@descope/node-sdk 1.5.0 → 1.5.1

package/README.md

@@ -15,10 +15,13 @@ Install the package with:
 npm i --save @descope/node-sdk
 ```
 
-## Setup
+## Authentication Functions
 
-A Descope `Project ID` is required to initialize the SDK. Find it on the
-[project page in the Descope Console](https://app.descope.com/settings/project).
+### Setup
+
+Before you can use authentication functions listed below, you must initialize `descopeClient` to use all of the built-in SDK functions.
+
+You'll need your Descope `Project ID` to create this, and you can find it on the [project page](https://app.descope.com/settings/project) in the Descope Console.
 
 ```typescript
 import DescopeClient from '@descope/node-sdk';
@@ -26,9 +29,53 @@ import DescopeClient from '@descope/node-sdk';
 const descopeClient = DescopeClient({ projectId: 'my-project-ID' });
 ```
 
-## Usage
+Once you've created a `descopeClient`, you can use that to work with the following functions:
+
+1. [OTP Authentication](#otp-authentication)
+2. [Magic Link](#magic-link)
+3. [Enchanted Link](#enchanted-link)
+4. [OAuth](#oauth)
+5. [SSO/SAML](#ssosaml)
+6. [TOTP Authentication](#totp-authentication)
+7. [Passwords](#passwords)
+8. [Session Validation](#session-validation)
+9. [Roles & Permission Validation](#roles--permission-validation)
+10. [Logging Out](#logging-out)
+
+## Management Functions
+
+### Setup
+
+Before you can use management functions listed below, you must initialize `descopeClient`.
 
-Here are some examples how to manage and authenticate users:
+If you wish to also use management functions, you will need to initialize a new version of your `descopeClient`, but this time with a `ManagementKey` as well as your `Project ID`. Create a management key in the [Descope Console](https://app.descope.com/settings/company/managementkeys).
+
+```typescript
+import DescopeClient from '@descope/node-sdk';
+
+const descopeClient = DescopeClient({
+  projectId: 'my-project-ID',
+  managementKey: 'management-key',
+});
+```
+
+Then, you can use that to work with the following functions:
+
+1. [Manage Tenants](#manage-tenants)
+2. [Manage Users](#manage-users)
+3. [Manage Access Keys](#manage-access-keys)
+4. [Manage SSO Setting](#manage-sso-setting)
+5. [Manage Permissions](#manage-permissions)
+6. [Manage Roles](#manage-roles)
+7. [Query SSO Groups](#query-sso-groups)
+8. [Manage Flows](#manage-flows)
+9. [Manage JWTs](#manage-jwts)
+
+If you wish to run any of our code samples and play with them, check out our [Code Examples](#code-examples) section.
+
+If you're performing end-to-end testing, check out the [Utils for your end to end (e2e) tests and integration tests](#utils-for-your-end-to-end-e2e-tests-and-integration-tests) section. You will need to use the `descopeClient` you created under the setup of [Management Functions](#management-functions).
+
+---
 
 ### OTP Authentication
 
@@ -399,10 +446,10 @@ invalidate all user's refresh tokens. After calling this function, you must inva
 await descopeClient.logoutAll(refreshToken);
 ```
 
-## Management API
+## Management Functions
 
 It is very common for some form of management or automation to be required. These can be performed
-using the management API. Please note that these actions are more sensitive as they are administrative
+using the management functions. Please note that these actions are more sensitive as they are administrative
 in nature. Please use responsibly.
 
 ### Setup
@@ -511,6 +558,20 @@ usersRes.data.forEach((user) => {
 });
 ```
 
+#### Set or Expire User Password
+
+You can set or expire a user's password.
+Note: When setting a password, it will automatically be set as expired.
+The user will not be able log-in using an expired password, and will be required replace it on next login.
+
+```typescript
+// Set a user's password
+await descopeClient.management.user.setPassword('<login-ID>', '<some-password>');
+
+// Or alternatively, expire a user password
+await descopeClient.management.user.expirePassword('<login-ID>');
+```
+
 ### Manage Access Keys
 
 You can create, update, delete or load access keys, as well as search according to filters:
@@ -585,6 +646,9 @@ Certifcate contents
 -----END CERTIFICATE-----
 ```
 
+// You can delete SSO settings for a specific tenant ID
+await descopeClient.management.sso.deleteSettings("tenant-id")
+
 ### Manage Permissions
 
