@descope/node-sdk 1.1.1 → 1.5.0

package/dist/index.d.ts

@@ -71,6 +71,7 @@ declare type Role = {
     name: string;
     description?: string;
     permissionNames: string[];
+    createdTime: number;
 };
 /** Represents a group in a project. It has an id and display name and a list of group members. */
 declare type Group = {
@@ -110,6 +111,49 @@ declare type Theme = {
 declare type ThemeResponse = {
     theme: Theme;
 };
+declare type GenerateOTPForTestResponse = {
+    loginId: string;
+    code: string;
+};
+declare type GenerateMagicLinkForTestResponse = {
+    loginId: string;
+    link: string;
+};
+declare type GenerateEnchantedLinkForTestResponse = {
+    loginId: string;
+    link: string;
+    pendingRef: string;
+};
+declare type AttributesTypes = string | boolean | number;
+declare type UserMapping = {
+    name: string;
+    email: string;
+    username: string;
+    phoneNumber: string;
+    group: string;
+};
+declare type RoleItem = {
+    id: string;
+    name: string;
+};
+declare type GroupsMapping = {
+    role: RoleItem;
+    groups: string[];
+};
+declare type SSOSettingsResponse = {
+    tenantId: string;
+    idpEntityId: string;
+    idpSSOUrl: string;
+    idpCertificate: string;
+    idpMetadataUrl: string;
+    spEntityId: string;
+    spACSUrl: string;
+    spCertificate: string;
+    userMapping: UserMapping;
+    groupsMapping: GroupsMapping[];
+    redirectUrl: string;
+    domain: string;
+};
 
 /** Parsed JWT token */
 interface Token {
@@ -133,24 +177,31 @@ declare const nodeSdk: {
     ({ managementKey, ...config }: NodeSdkArgs): {
         management: {
             user: {
-                create: (loginId: string, email?: string, phone?: string, displayName?: string, roles?: string[], userTenants?: AssociatedTenant[]) => Promise<SdkResponse<_descope_core_js_sdk.UserResponse>>;
-                invite: (loginId: string, email?: string, phone?: string, displayName?: string, roles?: string[], userTenants?: AssociatedTenant[]) => Promise<SdkResponse<_descope_core_js_sdk.UserResponse>>;
-                update: (loginId: string, email?: string, phone?: string, displayName?: string, roles?: string[], userTenants?: AssociatedTenant[]) => Promise<SdkResponse<_descope_core_js_sdk.UserResponse>>;
+                create: (loginId: string, email?: string, phone?: string, displayName?: string, roles?: string[], userTenants?: AssociatedTenant[], customAttributes?: Record<string, AttributesTypes>, picture?: string) => Promise<SdkResponse<_descope_core_js_sdk.UserResponse>>;
+                createTestUser: (loginId: string, email?: string, phone?: string, displayName?: string, roles?: string[], userTenants?: AssociatedTenant[], customAttributes?: Record<string, AttributesTypes>, picture?: string) => Promise<SdkResponse<_descope_core_js_sdk.UserResponse>>;
+                invite: (loginId: string, email?: string, phone?: string, displayName?: string, roles?: string[], userTenants?: AssociatedTenant[], customAttributes?: Record<string, AttributesTypes>, picture?: string) => Promise<SdkResponse<_descope_core_js_sdk.UserResponse>>;
+                update: (loginId: string, email?: string, phone?: string, displayName?: string, roles?: string[], userTenants?: AssociatedTenant[], customAttributes?: Record<string, AttributesTypes>, picture?: string) => Promise<SdkResponse<_descope_core_js_sdk.UserResponse>>;
                 delete: (loginId: string) => Promise<SdkResponse<never>>;
+                deleteAllTestUsers: () => Promise<SdkResponse<never>>;
                 load: (loginId: string) => Promise<SdkResponse<_descope_core_js_sdk.UserResponse>>;
                 loadByUserId: (userId: string) => Promise<SdkResponse<_descope_core_js_sdk.UserResponse>>;
-                searchAll: (tenantIds?: string[], roles?: string[], limit?: number, page?: number) => Promise<SdkResponse<_descope_core_js_sdk.UserResponse[]>>;
+                searchAll: (tenantIds?: string[], roles?: string[], limit?: number, page?: number, testUsersOnly?: boolean, withTestUser?: boolean, customAttributes?: Record<string, AttributesTypes>) => Promise<SdkResponse<_descope_core_js_sdk.UserResponse[]>>;
                 activate: (loginId: string) => Promise<SdkResponse<_descope_core_js_sdk.UserResponse>>;
                 deactivate: (loginId: string) => Promise<SdkResponse<_descope_core_js_sdk.UserResponse>>;
                 updateEmail: (loginId: string, email: string, isVerified: boolean) => Promise<SdkResponse<_descope_core_js_sdk.UserResponse>>;
                 updatePhone: (loginId: string, phone: string, isVerified: boolean) => Promise<SdkResponse<_descope_core_js_sdk.UserResponse>>;
                 updateDisplayName: (loginId: string, displayName: string) => Promise<SdkResponse<_descope_core_js_sdk.UserResponse>>;
+                updatePicture: (loginId: string, picture: string) => Promise<SdkResponse<_descope_core_js_sdk.UserResponse>>;
+                updateCustomAttribute: (loginId: string, attributeKey: string, attributeValue: AttributesTypes) => Promise<SdkResponse<_descope_core_js_sdk.UserResponse>>;
                 addRoles: (loginId: string, roles: string[]) => Promise<SdkResponse<_descope_core_js_sdk.UserResponse>>;
                 removeRoles: (loginId: string, roles: string[]) => Promise<SdkResponse<_descope_core_js_sdk.UserResponse>>;
                 addTenant: (loginId: string, tenantId: string) => Promise<SdkResponse<_descope_core_js_sdk.UserResponse>>;
                 removeTenant: (loginId: string, tenantId: string) => Promise<SdkResponse<_descope_core_js_sdk.UserResponse>>;
                 addTenantRoles: (loginId: string, tenantId: string, roles: string[]) => Promise<SdkResponse<_descope_core_js_sdk.UserResponse>>;
                 removeTenantRoles: (loginId: string, tenantId: string, roles: string[]) => Promise<SdkResponse<_descope_core_js_sdk.UserResponse>>;
+                generateOTPForTestUser: (deliveryMethod: "email" | "sms" | "whatsapp", loginId: string) => Promise<SdkResponse<GenerateOTPForTestResponse>>;
