@descope/node-sdk 1.1.1 → 1.5.1

package/README.md

@@ -15,10 +15,13 @@ Install the package with:
 npm i --save @descope/node-sdk
 ```
 
-## Setup
+## Authentication Functions
 
-A Descope `Project ID` is required to initialize the SDK. Find it on the
-[project page in the Descope Console](https://app.descope.com/settings/project).
+### Setup
+
+Before you can use authentication functions listed below, you must initialize `descopeClient` to use all of the built-in SDK functions.
+
+You'll need your Descope `Project ID` to create this, and you can find it on the [project page](https://app.descope.com/settings/project) in the Descope Console.
 
 ```typescript
 import DescopeClient from '@descope/node-sdk';
@@ -26,9 +29,53 @@ import DescopeClient from '@descope/node-sdk';
 const descopeClient = DescopeClient({ projectId: 'my-project-ID' });
 ```
 
-## Usage
+Once you've created a `descopeClient`, you can use that to work with the following functions:
+
+1. [OTP Authentication](#otp-authentication)
+2. [Magic Link](#magic-link)
+3. [Enchanted Link](#enchanted-link)
+4. [OAuth](#oauth)
+5. [SSO/SAML](#ssosaml)
+6. [TOTP Authentication](#totp-authentication)
+7. [Passwords](#passwords)
+8. [Session Validation](#session-validation)
+9. [Roles & Permission Validation](#roles--permission-validation)
+10. [Logging Out](#logging-out)
+
+## Management Functions
+
+### Setup
+
+Before you can use management functions listed below, you must initialize `descopeClient`.
+
+If you wish to also use management functions, you will need to initialize a new version of your `descopeClient`, but this time with a `ManagementKey` as well as your `Project ID`. Create a management key in the [Descope Console](https://app.descope.com/settings/company/managementkeys).
+
+```typescript
+import DescopeClient from '@descope/node-sdk';
+
+const descopeClient = DescopeClient({
+  projectId: 'my-project-ID',
+  managementKey: 'management-key',
+});
+```
+
+Then, you can use that to work with the following functions:
+
+1. [Manage Tenants](#manage-tenants)
+2. [Manage Users](#manage-users)
+3. [Manage Access Keys](#manage-access-keys)
+4. [Manage SSO Setting](#manage-sso-setting)
+5. [Manage Permissions](#manage-permissions)
+6. [Manage Roles](#manage-roles)
+7. [Query SSO Groups](#query-sso-groups)
+8. [Manage Flows](#manage-flows)
+9. [Manage JWTs](#manage-jwts)
+
+If you wish to run any of our code samples and play with them, check out our [Code Examples](#code-examples) section.
+
+If you're performing end-to-end testing, check out the [Utils for your end to end (e2e) tests and integration tests](#utils-for-your-end-to-end-e2e-tests-and-integration-tests) section. You will need to use the `descopeClient` you created under the setup of [Management Functions](#management-functions).
 
-Here are some examples how to manage and authenticate users:
+---
 
 ### OTP Authentication
 
@@ -399,10 +446,10 @@ invalidate all user's refresh tokens. After calling this function, you must inva
 await descopeClient.logoutAll(refreshToken);
 ```
 
-## Management API
+## Management Functions
 
 It is very common for some form of management or automation to be required. These can be performed
-using the management API. Please note that these actions are more sensitive as they are administrative
+using the management functions. Please note that these actions are more sensitive as they are administrative
 in nature. Please use responsibly.
 
 ### Setup
@@ -511,6 +558,20 @@ usersRes.data.forEach((user) => {
 });
 ```
 
+#### Set or Expire User Password
+
+You can set or expire a user's password.
+Note: When setting a password, it will automatically be set as expired.
+The user will not be able log-in using an expired password, and will be required replace it on next login.
+
+```typescript
+// Set a user's password
+await descopeClient.management.user.setPassword('<login-ID>', '<some-password>');
+
+// Or alternatively, expire a user password
+await descopeClient.management.user.expirePassword('<login-ID>');
+```
+
 ### Manage Access Keys
 
 You can create, update, delete or load access keys, as well as search according to filters:
@@ -553,6 +614,9 @@ await descopeClient.management.accessKey.delete('key-id');
 You can manage SSO settings and map SSO group roles and user attributes.
 
 ```typescript
+// You can get SSO settings for a specific tenant ID
+const ssoSettings = await descopeClient.management.sso.getSettings("tenant-id")
+
 // You can configure SSO settings manually by setting the required fields directly
 const tenantId = 'tenant-id' // Which tenant this configuration is for
 const idpURL = 'https://idp.com'
@@ -582,6 +646,9 @@ Certifcate contents
 -----END CERTIFICATE-----
 ```
 
+// You can delete SSO settings for a specific tenant ID
+await descopeClient.management.sso.deleteSettings("tenant-id")
+
 ### Manage Permissions
 
 You can create, update, delete or load permissions:
@@ -663,6 +730,35 @@ groupsRes.data.forEach((group) => {
 });
 ```
 
+### Manage Flows
+
+You can import and export flows and screens, or the project theme:
+
+```typescript
+// Export the flow and it's matching screens based on the given id
+const res = await descopeClient.management.flow.export('sign-up');
+console.log('found flow', res.data.flow);
+res.data.screens.forEach((screen) => {
+  // do something
+});
+
+// Import the given flow and screens as the given id
+const { flow, screens } = res.data;
+const updatedRes = descopeClient.management.flow.import('sign-up', flow, screens);
+console.log('updated flow', updatedRes.data.flow);
+updatedRes.data.screens.forEach((screen) => {
+  // do something
+});
+
+// Export the current theme of the project
+const res = descopeClient.management.theme.export();
+console.log(res.data.theme);
+
+// Import the given theme to the project
+const updatedRes = descopeClient.management.theme.import(theme);
+console.log(updatedRes.data.theme);
+```
+
 ### Manage JWTs
 
 You can add custom claims to a valid JWT.
@@ -674,6 +770,55 @@ const updatedJWTRes = await descopeClient.management.jwt.update('original-jwt',
 });
 ```
 
+### Utils for your end to end (e2e) tests and integration tests
+
+To ease your e2e tests, we exposed dedicated management methods,
+that way, you don't need to use 3rd party messaging services in order to receive sign-in/up Emails or SMS, and avoid the need of parsing the code and token from them.
+
+```typescript
+// User for test can be created, this user will be able to generate code/link without
+// the need of 3rd party messaging services.
+// Test user must have a loginId, other fields are optional.
+// Roles should be set directly if no tenants exist, otherwise set
+// on a per-tenant basis.
+await descopeClient.management.user.createTestUser(
+  'desmond@descope.com',
+  'desmond@descope.com',
+  null,
+  'Desmond Copeland',
+  null,
+  [{ tenantId: 'tenant-ID1', roleNames: ['role-name1'] }],
+);
+
+// Now test user got created, and this user will be available until you delete it,
+// you can use any management operation for test user CRUD.
+// You can also delete all test users.
+await descopeClient.management.user.deleteAllTestUsers();
+
+// OTP code can be generated for test user, for example:
+const { code } = await descopeClient.management.user.generateOTPForTestUser(
+  'sms',
+  'desmond@descope.com',
+);
+// Now you can verify the code is valid (using descopeClient.auth.*.verify for example)
+
+// Same as OTP, magic link can be generated for test user, for example:
+const { link } = await descopeClient.management.user.generateMagicLinkForTestUser(
+  'email',
+  'desmond@descope.com',
+  '',
+);
+
+// Enchanted link can be generated for test user, for example:
+const { link, pendingRef } = await descopeClient.management.user.generateEnchantedLinkForTestUser(
+  'desmond@descope.com',
+  '',
+);
+
+// Note 1: The generate code/link functions, work only for test users, will not work for regular users.
+// Note 2: In case of testing sign-in / sign-up operations with test users, need to make sure to generate the code prior calling the sign-in / sign-up operations.
+```
+
 ## Code Examples
 
 You can find various usage examples in the [examples folder](https://github.com/descope/node-sdk/blob/main/examples).

package/dist/cjs/index.cjs.js

@@ -1,2 +1,2 @@
-"use strict";var e=require("tslib"),t=require("@descope/core-js-sdk"),s=require("jose"),o=require("node-fetch-commonjs");function a(e){return e&&"object"==typeof e&&"default"in e?e:{default:e}}var n=a(t),r=a(o);const i=t=>async(...s)=>{var o,a,n;const r=await t(...s);if(!r.data)return r;let i=r.data,{refreshJwt:l}=i,p=e.__rest(i,["refreshJwt"]);const d=[];var m;return l?d.push(`${"DSR"}=${l}; Domain=${(null==(m=p)?void 0:m.cookieDomain)||""}; Max-Age=${(null==m?void 0:m.cookieMaxAge)||""}; Path=${(null==m?void 0:m.cookiePath)||"/"}; HttpOnly; SameSite=Strict`):(null===(o=r.response)||void 0===o?void 0:o.headers.get("set-cookie"))&&(l=((e,t)=>{const s=null==e?void 0:e.match(RegExp(`(?:^|;\\s*)${t}=([^;]*)`));return s?s[1]:null})(null===(a=r.response)||void 0===a?void 0:a.headers.get("set-cookie"),"DSR"),d.push(null===(n=r.response)||void 0===n?void 0:n.headers.get("set-cookie"))),Object.assign(Object.assign({},r),{data:Object.assign(Object.assign({},r.data),{refreshJwt:l,cookies:d})})};function l(e,t,s){var o,a;const n=s?null===(a=null===(o=e.token.tenants)||void 0===o?void 0:o[s])||void 0===a?void 0:a[t]:e.token[t];return Array.isArray(n)?n:[]}var p={create:"/v1/mgmt/user/create",update:"/v1/mgmt/user/update",delete:"/v1/mgmt/user/delete",load:"/v1/mgmt/user",search:"/v1/mgmt/user/search",updateStatus:"/v1/mgmt/user/update/status",updateEmail:"/v1/mgmt/user/update/email",updatePhone:"/v1/mgmt/user/update/phone",updateDisplayName:"/v1/mgmt/user/update/name",addRole:"/v1/mgmt/user/update/role/add",removeRole:"/v1/mgmt/user/update/role/remove",addTenant:"/v1/mgmt/user/update/tenant/add",removeTenant:"/v1/mgmt/user/update/tenant/remove"},d={create:"/v1/mgmt/accesskey/create",load:"/v1/mgmt/accesskey",search:"/v1/mgmt/accesskey/search",update:"/v1/mgmt/accesskey/update",deactivate:"/v1/mgmt/accesskey/deactivate",activate:"/v1/mgmt/accesskey/activate",delete:"/v1/mgmt/accesskey/delete"},m={create:"/v1/mgmt/tenant/create",update:"/v1/mgmt/tenant/update",delete:"/v1/mgmt/tenant/delete",loadAll:"/v1/mgmt/tenant/all"},c={configure:"/v1/mgmt/sso/settings",metadata:"/v1/mgmt/sso/metadata",mapping:"/v1/mgmt/sso/mapping"},u={update:"/v1/mgmt/jwt/update"},h={create:"/v1/mgmt/permission/create",update:"/v1/mgmt/permission/update",delete:"/v1/mgmt/permission/delete",loadAll:"/v1/mgmt/permission/all"},v={create:"/v1/mgmt/role/create",update:"/v1/mgmt/role/update",delete:"/v1/mgmt/role/delete",loadAll:"/v1/mgmt/role/all"},g={export:"/v1/mgmt/flow/export",import:"/v1/mgmt/flow/import"},f={export:"/v1/mgmt/theme/export",import:"/v1/mgmt/theme/import"},k={loadAllGroups:"/v1/mgmt/group/all",loadAllGroupsForMember:"/v1/mgmt/group/member/all",loadAllGroupMembers:"/v1/mgmt/group/members"};const y=(e,s)=>({create:(o,a,n,r,i,l)=>t.transformResponse(e.httpClient.post(p.create,{loginId:o,email:a,phone:n,displayName:r,roleNames:i,userTenants:l},{token:s}),(e=>e.user)),invite:(o,a,n,r,i,l)=>t.transformResponse(e.httpClient.post(p.create,{loginId:o,email:a,phone:n,displayName:r,roleNames:i,userTenants:l,invite:!0},{token:s}),(e=>e.user)),update:(o,a,n,r,i,l)=>t.transformResponse(e.httpClient.post(p.update,{loginId:o,email:a,phone:n,displayName:r,roleNames:i,userTenants:l},{token:s}),(e=>e.user)),delete:o=>t.transformResponse(e.httpClient.post(p.delete,{loginId:o},{token:s})),load:o=>t.transformResponse(e.httpClient.get(p.load,{queryParams:{loginId:o},token:s}),(e=>e.user)),loadByUserId:o=>t.transformResponse(e.httpClient.get(p.load,{queryParams:{userId:o},token:s}),(e=>e.user)),searchAll:(o,a,n,r)=>t.transformResponse(e.httpClient.post(p.search,{tenantIds:o,roleNames:a,limit:n,page:r},{token:s}),(e=>e.users)),activate:o=>t.transformResponse(e.httpClient.post(p.updateStatus,{loginId:o,status:"enabled"},{token:s}),(e=>e.user)),deactivate:o=>t.transformResponse(e.httpClient.post(p.updateStatus,{loginId:o,status:"disabled"},{token:s}),(e=>e.user)),updateEmail:(o,a,n)=>t.transformResponse(e.httpClient.post(p.updateEmail,{loginId:o,email:a,verified:n},{token:s}),(e=>e.user)),updatePhone:(o,a,n)=>t.transformResponse(e.httpClient.post(p.updatePhone,{loginId:o,phone:a,verified:n},{token:s}),(e=>e.user)),updateDisplayName:(o,a)=>t.transformResponse(e.httpClient.post(p.updateDisplayName,{loginId:o,displayName:a},{token:s}),(e=>e.user)),addRoles:(o,a)=>t.transformResponse(e.httpClient.post(p.addRole,{loginId:o,roleNames:a},{token:s}),(e=>e.user)),removeRoles:(o,a)=>t.transformResponse(e.httpClient.post(p.removeRole,{loginId:o,roleNames:a},{token:s}),(e=>e.user)),addTenant:(o,a)=>t.transformResponse(e.httpClient.post(p.addTenant,{loginId:o,tenantId:a},{token:s}),(e=>e.user)),removeTenant:(o,a)=>t.transformResponse(e.httpClient.post(p.removeTenant,{loginId:o,tenantId:a},{token:s}),(e=>e.user)),addTenantRoles:(o,a,n)=>t.transformResponse(e.httpClient.post(p.addRole,{loginId:o,tenantId:a,roleNames:n},{token:s}),(e=>e.user)),removeTenantRoles:(o,a,n)=>t.transformResponse(e.httpClient.post(p.removeRole,{loginId:o,tenantId:a,roleNames:n},{token:s}),(e=>e.user))}),R=(e,s)=>({create:(o,a)=>t.transformResponse(e.httpClient.post(m.create,{name:o,selfProvisioningDomains:a},{token:s})),createWithId:(o,a,n)=>t.transformResponse(e.httpClient.post(m.create,{id:o,name:a,selfProvisioningDomains:n},{token:s})),update:(o,a,n)=>t.transformResponse(e.httpClient.post(m.update,{id:o,name:a,selfProvisioningDomains:n},{token:s})),delete:o=>t.transformResponse(e.httpClient.post(m.delete,{id:o},{token:s})),loadAll:()=>t.transformResponse(e.httpClient.get(m.loadAll,{token:s}),(e=>e.tenants))}),w=(e,s)=>({update:(o,a)=>t.transformResponse(e.httpClient.post(u.update,{jwt:o,customClaims:a},{token:s}))}),C=(e,s)=>({create:(o,a)=>t.transformResponse(e.httpClient.post(h.create,{name:o,description:a},{token:s})),update:(o,a,n)=>t.transformResponse(e.httpClient.post(h.update,{name:o,newName:a,description:n},{token:s})),delete:o=>t.transformResponse(e.httpClient.post(h.delete,{name:o},{token:s})),loadAll:()=>t.transformResponse(e.httpClient.get(h.loadAll,{token:s}),(e=>e.permissions))}),I=(e,s)=>({create:(o,a,n)=>t.transformResponse(e.httpClient.post(v.create,{name:o,description:a,permissionNames:n},{token:s})),update:(o,a,n,r)=>t.transformResponse(e.httpClient.post(v.update,{name:o,newName:a,description:n,permissionNames:r},{token:s})),delete:o=>t.transformResponse(e.httpClient.post(v.delete,{name:o},{token:s})),loadAll:()=>t.transformResponse(e.httpClient.get(v.loadAll,{token:s}),(e=>e.roles))}),b=(e,s)=>({loadAllGroups:o=>t.transformResponse(e.httpClient.post(k.loadAllGroups,{tenantId:o},{token:s})),loadAllGroupsForMember:(o,a,n)=>t.transformResponse(e.httpClient.post(k.loadAllGroupsForMember,{tenantId:o,loginIds:n,userIds:a},{token:s})),loadAllGroupMembers:(o,a)=>t.transformResponse(e.httpClient.post(k.loadAllGroupMembers,{tenantId:o,groupId:a},{token:s}))}),A=(e,s)=>({configureSettings:(o,a,n,r,i,l)=>t.transformResponse(e.httpClient.post(c.configure,{tenantId:o,idpURL:a,entityId:r,idpCert:n,redirectURL:i,domain:l},{token:s})),configureMetadata:(o,a)=>t.transformResponse(e.httpClient.post(c.metadata,{tenantId:o,idpMetadataURL:a},{token:s})),configureMapping:(o,a,n)=>t.transformResponse(e.httpClient.post(c.mapping,{tenantId:o,roleMapping:a,attributeMapping:n},{token:s}))}),j=(e,s)=>({create:(o,a,n,r)=>t.transformResponse(e.httpClient.post(d.create,{name:o,expireTime:a,roleNames:n,keyTenants:r},{token:s})),load:o=>t.transformResponse(e.httpClient.get(d.load,{queryParams:{id:o},token:s}),(e=>e.key)),searchAll:o=>t.transformResponse(e.httpClient.post(d.search,{tenantIds:o},{token:s}),(e=>e.keys)),update:(o,a)=>t.transformResponse(e.httpClient.post(d.update,{id:o,name:a},{token:s}),(e=>e.key)),deactivate:o=>t.transformResponse(e.httpClient.post(d.deactivate,{id:o},{token:s})),activate:o=>t.transformResponse(e.httpClient.post(d.activate,{id:o},{token:s})),delete:o=>t.transformResponse(e.httpClient.post(d.delete,{id:o},{token:s}))}),x=(e,s)=>({export:o=>t.transformResponse(e.httpClient.post(g.export,{flowId:o},{token:s})),import:(o,a,n)=>t.transformResponse(e.httpClient.post(g.import,{flowId:o,flow:a,screens:n},{token:s}))}),T=(e,s)=>({export:()=>t.transformResponse(e.httpClient.post(f.export,{},{token:s})),import:o=>t.transformResponse(e.httpClient.post(f.import,{theme:o},{token:s}))});var N;null!==(N=globalThis.Headers)&&void 0!==N||(globalThis.Headers=o.Headers);const S=(...e)=>(e.forEach((e=>{var t,s;e&&(null!==(t=(s=e).highWaterMark)&&void 0!==t||(s.highWaterMark=32212254720))})),r.default(...e)),E=o=>{var a,{managementKey:r}=o,p=e.__rest(o,["managementKey"]);const d=n.default(Object.assign(Object.assign({},p),{fetch:S,baseHeaders:Object.assign(Object.assign({},p.baseHeaders),{"x-descope-sdk-name":"nodejs","x-descope-sdk-node-version":(null===(a=null===process||void 0===process?void 0:process.versions)||void 0===a?void 0:a.node)||"","x-descope-sdk-version":"1.1.1"})})),{projectId:m,logger:c}=p,u={},h=((e,t)=>({user:y(e,t),accessKey:j(e,t),tenant:R(e,t),sso:A(e,t),jwt:w(e,t),permission:C(e,t),role:I(e,t),group:b(e,t),flow:x(e,t),theme:T(e,t)}))(d,r),v=Object.assign(Object.assign({},d),{management:h,async getKey(e){if(!(null==e?void 0:e.kid))throw Error("header.kid must not be empty");if(u[e.kid])return u[e.kid];if(Object.assign(u,await(async()=>{const e=(await d.httpClient.get(`v2/keys/${m}`).then((e=>e.json()))).keys;return Array.isArray(e)?(await Promise.all(e.map((async e=>[e.kid,await s.importJWK(e)])))).reduce(((e,[t,s])=>t?Object.assign(Object.assign({},e),{[t.toString()]:s}):e),{}):{}})()),!u[e.kid])throw Error("failed to fetch matching key");return u[e.kid]},async validateJwt(e){var t;const o=(await s.jwtVerify(e,v.getKey,{clockTolerance:5})).payload;if(o&&(o.iss=null===(t=o.iss)||void 0===t?void 0:t.split("/").pop(),o.iss!==m))throw new s.errors.JWTClaimValidationFailed('unexpected "iss" claim value',"iss","check_failed");return{jwt:e,token:o}},async validateSession(e){if(!e)throw Error("session token is required for validation");try{return await v.validateJwt(e)}catch(e){throw null==c||c.error("session validation failed",e),Error("session validation failed")}},async refreshSession(e){var t,s;if(!e)throw Error("refresh token is required to refresh a session");try{await v.validateJwt(e);const o=await v.refresh(e);if(o.ok){return await v.validateJwt(null===(t=o.data)||void 0===t?void 0:t.sessionJwt)}throw Error(null===(s=o.error)||void 0===s?void 0:s.errorMessage)}catch(e){throw null==c||c.error("refresh token validation failed",e),Error("refresh token validation failed")}},async validateAndRefreshSession(e,t){if(!e&&!t)throw Error("both session and refresh tokens are empty");try{return await v.validateSession(e)}catch(e){null==c||c.log("session validation failed - trying to refresh it")}return v.refreshSession(t)},async exchangeAccessKey(e){if(!e)throw Error("access key must not be empty");let t;try{t=await v.accessKey.exchange(e)}catch(e){throw null==c||c.error("failed to exchange access key",e),Error("could not exchange access key")}const{sessionJwt:s}=t.data;if(!s)throw null==c||c.error("failed to parse exchange access key response"),Error("could not exchange access key");try{return await v.validateJwt(s)}catch(e){throw null==c||c.error("failed to parse jwt from access key",e),Error("could not exchange access key")}},validatePermissions:(e,t)=>v.validateTenantPermissions(e,null,t),validateTenantPermissions(e,t,s){const o=l(e,"permissions",t);return s.every((e=>o.includes(e)))},validateRoles:(e,t)=>v.validateTenantRoles(e,null,t),validateTenantRoles(e,t,s){const o=l(e,"roles",t);return s.every((e=>o.includes(e)))}});return t.wrapWith(v,["otp.verify.email","otp.verify.sms","otp.verify.whatsapp","magicLink.verify","enchantedLink.signUp","enchantedLink.signIn","oauth.exchange","saml.exchange","totp.verify","webauthn.signIn.finish","webauthn.signUp.finish","refresh"],i)};E.RefreshTokenCookieName="DSR",E.SessionTokenCookieName="DS",module.exports=E;
