e.httpClient.post(k.update,{name:o,newName:n,description:s,permissionNames:r},{token:t})),delete:o=>a(e.httpClient.post(k.delete,{name:o},{token:t})),loadAll:()=>a(e.httpClient.get(k.loadAll,{token:t}),(e=>e.roles))}),j=(e,t)=>({loadAllGroups:o=>a(e.httpClient.post(C.loadAllGroups,{tenantId:o},{token:t})),loadAllGroupsForMember:(o,n,s)=>a(e.httpClient.post(C.loadAllGroupsForMember,{tenantId:o,loginIds:s,userIds:n},{token:t})),loadAllGroupMembers:(o,n)=>a(e.httpClient.post(C.loadAllGroupMembers,{tenantId:o,groupId:n},{token:t}))}),T=(e,t)=>({configureSettings:(o,n,s,r,i,l)=>a(e.httpClient.post(h.configure,{tenantId:o,idpURL:n,entityId:r,idpCert:s,redirectURL:i,domain:l},{token:t})),configureMetadata:(o,n)=>a(e.httpClient.post(h.metadata,{tenantId:o,idpMetadataURL:n},{token:t})),configureMapping:(o,n,s)=>a(e.httpClient.post(h.mapping,{tenantId:o,roleMapping:n,attributeMapping:s},{token:t}))}),N=(e,t)=>({create:(o,n,s,r)=>a(e.httpClient.post(c.create,{name:o,expireTime:n,roleNames:s,keyTenants:r},{token:t})),load:o=>a(e.httpClient.get(c.load,{queryParams:{id:o},token:t}),(e=>e.key)),searchAll:o=>a(e.httpClient.post(c.search,{tenantIds:o},{token:t}),(e=>e.keys)),update:(o,n)=>a(e.httpClient.post(c.update,{id:o,name:n},{token:t}),(e=>e.key)),deactivate:o=>a(e.httpClient.post(c.deactivate,{id:o},{token:t})),activate:o=>a(e.httpClient.post(c.activate,{id:o},{token:t})),delete:o=>a(e.httpClient.post(c.delete,{id:o},{token:t}))}),R=(e,t)=>({export:o=>a(e.httpClient.post(f.export,{flowId:o},{token:t})),import:(o,n,s)=>a(e.httpClient.post(f.import,{flowId:o,flow:n,screens:s},{token:t}))}),S=(e,t)=>({export:()=>a(e.httpClient.post(y.export,{},{token:t})),import:o=>a(e.httpClient.post(y.import,{theme:o},{token:t}))});var E;null!==(E=globalThis.Headers)&&void 0!==E||(globalThis.Headers=l);const M=(...e)=>(e.forEach((e=>{var t,a;e&&(null!==(t=(a=e).highWaterMark)&&void 0!==t||(a.highWaterMark=32212254720))})),i(...e)),P=a=>{var i,{managementKey:l}=a,m=e(a,["managementKey"]);const c=t(Object.assign(Object.assign({},m),{fetch:M,baseHeaders:Object.assign(Object.assign({},m.baseHeaders),{"x-descope-sdk-name":"nodejs","x-descope-sdk-node-version":(null===(i=null===process||void 0===process?void 0:process.versions)||void 0===i?void 0:i.node)||"","x-descope-sdk-version":"1.1.0"})})),{projectId:u,logger:h}=m,g={},v=((e,t)=>({user:w(e,t),accessKey:N(e,t),tenant:I(e,t),sso:T(e,t),jwt:b(e,t),permission:A(e,t),role:x(e,t),group:j(e,t),flow:R(e,t),theme:S(e,t)}))(c,l),k=Object.assign(Object.assign({},c),{management:v,async getKey(e){if(!(null==e?void 0:e.kid))throw Error("header.kid must not be empty");if(g[e.kid])return g[e.kid];if(Object.assign(g,await(async()=>{const e=(await c.httpClient.get(`v2/keys/${u}`).then((e=>e.json()))).keys;return Array.isArray(e)?(await Promise.all(e.map((async e=>[e.kid,await r(e)])))).reduce(((e,[t,a])=>t?Object.assign(Object.assign({},e),{[t.toString()]:a}):e),{}):{}})()),!g[e.kid])throw Error("failed to fetch matching key");return g[e.kid]},async validateJwt(e){var t;const a=(await n(e,k.getKey,{clockTolerance:5})).payload;if(a&&(a.iss=null===(t=a.iss)||void 0===t?void 0:t.split("/").pop(),a.iss!==u))throw new s.JWTClaimValidationFailed('unexpected "iss" claim value',"iss","check_failed");return{jwt:e,token:a}},async validateSession(e){if(!e)throw Error("session token is required for validation");try{return await k.validateJwt(e)}catch(e){throw null==h||h.error("session validation failed",e),Error("session validation failed")}},async refreshSession(e){var t,a;if(!e)throw Error("refresh token is required to refresh a session");try{await k.validateJwt(e);const o=await k.refresh(e);if(o.ok){return await k.validateJwt(null===(t=o.data)||void 0===t?void 0:t.sessionJwt)}throw Error(null===(a=o.error)||void 0===a?void 0:a.errorMessage)}catch(e){throw null==h||h.error("refresh token validation failed",e),Error("refresh token validation failed")}},async validateAndRefreshSession(e,t){if(!e&&!t)throw Error("both session and refresh tokens are empty");try{return await k.validateSession(e)}catch(e){null==h||h.log("session validation failed - trying to refresh it")}return k.refreshSession(t)},async exchangeAccessKey(e){if(!e)throw Error("access key must not be empty");let t;try{t=await k.accessKey.exchange(e)}catch(e){throw null==h||h.error("failed to exchange access key",e),Error("could not exchange access key")}const{sessionJwt:a}=t.data;if(!a)throw null==h||h.error("failed to parse exchange access key response"),Error("could not exchange access key");try{return await k.validateJwt(a)}catch(e){throw null==h||h.error("failed to parse jwt from access key",e),Error("could not exchange access key")}},validatePermissions:(e,t)=>k.validateTenantPermissions(e,null,t),validateTenantPermissions(e,t,a){const o=p(e,"permissions",t);return a.every((e=>o.includes(e)))},validateRoles:(e,t)=>k.validateTenantRoles(e,null,t),validateTenantRoles(e,t,a){const o=p(e,"roles",t);return a.every((e=>o.includes(e)))}});return o(k,["otp.verify.email","otp.verify.sms","otp.verify.whatsapp","magicLink.verify","enchantedLink.signUp","enchantedLink.signIn","oauth.exchange","saml.exchange","totp.verify","webauthn.signIn.finish","webauthn.signUp.finish","refresh"],d)};P.RefreshTokenCookieName="DSR",P.SessionTokenCookieName="DS";export{P as default};
 //# sourceMappingURL=index.esm.js.map

package/dist/index.esm.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.esm.js","sources":["../lib/constants.ts","../lib/helpers.ts","../lib/management/paths.ts","../lib/management/user.ts","../lib/management/tenant.ts","../lib/management/jwt.ts","../lib/management/permission.ts","../lib/management/role.ts","../lib/management/group.ts","../lib/management/sso.ts","../lib/management/accesskey.ts","../lib/fetch-polyfill.ts","../lib/index.ts","../lib/management/index.ts"],"sourcesContent":["// eslint-disable-next-line import/prefer-default-export\n/** Refresh JWT cookie name */\nexport const refreshTokenCookieName = 'DSR';\n/** Session JWT cookie name */\nexport const sessionTokenCookieName = 'DS';\n/** The key of the tenants claims in the claims map */\nexport const authorizedTenantsClaimName = 'tenants';\n/** The key of the permissions claims in the claims map either under tenant or top level */\nexport const permissionsClaimName = 'permissions';\n/** The key of the roles claims in the claims map either under tenant or top level */\nexport const rolesClaimName = 'roles';\n","import type { SdkFnWrapper } from '@descope/core-js-sdk';\nimport { authorizedTenantsClaimName, refreshTokenCookieName } from './constants';\nimport { AuthenticationInfo } from './types';\n\n/**\n * Generate a cookie string from given parameters\n * @param name name of the cookie\n * @param value value of cookie that must be already encoded\n * @param options any options to put on the cookie like cookieDomain, cookieMaxAge, cookiePath\n * @returns Cookie string with all options on the string\n */\nconst generateCookie = (name: string, value: string, options?: Record<string, string | number>) =>\n  `${name}=${value}; Domain=${options?.cookieDomain || ''}; Max-Age=${\n    options?.cookieMaxAge || ''\n  }; Path=${options?.cookiePath || '/'}; HttpOnly; SameSite=Strict`;\n\n/**\n * Parse the cookie string and return the value of the cookie\n * @param cookie the raw cookie string\n * @param name the name of the cookie to get value for\n * @returns the value of the given cookie\n */\nconst getCookieValue = (cookie: string | null | undefined, name: string) => {\n  const match = cookie?.match(RegExp(`(?:^|;\\\\s*)${name}=([^;]*)`));\n  return match ? match[1] : null;\n};\n\n// eslint-disable-next-line import/prefer-default-export\n/**\n * Add cookie generation to core-js functions.\n * @param fn the function we are wrapping\n * @returns Wrapped function with cookie generation\n */\nexport const withCookie: SdkFnWrapper<{ refreshJwt?: string; cookies?: string[] }> =\n  (fn) =>\n  async (...args) => {\n    const resp = await fn(...args);\n\n    // istanbul ignore next\n    if (!resp.data) {\n      return resp;\n    }\n\n    // eslint-disable-next-line prefer-const\n    let { refreshJwt, ...rest } = resp.data;\n    const cookies: string[] = [];\n\n    if (!refreshJwt) {\n      if (resp.response?.headers.get('set-cookie')) {\n        refreshJwt = getCookieValue(\n          resp.response?.headers.get('set-cookie'),\n          refreshTokenCookieName,\n        );\n        cookies.push(resp.response?.headers.get('set-cookie')!);\n      }\n    } else {\n      cookies.push(generateCookie(refreshTokenCookieName, refreshJwt, rest));\n    }\n\n    return { ...resp, data: { ...resp.data, refreshJwt, cookies } };\n  };\n\n/**\n * Get the claim (used for permissions or roles) for a given tenant or top level if tenant is empty\n * @param authInfo The parsed authentication info from the JWT\n * @param claim name of the claim\n * @param tenant tenant to retrieve the claim for\n * @returns\n */\nexport function getAuthorizationClaimItems(\n  authInfo: AuthenticationInfo,\n  claim: string,\n  tenant?: string,\n): string[] {\n  const value = tenant\n    ? authInfo.token[authorizedTenantsClaimName]?.[tenant]?.[claim]\n    : authInfo.token[claim];\n  return Array.isArray(value) ? value : [];\n}\n","/** API paths for the Descope service Management APIs */\nexport default {\n  user: {\n    create: '/v1/mgmt/user/create',\n    update: '/v1/mgmt/user/update',\n    delete: '/v1/mgmt/user/delete',\n    load: '/v1/mgmt/user',\n    search: '/v1/mgmt/user/search',\n    updateStatus: '/v1/mgmt/user/update/status',\n    updateEmail: '/v1/mgmt/user/update/email',\n    updatePhone: '/v1/mgmt/user/update/phone',\n    updateDisplayName: '/v1/mgmt/user/update/name',\n    addRole: '/v1/mgmt/user/update/role/add',\n    removeRole: '/v1/mgmt/user/update/role/remove',\n    addTenant: '/v1/mgmt/user/update/tenant/add',\n    removeTenant: '/v1/mgmt/user/update/tenant/remove',\n  },\n  accessKey: {\n    create: '/v1/mgmt/accesskey/create',\n    load: '/v1/mgmt/accesskey',\n    search: '/v1/mgmt/accesskey/search',\n    update: '/v1/mgmt/accesskey/update',\n    deactivate: '/v1/mgmt/accesskey/deactivate',\n    activate: '/v1/mgmt/accesskey/activate',\n    delete: '/v1/mgmt/accesskey/delete',\n  },\n  tenant: {\n    create: '/v1/mgmt/tenant/create',\n    update: '/v1/mgmt/tenant/update',\n    delete: '/v1/mgmt/tenant/delete',\n    loadAll: '/v1/mgmt/tenant/all',\n  },\n  sso: {\n    configure: '/v1/mgmt/sso/settings',\n    metadata: '/v1/mgmt/sso/metadata',\n    mapping: '/v1/mgmt/sso/mapping',\n  },\n  jwt: {\n    update: '/v1/mgmt/jwt/update',\n  },\n  permission: {\n    create: '/v1/mgmt/permission/create',\n    update: '/v1/mgmt/permission/update',\n    delete: '/v1/mgmt/permission/delete',\n    loadAll: '/v1/mgmt/permission/all',\n  },\n  role: {\n    create: '/v1/mgmt/role/create',\n    update: '/v1/mgmt/role/update',\n    delete: '/v1/mgmt/role/delete',\n    loadAll: '/v1/mgmt/role/all',\n  },\n  group: {\n    loadAllGroups: '/v1/mgmt/group/all',\n    loadAllGroupsForMember: '/v1/mgmt/group/member/all',\n    loadAllGroupMembers: '/v1/mgmt/group/members',\n  },\n};\n","import { SdkResponse, transformResponse, UserResponse } from '@descope/core-js-sdk';\nimport { CoreSdk } from '../types';\nimport apiPaths from './paths';\nimport { AssociatedTenant } from './types';\n\ntype SingleUserResponse = {\n  user: UserResponse;\n};\n\ntype MultipleUsersResponse = {\n  users: UserResponse[];\n};\n\nconst withUser = (sdk: CoreSdk, managementKey?: string) => ({\n  create: (\n    loginId: string,\n    email?: string,\n    phone?: string,\n    displayName?: string,\n    roles?: string[],\n    userTenants?: AssociatedTenant[],\n  ): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.create,\n        { loginId, email, phone, displayName, roleNames: roles, userTenants },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  update: (\n    loginId: string,\n    email?: string,\n    phone?: string,\n    displayName?: string,\n    roles?: string[],\n    userTenants?: AssociatedTenant[],\n  ): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.update,\n        { loginId, email, phone, displayName, roleNames: roles, userTenants },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  delete: (loginId: string): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(apiPaths.user.delete, { loginId }, { token: managementKey }),\n    ),\n  load: (loginId: string): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.get(apiPaths.user.load, {\n        queryParams: { loginId },\n        token: managementKey,\n      }),\n      (data) => data.user,\n    ),\n  /**\n   * Load an existing user by user ID. The ID can be found\n   * on the user's JWT.\n   * @param userId load a user by this user ID field\n   * @returns The UserResponse if found, throws otherwise.