+                generateMagicLinkForTestUser: (deliveryMethod: "email" | "sms" | "whatsapp", loginId: string, uri: string) => Promise<SdkResponse<GenerateMagicLinkForTestResponse>>;
+                generateEnchantedLinkForTestUser: (loginId: string, uri: string) => Promise<SdkResponse<GenerateEnchantedLinkForTestResponse>>;
             };
             accessKey: {
                 create: (name: string, expireTime: number, roles?: string[], keyTenants?: AssociatedTenant[]) => Promise<SdkResponse<CreatedAccessKeyResponse>>;
@@ -169,6 +220,7 @@ declare const nodeSdk: {
                 loadAll: () => Promise<SdkResponse<Tenant[]>>;
             };
             sso: {
+                getSettings: (tenantId: string) => Promise<SdkResponse<SSOSettingsResponse>>;
                 configureSettings: (tenantId: string, idpURL: string, idpCert: string, entityId: string, redirectURL?: string, domain?: string) => Promise<SdkResponse<never>>;
                 configureMetadata: (tenantId: string, idpMetadataURL: string) => Promise<SdkResponse<never>>;
                 configureMapping: (tenantId: string, roleMapping?: RoleMapping, attributeMapping?: AttributeMapping) => Promise<SdkResponse<never>>;
@@ -217,76 +269,82 @@ declare const nodeSdk: {
         };
         otp: {
             verify: {
-                email: (loginId: string, code: string) => Promise<SdkResponse<_descope_core_js_sdk.JWTResponse & {
+                sms: (loginId: string, code: string) => Promise<SdkResponse<_descope_core_js_sdk.JWTResponse & {
                     refreshJwt?: string;
                     cookies?: string[];
                 }>>;
-                sms: (loginId: string, code: string) => Promise<SdkResponse<_descope_core_js_sdk.JWTResponse & {
+                whatsapp: (loginId: string, code: string) => Promise<SdkResponse<_descope_core_js_sdk.JWTResponse & {
                     refreshJwt?: string;
                     cookies?: string[];
                 }>>;
-                whatsapp: (loginId: string, code: string) => Promise<SdkResponse<_descope_core_js_sdk.JWTResponse & {
+                email: (loginId: string, code: string) => Promise<SdkResponse<_descope_core_js_sdk.JWTResponse & {
                     refreshJwt?: string;
                     cookies?: string[];
                 }>>;
             };
             signIn: {
-                email: (loginId: string) => Promise<SdkResponse<{
-                    maskedEmail: string;
-                }>>;
                 sms: (loginId: string) => Promise<SdkResponse<{
                     maskedPhone: string;
                 }>>;
                 whatsapp: (loginId: string) => Promise<SdkResponse<{
                     maskedPhone: string;
                 }>>;
+                email: (loginId: string) => Promise<SdkResponse<{
+                    maskedEmail: string;
+                }>>;
             };
             signUp: {
-                email: (loginId: string, user?: {
+                sms: (loginId: string, user?: {
                     email?: string;
                     name?: string;
                     phone?: string;
                 }) => Promise<SdkResponse<{
-                    maskedEmail: string;
+                    maskedPhone: string;
                 }>>;
-                sms: (loginId: string, user?: {
+                whatsapp: (loginId: string, user?: {
                     email?: string;
                     name?: string;
                     phone?: string;
                 }) => Promise<SdkResponse<{
                     maskedPhone: string;
                 }>>;
-                whatsapp: (loginId: string, user?: {
+                email: (loginId: string, user?: {
                     email?: string;
                     name?: string;
                     phone?: string;
                 }) => Promise<SdkResponse<{
-                    maskedPhone: string;
+                    maskedEmail: string;
                 }>>;
             };
             signUpOrIn: {
-                email: (loginId: string) => Promise<SdkResponse<{
-                    maskedEmail: string;
-                }>>;
                 sms: (loginId: string) => Promise<SdkResponse<{
                     maskedPhone: string;
                 }>>;
                 whatsapp: (loginId: string) => Promise<SdkResponse<{
                     maskedPhone: string;
                 }>>;
+                email: (loginId: string) => Promise<SdkResponse<{
+                    maskedEmail: string;
+                }>>;
             };
             update: {
-                email: (loginId: string, email: string, token?: string) => Promise<SdkResponse<{
+                email: <T extends boolean>(loginId: string, email: string, token?: string, updateOptions?: {
+                    addToLoginIDs?: T;
+                    onMergeUseExisting?: T extends true ? boolean : never;
+                }) => Promise<SdkResponse<{
                     maskedEmail: string;
                 }>>;
                 phone: {
-                    email: (loginId: string, phone: string) => Promise<SdkResponse<{
-                        maskedPhone: string;
-                    }>>;
-                    sms: (loginId: string, phone: string) => Promise<SdkResponse<{
+                    sms: <T_1 extends boolean>(loginId: string, phone: string, token?: string, updateOptions?: {
+                        addToLoginIDs?: T_1;
+                        onMergeUseExisting?: T_1 extends true ? boolean : never;
+                    }) => Promise<SdkResponse<{
                         maskedPhone: string;
                     }>>;
-                    whatsapp: (loginId: string, phone: string) => Promise<SdkResponse<{
+                    whatsapp: <T_1 extends boolean>(loginId: string, phone: string, token?: string, updateOptions?: {
+                        addToLoginIDs?: T_1;
+                        onMergeUseExisting?: T_1 extends true ? boolean : never;
+                    }) => Promise<SdkResponse<{
                         maskedPhone: string;
                     }>>;