 You can create, update, delete or load permissions:

package/dist/cjs/index.cjs.js

@@ -1,2 +1,2 @@
-"use strict";var e=require("tslib"),t=require("@descope/core-js-sdk"),s=require("jose"),n=require("node-fetch-commonjs");function o(e){return e&&"object"==typeof e&&"default"in e?e:{default:e}}var a=o(t),r=o(n);const i=t=>async(...s)=>{var n,o,a;const r=await t(...s);if(!r.data)return r;let i=r.data,{refreshJwt:l}=i,p=e.__rest(i,["refreshJwt"]);const d=[];var m;return l?d.push(`${"DSR"}=${l}; Domain=${(null==(m=p)?void 0:m.cookieDomain)||""}; Max-Age=${(null==m?void 0:m.cookieMaxAge)||""}; Path=${(null==m?void 0:m.cookiePath)||"/"}; HttpOnly; SameSite=Strict`):(null===(n=r.response)||void 0===n?void 0:n.headers.get("set-cookie"))&&(l=((e,t)=>{const s=null==e?void 0:e.match(RegExp(`(?:^|;\\s*)${t}=([^;]*)`));return s?s[1]:null})(null===(o=r.response)||void 0===o?void 0:o.headers.get("set-cookie"),"DSR"),d.push(null===(a=r.response)||void 0===a?void 0:a.headers.get("set-cookie"))),Object.assign(Object.assign({},r),{data:Object.assign(Object.assign({},r.data),{refreshJwt:l,cookies:d})})};function l(e,t,s){var n,o;const a=s?null===(o=null===(n=e.token.tenants)||void 0===n?void 0:n[s])||void 0===o?void 0:o[t]:e.token[t];return Array.isArray(a)?a:[]}var p={create:"/v1/mgmt/user/create",update:"/v1/mgmt/user/update",delete:"/v1/mgmt/user/delete",deleteAllTestUsers:"/v1/mgmt/user/test/delete/all",load:"/v1/mgmt/user",search:"/v1/mgmt/user/search",updateStatus:"/v1/mgmt/user/update/status",updateEmail:"/v1/mgmt/user/update/email",updatePhone:"/v1/mgmt/user/update/phone",updateDisplayName:"/v1/mgmt/user/update/name",updatePicture:"/v1/mgmt/user/update/picture",updateCustomAttribute:"/v1/mgmt/user/update/customAttribute",addRole:"/v1/mgmt/user/update/role/add",removeRole:"/v1/mgmt/user/update/role/remove",addTenant:"/v1/mgmt/user/update/tenant/add",removeTenant:"/v1/mgmt/user/update/tenant/remove",generateOTPForTest:"/v1/mgmt/tests/generate/otp",generateMagicLinkForTest:"/v1/mgmt/tests/generate/magiclink",generateEnchantedLinkForTest:"/v1/mgmt/tests/generate/enchantedlink"},d={create:"/v1/mgmt/accesskey/create",load:"/v1/mgmt/accesskey",search:"/v1/mgmt/accesskey/search",update:"/v1/mgmt/accesskey/update",deactivate:"/v1/mgmt/accesskey/deactivate",activate:"/v1/mgmt/accesskey/activate",delete:"/v1/mgmt/accesskey/delete"},m={create:"/v1/mgmt/tenant/create",update:"/v1/mgmt/tenant/update",delete:"/v1/mgmt/tenant/delete",loadAll:"/v1/mgmt/tenant/all"},u={settings:"/v1/mgmt/sso/settings",metadata:"/v1/mgmt/sso/metadata",mapping:"/v1/mgmt/sso/mapping"},c={update:"/v1/mgmt/jwt/update"},g={create:"/v1/mgmt/permission/create",update:"/v1/mgmt/permission/update",delete:"/v1/mgmt/permission/delete",loadAll:"/v1/mgmt/permission/all"},h={create:"/v1/mgmt/role/create",update:"/v1/mgmt/role/update",delete:"/v1/mgmt/role/delete",loadAll:"/v1/mgmt/role/all"},v={export:"/v1/mgmt/flow/export",import:"/v1/mgmt/flow/import"},f={export:"/v1/mgmt/theme/export",import:"/v1/mgmt/theme/import"},k={loadAllGroups:"/v1/mgmt/group/all",loadAllGroupsForMember:"/v1/mgmt/group/member/all",loadAllGroupMembers:"/v1/mgmt/group/members"};const