\n   */\n  loadByUserId: (userId: string): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.get(apiPaths.user.load, {\n        queryParams: { userId },\n        token: managementKey,\n      }),\n      (data) => data.user,\n    ),\n  searchAll: (\n    tenantIds?: string[],\n    roles?: string[],\n    limit?: number,\n  ): Promise<SdkResponse<UserResponse[]>> =>\n    transformResponse<MultipleUsersResponse, UserResponse[]>(\n      sdk.httpClient.post(\n        apiPaths.user.search,\n        { tenantIds, roleNames: roles, limit },\n        { token: managementKey },\n      ),\n      (data) => data.users,\n    ),\n  activate: (loginId: string): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.updateStatus,\n        { loginId, status: 'enabled' },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  deactivate: (loginId: string): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.updateStatus,\n        { loginId, status: 'disabled' },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  updateEmail: (\n    loginId: string,\n    email: string,\n    isVerified: boolean,\n  ): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.updateEmail,\n        { loginId, email, verified: isVerified },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  updatePhone: (\n    loginId: string,\n    phone: string,\n    isVerified: boolean,\n  ): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.updatePhone,\n        { loginId, phone, verified: isVerified },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  updateDisplayName: (loginId: string, displayName: string): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.updateDisplayName,\n        { loginId, displayName },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  addRoles: (loginId: string, roles: string[]): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.addRole,\n        { loginId, roleNames: roles },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  removeRoles: (loginId: string, roles: string[]): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.removeRole,\n        { loginId, roleNames: roles },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  addTenant: (loginId: string, tenantId: string): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(apiPaths.user.addTenant, { loginId, tenantId }, { token: managementKey }),\n      (data) => data.user,\n    ),\n  removeTenant: (loginId: string, tenantId: string): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.removeTenant,\n        { loginId, tenantId },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  addTenantRoles: (\n    loginId: string,\n    tenantId: string,\n    roles: string[],\n  ): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.addRole,\n        { loginId, tenantId, roleNames: roles },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  removeTenantRoles: (\n    loginId: string,\n    tenantId: string,\n    roles: string[],\n  ): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.removeRole,\n        { loginId, tenantId, roleNames: roles },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n});\n\nexport default withUser;\n","import { SdkResponse, transformResponse } from '@descope/core-js-sdk';\nimport { CoreSdk } from '../types';\nimport apiPaths from './paths';\nimport { CreateTenantResponse, Tenant } from './types';\n\ntype MultipleTenantResponse = {\n  tenants: Tenant[];\n};\n\nconst withTenant = (sdk: CoreSdk, managementKey?: string) => ({\n  create: (\n    name: string,\n    selfProvisioningDomains?: string[],\n  ): Promise<SdkResponse<CreateTenantResponse>> =>\n    transformResponse(\n      sdk.httpClient.post(\n        apiPaths.tenant.create,\n        { name, selfProvisioningDomains },\n        { token: managementKey },\n      ),\n    ),\n  createWithId: (\n    id: string,\n    name: string,\n    selfProvisioningDomains?: string[],\n  ): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(\n        apiPaths.tenant.create,\n        { id, name, selfProvisioningDomains },\n        { token: managementKey },\n      ),\n    ),\n  update: (\n    id: string,\n    name: string,\n    selfProvisioningDomains?: string[],\n  ): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(\n        apiPaths.tenant.update,\n        { id, name, selfProvisioningDomains },\n        { token: managementKey },\n      ),\n    ),\n  delete: (id: string): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(apiPaths.tenant.delete, { id }, { token: managementKey }),\n    ),\n  loadAll: (): Promise<SdkResponse<Tenant[]>> =>\n    transformResponse<MultipleTenantResponse, Tenant[]>(\n      sdk.httpClient.get(apiPaths.tenant.loadAll, {\n        token: managementKey,\n      }),\n      (data) => data.tenants,\n    ),\n});\n\nexport default withTenant;\n","import { SdkResponse, transformResponse } from '@descope/core-js-sdk';\nimport { CoreSdk } from '../types';\nimport apiPaths from './paths';\nimport { UpdateJWTResponse } from './types';\n\nconst withJWT = (sdk: CoreSdk, managementKey?: string) => ({\n  update: (\n    jwt: string,\n    customClaims?: Record<string, any>,\n  ): Promise<SdkResponse<UpdateJWTResponse>> =>\n    transformResponse(\n      sdk.httpClient.post(apiPaths.jwt.update, { jwt, customClaims }, { token: managementKey }),\n    ),\n});\n\nexport default withJWT;\n","import { SdkResponse, transformResponse } from '@descope/core-js-sdk';\nimport { CoreSdk } from '../types';\nimport apiPaths from './paths';\nimport { Permission } from './types';\n\ntype MultiplePermissionResponse = {\n  permissions: Permission[];\n};\n\nconst withPermission = (sdk: CoreSdk, managementKey?: string) => ({\n  create: (name: string, description?: string): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(\n        apiPaths.permission.create,\n        { name, description },\n        { token: managementKey },\n      ),\n    ),\n  update: (name: string, newName: string, description?: string): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(\n        apiPaths.permission.update,\n        { name, newName, description },\n        { token: managementKey },\n      ),\n    ),\n  delete: (name: string): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(apiPaths.permission.delete, { name }, { token: managementKey }),\n    ),\n  loadAll: (): Promise<SdkResponse<Permission[]>> =>\n    transformResponse<MultiplePermissionResponse, Permission[]>(\n      sdk.httpClient.get(apiPaths.permission.loadAll, {\n        token: managementKey,\n      }),\n      (data) => data.permissions,\n    ),\n});\n\nexport default withPermission;\n","import { SdkResponse, transformResponse } from '@descope/core-js-sdk';\nimport { CoreSdk } from '../types';\nimport apiPaths from './paths';\nimport { Role } from './types';\n\ntype MultipleRoleResponse = {\n  roles: Role[];\n};\n\nconst withRole = (sdk: CoreSdk, managementKey?: string) => ({\n  create: (\n    name: string,\n    description?: string,\n    permissionNames?: string[],\n  ): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(\n        apiPaths.role.create,\n        { name, description, permissionNames },\n        { token: managementKey },\n      ),\n    ),\n  update: (\n    name: string,\n    newName: string,\n    description?: string,\n    permissionNames?: string[],\n  ): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(\n        apiPaths.role.update,\n        { name, newName, description, permissionNames },\n        { token: managementKey },\n      ),\n    ),\n  delete: (name: string): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(apiPaths.role.delete, { name }, { token: managementKey }),\n    ),\n  loadAll: (): Promise<SdkResponse<Role[]>> =>\n    transformResponse<MultipleRoleResponse, Role[]>(\n      sdk.httpClient.get(apiPaths.role.loadAll, {\n        token: managementKey,\n      }),\n      (data) => data.roles,\n    ),\n});\n\nexport default withRole;\n","import { SdkResponse, transformResponse } from '@descope/core-js-sdk';\nimport { CoreSdk } from '../types';\nimport apiPaths from './paths';\nimport { Group } from './types';\n\nconst withGroup = (sdk: CoreSdk, managementKey?: string) => ({\n  /**\n   * Load all groups for a specific tenant id.\n   * @param tenantId Tenant ID to load groups from.\n   * @returns Group[] list of groups\n   */\n  loadAllGroups: (tenantId: string): Promise<SdkResponse<Group[]>> =>\n    transformResponse<Group[]>(\n      sdk.httpClient.post(apiPaths.group.loadAllGroups, { tenantId }, { token: managementKey }),\n    ),\n\n  /**\n   * Load all groups for the provided user IDs or login IDs.\n   * @param tenantId Tenant ID to load groups from.\n   * @param userIds Optional List of user IDs, with the format of \"U2J5ES9S8TkvCgOvcrkpzUgVTEBM\" (example), which can be found on the user's JWT.\n   * @param loginIds Optional List of login IDs, how the user identifies when logging in.\n   * @returns Group[] list of groups\n   */\n  loadAllGroupsForMember: (\n    tenantId: string,\n    userIds: string[],\n    loginIds: string[],\n  ): Promise<SdkResponse<Group[]>> =>\n    transformResponse<Group[]>(\n      sdk.httpClient.post(\n        apiPaths.group.loadAllGroupsForMember,\n        { tenantId, loginIds, userIds },\n        { token: managementKey },\n      ),\n    ),\n\n  /**\n   * Load all members of the provided group id.\n   * @param tenantId Tenant ID to load groups from.\n   * @param groupId Group ID to load members for.\n   * @returns Group[] list of groups\n   */\n  loadAllGroupMembers: (tenantId: string, groupId: string): Promise<SdkResponse<Group[]>> =>\n    transformResponse<Group[]>(\n      sdk.httpClient.post(\n        apiPaths.group.loadAllGroupMembers,\n        { tenantId, groupId },\n        { token: managementKey },\n      ),\n    ),\n});\n\nexport default withGroup;\n","import { SdkResponse, transformResponse } from '@descope/core-js-sdk';\nimport { CoreSdk } from '../types';\nimport apiPaths from './paths';\nimport { RoleMapping, AttributeMapping } from './types';\n\nconst withSSOSettings = (sdk: CoreSdk, managementKey?: string) => ({\n  configureSettings: (\n    tenantId: string,\n    idpURL: string,\n    idpCert: string,\n    entityId: string,\n    redirectURL?: string,\n    domain?: string,\n  ): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(\n        apiPaths.sso.configure,\n        { tenantId, idpURL, entityId, idpCert, redirectURL, domain },\n        { token: managementKey },\n      ),\n    ),\n  configureMetadata: (tenantId: string, idpMetadataURL: string): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(\n        apiPaths.sso.metadata,\n        { tenantId, idpMetadataURL },\n        { token: managementKey },\n      ),\n    ),\n  configureMapping: (\n    tenantId: string,\n    roleMapping?: RoleMapping,\n    attributeMapping?: AttributeMapping,\n  ): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(\n        apiPaths.sso.mapping,\n        { tenantId, roleMapping, attributeMapping },\n        { token: managementKey },\n      ),\n    ),\n});\n\nexport default withSSOSettings;\n","import { SdkResponse, transformResponse } from '@descope/core-js-sdk';\nimport { CoreSdk } from '../types';\nimport apiPaths from './paths';\nimport { AccessKey, AssociatedTenant, CreatedAccessKeyResponse } from './types';\n\ntype SingleKeyResponse = {\n  key: AccessKey;\n};\n\ntype MultipleKeysResponse = {\n  keys: AccessKey[];\n};\n\nconst withAccessKey = (sdk: CoreSdk, managementKey?: string) => ({\n  /**\n   * Create a new access key for a project.\n   * @param name Access key name\n   * @param expireTime When the access key expires. Keep at 0 to make it indefinite.\n   * @param roles Optional roles in the project. Does not apply for multi-tenants\n   * @param keyTenants Optional associated tenants for this key and its roles for each.\n   * @returns A newly created key and its cleartext. Make sure to save the cleartext securely.\n   */\n  create: (\n    name: string,\n    expireTime: number,\n    roles?: string[],\n    keyTenants?: AssociatedTenant[],\n  ): Promise<SdkResponse<CreatedAccessKeyResponse>> =>\n    transformResponse(\n      sdk.httpClient.post(\n        apiPaths.accessKey.create,\n        { name, expireTime, roleNames: roles, keyTenants },\n        { token: managementKey },\n      ),\n    ),\n  /**\n   * Load an access key.\n   * @param id Access key ID to load\n   * @returns The loaded access key.\n   */\n  load: (id: string): Promise<SdkResponse<AccessKey>> =>\n    transformResponse<SingleKeyResponse, AccessKey>(\n      sdk.httpClient.get(apiPaths.accessKey.load, {\n        queryParams: { id },\n        token: managementKey,\n      }),\n      (data) => data.key,\n    ),\n  /**\n   * Search all access keys\n   * @param tenantIds Optional tenant ID filter to apply on the search results\n   * @returns An array of found access keys\n   */\n  searchAll: (tenantIds?: string[]): Promise<SdkResponse<AccessKey[]>> =>\n    transformResponse<MultipleKeysResponse, AccessKey[]>(\n      sdk.httpClient.post(apiPaths.accessKey.search, { tenantIds }, { token: managementKey }),\n      (data) => data.keys,\n    ),\n  /**\n   * Update an access key.