                 };
@@ -298,60 +356,68 @@ declare const nodeSdk: {
                 cookies?: string[];
             }>>;
             signIn: {
-                email: (loginId: string, uri: string) => Promise<SdkResponse<{
-                    maskedEmail: string;
-                }>>;
                 sms: (loginId: string, uri: string) => Promise<SdkResponse<{
                     maskedPhone: string;
                 }>>;
                 whatsapp: (loginId: string, uri: string) => Promise<SdkResponse<{
                     maskedPhone: string;
                 }>>;
+                email: (loginId: string, uri: string) => Promise<SdkResponse<{
+                    maskedEmail: string;
+                }>>;
             };
             signUp: {
-                email: (loginId: string, uri: string, user?: {
+                sms: (loginId: string, uri: string, user?: {
                     email?: string;
                     name?: string;
                     phone?: string;
                 }) => Promise<SdkResponse<{
-                    maskedEmail: string;
+                    maskedPhone: string;
                 }>>;
-                sms: (loginId: string, uri: string, user?: {
+                whatsapp: (loginId: string, uri: string, user?: {
                     email?: string;
                     name?: string;
                     phone?: string;
                 }) => Promise<SdkResponse<{
                     maskedPhone: string;
                 }>>;
-                whatsapp: (loginId: string, uri: string, user?: {
+                email: (loginId: string, uri: string, user?: {
                     email?: string;
                     name?: string;
                     phone?: string;
                 }) => Promise<SdkResponse<{
-                    maskedPhone: string;
+                    maskedEmail: string;
                 }>>;
             };
             signUpOrIn: {
-                email: (loginId: string, uri: string) => Promise<SdkResponse<{
-                    maskedEmail: string;
-                }>>;
                 sms: (loginId: string, uri: string) => Promise<SdkResponse<{
                     maskedPhone: string;
                 }>>;
                 whatsapp: (loginId: string, uri: string) => Promise<SdkResponse<{
                     maskedPhone: string;
                 }>>;
+                email: (loginId: string, uri: string) => Promise<SdkResponse<{
+                    maskedEmail: string;
+                }>>;
             };
             update: {
-                email: (loginId: string, email: string, URI?: string, token?: string) => Promise<SdkResponse<never>>;
+                email: <T_2 extends boolean>(loginId: string, email: string, URI?: string, token?: string, updateOptions?: {
+                    addToLoginIDs?: T_2;
+                    onMergeUseExisting?: T_2 extends true ? boolean : never;
+                }) => Promise<SdkResponse<{
+                    maskedEmail: string;
+                }>>;
                 phone: {
-                    email: (loginId: string, phone: string) => Promise<SdkResponse<{
-                        maskedPhone: string;
-                    }>>;
-                    sms: (loginId: string, phone: string) => Promise<SdkResponse<{
+                    sms: <T_3 extends boolean>(loginId: string, phone: string, URI?: string, token?: string, updateOptions?: {
+                        addToLoginIDs?: T_3;
+                        onMergeUseExisting?: T_3 extends true ? boolean : never;
+                    }) => Promise<SdkResponse<{
                         maskedPhone: string;
                     }>>;
-                    whatsapp: (loginId: string, phone: string) => Promise<SdkResponse<{
+                    whatsapp: <T_3 extends boolean>(loginId: string, phone: string, URI?: string, token?: string, updateOptions?: {
+                        addToLoginIDs?: T_3;
+                        onMergeUseExisting?: T_3 extends true ? boolean : never;
+                    }) => Promise<SdkResponse<{
                         maskedPhone: string;
                     }>>;
                 };
@@ -377,51 +443,38 @@ declare const nodeSdk: {
                 timeoutMs: number;
             }) => Promise<SdkResponse<_descope_core_js_sdk.JWTResponse>>;
             update: {
-                email: (loginId: string, email: string, URI?: string, token?: string) => Promise<SdkResponse<_descope_core_js_sdk.EnchantedLinkResponse>>;
+                email: <T_4 extends boolean>(loginId: string, email: string, URI?: string, token?: string, updateOptions?: {
+                    addToLoginIDs?: T_4;
+                    onMergeUseExisting?: T_4 extends true ? boolean : never;
+                }) => Promise<SdkResponse<_descope_core_js_sdk.EnchantedLinkResponse>>;
             };
         };
         oauth: {
             start: {
                 facebook: <B extends {
                     redirect: boolean;
-                }>(redirectURL?: string, config?: B) => Promise<B extends {
-                    redirect: true;
-                } ? undefined : SdkResponse<_descope_core_js_sdk.URLResponse>>;
+                }>(redirectURL?: string, config?: B) => Promise<SdkResponse<_descope_core_js_sdk.URLResponse>>;
                 github: <B_1 extends {
                     redirect: boolean;
-                }>(redirectURL?: string, config?: B_1) => Promise<B_1 extends {
-                    redirect: true;
-                } ? undefined : SdkResponse<_descope_core_js_sdk.URLResponse>>;
+                }>(redirectURL?: string, config?: B_1) => Promise<SdkResponse<_descope_core_js_sdk.URLResponse>>;
                 google: <B_2 extends {
                     redirect: boolean;
-                }>(redirectURL?: string, config?: B_2) => Promise<B_2 extends {
-                    redirect: true;
-                } ? undefined : SdkResponse<_descope_core_js_sdk.URLResponse>>;
+                }>(redirectURL?: string, config?: B_2) => Promise<SdkResponse<_descope_core_js_sdk.URLResponse>>;