R=(e,s)=>({create:(n,o,a,r,i,l,d,m)=>t.transformResponse(e.httpClient.post(p.create,{loginId:n,email:o,phone:a,displayName:r,roleNames:i,userTenants:l,customAttributes:d,picture:m},{token:s}),(e=>e.user)),createTestUser:(n,o,a,r,i,l,d,m)=>t.transformResponse(e.httpClient.post(p.create,{loginId:n,email:o,phone:a,displayName:r,roleNames:i,userTenants:l,test:!0,customAttributes:d,picture:m},{token:s}),(e=>e.user)),invite:(n,o,a,r,i,l,d,m)=>t.transformResponse(e.httpClient.post(p.create,{loginId:n,email:o,phone:a,displayName:r,roleNames:i,userTenants:l,invite:!0,customAttributes:d,picture:m},{token:s}),(e=>e.user)),update:(n,o,a,r,i,l,d,m)=>t.transformResponse(e.httpClient.post(p.update,{loginId:n,email:o,phone:a,displayName:r,roleNames:i,userTenants:l,customAttributes:d,picture:m},{token:s}),(e=>e.user)),delete:n=>t.transformResponse(e.httpClient.post(p.delete,{loginId:n},{token:s})),deleteAllTestUsers:()=>t.transformResponse(e.httpClient.delete(p.deleteAllTestUsers,{},{token:s})),load:n=>t.transformResponse(e.httpClient.get(p.load,{queryParams:{loginId:n},token:s}),(e=>e.user)),loadByUserId:n=>t.transformResponse(e.httpClient.get(p.load,{queryParams:{userId:n},token:s}),(e=>e.user)),searchAll:(n,o,a,r,i,l,d)=>t.transformResponse(e.httpClient.post(p.search,{tenantIds:n,roleNames:o,limit:a,page:r,testUsersOnly:i,withTestUser:l,customAttributes:d},{token:s}),(e=>e.users)),activate:n=>t.transformResponse(e.httpClient.post(p.updateStatus,{loginId:n,status:"enabled"},{token:s}),(e=>e.user)),deactivate:n=>t.transformResponse(e.httpClient.post(p.updateStatus,{loginId:n,status:"disabled"},{token:s}),(e=>e.user)),updateEmail:(n,o,a)=>t.transformResponse(e.httpClient.post(p.updateEmail,{loginId:n,email:o,verified:a},{token:s}),(e=>e.user)),updatePhone:(n,o,a)=>t.transformResponse(e.httpClient.post(p.updatePhone,{loginId:n,phone:o,verified:a},{token:s}),(e=>e.user)),updateDisplayName:(n,o)=>t.transformResponse(e.httpClient.post(p.updateDisplayName,{loginId:n,displayName:o},{token:s}),(e=>e.user)),updatePicture:(n,o)=>t.transformResponse(e.httpClient.post(p.updatePicture,{loginId:n,picture:o},{token:s}),(e=>e.user)),updateCustomAttribute:(n,o,a)=>t.transformResponse(e.httpClient.post(p.updateCustomAttribute,{loginId:n,attributeKey:o,attributeValue:a},{token:s}),(e=>e.user)),addRoles:(n,o)=>t.transformResponse(e.httpClient.post(p.addRole,{loginId:n,roleNames:o},{token:s}),(e=>e.user)),removeRoles:(n,o)=>t.transformResponse(e.httpClient.post(p.removeRole,{loginId:n,roleNames:o},{token:s}),(e=>e.user)),addTenant:(n,o)=>t.transformResponse(e.httpClient.post(p.addTenant,{loginId:n,tenantId:o},{token:s}),(e=>e.user)),removeTenant:(n,o)=>t.transformResponse(e.httpClient.post(p.removeTenant,{loginId:n,tenantId:o},{token:s}),(e=>e.user)),addTenantRoles:(n,o,a)=>t.transformResponse(e.httpClient.post(p.addRole,{loginId:n,tenantId:o,roleNames:a},{token:s}),(e=>e.user)),removeTenantRoles:(n,o,a)=>t.transformResponse(e.httpClient.post(p.removeRole,{loginId:n,tenantId:o,roleNames:a},{token:s}),(e=>e.user)),generateOTPForTestUser:(n,o)=>t.transformResponse(e.httpClient.post(p.generateOTPForTest,{deliveryMethod:n,loginId:o},{token:s}),(e=>e)),generateMagicLinkForTestUser:(n,o,a)=>t.transformResponse(e.httpClient.post(p.generateMagicLinkForTest,{deliveryMethod:n,loginId:o,URI:a},{token:s}),(e=>e)),generateEnchantedLinkForTestUser:(n,o)=>t.transformResponse(e.httpClient.post(p.generateEnchantedLinkForTest,{loginId:n,URI:o},{token:s}),(e=>e))}),y=(e,s)=>({create:(n,o)=>t.transformResponse(e.httpClient.post(m.create,{name:n,selfProvisioningDomains:o},{token:s})),createWithId:(n,o,a)=>t.transformResponse(e.httpClient.post(m.create,{id:n,name:o,selfProvisioningDomains:a},{token:s})),update:(n,o,a