\n   * @param id Access key ID to load\n   * @param name The updated access key name\n   * @returns The updated access key\n   */\n  update: (id: string, name: string): Promise<SdkResponse<AccessKey>> =>\n    transformResponse<SingleKeyResponse, AccessKey>(\n      sdk.httpClient.post(apiPaths.accessKey.update, { id, name }, { token: managementKey }),\n      (data) => data.key,\n    ),\n  /**\n   * Deactivate an access key. Deactivated access keys cannot be used until they are\n   * activated again.\n   * @param id Access key ID to deactivate\n   */\n  deactivate: (id: string): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(apiPaths.accessKey.deactivate, { id }, { token: managementKey }),\n    ),\n  /**\n   * Activate an access key. Only deactivated access keys can be activated again.\n   * @param id Access key ID to activate\n   */\n  activate: (id: string): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(apiPaths.accessKey.activate, { id }, { token: managementKey }),\n    ),\n  /**\n   * Delete an access key. IMPORTANT: This cannot be undone. Use carefully.\n   * @param id Access key ID to delete\n   */\n  delete: (id: string): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(apiPaths.accessKey.delete, { id }, { token: managementKey }),\n    ),\n});\n\nexport default withAccessKey;\n","import nodeFetch, { Headers } from 'node-fetch-commonjs';\n\nglobalThis.Headers ??= Headers;\n\nconst highWaterMarkMb = 1024 * 1024 * 1024 * 30; // 30MB\n\n// we are increasing the response buffer size due to an issue where node-fetch hangs when response is too big\nconst patchedFetch = (...args: Parameters<typeof nodeFetch>) => {\n  // we can get Request on the first arg, or RequestInfo on the second arg\n  // we want to make sure we are setting the \"highWaterMark\" so we are doing it on both args\n  args.forEach((arg) => {\n    // eslint-disable-next-line no-param-reassign, @typescript-eslint/no-unused-expressions\n    arg && ((arg as any).highWaterMark ??= highWaterMarkMb);\n  });\n\n  return nodeFetch(...args);\n};\n\nexport default patchedFetch as unknown as typeof fetch;\n","import createSdk, { ExchangeAccessKeyResponse, SdkResponse, wrapWith } from '@descope/core-js-sdk';\nimport { JWK, JWTHeaderParameters, KeyLike, errors, importJWK, jwtVerify } from 'jose';\nimport {\n  permissionsClaimName,\n  refreshTokenCookieName,\n  rolesClaimName,\n  sessionTokenCookieName,\n} from './constants';\nimport { getAuthorizationClaimItems, withCookie } from './helpers';\nimport withManagement from './management';\nimport { AuthenticationInfo } from './types';\nimport fetch from './fetch-polyfill';\n\ndeclare const BUILD_VERSION: string;\n\n/** Configuration arguments which include the Descope core SDK args and an optional management key */\ntype NodeSdkArgs = Parameters<typeof createSdk>[0] & {\n  managementKey?: string;\n};\n\nconst nodeSdk = ({ managementKey, ...config }: NodeSdkArgs) => {\n  const coreSdk = createSdk({\n    ...config,\n    fetch,\n    baseHeaders: {\n      ...config.baseHeaders,\n      'x-descope-sdk-name': 'nodejs',\n      'x-descope-sdk-node-version': process?.versions?.node || '',\n      'x-descope-sdk-version': BUILD_VERSION,\n    },\n  });\n\n  const { projectId, logger } = config;\n\n  const keys: Record<string, KeyLike | Uint8Array> = {};\n\n  /** Fetch the public keys (JWKs) from Descope for the configured project */\n  const fetchKeys = async () => {\n    const keysWrapper = await coreSdk.httpClient\n      .get(`v2/keys/${projectId}`)\n      .then((resp) => resp.json());\n    const publicKeys: JWK[] = keysWrapper.keys;\n    if (!Array.isArray(publicKeys)) return {};\n    const kidJwksPairs = await Promise.all(\n      publicKeys.map(async (key) => [key.kid, await importJWK(key)]),\n    );\n\n    return kidJwksPairs.reduce(\n      (acc, [kid, jwk]) => (kid ? { ...acc, [kid.toString()]: jwk } : acc),\n      {},\n    );\n  };\n\n  const management = withManagement(coreSdk, managementKey);\n\n  const sdk = {\n    ...coreSdk,\n\n    /**\n     * Provides various APIs for managing a Descope project programmatically. A management key must\n     * be provided as an argument when initializing the SDK to use these APIs. Management keys can be\n     * generated in the Descope console.\n     */\n    management,\n\n    /** Get the key that can validate the given JWT KID in the header. Can retrieve the public key from local cache or from Descope. */\n    async getKey(header: JWTHeaderParameters): Promise<KeyLike | Uint8Array> {\n      if (!header?.kid) throw Error('header.kid must not be empty');\n\n      if (keys[header.kid]) return keys[header.kid];\n\n      // do we need to fetch once or every time?\n      Object.assign(keys, await fetchKeys());\n\n      if (!keys[header.kid]) throw Error('failed to fetch matching key');\n\n      return keys[header.kid];\n    },\n\n    /**\n     * Validate the given JWT with the right key and make sure the issuer is correct\n     * @param jwt the JWT string to parse and validate\n     * @returns AuthenticationInfo with the parsed token and JWT. Will throw an error if validation fails.\n     */\n    async validateJwt(jwt: string): Promise<AuthenticationInfo> {\n      // Do not hard-code the algo because library does not support `None` so all are valid\n      const res = await jwtVerify(jwt, sdk.getKey, { clockTolerance: 5 });\n      const token = res.payload;\n\n      if (token) {\n        token.iss = token.iss?.split('/').pop(); // support both url and project id as issuer\n        if (token.iss !== projectId) {\n          // We must do the verification here, since issuer can be either project ID or URL\n          throw new errors.JWTClaimValidationFailed(\n            'unexpected \"iss\" claim value',\n            'iss',\n            'check_failed',\n          );\n        }\n      }\n\n      return { jwt, token };\n    },\n\n    /**\n     * Validate an active session\n     * @param sessionToken session JWT to validate\n     * @returns AuthenticationInfo promise or throws Error if there is an issue with JWTs\n     */\n    async validateSession(sessionToken: string): Promise<AuthenticationInfo> {\n      if (!sessionToken) throw Error('session token is required for validation');\n\n      try {\n        const token = await sdk.validateJwt(sessionToken);\n        return token;\n      } catch (error) {\n        /* istanbul ignore next */\n        logger?.error('session validation failed', error);\n        throw Error('session validation failed');\n      }\n    },\n\n    /**\n     * Refresh the session using a refresh token\n     * @param refreshToken refresh JWT to refresh the session with\n     * @returns AuthenticationInfo promise or throws Error if there is an issue with JWTs\n     */\n    async refreshSession(refreshToken: string): Promise<AuthenticationInfo> {\n      if (!refreshToken) throw Error('refresh token is required to refresh a session');\n\n      try {\n        await sdk.validateJwt(refreshToken);\n        const jwtResp = await sdk.refresh(refreshToken);\n        if (jwtResp.ok) {\n          const token = await sdk.validateJwt(jwtResp.data?.sessionJwt);\n          return token;\n        }\n        /* istanbul ignore next */\n        throw Error(jwtResp.error?.errorMessage);\n      } catch (refreshTokenErr) {\n        /* istanbul ignore next */\n        logger?.error('refresh token validation failed', refreshTokenErr);\n        throw Error('refresh token validation failed');\n      }\n    },\n\n    /**\n     * Validate session and refresh it if it expired\n     * @param sessionToken session JWT\n     * @param refreshToken refresh JWT\n     * @returns AuthenticationInfo promise or throws Error if there is an issue with JWTs\n     */\n    async validateAndRefreshSession(\n      sessionToken?: string,\n      refreshToken?: string,\n    ): Promise<AuthenticationInfo> {\n      if (!sessionToken && !refreshToken) throw Error('both session and refresh tokens are empty');\n\n      try {\n        const token = await sdk.validateSession(sessionToken);\n        return token;\n      } catch (error) {\n        /* istanbul ignore next */\n        logger?.log('session validation failed - trying to refresh it');\n      }\n\n      return sdk.refreshSession(refreshToken);\n    },\n\n    /**\n     * Exchange API key (access key) for a session key\n     * @param accessKey access key to exchange for a session JWT\n     * @returns AuthneticationInfo with session JWT data\n     */\n    async exchangeAccessKey(accessKey: string): Promise<AuthenticationInfo> {\n      if (!accessKey) throw Error('access key must not be empty');\n\n      let resp: SdkResponse<ExchangeAccessKeyResponse>;\n      try {\n        resp = await sdk.accessKey.exchange(accessKey);\n      } catch (error) {\n        logger?.error('failed to exchange access key', error);\n        throw Error('could not exchange access key');\n      }\n\n      const { sessionJwt } = resp.data;\n      if (!sessionJwt) {\n        logger?.error('failed to parse exchange access key response');\n        throw Error('could not exchange access key');\n      }\n\n      try {\n        const token = await sdk.validateJwt(sessionJwt);\n        return token;\n      } catch (error) {\n        logger?.error('failed to parse jwt from access key', error);\n        throw Error('could not exchange access key');\n      }\n    },\n\n    /**\n     * Make sure that all given permissions exist on the parsed JWT top level claims\n     * @param authInfo JWT parsed info\n     * @param permissions list of permissions to make sure they exist on te JWT claims\n     * @returns true if all permissions exist, false otherwise\n     */\n    validatePermissions(authInfo: AuthenticationInfo, permissions: string[]): boolean {\n      return sdk.validateTenantPermissions(authInfo, null, permissions);\n    },\n\n    /**\n     * Make sure that all given permissions exist on the parsed JWT tenant claims\n     * @param authInfo JWT parsed info\n     * @param permissions list of permissions to make sure they exist on te JWT claims\n     * @returns true if all permissions exist, false otherwise\n     */\n    validateTenantPermissions(\n      authInfo: AuthenticationInfo,\n      tenant: string,\n      permissions: string[],\n    ): boolean {\n      const granted = getAuthorizationClaimItems(authInfo, permissionsClaimName, tenant);\n      return permissions.every((perm) => granted.includes(perm));\n    },\n\n    /**\n     * Make sure that all given roles exist on the parsed JWT top level claims\n     * @param authInfo JWT parsed info\n     * @param roles list of roles to make sure they exist on te JWT claims\n     * @returns true if all roles exist, false otherwise\n     */\n    validateRoles(authInfo: AuthenticationInfo, roles: string[]): boolean {\n      return sdk.validateTenantRoles(authInfo, null, roles);\n    },\n\n    /**\n     * Make sure that all given roles exist on the parsed JWT tenant claims\n     * @param authInfo JWT parsed info\n     * @param roles list of roles to make sure they exist on te JWT claims\n     * @returns true if all roles exist, false otherwise\n     */\n    validateTenantRoles(authInfo: AuthenticationInfo, tenant: string, roles: string[]): boolean {\n      const membership = getAuthorizationClaimItems(authInfo, rolesClaimName, tenant);\n      return roles.every((role) => membership.includes(role));\n    },\n  };\n\n  return wrapWith(\n    sdk,\n    [\n      'otp.verify.email',\n      'otp.verify.sms',\n      'otp.verify.whatsapp',\n      'magicLink.verify',\n      'enchantedLink.signUp',\n      'enchantedLink.signIn',\n      'oauth.exchange',\n      'saml.exchange',\n      'totp.verify',\n      'webauthn.signIn.finish',\n      'webauthn.signUp.finish',\n      'refresh',\n    ] as const,\n    withCookie,\n  );\n};\n\n/** Descope SDK client with delivery methods enum.