                 microsoft: <B_3 extends {
                     redirect: boolean;
-                }>(redirectURL?: string, config?: B_3) => Promise<B_3 extends {
-                    redirect: true;
-                } ? undefined : SdkResponse<_descope_core_js_sdk.URLResponse>>;
+                }>(redirectURL?: string, config?: B_3) => Promise<SdkResponse<_descope_core_js_sdk.URLResponse>>;
                 gitlab: <B_4 extends {
                     redirect: boolean;
-                }>(redirectURL?: string, config?: B_4) => Promise<B_4 extends {
-                    redirect: true;
-                } ? undefined : SdkResponse<_descope_core_js_sdk.URLResponse>>;
+                }>(redirectURL?: string, config?: B_4) => Promise<SdkResponse<_descope_core_js_sdk.URLResponse>>;
                 apple: <B_5 extends {
                     redirect: boolean;
-                }>(redirectURL?: string, config?: B_5) => Promise<B_5 extends {
-                    redirect: true;
-                } ? undefined : SdkResponse<_descope_core_js_sdk.URLResponse>>;
+                }>(redirectURL?: string, config?: B_5) => Promise<SdkResponse<_descope_core_js_sdk.URLResponse>>;
                 discord: <B_6 extends {
                     redirect: boolean;
-                }>(redirectURL?: string, config?: B_6) => Promise<B_6 extends {
-                    redirect: true;
-                } ? undefined : SdkResponse<_descope_core_js_sdk.URLResponse>>;
+                }>(redirectURL?: string, config?: B_6) => Promise<SdkResponse<_descope_core_js_sdk.URLResponse>>;
                 linkedin: <B_7 extends {
                     redirect: boolean;
-                }>(redirectURL?: string, config?: B_7) => Promise<B_7 extends {
-                    redirect: true;
-                } ? undefined : SdkResponse<_descope_core_js_sdk.URLResponse>>;
+                }>(redirectURL?: string, config?: B_7) => Promise<SdkResponse<_descope_core_js_sdk.URLResponse>>;
             };
             exchange: (code: string) => Promise<SdkResponse<_descope_core_js_sdk.JWTResponse & {
                 refreshJwt?: string;
@@ -429,11 +482,11 @@ declare const nodeSdk: {
             }>>;
         };
         saml: {
-            start: <B_1 extends {
-                redirect: boolean;
-            }>(tenantNameOrEmail: string, config?: B_1) => Promise<B_1 extends {
-                redirect: true;
-            } ? undefined : SdkResponse<_descope_core_js_sdk.URLResponse>>;
+            start: (tenantNameOrEmail: string, redirectUrl?: string, loginOptions?: {
+                stepup?: boolean;
+                mfa?: boolean;
+                customClaims?: Record<string, any>;
+            }, token?: string) => Promise<SdkResponse<_descope_core_js_sdk.URLResponse>>;
             exchange: (code: string) => Promise<SdkResponse<_descope_core_js_sdk.JWTResponse & {
                 refreshJwt?: string;
                 cookies?: string[];
@@ -460,7 +513,7 @@ declare const nodeSdk: {
                 start: (loginId: string, origin: string, name: string) => Promise<SdkResponse<{
                     transactionId: string;
                     options: string;
-                    create: boolean;
+                    create: boolean; /** Get the key that can validate the given JWT KID in the header. Can retrieve the public key from local cache or from Descope. */
                 }>>;
                 finish: (transactionId: string, response: string) => Promise<SdkResponse<_descope_core_js_sdk.JWTResponse & {
                     refreshJwt?: string;
@@ -475,7 +528,7 @@ declare const nodeSdk: {
                 }, token?: string) => Promise<SdkResponse<{
                     transactionId: string;
                     options: string;
-                    create: boolean;
+                    create: boolean; /** Get the key that can validate the given JWT KID in the header. Can retrieve the public key from local cache or from Descope. */
                 }>>;
                 finish: (transactionId: string, response: string) => Promise<SdkResponse<_descope_core_js_sdk.JWTResponse & {
                     refreshJwt?: string;
@@ -486,14 +539,14 @@ declare const nodeSdk: {
                 start: (loginId: string, origin: string) => Promise<SdkResponse<{
                     transactionId: string;
                     options: string;
-                    create: boolean;
+                    create: boolean; /** Get the key that can validate the given JWT KID in the header. Can retrieve the public key from local cache or from Descope. */
                 }>>;
             };
             update: {
                 start: (loginId: string, origin: string, token: string) => Promise<SdkResponse<{
                     transactionId: string;
                     options: string;
-                    create: boolean;
+                    create: boolean; /** Get the key that can validate the given JWT KID in the header. Can retrieve the public key from local cache or from Descope. */
                 }>>;
                 finish: (transactionId: string, response: string) => Promise<SdkResponse<_descope_core_js_sdk.ResponseData>>;
             };
@@ -534,12 +587,16 @@ declare const nodeSdk: {
                     name?: string;
                     loginId?: string;
                 };
+                redirectAuth?: {
+                    callbackUrl: string;
+                    codeChallenge: string;
+                };
             }, conditionInteractionId?: string, interactionId?: string, input?: {
                 [x: string]: string | number | boolean | (string | number | boolean | (string | number | boolean | (string | number | boolean | (string | number | boolean | (string | number | boolean | (string | number | boolean | (string | number | boolean | (string | number | boolean | (string | number | boolean | (string | number | boolean | (string | number | boolean | any)[])[])[])[])[])[])[])[])[])[])[];
-            }) => Promise<SdkResponse<_descope_core_js_sdk.FlowResponse>>;