)=>t.transformResponse(e.httpClient.post(m.update,{id:n,name:o,selfProvisioningDomains:a},{token:s})),delete:n=>t.transformResponse(e.httpClient.post(m.delete,{id:n},{token:s})),loadAll:()=>t.transformResponse(e.httpClient.get(m.loadAll,{token:s}),(e=>e.tenants))}),C=(e,s)=>({update:(n,o)=>t.transformResponse(e.httpClient.post(c.update,{jwt:n,customClaims:o},{token:s}))}),w=(e,s)=>({create:(n,o)=>t.transformResponse(e.httpClient.post(g.create,{name:n,description:o},{token:s})),update:(n,o,a)=>t.transformResponse(e.httpClient.post(g.update,{name:n,newName:o,description:a},{token:s})),delete:n=>t.transformResponse(e.httpClient.post(g.delete,{name:n},{token:s})),loadAll:()=>t.transformResponse(e.httpClient.get(g.loadAll,{token:s}),(e=>e.permissions))}),I=(e,s)=>({create:(n,o,a)=>t.transformResponse(e.httpClient.post(h.create,{name:n,description:o,permissionNames:a},{token:s})),update:(n,o,a,r)=>t.transformResponse(e.httpClient.post(h.update,{name:n,newName:o,description:a,permissionNames:r},{token:s})),delete:n=>t.transformResponse(e.httpClient.post(h.delete,{name:n},{token:s})),loadAll:()=>t.transformResponse(e.httpClient.get(h.loadAll,{token:s}),(e=>e.roles))}),b=(e,s)=>({loadAllGroups:n=>t.transformResponse(e.httpClient.post(k.loadAllGroups,{tenantId:n},{token:s})),loadAllGroupsForMember:(n,o,a)=>t.transformResponse(e.httpClient.post(k.loadAllGroupsForMember,{tenantId:n,loginIds:a,userIds:o},{token:s})),loadAllGroupMembers:(n,o)=>t.transformResponse(e.httpClient.post(k.loadAllGroupMembers,{tenantId:n,groupId:o},{token:s}))}),T=(e,s)=>({getSettings:n=>t.transformResponse(e.httpClient.get(u.settings,{queryParams:{tenantId:n},token:s}),(e=>e)),configureSettings:(n,o,a,r,i,l)=>t.transformResponse(e.httpClient.post(u.settings,{tenantId:n,idpURL:o,entityId:r,idpCert:a,redirectURL:i,domain:l},{token:s})),configureMetadata:(n,o)=>t.transformResponse(e.httpClient.post(u.metadata,{tenantId:n,idpMetadataURL:o},{token:s})),configureMapping:(n,o,a)=>t.transformResponse(e.httpClient.post(u.mapping,{tenantId:n,roleMapping:o,attributeMapping:a},{token:s}))}),A=(e,s)=>({create:(n,o,a,r)=>t.transformResponse(e.httpClient.post(d.create,{name:n,expireTime:o,roleNames:a,keyTenants:r},{token:s})),load:n=>t.transformResponse(e.httpClient.get(d.load,{queryParams:{id:n},token:s}),(e=>e.key)),searchAll:n=>t.transformResponse(e.httpClient.post(d.search,{tenantIds:n},{token:s}),(e=>e.keys)),update:(n,o)=>t.transformResponse(e.httpClient.post(d.update,{id:n,name:o},{token:s}),(e=>e.key)),deactivate:n=>t.transformResponse(e.httpClient.post(d.deactivate,{id:n},{token:s})),activate:n=>t.transformResponse(e.httpClient.post(d.activate,{id:n},{token:s})),delete:n=>t.transformResponse(e.httpClient.post(d.delete,{id:n},{token:s}))}),j=(e,s)=>({export:n=>t.transformResponse(e.httpClient.post(v.export,{flowId:n},{token:s})),import:(n,o,a)=>t.transformResponse(e.httpClient.post(v.import,{flowId:n,flow:o,screens:a},{token:s}))}),x=(e,s)=>({export:()=>t.transformResponse(e.httpClient.post(f.export,{},{token:s})),import:n=>t.transformResponse(e.httpClient.post(f.import,{theme:n},{token:s}))});var N;null!==(N=globalThis.Headers)&&void 0!==N||(globalThis.Headers=n.Headers);const P=(...e)=>(e.forEach((e=>{var t,s;e&&(null!==(t=(s=e).highWaterMark)&&void 0!==t||(s.highWaterMark=31457280))})),r.default(...e)),M=n=>{var o,{managementKey:r}=n,p=e.