\n *\n * Please see full documentation at {@link https://docs.descope.com/guides Descope Docs}\n * @example Usage\n *\n * ```js\n * import descopeSdk from '@descope/node-sdk';\n *\n * const myProjectId = 'xxx';\n * const sdk = descopeSdk({ projectId: myProjectId });\n *\n * const userLoginId = 'loginId';\n * sdk.otp.signIn.email(userLoginId);\n * const jwtResponse = sdk.otp.verify.email(userLoginId, codeFromEmail);\n * ```\n */\n\nnodeSdk.RefreshTokenCookieName = refreshTokenCookieName;\nnodeSdk.SessionTokenCookieName = sessionTokenCookieName;\n\nexport default nodeSdk;\nexport type { DeliveryMethod, OAuthProvider } from '@descope/core-js-sdk';\n","import { CoreSdk } from '../types';\nimport withUser from './user';\nimport withTenant from './tenant';\nimport withJWT from './jwt';\nimport withPermission from './permission';\nimport withRole from './role';\nimport withGroup from './group';\nimport withSSOSettings from './sso';\nimport withAccessKey from './accesskey';\n\n/** Constructs a higher level Management API that wraps the functions from code-js-sdk */\nconst withManagement = (sdk: CoreSdk, managementKey?: string) => ({\n  user: withUser(sdk, managementKey),\n  accessKey: withAccessKey(sdk, managementKey),\n  tenant: withTenant(sdk, managementKey),\n  sso: withSSOSettings(sdk, managementKey),\n  jwt: withJWT(sdk, managementKey),\n  permission: withPermission(sdk, managementKey),\n  role: withRole(sdk, managementKey),\n  group: withGroup(sdk, managementKey),\n});\n\nexport default withManagement;\n"],"names":["withCookie","fn","async","args","resp","data","_d","refreshJwt","rest","__rest","cookies","options","push","cookieDomain","cookieMaxAge","cookiePath","_a","response","headers","get","cookie","name","match","RegExp","getCookieValue","_b","_c","Object","assign","getAuthorizationClaimItems","authInfo","claim","tenant","value","token","Array","isArray","apiPaths","create","update","delete","load","search","updateStatus","updateEmail","updatePhone","updateDisplayName","addRole","removeRole","addTenant","removeTenant","deactivate","activate","loadAll","configure","metadata","mapping","loadAllGroups","loadAllGroupsForMember","loadAllGroupMembers","withUser","sdk","managementKey","loginId","email","phone","displayName","roles","userTenants","transformResponse","httpClient","post","roleNames","user","queryParams","loadByUserId","userId","searchAll","tenantIds","limit","users","status","isVerified","verified","addRoles","removeRoles","tenantId","addTenantRoles","removeTenantRoles","withTenant","selfProvisioningDomains","createWithId","id","tenants","withJWT","jwt","customClaims","withPermission","description","newName","permissions","withRole","permissionNames","withGroup","userIds","loginIds","groupId","withSSOSettings","configureSettings","idpURL","idpCert","entityId","redirectURL","domain","configureMetadata","idpMetadataURL","configureMapping","roleMapping","attributeMapping","withAccessKey","expireTime","keyTenants","key","keys","globalThis","Headers","patchedFetch","forEach","arg","highWaterMark","nodeFetch","nodeSdk","config","coreSdk","createSdk","fetch","baseHeaders","process","versions","node","projectId","logger","management","accessKey","sso","permission","role","group","withManagement","header","kid","Error","publicKeys","then","json","Promise","all","map","importJWK","reduce","acc","jwk","toString","fetchKeys","jwtVerify","getKey","clockTolerance","payload","iss","split","pop","errors","JWTClaimValidationFailed","sessionToken","validateJwt","error","refreshToken","jwtResp","refresh","ok","sessionJwt","errorMessage","refreshTokenErr","validateSession","log","refreshSession","exchange","validatePermissions","validateTenantPermissions","granted","every","perm","includes","validateRoles","validateTenantRoles","membership","wrapWith","RefreshTokenCookieName","SessionTokenCookieName"],"mappings":"sNAEO,MC+BMA,EACVC,GACDC,SAAUC,eACR,MAAMC,QAAaH,KAAME,GAGzB,IAAKC,EAAKC,KACR,OAAOD,EAIT,IAAIE,EAA0BF,EAAKC,MAA/BE,WAAEA,GAAUD,EAAKE,EAAjBC,EAAAH,EAAA,CAAA,eACJ,MAAMI,EAAoB,GAlCP,IAA8BC,EAgDjD,OAZKJ,EASHG,EAAQE,KA5CZ,GDVoC,SCsDoBL,cA5C5BI,OADuBA,EA6CiBH,QA5CxC,EAAAG,EAASE,eAAgB,gBACnDF,aAAA,EAAAA,EAASG,eAAgB,aACjBH,aAAA,EAAAA,EAASI,aAAc,mCAkCZ,QAAbC,EAAAZ,EAAKa,gBAAQ,IAAAD,OAAA,EAAAA,EAAEE,QAAQC,IAAI,iBAC7BZ,EA3Be,EAACa,EAAmCC,KACzD,MAAMC,EAAQF,eAAAA,EAAQE,MAAMC,OAAO,cAAcF,cACjD,OAAOC,EAAQA,EAAM,GAAK,IAAI,EAyBXE,CACE,QAAbC,EAAArB,EAAKa,gBAAQ,IAAAQ,OAAA,EAAAA,EAAEP,QAAQC,IAAI,cDhDC,OCmD9BT,EAAQE,KAAoB,QAAfc,EAAAtB,EAAKa,gBAAU,IAAAS,OAAA,EAAAA,EAAAR,QAAQC,IAAI,gBAMhCQ,OAAAC,OAAAD,OAAAC,OAAA,CAAA,EAAAxB,GAAM,CAAAC,KAAWsB,OAAAC,OAAAD,OAAAC,OAAA,GAAAxB,EAAKC,MAAM,CAAAE,aAAYG,aAAY,WAUpDmB,EACdC,EACAC,EACAC,WAEA,MAAMC,EAAQD,EAC0C,QAApDP,EAA6C,QAA7CT,EAAAc,EAASI,MAAgC,eAAI,IAAAlB,OAAA,EAAAA,EAAAgB,UAAO,IAAAP,OAAA,EAAAA,EAAGM,GACvDD,EAASI,MAAMH,GACnB,OAAOI,MAAMC,QAAQH,GAASA,EAAQ,EACxC,CC7EA,IAAeI,EACP,CACJC,OAAQ,uBACRC,OAAQ,uBACRC,OAAQ,uBACRC,KAAM,gBACNC,OAAQ,uBACRC,aAAc,8BACdC,YAAa,6BACbC,YAAa,6BACbC,kBAAmB,4BACnBC,QAAS,gCACTC,WAAY,mCACZC,UAAW,kCACXC,aAAc,sCAdHb,EAgBF,CACTC,OAAQ,4BACRG,KAAM,qBACNC,OAAQ,4BACRH,OAAQ,4BACRY,WAAY,gCACZC,SAAU,8BACVZ,OAAQ,6BAvBGH,EAyBL,CACNC,OAAQ,yBACRC,OAAQ,yBACRC,OAAQ,yBACRa,QAAS,uBA7BEhB,EA+BR,CACHiB,UAAW,wBACXC,SAAU,wBACVC,QAAS,wBAlCEnB,EAoCR,CACHE,OAAQ,uBArCGF,EAuCD,CACVC,OAAQ,6BACRC,OAAQ,6BACRC,OAAQ,6BACRa,QAAS,2BA3CEhB,EA6CP,CACJC,OAAQ,uBACRC,OAAQ,uBACRC,OAAQ,uBACRa,QAAS,qBAjDEhB,EAmDN,CACLoB,cAAe,qBACfC,uBAAwB,4BACxBC,oBAAqB,0BC1CzB,MAAMC,EAAW,CAACC,EAAcC,KAA4B,CAC1DxB,OAAQ,CACNyB,EACAC,EACAC,EACAC,EACAC,EACAC,IAEAC,EACER,EAAIS,WAAWC,KACblC,EAAcC,OACd,CAAEyB,UAASC,QAAOC,QAAOC,cAAaM,UAAWL,EAAOC,eACxD,CAAElC,MAAO4B,KAEVzD,GAASA,EAAKoE,OAEnBlC,OAAQ,CACNwB,EACAC,EACAC,EACAC,EACAC,EACAC,IAEAC,EACER,EAAIS,WAAWC,KACblC,EAAcE,OACd,CAAEwB,UAASC,QAAOC,QAAOC,cAAaM,UAAWL,EAAOC,eACxD,CAAElC,MAAO4B,KAEVzD,GAASA,EAAKoE,OAEnBjC,OAASuB,GACPM,EACER,EAAIS,WAAWC,KAAKlC,EAAcG,OAAQ,CAAEuB,WAAW,CAAE7B,MAAO4B,KAEpErB,KAAOsB,GACLM,EACER,EAAIS,WAAWnD,IAAIkB,EAAcI,KAAM,CACrCiC,YAAa,CAAEX,WACf7B,MAAO4B,KAERzD,GAASA,EAAKoE,OAQnBE,aAAeC,GACbP,EACER,EAAIS,WAAWnD,IAAIkB,EAAcI,KAAM,CACrCiC,YAAa,CAAEE,UACf1C,MAAO4B,KAERzD,GAASA,EAAKoE,OAEnBI,UAAW,CACTC,EACAX,EACAY,IAEAV,EACER,EAAIS,WAAWC,KACblC,EAAcK,OACd,CAAEoC,YAAWN,UAAWL,EAAOY,SAC/B,CAAE7C,MAAO4B,KAEVzD,GAASA,EAAK2E,QAEnB5B,SAAWW,GACTM,EACER,EAAIS,WAAWC,KACblC,EAAcM,aACd,CAAEoB,UAASkB,OAAQ,WACnB,CAAE/C,MAAO4B,KAEVzD,GAASA,EAAKoE,OAEnBtB,WAAaY,GACXM,EACER,EAAIS,WAAWC,KACblC,EAAcM,aACd,CAAEoB,UAASkB,OAAQ,YACnB,CAAE/C,MAAO4B,KAEVzD,GAASA,EAAKoE,OAEnB7B,YAAa,CACXmB,EACAC,EACAkB,IAEAb,EACER,EAAIS,WAAWC,KACblC,EAAcO,YACd,CAAEmB,UAASC,QAAOmB,SAAUD,GAC5B,CAAEhD,MAAO4B,KAEVzD,GAASA,EAAKoE,OAEnB5B,YAAa,CACXkB,EACAE,EACAiB,IAEAb,EACER,EAAIS,WAAWC,KACblC,EAAcQ,YACd,CAAEkB,UAASE,QAAOkB,SAAUD,GAC5B,CAAEhD,MAAO4B,KAEVzD,GAASA,EAAKoE,OAEnB3B,kBAAmB,CAACiB,EAAiBG,IACnCG,EACER,EAAIS,WAAWC,KACblC,EAAcS,kBACd,CAAEiB,UAASG,eACX,CAAEhC,MAAO4B,KAEVzD,GAASA,EAAKoE,OAEnBW,SAAU,CAACrB,EAAiBI,IAC1BE,EACER,EAAIS,WAAWC,KACblC,EAAcU,QACd,CAAEgB,UAASS,UAAWL,GACtB,CAAEjC,MAAO4B,KAEVzD,GAASA,EAAKoE,OAEnBY,YAAa,CAACtB,EAAiBI,IAC7BE,EACER,EAAIS,WAAWC,KACblC,EAAcW,WACd,CAAEe,UAASS,UAAWL,GACtB,CAAEjC,MAAO4B,KAEVzD,GAASA,EAAKoE,OAEnBxB,UAAW,CAACc,EAAiBuB,IAC3BjB,EACER,EAAIS,WAAWC,KAAKlC,EAAcY,UAAW,CAAEc,UAASuB,YAAY,CAAEpD,MAAO4B,KAC5EzD,GAASA,EAAKoE,OAEnBvB,aAAc,CAACa,EAAiBuB,IAC9BjB,EACER,EAAIS,WAAWC,KACblC,EAAca,aACd,CAAEa,UAASuB,YACX,CAAEpD,MAAO4B,KAEVzD,GAASA,EAAKoE,OAEnBc,eAAgB,CACdxB,EACAuB,EACAnB,IAEAE,EACER,EAAIS,WAAWC,KACblC,EAAcU,QACd,CAAEgB,UAASuB,WAAUd,UAAWL,GAChC,CAAEjC,MAAO4B,KAEVzD,GAASA,EAAKoE,OAEnBe,kBAAmB,CACjBzB,EACAuB,EACAnB,IAEAE,EACER,EAAIS,WAAWC,KACblC,EAAcW,WACd,CAAEe,UAASuB,WAAUd,UAAWL,GAChC,CAAEjC,MAAO4B,KAEVzD,GAASA,EAAKoE,SCzLfgB,EAAa,CAAC5B,EAAcC,KAA4B,CAC5DxB,OAAQ,CACNjB,EACAqE,IAEArB,EACER,EAAIS,WAAWC,KACblC,EAAgBC,OAChB,CAAEjB,OAAMqE,2BACR,CAAExD,MAAO4B,KAGf6B,aAAc,CACZC,EACAvE,EACAqE,IAEArB,EACER,EAAIS,WAAWC,KACblC,EAAgBC,OAChB,CAAEsD,KAAIvE,OAAMqE,2BACZ,CAAExD,MAAO4B,KAGfvB,OAAQ,CACNqD,EACAvE,EACAqE,IAEArB,EACER,EAAIS,WAAWC,KACblC,EAAgBE,OAChB,CAAEqD,KAAIvE,OAAMqE,2BACZ,CAAExD,MAAO4B,KAGftB,OAASoD,GACPvB,EACER,EAAIS,WAAWC,KAAKlC,EAAgBG,OAAQ,CAAEoD,MAAM,CAAE1D,MAAO4B,KAEjET,QAAS,IACPgB,EACER,EAAIS,WAAWnD,IAAIkB,EAAgBgB,QAAS,CAC1CnB,MAAO4B,KAERzD,GAASA,EAAKwF,YCjDfC,EAAU,CAACjC,EAAcC,KAA4B,CACzDvB,OAAQ,CACNwD,EACAC,IAEA3B,EACER,EAAIS,WAAWC,KAAKlC,EAAaE,OAAQ,CAAEwD,MAAKC,gBAAgB,CAAE9D,MAAO4B,OCFzEmC,EAAiB,CAACpC,EAAcC,KAA4B,CAChExB,OAAQ,CAACjB,EAAc6E,IACrB7B,EACER,EAAIS,WAAWC,KACblC,EAAoBC,OACpB,CAAEjB,OAAM6E,eACR,CAAEhE,MAAO4B,KAGfvB,OAAQ,CAAClB,EAAc8E,EAAiBD,IACtC7B,EACER,EAAIS,WAAWC,KACblC,EAAoBE,OACpB,CAAElB,OAAM8E,UAASD,eACjB,CAAEhE,MAAO4B,KAGftB,OAASnB,GACPgD,EACER,EAAIS,WAAWC,KAAKlC,EAAoBG,OAAQ,CAAEnB,QAAQ,CAAEa,MAAO4B,KAEvET,QAAS,IACPgB,EACER,EAAIS,WAAWnD,IAAIkB,EAAoBgB,QAAS,CAC9CnB,MAAO4B,KAERzD,GAASA,EAAK+F,gBC1BfC,EAAW,CAACxC,EAAcC,KAA4B,CAC1DxB,OAAQ,CACNjB,EACA6E,EACAI,IAEAjC,EACER,EAAIS,WAAWC,KACblC,EAAcC,OACd,CAAEjB,OAAM6E,cAAaI,mBACrB,CAAEpE,MAAO4B,KAGfvB,OAAQ,CACNlB,EACA8E,EACAD,EACAI,IAEAjC,EACER,EAAIS,WAAWC,KACblC,EAAcE,OACd,CAAElB,OAAM8E,UAASD,cAAaI,mBAC9B,CAAEpE,MAAO4B,KAGftB,OAASnB,GACPgD,EACER,EAAIS,WAAWC,KAAKlC,EAAcG,OAAQ,CAAEnB,QAAQ,CAAEa,MAAO4B,KAEjET,QAAS,IACPgB,EACER,EAAIS,WAAWnD,IAAIkB,EAAcgB,QAAS,CACxCnB,MAAO4B,KAERzD,GAASA,EAAK8D,UCvCfoC,EAAY,CAAC1C,EAAcC,KAA4B,CAM3DL,cAAgB6B,GACdjB,EACER,EAAIS,WAAWC,KAAKlC,EAAeoB,cAAe,CAAE6B,YAAY,CAAEpD,MAAO4B,KAU7EJ,uBAAwB,CACtB4B,EACAkB,EACAC,IAEApC,EACER,EAAIS,WAAWC,KACblC,EAAeqB,uBACf,CAAE4B,WAAUmB,WAAUD,WACtB,CAAEtE,MAAO4B,KAUfH,oBAAqB,CAAC2B,EAAkBoB,IACtCrC,EACER,EAAIS,WAAWC,KACblC,EAAesB,oBACf,CAAE2B,WAAUoB,WACZ,CAAExE,MAAO4B,OC1CX6C,EAAkB,CAAC9C,EAAcC,KAA4B,CACjE8C,kBAAmB,CACjBtB,EACAuB,EACAC,EACAC,EACAC,EACAC,IAEA5C,EACER,EAAIS,WAAWC,KACblC,EAAaiB,UACb,CAAEgC,WAAUuB,SAAQE,WAAUD,UAASE,cAAaC,UACpD,CAAE/E,MAAO4B,KAGfoD,kBAAmB,CAAC5B,EAAkB6B,IACpC9C,EACER,EAAIS,WAAWC,KACblC,EAAakB,SACb,CAAE+B,WAAU6B,kBACZ,CAAEjF,MAAO4B,KAGfsD,iBAAkB,CAChB9B,EACA+B,EACAC,IAEAjD,EACER,EAAIS,WAAWC,KACblC,EAAamB,QACb,CAAE8B,WAAU+B,cAAaC,oBACzB,CAAEpF,MAAO4B,OCzBXyD,EAAgB,CAAC1D,EAAcC,KAA4B,CAS/DxB,OAAQ,CACNjB,EACAmG,EACArD,EACAsD,IAEApD,EACER,EAAIS,WAAWC,KACblC,EAAmBC,OACnB,CAAEjB,OAAMmG,aAAYhD,UAAWL,EAAOsD,cACtC,CAAEvF,MAAO4B,KAQfrB,KAAOmD,GACLvB,EACER,EAAIS,WAAWnD,IAAIkB,EAAmBI,KAAM,CAC1CiC,YAAa,CAAEkB,MACf1D,MAAO4B,KAERzD,GAASA,EAAKqH,MAOnB7C,UAAYC,GACVT,EACER,EAAIS,WAAWC,KAAKlC,EAAmBK,OAAQ,CAAEoC,aAAa,CAAE5C,MAAO4B,KACtEzD,GAASA,EAAKsH,OAQnBpF,OAAQ,CAACqD,EAAYvE,IACnBgD,EACER,EAAIS,WAAWC,KAAKlC,EAAmBE,OAAQ,CAAEqD,KAAIvE,QAAQ,CAAEa,MAAO4B,KACrEzD,GAASA,EAAKqH,MAOnBvE,WAAayC,GACXvB,EACER,EAAIS,WAAWC,KAAKlC,EAAmBc,WAAY,CAAEyC,MAAM,CAAE1D,MAAO4B,KAMxEV,SAAWwC,GACTvB,EACER,EAAIS,WAAWC,KAAKlC,EAAmBe,SAAU,CAAEwC,MAAM,CAAE1D,MAAO4B,KAMtEtB,OAASoD,GACPvB,EACER,EAAIS,WAAWC,KAAKlC,EAAmBG,OAAQ,CAAEoD,MAAM,CAAE1D,MAAO4B,aC1FpD,QAAlB9C,EAAA4G,WAAWC,eAAO,IAAA7G,IAAlB4G,WAAWC,QAAYA,GAEvB,MAGMC,EAAe,IAAI3H,KAGvBA,EAAK4H,SAASC,YAEZA,YAAShH,GAAAS,EAAAuG,GAAYC,+BAAAA,cARD,aAQmC,IAGlDC,KAAa/H,ICKhBgI,EAAWnH,WAAA8C,cAAEA,GAAuC9C,EAArBoH,EAAM3H,EAAAO,EAA1B,mBACf,MAAMqH,EAAUC,EACX3G,OAAAC,OAAAD,OAAAC,OAAA,CAAA,EAAAwG,UACHG,EACAC,YAAW7G,OAAAC,OAAAD,OAAAC,OAAA,CAAA,EACNwG,EAAOI,cACV,qBAAsB,SACtB,8BAAiD,UAAZ,OAAPC,cAAO,IAAPA,aAAO,EAAPA,QAASC,gBAAU,IAAAjH,OAAA,EAAAA,EAAAkH,OAAQ,GACzD,wBAAyB,cAIvBC,UAAEA,EAASC,OAAEA,GAAWT,EAExBT,EAA6C,CAAA,EAmB7CmB,EC1Ce,EAACjF,EAAcC,KAA4B,CAChEW,KAAMb,EAASC,EAAKC,GACpBiF,UAAWxB,EAAc1D,EAAKC,GAC9B9B,OAAQyD,EAAW5B,EAAKC,GACxBkF,IAAKrC,EAAgB9C,EAAKC,GAC1BiC,IAAKD,EAAQjC,EAAKC,GAClBmF,WAAYhD,EAAepC,EAAKC,GAChCoF,KAAM7C,EAASxC,EAAKC,GACpBqF,MAAO5C,EAAU1C,EAAKC,KDkCHsF,CAAef,EAASvE,GAErCD,iCACDwE,GAAO,CAOVS,aAGA5I,aAAamJ,GACX,KAAKA,aAAA,EAAAA,EAAQC,KAAK,MAAMC,MAAM,gCAE9B,GAAI5B,EAAK0B,EAAOC,KAAM,OAAO3B,EAAK0B,EAAOC,KAKzC,GAFA3H,OAAOC,OAAO+F,OAnCAzH,WAChB,MAGMsJ,SAHoBnB,EAAQ/D,WAC/BnD,IAAI,WAAWyH,KACfa,MAAMrJ,GAASA,EAAKsJ,UACe/B,KACtC,OAAKxF,MAAMC,QAAQoH,UACQG,QAAQC,IACjCJ,EAAWK,KAAI3J,MAAOwH,GAAQ,CAACA,EAAI4B,UAAWQ,EAAUpC,QAGtCqC,QAClB,CAACC,GAAMV,EAAKW,KAAUX,EAAW3H,OAAAC,OAAAD,OAAAC,OAAA,CAAA,EAAAoI,IAAK,CAACV,EAAIY,YAAaD,IAAQD,GAChE,CAAE,GAPmC,EAQtC,EAsB2BG,KAErBxC,EAAK0B,EAAOC,KAAM,MAAMC,MAAM,gCAEnC,OAAO5B,EAAK0B,EAAOC,IACpB,EAODpJ,kBAAkB6F,SAEhB,MACM7D,SADYkI,EAAUrE,EAAKlC,EAAIwG,OAAQ,CAAEC,eAAgB,KAC7CC,QAElB,GAAIrI,IACFA,EAAMsI,IAAe,QAATxJ,EAAAkB,EAAMsI,WAAG,IAAAxJ,OAAA,EAAAA,EAAEyJ,MAAM,KAAKC,MAC9BxI,EAAMsI,MAAQ5B,GAEhB,MAAM,IAAI+B,EAAOC,yBACf,+BACA,MACA,gBAKN,MAAO,CAAE7E,MAAK7D,QACf,EAODhC,sBAAsB2K,GACpB,IAAKA,EAAc,MAAMtB,MAAM,4CAE/B,IAEE,aADoB1F,EAAIiH,YAAYD,EAMrC,CAJC,MAAOE,GAGP,MADAlC,SAAAA,EAAQkC,MAAM,4BAA6BA,GACrCxB,MAAM,4BACb,CACF,EAODrJ,qBAAqB8K,WACnB,IAAKA,EAAc,MAAMzB,MAAM,kDAE/B,UACQ1F,EAAIiH,YAAYE,GACtB,MAAMC,QAAgBpH,EAAIqH,QAAQF,GAClC,GAAIC,EAAQE,GAAI,CAEd,aADoBtH,EAAIiH,YAA0B,QAAd9J,EAAAiK,EAAQ5K,YAAM,IAAAW,OAAA,EAAAA,EAAAoK,WAEnD,CAED,MAAM7B,MAAmB,QAAb9H,EAAAwJ,EAAQF,aAAK,IAAAtJ,OAAA,EAAAA,EAAE4J,aAK5B,CAJC,MAAOC,GAGP,MADAzC,SAAAA,EAAQkC,MAAM,kCAAmCO,GAC3C/B,MAAM,kCACb,CACF,EAQDrJ,gCACE2K,EACAG,GAEA,IAAKH,IAAiBG,EAAc,MAAMzB,MAAM,6CAEhD,IAEE,aADoB1F,EAAI0H,gBAAgBV,EAKzC,CAHC,MAAOE,GAEPlC,SAAAA,EAAQ2C,IAAI,mDACb,CAED,OAAO3H,EAAI4H,eAAeT,EAC3B,EAOD9K,wBAAwB6I,GACtB,IAAKA,EAAW,MAAMQ,MAAM,gCAE5B,IAAInJ,EACJ,IACEA,QAAayD,EAAIkF,UAAU2C,SAAS3C,EAIrC,CAHC,MAAOgC,GAEP,MADAlC,SAAAA,EAAQkC,MAAM,gCAAiCA,GACzCxB,MAAM,gCACb,CAED,MAAM6B,WAAEA,GAAehL,EAAKC,KAC5B,IAAK+K,EAEH,MADAvC,SAAAA,EAAQkC,MAAM,gDACRxB,MAAM,iCAGd,IAEE,aADoB1F,EAAIiH,YAAYM,EAKrC,CAHC,MAAOL,GAEP,MADAlC,SAAAA,EAAQkC,MAAM,sCAAuCA,GAC/CxB,MAAM,gCACb,CACF,EAQDoC,oBAAmB,CAAC7J,EAA8BsE,IACzCvC,EAAI+H,0BAA0B9J,EAAU,KAAMsE,GASvDwF,0BACE9J,EACAE,EACAoE,GAEA,MAAMyF,EAAUhK,EAA2BC,EZrNb,cYqN6CE,GAC3E,OAAOoE,EAAY0F,OAAOC,GAASF,EAAQG,SAASD,IACrD,EAQDE,cAAa,CAACnK,EAA8BqC,IACnCN,EAAIqI,oBAAoBpK,EAAU,KAAMqC,GASjD+H,oBAAoBpK,EAA8BE,EAAgBmC,GAChE,MAAMgI,EAAatK,EAA2BC,EZxOtB,QYwOgDE,GACxE,OAAOmC,EAAM2H,OAAO5C,GAASiD,EAAWH,SAAS9C,IAClD,IAGH,OAAOkD,EACLvI,EACA,CACE,mBACA,iBACA,sBACA,mBACA,uBACA,uBACA,iBACA,gBACA,cACA,yBACA,yBACA,WAEF7D,EACD,EAoBHmI,EAAQkE,uBZ1R8B,MY2RtClE,EAAQmE,uBZzR8B"}