+            }, version?: number) => Promise<SdkResponse<_descope_core_js_sdk.FlowResponse>>;
             next: (executionId: string, stepId: string, interactionId: string, input?: {
                 [x: string]: string | number | boolean | (string | number | boolean | (string | number | boolean | (string | number | boolean | (string | number | boolean | (string | number | boolean | (string | number | boolean | (string | number | boolean | (string | number | boolean | (string | number | boolean | (string | number | boolean | (string | number | boolean | any)[])[])[])[])[])[])[])[])[])[])[];
-            }) => Promise<SdkResponse<_descope_core_js_sdk.FlowResponse>>;
+            }, version?: number) => Promise<SdkResponse<_descope_core_js_sdk.FlowResponse>>;
         };
         refresh: (token?: string) => Promise<SdkResponse<_descope_core_js_sdk.JWTResponse & {
             refreshJwt?: string;

package/dist/index.esm.js

@@ -1,2 +1,2 @@
-import{__rest as e}from"tslib";import t,{transformResponse as a,wrapWith as o}from"@descope/core-js-sdk";import{jwtVerify as n,errors as s,importJWK as r}from"jose";import i,{Headers as l}from"node-fetch-commonjs";const d=t=>async(...a)=>{var o,n,s;const r=await t(...a);if(!r.data)return r;let i=r.data,{refreshJwt:l}=i,d=e(i,["refreshJwt"]);const p=[];var m;return l?p.push(`${"DSR"}=${l}; Domain=${(null==(m=d)?void 0:m.cookieDomain)||""}; Max-Age=${(null==m?void 0:m.cookieMaxAge)||""}; Path=${(null==m?void 0:m.cookiePath)||"/"}; HttpOnly; SameSite=Strict`):(null===(o=r.response)||void 0===o?void 0:o.headers.get("set-cookie"))&&(l=((e,t)=>{const a=null==e?void 0:e.match(RegExp(`(?:^|;\\s*)${t}=([^;]*)`));return a?a[1]:null})(null===(n=r.response)||void 0===n?void 0:n.headers.get("set-cookie"),"DSR"),p.push(null===(s=r.response)||void 0===s?void 0:s.headers.get("set-cookie"))),Object.assign(Object.assign({},r),{data:Object.assign(Object.assign({},r.data),{refreshJwt:l,cookies:p})})};function p(e,t,a){var o,n;const s=a?null===(n=null===(o=e.token.tenants)||void 0===o?void 0:o[a])||void 0===n?void 0:n[t]:e.token[t];return Array.isArray(s)?s:[]}var m={create:"/v1/mgmt/user/create",update:"/v1/mgmt/user/update",delete:"/v1/mgmt/user/delete",load:"/v1/mgmt/user",search:"/v1/mgmt/user/search",updateStatus:"/v1/mgmt/user/update/status",updateEmail:"/v1/mgmt/user/update/email",updatePhone:"/v1/mgmt/user/update/phone",updateDisplayName:"/v1/mgmt/user/update/name",addRole:"/v1/mgmt/user/update/role/add",removeRole:"/v1/mgmt/user/update/role/remove",addTenant:"/v1/mgmt/user/update/tenant/add",removeTenant:"/v1/mgmt/user/update/tenant/remove"},c={create:"/v1/mgmt/accesskey/create",load:"/v1/mgmt/accesskey",search:"/v1/mgmt/accesskey/search",update:"/v1/mgmt/accesskey/update",deactivate:"/v1/mgmt/accesskey/deactivate",activate:"/v1/mgmt/accesskey/activate",delete:"/v1/mgmt/accesskey/delete"},u={create:"/v1/mgmt/tenant/create",update:"/v1/mgmt/tenant/update",delete:"/v1/mgmt/tenant/delete",loadAll:"/v1/mgmt/tenant/all"},h={configure:"/v1/mgmt/sso/settings",metadata:"/v1/mgmt/sso/metadata",mapping:"/v1/mgmt/sso/mapping"},g={update:"/v1/mgmt/jwt/update"},v={create:"/v1/mgmt/permission/create",update:"/v1/mgmt/permission/update",delete:"/v1/mgmt/permission/delete",loadAll:"/v1/mgmt/permission/all"},k={create:"/v1/mgmt/role/create",update:"/v1/mgmt/role/update",delete:"/v1/mgmt/role/delete",loadAll:"/v1/mgmt/role/all"},f={export:"/v1/mgmt/flow/export",import:"/v1/mgmt/flow/import"},y={export:"/v1/mgmt/theme/export",import:"/v1/mgmt/theme/import"},C={loadAllGroups:"/v1/mgmt/group/all",loadAllGroupsForMember:"/v1/mgmt/group/member/all",loadAllGroupMembers:"/v1/mgmt/group/members"};const w=(e,t)=>({create:(o,n,s,r,i,l)=>a(e.httpClient.post(m.create,{loginId:o,email:n,phone:s,displayName:r,roleNames:i,userTenants:l},{token:t}),(e=>e.user)),invite:(o,n,s,r,i,l)=>a(e.httpClient.post(m.create,{loginId:o,email:n,phone:s,displayName:r,roleNames:i,userTenants:l,invite:!0},{token:t}),(e=>e.user)),update:(o,n,s,r,i,l)=>a(e.httpClient.post(m.update,{loginId:o,email:n,phone:s,displayName:r,roleNames:i,userTenants:l},{token:t}),(e=>e.user)),delete:o=>a(e.httpClient.post(m.delete,{loginId:o},{token:t})),load:o=>a(e.httpClient.get(m.load,{queryParams:{loginId:o},token:t}),(e=>e.user)),loadByUserId:o=>a(e.httpClient.get(m.load,{queryParams:{userId:o},token:t}),(e=>e.user)),searchAll:(o,n,s,r)=>a(e.httpClient.post(m.search,{tenantIds:o,roleNames:n,limit:s,page:r},{token:t}),(e=>e.users)),activate:o=>a(e.httpClient.post(m.updateStatus,{loginId:o,status:"enabled"},{token:t}),(e=>e.user)),deactivate:o=>a(e.httpClient.post(m.updateStatus,{loginId:o,status:"disabled"},{token:t}),(e=>e.user)),updateEmail:(o,n,s)=>a(e.httpClient.post(m.updateEmail,{loginId:o,email:n,verified:s},{token:t}),(e=>e.user)),updatePhone:(o,n,s)=>a(e.httpClient.post(m.updatePhone,{loginId:o,phone:n,verified:s},{token:t}),(e=>e.user)),updateDisplayName:(o,n)=>a(e.httpClient.post(m.updateDisplayName,{loginId:o,displayName:n},{token:t}),(e=>e.user)),addRoles:(o,n)=>a(e.httpClient.post(m.addRole,{loginId:o,roleNames:n},{token:t}),(e=>e.user)),removeRoles:(o,n)=>a(e.httpClient.post(m.removeRole,{loginId:o,roleNames:n},{token:t}),(e=>e.user)),addTenant:(o,n)=>a(e.httpClient.post(m.addTenant,{loginId:o,tenantId:n},{token:t}),(e=>e.user)),removeTenant:(o,n)=>a(e.httpClient.post(m.removeTenant,{loginId:o,tenantId:n},{token:t}),(e=>e.user)),addTenantRoles:(o,n,s)=>a(e.httpClient.post(m.addRole,{loginId:o,tenantId:n,roleNames:s},{token:t}),(e=>e.user)),removeTenantRoles:(o,n,s)=>a(e.httpClient.post(m.removeRole,{loginId:o,tenantId:n,roleNames:s},{token:t}),(e=>e.user))}),I=(e,t)=>({create:(o,n)=>a(e.httpClient.post(u.create,{name:o,selfProvisioningDomains:n},{token:t})),createWithId:(o,n,s)=>a(e.httpClient.post(u.create,{id:o,name:n,selfProvisioningDomains:s},{token:t})),update:(o,n,s)=>a(e.httpClient.post(u.update,{id:o,name:n,selfProvisioningDomains:s},{token:t})),delete:o=>a(e.httpClient.post(u.delete,{id:o},{token:t})),loadAll:()=>a(e.httpClient.get(u.loadAll,{token:t}),(e=>e.tenants))}),b=(e,t)=>({update:(o,n)=>a(e.httpClient.post(g.update,{jwt:o,customClaims:n},{token:t}))}),A=(e,t)=>({create:(o,n)=>a(e.httpClient.post(v.create,{name:o,description:n},{token:t})),update:(o,n,s)=>a(e.httpClient.post(v.update,{name:o,newName:n,description:s},{token:t})),delete:o=>a(e.httpClient.post(v.delete,{name:o},{token:t})),loadAll:()=>a(e.httpClient.get(v.loadAll,{token:t}),(e=>e.permissions))}),x=(e,t)=>({create:(o,n,s)=>a(e.httpClient.post(k.create,{name:o,description:n,permissionNames:s},{token:t})),update:(o,n,s,r)=>a(e.httpClient.post(k.update,{name:o,newName:n,description:s,permissionNames:r},{token:t})),delete:o=>a(e.httpClient.post(k.delete,{name:o},{token:t})),loadAll:()=>a(e.httpClient.get(k.loadAll,{token:t}),(e=>e.roles))}),j=(e,t)=>({loadAllGroups:o=>a(e.httpClient.post(C.loadAllGroups,{tenantId:o},{token:t})),loadAllGroupsForMember:(o,n,s)=>a(e.httpClient.post(C.loadAllGroupsForMember,{tenantId:o,loginIds:s,userIds:n},{token:t})),loadAllGroupMembers:(o,n)=>a(e.httpClient.post(C.loadAllGroupMembers,{tenantId:o,groupId:n},{token:t}))}),T=(e,t)=>({configureSettings:(o,n,s,r,i,l)=>a(e.httpClient.post(h.configure,{tenantId:o,idpURL:n,entityId:r,idpCert:s,redirectURL:i,domain:l},{token:t})),configureMetadata:(o,n)=>a(e.httpClient.post(h.metadata,{tenantId:o,idpMetadataURL:n},{token:t})),configureMapping:(o,n,s)=>a(e.httpClient.post(h.mapping,{tenantId:o,roleMapping:n,attributeMapping:s},{token:t}))}),N=(e,t)=>({create:(o,n,s,r)=>a(e.httpClient.post(c.create,{name:o,expireTime:n,roleNames:s,keyTenants:r},{token:t})),load:o=>a(e.httpClient.get(c.load,{queryParams:{id:o},token:t}),(e=>e.key)),searchAll:o=>a(e.httpClient.post(c.search,{tenantIds:o},{token:t}),(e=>e.keys)),update:(o,n)=>a(e.httpClient.post(c.update,{id:o,name:n},{token:t}),(e=>e.key)),deactivate:o=>a(e.httpClient.post(c.deactivate,{id:o},{token:t})),activate:o=>a(e.httpClient.post(c.activate,{id:o},{token:t})),delete:o=>a(e.httpClient.post(c.delete,{id:o},{token:t}))}),R=(e,t)=>({export:o=>a(e.httpClient.post(f.export,{flowId:o},{token:t})),import:(o,n,s)=>a(e.httpClient.post(f.import,{flowId:o,flow:n,screens:s},{token:t}))}),S=(e,t)=>({export:()=>a(e.httpClient.post(y.export,{},{token:t})),import:o=>a(e.httpClient.post(y.import,{theme:o},{token:t}))});var E;null!==(E=globalThis.Headers)&&void 0!==E||(globalThis.Headers=l);const M=(...e)=>(e.forEach((e=>{var t,a;e&&(null!==(t=(a=e).highWaterMark)&&void 0!==t||(a.highWaterMark=32212254720))})),i(...e)),P=a=>{var i,{managementKey:l}=a,m=e(a,["managementKey"]);const c=t(Object.assign(Object.assign({},m),{fetch:M,baseHeaders:Object.assign(Object.assign({},m.baseHeaders),{"x-descope-sdk-name":"nodejs","x-descope-sdk-node-version":(null===(i=null===process||void 0===process?void 0:process.versions)||void 0===i?void 0:i.node)||"","x-descope-sdk-version":"1.1.1"})})),{projectId:u,logger:h}=m,g={},v=((e,t)=>({user:w(e,t),accessKey:N(e,t),tenant:I(e,t),sso:T(e,t),jwt:b(e,t),permission:A(e,t),role:x(e,t),group:j(e,t),flow:R(e,t),theme:S(e,t)}))(c,l),k=Object.assign(Object.assign({},c),{management:v,async getKey(e){if(!(null==e?void 0:e.kid))throw Error("header.kid must not be empty");if(g[e.kid])return g[e.kid];if(Object.assign(g,await(async()=>{const e=(await c.httpClient.get(`v2/keys/${u}`).then((e=>e.json()))).keys;return Array.isArray(e)?(await Promise.all(e.map((async e=>[e.kid,await r(e)])))).reduce(((e,[t,a])=>t?Object.assign(Object.assign({},e),{[t.toString()]:a}):e),{}):{}})()),!g[e.kid])throw Error("failed to fetch matching key");return g[e.kid]},async validateJwt(e){var t;const a=(await n(e,k.getKey,{clockTolerance:5})).payload;if(a&&(a.iss=null===(t=a.iss)||void 0===t?void 0:t.split("/").pop(),a.iss!==u))throw new s.JWTClaimValidationFailed('unexpected "iss" claim value',"iss","check_failed");return{jwt:e,token:a}},async validateSession(e){if(!e)throw Error("session token is required for validation");try{return await k.validateJwt(e)}catch(e){throw null==h||h.error("session validation failed",e),Error("session validation failed")}},async refreshSession(e){var t,a;if(!e)throw Error("refresh token is required to refresh a session");try{await k.validateJwt(e);const o=await k.refresh(e);if(o.ok){return await k.validateJwt(null===(t=o.data)||void 0===t?void 0:t.sessionJwt)}throw Error(null===(a=o.error)||void 0===a?void 0:a.errorMessage)}catch(e){throw null==h||h.error("refresh token validation failed",e),Error("refresh token validation failed")}},async validateAndRefreshSession(e,t){if(!e&&!t)throw Error("both session and refresh tokens are empty");try{return await k.validateSession(e)}catch(e){null==h||h.log("session validation failed - trying to refresh it")}return k.refreshSession(t)},async exchangeAccessKey(e){if(!e)throw Error("access key must not be empty");let t;try{t=await k.accessKey.exchange(e)}catch(e){throw null==h||h.error("failed to exchange access key",e),Error("could not exchange access key")}const{sessionJwt:a}=t.data;if(!a)throw null==h||h.error("failed to parse exchange access key response"),Error("could not exchange access key");try{return await k.validateJwt(a)}catch(e){throw null==h||h.error("failed to parse jwt from access key",e),Error("could not exchange access key")}},validatePermissions:(e,t)=>k.validateTenantPermissions(e,null,t),validateTenantPermissions(e,t,a){const o=p(e,"permissions",t);return a.every((e=>o.includes(e)))},validateRoles:(e,t)=>k.validateTenantRoles(e,null,t),validateTenantRoles(e,t,a){const o=p(e,"roles",t);return a.every((e=>o.includes(e)))}});return o(k,["otp.verify.email","otp.verify.sms","otp.verify.whatsapp","magicLink.verify","enchantedLink.signUp","enchantedLink.signIn","oauth.exchange","saml.exchange","totp.verify","webauthn.signIn.finish","webauthn.signUp.finish","refresh"],d)};P.RefreshTokenCookieName="DSR",P.SessionTokenCookieName="DS";export{P as default};