+"use strict";var e=require("tslib"),t=require("@descope/core-js-sdk"),s=require("jose"),o=require("node-fetch-commonjs");function n(e){return e&&"object"==typeof e&&"default"in e?e:{default:e}}var a=n(t),r=n(o);const i=t=>async(...s)=>{var o,n,a;const r=await t(...s);if(!r.data)return r;let i=r.data,{refreshJwt:l}=i,p=e.__rest(i,["refreshJwt"]);const d=[];var m;return l?d.push(`${"DSR"}=${l}; Domain=${(null==(m=p)?void 0:m.cookieDomain)||""}; Max-Age=${(null==m?void 0:m.cookieMaxAge)||""}; Path=${(null==m?void 0:m.cookiePath)||"/"}; HttpOnly; SameSite=Strict`):(null===(o=r.response)||void 0===o?void 0:o.headers.get("set-cookie"))&&(l=((e,t)=>{const s=null==e?void 0:e.match(RegExp(`(?:^|;\\s*)${t}=([^;]*)`));return s?s[1]:null})(null===(n=r.response)||void 0===n?void 0:n.headers.get("set-cookie"),"DSR"),d.push(null===(a=r.response)||void 0===a?void 0:a.headers.get("set-cookie"))),Object.assign(Object.assign({},r),{data:Object.assign(Object.assign({},r.data),{refreshJwt:l,cookies:d})})};function l(e,t,s){var o,n;const a=s?null===(n=null===(o=e.token.tenants)||void 0===o?void 0:o[s])||void 0===n?void 0:n[t]:e.token[t];return Array.isArray(a)?a:[]}var p={create:"/v1/mgmt/user/create",update:"/v1/mgmt/user/update",delete:"/v1/mgmt/user/delete",deleteAllTestUsers:"/v1/mgmt/user/test/delete/all",load:"/v1/mgmt/user",search:"/v1/mgmt/user/search",updateStatus:"/v1/mgmt/user/update/status",updateEmail:"/v1/mgmt/user/update/email",updatePhone:"/v1/mgmt/user/update/phone",updateDisplayName:"/v1/mgmt/user/update/name",updatePicture:"/v1/mgmt/user/update/picture",updateCustomAttribute:"/v1/mgmt/user/update/customAttribute",addRole:"/v1/mgmt/user/update/role/add",removeRole:"/v1/mgmt/user/update/role/remove",addTenant:"/v1/mgmt/user/update/tenant/add",removeTenant:"/v1/mgmt/user/update/tenant/remove",setPassword:"/v1/mgmt/user/password/set",expirePassword:"/v1/mgmt/user/password/expire",generateOTPForTest:"/v1/mgmt/tests/generate/otp",generateMagicLinkForTest:"/v1/mgmt/tests/generate/magiclink",generateEnchantedLinkForTest:"/v1/mgmt/tests/generate/enchantedlink"},d={create:"/v1/mgmt/accesskey/create",load:"/v1/mgmt/accesskey",search:"/v1/mgmt/accesskey/search",update:"/v1/mgmt/accesskey/update",deactivate:"/v1/mgmt/accesskey/deactivate",activate:"/v1/mgmt/accesskey/activate",delete:"/v1/mgmt/accesskey/delete"},m={create:"/v1/mgmt/tenant/create",update:"/v1/mgmt/tenant/update",delete:"/v1/mgmt/tenant/delete",loadAll:"/v1/mgmt/tenant/all"},u={settings:"/v1/mgmt/sso/settings",metadata:"/v1/mgmt/sso/metadata",mapping:"/v1/mgmt/sso/mapping"},c={update:"/v1/mgmt/jwt/update"},g={create:"/v1/mgmt/permission/create",update:"/v1/mgmt/permission/update",delete:"/v1/mgmt/permission/delete",loadAll:"/v1/mgmt/permission/all"},h={create:"/v1/mgmt/role/create",update:"/v1/mgmt/role/update",delete:"/v1/mgmt/role/delete",loadAll:"/v1/mgmt/role/all"},v={export:"/v1/mgmt/flow/export",import:"/v1/mgmt/flow/import"},f={export:"/v1/mgmt/theme/export",import:"/v1/mgmt/theme/import"},k={loadAllGroups:"/v1/mgmt/group/all",loadAllGroupsForMember:"/v1/mgmt/group/member/all",loadAllGroupMembers:"/v1/mgmt/group/members"};const R=(e,s)=>({create:(o,n,a,r,i,l,d,m)=>t.transformResponse(e.httpClient.post(p.create,{loginId:o,email:n,phone:a,displayName:r,roleNames:i,userTenants:l,customAttributes:d,picture:m},{token:s}),(e=>e.user)),createTestUser:(o,n,a,r,i,l,d,m)=>t.transformResponse(e.httpClient.post(p.create,{loginId:o,email:n,phone:a,displayName:r,roleNames:i,userTenants:l,test:!0,customAttributes:d,picture:m},{token:s}),(e=>e.user)),invite:(o,n,a,r,i,l,d,m)=>t.transformResponse(e.httpClient.post(p.create,{loginId:o,email:n,phone:a,displayName:r,roleNames:i,userTenants:l,invite:!0,customAttributes:d,picture:m},{token:s}),(e=>e.user)),update:(o,n,a,r,i,l,d,m)=>t.transformResponse(e.httpClient.post(p.update,{loginId:o,email:n,phone:a,displayName:r,roleNames:i,userTenants:l,customAttributes:d,picture:m},{token:s}),(e=>e.user)),delete:o=>t.transformResponse(e.httpClient.post(p.delete,{loginId:o},{token:s})),deleteAllTestUsers:()=>t.transformResponse(e.httpClient.delete(p.deleteAllTestUsers,{token:s})),load:o=>t.transformResponse(e.httpClient.get(p.load,{queryParams:{loginId:o},token:s}),(e=>e.user)),loadByUserId:o=>t.transformResponse(e.httpClient.get(p.load,{queryParams:{userId:o},token:s}),(e=>e.user)),searchAll:(o,n,a,r,i,l,d)=>t.transformResponse(e.httpClient.post(p.search,{tenantIds:o,roleNames:n,limit:a,page:r,testUsersOnly:i,withTestUser:l,customAttributes:d},{token:s}),(e=>e.users)),activate:o=>t.transformResponse(e.httpClient.post(p.updateStatus,{loginId:o,status:"enabled"},{token:s}),(e=>e.user)),deactivate:o=>t.transformResponse(e.httpClient.post(p.updateStatus,{loginId:o,status:"disabled"},{token:s}),(e=>e.user)),updateEmail:(o,n,a)=>t.transformResponse(e.httpClient.post(p.updateEmail,{loginId:o,email:n,verified:a},{token:s}),(e=>e.user)),updatePhone:(o,n,a)=>t.transformResponse(e.httpClient.post(p.updatePhone,{loginId:o,phone:n,verified:a},{token:s}),(e=>e.user)),updateDisplayName:(o,n)=>t.transformResponse(e.httpClient.post(p.updateDisplayName,{loginId:o,displayName:n},{token:s}),(e=>e.user)),updatePicture:(o,n)=>t.transformResponse(e.httpClient.post(p.updatePicture,{loginId:o,picture:n},{token:s}),(e=>e.user)),updateCustomAttribute:(o,n,a)=>t.transformResponse(e.httpClient.post(p.updateCustomAttribute,{loginId:o,attributeKey:n,attributeValue:a},{token:s}),(e=>e.user)),addRoles:(o,n)=>t.transformResponse(e.httpClient.post(p.addRole,{loginId:o,roleNames:n},{token:s}),(e=>e.user)),removeRoles:(o,n)=>t.transformResponse(e.httpClient.post(p.removeRole,{loginId:o,roleNames:n},{token:s}),(e=>e.user)),addTenant:(o,n)=>t.transformResponse(e.httpClient.post(p.addTenant,{loginId:o,tenantId:n},{token:s}),(e=>e.user)),removeTenant:(o,n)=>t.transformResponse(e.httpClient.post(p.removeTenant,{loginId:o,tenantId:n},{token:s}),(e=>e.user)),addTenantRoles:(o,n,a)=>t.transformResponse(e.httpClient.post(p.addRole,{loginId:o,tenantId:n,roleNames:a},{token:s}),(e=>e.user)),removeTenantRoles:(o,n,a)=>t.transformResponse(e.httpClient.post(p.removeRole,{loginId:o,tenantId:n,roleNames:a},{token:s}),(e=>e.user)),generateOTPForTestUser:(o,n)=>t.transformResponse(e.httpClient.post(p.generateOTPForTest,{deliveryMethod:o,loginId:n},{token:s}),(e=>e)),generateMagicLinkForTestUser:(o,n,a)=>t.transformResponse(e.httpClient.post(p.generateMagicLinkForTest,{deliveryMethod:o,loginId:n,URI:a},{token:s}),(e=>e)),generateEnchantedLinkForTestUser:(o,n)=>t.transformResponse(e.httpClient.post(p.generateEnchantedLinkForTest,{loginId:o,URI:n},{token:s}),(e=>e)),setPassword:(o,n)=>t.transformResponse(e.httpClient.post(p.setPassword,{loginId:o,password:n},{token:s}),(e=>e)),expirePassword:o=>t.transformResponse(e.httpClient.post(p.expirePassword,{loginId:o},{token:s}),(e=>e))}),y=(e,s)=>({create:(o,n)=>t.transformResponse(e.httpClient.post(m.create,{name:o,selfProvisioningDomains:n},{token:s})),createWithId:(o,n,a)=>t.transformResponse(e.httpClient.post(m.create,{id:o,name:n,selfProvisioningDomains:a},{token:s})),update:(o,n,a)=>t.transformResponse(e.httpClient.post(m.update,{id:o,name:n,selfProvisioningDomains:a},{token:s})),delete:o=>t.transformResponse(e.httpClient.post(m.delete,{id:o},{token:s})),loadAll:()=>t.transformResponse(e.httpClient.get(m.loadAll,{token:s}),(e=>e.tenants))}),C=(e,s)=>({update:(o,n)=>t.transformResponse(e.httpClient.post(c.update,{jwt:o,customClaims:n},{token:s}))}),w=(e,s)=>({create:(o,n)=>t.transformResponse(e.httpClient.post(g.create,{name:o,description:n},{token:s})),update:(o,n,a)=>t.transformResponse(e.httpClient.post(g.update,{name:o,newName:n,description:a},{token:s})),delete:o=>t.transformResponse(e.httpClient.post(g.delete,{name:o},{token:s})),loadAll:()=>t.transformResponse(e.httpClient.get(g.loadAll,{token:s}),(e=>e.permissions))}),I=(e,s)=>({create:(o,n,a)=>t.transformResponse(e.httpClient.post(h.create,{name:o,description:n,permissionNames:a},{token:s})),update:(o,n,a,r)=>t.transformResponse(e.httpClient.post(h.update,{name:o,newName:n,description:a,permissionNames:r},{token:s})),delete:o=>t.transformResponse(e.httpClient.post(h.delete,{name:o},{token:s})),loadAll:()=>t.transformResponse(e.httpClient.get(h.loadAll,{token:s}),(e=>e.roles))}),b=(e,s)=>({loadAllGroups:o=>t.transformResponse(e.httpClient.post(k.loadAllGroups,{tenantId:o},{token:s})),loadAllGroupsForMember:(o,n,a)=>t.transformResponse(e.httpClient.post(k.loadAllGroupsForMember,{tenantId:o,loginIds:a,userIds:n},{token:s})),loadAllGroupMembers:(o,n)=>t.transformResponse(e.httpClient.post(k.loadAllGroupMembers,{tenantId:o,groupId:n},{token:s}))}),T=(e,s)=>({getSettings:o=>t.transformResponse(e.httpClient.get(u.settings,{queryParams:{tenantId:o},token:s}),(e=>e)),deleteSettings:o=>t.transformResponse(e.httpClient.delete(u.settings,{queryParams:{tenantId:o},token:s})),configureSettings:(o,n,a,r,i,l)=>t.transformResponse(e.httpClient.post(u.settings,{tenantId:o,idpURL:n,entityId:r,idpCert:a,redirectURL:i,domain:l},{token:s})),configureMetadata:(o,n)=>t.transformResponse(e.httpClient.post(u.metadata,{tenantId:o,idpMetadataURL:n},{token:s})),configureMapping:(o,n,a)=>t.transformResponse(e.httpClient.post(u.mapping,{tenantId:o,roleMapping:n,attributeMapping:a},{token:s}))}),A=(e,s)=>({create:(o,n,a,r)=>t.transformResponse(e.httpClient.post(d.create,{name:o,expireTime:n,roleNames:a,keyTenants:r},{token:s})),load:o=>t.transformResponse(e.httpClient.get(d.load,{queryParams:{id:o},token:s}),(e=>e.key)),searchAll:o=>t.transformResponse(e.httpClient.post(d.search,{tenantIds:o},{token:s}),(e=>e.keys)),update:(o,n)=>t.transformResponse(e.httpClient.post(d.update,{id:o,name:n},{token:s}),(e=>e.key)),deactivate:o=>t.transformResponse(e.httpClient.post(d.deactivate,{id:o},{token:s})),activate:o=>t.transformResponse(e.httpClient.post(d.activate,{id:o},{token:s})),delete:o=>t.transformResponse(e.httpClient.post(d.delete,{id:o},{token:s}))}),x=(e,s)=>({export:o=>t.transformResponse(e.httpClient.post(v.export,{flowId:o},{token:s})),import:(o,n,a)=>t.transformResponse(e.httpClient.post(v.import,{flowId:o,flow:n,screens:a},{token:s}))}),P=(e,s)=>({export:()=>t.transformResponse(e.httpClient.post(f.export,{},{token:s})),import:o=>t.transformResponse(e.httpClient.post(f.import,{theme:o},{token:s}))});var j;null!==(j=globalThis.Headers)&&void 0!==j||(globalThis.Headers=o.Headers);const N=(...e)=>(e.forEach((e=>{var t,s;e&&(null!==(t=(s=e).highWaterMark)&&void 0!==t||(s.highWaterMark=31457280))})),r.default(...e)),M=o=>{var n,{managementKey:r}=o,p=e.__rest(o,["managementKey"]);const d=a.default(Object.assign(Object.assign({},p),{fetch:N,baseHeaders:Object.assign(Object.assign({},p.baseHeaders),{"x-descope-sdk-name":"nodejs","x-descope-sdk-node-version":(null===(n=null===process||void 0===process?void 0:process.versions)||void 0===n?void 0:n.node)||"","x-descope-sdk-version":"1.5.1"})})),{projectId:m,logger:u}=p,c={},g=((e,t)=>({user:R(e,t),accessKey:A(e,t),tenant:y(e,t),sso:T(e,t),jwt:C(e,t),permission:w(e,t),role:I(e,t),group:b(e,t),flow:x(e,t),theme:P(e,t)}))(d,r),h=Object.assign(Object.assign({},d),{management:g,async getKey(e){if(!(null==e?void 0:e.kid))throw Error("header.kid must not be empty");if(c[e.kid])return c[e.kid];if(Object.assign(c,await(async()=>{const e=(await d.httpClient.get(`v2/keys/${m}`).then((e=>e.json()))).keys;return Array.isArray(e)?(await Promise.all(e.map((async e=>[e.kid,await s.importJWK(e)])))).reduce(((e,[t,s])=>t?Object.assign(Object.assign({},e),{[t.toString()]:s}):e),{}):{}})()),!c[e.kid])throw Error("failed to fetch matching key");return c[e.kid]},async validateJwt(e){var t;const o=(await s.jwtVerify(e,h.getKey,{clockTolerance:5})).payload;if(o&&(o.iss=null===(t=o.iss)||void 0===t?void 0:t.split("/").pop(),o.iss!==m))throw new s.errors.JWTClaimValidationFailed('unexpected "iss" claim value',"iss","check_failed");return{jwt:e,token:o}},async validateSession(e){if(!e)throw Error("session token is required for validation");try{return await h.validateJwt(e)}catch(e){throw null==u||u.error("session validation failed",e),Error("session validation failed")}},async refreshSession(e){var t,s;if(!e)throw Error("refresh token is required to refresh a session");try{await h.validateJwt(e);const o=await h.refresh(e);if(o.ok){return await h.validateJwt(null===(t=o.data)||void 0===t?void 0:t.sessionJwt)}throw Error(null===(s=o.error)||void 0===s?void 0:s.errorMessage)}catch(e){throw null==u||u.error("refresh token validation failed",e),Error("refresh token validation failed")}},async validateAndRefreshSession(e,t){if(!e&&!t)throw Error("both session and refresh tokens are empty");try{return await h.validateSession(e)}catch(e){null==u||u.log("session validation failed - trying to refresh it")}return h.refreshSession(t)},async exchangeAccessKey(e){if(!e)throw Error("access key must not be empty");let t;try{t=await h.accessKey.exchange(e)}catch(e){throw null==u||u.error("failed to exchange access key",e),Error("could not exchange access key")}const{sessionJwt:s}=t.data;if(!s)throw null==u||u.error("failed to parse exchange access key response"),Error("could not exchange access key");try{return await h.validateJwt(s)}catch(e){throw null==u||u.error("failed to parse jwt from access key",e),Error("could not exchange access key")}},validatePermissions:(e,t)=>h.validateTenantPermissions(e,null,t),validateTenantPermissions(e,t,s){const o=l(e,"permissions",t);return s.every((e=>o.includes(e)))},validateRoles:(e,t)=>h.validateTenantRoles(e,null,t),validateTenantRoles(e,t,s){const o=l(e,"roles",t);return s.every((e=>o.includes(e)))}});return t.wrapWith(h,["otp.verify.email","otp.verify.sms","otp.verify.whatsapp","magicLink.verify","enchantedLink.signUp","enchantedLink.signIn","oauth.exchange","saml.exchange","totp.verify","webauthn.signIn.finish","webauthn.signUp.finish","refresh"],i)};M.RefreshTokenCookieName="DSR",M.SessionTokenCookieName="DS",module.exports=M;
 //# sourceMappingURL=index.cjs.js.map