+{"version":3,"file":"index.esm.js","sources":["../lib/constants.ts","../lib/helpers.ts","../lib/management/paths.ts","../lib/management/user.ts","../lib/management/tenant.ts","../lib/management/jwt.ts","../lib/management/permission.ts","../lib/management/role.ts","../lib/management/group.ts","../lib/management/sso.ts","../lib/management/accesskey.ts","../lib/management/flow.ts","../lib/management/theme.ts","../lib/fetch-polyfill.ts","../lib/index.ts","../lib/management/index.ts"],"sourcesContent":["// eslint-disable-next-line import/prefer-default-export\n/** Refresh JWT cookie name */\nexport const refreshTokenCookieName = 'DSR';\n/** Session JWT cookie name */\nexport const sessionTokenCookieName = 'DS';\n/** The key of the tenants claims in the claims map */\nexport const authorizedTenantsClaimName = 'tenants';\n/** The key of the permissions claims in the claims map either under tenant or top level */\nexport const permissionsClaimName = 'permissions';\n/** The key of the roles claims in the claims map either under tenant or top level */\nexport const rolesClaimName = 'roles';\n","import type { SdkFnWrapper } from '@descope/core-js-sdk';\nimport { authorizedTenantsClaimName, refreshTokenCookieName } from './constants';\nimport { AuthenticationInfo } from './types';\n\n/**\n * Generate a cookie string from given parameters\n * @param name name of the cookie\n * @param value value of cookie that must be already encoded\n * @param options any options to put on the cookie like cookieDomain, cookieMaxAge, cookiePath\n * @returns Cookie string with all options on the string\n */\nconst generateCookie = (name: string, value: string, options?: Record<string, string | number>) =>\n  `${name}=${value}; Domain=${options?.cookieDomain || ''}; Max-Age=${\n    options?.cookieMaxAge || ''\n  }; Path=${options?.cookiePath || '/'}; HttpOnly; SameSite=Strict`;\n\n/**\n * Parse the cookie string and return the value of the cookie\n * @param cookie the raw cookie string\n * @param name the name of the cookie to get value for\n * @returns the value of the given cookie\n */\nconst getCookieValue = (cookie: string | null | undefined, name: string) => {\n  const match = cookie?.match(RegExp(`(?:^|;\\\\s*)${name}=([^;]*)`));\n  return match ? match[1] : null;\n};\n\n// eslint-disable-next-line import/prefer-default-export\n/**\n * Add cookie generation to core-js functions.\n * @param fn the function we are wrapping\n * @returns Wrapped function with cookie generation\n */\nexport const withCookie: SdkFnWrapper<{ refreshJwt?: string; cookies?: string[] }> =\n  (fn) =>\n  async (...args) => {\n    const resp = await fn(...args);\n\n    // istanbul ignore next\n    if (!resp.data) {\n      return resp;\n    }\n\n    // eslint-disable-next-line prefer-const\n    let { refreshJwt, ...rest } = resp.data;\n    const cookies: string[] = [];\n\n    if (!refreshJwt) {\n      if (resp.response?.headers.get('set-cookie')) {\n        refreshJwt = getCookieValue(\n          resp.response?.headers.get('set-cookie'),\n          refreshTokenCookieName,\n        );\n        cookies.push(resp.response?.headers.get('set-cookie')!);\n      }\n    } else {\n      cookies.push(generateCookie(refreshTokenCookieName, refreshJwt, rest));\n    }\n\n    return { ...resp, data: { ...resp.data, refreshJwt, cookies } };\n  };\n\n/**\n * Get the claim (used for permissions or roles) for a given tenant or top level if tenant is empty\n * @param authInfo The parsed authentication info from the JWT\n * @param claim name of the claim\n * @param tenant tenant to retrieve the claim for\n * @returns\n */\nexport function getAuthorizationClaimItems(\n  authInfo: AuthenticationInfo,\n  claim: string,\n  tenant?: string,\n): string[] {\n  const value = tenant\n    ? authInfo.token[authorizedTenantsClaimName]?.[tenant]?.[claim]\n    : authInfo.token[claim];\n  return Array.isArray(value) ? value : [];\n}\n","/** API paths for the Descope service Management APIs */\nexport default {\n  user: {\n    create: '/v1/mgmt/user/create',\n    update: '/v1/mgmt/user/update',\n    delete: '/v1/mgmt/user/delete',\n    load: '/v1/mgmt/user',\n    search: '/v1/mgmt/user/search',\n    updateStatus: '/v1/mgmt/user/update/status',\n    updateEmail: '/v1/mgmt/user/update/email',\n    updatePhone: '/v1/mgmt/user/update/phone',\n    updateDisplayName: '/v1/mgmt/user/update/name',\n    addRole: '/v1/mgmt/user/update/role/add',\n    removeRole: '/v1/mgmt/user/update/role/remove',\n    addTenant: '/v1/mgmt/user/update/tenant/add',\n    removeTenant: '/v1/mgmt/user/update/tenant/remove',\n  },\n  accessKey: {\n    create: '/v1/mgmt/accesskey/create',\n    load: '/v1/mgmt/accesskey',\n    search: '/v1/mgmt/accesskey/search',\n    update: '/v1/mgmt/accesskey/update',\n    deactivate: '/v1/mgmt/accesskey/deactivate',\n    activate: '/v1/mgmt/accesskey/activate',\n    delete: '/v1/mgmt/accesskey/delete',\n  },\n  tenant: {\n    create: '/v1/mgmt/tenant/create',\n    update: '/v1/mgmt/tenant/update',\n    delete: '/v1/mgmt/tenant/delete',\n    loadAll: '/v1/mgmt/tenant/all',\n  },\n  sso: {\n    configure: '/v1/mgmt/sso/settings',\n    metadata: '/v1/mgmt/sso/metadata',\n    mapping: '/v1/mgmt/sso/mapping',\n  },\n  jwt: {\n    update: '/v1/mgmt/jwt/update',\n  },\n  permission: {\n    create: '/v1/mgmt/permission/create',\n    update: '/v1/mgmt/permission/update',\n    delete: '/v1/mgmt/permission/delete',\n    loadAll: '/v1/mgmt/permission/all',\n  },\n  role: {\n    create: '/v1/mgmt/role/create',\n    update: '/v1/mgmt/role/update',\n    delete: '/v1/mgmt/role/delete',\n    loadAll: '/v1/mgmt/role/all',\n  },\n  flow: {\n    export: '/v1/mgmt/flow/export',\n    import: '/v1/mgmt/flow/import',\n  },\n  theme: {\n    export: '/v1/mgmt/theme/export',\n    import: '/v1/mgmt/theme/import',\n  },\n  group: {\n    loadAllGroups: '/v1/mgmt/group/all',\n    loadAllGroupsForMember: '/v1/mgmt/group/member/all',\n    loadAllGroupMembers: '/v1/mgmt/group/members',\n  },\n};\n","import { SdkResponse, transformResponse, UserResponse } from '@descope/core-js-sdk';\nimport { CoreSdk } from '../types';\nimport apiPaths from './paths';\nimport { AssociatedTenant } from './types';\n\ntype SingleUserResponse = {\n  user: UserResponse;\n};\n\ntype MultipleUsersResponse = {\n  users: UserResponse[];\n};\n\nconst withUser = (sdk: CoreSdk, managementKey?: string) => ({\n  create: (\n    loginId: string,\n    email?: string,\n    phone?: string,\n    displayName?: string,\n    roles?: string[],\n    userTenants?: AssociatedTenant[],\n  ): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.create,\n        { loginId, email, phone, displayName, roleNames: roles, userTenants },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  invite: (\n    loginId: string,\n    email?: string,\n    phone?: string,\n    displayName?: string,\n    roles?: string[],\n    userTenants?: AssociatedTenant[],\n  ): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.create,\n        { loginId, email, phone, displayName, roleNames: roles, userTenants, invite: true },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  update: (\n    loginId: string,\n    email?: string,\n    phone?: string,\n    displayName?: string,\n    roles?: string[],\n    userTenants?: AssociatedTenant[],\n  ): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.update,\n        { loginId, email, phone, displayName, roleNames: roles, userTenants },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  delete: (loginId: string): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(apiPaths.user.delete, { loginId }, { token: managementKey }),\n    ),\n  load: (loginId: string): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.get(apiPaths.user.load, {\n        queryParams: { loginId },\n        token: managementKey,\n      }),\n      (data) => data.user,\n    ),\n  /**\n   * Load an existing user by user ID. The ID can be found\n   * on the user's JWT.\n   * @param userId load a user by this user ID field\n   * @returns The UserResponse if found, throws otherwise.\n   */\n  loadByUserId: (userId: string): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.get(apiPaths.user.load, {\n        queryParams: { userId },\n        token: managementKey,\n      }),\n      (data) => data.user,\n    ),\n  /**\n   * Search all users. Results can be filtered according to tenants and/or\n   * roles, and also paginated used the limit and page parameters.\n   * @param tenantIds optional list of tenant IDs to filter by\n   * @param roles optional list of roles to filter by\n   * @param limit optionally limit the response, leave out for default limit\n   * @param page optionally paginate over the response\n   * @returns An array of UserResponse found by the query\n   */\n  searchAll: (\n    tenantIds?: string[],\n    roles?: string[],\n    limit?: number,\n    page?: number,\n  ): Promise<SdkResponse<UserResponse[]>> =>\n    transformResponse<MultipleUsersResponse, UserResponse[]>(\n      sdk.httpClient.post(\n        apiPaths.user.search,\n        { tenantIds, roleNames: roles, limit, page },\n        { token: managementKey },\n      ),\n      (data) => data.users,\n    ),\n  activate: (loginId: string): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.updateStatus,\n        { loginId, status: 'enabled' },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  deactivate: (loginId: string): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.updateStatus,\n        { loginId, status: 'disabled' },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  updateEmail: (\n    loginId: string,\n    email: string,\n    isVerified: boolean,\n  ): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.updateEmail,\n        { loginId, email, verified: isVerified },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  updatePhone: (\n    loginId: string,\n    phone: string,\n    isVerified: boolean,\n  ): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.updatePhone,\n        { loginId, phone, verified: isVerified },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  updateDisplayName: (loginId: string, displayName: string): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.updateDisplayName,\n        { loginId, displayName },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  addRoles: (loginId: string, roles: string[]): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.addRole,\n        { loginId, roleNames: roles },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  removeRoles: (loginId: string, roles: string[]): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.removeRole,\n        { loginId, roleNames: roles },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  addTenant: (loginId: string, tenantId: string): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(apiPaths.user.addTenant, { loginId, tenantId }, { token: managementKey }),\n      (data) => data.user,\n    ),\n  removeTenant: (loginId: string, tenantId: string): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.removeTenant,\n        { loginId, tenantId },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  addTenantRoles: (\n    loginId: string,\n    tenantId: string,\n    roles: string[],\n  ): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.addRole,\n        { loginId, tenantId, roleNames: roles },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  removeTenantRoles: (\n    loginId: string,\n    tenantId: string,\n    roles: string[],\n  ): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.removeRole,\n        { loginId, tenantId, roleNames: roles },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n});\n\nexport default withUser;\n","import { SdkResponse, transformResponse } from '@descope/core-js-sdk';\nimport { CoreSdk } from '../types';\nimport apiPaths from './paths';\nimport { CreateTenantResponse, Tenant } from './types';\n\ntype MultipleTenantResponse = {\n  tenants: Tenant[];\n};\n\nconst withTenant = (sdk: CoreSdk, managementKey?: string) => ({\n  create: (\n    name: string,\n    selfProvisioningDomains?: string[],\n  ): Promise<SdkResponse<CreateTenantResponse>> =>\n    transformResponse(\n      sdk.httpClient.post(\n        apiPaths.tenant.create,\n        { name, selfProvisioningDomains },\n        { token: managementKey },\n      ),\n    ),\n  createWithId: (\n    id: string,\n    name: string,\n    selfProvisioningDomains?: string[],\n  ): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(\n        apiPaths.tenant.create,\n        { id, name, selfProvisioningDomains },\n        { token: managementKey },\n      ),\n    ),\n  update: (\n    id: string,\n    name: string,\n    selfProvisioningDomains?: string[],\n  ): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(\n        apiPaths.tenant.update,\n        { id, name, selfProvisioningDomains },\n        { token: managementKey },\n      ),\n    ),\n  delete: (id: string): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(apiPaths.tenant.delete, { id }, { token: managementKey }),\n    ),\n  loadAll: (): Promise<SdkResponse<Tenant[]>> =>\n    transformResponse<MultipleTenantResponse, Tenant[]>(\n      sdk.httpClient.get(apiPaths.tenant.loadAll, {\n        token: managementKey,\n      }),\n      (data) => data.tenants,\n    ),\n});\n\nexport default withTenant;\n","import { SdkResponse, transformResponse } from '@descope/core-js-sdk';\nimport { CoreSdk } from '../types';\nimport apiPaths from './paths';\nimport { UpdateJWTResponse } from './types';\n\nconst withJWT = (sdk: CoreSdk, managementKey?: string) => ({\n  update: (\n    jwt: string,\n    customClaims?: Record<string, any>,\n  ): Promise<SdkResponse<UpdateJWTResponse>> =>\n    transformResponse(\n      sdk.httpClient.post(apiPaths.jwt.update, { jwt, customClaims }, { token: managementKey }),\n    ),\n});\n\nexport default withJWT;\n","import { SdkResponse, transformResponse } from '@descope/core-js-sdk';\nimport { CoreSdk } from '../types';\nimport apiPaths from './paths';\nimport { Permission } from './types';\n\ntype MultiplePermissionResponse = {\n  permissions: Permission[];\n};\n\nconst withPermission = (sdk: CoreSdk, managementKey?: string) => ({\n  create: (name: string, description?: string): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(\n        apiPaths.permission.create,\n        { name, description },\n        { token: managementKey },\n      ),\n    ),\n  update: (name: string, newName: string, description?: string): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(\n        apiPaths.permission.update,\n        { name, newName, description },\n        { token: managementKey },\n      ),\n    ),\n  delete: (name: string): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(apiPaths.permission.delete, { name }, { token: managementKey }),\n    ),\n  loadAll: (): Promise<SdkResponse<Permission[]>> =>\n    transformResponse<MultiplePermissionResponse, Permission[]>(\n      sdk.httpClient.get(apiPaths.permission.loadAll, {\n        token: managementKey,\n      }),\n      (data) => data.permissions,\n    ),\n});\n\nexport default withPermission;\n","import { SdkResponse, transformResponse } from '@descope/core-js-sdk';\nimport { CoreSdk } from '../types';\nimport apiPaths from './paths';\nimport { Role } from './types';\n\ntype MultipleRoleResponse = {\n  roles: Role[];\n};\n\nconst withRole = (sdk: CoreSdk, managementKey?: string) => ({\n  create: (\n    name: string,\n    description?: string,\n    permissionNames?: string[],\n  ): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(\n        apiPaths.role.create,\n        { name, description, permissionNames },\n        { token: managementKey },\n      ),\n    ),\n  update: (\n    name: string,\n    newName: string,\n    description?: string,\n    permissionNames?: string[],\n  ): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(\n        apiPaths.role.update,\n        { name, newName, description, permissionNames },\n        { token: managementKey },\n      ),\n    ),\n  delete: (name: string): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(apiPaths.role.delete, { name }, { token: managementKey }),\n    ),\n  loadAll: (): Promise<SdkResponse<Role[]>> =>\n    transformResponse<MultipleRoleResponse, Role[]>(\n      sdk.httpClient.get(apiPaths.role.loadAll, {\n        token: managementKey,\n      }),\n      (data) => data.roles,\n    ),\n});\n\nexport default withRole;\n","import { SdkResponse, transformResponse } from '@descope/core-js-sdk';\nimport { CoreSdk } from '../types';\nimport apiPaths from './paths';\nimport { Group } from './types';\n\nconst withGroup = (sdk: CoreSdk, managementKey?: string) => ({\n  /**\n   * Load all groups for a specific tenant id.\n   * @param tenantId Tenant ID to load groups from.\n   * @returns Group[] list of groups\n   */\n  loadAllGroups: (tenantId: string): Promise<SdkResponse<Group[]>> =>\n    transformResponse<Group[]>(\n      sdk.httpClient.post(apiPaths.group.loadAllGroups, { tenantId }, { token: managementKey }),\n    ),\n\n  /**\n   * Load all groups for the provided user IDs or login IDs.\n   * @param tenantId Tenant ID to load groups from.\n   * @param userIds Optional List of user IDs, with the format of \"U2J5ES9S8TkvCgOvcrkpzUgVTEBM\" (example), which can be found on the user's JWT.\n   * @param loginIds Optional List of login IDs, how the user identifies when logging in.\n   * @returns Group[] list of groups\n   */\n  loadAllGroupsForMember: (\n    tenantId: string,\n    userIds: string[],\n    loginIds: string[],\n  ): Promise<SdkResponse<Group[]>> =>\n    transformResponse<Group[]>(\n      sdk.httpClient.post(\n        apiPaths.group.loadAllGroupsForMember,\n        { tenantId, loginIds, userIds },\n        { token: managementKey },\n      ),\n    ),\n\n  /**\n   * Load all members of the provided group id.\n   * @param tenantId Tenant ID to load groups from.\n   * @param groupId Group ID to load members for.\n   * @returns Group[] list of groups\n   */\n  loadAllGroupMembers: (tenantId: string, groupId: string): Promise<SdkResponse<Group[]>> =>\n    transformResponse<Group[]>(\n      sdk.httpClient.post(\n        apiPaths.group.loadAllGroupMembers,\n        { tenantId, groupId },\n        { token: managementKey },\n      ),\n    ),\n});\n\nexport default withGroup;\n","import { SdkResponse, transformResponse } from '@descope/core-js-sdk';\nimport { CoreSdk } from '../types';\nimport apiPaths from './paths';\nimport { RoleMapping, AttributeMapping } from './types';\n\nconst withSSOSettings = (sdk: CoreSdk, managementKey?: string) => ({\n  configureSettings: (\n    tenantId: string,\n    idpURL: string,\n    idpCert: string,\n    entityId: string,\n    redirectURL?: string,\n    domain?: string,\n  ): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(\n        apiPaths.sso.configure,\n        { tenantId, idpURL, entityId, idpCert, redirectURL, domain },\n        { token: managementKey },\n      ),\n    ),\n  configureMetadata: (tenantId: string, idpMetadataURL: string): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(\n        apiPaths.sso.metadata,\n        { tenantId, idpMetadataURL },\n        { token: managementKey },\n      ),\n    ),\n  configureMapping: (\n    tenantId: string,\n    roleMapping?: RoleMapping,\n    attributeMapping?: AttributeMapping,\n  ): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(\n        apiPaths.sso.mapping,\n        { tenantId, roleMapping, attributeMapping },\n        { token: managementKey },\n      ),\n    ),\n});\n\nexport default withSSOSettings;\n","import { SdkResponse, transformResponse } from '@descope/core-js-sdk';\nimport { CoreSdk } from '../types';\nimport apiPaths from './paths';\nimport { AccessKey, AssociatedTenant, CreatedAccessKeyResponse } from './types';\n\ntype SingleKeyResponse = {\n  key: AccessKey;\n};\n\ntype MultipleKeysResponse = {\n  keys: AccessKey[];\n};\n\nconst withAccessKey = (sdk: CoreSdk, managementKey?: string) => ({\n  /**\n   * Create a new access key for a project.\n   * @param name Access key name\n   * @param expireTime When the access key expires. Keep at 0 to make it indefinite.\n   * @param roles Optional roles in the project. Does not apply for multi-tenants\n   * @param keyTenants Optional associated tenants for this key and its roles for each.\n   * @returns A newly created key and its cleartext. Make sure to save the cleartext securely.\n   */\n  create: (\n    name: string,\n    expireTime: number,\n    roles?: string[],\n    keyTenants?: AssociatedTenant[],\n  ): Promise<SdkResponse<CreatedAccessKeyResponse>> =>\n    transformResponse(\n      sdk.httpClient.post(\n        apiPaths.accessKey.create,\n        { name, expireTime, roleNames: roles, keyTenants },\n        { token: managementKey },\n      ),\n    ),\n  /**\n   * Load an access key.\n   * @param id Access key ID to load\n   * @returns The loaded access key.\n   */\n  load: (id: string): Promise<SdkResponse<AccessKey>> =>\n    transformResponse<SingleKeyResponse, AccessKey>(\n      sdk.httpClient.get(apiPaths.accessKey.load, {\n        queryParams: { id },\n        token: managementKey,\n      }),\n      (data) => data.key,\n    ),\n  /**\n   * Search all access keys\n   * @param tenantIds Optional tenant ID filter to apply on the search results\n   * @returns An array of found access keys\n   */\n  searchAll: (tenantIds?: string[]): Promise<SdkResponse<AccessKey[]>> =>\n    transformResponse<MultipleKeysResponse, AccessKey[]>(\n      sdk.httpClient.post(apiPaths.accessKey.search, { tenantIds }, { token: managementKey }),\n      (data) => data.keys,\n    ),\n  /**\n   * Update an access key.\n   * @param id Access key ID to load\n   * @param name The updated access key name\n   * @returns The updated access key\n   */\n  update: (id: string, name: string): Promise<SdkResponse<AccessKey>> =>\n    transformResponse<SingleKeyResponse, AccessKey>(\n      sdk.httpClient.post(apiPaths.accessKey.update, { id, name }, { token: managementKey }),\n      (data) => data.key,\n    ),\n  /**\n   * Deactivate an access key. Deactivated access keys cannot be used until they are\n   * activated again.\n   * @param id Access key ID to deactivate\n   */\n  deactivate: (id: string): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(apiPaths.accessKey.deactivate, { id }, { token: managementKey }),\n    ),\n  /**\n   * Activate an access key. Only deactivated access keys can be activated again.\n   * @param id Access key ID to activate\n   */\n  activate: (id: string): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(apiPaths.accessKey.activate, { id }, { token: managementKey }),\n    ),\n  /**\n   * Delete an access key. IMPORTANT: This cannot be undone. Use carefully.\n   * @param id Access key ID to delete\n   */\n  delete: (id: string): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(apiPaths.accessKey.delete, { id }, { token: managementKey }),\n    ),\n});\n\nexport default withAccessKey;\n","import { SdkResponse, transformResponse } from '@descope/core-js-sdk';\nimport { CoreSdk } from '../types';\nimport apiPaths from './paths';\nimport { FlowResponse, Screen, Flow } from './types';\n\nconst WithFlow = (sdk: CoreSdk, managementKey?: string) => ({\n  export: (flowId: string): Promise<SdkResponse<FlowResponse>> =>\n    transformResponse(\n      sdk.httpClient.post(apiPaths.flow.export, { flowId }, { token: managementKey }),\n    ),\n  import: (flowId: string, flow: Flow, screens?: Screen[]): Promise<SdkResponse<FlowResponse>> =>\n    transformResponse(\n      sdk.httpClient.post(\n        apiPaths.flow.import,\n        { flowId, flow, screens },\n        { token: managementKey },\n      ),\n    ),\n});\n\nexport default WithFlow;\n","import { SdkResponse, transformResponse } from '@descope/core-js-sdk';\nimport { CoreSdk } from '../types';\nimport apiPaths from './paths';\nimport { Theme, ThemeResponse } from './types';\n\nconst WithTheme = (sdk: CoreSdk, managementKey?: string) => ({\n  export: (): Promise<SdkResponse<ThemeResponse>> =>\n    transformResponse(sdk.httpClient.post(apiPaths.theme.export, {}, { token: managementKey })),\n  import: (theme: Theme): Promise<SdkResponse<ThemeResponse>> =>\n    transformResponse(\n      sdk.httpClient.post(apiPaths.theme.import, { theme }, { token: managementKey }),\n    ),\n});\n\nexport default WithTheme;\n","import nodeFetch, { Headers } from 'node-fetch-commonjs';\n\nglobalThis.Headers ??= Headers;\n\nconst highWaterMarkMb = 1024 * 1024 * 1024 * 30; // 30MB\n\n// we are increasing the response buffer size due to an issue where node-fetch hangs when response is too big\nconst patchedFetch = (...args: Parameters<typeof nodeFetch>) => {\n  // we can get Request on the first arg, or RequestInfo on the second arg\n  // we want to make sure we are setting the \"highWaterMark\" so we are doing it on both args\n  args.forEach((arg) => {\n    // eslint-disable-next-line no-param-reassign, @typescript-eslint/no-unused-expressions\n    arg && ((arg as any).highWaterMark ??