+import{__rest as e}from"tslib";import t,{transformResponse as a,wrapWith as s}from"@descope/core-js-sdk";import{jwtVerify as o,errors as n,importJWK as r}from"jose";import i,{Headers as l}from"node-fetch-commonjs";const d=t=>async(...a)=>{var s,o,n;const r=await t(...a);if(!r.data)return r;let i=r.data,{refreshJwt:l}=i,d=e(i,["refreshJwt"]);const p=[];var m;return l?p.push(`${"DSR"}=${l}; Domain=${(null==(m=d)?void 0:m.cookieDomain)||""}; Max-Age=${(null==m?void 0:m.cookieMaxAge)||""}; Path=${(null==m?void 0:m.cookiePath)||"/"}; HttpOnly; SameSite=Strict`):(null===(s=r.response)||void 0===s?void 0:s.headers.get("set-cookie"))&&(l=((e,t)=>{const a=null==e?void 0:e.match(RegExp(`(?:^|;\\s*)${t}=([^;]*)`));return a?a[1]:null})(null===(o=r.response)||void 0===o?void 0:o.headers.get("set-cookie"),"DSR"),p.push(null===(n=r.response)||void 0===n?void 0:n.headers.get("set-cookie"))),Object.assign(Object.assign({},r),{data:Object.assign(Object.assign({},r.data),{refreshJwt:l,cookies:p})})};function p(e,t,a){var s,o;const n=a?null===(o=null===(s=e.token.tenants)||void 0===s?void 0:s[a])||void 0===o?void 0:o[t]:e.token[t];return Array.isArray(n)?n:[]}var m={create:"/v1/mgmt/user/create",update:"/v1/mgmt/user/update",delete:"/v1/mgmt/user/delete",deleteAllTestUsers:"/v1/mgmt/user/test/delete/all",load:"/v1/mgmt/user",search:"/v1/mgmt/user/search",updateStatus:"/v1/mgmt/user/update/status",updateEmail:"/v1/mgmt/user/update/email",updatePhone:"/v1/mgmt/user/update/phone",updateDisplayName:"/v1/mgmt/user/update/name",updatePicture:"/v1/mgmt/user/update/picture",updateCustomAttribute:"/v1/mgmt/user/update/customAttribute",addRole:"/v1/mgmt/user/update/role/add",removeRole:"/v1/mgmt/user/update/role/remove",addTenant:"/v1/mgmt/user/update/tenant/add",removeTenant:"/v1/mgmt/user/update/tenant/remove",generateOTPForTest:"/v1/mgmt/tests/generate/otp",generateMagicLinkForTest:"/v1/mgmt/tests/generate/magiclink",generateEnchantedLinkForTest:"/v1/mgmt/tests/generate/enchantedlink"},u={create:"/v1/mgmt/accesskey/create",load:"/v1/mgmt/accesskey",search:"/v1/mgmt/accesskey/search",update:"/v1/mgmt/accesskey/update",deactivate:"/v1/mgmt/accesskey/deactivate",activate:"/v1/mgmt/accesskey/activate",delete:"/v1/mgmt/accesskey/delete"},c={create:"/v1/mgmt/tenant/create",update:"/v1/mgmt/tenant/update",delete:"/v1/mgmt/tenant/delete",loadAll:"/v1/mgmt/tenant/all"},g={settings:"/v1/mgmt/sso/settings",metadata:"/v1/mgmt/sso/metadata",mapping:"/v1/mgmt/sso/mapping"},h={update:"/v1/mgmt/jwt/update"},v={create:"/v1/mgmt/permission/create",update:"/v1/mgmt/permission/update",delete:"/v1/mgmt/permission/delete",loadAll:"/v1/mgmt/permission/all"},k={create:"/v1/mgmt/role/create",update:"/v1/mgmt/role/update",delete:"/v1/mgmt/role/delete",loadAll:"/v1/mgmt/role/all"},y={export:"/v1/mgmt/flow/export",import:"/v1/mgmt/flow/import"},f={export:"/v1/mgmt/theme/export",import:"/v1/mgmt/theme/import"},C={loadAllGroups:"/v1/mgmt/group/all",loadAllGroupsForMember:"/v1/mgmt/group/member/all",loadAllGroupMembers:"/v1/mgmt/group/members"};const w=(e,t)=>({create:(s,o,n,r,i,l,d,p)=>a(e.httpClient.post(m.create,{loginId:s,email:o,phone:n,displayName:r,roleNames:i,userTenants:l,customAttributes:d,picture:p},{token:t}),(e=>e.user)),createTestUser:(s,o,n,r,i,l,d,p)=>a(e.httpClient.post(m.create,{loginId:s,email:o,phone:n,displayName:r,roleNames:i,userTenants:l,test:!0,customAttributes:d,picture:p},{token:t}),(e=>e.user)),invite:(s,o,n,r,i,l,d,p)=>a(e.httpClient.post(m.create,{loginId:s,email:o,phone:n,displayName:r,roleNames:i,userTenants:l,invite:!0,customAttributes:d,picture:p},{token:t}),(e=>e.user)),update:(s,o,n,r,i,l,d,p)=>a(e.httpClient.post(m.update,{loginId:s,email:o,phone:n,displayName:r,roleNames:i,userTenants:l,customAttributes:d,picture:p},{token:t}),(e=>e.user)),delete:s=>a(e.httpClient.post(m.delete,{loginId:s},{token:t})),deleteAllTestUsers:()=>a(e.httpClient.delete(m.deleteAllTestUsers,{},{token:t})),load:s=>a(e.httpClient.get(m.load,{queryParams:{loginId:s},token:t}),(e=>e.user)),loadByUserId:s=>a(e.httpClient.get(m.load,{queryParams:{userId:s},token:t}),(e=>e.user)),searchAll:(s,o,n,r,i,l,d)=>a(e.httpClient.post(m.search,{tenantIds:s,roleNames:o,limit:n,page:r,testUsersOnly:i,withTestUser:l,customAttributes:d},{token:t}),(e=>e.users)),activate:s=>a(e.httpClient.post(m.updateStatus,{loginId:s,status:"enabled"},{token:t}),(e=>e.user)),deactivate:s=>a(e.httpClient.post(m.updateStatus,{loginId:s,status:"disabled"},{token:t}),(e=>e.user)),updateEmail:(s,o,n)=>a(e.httpClient.post(m.updateEmail,{loginId:s,email:o,verified:n},{token:t}),(e=>e.user)),updatePhone:(s,o,n)=>a(e.httpClient.post(m.updatePhone,{loginId:s,phone:o,verified:n},{token:t}),(e=>e.user)),updateDisplayName:(s,o)=>a(e.httpClient.post(m.updateDisplayName,{loginId:s,displayName:o},{token:t}),(e=>e.user)),updatePicture:(s,o)=>a(e.httpClient.post(m.updatePicture,{loginId:s,picture:o},{token:t}),(e=>e.user)),updateCustomAttribute:(s,o,n)=>a(e.httpClient.post(m.updateCustomAttribute,{loginId:s,attributeKey:o,attributeValue:n},{token:t}),(e=>e.user)),addRoles:(s,o)=>a(e.httpClient.post(m.addRole,{loginId:s,roleNames:o},{token:t}),(e=>e.user)),removeRoles:(s,o)=>a(e.httpClient.post(m.removeRole,{loginId:s,roleNames:o},{token:t}),(e=>e.user)),addTenant:(s,o)=>a(e.httpClient.post(m.addTenant,{loginId:s,tenantId:o},{token:t}),(e=>e.user)),removeTenant:(s,o)=>a(e.httpClient.post(m.removeTenant,{loginId:s,tenantId:o},{token:t}),(e=>e.user)),addTenantRoles:(s,o,n)=>a(e.httpClient.post(m.addRole,{loginId:s,tenantId:o,roleNames:n},{token:t}),(e=>e.user)),removeTenantRoles:(s,o,n)=>a(e.httpClient.post(m.removeRole,{loginId:s,tenantId:o,roleNames:n},{token:t}),(e=>e.user)),generateOTPForTestUser:(s,o)=>a(e.httpClient.post(m.generateOTPForTest,{deliveryMethod:s,loginId:o},{token:t}),(e=>e)),generateMagicLinkForTestUser:(s,o,n)=>a(e.httpClient.post(m.generateMagicLinkForTest,{deliveryMethod:s,loginId:o,URI:n},{token:t}),(e=>e)),generateEnchantedLinkForTestUser:(s,o)=>a(e.httpClient.post(m.generateEnchantedLinkForTest,{loginId:s,URI:o},{token:t}),(e=>e))}),I=(e,t)=>({create:(s,o)=>a(e.httpClient.post(c.create,{name:s,selfProvisioningDomains:o},{token:t})),createWithId:(s,o,n)=>a(e.httpClient.post(c.create,{id:s,name:o,selfProvisioningDomains:n},{token:t})),update:(s,o,n)=>a(e.httpClient.post(c.update,{id:s,name:o,selfProvisioningDomains:n},{token:t})),delete:s=>a(e.