package/dist/cjs/index.cjs.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.cjs.js","sources":["../../lib/constants.ts","../../lib/helpers.ts","../../lib/management/paths.ts","../../lib/management/user.ts","../../lib/management/tenant.ts","../../lib/management/jwt.ts","../../lib/management/permission.ts","../../lib/management/role.ts","../../lib/management/group.ts","../../lib/management/sso.ts","../../lib/management/accesskey.ts","../../lib/management/flow.ts","../../lib/management/theme.ts","../../lib/fetch-polyfill.ts","../../lib/index.ts","../../lib/management/index.ts"],"sourcesContent":["// eslint-disable-next-line import/prefer-default-export\n/** Refresh JWT cookie name */\nexport const refreshTokenCookieName = 'DSR';\n/** Session JWT cookie name */\nexport const sessionTokenCookieName = 'DS';\n/** The key of the tenants claims in the claims map */\nexport const authorizedTenantsClaimName = 'tenants';\n/** The key of the permissions claims in the claims map either under tenant or top level */\nexport const permissionsClaimName = 'permissions';\n/** The key of the roles claims in the claims map either under tenant or top level */\nexport const rolesClaimName = 'roles';\n","import type { SdkFnWrapper } from '@descope/core-js-sdk';\nimport { authorizedTenantsClaimName, refreshTokenCookieName } from './constants';\nimport { AuthenticationInfo } from './types';\n\n/**\n * Generate a cookie string from given parameters\n * @param name name of the cookie\n * @param value value of cookie that must be already encoded\n * @param options any options to put on the cookie like cookieDomain, cookieMaxAge, cookiePath\n * @returns Cookie string with all options on the string\n */\nconst generateCookie = (name: string, value: string, options?: Record<string, string | number>) =>\n  `${name}=${value}; Domain=${options?.cookieDomain || ''}; Max-Age=${\n    options?.cookieMaxAge || ''\n  }; Path=${options?.cookiePath || '/'}; HttpOnly; SameSite=Strict`;\n\n/**\n * Parse the cookie string and return the value of the cookie\n * @param cookie the raw cookie string\n * @param name the name of the cookie to get value for\n * @returns the value of the given cookie\n */\nconst getCookieValue = (cookie: string | null | undefined, name: string) => {\n  const match = cookie?.match(RegExp(`(?:^|;\\\\s*)${name}=([^;]*)`));\n  return match ? match[1] : null;\n};\n\n// eslint-disable-next-line import/prefer-default-export\n/**\n * Add cookie generation to core-js functions.\n * @param fn the function we are wrapping\n * @returns Wrapped function with cookie generation\n */\nexport const withCookie: SdkFnWrapper<{ refreshJwt?: string; cookies?: string[] }> =\n  (fn) =>\n  async (...args) => {\n    const resp = await fn(...args);\n\n    // istanbul ignore next\n    if (!resp.data) {\n      return resp;\n    }\n\n    // eslint-disable-next-line prefer-const\n    let { refreshJwt, ...rest } = resp.data;\n    const cookies: string[] = [];\n\n    if (!refreshJwt) {\n      if (resp.response?.headers.get('set-cookie')) {\n        refreshJwt = getCookieValue(\n          resp.response?.headers.get('set-cookie'),\n          refreshTokenCookieName,\n        );\n        cookies.push(resp.response?.headers.get('set-cookie')!);\n      }\n    } else {\n      cookies.push(generateCookie(refreshTokenCookieName, refreshJwt, rest));\n    }\n\n    return { ...resp, data: { ...resp.data, refreshJwt, cookies } };\n  };\n\n/**\n * Get the claim (used for permissions or roles) for a given tenant or top level if tenant is empty\n * @param authInfo The parsed authentication info from the JWT\n * @param claim name of the claim\n * @param tenant tenant to retrieve the claim for\n * @returns\n */\nexport function getAuthorizationClaimItems(\n  authInfo: AuthenticationInfo,\n  claim: string,\n  tenant?: string,\n): string[] {\n  const value = tenant\n    ? authInfo.token[authorizedTenantsClaimName]?.[tenant]?.[claim]\n    : authInfo.token[claim];\n  return Array.isArray(value) ? value : [];\n}\n","/** API paths for the Descope service Management APIs */\nexport default {\n  user: {\n    create: '/v1/mgmt/user/create',\n    update: '/v1/mgmt/user/update',\n    delete: '/v1/mgmt/user/delete',\n    load: '/v1/mgmt/user',\n    search: '/v1/mgmt/user/search',\n    updateStatus: '/v1/mgmt/user/update/status',\n    updateEmail: '/v1/mgmt/user/update/email',\n    updatePhone: '/v1/mgmt/user/update/phone',\n    updateDisplayName: '/v1/mgmt/user/update/name',\n    addRole: '/v1/mgmt/user/update/role/add',\n    removeRole: '/v1/mgmt/user/update/role/remove',\n    addTenant: '/v1/mgmt/user/update/tenant/add',\n    removeTenant: '/v1/mgmt/user/update/tenant/remove',\n  },\n  accessKey: {\n    create: '/v1/mgmt/accesskey/create',\n    load: '/v1/mgmt/accesskey',\n    search: '/v1/mgmt/accesskey/search',\n    update: '/v1/mgmt/accesskey/update',\n    deactivate: '/v1/mgmt/accesskey/deactivate',\n    activate: '/v1/mgmt/accesskey/activate',\n    delete: '/v1/mgmt/accesskey/delete',\n  },\n  tenant: {\n    create: '/v1/mgmt/tenant/create',\n    update: '/v1/mgmt/tenant/update',\n    delete: '/v1/mgmt/tenant/delete',\n    loadAll: '/v1/mgmt/tenant/all',\n  },\n  sso: {\n    configure: '/v1/mgmt/sso/settings',\n    metadata: '/v1/mgmt/sso/metadata',\n    mapping: '/v1/mgmt/sso/mapping',\n  },\n  jwt: {\n    update: '/v1/mgmt/jwt/update',\n  },\n  permission: {\n    create: '/v1/mgmt/permission/create',\n    update: '/v1/mgmt/permission/update',\n    delete: '/v1/mgmt/permission/delete',\n    loadAll: '/v1/mgmt/permission/all',\n  },\n  role: {\n    create: '/v1/mgmt/role/create',\n    update: '/v1/mgmt/role/update',\n    delete: '/v1/mgmt/role/delete',\n    loadAll: '/v1/mgmt/role/all',\n  },\n  flow: {\n    export: '/v1/mgmt/flow/export',\n    import: '/v1/mgmt/flow/import',\n  },\n  theme: {\n    export: '/v1/mgmt/theme/export',\n    import: '/v1/mgmt/theme/import',\n  },\n  group: {\n    loadAllGroups: '/v1/mgmt/group/all',\n    loadAllGroupsForMember: '/v1/mgmt/group/member/all',\n    loadAllGroupMembers: '/v1/mgmt/group/members',\n  },\n};\n","import { SdkResponse, transformResponse, UserResponse } from '@descope/core-js-sdk';\nimport { CoreSdk } from '../types';\nimport apiPaths from './paths';\nimport { AssociatedTenant } from './types';\n\ntype SingleUserResponse = {\n  user: UserResponse;\n};\n\ntype MultipleUsersResponse = {\n  users: UserResponse[];\n};\n\nconst withUser = (sdk: CoreSdk, managementKey?: string) => ({\n  create: (\n    loginId: string,\n    email?: string,\n    phone?: string,\n    displayName?: string,\n    roles?: string[],\n    userTenants?: AssociatedTenant[],\n  ): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.create,\n        { loginId, email, phone, displayName, roleNames: roles, userTenants },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  invite: (\n    loginId: string,\n    email?: string,\n    phone?: string,\n    displayName?: string,\n    roles?: string[],\n    userTenants?: AssociatedTenant[],\n  ): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.create,\n        { loginId, email, phone, displayName, roleNames: roles, userTenants, invite: true },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  update: (\n    loginId: string,\n    email?: string,\n    phone?: string,\n    displayName?: string,\n    roles?: string[],\n    userTenants?: AssociatedTenant[],\n  ): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.update,\n        { loginId, email, phone, displayName, roleNames: roles, userTenants },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  delete: (loginId: string): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(apiPaths.user.delete, { loginId }, { token: managementKey }),\n    ),\n  load: (loginId: string): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.get(apiPaths.user.load, {\n        queryParams: { loginId },\n        token: managementKey,\n      }),\n      (data) => data.user,\n    ),\n  /**\n   * Load an existing user by user ID. The ID can be found\n   * on the user's JWT.\n   * @param userId load a user by this user ID field\n   * @returns The UserResponse if found, throws otherwise.\n   */\n  loadByUserId: (userId: string): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.get(apiPaths.user.load, {\n        queryParams: { userId },\n        token: managementKey,\n      }),\n      (data) => data.user,\n    ),\n  /**\n   * Search all users. Results can be filtered according to tenants and/or\n   * roles, and also paginated used the limit and page parameters.\n   * @param tenantIds optional list of tenant IDs to filter by\n   * @param roles optional list of roles to filter by\n   * @param limit optionally limit the response, leave out for default limit\n   * @param page optionally paginate over the response\n   * @returns An array of UserResponse found by the query\n   */\n  searchAll: (\n    tenantIds?: string[],\n    roles?: string[],\n    limit?: number,\n    page?: number,\n  ): Promise<SdkResponse<UserResponse[]>> =>\n    transformResponse<MultipleUsersResponse, UserResponse[]>(\n      sdk.httpClient.post(\n        apiPaths.user.search,\n        { tenantIds, roleNames: roles, limit, page },\n        { token: managementKey },\n      ),\n      (data) => data.users,\n    ),\n  activate: (loginId: string): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.updateStatus,\n        { loginId, status: 'enabled' },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  deactivate: (loginId: string): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.updateStatus,\n        { loginId, status: 'disabled' },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  updateEmail: (\n    loginId: string,\n    email: string,\n    isVerified: boolean,\n  ): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.updateEmail,\n        { loginId, email, verified: isVerified },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  updatePhone: (\n    loginId: string,\n    phone: string,\n    isVerified: boolean,\n  ): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.updatePhone,\n        { loginId, phone, verified: isVerified },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  updateDisplayName: (loginId: string, displayName: string): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.updateDisplayName,\n        { loginId, displayName },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  addRoles: (loginId: string, roles: string[]): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.addRole,\n        { loginId, roleNames: roles },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  removeRoles: (loginId: string, roles: string[]): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.removeRole,\n        { loginId, roleNames: roles },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  addTenant: (loginId: string, tenantId: string): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(apiPaths.user.addTenant, { loginId, tenantId }, { token: managementKey }),\n      (data) => data.user,\n    ),\n  removeTenant: (loginId: string, tenantId: string): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.removeTenant,\n        { loginId, tenantId },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  addTenantRoles: (\n    loginId: string,\n    tenantId: string,\n    roles: string[],\n  ): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.addRole,\n        { loginId, tenantId, roleNames: roles },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  removeTenantRoles: (\n    loginId: string,\n    tenantId: string,\n    roles: string[],\n  ): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.removeRole,\n        { loginId, tenantId, roleNames: roles },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n});\n\nexport default withUser;\n","import { SdkResponse, transformResponse } from '@descope/core-js-sdk';\nimport { CoreSdk } from '../types';\nimport apiPaths from './paths';\nimport { CreateTenantResponse, Tenant } from './types';\n\ntype MultipleTenantResponse = {\n  tenants: Tenant[];\n};\n\nconst withTenant = (sdk: CoreSdk, managementKey?: string) => ({\n  create: (\n    name: string,\n    selfProvisioningDomains?: string[],\n  ): Promise<SdkResponse<CreateTenantResponse>> =>\n    transformResponse(\n      sdk.httpClient.post(\n        apiPaths.tenant.create,\n        { name, selfProvisioningDomains },\n        { token: managementKey },\n      ),\n    ),\n  createWithId: (\n    id: string,\n    name: string,\n    selfProvisioningDomains?: string[],\n  ): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(\n        apiPaths.tenant.create,\n        { id, name, selfProvisioningDomains },\n        { token: managementKey },\n      ),\n    ),\n  update: (\n    id: string,\n    name: string,\n    selfProvisioningDomains?: string[],\n  ): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(\n        apiPaths.tenant.update,\n        { id, name, selfProvisioningDomains },\n        { token: managementKey },\n      ),\n    ),\n  delete: (id: string): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(apiPaths.tenant.delete, { id }, { token: managementKey }),\n    ),\n  loadAll: (): Promise<SdkResponse<Tenant[]>> =>\n    transformResponse<MultipleTenantResponse, Tenant[]>(\n      sdk.httpClient.get(apiPaths.tenant.loadAll, {\n        token: managementKey,\n      }),\n      (data) => data.tenants,\n    ),\n});\n\nexport default withTenant;\n","import { SdkResponse, transformResponse } from '@descope/core-js-sdk';\nimport { CoreSdk } from '../types';\nimport apiPaths from './paths';\nimport { UpdateJWTResponse } from './types';\n\nconst withJWT = (sdk: CoreSdk, managementKey?: string) => ({\n  update: (\n    jwt: string,\n    customClaims?: Record<string, any>,\n  ): Promise<SdkResponse<UpdateJWTResponse>> =>\n    transformResponse(\n      sdk.httpClient.post(apiPaths.jwt.update, { jwt, customClaims }, { token: managementKey }),\n    ),\n});\n\nexport default withJWT;\n","import { SdkResponse, transformResponse } from '@descope/core-js-sdk';\nimport { CoreSdk } from '../types';\nimport apiPaths from './paths';\nimport { Permission } from './types';\n\ntype MultiplePermissionResponse = {\n  permissions: Permission[];\n};\n\nconst withPermission = (sdk: CoreSdk, managementKey?: string) => ({\n  create: (name: string, description?: string): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(\n        apiPaths.permission.create,\n        { name, description },\n        { token: managementKey },\n      ),\n    ),\n  update: (name: string, newName: string, description?: string): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(\n        apiPaths.permission.update,\n        { name, newName, description },\n        { token: managementKey },\n      ),\n    ),\n  delete: (name: string): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(apiPaths.permission.delete, { name }, { token: managementKey }),\n    ),\n  loadAll: (): Promise<SdkResponse<Permission[]>> =>\n    transformResponse<MultiplePermissionResponse, Permission[]>(\n      sdk.httpClient.get(apiPaths.permission.loadAll, {\n        token: managementKey,\n      }),\n      (data) => data.permissions,\n    ),\n});\n\nexport default withPermission;\n","import { SdkResponse, transformResponse } from '@descope/core-js-sdk';\nimport { CoreSdk } from '../types';\nimport apiPaths from './paths';\nimport { Role } from './types';\n\ntype MultipleRoleResponse = {\n  roles: Role[];\n};\n\nconst withRole = (sdk: CoreSdk, managementKey?: string) => ({\n  create: (\n    name: string,\n    description?: string,\n    permissionNames?: string[],\n  ): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(\n        apiPaths.role.create,\n        { name, description, permissionNames },\n        { token: managementKey },\n      ),\n    ),\n  update: (\n    name: string,\n    newName: string,\n    description?: string,\n    permissionNames?: string[],\n  ): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(\n        apiPaths.role.update,\n        { name, newName, description, permissionNames },\n        { token: managementKey },\n      ),\n    ),\n  delete: (name: string): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(apiPaths.role.delete, { name }, { token: managementKey }),\n    ),\n  loadAll: (): Promise<SdkResponse<Role[]>> =>\n    transformResponse<MultipleRoleResponse, Role[]>(\n      sdk.httpClient.get(apiPaths.role.loadAll, {\n        token: managementKey,\n      }),\n      (data) => data.roles,\n    ),\n});\n\nexport default withRole;\n","import { SdkResponse, transformResponse } from '@descope/core-js-sdk';\nimport { CoreSdk } from '../types';\nimport apiPaths from './paths';\nimport { Group } from './types';\n\nconst withGroup = (sdk: CoreSdk, managementKey?: string) => ({\n  /**\n   * Load all groups for a specific tenant id.\n   * @param tenantId Tenant ID to load groups from.\n   * @returns Group[] list of groups\n   */\n  loadAllGroups: (tenantId: string): Promise<SdkResponse<Group[]>> =>\n    transformResponse<Group[]>(\n      sdk.httpClient.post(apiPaths.group.loadAllGroups, { tenantId }, { token: managementKey }),\n    ),\n\n  /**\n   * Load all groups for the provided user IDs or login IDs.\n   * @param tenantId Tenant ID to load groups from.\n   * @param userIds Optional List of user IDs, with the format of \"U2J5ES9S8TkvCgOvcrkpzUgVTEBM\" (example), which can be found on the user's JWT.\n   * @param loginIds Optional List of login IDs, how the user identifies when logging in.\n   * @returns Group[] list of groups\n   */\n  loadAllGroupsForMember: (\n    tenantId: string,\n    userIds: string[],\n    loginIds: string[],\n  ): Promise<SdkResponse<Group[]>> =>\n    transformResponse<Group[]>(\n      sdk.httpClient.post(\n        apiPaths.group.loadAllGroupsForMember,\n        { tenantId, loginIds, userIds },\n        { token: managementKey },\n      ),\n    ),\n\n  /**\n   * Load all members of the provided group id.\n   * @param tenantId Tenant ID to load groups from.\n   * @param groupId Group ID to load members for.\n   * @returns Group[] list of groups\n   */\n  loadAllGroupMembers: (tenantId: string, groupId: string): Promise<SdkResponse<Group[]>> =>\n    transformResponse<Group[]>(\n      sdk.httpClient.post(\n        apiPaths.group.loadAllGroupMembers,\n        { tenantId, groupId },\n        { token: managementKey },\n      ),\n    ),\n});\n\nexport default withGroup;\n","import { SdkResponse, transformResponse } from '@descope/core-js-sdk';\nimport { CoreSdk } from '../types';\nimport apiPaths from './paths';\nimport { RoleMapping, AttributeMapping } from './types';\n\nconst withSSOSettings = (sdk: CoreSdk, managementKey?: string) => ({\n  configureSettings: (\n    tenantId: string,\n    idpURL: string,\n    idpCert: string,\n    entityId: string,\n    redirectURL?: string,\n    domain?: string,\n  ): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(\n        apiPaths.sso.configure,\n        { tenantId, idpURL, entityId, idpCert, redirectURL, domain },\n        { token: managementKey },\n      ),\n    ),\n  configureMetadata: (tenantId: string, idpMetadataURL: string): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(\n        apiPaths.sso.metadata,\n        { tenantId, idpMetadataURL },\n        { token: managementKey },\n      ),\n    ),\n  configureMapping: (\n    tenantId: string,\n    roleMapping?: RoleMapping,\n    attributeMapping?: AttributeMapping,\n  ): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(\n        apiPaths.sso.mapping,\n        { tenantId, roleMapping, attributeMapping },\n        { token: managementKey },\n      ),\n    ),\n});\n\nexport default withSSOSettings;\n","import { SdkResponse, transformResponse } from '@descope/core-js-sdk';\nimport { CoreSdk } from '../types';\nimport apiPaths from './paths';\nimport { AccessKey, AssociatedTenant, CreatedAccessKeyResponse } from './types';\n\ntype SingleKeyResponse = {\n  key: AccessKey;\n};\n\ntype MultipleKeysResponse = {\n  keys: AccessKey[];\n};\n\nconst withAccessKey = (sdk: CoreSdk, managementKey?: string) => ({\n  /**\n   * Create a new access key for a project.\n   * @param name Access key name\n   * @param expireTime When the access key expires. Keep at 0 to make it indefinite.