= highWaterMarkMb);\n  });\n\n  return nodeFetch(...args);\n};\n\nexport default patchedFetch as unknown as typeof fetch;\n","import createSdk, { ExchangeAccessKeyResponse, SdkResponse, wrapWith } from '@descope/core-js-sdk';\nimport { JWK, JWTHeaderParameters, KeyLike, errors, importJWK, jwtVerify } from 'jose';\nimport {\n  permissionsClaimName,\n  refreshTokenCookieName,\n  rolesClaimName,\n  sessionTokenCookieName,\n} from './constants';\nimport { getAuthorizationClaimItems, withCookie } from './helpers';\nimport withManagement from './management';\nimport { AuthenticationInfo } from './types';\nimport fetch from './fetch-polyfill';\n\ndeclare const BUILD_VERSION: string;\n\n/** Configuration arguments which include the Descope core SDK args and an optional management key */\ntype NodeSdkArgs = Parameters<typeof createSdk>[0] & {\n  managementKey?: string;\n};\n\nconst nodeSdk = ({ managementKey, ...config }: NodeSdkArgs) => {\n  const coreSdk = createSdk({\n    ...config,\n    fetch,\n    baseHeaders: {\n      ...config.baseHeaders,\n      'x-descope-sdk-name': 'nodejs',\n      'x-descope-sdk-node-version': process?.versions?.node || '',\n      'x-descope-sdk-version': BUILD_VERSION,\n    },\n  });\n\n  const { projectId, logger } = config;\n\n  const keys: Record<string, KeyLike | Uint8Array> = {};\n\n  /** Fetch the public keys (JWKs) from Descope for the configured project */\n  const fetchKeys = async () => {\n    const keysWrapper = await coreSdk.httpClient\n      .get(`v2/keys/${projectId}`)\n      .then((resp) => resp.json());\n    const publicKeys: JWK[] = keysWrapper.keys;\n    if (!Array.isArray(publicKeys)) return {};\n    const kidJwksPairs = await Promise.all(\n      publicKeys.map(async (key) => [key.kid, await importJWK(key)]),\n    );\n\n    return kidJwksPairs.reduce(\n      (acc, [kid, jwk]) => (kid ? { ...acc, [kid.toString()]: jwk } : acc),\n      {},\n    );\n  };\n\n  const management = withManagement(coreSdk, managementKey);\n\n  const sdk = {\n    ...coreSdk,\n\n    /**\n     * Provides various APIs for managing a Descope project programmatically. A management key must\n     * be provided as an argument when initializing the SDK to use these APIs. Management keys can be\n     * generated in the Descope console.\n     */\n    management,\n\n    /** Get the key that can validate the given JWT KID in the header. Can retrieve the public key from local cache or from Descope. */\n    async getKey(header: JWTHeaderParameters): Promise<KeyLike | Uint8Array> {\n      if (!header?.kid) throw Error('header.kid must not be empty');\n\n      if (keys[header.kid]) return keys[header.kid];\n\n      // do we need to fetch once or every time?\n      Object.assign(keys, await fetchKeys());\n\n      if (!keys[header.kid]) throw Error('failed to fetch matching key');\n\n      return keys[header.kid];\n    },\n\n    /**\n     * Validate the given JWT with the right key and make sure the issuer is correct\n     * @param jwt the JWT string to parse and validate\n     * @returns AuthenticationInfo with the parsed token and JWT. Will throw an error if validation fails.\n     */\n    async validateJwt(jwt: string): Promise<AuthenticationInfo> {\n      // Do not hard-code the algo because library does not support `None` so all are valid\n      const res = await jwtVerify(jwt, sdk.getKey, { clockTolerance: 5 });\n      const token = res.payload;\n\n      if (token) {\n        token.iss = token.iss?.split('/').pop(); // support both url and project id as issuer\n        if (token.iss !== projectId) {\n          // We must do the verification here, since issuer can be either project ID or URL\n          throw new errors.JWTClaimValidationFailed(\n            'unexpected \"iss\" claim value',\n            'iss',\n            'check_failed',\n          );\n        }\n      }\n\n      return { jwt, token };\n    },\n\n    /**\n     * Validate an active session\n     * @param sessionToken session JWT to validate\n     * @returns AuthenticationInfo promise or throws Error if there is an issue with JWTs\n     */\n    async validateSession(sessionToken: string): Promise<AuthenticationInfo> {\n      if (!sessionToken) throw Error('session token is required for validation');\n\n      try {\n        const token = await sdk.validateJwt(sessionToken);\n        return token;\n      } catch (error) {\n        /* istanbul ignore next */\n        logger?.error('session validation failed', error);\n        throw Error('session validation failed');\n      }\n    },\n\n    /**\n     * Refresh the session using a refresh token\n     * @param refreshToken refresh JWT to refresh the session with\n     * @returns AuthenticationInfo promise or throws Error if there is an issue with JWTs\n     */\n    async refreshSession(refreshToken: string): Promise<AuthenticationInfo> {\n      if (!refreshToken) throw Error('refresh token is required to refresh a session');\n\n      try {\n        await sdk.validateJwt(refreshToken);\n        const jwtResp = await sdk.refresh(refreshToken);\n        if (jwtResp.ok) {\n          const token = await sdk.validateJwt(jwtResp.data?.sessionJwt);\n          return token;\n        }\n        /* istanbul ignore next */\n        throw Error(jwtResp.error?.errorMessage);\n      } catch (refreshTokenErr) {\n        /* istanbul ignore next */\n        logger?.error('refresh token validation failed', refreshTokenErr);\n        throw Error('refresh token validation failed');\n      }\n    },\n\n    /**\n     * Validate session and refresh it if it expired\n     * @param sessionToken session JWT\n     * @param refreshToken refresh JWT\n     * @returns AuthenticationInfo promise or throws Error if there is an issue with JWTs\n     */\n    async validateAndRefreshSession(\n      sessionToken?: string,\n      refreshToken?: string,\n    ): Promise<AuthenticationInfo> {\n      if (!sessionToken && !refreshToken) throw Error('both session and refresh tokens are empty');\n\n      try {\n        const token = await sdk.validateSession(sessionToken);\n        return token;\n      } catch (error) {\n        /* istanbul ignore next */\n        logger?.log('session validation failed - trying to refresh it');\n      }\n\n      return sdk.refreshSession(refreshToken);\n    },\n\n    /**\n     * Exchange API key (access key) for a session key\n     * @param accessKey access key to exchange for a session JWT\n     * @returns AuthneticationInfo with session JWT data\n     */\n    async exchangeAccessKey(accessKey: string): Promise<AuthenticationInfo> {\n      if (!accessKey) throw Error('access key must not be empty');\n\n      let resp: SdkResponse<ExchangeAccessKeyResponse>;\n      try {\n        resp = await sdk.accessKey.exchange(accessKey);\n      } catch (error) {\n        logger?.error('failed to exchange access key', error);\n        throw Error('could not exchange access key');\n      }\n\n      const { sessionJwt } = resp.data;\n      if (!sessionJwt) {\n        logger?.error('failed to parse exchange access key response');\n        throw Error('could not exchange access key');\n      }\n\n      try {\n        const token = await sdk.validateJwt(sessionJwt);\n        return token;\n      } catch (error) {\n        logger?.error('failed to parse jwt from access key', error);\n        throw Error('could not exchange access key');\n      }\n    },\n\n    /**\n     * Make sure that all given permissions exist on the parsed JWT top level claims\n     * @param authInfo JWT parsed info\n     * @param permissions list of permissions to make sure they exist on te JWT claims\n     * @returns true if all permissions exist, false otherwise\n     */\n    validatePermissions(authInfo: AuthenticationInfo, permissions: string[]): boolean {\n      return sdk.validateTenantPermissions(authInfo, null, permissions);\n    },\n\n    /**\n     * Make sure that all given permissions exist on the parsed JWT tenant claims\n     * @param authInfo JWT parsed info\n     * @param permissions list of permissions to make sure they exist on te JWT claims\n     * @returns true if all permissions exist, false otherwise\n     */\n    validateTenantPermissions(\n      authInfo: AuthenticationInfo,\n      tenant: string,\n      permissions: string[],\n    ): boolean {\n      const granted = getAuthorizationClaimItems(authInfo, permissionsClaimName, tenant);\n      return permissions.every((perm) => granted.includes(perm));\n    },\n\n    /**\n     * Make sure that all given roles exist on the parsed JWT top level claims\n     * @param authInfo JWT parsed info\n     * @param roles list of roles to make sure they exist on te JWT claims\n     * @returns true if all roles exist, false otherwise\n     */\n    validateRoles(authInfo: AuthenticationInfo, roles: string[]): boolean {\n      return sdk.validateTenantRoles(authInfo, null, roles);\n    },\n\n    /**\n     * Make sure that all given roles exist on the parsed JWT tenant claims\n     * @param authInfo JWT parsed info\n     * @param roles list of roles to make sure they exist on te JWT claims\n     * @returns true if all roles exist, false otherwise\n     */\n    validateTenantRoles(authInfo: AuthenticationInfo, tenant: string, roles: string[]): boolean {\n      const membership = getAuthorizationClaimItems(authInfo, rolesClaimName, tenant);\n      return roles.every((role) => membership.includes(role));\n    },\n  };\n\n  return wrapWith(\n    sdk,\n    [\n      'otp.verify.email',\n      'otp.verify.sms',\n      'otp.verify.whatsapp',\n      'magicLink.verify',\n      'enchantedLink.signUp',\n      'enchantedLink.signIn',\n      'oauth.exchange',\n      'saml.exchange',\n      'totp.verify',\n      'webauthn.signIn.finish',\n      'webauthn.signUp.finish',\n      'refresh',\n    ] as const,\n    withCookie,\n  );\n};\n\n/** Descope SDK client with delivery methods enum.\n *\n * Please see full documentation at {@link https://docs.descope.com/guides Descope Docs}\n * @example Usage\n *\n * ```js\n * import descopeSdk from '@descope/node-sdk';\n *\n * const myProjectId = 'xxx';\n * const sdk = descopeSdk({ projectId: myProjectId });\n *\n * const userLoginId = 'loginId';\n * sdk.otp.signIn.email(userLoginId);\n * const jwtResponse = sdk.otp.verify.email(userLoginId, codeFromEmail);\n * ```\n */\n\nnodeSdk.RefreshTokenCookieName = refreshTokenCookieName;\nnodeSdk.SessionTokenCookieName = sessionTokenCookieName;\n\nexport default nodeSdk;\nexport type { DeliveryMethod, OAuthProvider } from '@descope/core-js-sdk';\n","import { CoreSdk } from '../types';\nimport withUser from './user';\nimport withTenant from './tenant';\nimport withJWT from './jwt';\nimport withPermission from './permission';\nimport withRole from './role';\nimport withGroup from './group';\nimport withSSOSettings from './sso';\nimport withAccessKey from './accesskey';\nimport WithFlow from './flow';\nimport WithTheme from './theme';\n\n/** Constructs a higher level Management API that wraps the functions from code-js-sdk */\nconst withManagement = (sdk: CoreSdk, managementKey?: string) => ({\n  user: withUser(sdk, managementKey),\n  accessKey: withAccessKey(sdk, managementKey),\n  tenant: withTenant(sdk, managementKey),\n  sso: withSSOSettings(sdk, managementKey),\n  jwt: withJWT(sdk, managementKey),\n  permission: withPermission(sdk, managementKey),\n  role: withRole(sdk, managementKey),\n  group: withGroup(sdk, managementKey),\n  flow: WithFlow(sdk, managementKey),\n  theme: WithTheme(sdk, managementKey),\n});\n\nexport default withManagement;\n"],"names":["withCookie","fn","async","args","resp","data","_d","refreshJwt","rest","__rest","cookies","options","push","cookieDomain","cookieMaxAge","cookiePath","_a","response","headers","get","cookie","name","match","RegExp","getCookieValue","_b","_c","Object","assign","getAuthorizationClaimItems","authInfo","claim","tenant","value","token","Array","isArray","apiPaths","create","update","delete","load","search","updateStatus","updateEmail","updatePhone","updateDisplayName","addRole","removeRole","addTenant","removeTenant","deactivate","activate","loadAll","configure","metadata","mapping","export","import","loadAllGroups","loadAllGroupsForMember","loadAllGroupMembers","withUser","sdk","managementKey","loginId","email","phone","displayName","roles","userTenants","transformResponse","httpClient","post","roleNames","user","invite","queryParams","loadByUserId","userId","searchAll","tenantIds","limit","page","users","status","isVerified","verified","addRoles","removeRoles","tenantId","addTenantRoles","removeTenantRoles","withTenant","selfProvisioningDomains","createWithId","id","tenants","withJWT","jwt","customClaims","withPermission","description","newName","permissions","withRole","permissionNames","withGroup","userIds","loginIds","groupId","withSSOSettings","configureSettings","idpURL","idpCert","entityId","redirectURL","domain","configureMetadata","idpMetadataURL","configureMapping","roleMapping","attributeMapping","withAccessKey","expireTime","keyTenants","key","keys","WithFlow","flowId","flow","screens","WithTheme","theme","globalThis","Headers","patchedFetch","forEach","arg","highWaterMark","nodeFetch","nodeSdk","config","coreSdk","createSdk","fetch","baseHeaders","process","versions","node","projectId","logger","management","accessKey","sso","permission","role","group","withManagement","header","kid","Error","publicKeys","then","json","Promise","all","map","importJWK","reduce","acc","jwk","toString","fetchKeys","jwtVerify","getKey","clockTolerance","payload","iss","split","pop","errors","JWTClaimValidationFailed","sessionToken","validateJwt","error","refreshToken","jwtResp","refresh","ok","sessionJwt","errorMessage","refreshTokenErr","validateSession","log","refreshSession","exchange","validatePermissions","validateTenantPermissions","granted