httpClient.post(c.delete,{id:s},{token:t})),loadAll:()=>a(e.httpClient.get(c.loadAll,{token:t}),(e=>e.tenants))}),b=(e,t)=>({update:(s,o)=>a(e.httpClient.post(h.update,{jwt:s,customClaims:o},{token:t}))}),T=(e,t)=>({create:(s,o)=>a(e.httpClient.post(v.create,{name:s,description:o},{token:t})),update:(s,o,n)=>a(e.httpClient.post(v.update,{name:s,newName:o,description:n},{token:t})),delete:s=>a(e.httpClient.post(v.delete,{name:s},{token:t})),loadAll:()=>a(e.httpClient.get(v.loadAll,{token:t}),(e=>e.permissions))}),A=(e,t)=>({create:(s,o,n)=>a(e.httpClient.post(k.create,{name:s,description:o,permissionNames:n},{token:t})),update:(s,o,n,r)=>a(e.httpClient.post(k.update,{name:s,newName:o,description:n,permissionNames:r},{token:t})),delete:s=>a(e.httpClient.post(k.delete,{name:s},{token:t})),loadAll:()=>a(e.httpClient.get(k.loadAll,{token:t}),(e=>e.roles))}),x=(e,t)=>({loadAllGroups:s=>a(e.httpClient.post(C.loadAllGroups,{tenantId:s},{token:t})),loadAllGroupsForMember:(s,o,n)=>a(e.httpClient.post(C.loadAllGroupsForMember,{tenantId:s,loginIds:n,userIds:o},{token:t})),loadAllGroupMembers:(s,o)=>a(e.httpClient.post(C.loadAllGroupMembers,{tenantId:s,groupId:o},{token:t}))}),j=(e,t)=>({getSettings:s=>a(e.httpClient.get(g.settings,{queryParams:{tenantId:s},token:t}),(e=>e)),configureSettings:(s,o,n,r,i,l)=>a(e.httpClient.post(g.settings,{tenantId:s,idpURL:o,entityId:r,idpCert:n,redirectURL:i,domain:l},{token:t})),configureMetadata:(s,o)=>a(e.httpClient.post(g.metadata,{tenantId:s,idpMetadataURL:o},{token:t})),configureMapping:(s,o,n)=>a(e.httpClient.post(g.mapping,{tenantId:s,roleMapping:o,attributeMapping:n},{token:t}))}),N=(e,t)=>({create:(s,o,n,r)=>a(e.httpClient.post(u.create,{name:s,expireTime:o,roleNames:n,keyTenants:r},{token:t})),load:s=>a(e.httpClient.get(u.load,{queryParams:{id:s},token:t}),(e=>e.key)),searchAll:s=>a(e.httpClient.post(u.search,{tenantIds:s},{token:t}),(e=>e.keys)),update:(s,o)=>a(e.httpClient.post(u.update,{id:s,name:o},{token:t}),(e=>e.key)),deactivate:s=>a(e.httpClient.post(u.deactivate,{id:s},{token:t})),activate:s=>a(e.httpClient.post(u.activate,{id:s},{token:t})),delete:s=>a(e.httpClient.post(u.delete,{id:s},{token:t}))}),R=(e,t)=>({export:s=>a(e.httpClient.post(y.export,{flowId:s},{token:t})),import:(s,o,n)=>a(e.httpClient.post(y.import,{flowId:s,flow:o,screens:n},{token:t}))}),P=(e,t)=>({export:()=>a(e.httpClient.post(f.export,{},{token:t})),import:s=>a(e.httpClient.post(f.import,{theme:s},{token:t}))});var M;null!==(M=globalThis.Headers)&&void 0!==M||(globalThis.Headers=l);const E=(...e)=>(e.forEach((e=>{var t,a;e&&(null!==(t=(a=e).highWaterMark)&&void 0!==t||(a.highWaterMark=31457280))})),i(...e)),S=a=>{var i,{managementKey:l}=a,m=e(a,["managementKey"]);const u=t(Object.assign(Object.assign({},m),{fetch:E,baseHeaders:Object.assign(Object.assign({},m.baseHeaders),{"x-descope-sdk-name":"nodejs","x-descope-sdk-node-version":(null===(i=null===process||void 0===process?void 0:process.versions)||void 0===i?void 0:i.node)||"","x-descope-sdk-version":"1.5.0"})})),{projectId:c,logger:g}=m,h={},v=((e,t)=>({user:w(e,t),accessKey:N(e,t),tenant:I(e,t),sso:j(e,t),jwt:b(e,t),permission:T(e,t),role:A(e,t),group:x(e,t),flow:R(e,t),theme:P(e,t)}))(u,l),k=Object.assign(Object.assign({},u),{management:v,async getKey(e){if(!(null==e?void 0:e.kid))throw Error("header.kid must not be empty");if(h[e.kid])return h[e.kid];if(Object.assign(h,await(async()=>{const e=(await u.httpClient.get(`v2/keys/${c}`).then((e=>e.json()))).keys;return Array.isArray(e)?(await Promise.all(e.map((async e=>[e.kid,await r(e)])))).reduce(((e,[t,a])=>t?Object.assign(Object.assign({},e),{[t.toString()]:a}):e),{}):{}})()),!h[e.kid])throw Error("failed to fetch matching key");return h[e.kid]},async validateJwt(e){var t;const a=(await o(e,k.getKey,{clockTolerance:5})).payload;if(a&&(a.iss=null===(t=a.iss)||void 0===t?void 0:t.split("/").pop(),a.iss!==c))throw new n.JWTClaimValidationFailed('unexpected "iss" claim value',"iss","check_failed");return{jwt:e,token:a}},async validateSession(e){if(!e)throw Error("session token is required for validation");try{return await k.validateJwt(e)}catch(e){throw null==g||g.error("session validation failed",e),Error("session validation failed")}},async refreshSession(e){var t,a;if(!e)throw Error("refresh token is required to refresh a session");try{await k.validateJwt(e);const s=await k.refresh(e);if(s.ok){return await k.validateJwt(null===(t=s.data)||void 0===t?void 0:t.sessionJwt)}throw Error(null===(a=s.error)||void 0===a?void 0:a.errorMessage)}catch(e){throw null==g||g.error("refresh token validation failed",e),Error("refresh token validation failed")}},async validateAndRefreshSession(e,t){if(!e&&!t)throw Error("both session and refresh tokens are empty");try{return await k.validateSession(e)}catch(e){null==g||g.log("session validation failed - trying to refresh it")}return k.refreshSession(t)},async exchangeAccessKey(e){if(!e)throw Error("access key must not be empty");let t;try{t=await k.accessKey.exchange(e)}catch(e){throw null==g||g.error("failed to exchange access key",e),Error("could not exchange access key")}const{sessionJwt:a}=t.data;if(!a)throw null==g||g.error("failed to parse exchange access key response"),Error("could not exchange access key");try{return await k.validateJwt(a)}catch(e){throw null==g||g.error("failed to parse jwt from access key",e),Error("could not exchange access key")}},validatePermissions:(e,t)=>k.validateTenantPermissions(e,null,t),validateTenantPermissions(e,t,a){const s=p(e,"permissions",t);return a.every((e=>s.includes(e)))},validateRoles:(e,t)=>k.validateTenantRoles(e,null,t),validateTenantRoles(e,t,a){const s=p(e,"roles",t);return a.every((e=>s.includes(e)))}});return s(k,["otp.verify.email","otp.verify.sms","otp.verify.whatsapp","magicLink.verify","enchantedLink.signUp","enchantedLink.signIn","oauth.exchange","saml.exchange","totp.verify","webauthn.signIn.finish","webauthn.signUp.finish","refresh"],d)};S.RefreshTokenCookieName="DSR",S.SessionTokenCookieName="DS";export{S as default};
 //# sourceMappingURL=index.esm.js.map