\n   * @param roles Optional roles in the project. Does not apply for multi-tenants\n   * @param keyTenants Optional associated tenants for this key and its roles for each.\n   * @returns A newly created key and its cleartext. Make sure to save the cleartext securely.\n   */\n  create: (\n    name: string,\n    expireTime: number,\n    roles?: string[],\n    keyTenants?: AssociatedTenant[],\n  ): Promise<SdkResponse<CreatedAccessKeyResponse>> =>\n    transformResponse(\n      sdk.httpClient.post(\n        apiPaths.accessKey.create,\n        { name, expireTime, roleNames: roles, keyTenants },\n        { token: managementKey },\n      ),\n    ),\n  /**\n   * Load an access key.\n   * @param id Access key ID to load\n   * @returns The loaded access key.\n   */\n  load: (id: string): Promise<SdkResponse<AccessKey>> =>\n    transformResponse<SingleKeyResponse, AccessKey>(\n      sdk.httpClient.get(apiPaths.accessKey.load, {\n        queryParams: { id },\n        token: managementKey,\n      }),\n      (data) => data.key,\n    ),\n  /**\n   * Search all access keys\n   * @param tenantIds Optional tenant ID filter to apply on the search results\n   * @returns An array of found access keys\n   */\n  searchAll: (tenantIds?: string[]): Promise<SdkResponse<AccessKey[]>> =>\n    transformResponse<MultipleKeysResponse, AccessKey[]>(\n      sdk.httpClient.post(apiPaths.accessKey.search, { tenantIds }, { token: managementKey }),\n      (data) => data.keys,\n    ),\n  /**\n   * Update an access key.\n   * @param id Access key ID to load\n   * @param name The updated access key name\n   * @returns The updated access key\n   */\n  update: (id: string, name: string): Promise<SdkResponse<AccessKey>> =>\n    transformResponse<SingleKeyResponse, AccessKey>(\n      sdk.httpClient.post(apiPaths.accessKey.update, { id, name }, { token: managementKey }),\n      (data) => data.key,\n    ),\n  /**\n   * Deactivate an access key. Deactivated access keys cannot be used until they are\n   * activated again.\n   * @param id Access key ID to deactivate\n   */\n  deactivate: (id: string): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(apiPaths.accessKey.deactivate, { id }, { token: managementKey }),\n    ),\n  /**\n   * Activate an access key. Only deactivated access keys can be activated again.\n   * @param id Access key ID to activate\n   */\n  activate: (id: string): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(apiPaths.accessKey.activate, { id }, { token: managementKey }),\n    ),\n  /**\n   * Delete an access key. IMPORTANT: This cannot be undone. Use carefully.\n   * @param id Access key ID to delete\n   */\n  delete: (id: string): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(apiPaths.accessKey.delete, { id }, { token: managementKey }),\n    ),\n});\n\nexport default withAccessKey;\n","import { SdkResponse, transformResponse } from '@descope/core-js-sdk';\nimport { CoreSdk } from '../types';\nimport apiPaths from './paths';\nimport { FlowResponse, Screen, Flow } from './types';\n\nconst WithFlow = (sdk: CoreSdk, managementKey?: string) => ({\n  export: (flowId: string): Promise<SdkResponse<FlowResponse>> =>\n    transformResponse(\n      sdk.httpClient.post(apiPaths.flow.export, { flowId }, { token: managementKey }),\n    ),\n  import: (flowId: string, flow: Flow, screens?: Screen[]): Promise<SdkResponse<FlowResponse>> =>\n    transformResponse(\n      sdk.httpClient.post(\n        apiPaths.flow.import,\n        { flowId, flow, screens },\n        { token: managementKey },\n      ),\n    ),\n});\n\nexport default WithFlow;\n","import { SdkResponse, transformResponse } from '@descope/core-js-sdk';\nimport { CoreSdk } from '../types';\nimport apiPaths from './paths';\nimport { Theme, ThemeResponse } from './types';\n\nconst WithTheme = (sdk: CoreSdk, managementKey?: string) => ({\n  export: (): Promise<SdkResponse<ThemeResponse>> =>\n    transformResponse(sdk.httpClient.post(apiPaths.theme.export, {}, { token: managementKey })),\n  import: (theme: Theme): Promise<SdkResponse<ThemeResponse>> =>\n    transformResponse(\n      sdk.httpClient.post(apiPaths.theme.import, { theme }, { token: managementKey }),\n    ),\n});\n\nexport default WithTheme;\n","import nodeFetch, { Headers } from 'node-fetch-commonjs';\n\nglobalThis.Headers ??= Headers;\n\nconst highWaterMarkMb = 1024 * 1024 * 1024 * 30; // 30MB\n\n// we are increasing the response buffer size due to an issue where node-fetch hangs when response is too big\nconst patchedFetch = (...args: Parameters<typeof nodeFetch>) => {\n  // we can get Request on the first arg, or RequestInfo on the second arg\n  // we want to make sure we are setting the \"highWaterMark\" so we are doing it on both args\n  args.forEach((arg) => {\n    // eslint-disable-next-line no-param-reassign, @typescript-eslint/no-unused-expressions\n    arg && ((arg as any).highWaterMark ??= highWaterMarkMb);\n  });\n\n  return nodeFetch(...args);\n};\n\nexport default patchedFetch as unknown as typeof fetch;\n","import createSdk, { ExchangeAccessKeyResponse, SdkResponse, wrapWith } from '@descope/core-js-sdk';\nimport { JWK, JWTHeaderParameters, KeyLike, errors, importJWK, jwtVerify } from 'jose';\nimport {\n  permissionsClaimName,\n  refreshTokenCookieName,\n  rolesClaimName,\n  sessionTokenCookieName,\n} from './constants';\nimport { getAuthorizationClaimItems, withCookie } from './helpers';\nimport withManagement from './management';\nimport { AuthenticationInfo } from './types';\nimport fetch from './fetch-polyfill';\n\ndeclare const BUILD_VERSION: string;\n\n/** Configuration arguments which include the Descope core SDK args and an optional management key */\ntype NodeSdkArgs = Parameters<typeof createSdk>[0] & {\n  managementKey?: string;\n};\n\nconst nodeSdk = ({ managementKey, ...config }: NodeSdkArgs) => {\n  const coreSdk = createSdk({\n    ...config,\n    fetch,\n    baseHeaders: {\n      ...config.baseHeaders,\n      'x-descope-sdk-name': 'nodejs',\n      'x-descope-sdk-node-version': process?.versions?.node || '',\n      'x-descope-sdk-version': BUILD_VERSION,\n    },\n  });\n\n  const { projectId, logger } = config;\n\n  const keys: Record<string, KeyLike | Uint8Array> = {};\n\n  /** Fetch the public keys (JWKs) from Descope for the configured project */\n  const fetchKeys = async () => {\n    const keysWrapper = await coreSdk.httpClient\n      .get(`v2/keys/${projectId}`)\n      .then((resp) => resp.json());\n    const publicKeys: JWK[] = keysWrapper.keys;\n    if (!Array.isArray(publicKeys)) return {};\n    const kidJwksPairs = await Promise.all(\n      publicKeys.map(async (key) => [key.kid, await importJWK(key)]),\n    );\n\n    return kidJwksPairs.reduce(\n      (acc, [kid, jwk]) => (kid ? { ...acc, [kid.toString()]: jwk } : acc),\n      {},\n    );\n  };\n\n  const management = withManagement(coreSdk, managementKey);\n\n  const sdk = {\n    ...coreSdk,\n\n    /**\n     * Provides various APIs for managing a Descope project programmatically. A management key must\n     * be provided as an argument when initializing the SDK to use these APIs. Management keys can be\n     * generated in the Descope console.\n     */\n    management,\n\n    /** Get the key that can validate the given JWT KID in the header. Can retrieve the public key from local cache or from Descope. */\n    async getKey(header: JWTHeaderParameters): Promise<KeyLike | Uint8Array> {\n      if (!header?.kid) throw Error('header.kid must not be empty');\n\n      if (keys[header.kid]) return keys[header.kid];\n\n      // do we need to fetch once or every time?\n      Object.assign(keys, await fetchKeys());\n\n      if (!keys[header.kid]) throw Error('failed to fetch matching key');\n\n      return keys[header.kid];\n    },\n\n    /**\n     * Validate the given JWT with the right key and make sure the issuer is correct\n     * @param jwt the JWT string to parse and validate\n     * @returns AuthenticationInfo with the parsed token and JWT. Will throw an error if validation fails.\n     */\n    async validateJwt(jwt: string): Promise<AuthenticationInfo> {\n      // Do not hard-code the algo because library does not support `None` so all are valid\n      const res = await jwtVerify(jwt, sdk.getKey, { clockTolerance: 5 });\n      const token = res.payload;\n\n      if (token) {\n        token.iss = token.iss?.split('/').pop(); // support both url and project id as issuer\n        if (token.iss !== projectId) {\n          // We must do the verification here, since issuer can be either project ID or URL\n          throw new errors.JWTClaimValidationFailed(\n            'unexpected \"iss\" claim value',\n            'iss',\n            'check_failed',\n          );\n        }\n      }\n\n      return { jwt, token };\n    },\n\n    /**\n     * Validate an active session\n     * @param sessionToken session JWT to validate\n     * @returns AuthenticationInfo promise or throws Error if there is an issue with JWTs\n     */\n    async validateSession(sessionToken: string): Promise<AuthenticationInfo> {\n      if (!sessionToken) throw Error('session token is required for validation');\n\n      try {\n        const token = await sdk.validateJwt(sessionToken);\n        return token;\n      } catch (error) {\n        /* istanbul ignore next */\n        logger?.error('session validation failed', error);\n        throw Error('session validation failed');\n      }\n    },\n\n    /**\n     * Refresh the session using a refresh token\n     * @param refreshToken refresh JWT to refresh the session with\n     * @returns AuthenticationInfo promise or throws Error if there is an issue with JWTs\n     */\n    async refreshSession(refreshToken: string): Promise<AuthenticationInfo> {\n      if (!refreshToken) throw Error('refresh token is required to refresh a session');\n\n      try {\n        await sdk.validateJwt(refreshToken);\n        const jwtResp = await sdk.refresh(refreshToken);\n        if (jwtResp.ok) {\n          const token = await sdk.validateJwt(jwtResp.data?.sessionJwt);\n          return token;\n        }\n        /* istanbul ignore next */\n        throw Error(jwtResp.error?.errorMessage);\n      } catch (refreshTokenErr) {\n        /* istanbul ignore next */\n        logger?.error('refresh token validation failed', refreshTokenErr);\n        throw Error('refresh token validation failed');\n      }\n    },\n\n    /**\n     * Validate session and refresh it if it expired\n     * @param sessionToken session JWT\n     * @param refreshToken refresh JWT\n     * @returns AuthenticationInfo promise or throws Error if there is an issue with JWTs\n     */\n    async validateAndRefreshSession(\n      sessionToken?: string,\n      refreshToken?: string,\n    ): Promise<AuthenticationInfo> {\n      if (!sessionToken && !refreshToken) throw Error('both session and refresh tokens are empty');\n\n      try {\n        const token = await sdk.validateSession(sessionToken);\n        return token;\n      } catch (error) {\n        /* istanbul ignore next */\n        logger?.log('session validation failed - trying to refresh it');\n      }\n\n      return sdk.refreshSession(refreshToken);\n    },\n\n    /**\n     * Exchange API key (access key) for a session key\n     * @param accessKey access key to exchange for a session JWT\n     * @returns AuthneticationInfo with session JWT data\n     */\n    async exchangeAccessKey(accessKey: string): Promise<AuthenticationInfo> {\n      if (!accessKey) throw Error('access key must not be empty');\n\n      let resp: SdkResponse<ExchangeAccessKeyResponse>;\n      try {\n        resp = await sdk.accessKey.exchange(accessKey);\n      } catch (error) {\n        logger?.error('failed to exchange access key', error);\n        throw Error('could not exchange access key');\n      }\n\n      const { sessionJwt } = resp.data;\n      if (!sessionJwt) {\n        logger?.error('failed to parse exchange access key response');\n        throw Error('could not exchange access key');\n      }\n\n      try {\n        const token = await sdk.validateJwt(sessionJwt);\n        return token;\n      } catch (error) {\n        logger?.error('failed to parse jwt from access key', error);\n        throw Error('could not exchange access key');\n      }\n    },\n\n    /**\n     * Make sure that all given permissions exist on the parsed JWT top level claims\n     * @param authInfo JWT parsed info\n     * @param permissions list of permissions to make sure they exist on te JWT claims\n     * @returns true if all permissions exist, false otherwise\n     */\n    validatePermissions(authInfo: AuthenticationInfo, permissions: string[]): boolean {\n      return sdk.validateTenantPermissions(authInfo, null, permissions);\n    },\n\n    /**\n     * Make sure that all given permissions exist on the parsed JWT tenant claims\n     * @param authInfo JWT parsed info\n     * @param permissions list of permissions to make sure they exist on te JWT claims\n     * @returns true if all permissions exist, false otherwise\n     */\n    validateTenantPermissions(\n      authInfo: AuthenticationInfo,\n      tenant: string,\n      permissions: string[],\n    ): boolean {\n      const granted = getAuthorizationClaimItems(authInfo, permissionsClaimName, tenant);\n      return permissions.every((perm) => granted.includes(perm));\n    },\n\n    /**\n     * Make sure that all given roles exist on the parsed JWT top level claims\n     * @param authInfo JWT parsed info\n     * @param roles list of roles to make sure they exist on te JWT claims\n     * @returns true if all roles exist, false otherwise\n     */\n    validateRoles(authInfo: AuthenticationInfo, roles: string[]): boolean {\n      return sdk.validateTenantRoles(authInfo, null, roles);\n    },\n\n    /**\n     * Make sure that all given roles exist on the parsed JWT tenant claims\n     * @param authInfo JWT parsed info\n     * @param roles list of roles to make sure they exist on te JWT claims\n     * @returns true if all roles exist, false otherwise\n     */\n    validateTenantRoles(authInfo: AuthenticationInfo, tenant: string, roles: string[]): boolean {\n      const membership = getAuthorizationClaimItems(authInfo, rolesClaimName, tenant);\n      return roles.every((role) => membership.includes(role));\n    },\n  };\n\n  return wrapWith(\n    sdk,\n    [\n      'otp.verify.email',\n      'otp.verify.sms',\n      'otp.verify.whatsapp',\n      'magicLink.verify',\n      'enchantedLink.signUp',\n      'enchantedLink.signIn',\n      'oauth.exchange',\n      'saml.exchange',\n      'totp.verify',\n      'webauthn.signIn.finish',\n      'webauthn.signUp.finish',\n      'refresh',\n    ] as const,\n    withCookie,\n  );\n};\n\n/** Descope SDK client with delivery methods enum.\n *\n * Please see full documentation at {@link https://docs.descope.com/guides Descope Docs}\n * @example Usage\n *\n * ```js\n * import descopeSdk from '@descope/node-sdk';\n *\n * const myProjectId = 'xxx';\n * const sdk = descopeSdk({ projectId: myProjectId });\n *\n * const userLoginId = 'loginId';\n * sdk.otp.signIn.email(userLoginId);\n * const jwtResponse = sdk.otp.verify.email(userLoginId, codeFromEmail);\n * ```\n */\n\nnodeSdk.RefreshTokenCookieName = refreshTokenCookieName;\nnodeSdk.SessionTokenCookieName = sessionTokenCookieName;\n\nexport default nodeSdk;\nexport type {\n  DeliveryMethod,\n  OAuthProvider,\n  ResponseData,\n  SdkResponse,\n} from '@descope/core-js-sdk';\n","import { CoreSdk } from '../types';\nimport withUser from './user';\nimport withTenant from './tenant';\nimport withJWT from './jwt';\nimport withPermission from './permission';\nimport withRole from './role';\nimport withGroup from './group';\nimport withSSOSettings from './sso';\nimport withAccessKey from './accesskey';\nimport WithFlow from './flow';\nimport WithTheme from './theme';\n\n/** Constructs a higher level Management API that wraps the functions from code-js-sdk */\nconst withManagement = (sdk: CoreSdk, managementKey?: string) => ({\n  user: withUser(sdk, managementKey),\n  accessKey: withAccessKey(sdk, managementKey),\n  tenant: withTenant(sdk, managementKey),\n  sso: withSSOSettings(sdk, managementKey),\n  jwt: withJWT(sdk, managementKey),\n  permission: withPermission(sdk, managementKey),\n  role: withRole(sdk, managementKey),\n  group: withGroup(sdk, managementKey),\n  flow: WithFlow(sdk, managementKey),\n  theme: WithTheme(sdk, managementKey),\n});\n\nexport default