","every","perm","includes","validateRoles","validateTenantRoles","membership","wrapWith","RefreshTokenCookieName","SessionTokenCookieName"],"mappings":"sNAEO,MC+BMA,EACVC,GACDC,SAAUC,eACR,MAAMC,QAAaH,KAAME,GAGzB,IAAKC,EAAKC,KACR,OAAOD,EAIT,IAAIE,EAA0BF,EAAKC,MAA/BE,WAAEA,GAAUD,EAAKE,EAAjBC,EAAAH,EAAA,CAAA,eACJ,MAAMI,EAAoB,GAlCP,IAA8BC,EAgDjD,OAZKJ,EASHG,EAAQE,KA5CZ,GDVoC,SCsDoBL,cA5C5BI,OADuBA,EA6CiBH,QA5CxC,EAAAG,EAASE,eAAgB,gBACnDF,aAAA,EAAAA,EAASG,eAAgB,aACjBH,aAAA,EAAAA,EAASI,aAAc,mCAkCZ,QAAbC,EAAAZ,EAAKa,gBAAQ,IAAAD,OAAA,EAAAA,EAAEE,QAAQC,IAAI,iBAC7BZ,EA3Be,EAACa,EAAmCC,KACzD,MAAMC,EAAQF,eAAAA,EAAQE,MAAMC,OAAO,cAAcF,cACjD,OAAOC,EAAQA,EAAM,GAAK,IAAI,EAyBXE,CACE,QAAbC,EAAArB,EAAKa,gBAAQ,IAAAQ,OAAA,EAAAA,EAAEP,QAAQC,IAAI,cDhDC,OCmD9BT,EAAQE,KAAoB,QAAfc,EAAAtB,EAAKa,gBAAU,IAAAS,OAAA,EAAAA,EAAAR,QAAQC,IAAI,gBAMhCQ,OAAAC,OAAAD,OAAAC,OAAA,CAAA,EAAAxB,GAAM,CAAAC,KAAWsB,OAAAC,OAAAD,OAAAC,OAAA,GAAAxB,EAAKC,MAAM,CAAAE,aAAYG,aAAY,WAUpDmB,EACdC,EACAC,EACAC,WAEA,MAAMC,EAAQD,EAC0C,QAApDP,EAA6C,QAA7CT,EAAAc,EAASI,MAAgC,eAAI,IAAAlB,OAAA,EAAAA,EAAAgB,UAAO,IAAAP,OAAA,EAAAA,EAAGM,GACvDD,EAASI,MAAMH,GACnB,OAAOI,MAAMC,QAAQH,GAASA,EAAQ,EACxC,CC7EA,IAAeI,EACP,CACJC,OAAQ,uBACRC,OAAQ,uBACRC,OAAQ,uBACRC,KAAM,gBACNC,OAAQ,uBACRC,aAAc,8BACdC,YAAa,6BACbC,YAAa,6BACbC,kBAAmB,4BACnBC,QAAS,gCACTC,WAAY,mCACZC,UAAW,kCACXC,aAAc,sCAdHb,EAgBF,CACTC,OAAQ,4BACRG,KAAM,qBACNC,OAAQ,4BACRH,OAAQ,4BACRY,WAAY,gCACZC,SAAU,8BACVZ,OAAQ,6BAvBGH,EAyBL,CACNC,OAAQ,yBACRC,OAAQ,yBACRC,OAAQ,yBACRa,QAAS,uBA7BEhB,EA+BR,CACHiB,UAAW,wBACXC,SAAU,wBACVC,QAAS,wBAlCEnB,EAoCR,CACHE,OAAQ,uBArCGF,EAuCD,CACVC,OAAQ,6BACRC,OAAQ,6BACRC,OAAQ,6BACRa,QAAS,2BA3CEhB,EA6CP,CACJC,OAAQ,uBACRC,OAAQ,uBACRC,OAAQ,uBACRa,QAAS,qBAjDEhB,EAmDP,CACJoB,OAAQ,uBACRC,OAAQ,wBArDGrB,EAuDN,CACLoB,OAAQ,wBACRC,OAAQ,yBAzDGrB,EA2DN,CACLsB,cAAe,qBACfC,uBAAwB,4BACxBC,oBAAqB,0BClDzB,MAAMC,EAAW,CAACC,EAAcC,KAA4B,CAC1D1B,OAAQ,CACN2B,EACAC,EACAC,EACAC,EACAC,EACAC,IAEAC,EACER,EAAIS,WAAWC,KACbpC,EAAcC,OACd,CAAE2B,UAASC,QAAOC,QAAOC,cAAaM,UAAWL,EAAOC,eACxD,CAAEpC,MAAO8B,KAEV3D,GAASA,EAAKsE,OAEnBC,OAAQ,CACNX,EACAC,EACAC,EACAC,EACAC,EACAC,IAEAC,EACER,EAAIS,WAAWC,KACbpC,EAAcC,OACd,CAAE2B,UAASC,QAAOC,QAAOC,cAAaM,UAAWL,EAAOC,cAAaM,QAAQ,GAC7E,CAAE1C,MAAO8B,KAEV3D,GAASA,EAAKsE,OAEnBpC,OAAQ,CACN0B,EACAC,EACAC,EACAC,EACAC,EACAC,IAEAC,EACER,EAAIS,WAAWC,KACbpC,EAAcE,OACd,CAAE0B,UAASC,QAAOC,QAAOC,cAAaM,UAAWL,EAAOC,eACxD,CAAEpC,MAAO8B,KAEV3D,GAASA,EAAKsE,OAEnBnC,OAASyB,GACPM,EACER,EAAIS,WAAWC,KAAKpC,EAAcG,OAAQ,CAAEyB,WAAW,CAAE/B,MAAO8B,KAEpEvB,KAAOwB,GACLM,EACER,EAAIS,WAAWrD,IAAIkB,EAAcI,KAAM,CACrCoC,YAAa,CAAEZ,WACf/B,MAAO8B,KAER3D,GAASA,EAAKsE,OAQnBG,aAAeC,GACbR,EACER,EAAIS,WAAWrD,IAAIkB,EAAcI,KAAM,CACrCoC,YAAa,CAAEE,UACf7C,MAAO8B,KAER3D,GAASA,EAAKsE,OAWnBK,UAAW,CACTC,EACAZ,EACAa,EACAC,IAEAZ,EACER,EAAIS,WAAWC,KACbpC,EAAcK,OACd,CAAEuC,YAAWP,UAAWL,EAAOa,QAAOC,QACtC,CAAEjD,MAAO8B,KAEV3D,GAASA,EAAK+E,QAEnBhC,SAAWa,GACTM,EACER,EAAIS,WAAWC,KACbpC,EAAcM,aACd,CAAEsB,UAASoB,OAAQ,WACnB,CAAEnD,MAAO8B,KAEV3D,GAASA,EAAKsE,OAEnBxB,WAAac,GACXM,EACER,EAAIS,WAAWC,KACbpC,EAAcM,aACd,CAAEsB,UAASoB,OAAQ,YACnB,CAAEnD,MAAO8B,KAEV3D,GAASA,EAAKsE,OAEnB/B,YAAa,CACXqB,EACAC,EACAoB,IAEAf,EACER,EAAIS,WAAWC,KACbpC,EAAcO,YACd,CAAEqB,UAASC,QAAOqB,SAAUD,GAC5B,CAAEpD,MAAO8B,KAEV3D,GAASA,EAAKsE,OAEnB9B,YAAa,CACXoB,EACAE,EACAmB,IAEAf,EACER,EAAIS,WAAWC,KACbpC,EAAcQ,YACd,CAAEoB,UAASE,QAAOoB,SAAUD,GAC5B,CAAEpD,MAAO8B,KAEV3D,GAASA,EAAKsE,OAEnB7B,kBAAmB,CAACmB,EAAiBG,IACnCG,EACER,EAAIS,WAAWC,KACbpC,EAAcS,kBACd,CAAEmB,UAASG,eACX,CAAElC,MAAO8B,KAEV3D,GAASA,EAAKsE,OAEnBa,SAAU,CAACvB,EAAiBI,IAC1BE,EACER,EAAIS,WAAWC,KACbpC,EAAcU,QACd,CAAEkB,UAASS,UAAWL,GACtB,CAAEnC,MAAO8B,KAEV3D,GAASA,EAAKsE,OAEnBc,YAAa,CAACxB,EAAiBI,IAC7BE,EACER,EAAIS,WAAWC,KACbpC,EAAcW,WACd,CAAEiB,UAASS,UAAWL,GACtB,CAAEnC,MAAO8B,KAEV3D,GAASA,EAAKsE,OAEnB1B,UAAW,CAACgB,EAAiByB,IAC3BnB,EACER,EAAIS,WAAWC,KAAKpC,EAAcY,UAAW,CAAEgB,UAASyB,YAAY,CAAExD,MAAO8B,KAC5E3D,GAASA,EAAKsE,OAEnBzB,aAAc,CAACe,EAAiByB,IAC9BnB,EACER,EAAIS,WAAWC,KACbpC,EAAca,aACd,CAAEe,UAASyB,YACX,CAAExD,MAAO8B,KAEV3D,GAASA,EAAKsE,OAEnBgB,eAAgB,CACd1B,EACAyB,EACArB,IAEAE,EACER,EAAIS,WAAWC,KACbpC,EAAcU,QACd,CAAEkB,UAASyB,WAAUhB,UAAWL,GAChC,CAAEnC,MAAO8B,KAEV3D,GAASA,EAAKsE,OAEnBiB,kBAAmB,CACjB3B,EACAyB,EACArB,IAEAE,EACER,EAAIS,WAAWC,KACbpC,EAAcW,WACd,CAAEiB,UAASyB,WAAUhB,UAAWL,GAChC,CAAEnC,MAAO8B,KAEV3D,GAASA,EAAKsE,SCnNfkB,EAAa,CAAC9B,EAAcC,KAA4B,CAC5D1B,OAAQ,CACNjB,EACAyE,IAEAvB,EACER,EAAIS,WAAWC,KACbpC,EAAgBC,OAChB,CAAEjB,OAAMyE,2BACR,CAAE5D,MAAO8B,KAGf+B,aAAc,CACZC,EACA3E,EACAyE,IAEAvB,EACER,EAAIS,WAAWC,KACbpC,EAAgBC,OAChB,CAAE0D,KAAI3E,OAAMyE,2BACZ,CAAE5D,MAAO8B,KAGfzB,OAAQ,CACNyD,EACA3E,EACAyE,IAEAvB,EACER,EAAIS,WAAWC,KACbpC,EAAgBE,OAChB,CAAEyD,KAAI3E,OAAMyE,2BACZ,CAAE5D,MAAO8B,KAGfxB,OAASwD,GACPzB,EACER,EAAIS,WAAWC,KAAKpC,EAAgBG,OAAQ,CAAEwD,MAAM,CAAE9D,MAAO8B,KAEjEX,QAAS,IACPkB,EACER,EAAIS,WAAWrD,IAAIkB,EAAgBgB,QAAS,CAC1CnB,MAAO8B,KAER3D,GAASA,EAAK4F,YCjDfC,EAAU,CAACnC,EAAcC,KAA4B,CACzDzB,OAAQ,CACN4D,EACAC,IAEA7B,EACER,EAAIS,WAAWC,KAAKpC,EAAaE,OAAQ,CAAE4D,MAAKC,gBAAgB,CAAElE,MAAO8B,OCFzEqC,EAAiB,CAACtC,EAAcC,KAA4B,CAChE1B,OAAQ,CAACjB,EAAciF,IACrB/B,EACER,EAAIS,WAAWC,KACbpC,EAAoBC,OACpB,CAAEjB,OAAMiF,eACR,CAAEpE,MAAO8B,KAGfzB,OAAQ,CAAClB,EAAckF,EAAiBD,IACtC/B,EACER,EAAIS,WAAWC,KACbpC,EAAoBE,OACpB,CAAElB,OAAMkF,UAASD,eACjB,CAAEpE,MAAO8B,KAGfxB,OAASnB,GACPkD,EACER,EAAIS,WAAWC,KAAKpC,EAAoBG,OAAQ,CAAEnB,QAAQ,CAAEa,MAAO8B,KAEvEX,QAAS,IACPkB,EACER,EAAIS,WAAWrD,IAAIkB,EAAoBgB,QAAS,CAC9CnB,MAAO8B,KAER3D,GAASA,EAAKmG,gBC1BfC,EAAW,CAAC1C,EAAcC,KAA4B,CAC1D1B,OAAQ,CACNjB,EACAiF,EACAI,IAEAnC,EACER,EAAIS,WAAWC,KACbpC,EAAcC,OACd,CAAEjB,OAAMiF,cAAaI,mBACrB,CAAExE,MAAO8B,KAGfzB,OAAQ,CACNlB,EACAkF,EACAD,EACAI,IAEAnC,EACER,EAAIS,WAAWC,KACbpC,EAAcE,OACd,CAAElB,OAAMkF,UAASD,cAAaI,mBAC9B,CAAExE,MAAO8B,KAGfxB,OAASnB,GACPkD,EACER,EAAIS,WAAWC,KAAKpC,EAAcG,OAAQ,CAAEnB,QAAQ,CAAEa,MAAO8B,KAEjEX,QAAS,IACPkB,EACER,EAAIS,WAAWrD,IAAIkB,EAAcgB,QAAS,CACxCnB,MAAO8B,KAER3D,GAASA,EAAKgE,UCvCfsC,EAAY,CAAC5C,EAAcC,KAA4B,CAM3DL,cAAgB+B,GACdnB,EACER,EAAIS,WAAWC,KAAKpC,EAAesB,cAAe,CAAE+B,YAAY,CAAExD,MAAO8B,KAU7EJ,uBAAwB,CACtB8B,EACAkB,EACAC,IAEAtC,EACER,EAAIS,WAAWC,KACbpC,EAAeuB,uBACf,CAAE8B,WAAUmB,WAAUD,WACtB,CAAE1E,MAAO8B,KAUfH,oBAAqB,CAAC6B,EAAkBoB,IACtCvC,EACER,EAAIS,WAAWC,KACbpC,EAAewB,oBACf,CAAE6B,WAAUoB,WACZ,CAAE5E,MAAO8B,OC1CX+C,EAAkB,CAAChD,EAAcC,KAA4B,CACjEgD,kBAAmB,CACjBtB,EACAuB,EACAC,EACAC,EACAC,EACAC,IAEA9C,EACER,EAAIS,WAAWC,KACbpC,EAAaiB,UACb,CAAEoC,WAAUuB,SAAQE,WAAUD,UAASE,cAAaC,UACpD,CAAEnF,MAAO8B,KAGfsD,kBAAmB,CAAC5B,EAAkB6B,IACpChD,EACER,EAAIS,WAAWC,KACbpC,EAAakB,SACb,CAAEmC,WAAU6B,kBACZ,CAAErF,MAAO8B,KAGfwD,iBAAkB,CAChB9B,EACA+B,EACAC,IAEAnD,EACER,EAAIS,WAAWC,KACbpC,EAAamB,QACb,CAAEkC,WAAU+B,cAAaC,oBACzB,CAAExF,MAAO8B,OCzBX2D,EAAgB,CAAC5D,EAAcC,KAA4B,CAS/D1B,OAAQ,CACNjB,EACAuG,EACAvD,EACAwD,IAEAtD,EACER,EAAIS,WAAWC,KACbpC,EAAmBC,OACnB,CAAEjB,OAAMuG,aAAYlD,UAAWL,EAAOwD,cACtC,CAAE3F,MAAO8B,KAQfvB,KAAOuD,GACLzB,EACER,EAAIS,WAAWrD,IAAIkB,EAAmBI,KAAM,CAC1CoC,YAAa,CAAEmB,MACf9D,MAAO8B,KAER3D,GAASA,EAAKyH,MAOnB9C,UAAYC,GACVV,EACER,EAAIS,WAAWC,KAAKpC,EAAmBK,OAAQ,CAAEuC,aAAa,CAAE/C,MAAO8B,KACtE3D,GAASA,EAAK0H,OAQnBxF,OAAQ,CAACyD,EAAY3E,IACnBkD,EACER,EAAIS,WAAWC,KAAKpC,EAAmBE,OAAQ,CAAEyD,KAAI3E,QAAQ,CAAEa,MAAO8B,KACrE3D,GAASA,EAAKyH,MAOnB3E,WAAa6C,GACXzB,EACER,EAAIS,WAAWC,KAAKpC,EAAmBc,WAAY,CAAE6C,MAAM,CAAE9D,MAAO8B,KAMxEZ,SAAW4C,GACTzB,EACER,EAAIS,WAAWC,KAAKpC,EAAmBe,SAAU,CAAE4C,MAAM,CAAE9D,MAAO8B,KAMtExB,OAASwD,GACPzB,EACER,EAAIS,WAAWC,KAAKpC,EAAmBG,OAAQ,CAAEwD,MAAM,CAAE9D,MAAO8B,OCvFhEgE,EAAW,CAACjE,EAAcC,KAA4B,CAC1DP,OAASwE,GACP1D,EACER,EAAIS,WAAWC,KAAKpC,EAAcoB,OAAQ,CAAEwE,UAAU,CAAE/F,MAAO8B,KAEnEN,OAAQ,CAACuE,EAAgBC,EAAYC,IACnC5D,EACER,EAAIS,WAAWC,KACbpC,EAAcqB,OACd,CAAEuE,SAAQC,OAAMC,WAChB,CAAEjG,MAAO8B,OCVXoE,EAAY,CAACrE,EAAcC,KAA4B,CAC3DP,OAAQ,IACNc,EAAkBR,EAAIS,WAAWC,KAAKpC,EAAeoB,OAAQ,CAAE,EAAE,CAAEvB,MAAO8B,KAC5EN,OAAS2E,GACP9D,EACER,EAAIS,WAAWC,KAAKpC,EAAeqB,OAAQ,CAAE2E,SAAS,CAAEnG,MAAO8B,aCRnD,QAAlBhD,EAAAsH,WAAWC,eAAO,IAAAvH,IAAlBsH,WAAWC,QAAYA,GAEvB,MAGMC,EAAe,IAAIrI,KAGvBA,EAAKsI,SAASC,YAEZA,YAAS1H,GAAAS,EAAAiH,GAAYC,+BAAAA,cARD,aAQmC,IAGlDC,KAAazI,ICKhB0I,EAAW7H,WAAAgD,cAAEA,GAAuChD,EAArB8H,EAAMrI,EAAAO,EAA1B,mBACf,MAAM+H,EAAUC,EACXrH,OAAAC,OAAAD,OAAAC,OAAA,CAAA,EAAAkH,UACHG,EACAC,YAAWvH,OAAAC,OAAAD,OAAAC,OAAA,CAAA,EACNkH,EAAOI,cACV,qBAAsB,SACtB,8BAAiD,UAAZ,OAAPC,cAAO,IAAPA,aAAO,EAAPA,QAASC,gBAAU,IAAA3H,OAAA,EAAAA,EAAA4H,OAAQ,GACzD,wBAAyB,cAIvBC,UAAEA,EAASC,OAAEA,GAAWT,EAExBf,EAA6C,CAAA,EAmB7CyB,ECxCe,EAACzF,EAAcC,KAA4B,CAChEW,KAAMb,EAASC,EAAKC,GACpByF,UAAW9B,EAAc5D,EAAKC,GAC9BhC,OAAQ6D,EAAW9B,EAAKC,GACxB0F,IAAK3C,EAAgBhD,EAAKC,GAC1BmC,IAAKD,EAAQnC,EAAKC,GAClB2F,WAAYtD,EAAetC,EAAKC,GAChC4F,KAAMnD,EAAS1C,EAAKC,GACpB6F,MAAOlD,EAAU5C,EAAKC,GACtBkE,KAAMF,EAASjE,EAAKC,GACpBqE,MAAOD,EAAUrE,EAAKC,KD8BH8F,CAAef,EAAS/E,GAErCD,iCACDgF,GAAO,CAOVS,aAGAtJ,aAAa6J,GACX,KAAKA,aAAA,EAAAA,EAAQC,KAAK,MAAMC,MAAM,gCAE9B,GAAIlC,EAAKgC,EAAOC,KAAM,OAAOjC,EAAKgC,EAAOC,KAKzC,GAFArI,OAAOC,OAAOmG,OAnCA7H,WAChB,MAGMgK,SAHoBnB,EAAQvE,WAC/BrD,IAAI,WAAWmI,KACfa,MAAM/J,GAASA,EAAKgK,UACerC,KACtC,OAAK5F,MAAMC,QAAQ8H,UACQG,QAAQC,IACjCJ,EAAWK,KAAIrK,MAAO4H,GAAQ,CAACA,EAAIkC,UAAWQ,EAAU1C,QAGtC2C,QAClB,CAACC,GAAMV,EAAKW,KAAUX,EAAWrI,OAAAC,OAAAD,OAAAC,OAAA,CAAA,EAAA8I,IAAK,CAACV,EAAIY,YAAaD,IAAQD,GAChE,CAAE,GAPmC,EAQtC,EAsB2BG,KAErB9C,EAAKgC,EAAOC,KAAM,MAAMC,MAAM,gCAEnC,OAAOlC,EAAKgC,EAAOC,IACpB,EAOD9J,kBAAkBiG,SAEhB,MACMjE,SADY4I,EAAU3E,EAAKpC,EAAIgH,OAAQ,CAAEC,eAAgB,KAC7CC,QAElB,GAAI/I,IACFA,EAAMgJ,IAAe,QAATlK,EAAAkB,EAAMgJ,WAAG,IAAAlK,OAAA,EAAAA,EAAEmK,MAAM,KAAKC,MAC9BlJ,EAAMgJ,MAAQ5B,GAEhB,MAAM,IAAI+B,EAAOC,yBACf,+BACA,MACA,gBAKN,MAAO,CAAEnF,MAAKjE,QACf,EAODhC,sBAAsBqL,GACpB,IAAKA,EAAc,MAAMtB,MAAM,4CAE/B,IAEE,aADoBlG,EAAIyH,YAAYD,EAMrC,CAJC,MAAOE,GAGP,MADAlC,SAAAA,EAAQkC,MAAM,4BAA6BA,GACrCxB,MAAM,4BACb,CACF,EAOD/J,qBAAqBwL,WACnB,IAAKA,EAAc,MAAMzB,MAAM,kDAE/B,UACQlG,EAAIyH,YAAYE,GACtB,MAAMC,QAAgB5H,EAAI6H,QAAQF,GAClC,GAAIC,EAAQE,GAAI,CAEd,aADoB9H,EAAIyH,YAA0B,QAAdxK,EAAA2K,EAAQtL,YAAM,IAAAW,OAAA,EAAAA,EAAA8K,WAEnD,CAED,MAAM7B,MAAmB,QAAbxI,EAAAkK,EAAQF,aAAK,IAAAhK,OAAA,EAAAA,EAAEsK,aAK5B,CAJC,MAAOC,GAGP,MADAzC,SAAAA,EAAQkC,MAAM,kCAAmCO,GAC3C/B,MAAM,kCACb,CACF,EAQD/J,gCACEqL,EACAG,GAEA,IAAKH,IAAiBG,EAAc,MAAMzB,MAAM,6CAEhD,IAEE,aADoBlG,EAAIkI,gBAAgBV,EAKzC,CAHC,MAAOE,GAEPlC,SAAAA,EAAQ2C,IAAI,mDACb,CAED,OAAOnI,EAAIoI,eAAeT,EAC3B,EAODxL,wBAAwBuJ,GACtB,IAAKA,EAAW,MAAMQ,MAAM,gCAE5B,IAAI7J,EACJ,IACEA,QAAa2D,EAAI0F,UAAU2C,SAAS3C,EAIrC,CAHC,MAAOgC,GAEP,MADAlC,SAAAA,EAAQkC,MAAM,gCAAiCA,GACzCxB,MAAM,gCACb,CAED,MAAM6B,WAAEA,GAAe1L,EAAKC,KAC5B,IAAKyL,EAEH,MADAvC,SAAAA,EAAQkC,MAAM,gDACRxB,MAAM,iCAGd,IAEE,aADoBlG,EAAIyH,YAAYM,EAKrC,CAHC,MAAOL,GAEP,MADAlC,SAAAA,EAAQkC,MAAM,sCAAuCA,GAC/CxB,MAAM,gCACb,CACF,EAQDoC,oBAAmB,CAACvK,EAA8B0E,IACzCzC,EAAIuI,0BAA0BxK,EAAU,KAAM0E,GASvD8F,0BACExK,EACAE,EACAwE,GAEA,MAAM+F,EAAU1K,EAA2BC,EdrNb,ccqN6CE,GAC3E,OAAOwE,EAAYgG,OAAOC,GAASF,EAAQG,SAASD,IACrD,EAQDE,cAAa,CAAC7K,EAA8BuC,IACnCN,EAAI6I,oBAAoB9K,EAAU,KAAMuC,GASjDuI,oBAAoB9K,EAA8BE,EAAgBqC,GAChE,MAAMwI,EAAahL,EAA2BC,EdxOtB,QcwOgDE,GACxE,OAAOqC,EAAMmI,OAAO5C,GAASiD,EAAWH,SAAS9C,IAClD,IAGH,OAAOkD,EACL/I,EACA,CACE,mBACA,iBACA,sBACA,mBACA,uBACA,uBACA,iBACA,gBACA,cACA,yBACA,yBACA,WAEF/D,EACD,EAoBH6I,EAAQkE,uBd1R8B,Mc2RtClE,EAAQmE,uBdzR8B"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@descope/node-sdk",
-  "version": "1.0.5",
+  "version": "1.1.0",
   "description": "Node.js library used to integrate with Descope",
   "typings": "./dist/index.d.ts",
   "main": "dist/cjs/index.cjs.js",
@@ -49,10 +49,10 @@
     "authentication"
   ],
   "devDependencies": {
-    "@rollup/plugin-commonjs": "^22.0.0",
+    "@rollup/plugin-commonjs": "^24.0.0",
     "@rollup/plugin-json": "^4.1.0",
     "@rollup/plugin-node-resolve": "^13.3.0",
-    "@rollup/plugin-replace": "^4.0.0",
+    "@rollup/plugin-replace": "^5.0.0",
     "@rollup/plugin-typescript": "^8.3.0",
     "@size-limit/preset-small-lib": "^8.0.0",
     "@types/jest": "^29.0.0",
@@ -67,7 +67,7 @@
     "eslint-config-prettier": "^8.5.0",
     "eslint-import-resolver-typescript": "^3.0.0",
     "eslint-plugin-import": "^2.26.0",
-    "eslint-plugin-jest": "^26.4.6",
+    "eslint-plugin-jest": "^27.0.0",
     "eslint-plugin-jest-dom": "^4.0.2",
     "eslint-plugin-jest-formatting": "^3.1.0",
     "eslint-plugin-no-only-tests": "^3.0.0",
@@ -75,7 +75,7 @@
     "eslint-plugin-prettier": "^4.0.0",
     "husky": "^8.0.1",
     "jest": "^29.0.0",
-    "jsdoc": "^3.6.10",
+    "jsdoc": "^4.0.0",
     "lint-staged": "^13.0.3",
     "nock": "^13.2.4",
     "prettier": "^2.7.1",
@@ -86,7 +86,7 @@
     "rollup-plugin-define": "^1.0.1",
     "rollup-plugin-delete": "^2.0.0",
     "rollup-plugin-dts": "^4.2.2",
-    "rollup-plugin-esbuild": "^4.9.1",
+    "rollup-plugin-esbuild": "^5.0.0",
     "rollup-plugin-inject-process-env": "^1.3.1",
     "rollup-plugin-livereload": "^2.0.5",
     "rollup-plugin-terser": "^7.0.2",
@@ -95,8 +95,8 @@
     "typescript": "^4.6.4"
   },
   "dependencies": {
-    "@descope/core-js-sdk": "0.0.42",
-    "jose": "4.11.2",
+    "@descope/core-js-sdk": "1.0.9",
+    "jose": "4.13.1",
     "node-fetch-commonjs": "3.2.4"
   },
   "peerDependencies": {