withManagement;\n"],"names":["withCookie","fn","async","args","resp","data","_d","refreshJwt","rest","__rest","cookies","options","push","cookieDomain","cookieMaxAge","cookiePath","_a","response","headers","get","cookie","name","match","RegExp","getCookieValue","_b","_c","Object","assign","getAuthorizationClaimItems","authInfo","claim","tenant","value","token","Array","isArray","apiPaths","create","update","delete","load","search","updateStatus","updateEmail","updatePhone","updateDisplayName","addRole","removeRole","addTenant","removeTenant","deactivate","activate","loadAll","configure","metadata","mapping","export","import","loadAllGroups","loadAllGroupsForMember","loadAllGroupMembers","withUser","sdk","managementKey","loginId","email","phone","displayName","roles","userTenants","transformResponse","httpClient","post","roleNames","user","invite","queryParams","loadByUserId","userId","searchAll","tenantIds","limit","page","users","status","isVerified","verified","addRoles","removeRoles","tenantId","addTenantRoles","removeTenantRoles","withTenant","selfProvisioningDomains","createWithId","id","tenants","withJWT","jwt","customClaims","withPermission","description","newName","permissions","withRole","permissionNames","withGroup","userIds","loginIds","groupId","withSSOSettings","configureSettings","idpURL","idpCert","entityId","redirectURL","domain","configureMetadata","idpMetadataURL","configureMapping","roleMapping","attributeMapping","withAccessKey","expireTime","keyTenants","key","keys","WithFlow","flowId","flow","screens","WithTheme","theme","globalThis","Headers","patchedFetch","forEach","arg","highWaterMark","nodeFetch","nodeSdk","config","coreSdk","createSdk","fetch","baseHeaders","process","versions","node","projectId","logger","management","accessKey","sso","permission","role","group","withManagement","header","kid","Error","publicKeys","then","json","Promise","all","map","importJWK","reduce","acc","jwk","toString","fetchKeys","jwtVerify","getKey","clockTolerance","payload","iss","split","pop","errors","JWTClaimValidationFailed","sessionToken","validateJwt","error","refreshToken","jwtResp","refresh","ok","sessionJwt","errorMessage","refreshTokenErr","validateSession","log","refreshSession","exchange","validatePermissions","validateTenantPermissions","granted","every","perm","includes","validateRoles","validateTenantRoles","membership","wrapWith","RefreshTokenCookieName","SessionTokenCookieName"],"mappings":"mNAEO,MC+BMA,EACVC,GACDC,SAAUC,eACR,MAAMC,QAAaH,KAAME,GAGzB,IAAKC,EAAKC,KACR,OAAOD,EAIT,IAAIE,EAA0BF,EAAKC,MAA/BE,WAAEA,GAAUD,EAAKE,EAAjBC,EAAAA,OAAAH,EAAA,CAAA,eACJ,MAAMI,EAAoB,GAlCP,IAA8BC,EAgDjD,OAZKJ,EASHG,EAAQE,KA5CZ,GDVoC,SCsDoBL,cA5C5BI,OADuBA,EA6CiBH,QA5CxC,EAAAG,EAASE,eAAgB,gBACnDF,aAAA,EAAAA,EAASG,eAAgB,aACjBH,aAAA,EAAAA,EAASI,aAAc,mCAkCZ,QAAbC,EAAAZ,EAAKa,gBAAQ,IAAAD,OAAA,EAAAA,EAAEE,QAAQC,IAAI,iBAC7BZ,EA3Be,EAACa,EAAmCC,KACzD,MAAMC,EAAQF,eAAAA,EAAQE,MAAMC,OAAO,cAAcF,cACjD,OAAOC,EAAQA,EAAM,GAAK,IAAI,EAyBXE,CACE,QAAbC,EAAArB,EAAKa,gBAAQ,IAAAQ,OAAA,EAAAA,EAAEP,QAAQC,IAAI,cDhDC,OCmD9BT,EAAQE,KAAoB,QAAfc,EAAAtB,EAAKa,gBAAU,IAAAS,OAAA,EAAAA,EAAAR,QAAQC,IAAI,gBAMhCQ,OAAAC,OAAAD,OAAAC,OAAA,CAAA,EAAAxB,GAAM,CAAAC,KAAWsB,OAAAC,OAAAD,OAAAC,OAAA,GAAAxB,EAAKC,MAAM,CAAAE,aAAYG,aAAY,WAUpDmB,EACdC,EACAC,EACAC,WAEA,MAAMC,EAAQD,EAC0C,QAApDP,EAA6C,QAA7CT,EAAAc,EAASI,MAAgC,eAAI,IAAAlB,OAAA,EAAAA,EAAAgB,UAAO,IAAAP,OAAA,EAAAA,EAAGM,GACvDD,EAASI,MAAMH,GACnB,OAAOI,MAAMC,QAAQH,GAASA,EAAQ,EACxC,CC7EA,IAAeI,EACP,CACJC,OAAQ,uBACRC,OAAQ,uBACRC,OAAQ,uBACRC,KAAM,gBACNC,OAAQ,uBACRC,aAAc,8BACdC,YAAa,6BACbC,YAAa,6BACbC,kBAAmB,4BACnBC,QAAS,gCACTC,WAAY,mCACZC,UAAW,kCACXC,aAAc,sCAdHb,EAgBF,CACTC,OAAQ,4BACRG,KAAM,qBACNC,OAAQ,4BACRH,OAAQ,4BACRY,WAAY,gCACZC,SAAU,8BACVZ,OAAQ,6BAvBGH,EAyBL,CACNC,OAAQ,yBACRC,OAAQ,yBACRC,OAAQ,yBACRa,QAAS,uBA7BEhB,EA+BR,CACHiB,UAAW,wBACXC,SAAU,wBACVC,QAAS,wBAlCEnB,EAoCR,CACHE,OAAQ,uBArCGF,EAuCD,CACVC,OAAQ,6BACRC,OAAQ,6BACRC,OAAQ,6BACRa,QAAS,2BA3CEhB,EA6CP,CACJC,OAAQ,uBACRC,OAAQ,uBACRC,OAAQ,uBACRa,QAAS,qBAjDEhB,EAmDP,CACJoB,OAAQ,uBACRC,OAAQ,wBArDGrB,EAuDN,CACLoB,OAAQ,wBACRC,OAAQ,yBAzDGrB,EA2DN,CACLsB,cAAe,qBACfC,uBAAwB,4BACxBC,oBAAqB,0BClDzB,MAAMC,EAAW,CAACC,EAAcC,KAA4B,CAC1D1B,OAAQ,CACN2B,EACAC,EACAC,EACAC,EACAC,EACAC,IAEAC,EAAiBA,kBACfR,EAAIS,WAAWC,KACbpC,EAAcC,OACd,CAAE2B,UAASC,QAAOC,QAAOC,cAAaM,UAAWL,EAAOC,eACxD,CAAEpC,MAAO8B,KAEV3D,GAASA,EAAKsE,OAEnBC,OAAQ,CACNX,EACAC,EACAC,EACAC,EACAC,EACAC,IAEAC,EAAAA,kBACER,EAAIS,WAAWC,KACbpC,EAAcC,OACd,CAAE2B,UAASC,QAAOC,QAAOC,cAAaM,UAAWL,EAAOC,cAAaM,QAAQ,GAC7E,CAAE1C,MAAO8B,KAEV3D,GAASA,EAAKsE,OAEnBpC,OAAQ,CACN0B,EACAC,EACAC,EACAC,EACAC,EACAC,IAEAC,EAAiBA,kBACfR,EAAIS,WAAWC,KACbpC,EAAcE,OACd,CAAE0B,UAASC,QAAOC,QAAOC,cAAaM,UAAWL,EAAOC,eACxD,CAAEpC,MAAO8B,KAEV3D,GAASA,EAAKsE,OAEnBnC,OAASyB,GACPM,EAAAA,kBACER,EAAIS,WAAWC,KAAKpC,EAAcG,OAAQ,CAAEyB,WAAW,CAAE/B,MAAO8B,KAEpEvB,KAAOwB,GACLM,EAAAA,kBACER,EAAIS,WAAWrD,IAAIkB,EAAcI,KAAM,CACrCoC,YAAa,CAAEZ,WACf/B,MAAO8B,KAER3D,GAASA,EAAKsE,OAQnBG,aAAeC,GACbR,EAAAA,kBACER,EAAIS,WAAWrD,IAAIkB,EAAcI,KAAM,CACrCoC,YAAa,CAAEE,UACf7C,MAAO8B,KAER3D,GAASA,EAAKsE,OAWnBK,UAAW,CACTC,EACAZ,EACAa,EACAC,IAEAZ,oBACER,EAAIS,WAAWC,KACbpC,EAAcK,OACd,CAAEuC,YAAWP,UAAWL,EAAOa,QAAOC,QACtC,CAAEjD,MAAO8B,KAEV3D,GAASA,EAAK+E,QAEnBhC,SAAWa,GACTM,EAAAA,kBACER,EAAIS,WAAWC,KACbpC,EAAcM,aACd,CAAEsB,UAASoB,OAAQ,WACnB,CAAEnD,MAAO8B,KAEV3D,GAASA,EAAKsE,OAEnBxB,WAAac,GACXM,EAAAA,kBACER,EAAIS,WAAWC,KACbpC,EAAcM,aACd,CAAEsB,UAASoB,OAAQ,YACnB,CAAEnD,MAAO8B,KAEV3D,GAASA,EAAKsE,OAEnB/B,YAAa,CACXqB,EACAC,EACAoB,IAEAf,EAAAA,kBACER,EAAIS,WAAWC,KACbpC,EAAcO,YACd,CAAEqB,UAASC,QAAOqB,SAAUD,GAC5B,CAAEpD,MAAO8B,KAEV3D,GAASA,EAAKsE,OAEnB9B,YAAa,CACXoB,EACAE,EACAmB,IAEAf,EAAAA,kBACER,EAAIS,WAAWC,KACbpC,EAAcQ,YACd,CAAEoB,UAASE,QAAOoB,SAAUD,GAC5B,CAAEpD,MAAO8B,KAEV3D,GAASA,EAAKsE,OAEnB7B,kBAAmB,CAACmB,EAAiBG,IACnCG,EAAiBA,kBACfR,EAAIS,WAAWC,KACbpC,EAAcS,kBACd,CAAEmB,UAASG,eACX,CAAElC,MAAO8B,KAEV3D,GAASA,EAAKsE,OAEnBa,SAAU,CAACvB,EAAiBI,IAC1BE,EAAiBA,kBACfR,EAAIS,WAAWC,KACbpC,EAAcU,QACd,CAAEkB,UAASS,UAAWL,GACtB,CAAEnC,MAAO8B,KAEV3D,GAASA,EAAKsE,OAEnBc,YAAa,CAACxB,EAAiBI,IAC7BE,EAAiBA,kBACfR,EAAIS,WAAWC,KACbpC,EAAcW,WACd,CAAEiB,UAASS,UAAWL,GACtB,CAAEnC,MAAO8B,KAEV3D,GAASA,EAAKsE,OAEnB1B,UAAW,CAACgB,EAAiByB,IAC3BnB,EAAiBA,kBACfR,EAAIS,WAAWC,KAAKpC,EAAcY,UAAW,CAAEgB,UAASyB,YAAY,CAAExD,MAAO8B,KAC5E3D,GAASA,EAAKsE,OAEnBzB,aAAc,CAACe,EAAiByB,IAC9BnB,EAAiBA,kBACfR,EAAIS,WAAWC,KACbpC,EAAca,aACd,CAAEe,UAASyB,YACX,CAAExD,MAAO8B,KAEV3D,GAASA,EAAKsE,OAEnBgB,eAAgB,CACd1B,EACAyB,EACArB,IAEAE,EAAAA,kBACER,EAAIS,WAAWC,KACbpC,EAAcU,QACd,CAAEkB,UAASyB,WAAUhB,UAAWL,GAChC,CAAEnC,MAAO8B,KAEV3D,GAASA,EAAKsE,OAEnBiB,kBAAmB,CACjB3B,EACAyB,EACArB,IAEAE,EAAAA,kBACER,EAAIS,WAAWC,KACbpC,EAAcW,WACd,CAAEiB,UAASyB,WAAUhB,UAAWL,GAChC,CAAEnC,MAAO8B,KAEV3D,GAASA,EAAKsE,SCnNfkB,EAAa,CAAC9B,EAAcC,KAA4B,CAC5D1B,OAAQ,CACNjB,EACAyE,IAEAvB,EAAiBA,kBACfR,EAAIS,WAAWC,KACbpC,EAAgBC,OAChB,CAAEjB,OAAMyE,2BACR,CAAE5D,MAAO8B,KAGf+B,aAAc,CACZC,EACA3E,EACAyE,IAEAvB,EAAAA,kBACER,EAAIS,WAAWC,KACbpC,EAAgBC,OAChB,CAAE0D,KAAI3E,OAAMyE,2BACZ,CAAE5D,MAAO8B,KAGfzB,OAAQ,CACNyD,EACA3E,EACAyE,IAEAvB,EAAAA,kBACER,EAAIS,WAAWC,KACbpC,EAAgBE,OAChB,CAAEyD,KAAI3E,OAAMyE,2BACZ,CAAE5D,MAAO8B,KAGfxB,OAASwD,GACPzB,EAAAA,kBACER,EAAIS,WAAWC,KAAKpC,EAAgBG,OAAQ,CAAEwD,MAAM,CAAE9D,MAAO8B,KAEjEX,QAAS,IACPkB,EAAiBA,kBACfR,EAAIS,WAAWrD,IAAIkB,EAAgBgB,QAAS,CAC1CnB,MAAO8B,KAER3D,GAASA,EAAK4F,YCjDfC,EAAU,CAACnC,EAAcC,KAA4B,CACzDzB,OAAQ,CACN4D,EACAC,IAEA7B,EAAiBA,kBACfR,EAAIS,WAAWC,KAAKpC,EAAaE,OAAQ,CAAE4D,MAAKC,gBAAgB,CAAElE,MAAO8B,OCFzEqC,EAAiB,CAACtC,EAAcC,KAA4B,CAChE1B,OAAQ,CAACjB,EAAciF,IACrB/B,EAAiBA,kBACfR,EAAIS,WAAWC,KACbpC,EAAoBC,OACpB,CAAEjB,OAAMiF,eACR,CAAEpE,MAAO8B,KAGfzB,OAAQ,CAAClB,EAAckF,EAAiBD,IACtC/B,EAAAA,kBACER,EAAIS,WAAWC,KACbpC,EAAoBE,OACpB,CAAElB,OAAMkF,UAASD,eACjB,CAAEpE,MAAO8B,KAGfxB,OAASnB,GACPkD,EAAAA,kBACER,EAAIS,WAAWC,KAAKpC,EAAoBG,OAAQ,CAAEnB,QAAQ,CAAEa,MAAO8B,KAEvEX,QAAS,IACPkB,EAAiBA,kBACfR,EAAIS,WAAWrD,IAAIkB,EAAoBgB,QAAS,CAC9CnB,MAAO8B,KAER3D,GAASA,EAAKmG,gBC1BfC,EAAW,CAAC1C,EAAcC,KAA4B,CAC1D1B,OAAQ,CACNjB,EACAiF,EACAI,IAEAnC,EAAAA,kBACER,EAAIS,WAAWC,KACbpC,EAAcC,OACd,CAAEjB,OAAMiF,cAAaI,mBACrB,CAAExE,MAAO8B,KAGfzB,OAAQ,CACNlB,EACAkF,EACAD,EACAI,IAEAnC,oBACER,EAAIS,WAAWC,KACbpC,EAAcE,OACd,CAAElB,OAAMkF,UAASD,cAAaI,mBAC9B,CAAExE,MAAO8B,KAGfxB,OAASnB,GACPkD,EAAAA,kBACER,EAAIS,WAAWC,KAAKpC,EAAcG,OAAQ,CAAEnB,QAAQ,CAAEa,MAAO8B,KAEjEX,QAAS,IACPkB,EAAiBA,kBACfR,EAAIS,WAAWrD,IAAIkB,EAAcgB,QAAS,CACxCnB,MAAO8B,KAER3D,GAASA,EAAKgE,UCvCfsC,EAAY,CAAC5C,EAAcC,KAA4B,CAM3DL,cAAgB+B,GACdnB,EAAAA,kBACER,EAAIS,WAAWC,KAAKpC,EAAesB,cAAe,CAAE+B,YAAY,CAAExD,MAAO8B,KAU7EJ,uBAAwB,CACtB8B,EACAkB,EACAC,IAEAtC,EAAAA,kBACER,EAAIS,WAAWC,KACbpC,EAAeuB,uBACf,CAAE8B,WAAUmB,WAAUD,WACtB,CAAE1E,MAAO8B,KAUfH,oBAAqB,CAAC6B,EAAkBoB,IACtCvC,EAAiBA,kBACfR,EAAIS,WAAWC,KACbpC,EAAewB,oBACf,CAAE6B,WAAUoB,WACZ,CAAE5E,MAAO8B,OC1CX+C,EAAkB,CAAChD,EAAcC,KAA4B,CACjEgD,kBAAmB,CACjBtB,EACAuB,EACAC,EACAC,EACAC,EACAC,IAEA9C,EAAiBA,kBACfR,EAAIS,WAAWC,KACbpC,EAAaiB,UACb,CAAEoC,WAAUuB,SAAQE,WAAUD,UAASE,cAAaC,UACpD,CAAEnF,MAAO8B,KAGfsD,kBAAmB,CAAC5B,EAAkB6B,IACpChD,EAAiBA,kBACfR,EAAIS,WAAWC,KACbpC,EAAakB,SACb,CAAEmC,WAAU6B,kBACZ,CAAErF,MAAO8B,KAGfwD,iBAAkB,CAChB9B,EACA+B,EACAC,IAEAnD,EAAAA,kBACER,EAAIS,WAAWC,KACbpC,EAAamB,QACb,CAAEkC,WAAU+B,cAAaC,oBACzB,CAAExF,MAAO8B,OCzBX2D,EAAgB,CAAC5D,EAAcC,KAA4B,CAS/D1B,OAAQ,CACNjB,EACAuG,EACAvD,EACAwD,IAEAtD,EAAAA,kBACER,EAAIS,WAAWC,KACbpC,EAAmBC,OACnB,CAAEjB,OAAMuG,aAAYlD,UAAWL,EAAOwD,cACtC,CAAE3F,MAAO8B,KAQfvB,KAAOuD,GACLzB,EAAAA,kBACER,EAAIS,WAAWrD,IAAIkB,EAAmBI,KAAM,CAC1CoC,YAAa,CAAEmB,MACf9D,MAAO8B,KAER3D,GAASA,EAAKyH,MAOnB9C,UAAYC,GACVV,oBACER,EAAIS,WAAWC,KAAKpC,EAAmBK,OAAQ,CAAEuC,aAAa,CAAE/C,MAAO8B,KACtE3D,GAASA,EAAK0H,OAQnBxF,OAAQ,CAACyD,EAAY3E,IACnBkD,EAAiBA,kBACfR,EAAIS,WAAWC,KAAKpC,EAAmBE,OAAQ,CAAEyD,KAAI3E,QAAQ,CAAEa,MAAO8B,KACrE3D,GAASA,EAAKyH,MAOnB3E,WAAa6C,GACXzB,EAAAA,kBACER,EAAIS,WAAWC,KAAKpC,EAAmBc,WAAY,CAAE6C,MAAM,CAAE9D,MAAO8B,KAMxEZ,SAAW4C,GACTzB,EAAAA,kBACER,EAAIS,WAAWC,KAAKpC,EAAmBe,SAAU,CAAE4C,MAAM,CAAE9D,MAAO8B,KAMtExB,OAASwD,GACPzB,EAAAA,kBACER,EAAIS,WAAWC,KAAKpC,EAAmBG,OAAQ,CAAEwD,MAAM,CAAE9D,MAAO8B,OCvFhEgE,EAAW,CAACjE,EAAcC,KAA4B,CAC1DP,OAASwE,GACP1D,EAAAA,kBACER,EAAIS,WAAWC,KAAKpC,EAAcoB,OAAQ,CAAEwE,UAAU,CAAE/F,MAAO8B,KAEnEN,OAAQ,CAACuE,EAAgBC,EAAYC,IACnC5D,EAAAA,kBACER,EAAIS,WAAWC,KACbpC,EAAcqB,OACd,CAAEuE,SAAQC,OAAMC,WAChB,CAAEjG,MAAO8B,OCVXoE,EAAY,CAACrE,EAAcC,KAA4B,CAC3DP,OAAQ,IACNc,EAAiBA,kBAACR,EAAIS,WAAWC,KAAKpC,EAAeoB,OAAQ,CAAE,EAAE,CAAEvB,MAAO8B,KAC5EN,OAAS2E,GACP9D,EAAAA,kBACER,EAAIS,WAAWC,KAAKpC,EAAeqB,OAAQ,CAAE2E,SAAS,CAAEnG,MAAO8B,aCRnD,QAAlBhD,EAAAsH,WAAWC,eAAO,IAAAvH,IAAlBsH,WAAWC,QAAYA,EAAOA,SAE9B,MAGMC,EAAe,IAAIrI,KAGvBA,EAAKsI,SAASC,YAEZA,YAAS1H,GAAAS,EAAAiH,GAAYC,+BAAAA,cARD,aAQmC,IAGlDC,EAAS,WAAIzI,ICKhB0I,EAAW7H,WAAAgD,cAAEA,GAAuChD,EAArB8H,EAAMrI,EAAAA,OAAAO,EAA1B,mBACf,MAAM+H,EAAUC,UACXrH,OAAAC,OAAAD,OAAAC,OAAA,CAAA,EAAAkH,UACHG,EACAC,YAAWvH,OAAAC,OAAAD,OAAAC,OAAA,CAAA,EACNkH,EAAOI,cACV,qBAAsB,SACtB,8BAAiD,UAAZ,OAAPC,cAAO,IAAPA,aAAO,EAAPA,QAASC,gBAAU,IAAA3H,OAAA,EAAAA,EAAA4H,OAAQ,GACzD,wBAAyB,cAIvBC,UAAEA,EAASC,OAAEA,GAAWT,EAExBf,EAA6C,CAAA,EAmB7CyB,ECxCe,EAACzF,EAAcC,KAA4B,CAChEW,KAAMb,EAASC,EAAKC,GACpByF,UAAW9B,EAAc5D,EAAKC,GAC9BhC,OAAQ6D,EAAW9B,EAAKC,GACxB0F,IAAK3C,EAAgBhD,EAAKC,GAC1BmC,IAAKD,EAAQnC,EAAKC,GAClB2F,WAAYtD,EAAetC,EAAKC,GAChC4F,KAAMnD,EAAS1C,EAAKC,GACpB6F,MAAOlD,EAAU5C,EAAKC,GACtBkE,KAAMF,EAASjE,EAAKC,GACpBqE,MAAOD,EAAUrE,EAAKC,KD8BH8F,CAAef,EAAS/E,GAErCD,iCACDgF,GAAO,CAOVS,aAGAtJ,aAAa6J,GACX,KAAKA,aAAA,EAAAA,EAAQC,KAAK,MAAMC,MAAM,gCAE9B,GAAIlC,EAAKgC,EAAOC,KAAM,OAAOjC,EAAKgC,EAAOC,KAKzC,GAFArI,OAAOC,OAAOmG,OAnCA7H,WAChB,MAGMgK,SAHoBnB,EAAQvE,WAC/BrD,IAAI,WAAWmI,KACfa,MAAM/J,GAASA,EAAKgK,UACerC,KACtC,OAAK5F,MAAMC,QAAQ8H,UACQG,QAAQC,IACjCJ,EAAWK,KAAIrK,MAAO4H,GAAQ,CAACA,EAAIkC,UAAWQ,EAAAA,UAAU1C,QAGtC2C,QAClB,CAACC,GAAMV,EAAKW,KAAUX,EAAWrI,OAAAC,OAAAD,OAAAC,OAAA,CAAA,EAAA8I,IAAK,CAACV,EAAIY,YAAaD,IAAQD,GAChE,CAAE,GAPmC,EAQtC,EAsB2BG,KAErB9C,EAAKgC,EAAOC,KAAM,MAAMC,MAAM,gCAEnC,OAAOlC,EAAKgC,EAAOC,IACpB,EAOD9J,kBAAkBiG,SAEhB,MACMjE,SADY4I,EAASA,UAAC3E,EAAKpC,EAAIgH,OAAQ,CAAEC,eAAgB,KAC7CC,QAElB,GAAI/I,IACFA,EAAMgJ,IAAe,QAATlK,EAAAkB,EAAMgJ,WAAG,IAAAlK,OAAA,EAAAA,EAAEmK,MAAM,KAAKC,MAC9BlJ,EAAMgJ,MAAQ5B,GAEhB,MAAM,IAAI+B,EAAMA,OAACC,yBACf,+BACA,MACA,gBAKN,MAAO,CAAEnF,MAAKjE,QACf,EAODhC,sBAAsBqL,GACpB,IAAKA,EAAc,MAAMtB,MAAM,4CAE/B,IAEE,aADoBlG,EAAIyH,YAAYD,EAMrC,CAJC,MAAOE,GAGP,MADAlC,SAAAA,EAAQkC,MAAM,4BAA6BA,GACrCxB,MAAM,4BACb,CACF,EAOD/J,qBAAqBwL,WACnB,IAAKA,EAAc,MAAMzB,MAAM,kDAE/B,UACQlG,EAAIyH,YAAYE,GACtB,MAAMC,QAAgB5H,EAAI6H,QAAQF,GAClC,GAAIC,EAAQE,GAAI,CAEd,aADoB9H,EAAIyH,YAA0B,QAAdxK,EAAA2K,EAAQtL,YAAM,IAAAW,OAAA,EAAAA,EAAA8K,WAEnD,CAED,MAAM7B,MAAmB,QAAbxI,EAAAkK,EAAQF,aAAK,IAAAhK,OAAA,EAAAA,EAAEsK,aAK5B,CAJC,MAAOC,GAGP,MADAzC,SAAAA,EAAQkC,MAAM,kCAAmCO,GAC3C/B,MAAM,kCACb,CACF,EAQD/J,gCACEqL,EACAG,GAEA,IAAKH,IAAiBG,EAAc,MAAMzB,MAAM,6CAEhD,IAEE,aADoBlG,EAAIkI,gBAAgBV,EAKzC,CAHC,MAAOE,GAEPlC,SAAAA,EAAQ2C,IAAI,mDACb,CAED,OAAOnI,EAAIoI,eAAeT,EAC3B,EAODxL,wBAAwBuJ,GACtB,IAAKA,EAAW,MAAMQ,MAAM,gCAE5B,IAAI7J,EACJ,IACEA,QAAa2D,EAAI0F,UAAU2C,SAAS3C,EAIrC,CAHC,MAAOgC,GAEP,MADAlC,SAAAA,EAAQkC,MAAM,gCAAiCA,GACzCxB,MAAM,gCACb,CAED,MAAM6B,WAAEA,GAAe1L,EAAKC,KAC5B,IAAKyL,EAEH,MADAvC,SAAAA,EAAQkC,MAAM,gDACRxB,MAAM,iCAGd,IAEE,aADoBlG,EAAIyH,YAAYM,EAKrC,CAHC,MAAOL,GAEP,MADAlC,SAAAA,EAAQkC,MAAM,sCAAuCA,GAC/CxB,MAAM,gCACb,CACF,EAQDoC,oBAAmB,CAACvK,EAA8B0E,IACzCzC,EAAIuI,0BAA0BxK,EAAU,KAAM0E,GASvD8F,0BACExK,EACAE,EACAwE,GAEA,MAAM+F,EAAU1K,EAA2BC,EdrNb,ccqN6CE,GAC3E,OAAOwE,EAAYgG,OAAOC,GAASF,EAAQG,SAASD,IACrD,EAQDE,cAAa,CAAC7K,EAA8BuC,IACnCN,EAAI6I,oBAAoB9K,EAAU,KAAMuC,GASjDuI,oBAAoB9K,EAA8BE,EAAgBqC,GAChE,MAAMwI,EAAahL,EAA2BC,EdxOtB,QcwOgDE,GACxE,OAAOqC,EAAMmI,OAAO5C,GAASiD,EAAWH,SAAS9C,IAClD,IAGH,OAAOkD,EAAAA,SACL/I,EACA,CACE,mBACA,iBACA,sBACA,mBACA,uBACA,uBACA,iBACA,gBACA,cACA,yBACA,yBACA,WAEF/D,EACD,EAoBH6I,EAAQkE,uBd1R8B,Mc2RtClE,EAAQmE,uBdzR8B"}
+{"version":3,"file":"index.cjs.js","sources":["../../lib/constants.ts","../../lib/helpers.ts","../../lib/management/paths.ts","../../lib/management/user.ts","../../lib/management/tenant.ts","../../lib/management/jwt.ts","../../lib/management/permission.ts","../../lib/management/role.ts","../../lib/management/group.ts","../../lib/management/sso.ts","../../lib/management/accesskey.ts","../../lib/management/flow.ts","../../lib/management/theme.ts","../../lib/fetch-polyfill.ts","../../lib/index.ts","../../lib/management/index.ts"],"sourcesContent":["// eslint-disable-next-line import/prefer-default-export\n/** Refresh JWT cookie name */\nexport const refreshTokenCookieName = 'DSR';\n/** Session JWT cookie name */\nexport const sessionTokenCookieName = 'DS';\n/** The key of the tenants claims in the claims map */\nexport const authorizedTenantsClaimName = 'tenants';\n/** The key of the permissions claims in the claims map either under tenant or top level */\nexport const permissionsClaimName = 'permissions';\n/** The key of the roles claims in the claims map either under tenant or top level */\nexport const rolesClaimName = 'roles';\n","import type { SdkFnWrapper } from '@descope/core-js-sdk';\nimport { authorizedTenantsClaimName, refreshTokenCookieName } from './constants';\nimport { AuthenticationInfo } from './types';\n\n/**\n * Generate a cookie string from given parameters\n * @param name name of the cookie\n * @param value value of cookie that must be already encoded\n * @param options any options to put on the cookie like cookieDomain, cookieMaxAge, cookiePath\n * @returns Cookie string with all options on the string\n */\nconst generateCookie = (name: string, value: string, options?: Record<string, string | number>) =>\n  `${name}=${value}; Domain=${options?.cookieDomain || ''}; Max-Age=${\n    options?.cookieMaxAge || ''\n  }; Path=${options?.cookiePath || '/'}; HttpOnly; SameSite=Strict`;\n\n/**\n * Parse the cookie string and return the value of the cookie\n * @param cookie the raw cookie string\n * @param name the name of the cookie to get value for\n * @returns the value of the given cookie\n */\nconst getCookieValue = (cookie: string | null | undefined, name: string) => {\n  const match = cookie?.match(RegExp(`(?:^|;\\\\s*)${name}=([^;]*)`));\n  return match ? match[1] : null;\n};\n\n// eslint-disable-next-line import/prefer-default-export\n/**\n * Add cookie generation to core-js functions.\n * @param fn the function we are wrapping\n * @returns Wrapped function with cookie generation\n */\nexport const withCookie: SdkFnWrapper<{ refreshJwt?: string; cookies?: string[] }> =\n  (fn) =>\n  async (...args) => {\n    const resp = await fn(...args);\n\n    // istanbul ignore next\n    if (!resp.data) {\n      return resp;\n    }\n\n    // eslint-disable-next-line prefer-const\n    let { refreshJwt, ...rest } = resp.data;\n    const cookies: string[] = [];\n\n    if (!refreshJwt) {\n      if (resp.response?.headers.get('set-cookie')) {\n        refreshJwt = getCookieValue(\n          resp.response?.headers.get('set-cookie'),\n          refreshTokenCookieName,\n        );\n        cookies.push(resp.response?.headers.get('set-cookie')!);\n      }\n    } else {\n      cookies.push(generateCookie(refreshTokenCookieName, refreshJwt, rest));\n    }\n\n    return { ...resp, data: { ...resp.data, refreshJwt, cookies } };\n  };\n\n/**\n * Get the claim (used for permissions or roles) for a given tenant or top level if tenant is empty\n * @param authInfo The parsed authentication info from the JWT\n * @param claim name of the claim\n * @param tenant tenant to retrieve the claim for\n * @returns\n */\nexport function getAuthorizationClaimItems(\n  authInfo: AuthenticationInfo,\n  claim: string,\n  tenant?: string,\n): string[] {\n  const value = tenant\n    ? authInfo.token[authorizedTenantsClaimName]?.[tenant]?.[claim]\n    : authInfo.token[claim];\n  return Array.isArray(value) ? value : [];\n}\n","/** API paths for the Descope service Management APIs */\nexport default {\n  user: {\n    create: '/v1/mgmt/user/create',\n    update: '/v1/mgmt/user/update',\n    delete: '/v1/mgmt/user/delete',\n    deleteAllTestUsers: '/v1/mgmt/user/test/delete/all',\n    load: '/v1/mgmt/user',\n    search: '/v1/mgmt/user/search',\n    updateStatus: '/v1/mgmt/user/update/status',\n    updateEmail: '/v1/mgmt/user/update/email',\n    updatePhone: '/v1/mgmt/user/update/phone',\n    updateDisplayName: '/v1/mgmt/user/update/name',\n    updatePicture: '/v1/mgmt/user/update/picture',\n    updateCustomAttribute: '/v1/mgmt/user/update/customAttribute',\n    addRole: '/v1/mgmt/user/update/role/add',\n    removeRole: '/v1/mgmt/user/update/role/remove',\n    addTenant: '/v1/mgmt/user/update/tenant/add',\n    removeTenant: '/v1/mgmt/user/update/tenant/remove',\n    setPassword: '/v1/mgmt/user/password/set',\n    expirePassword: '/v1/mgmt/user/password/expire',\n    generateOTPForTest: '/v1/mgmt/tests/generate/otp',\n    generateMagicLinkForTest: '/v1/mgmt/tests/generate/magiclink',\n    generateEnchantedLinkForTest: '/v1/mgmt/tests/generate/enchantedlink',\n  },\n  accessKey: {\n    create: '/v1/mgmt/accesskey/create',\n    load: '/v1/mgmt/accesskey',\n    search: '/v1/mgmt/accesskey/search',\n    update: '/v1/mgmt/accesskey/update',\n    deactivate: '/v1/mgmt/accesskey/deactivate',\n    activate: '/v1/mgmt/accesskey/activate',\n    delete: '/v1/mgmt/accesskey/delete',\n  },\n  tenant: {\n    create: '/v1/mgmt/tenant/create',\n    update: '/v1/mgmt/tenant/update',\n    delete: '/v1/mgmt/tenant/delete',\n    loadAll: '/v1/mgmt/tenant/all',\n  },\n  sso: {\n    settings: '/v1/mgmt/sso/settings',\n    metadata: '/v1/mgmt/sso/metadata',\n    mapping: '/v1/mgmt/sso/mapping',\n  },\n  jwt: {\n    update: '/v1/mgmt/jwt/update',\n  },\n  permission: {\n    create: '/v1/mgmt/permission/create',\n    update: '/v1/mgmt/permission/update',\n    delete: '/v1/mgmt/permission/delete',\n    loadAll: '/v1/mgmt/permission/all',\n  },\n  role: {\n    create: '/v1/mgmt/role/create',\n    update: '/v1/mgmt/role/update',\n    delete: '/v1/mgmt/role/delete',\n    loadAll: '/v1/mgmt/role/all',\n  },\n  flow: {\n    export: '/v1/mgmt/flow/export',\n    import: '/v1/mgmt/flow/import',\n  },\n  theme: {\n    export: '/v1/mgmt/theme/export',\n    import: '/v1/mgmt/theme/import',\n  },\n  group: {\n    loadAllGroups: '/v1/mgmt/group/all',\n    loadAllGroupsForMember: '/v1/mgmt/group/member/all',\n    loadAllGroupMembers: '/v1/mgmt/group/members',\n  },\n};\n","import { DeliveryMethod, SdkResponse, transformResponse, UserResponse } from '@descope/core-js-sdk';\nimport { CoreSdk } from '../types';\nimport apiPaths from './paths';\nimport {\n  AssociatedTenant,\n  GenerateEnchantedLinkForTestResponse,\n  GenerateMagicLinkForTestResponse,\n  GenerateOTPForTestResponse,\n  AttributesTypes,\n} from './types';\n\ntype SingleUserResponse = {\n  user: UserResponse;\n};\n\ntype MultipleUsersResponse = {\n  users: UserResponse[];\n};\n\nconst withUser = (sdk: CoreSdk, managementKey?: string) => ({\n  create: (\n    loginId: string,\n    email?: string,\n    phone?: string,\n    displayName?: string,\n    roles?: string[],\n    userTenants?: AssociatedTenant[],\n    customAttributes?: Record<string, AttributesTypes>,\n    picture?: string,\n  ): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.create,\n        {\n          loginId,\n          email,\n          phone,\n          displayName,\n          roleNames: roles,\n          userTenants,\n          customAttributes,\n          picture,\n        },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  /**\n   * Create a new test user.\n   * The loginID is required and will determine what the user will use to sign in.\n   * Make sure the login id is unique for test. All other fields are optional.\n   *\n   * You can later generate OTP, Magic link and enchanted link to use in the test without the need\n   * of 3rd party messaging services.\n   * Those users are not counted as part of the monthly active users\n   * @returns The UserResponse if found, throws otherwise.\n   */\n  createTestUser: (\n    loginId: string,\n    email?: string,\n    phone?: string,\n    displayName?: string,\n    roles?: string[],\n    userTenants?: AssociatedTenant[],\n    customAttributes?: Record<string, AttributesTypes>,\n    picture?: string,\n  ): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.create,\n        {\n          loginId,\n          email,\n          phone,\n          displayName,\n          roleNames: roles,\n          userTenants,\n          test: true,\n          customAttributes,\n          picture,\n        },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  invite: (\n    loginId: string,\n    email?: string,\n    phone?: string,\n    displayName?: string,\n    roles?: string[],\n    userTenants?: AssociatedTenant[],\n    customAttributes?: Record<string, AttributesTypes>,\n    picture?: string,\n  ): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.create,\n        {\n          loginId,\n          email,\n          phone,\n          displayName,\n          roleNames: roles,\n          userTenants,\n          invite: true,\n          customAttributes,\n          picture,\n        },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  update: (\n    loginId: string,\n    email?: string,\n    phone?: string,\n    displayName?: string,\n    roles?: string[],\n    userTenants?: AssociatedTenant[],\n    customAttributes?: Record<string, AttributesTypes>,\n    picture?: string,\n  ): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.update,\n        {\n          loginId,\n          email,\n          phone,\n          displayName,\n          roleNames: roles,\n          userTenants,\n          customAttributes,\n          picture,\n        },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  delete: (loginId: string): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(apiPaths.user.delete, { loginId }, { token: managementKey }),\n    ),\n  /**\n   * Delete all test users in the project.\n   */\n  deleteAllTestUsers: (): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.delete(apiPaths.user.deleteAllTestUsers, { token: managementKey }),\n    ),\n  load: (loginId: string): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.get(apiPaths.user.load, {\n        queryParams: { loginId },\n        token: managementKey,\n      }),\n      (data) => data.user,\n    ),\n  /**\n   * Load an existing user by user ID. The ID can be found\n   * on the user's JWT.\n   * @param userId load a user by this user ID field\n   * @returns The UserResponse if found, throws otherwise.\n   */\n  loadByUserId: (userId: string): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.get(apiPaths.user.load, {\n        queryParams: { userId },\n        token: managementKey,\n      }),\n      (data) => data.user,\n    ),\n  /**\n   * Search all users. Results can be filtered according to tenants and/or\n   * roles, and also paginated used the limit and page parameters.\n   * @param tenantIds optional list of tenant IDs to filter by\n   * @param roles optional list of roles to filter by\n   * @param limit optionally limit the response, leave out for default limit\n   * @param page optionally paginate over the response\n   * @param testUsersOnly optionally filter only test users\n   * @param withTestUser optionally include test users in search\n   * @returns An array of UserResponse found by the query\n   */\n  searchAll: (\n    tenantIds?: string[],\n    roles?: string[],\n    limit?: number,\n    page?: number,\n    testUsersOnly?: boolean,\n    withTestUser?: boolean,\n    customAttributes?: Record<string, AttributesTypes>,\n  ): Promise<SdkResponse<UserResponse[]>> =>\n    transformResponse<MultipleUsersResponse, UserResponse[]>(\n      sdk.httpClient.post(\n        apiPaths.user.search,\n        { tenantIds, roleNames: roles, limit, page, testUsersOnly, withTestUser, customAttributes },\n        { token: managementKey },\n      ),\n      (data) => data.users,\n    ),\n  activate: (loginId: string): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.updateStatus,\n        { loginId, status: 'enabled' },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  deactivate: (loginId: string): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.updateStatus,\n        { loginId, status: 'disabled' },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  updateEmail: (\n    loginId: string,\n    email: string,\n    isVerified: boolean,\n  ): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.updateEmail,\n        { loginId, email, verified: isVerified },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  updatePhone: (\n    loginId: string,\n    phone: string,\n    isVerified: boolean,\n  ): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.updatePhone,\n        { loginId, phone, verified: isVerified },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  updateDisplayName: (loginId: string, displayName: string): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.updateDisplayName,\n        { loginId, displayName },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  updatePicture: (loginId: string, picture: string): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.updatePicture,\n        { loginId, picture },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  updateCustomAttribute: (\n    loginId: string,\n    attributeKey: string,\n    attributeValue: AttributesTypes,\n  ): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.updateCustomAttribute,\n        { loginId, attributeKey, attributeValue },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  addRoles: (loginId: string, roles: string[]): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.addRole,\n        { loginId, roleNames: roles },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  removeRoles: (loginId: string, roles: string[]): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.removeRole,\n        { loginId, roleNames: roles },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  addTenant: (loginId: string, tenantId: string): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(apiPaths.user.addTenant, { loginId, tenantId }, { token: managementKey }),\n      (data) => data.user,\n    ),\n  removeTenant: (loginId: string, tenantId: string): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.removeTenant,\n        { loginId, tenantId },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  addTenantRoles: (\n    loginId: string,\n    tenantId: string,\n    roles: string[],\n  ): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.addRole,\n        { loginId, tenantId, roleNames: roles },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  removeTenantRoles: (\n    loginId: string,\n    tenantId: string,\n    roles: string[],\n  ): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.removeRole,\n        { loginId, tenantId, roleNames: roles },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n\n  /**\n   * Generate OTP for the given login ID of a test user.\n   * Choose the selected delivery method for verification.\n   * Returns the code for the login (exactly as it sent via Email or SMS)\n   * This is useful when running tests and don't want to use 3rd party messaging services\n   *\n   * @param deliveryMethod optional DeliveryMethod\n   * @param loginId login ID of a test user\n   * @returns GenerateOTPForTestResponse which includes the loginId and the OTP code\n   */\n  generateOTPForTestUser: (\n    deliveryMethod: DeliveryMethod,\n    loginId: string,\n  ): Promise<SdkResponse<GenerateOTPForTestResponse>> =>\n    transformResponse<GenerateOTPForTestResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.generateOTPForTest,\n        { deliveryMethod, loginId },\n        { token: managementKey },\n      ),\n      (data) => data,\n    ),\n\n  /**\n   * Generate Magic Link for the given login ID of a test user.\n   * Choose the selected delivery method for verification.\n   * It returns the link for the login (exactly as it sent via Email)\n   * This is useful when running tests and don't want to use 3rd party messaging services\n   *\n   * @param deliveryMethod optional DeliveryMethod\n   * @param loginId login ID of a test user\n   * @param uri optional redirect uri which will be used instead of any global configuration.\n   * @returns GenerateMagicLinkForTestResponse which includes the loginId and the magic link\n   */\n  generateMagicLinkForTestUser: (\n    deliveryMethod: DeliveryMethod,\n    loginId: string,\n    uri: string,\n  ): Promise<SdkResponse<GenerateMagicLinkForTestResponse>> =>\n    transformResponse<GenerateMagicLinkForTestResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.generateMagicLinkForTest,\n        { deliveryMethod, loginId, URI: uri },\n        { token: managementKey },\n      ),\n      (data) => data,\n    ),\n\n  /**\n   * Generate Enchanted Link for the given login ID of a test user.\n   * It returns the link for the login (exactly as it sent via Email)\n   * and pendingRef which is used to poll for a valid session\n   * This is useful when running tests and don't want to use 3rd party messaging services\n   *\n   * @param loginId login ID of a test user\n   * @param uri optional redirect uri which will be used instead of any global configuration.\n   * @returns GenerateEnchantedLinkForTestResponse which includes the loginId, the enchanted link and the pendingRef\n   */\n  generateEnchantedLinkForTestUser: (\n    loginId: string,\n    uri: string,\n  ): Promise<SdkResponse<GenerateEnchantedLinkForTestResponse>> =>\n    transformResponse<GenerateEnchantedLinkForTestResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.generateEnchantedLinkForTest,\n        { loginId, URI: uri },\n        { token: managementKey },\n      ),\n      (data) => data,\n    ),\n\n  /**\n   * Set password for the given login ID of user.\n   * Note: The password will automatically be set as expired.\n   * The user will not be able to log-in with this password, and will be required to replace it on next login.\n   * See also: expirePassword\n   * @param loginId login ID of a test user\n   * @param password The password to set for the user\n   */\n  setPassword: (loginId: string, password: string): Promise<SdkResponse<never>> =>\n    transformResponse<never>(\n      sdk.httpClient.post(\n        apiPaths.user.setPassword,\n        { loginId, password },\n        { token: managementKey },\n      ),\n      (data) => data,\n    ),\n\n  /**\n   * Expire password for the given login ID.\n   * Note: user sign-in with an expired password, the user will get an error with code.\n   * Use the `ResetPassword` or `ReplacePassword` methods to reset/replace the password.\n   * @param loginId login ID of a test user\n   */\n  expirePassword: (loginId: string): Promise<SdkResponse<never>> =>\n    transformResponse<never>(\n      sdk.httpClient.post(apiPaths.user.expirePassword, { loginId }, { token: managementKey }),\n      (data) => data,\n    ),\n});\n\nexport default withUser;\n","import { SdkResponse, transformResponse } from '@descope/core-js-sdk';\nimport { CoreSdk } from '../types';\nimport apiPaths from './paths';\nimport { CreateTenantResponse, Tenant } from './types';\n\ntype MultipleTenantResponse = {\n  tenants: Tenant[];\n};\n\nconst withTenant = (sdk: CoreSdk, managementKey?: string) => ({\n  create: (\n    name: string,\n    selfProvisioningDomains?: string[],\n  ): Promise<SdkResponse<CreateTenantResponse>> =>\n    transformResponse(\n      sdk.httpClient.post(\n        apiPaths.tenant.create,\n        { name, selfProvisioningDomains },\n        { token: managementKey },\n      ),\n    ),\n  createWithId: (\n    id: string,\n    name: string,\n    selfProvisioningDomains?: string[],\n  ): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(\n        apiPaths.tenant.create,\n        { id, name, selfProvisioningDomains },\n        { token: managementKey },\n      ),\n    ),\n  update: (\n    id: string,\n    name: string,\n    selfProvisioningDomains?: string[],\n  ): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(\n        apiPaths.tenant.update,\n        { id, name, selfProvisioningDomains },\n        { token: managementKey },\n      ),\n    ),\n  delete: (id: string): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(apiPaths.tenant.delete, { id }, { token: managementKey }),\n    ),\n  loadAll: (): Promise<SdkResponse<Tenant[]>> =>\n    transformResponse<MultipleTenantResponse, Tenant[]>(\n      sdk.httpClient.get(apiPaths.tenant.loadAll, {\n        token: managementKey,\n      }),\n      (data) => data.tenants,\n    ),\n});\n\nexport default withTenant;\n","import { SdkResponse, transformResponse } from '@descope/core-js-sdk';\nimport { CoreSdk } from '../types';\nimport apiPaths from './paths';\nimport { UpdateJWTResponse } from './types';\n\nconst withJWT = (sdk: CoreSdk, managementKey?: string) => ({\n  update: (\n    jwt: string,\n    customClaims?: Record<string, any>,\n  ): Promise<SdkResponse<UpdateJWTResponse>> =>\n    transformResponse(\n      sdk.httpClient.post(apiPaths.jwt.update, { jwt, customClaims }, { token: managementKey }),\n    ),\n});\n\nexport default withJWT;\n","import { SdkResponse, transformResponse } from '@descope/core-js-sdk';\nimport { CoreSdk } from '../types';\nimport apiPaths from './paths';\nimport { Permission } from './types';\n\ntype MultiplePermissionResponse = {\n  permissions: Permission[];\n};\n\nconst withPermission = (sdk: CoreSdk, managementKey?: string) => ({\n  create: (name: string, description?: string): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(\n        apiPaths.permission.create,\n        { name, description },\n        { token: managementKey },\n      ),\n    ),\n  update: (name: string, newName: string, description?: string): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(\n        apiPaths.permission.update,\n        { name, newName, description },\n        { token: managementKey },\n      ),\n    ),\n  delete: (name: string): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(apiPaths.permission.delete, { name }, { token: managementKey }),\n    ),\n  loadAll: (): Promise<SdkResponse<Permission[]>> =>\n    transformResponse<MultiplePermissionResponse, Permission[]>(\n      sdk.httpClient.get(apiPaths.permission.loadAll, {\n        token: managementKey,\n      }),\n      (data) => data.permissions,\n    ),\n});\n\nexport default withPermission;\n","import { SdkResponse, transformResponse } from '@descope/core-js-sdk';\nimport { CoreSdk } from '../types';\nimport apiPaths from './paths';\nimport { Role } from './types';\n\ntype MultipleRoleResponse = {\n  roles: Role[];\n};\n\nconst withRole = (sdk: CoreSdk, managementKey?: string) => ({\n  create: (\n    name: string,\n    description?: string,\n    permissionNames?: string[],\n  ): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(\n        apiPaths.role.create,\n        { name, description, permissionNames },\n        { token: managementKey },\n      ),\n    ),\n  update: (\n    name: string,\n    newName: string,\n    description?: string,\n    permissionNames?: string[],\n  ): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(\n        apiPaths.role.update,\n        { name, newName, description, permissionNames },\n        { token: managementKey },\n      ),\n    ),\n  delete: (name: string): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(apiPaths.role.delete, { name }, { token: managementKey }),\n    ),\n  loadAll: (): Promise<SdkResponse<Role[]>> =>\n    transformResponse<MultipleRoleResponse, Role[]>(\n      sdk.httpClient.get(apiPaths.role.loadAll, {\n        token: managementKey,\n      }),\n      (data) => data.roles,\n    ),\n});\n\nexport default withRole;\n","import { SdkResponse, transformResponse } from '@descope/core-js-sdk';\nimport { CoreSdk } from '../types';\nimport apiPaths from './paths';\nimport { Group } from './types';\n\nconst withGroup = (sdk: CoreSdk, managementKey?: string) => ({\n  /**\n   * Load all groups for a specific tenant id.\n   * @param tenantId Tenant ID to load groups from.\n   * @returns Group[] list of groups\n   */\n  loadAllGroups: (tenantId: string): Promise<SdkResponse<Group[]>> =>\n    transformResponse<Group[]>(\n      sdk.httpClient.post(apiPaths.group.loadAllGroups, { tenantId }, { token: managementKey }),\n    ),\n\n  /**\n   * Load all groups for the provided user IDs or login IDs.\n   * @param tenantId Tenant ID to load groups from.\n   * @param userIds Optional List of user IDs, with the format of \"U2J5ES9S8TkvCgOvcrkpzUgVTEBM\" (example), which can be found on the user's JWT.\n   * @param loginIds Optional List of login IDs, how the user identifies when logging in.\n   * @returns Group[] list of groups\n   */\n  loadAllGroupsForMember: (\n    tenantId: string,\n    userIds: string[],\n    loginIds: string[],\n  ): Promise<SdkResponse<Group[]>> =>\n    transformResponse<Group[]>(\n      sdk.httpClient.post(\n        apiPaths.group.loadAllGroupsForMember,\n        { tenantId, loginIds, userIds },\n        { token: managementKey },\n      ),\n    ),\n\n  /**\n   * Load all members of the provided group id.\n   * @param tenantId Tenant ID to load groups from.\n   * @param groupId Group ID to load members for.\n   * @returns Group[] list of groups\n   */\n  loadAllGroupMembers: (tenantId: string, groupId: string): Promise<SdkResponse<Group[]>> =>\n    transformResponse<Group[]>(\n      sdk.httpClient.post(\n        apiPaths.group.loadAllGroupMembers,\n        { tenantId, groupId },\n        { token: managementKey },\n      ),\n    ),\n});\n\nexport default withGroup;\n","import { SdkResponse, transformResponse } from '@descope/core-js-sdk';\nimport { CoreSdk } from '../types';\nimport apiPaths from './paths';\nimport { RoleMapping, AttributeMapping, SSOSettingsResponse } from './types';\n\nconst withSSOSettings = (sdk: CoreSdk, managementKey?: string) => ({\n  getSettings: (tenantId: string): Promise<SdkResponse<SSOSettingsResponse>> =>\n    transformResponse<SSOSettingsResponse>(\n      sdk.httpClient.get(apiPaths.sso.settings, {\n        queryParams: { tenantId },\n        token: managementKey,\n      }),\n      (data) => data,\n    ),\n  deleteSettings: (tenantId: string): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.delete(apiPaths.sso.settings, {\n        queryParams: { tenantId },\n        token: managementKey,\n      }),\n    ),\n  configureSettings: (\n    tenantId: string,\n    idpURL: string,\n    idpCert: string,\n    entityId: string,\n    redirectURL?: string,\n    domain?: string,\n  ): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(\n        apiPaths.sso.settings,\n        { tenantId, idpURL, entityId, idpCert, redirectURL, domain },\n        { token: managementKey },\n      ),\n    ),\n  configureMetadata: (tenantId: string, idpMetadataURL: string): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(\n        apiPaths.sso.metadata,\n        { tenantId, idpMetadataURL },\n        { token: managementKey },\n      ),\n    ),\n  configureMapping: (\n    tenantId: string,\n    roleMapping?: RoleMapping,\n    attributeMapping?: AttributeMapping,\n  ): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(\n        apiPaths.sso.mapping,\n        { tenantId, roleMapping, attributeMapping },\n        { token: managementKey },\n      ),\n    ),\n});\n\nexport default withSSOSettings;\n","import { SdkResponse, transformResponse } from '@descope/core-js-sdk';\nimport { CoreSdk } from '../types';\nimport apiPaths from './paths';\nimport { AccessKey, AssociatedTenant, CreatedAccessKeyResponse } from './types';\n\ntype SingleKeyResponse = {\n  key: AccessKey;\n};\n\ntype MultipleKeysResponse = {\n  keys: AccessKey[];\n};\n\nconst withAccessKey = (sdk: CoreSdk, managementKey?: string) => ({\n  /**\n   * Create a new access key for a project.\n   * @param name Access key name\n   * @param expireTime When the access key expires. Keep at 0 to make it indefinite.\n   * @param roles Optional roles in the project. Does not apply for multi-tenants\n   * @param keyTenants Optional associated tenants for this key and its roles for each.\n   * @returns A newly created key and its cleartext. Make sure to save the cleartext securely.\n   */\n  create: (\n    name: string,\n    expireTime: number,\n    roles?: string[],\n    keyTenants?: AssociatedTenant[],\n  ): Promise<SdkResponse<CreatedAccessKeyResponse>> =>\n    transformResponse(\n      sdk.httpClient.post(\n        apiPaths.accessKey.create,\n        { name, expireTime, roleNames: roles, keyTenants },\n        { token: managementKey },\n      ),\n    ),\n  /**\n   * Load an access key.\n   * @param id Access key ID to load\n   * @returns The loaded access key.\n   */\n  load: (id: string): Promise<SdkResponse<AccessKey>> =>\n    transformResponse<SingleKeyResponse, AccessKey>(\n      sdk.httpClient.get(apiPaths.accessKey.load, {\n        queryParams: { id },\n        token: managementKey,\n      }),\n      (data) => data.key,\n    ),\n  /**\n   * Search all access keys\n   * @param tenantIds Optional tenant ID filter to apply on the search results\n   * @returns An array of found access keys\n   */\n  searchAll: (tenantIds?: string[]): Promise<SdkResponse<AccessKey[]>> =>\n    transformResponse<MultipleKeysResponse, AccessKey[]>(\n      sdk.httpClient.post(apiPaths.accessKey.search, { tenantIds }, { token: managementKey }),\n      (data) => data.keys,\n    ),\n  /**\n   * Update an access key.\n   * @param id Access key ID to load\n   * @param name The updated access key name\n   * @returns The updated access key\n   */\n  update: (id: string, name: string): Promise<SdkResponse<AccessKey>> =>\n    transformResponse<SingleKeyResponse, AccessKey>(\n      sdk.httpClient.post(apiPaths.accessKey.update, { id, name }, { token: managementKey }),\n      (data) => data.key,\n    ),\n  /**\n   * Deactivate an access key. Deactivated access keys cannot be used until they are\n   * activated again.\n   * @param id Access key ID to deactivate\n   */\n  deactivate: (id: string): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(apiPaths.accessKey.deactivate, { id }, { token: managementKey }),\n    ),\n  /**\n   * Activate an access key. Only deactivated access keys can be activated again.\n   * @param id Access key ID to activate\n   */\n  activate: (id: string): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(apiPaths.accessKey.activate, { id }, { token: managementKey }),\n    ),\n  /**\n   * Delete an access key. IMPORTANT: This cannot be undone. Use carefully.\n   * @param id Access key ID to delete\n   */\n  delete: (id: string): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(apiPaths.accessKey.delete, { id }, { token: managementKey }),\n    ),\n});\n\nexport default withAccessKey;\n","import { SdkResponse, transformResponse } from '@descope/core-js-sdk';\nimport { CoreSdk } from '../types';\nimport apiPaths from './paths';\nimport { FlowResponse, Screen, Flow } from './types';\n\nconst WithFlow = (sdk: CoreSdk, managementKey?: string) => ({\n  export: (flowId: string): Promise<SdkResponse<FlowResponse>> =>\n    transformResponse(\n      sdk.httpClient.post(apiPaths.flow.export, { flowId }, { token: managementKey }),\n    ),\n  import: (flowId: string, flow: Flow, screens?: Screen[]): Promise<SdkResponse<FlowResponse>> =>\n    transformResponse(\n      sdk.httpClient.post(\n        apiPaths.flow.import,\n        { flowId, flow, screens },\n        { token: managementKey },\n      ),\n    ),\n});\n\nexport default WithFlow;\n","import { SdkResponse, transformResponse } from '@descope/core-js-sdk';\nimport { CoreSdk } from '../types';\nimport apiPaths from './paths';\nimport { Theme, ThemeResponse } from './types';\n\nconst WithTheme = (sdk: CoreSdk, managementKey?: string) => ({\n  export: (): Promise<SdkResponse<ThemeResponse>> =>\n    transformResponse(sdk.httpClient.post(apiPaths.theme.export, {}, { token: managementKey })),\n  import: (theme: Theme): Promise<SdkResponse<ThemeResponse>> =>\n    transformResponse(\n      sdk.httpClient.post(apiPaths.theme.import, { theme }, { token: managementKey }),\n    ),\n});\n\nexport default WithTheme;\n","import nodeFetch, { Headers } from 'node-fetch-commonjs';\n\nglobalThis.Headers ??= Headers;\n\nconst highWaterMarkMb = 1024 * 1024 * 30; // 30MB\n\n// we are increasing the response buffer size due to an issue where node-fetch hangs when response is too big\nconst patchedFetch = (...args: Parameters<typeof nodeFetch>) => {\n  // we can get Request on the first arg, or RequestInfo on the second arg\n  // we want to make sure we are setting the \"highWaterMark\" so we are doing it on both args\n  args.forEach((arg) => {\n    // eslint-disable-next-line no-param-reassign, @typescript-eslint/no-unused-expressions\n    arg && ((arg as any).highWaterMark ??= highWaterMarkMb);\n  });\n\n  return nodeFetch(...args);\n};\n\nexport default patchedFetch as unknown as typeof fetch;\n","import createSdk, { ExchangeAccessKeyResponse, SdkResponse, wrapWith } from '@descope/core-js-sdk';\nimport { JWK, JWTHeaderParameters, KeyLike, errors, importJWK, jwtVerify } from 'jose';\nimport {\n  permissionsClaimName,\n  refreshTokenCookieName,\n  rolesClaimName,\n  sessionTokenCookieName,\n} from './constants';\nimport { getAuthorizationClaimItems, withCookie } from './helpers';\nimport withManagement from './management';\nimport { AuthenticationInfo } from './types';\nimport fetch from './fetch-polyfill';\n\ndeclare const BUILD_VERSION: string;\n\n/** Configuration arguments which include the Descope core SDK args and an optional management key */\ntype NodeSdkArgs = Parameters<typeof createSdk>[0] & {\n  managementKey?: string;\n};\n\nconst nodeSdk = ({ managementKey, ...config }: NodeSdkArgs) => {\n  const coreSdk = createSdk({\n    ...config,\n    fetch,\n    baseHeaders: {\n      ...config.baseHeaders,\n      'x-descope-sdk-name': 'nodejs',\n      'x-descope-sdk-node-version': process?.versions?.node || '',\n      'x-descope-sdk-version': BUILD_VERSION,\n    },\n  });\n\n  const { projectId, logger } = config;\n\n  const keys: Record<string, KeyLike | Uint8Array> = {};\n\n  /** Fetch the public keys (JWKs) from Descope for the configured project */\n  const fetchKeys = async () => {\n    const keysWrapper = await coreSdk.httpClient\n      .get(`v2/keys/${projectId}`)\n      .then((resp) => resp.json());\n    const publicKeys: JWK[] = keysWrapper.keys;\n    if (!Array.isArray(publicKeys)) return {};\n    const kidJwksPairs = await Promise.all(\n      publicKeys.map(async (key) => [key.kid, await importJWK(key)]),\n    );\n\n    return kidJwksPairs.reduce(\n      (acc, [kid, jwk]) => (kid ? { ...acc, [kid.toString()]: jwk } : acc),\n      {},\n    );\n  };\n\n  const management = withManagement(coreSdk, managementKey);\n\n  const sdk = {\n    ...coreSdk,\n\n    /**\n     * Provides various APIs for managing a Descope project programmatically. A management key must\n     * be provided as an argument when initializing the SDK to use these APIs. Management keys can be\n     * generated in the Descope console.\n     */\n    management,\n\n    /** Get the key that can validate the given JWT KID in the header. Can retrieve the public key from local cache or from Descope. */\n    async getKey(header: JWTHeaderParameters): Promise<KeyLike | Uint8Array> {\n      if (!header?.kid) throw Error('header.kid must not be empty');\n\n      if (keys[header.kid]) return keys[header.kid];\n\n      // do we need to fetch once or every time?\n      Object.assign(keys, await fetchKeys());\n\n      if (!keys[header.kid]) throw Error('failed to fetch matching key');\n\n      return keys[header.kid];\n    },\n\n    /**\n     * Validate the given JWT with the right key and make sure the issuer is correct\n     * @param jwt the JWT string to parse and validate\n     * @returns AuthenticationInfo with the parsed token and JWT. Will throw an error if validation fails.\n     */\n    async validateJwt(jwt: string): Promise<AuthenticationInfo> {\n      // Do not hard-code the algo because library does not support `None` so all are valid\n      const res = await jwtVerify(jwt, sdk.getKey, { clockTolerance: 5 });\n      const token = res.payload;\n\n      if (token) {\n        token.iss = token.iss?.split('/').pop(); // support both url and project id as issuer\n        if (token.iss !== projectId) {\n          // We must do the verification here, since issuer can be either project ID or URL\n          throw new errors.JWTClaimValidationFailed(\n            'unexpected \"iss\" claim value',\n            'iss',\n            'check_failed',\n          );\n        }\n      }\n\n      return { jwt, token };\n    },\n\n    /**\n     * Validate an active session\n     * @param sessionToken session JWT to validate\n     * @returns AuthenticationInfo promise or throws Error if there is an issue with JWTs\n     */\n    async validateSession(sessionToken: string): Promise<AuthenticationInfo> {\n      if (!sessionToken) throw Error('session token is required for validation');\n\n      try {\n        const token = await sdk.validateJwt(sessionToken);\n        return token;\n      } catch (error) {\n        /* istanbul ignore next */\n        logger?.error('session validation failed', error);\n        throw Error('session validation failed');\n      }\n    },\n\n    /**\n     * Refresh the session using a refresh token\n     * @param refreshToken refresh JWT to refresh the session with\n     * @returns AuthenticationInfo promise or throws Error if there is an issue with JWTs\n     */\n    async refreshSession(refreshToken: string): Promise<AuthenticationInfo> {\n      if (!refreshToken) throw Error('refresh token is required to refresh a session');\n\n      try {\n        await sdk.validateJwt(refreshToken);\n        const jwtResp = await sdk.refresh(refreshToken);\n        if (jwtResp.ok) {\n          const token = await sdk.validateJwt(jwtResp.data?.sessionJwt);\n          return token;\n        }\n        /* istanbul ignore next */\n        throw Error(jwtResp.error?.errorMessage);\n      } catch (refreshTokenErr) {\n        /* istanbul ignore next */\n        logger?.error('refresh token validation failed', refreshTokenErr);\n        throw Error('refresh token validation failed');\n      }\n    },\n\n    /**\n     * Validate session and refresh it if it expired\n     * @param sessionToken session JWT\n     * @param refreshToken refresh JWT\n     * @returns AuthenticationInfo promise or throws Error if there is an issue with JWTs\n     */\n    async validateAndRefreshSession(\n      sessionToken?: string,\n      refreshToken?: string,\n    ): Promise<AuthenticationInfo> {\n      if (!sessionToken && !refreshToken) throw Error('both session and refresh tokens are empty');\n\n      try {\n        const token = await sdk.validateSession(sessionToken);\n        return token;\n      } catch (error) {\n        /* istanbul ignore next */\n        logger?.log('session validation failed - trying to refresh it');\n      }\n\n      return sdk.refreshSession(refreshToken);\n    },\n\n    /**\n     * Exchange API key (access key) for a session key\n     * @param accessKey access key to exchange for a session JWT\n     * @returns AuthneticationInfo with session JWT data\n     */\n    async exchangeAccessKey(accessKey: string): Promise<AuthenticationInfo> {\n      if (!accessKey) throw Error('access key must not be empty');\n\n      let resp: SdkResponse<ExchangeAccessKeyResponse>;\n      try {\n        resp = await sdk.accessKey.exchange(accessKey);\n      } catch (error) {\n        logger?.error('failed to exchange access key', error);\n        throw Error('could not exchange access key');\n      }\n\n      const { sessionJwt } = resp.data;\n      if (!sessionJwt) {\n        logger?.error('failed to parse exchange access key response');\n        throw Error('could not exchange access key');\n      }\n\n      try {\n        const token = await sdk.validateJwt(sessionJwt);\n        return token;\n      } catch (error) {\n        logger?.error('failed to parse jwt from access key', error);\n        throw Error('could not exchange access key');\n      }\n    },\n\n    /**\n     * Make sure that all given permissions exist on the parsed JWT top level claims\n     * @param authInfo JWT parsed info\n     * @param permissions list of permissions to make sure they exist on te JWT claims\n     * @returns true if all permissions exist, false otherwise\n     */\n    validatePermissions(authInfo: AuthenticationInfo, permissions: string[]): boolean {\n      return sdk.validateTenantPermissions(authInfo, null, permissions);\n    },\n\n    /**\n     * Make sure that all given permissions exist on the parsed JWT tenant claims\n     * @param authInfo JWT parsed info\n     * @param permissions list of permissions to make sure they exist on te JWT claims\n     * @returns true if all permissions exist, false otherwise\n     */\n    validateTenantPermissions(\n      authInfo: AuthenticationInfo,\n      tenant: string,\n      permissions: string[],\n    ): boolean {\n      const granted = getAuthorizationClaimItems(authInfo, permissionsClaimName, tenant);\n      return permissions.every((perm) => granted.includes(perm));\n    },\n\n    /**\n     * Make sure that all given roles exist on the parsed JWT top level claims\n     * @param authInfo JWT parsed info\n     * @param roles list of roles to make sure they exist on te JWT claims\n     * @returns true if all roles exist, false otherwise\n     */\n    validateRoles(authInfo: AuthenticationInfo, roles: string[]): boolean {\n      return sdk.validateTenantRoles(authInfo, null, roles);\n    },\n\n    /**\n     * Make sure that all given roles exist on the parsed JWT tenant claims\n     * @param authInfo JWT parsed info\n     * @param roles list of roles to make sure they exist on te JWT claims\n     * @returns true if all roles exist, false otherwise\n     */\n    validateTenantRoles(authInfo: AuthenticationInfo, tenant: string, roles: string[]): boolean {\n      const membership = getAuthorizationClaimItems(authInfo, rolesClaimName, tenant);\n      return roles.every((role) => membership.includes(role));\n    },\n  };\n\n  return wrapWith(\n    sdk,\n    [\n      'otp.verify.email',\n      'otp.verify.sms',\n      'otp.verify.whatsapp',\n      'magicLink.verify',\n      'enchantedLink.signUp',\n      'enchantedLink.signIn',\n      'oauth.exchange',\n      'saml.exchange',\n      'totp.verify',\n      'webauthn.signIn.finish',\n      'webauthn.signUp.finish',\n      'refresh',\n    ] as const,\n    withCookie,\n  );\n};\n\n/** Descope SDK client with delivery methods enum.\n *\n * Please see full documentation at {@link https://docs.descope.com/guides Descope Docs}\n * @example Usage\n *\n * ```js\n * import descopeSdk from '@descope/node-sdk';\n *\n * const myProjectId = 'xxx';\n * const sdk = descopeSdk({ projectId: myProjectId });\n *\n * const userLoginId = 'loginId';\n * sdk.otp.signIn.email(userLoginId);\n * const jwtResponse = sdk.otp.verify.email(userLoginId, codeFromEmail);\n * ```\n */\n\nnodeSdk.RefreshTokenCookieName = refreshTokenCookieName;\nnodeSdk.SessionTokenCookieName = sessionTokenCookieName;\n\nexport default nodeSdk;\nexport type {\n  DeliveryMethod,\n  OAuthProvider,\n  ResponseData,\n  SdkResponse,\n} from '@descope/core-js-sdk';\n","import { CoreSdk } from '../types';\nimport withUser from './user';\nimport withTenant from './tenant';\nimport withJWT from './jwt';\nimport withPermission from './permission';\nimport withRole from './role';\nimport withGroup from './group';\nimport withSSOSettings from './sso';\nimport withAccessKey from './accesskey';\nimport WithFlow from './flow';\nimport WithTheme from './theme';\n\n/** Constructs a higher level Management API that wraps the functions from code-js-sdk */\nconst withManagement = (sdk: CoreSdk, managementKey?: string) => ({\n  user: withUser(sdk, managementKey),\n  accessKey: withAccessKey(sdk, managementKey),\n  tenant: withTenant(sdk, managementKey),\n  sso: withSSOSettings(sdk, managementKey),\n  jwt: withJWT(sdk, managementKey),\n  permission: withPermission(sdk, managementKey),\n  role: withRole(sdk, managementKey),\n  group: withGroup(sdk, managementKey),\n  flow: WithFlow(sdk, managementKey),\n  theme: WithTheme(sdk, managementKey),\n});\n\nexport default withManagement;\n"],"names":["withCookie","fn","async","args","resp","data","_d","refreshJwt","rest","__rest","cookies","options","push","cookieDomain","cookieMaxAge","cookiePath","_a","response","headers","get","cookie","name","match","RegExp","getCookieValue","_b","_c","Object","assign","getAuthorizationClaimItems","authInfo","claim","tenant","value","token","Array","isArray","apiPaths","create","update","delete","deleteAllTestUsers","load","search","updateStatus","updateEmail","updatePhone","updateDisplayName","updatePicture","updateCustomAttribute","addRole","removeRole","addTenant","removeTenant","setPassword","expirePassword","generateOTPForTest","generateMagicLinkForTest","generateEnchantedLinkForTest","deactivate","activate","loadAll","settings","metadata","mapping","export","import","loadAllGroups","loadAllGroupsForMember","loadAllGroupMembers","withUser","sdk","managementKey","loginId","email","phone","displayName","roles","userTenants","customAttributes","picture","transformResponse","httpClient","post","roleNames","user","createTestUser","test","invite","queryParams","loadByUserId","userId","searchAll","tenantIds","limit","page","testUsersOnly","withTestUser","users","status","isVerified","verified","attributeKey","attributeValue","addRoles","removeRoles","tenantId","addTenantRoles","removeTenantRoles","generateOTPForTestUser","deliveryMethod","generateMagicLinkForTestUser","uri","URI","generateEnchantedLinkForTestUser","password","withTenant","selfProvisioningDomains","createWithId","id","tenants","withJWT","jwt","customClaims","withPermission","description","newName","permissions","withRole","permissionNames","withGroup","userIds","loginIds","groupId","withSSOSettings","getSettings","deleteSettings","configureSettings","idpURL","idpCert","entityId","redirectURL","domain","configureMetadata","idpMetadataURL","configureMapping","roleMapping","attributeMapping","withAccessKey","expireTime","keyTenants","key","keys","WithFlow","flowId","flow","screens","WithTheme","theme","globalThis","Headers","patchedFetch","forEach","arg","highWaterMark","nodeFetch","nodeSdk","config","coreSdk","createSdk","fetch","baseHeaders","process","versions","node","projectId","logger","management","accessKey","sso","permission","role","group","withManagement","header","kid","Error","publicKeys","then","json","Promise","all","map","importJWK","reduce","acc","jwk","toString","fetchKeys","jwtVerify","getKey","clockTolerance","payload","iss","split","pop","errors","JWTClaimValidationFailed","sessionToken","validateJwt","error","refreshToken","jwtResp","refresh","ok","sessionJwt","errorMessage","refreshTokenErr","validateSession","log","refreshSession","exchange","validatePermissions","validateTenantPermissions","granted","every","perm","includes","validateRoles","validateTenantRoles","membership","wrapWith","RefreshTokenCookieName","SessionTokenCookieName"],"mappings":"mNAEO,MC+BMA,EACVC,GACDC,SAAUC,eACR,MAAMC,QAAaH,KAAME,GAGzB,IAAKC,EAAKC,KACR,OAAOD,EAIT,IAAIE,EAA0BF,EAAKC,MAA/BE,WAAEA,GAAUD,EAAKE,EAAjBC,EAAAA,OAAAH,EAAA,CAAA,eACJ,MAAMI,EAAoB,GAlCP,IAA8BC,EAgDjD,OAZKJ,EASHG,EAAQE,KA5CZ,GDVoC,SCsDoBL,cA5C5BI,OADuBA,EA6CiBH,QA5CxC,EAAAG,EAASE,eAAgB,gBACnDF,aAAA,EAAAA,EAASG,eAAgB,aACjBH,aAAA,EAAAA,EAASI,aAAc,mCAkCZ,QAAbC,EAAAZ,EAAKa,gBAAQ,IAAAD,OAAA,EAAAA,EAAEE,QAAQC,IAAI,iBAC7BZ,EA3Be,EAACa,EAAmCC,KACzD,MAAMC,EAAQF,eAAAA,EAAQE,MAAMC,OAAO,cAAcF,cACjD,OAAOC,EAAQA,EAAM,GAAK,IAAI,EAyBXE,CACE,QAAbC,EAAArB,EAAKa,gBAAQ,IAAAQ,OAAA,EAAAA,EAAEP,QAAQC,IAAI,cDhDC,OCmD9BT,EAAQE,KAAoB,QAAfc,EAAAtB,EAAKa,gBAAU,IAAAS,OAAA,EAAAA,EAAAR,QAAQC,IAAI,gBAMhCQ,OAAAC,OAAAD,OAAAC,OAAA,CAAA,EAAAxB,GAAM,CAAAC,KAAWsB,OAAAC,OAAAD,OAAAC,OAAA,GAAAxB,EAAKC,MAAM,CAAAE,aAAYG,aAAY,WAUpDmB,EACdC,EACAC,EACAC,WAEA,MAAMC,EAAQD,EAC0C,QAApDP,EAA6C,QAA7CT,EAAAc,EAASI,MAAgC,eAAI,IAAAlB,OAAA,EAAAA,EAAAgB,UAAO,IAAAP,OAAA,EAAAA,EAAGM,GACvDD,EAASI,MAAMH,GACnB,OAAOI,MAAMC,QAAQH,GAASA,EAAQ,EACxC,CC7EA,IAAeI,EACP,CACJC,OAAQ,uBACRC,OAAQ,uBACRC,OAAQ,uBACRC,mBAAoB,gCACpBC,KAAM,gBACNC,OAAQ,uBACRC,aAAc,8BACdC,YAAa,6BACbC,YAAa,6BACbC,kBAAmB,4BACnBC,cAAe,+BACfC,sBAAuB,uCACvBC,QAAS,gCACTC,WAAY,mCACZC,UAAW,kCACXC,aAAc,qCACdC,YAAa,6BACbC,eAAgB,gCAChBC,mBAAoB,8BACpBC,yBAA0B,oCAC1BC,6BAA8B,yCAtBnBrB,EAwBF,CACTC,OAAQ,4BACRI,KAAM,qBACNC,OAAQ,4BACRJ,OAAQ,4BACRoB,WAAY,gCACZC,SAAU,8BACVpB,OAAQ,6BA/BGH,EAiCL,CACNC,OAAQ,yBACRC,OAAQ,yBACRC,OAAQ,yBACRqB,QAAS,uBArCExB,EAuCR,CACHyB,SAAU,wBACVC,SAAU,wBACVC,QAAS,wBA1CE3B,EA4CR,CACHE,OAAQ,uBA7CGF,EA+CD,CACVC,OAAQ,6BACRC,OAAQ,6BACRC,OAAQ,6BACRqB,QAAS,2BAnDExB,EAqDP,CACJC,OAAQ,uBACRC,OAAQ,uBACRC,OAAQ,uBACRqB,QAAS,qBAzDExB,EA2DP,CACJ4B,OAAQ,uBACRC,OAAQ,wBA7DG7B,EA+DN,CACL4B,OAAQ,wBACRC,OAAQ,yBAjEG7B,EAmEN,CACL8B,cAAe,qBACfC,uBAAwB,4BACxBC,oBAAqB,0BCpDzB,MAAMC,EAAW,CAACC,EAAcC,KAA4B,CAC1DlC,OAAQ,CACNmC,EACAC,EACAC,EACAC,EACAC,EACAC,EACAC,EACAC,IAEAC,EAAAA,kBACEV,EAAIW,WAAWC,KACb9C,EAAcC,OACd,CACEmC,UACAC,QACAC,QACAC,cACAQ,UAAWP,EACXC,cACAC,mBACAC,WAEF,CAAE9C,MAAOsC,KAEVnE,GAASA,EAAKgF,OAYnBC,eAAgB,CACdb,EACAC,EACAC,EACAC,EACAC,EACAC,EACAC,EACAC,IAEAC,EAAAA,kBACEV,EAAIW,WAAWC,KACb9C,EAAcC,OACd,CACEmC,UACAC,QACAC,QACAC,cACAQ,UAAWP,EACXC,cACAS,MAAM,EACNR,mBACAC,WAEF,CAAE9C,MAAOsC,KAEVnE,GAASA,EAAKgF,OAEnBG,OAAQ,CACNf,EACAC,EACAC,EACAC,EACAC,EACAC,EACAC,EACAC,IAEAC,EAAAA,kBACEV,EAAIW,WAAWC,KACb9C,EAAcC,OACd,CACEmC,UACAC,QACAC,QACAC,cACAQ,UAAWP,EACXC,cACAU,QAAQ,EACRT,mBACAC,WAEF,CAAE9C,MAAOsC,KAEVnE,GAASA,EAAKgF,OAEnB9C,OAAQ,CACNkC,EACAC,EACAC,EACAC,EACAC,EACAC,EACAC,EACAC,IAEAC,EAAAA,kBACEV,EAAIW,WAAWC,KACb9C,EAAcE,OACd,CACEkC,UACAC,QACAC,QACAC,cACAQ,UAAWP,EACXC,cACAC,mBACAC,WAEF,CAAE9C,MAAOsC,KAEVnE,GAASA,EAAKgF,OAEnB7C,OAASiC,GACPQ,EAAAA,kBACEV,EAAIW,WAAWC,KAAK9C,EAAcG,OAAQ,CAAEiC,WAAW,CAAEvC,MAAOsC,KAKpE/B,mBAAoB,IAClBwC,EAAAA,kBACEV,EAAIW,WAAW1C,OAAOH,EAAcI,mBAAoB,CAAEP,MAAOsC,KAErE9B,KAAO+B,GACLQ,EAAAA,kBACEV,EAAIW,WAAW/D,IAAIkB,EAAcK,KAAM,CACrC+C,YAAa,CAAEhB,WACfvC,MAAOsC,KAERnE,GAASA,EAAKgF,OAQnBK,aAAeC,GACbV,EAAAA,kBACEV,EAAIW,WAAW/D,IAAIkB,EAAcK,KAAM,CACrC+C,YAAa,CAAEE,UACfzD,MAAOsC,KAERnE,GAASA,EAAKgF,OAanBO,UAAW,CACTC,EACAhB,EACAiB,EACAC,EACAC,EACAC,EACAlB,IAEAE,EAAAA,kBACEV,EAAIW,WAAWC,KACb9C,EAAcM,OACd,CAAEkD,YAAWT,UAAWP,EAAOiB,QAAOC,OAAMC,gBAAeC,eAAclB,oBACzE,CAAE7C,MAAOsC,KAEVnE,GAASA,EAAK6F,QAEnBtC,SAAWa,GACTQ,EAAAA,kBACEV,EAAIW,WAAWC,KACb9C,EAAcO,aACd,CAAE6B,UAAS0B,OAAQ,WACnB,CAAEjE,MAAOsC,KAEVnE,GAASA,EAAKgF,OAEnB1B,WAAac,GACXQ,EAAAA,kBACEV,EAAIW,WAAWC,KACb9C,EAAcO,aACd,CAAE6B,UAAS0B,OAAQ,YACnB,CAAEjE,MAAOsC,KAEVnE,GAASA,EAAKgF,OAEnBxC,YAAa,CACX4B,EACAC,EACA0B,IAEAnB,EAAAA,kBACEV,EAAIW,WAAWC,KACb9C,EAAcQ,YACd,CAAE4B,UAASC,QAAO2B,SAAUD,GAC5B,CAAElE,MAAOsC,KAEVnE,GAASA,EAAKgF,OAEnBvC,YAAa,CACX2B,EACAE,EACAyB,IAEAnB,EAAAA,kBACEV,EAAIW,WAAWC,KACb9C,EAAcS,YACd,CAAE2B,UAASE,QAAO0B,SAAUD,GAC5B,CAAElE,MAAOsC,KAEVnE,GAASA,EAAKgF,OAEnBtC,kBAAmB,CAAC0B,EAAiBG,IACnCK,EAAiBA,kBACfV,EAAIW,WAAWC,KACb9C,EAAcU,kBACd,CAAE0B,UAASG,eACX,CAAE1C,MAAOsC,KAEVnE,GAASA,EAAKgF,OAEnBrC,cAAe,CAACyB,EAAiBO,IAC/BC,EAAiBA,kBACfV,EAAIW,WAAWC,KACb9C,EAAcW,cACd,CAAEyB,UAASO,WACX,CAAE9C,MAAOsC,KAEVnE,GAASA,EAAKgF,OAEnBpC,sBAAuB,CACrBwB,EACA6B,EACAC,IAEAtB,EAAAA,kBACEV,EAAIW,WAAWC,KACb9C,EAAcY,sBACd,CAAEwB,UAAS6B,eAAcC,kBACzB,CAAErE,MAAOsC,KAEVnE,GAASA,EAAKgF,OAEnBmB,SAAU,CAAC/B,EAAiBI,IAC1BI,EAAiBA,kBACfV,EAAIW,WAAWC,KACb9C,EAAca,QACd,CAAEuB,UAASW,UAAWP,GACtB,CAAE3C,MAAOsC,KAEVnE,GAASA,EAAKgF,OAEnBoB,YAAa,CAAChC,EAAiBI,IAC7BI,EAAiBA,kBACfV,EAAIW,WAAWC,KACb9C,EAAcc,WACd,CAAEsB,UAASW,UAAWP,GACtB,CAAE3C,MAAOsC,KAEVnE,GAASA,EAAKgF,OAEnBjC,UAAW,CAACqB,EAAiBiC,IAC3BzB,EAAiBA,kBACfV,EAAIW,WAAWC,KAAK9C,EAAce,UAAW,CAAEqB,UAASiC,YAAY,CAAExE,MAAOsC,KAC5EnE,GAASA,EAAKgF,OAEnBhC,aAAc,CAACoB,EAAiBiC,IAC9BzB,EAAiBA,kBACfV,EAAIW,WAAWC,KACb9C,EAAcgB,aACd,CAAEoB,UAASiC,YACX,CAAExE,MAAOsC,KAEVnE,GAASA,EAAKgF,OAEnBsB,eAAgB,CACdlC,EACAiC,EACA7B,IAEAI,EAAAA,kBACEV,EAAIW,WAAWC,KACb9C,EAAca,QACd,CAAEuB,UAASiC,WAAUtB,UAAWP,GAChC,CAAE3C,MAAOsC,KAEVnE,GAASA,EAAKgF,OAEnBuB,kBAAmB,CACjBnC,EACAiC,EACA7B,IAEAI,EAAAA,kBACEV,EAAIW,WAAWC,KACb9C,EAAcc,WACd,CAAEsB,UAASiC,WAAUtB,UAAWP,GAChC,CAAE3C,MAAOsC,KAEVnE,GAASA,EAAKgF,OAanBwB,uBAAwB,CACtBC,EACArC,IAEAQ,EAAAA,kBACEV,EAAIW,WAAWC,KACb9C,EAAcmB,mBACd,CAAEsD,iBAAgBrC,WAClB,CAAEvC,MAAOsC,KAEVnE,GAASA,IAcd0G,6BAA8B,CAC5BD,EACArC,EACAuC,IAEA/B,EAAAA,kBACEV,EAAIW,WAAWC,KACb9C,EAAcoB,yBACd,CAAEqD,iBAAgBrC,UAASwC,IAAKD,GAChC,CAAE9E,MAAOsC,KAEVnE,GAASA,IAad6G,iCAAkC,CAChCzC,EACAuC,IAEA/B,EAAiBA,kBACfV,EAAIW,WAAWC,KACb9C,EAAcqB,6BACd,CAAEe,UAASwC,IAAKD,GAChB,CAAE9E,MAAOsC,KAEVnE,GAASA,IAWdiD,YAAa,CAACmB,EAAiB0C,IAC7BlC,EAAAA,kBACEV,EAAIW,WAAWC,KACb9C,EAAciB,YACd,CAAEmB,UAAS0C,YACX,CAAEjF,MAAOsC,KAEVnE,GAASA,IASdkD,eAAiBkB,GACfQ,EAAiBA,kBACfV,EAAIW,WAAWC,KAAK9C,EAAckB,eAAgB,CAAEkB,WAAW,CAAEvC,MAAOsC,KACvEnE,GAASA,MCxaV+G,EAAa,CAAC7C,EAAcC,KAA4B,CAC5DlC,OAAQ,CACNjB,EACAgG,IAEApC,EAAiBA,kBACfV,EAAIW,WAAWC,KACb9C,EAAgBC,OAChB,CAAEjB,OAAMgG,2BACR,CAAEnF,MAAOsC,KAGf8C,aAAc,CACZC,EACAlG,EACAgG,IAEApC,EAAAA,kBACEV,EAAIW,WAAWC,KACb9C,EAAgBC,OAChB,CAAEiF,KAAIlG,OAAMgG,2BACZ,CAAEnF,MAAOsC,KAGfjC,OAAQ,CACNgF,EACAlG,EACAgG,IAEApC,EAAAA,kBACEV,EAAIW,WAAWC,KACb9C,EAAgBE,OAChB,CAAEgF,KAAIlG,OAAMgG,2BACZ,CAAEnF,MAAOsC,KAGfhC,OAAS+E,GACPtC,EAAAA,kBACEV,EAAIW,WAAWC,KAAK9C,EAAgBG,OAAQ,CAAE+E,MAAM,CAAErF,MAAOsC,KAEjEX,QAAS,IACPoB,EAAiBA,kBACfV,EAAIW,WAAW/D,IAAIkB,EAAgBwB,QAAS,CAC1C3B,MAAOsC,KAERnE,GAASA,EAAKmH,YCjDfC,EAAU,CAAClD,EAAcC,KAA4B,CACzDjC,OAAQ,CACNmF,EACAC,IAEA1C,EAAiBA,kBACfV,EAAIW,WAAWC,KAAK9C,EAAaE,OAAQ,CAAEmF,MAAKC,gBAAgB,CAAEzF,MAAOsC,OCFzEoD,EAAiB,CAACrD,EAAcC,KAA4B,CAChElC,OAAQ,CAACjB,EAAcwG,IACrB5C,EAAiBA,kBACfV,EAAIW,WAAWC,KACb9C,EAAoBC,OACpB,CAAEjB,OAAMwG,eACR,CAAE3F,MAAOsC,KAGfjC,OAAQ,CAAClB,EAAcyG,EAAiBD,IACtC5C,EAAAA,kBACEV,EAAIW,WAAWC,KACb9C,EAAoBE,OACpB,CAAElB,OAAMyG,UAASD,eACjB,CAAE3F,MAAOsC,KAGfhC,OAASnB,GACP4D,EAAAA,kBACEV,EAAIW,WAAWC,KAAK9C,EAAoBG,OAAQ,CAAEnB,QAAQ,CAAEa,MAAOsC,KAEvEX,QAAS,IACPoB,EAAiBA,kBACfV,EAAIW,WAAW/D,IAAIkB,EAAoBwB,QAAS,CAC9C3B,MAAOsC,KAERnE,GAASA,EAAK0H,gBC1BfC,EAAW,CAACzD,EAAcC,KAA4B,CAC1DlC,OAAQ,CACNjB,EACAwG,EACAI,IAEAhD,EAAAA,kBACEV,EAAIW,WAAWC,KACb9C,EAAcC,OACd,CAAEjB,OAAMwG,cAAaI,mBACrB,CAAE/F,MAAOsC,KAGfjC,OAAQ,CACNlB,EACAyG,EACAD,EACAI,IAEAhD,oBACEV,EAAIW,WAAWC,KACb9C,EAAcE,OACd,CAAElB,OAAMyG,UAASD,cAAaI,mBAC9B,CAAE/F,MAAOsC,KAGfhC,OAASnB,GACP4D,EAAAA,kBACEV,EAAIW,WAAWC,KAAK9C,EAAcG,OAAQ,CAAEnB,QAAQ,CAAEa,MAAOsC,KAEjEX,QAAS,IACPoB,EAAiBA,kBACfV,EAAIW,WAAW/D,IAAIkB,EAAcwB,QAAS,CACxC3B,MAAOsC,KAERnE,GAASA,EAAKwE,UCvCfqD,EAAY,CAAC3D,EAAcC,KAA4B,CAM3DL,cAAgBuC,GACdzB,EAAAA,kBACEV,EAAIW,WAAWC,KAAK9C,EAAe8B,cAAe,CAAEuC,YAAY,CAAExE,MAAOsC,KAU7EJ,uBAAwB,CACtBsC,EACAyB,EACAC,IAEAnD,EAAAA,kBACEV,EAAIW,WAAWC,KACb9C,EAAe+B,uBACf,CAAEsC,WAAU0B,WAAUD,WACtB,CAAEjG,MAAOsC,KAUfH,oBAAqB,CAACqC,EAAkB2B,IACtCpD,EAAiBA,kBACfV,EAAIW,WAAWC,KACb9C,EAAegC,oBACf,CAAEqC,WAAU2B,WACZ,CAAEnG,MAAOsC,OC1CX8D,EAAkB,CAAC/D,EAAcC,KAA4B,CACjE+D,YAAc7B,GACZzB,EAAAA,kBACEV,EAAIW,WAAW/D,IAAIkB,EAAayB,SAAU,CACxC2B,YAAa,CAAEiB,YACfxE,MAAOsC,KAERnE,GAASA,IAEdmI,eAAiB9B,GACfzB,EAAAA,kBACEV,EAAIW,WAAW1C,OAAOH,EAAayB,SAAU,CAC3C2B,YAAa,CAAEiB,YACfxE,MAAOsC,KAGbiE,kBAAmB,CACjB/B,EACAgC,EACAC,EACAC,EACAC,EACAC,IAEA7D,EAAiBA,kBACfV,EAAIW,WAAWC,KACb9C,EAAayB,SACb,CAAE4C,WAAUgC,SAAQE,WAAUD,UAASE,cAAaC,UACpD,CAAE5G,MAAOsC,KAGfuE,kBAAmB,CAACrC,EAAkBsC,IACpC/D,EAAiBA,kBACfV,EAAIW,WAAWC,KACb9C,EAAa0B,SACb,CAAE2C,WAAUsC,kBACZ,CAAE9G,MAAOsC,KAGfyE,iBAAkB,CAChBvC,EACAwC,EACAC,IAEAlE,EAAAA,kBACEV,EAAIW,WAAWC,KACb9C,EAAa2B,QACb,CAAE0C,WAAUwC,cAAaC,oBACzB,CAAEjH,MAAOsC,OCxCX4E,EAAgB,CAAC7E,EAAcC,KAA4B,CAS/DlC,OAAQ,CACNjB,EACAgI,EACAxE,EACAyE,IAEArE,EAAAA,kBACEV,EAAIW,WAAWC,KACb9C,EAAmBC,OACnB,CAAEjB,OAAMgI,aAAYjE,UAAWP,EAAOyE,cACtC,CAAEpH,MAAOsC,KAQf9B,KAAO6E,GACLtC,EAAAA,kBACEV,EAAIW,WAAW/D,IAAIkB,EAAmBK,KAAM,CAC1C+C,YAAa,CAAE8B,MACfrF,MAAOsC,KAERnE,GAASA,EAAKkJ,MAOnB3D,UAAYC,GACVZ,oBACEV,EAAIW,WAAWC,KAAK9C,EAAmBM,OAAQ,CAAEkD,aAAa,CAAE3D,MAAOsC,KACtEnE,GAASA,EAAKmJ,OAQnBjH,OAAQ,CAACgF,EAAYlG,IACnB4D,EAAiBA,kBACfV,EAAIW,WAAWC,KAAK9C,EAAmBE,OAAQ,CAAEgF,KAAIlG,QAAQ,CAAEa,MAAOsC,KACrEnE,GAASA,EAAKkJ,MAOnB5F,WAAa4D,GACXtC,EAAAA,kBACEV,EAAIW,WAAWC,KAAK9C,EAAmBsB,WAAY,CAAE4D,MAAM,CAAErF,MAAOsC,KAMxEZ,SAAW2D,GACTtC,EAAAA,kBACEV,EAAIW,WAAWC,KAAK9C,EAAmBuB,SAAU,CAAE2D,MAAM,CAAErF,MAAOsC,KAMtEhC,OAAS+E,GACPtC,EAAAA,kBACEV,EAAIW,WAAWC,KAAK9C,EAAmBG,OAAQ,CAAE+E,MAAM,CAAErF,MAAOsC,OCvFhEiF,EAAW,CAAClF,EAAcC,KAA4B,CAC1DP,OAASyF,GACPzE,EAAAA,kBACEV,EAAIW,WAAWC,KAAK9C,EAAc4B,OAAQ,CAAEyF,UAAU,CAAExH,MAAOsC,KAEnEN,OAAQ,CAACwF,EAAgBC,EAAYC,IACnC3E,EAAAA,kBACEV,EAAIW,WAAWC,KACb9C,EAAc6B,OACd,CAAEwF,SAAQC,OAAMC,WAChB,CAAE1H,MAAOsC,OCVXqF,EAAY,CAACtF,EAAcC,KAA4B,CAC3DP,OAAQ,IACNgB,EAAiBA,kBAACV,EAAIW,WAAWC,KAAK9C,EAAe4B,OAAQ,CAAE,EAAE,CAAE/B,MAAOsC,KAC5EN,OAAS4F,GACP7E,EAAAA,kBACEV,EAAIW,WAAWC,KAAK9C,EAAe6B,OAAQ,CAAE4F,SAAS,CAAE5H,MAAOsC,aCRnD,QAAlBxD,EAAA+I,WAAWC,eAAO,IAAAhJ,IAAlB+I,WAAWC,QAAYA,EAAOA,SAE9B,MAGMC,EAAe,IAAI9J,KAGvBA,EAAK+J,SAASC,YAEZA,YAASnJ,GAAAS,EAAA0I,GAAYC,+BAAAA,cARD,UAQmC,IAGlDC,EAAS,WAAIlK,ICKhBmK,EAAWtJ,WAAAwD,cAAEA,GAAuCxD,EAArBuJ,EAAM9J,EAAAA,OAAAO,EAA1B,mBACf,MAAMwJ,EAAUC,UACX9I,OAAAC,OAAAD,OAAAC,OAAA,CAAA,EAAA2I,UACHG,EACAC,YAAWhJ,OAAAC,OAAAD,OAAAC,OAAA,CAAA,EACN2I,EAAOI,cACV,qBAAsB,SACtB,8BAAiD,UAAZ,OAAPC,cAAO,IAAPA,aAAO,EAAPA,QAASC,gBAAU,IAAApJ,OAAA,EAAAA,EAAAqJ,OAAQ,GACzD,wBAAyB,cAIvBC,UAAEA,EAASC,OAAEA,GAAWT,EAExBf,EAA6C,CAAA,EAmB7CyB,ECxCe,EAAC1G,EAAcC,KAA4B,CAChEa,KAAMf,EAASC,EAAKC,GACpB0G,UAAW9B,EAAc7E,EAAKC,GAC9BxC,OAAQoF,EAAW7C,EAAKC,GACxB2G,IAAK7C,EAAgB/D,EAAKC,GAC1BkD,IAAKD,EAAQlD,EAAKC,GAClB4G,WAAYxD,EAAerD,EAAKC,GAChC6G,KAAMrD,EAASzD,EAAKC,GACpB8G,MAAOpD,EAAU3D,EAAKC,GACtBmF,KAAMF,EAASlF,EAAKC,GACpBsF,MAAOD,EAAUtF,EAAKC,KD8BH+G,CAAef,EAAShG,GAErCD,iCACDiG,GAAO,CAOVS,aAGA/K,aAAasL,GACX,KAAKA,aAAA,EAAAA,EAAQC,KAAK,MAAMC,MAAM,gCAE9B,GAAIlC,EAAKgC,EAAOC,KAAM,OAAOjC,EAAKgC,EAAOC,KAKzC,GAFA9J,OAAOC,OAAO4H,OAnCAtJ,WAChB,MAGMyL,SAHoBnB,EAAQtF,WAC/B/D,IAAI,WAAW4J,KACfa,MAAMxL,GAASA,EAAKyL,UACerC,KACtC,OAAKrH,MAAMC,QAAQuJ,UACQG,QAAQC,IACjCJ,EAAWK,KAAI9L,MAAOqJ,GAAQ,CAACA,EAAIkC,UAAWQ,EAAAA,UAAU1C,QAGtC2C,QAClB,CAACC,GAAMV,EAAKW,KAAUX,EAAW9J,OAAAC,OAAAD,OAAAC,OAAA,CAAA,EAAAuK,IAAK,CAACV,EAAIY,YAAaD,IAAQD,GAChE,CAAE,GAPmC,EAQtC,EAsB2BG,KAErB9C,EAAKgC,EAAOC,KAAM,MAAMC,MAAM,gCAEnC,OAAOlC,EAAKgC,EAAOC,IACpB,EAODvL,kBAAkBwH,SAEhB,MACMxF,SADYqK,EAASA,UAAC7E,EAAKnD,EAAIiI,OAAQ,CAAEC,eAAgB,KAC7CC,QAElB,GAAIxK,IACFA,EAAMyK,IAAe,QAAT3L,EAAAkB,EAAMyK,WAAG,IAAA3L,OAAA,EAAAA,EAAE4L,MAAM,KAAKC,MAC9B3K,EAAMyK,MAAQ5B,GAEhB,MAAM,IAAI+B,EAAMA,OAACC,yBACf,+BACA,MACA,gBAKN,MAAO,CAAErF,MAAKxF,QACf,EAODhC,sBAAsB8M,GACpB,IAAKA,EAAc,MAAMtB,MAAM,4CAE/B,IAEE,aADoBnH,EAAI0I,YAAYD,EAMrC,CAJC,MAAOE,GAGP,MADAlC,SAAAA,EAAQkC,MAAM,4BAA6BA,GACrCxB,MAAM,4BACb,CACF,EAODxL,qBAAqBiN,WACnB,IAAKA,EAAc,MAAMzB,MAAM,kDAE/B,UACQnH,EAAI0I,YAAYE,GACtB,MAAMC,QAAgB7I,EAAI8I,QAAQF,GAClC,GAAIC,EAAQE,GAAI,CAEd,aADoB/I,EAAI0I,YAA0B,QAAdjM,EAAAoM,EAAQ/M,YAAM,IAAAW,OAAA,EAAAA,EAAAuM,WAEnD,CAED,MAAM7B,MAAmB,QAAbjK,EAAA2L,EAAQF,aAAK,IAAAzL,OAAA,EAAAA,EAAE+L,aAK5B,CAJC,MAAOC,GAGP,MADAzC,SAAAA,EAAQkC,MAAM,kCAAmCO,GAC3C/B,MAAM,kCACb,CACF,EAQDxL,gCACE8M,EACAG,GAEA,IAAKH,IAAiBG,EAAc,MAAMzB,MAAM,6CAEhD,IAEE,aADoBnH,EAAImJ,gBAAgBV,EAKzC,CAHC,MAAOE,GAEPlC,SAAAA,EAAQ2C,IAAI,mDACb,CAED,OAAOpJ,EAAIqJ,eAAeT,EAC3B,EAODjN,wBAAwBgL,GACtB,IAAKA,EAAW,MAAMQ,MAAM,gCAE5B,IAAItL,EACJ,IACEA,QAAamE,EAAI2G,UAAU2C,SAAS3C,EAIrC,CAHC,MAAOgC,GAEP,MADAlC,SAAAA,EAAQkC,MAAM,gCAAiCA,GACzCxB,MAAM,gCACb,CAED,MAAM6B,WAAEA,GAAenN,EAAKC,KAC5B,IAAKkN,EAEH,MADAvC,SAAAA,EAAQkC,MAAM,gDACRxB,MAAM,iCAGd,IAEE,aADoBnH,EAAI0I,YAAYM,EAKrC,CAHC,MAAOL,GAEP,MADAlC,SAAAA,EAAQkC,MAAM,sCAAuCA,GAC/CxB,MAAM,gCACb,CACF,EAQDoC,oBAAmB,CAAChM,EAA8BiG,IACzCxD,EAAIwJ,0BAA0BjM,EAAU,KAAMiG,GASvDgG,0BACEjM,EACAE,EACA+F,GAEA,MAAMiG,EAAUnM,EAA2BC,EdrNb,ccqN6CE,GAC3E,OAAO+F,EAAYkG,OAAOC,GAASF,EAAQG,SAASD,IACrD,EAQDE,cAAa,CAACtM,EAA8B+C,IACnCN,EAAI8J,oBAAoBvM,EAAU,KAAM+C,GASjDwJ,oBAAoBvM,EAA8BE,EAAgB6C,GAChE,MAAMyJ,EAAazM,EAA2BC,EdxOtB,QcwOgDE,GACxE,OAAO6C,EAAMoJ,OAAO5C,GAASiD,EAAWH,SAAS9C,IAClD,IAGH,OAAOkD,EAAAA,SACLhK,EACA,CACE,mBACA,iBACA,sBACA,mBACA,uBACA,uBACA,iBACA,gBACA,cACA,yBACA,yBACA,WAEFvE,EACD,EAoBHsK,EAAQkE,uBd1R8B,Mc2RtClE,EAAQmE,uBdzR8B"}