__rest(n,["managementKey"]);const d=a.default(Object.assign(Object.assign({},p),{fetch:P,baseHeaders:Object.assign(Object.assign({},p.baseHeaders),{"x-descope-sdk-name":"nodejs","x-descope-sdk-node-version":(null===(o=null===process||void 0===process?void 0:process.versions)||void 0===o?void 0:o.node)||"","x-descope-sdk-version":"1.5.0"})})),{projectId:m,logger:u}=p,c={},g=((e,t)=>({user:R(e,t),accessKey:A(e,t),tenant:y(e,t),sso:T(e,t),jwt:C(e,t),permission:w(e,t),role:I(e,t),group:b(e,t),flow:j(e,t),theme:x(e,t)}))(d,r),h=Object.assign(Object.assign({},d),{management:g,async getKey(e){if(!(null==e?void 0:e.kid))throw Error("header.kid must not be empty");if(c[e.kid])return c[e.kid];if(Object.assign(c,await(async()=>{const e=(await d.httpClient.get(`v2/keys/${m}`).then((e=>e.json()))).keys;return Array.isArray(e)?(await Promise.all(e.map((async e=>[e.kid,await s.importJWK(e)])))).reduce(((e,[t,s])=>t?Object.assign(Object.assign({},e),{[t.toString()]:s}):e),{}):{}})()),!c[e.kid])throw Error("failed to fetch matching key");return c[e.kid]},async validateJwt(e){var t;const n=(await s.jwtVerify(e,h.getKey,{clockTolerance:5})).payload;if(n&&(n.iss=null===(t=n.iss)||void 0===t?void 0:t.split("/").pop(),n.iss!==m))throw new s.errors.JWTClaimValidationFailed('unexpected "iss" claim value',"iss","check_failed");return{jwt:e,token:n}},async validateSession(e){if(!e)throw Error("session token is required for validation");try{return await h.validateJwt(e)}catch(e){throw null==u||u.error("session validation failed",e),Error("session validation failed")}},async refreshSession(e){var t,s;if(!e)throw Error("refresh token is required to refresh a session");try{await h.validateJwt(e);const n=await h.refresh(e);if(n.ok){return await h.validateJwt(null===(t=n.data)||void 0===t?void 0:t.sessionJwt)}throw Error(null===(s=n.error)||void 0===s?void 0:s.errorMessage)}catch(e){throw null==u||u.error("refresh token validation failed",e),Error("refresh token validation failed")}},async validateAndRefreshSession(e,t){if(!e&&!t)throw Error("both session and refresh tokens are empty");try{return await h.validateSession(e)}catch(e){null==u||u.log("session validation failed - trying to refresh it")}return h.refreshSession(t)},async exchangeAccessKey(e){if(!e)throw Error("access key must not be empty");let t;try{t=await h.accessKey.exchange(e)}catch(e){throw null==u||u.error("failed to exchange access key",e),Error("could not exchange access key")}const{sessionJwt:s}=t.data;if(!s)throw null==u||u.error("failed to parse exchange access key response"),Error("could not exchange access key");try{return await h.validateJwt(s)}catch(e){throw null==u||u.error("failed to parse jwt from access key",e),Error("could not exchange access key")}},validatePermissions:(e,t)=>h.validateTenantPermissions(e,null,t),validateTenantPermissions(e,t,s){const n=l(e,"permissions",t);return s.every((e=>n.includes(e)))},validateRoles:(e,t)=>h.validateTenantRoles(e,null,t),validateTenantRoles(e,t,s){const n=l(e,"roles",t);return s.every((e=>n.includes(e)))}});return t.wrapWith(h,["otp.verify.email","otp.verify.sms","otp.verify.whatsapp","magicLink.verify","enchantedLink.signUp","enchantedLink.signIn","oauth.exchange","saml.exchange","totp.verify","webauthn.signIn.finish","webauthn.signUp.finish","refresh"],i)};M.RefreshTokenCookieName="DSR",M.SessionTokenCookieName="DS",module.exports=M;
+"use strict";var e=require("tslib"),t=require("@descope/core-js-sdk"),s=require("jose"),o=require("node-fetch-commonjs");function n(e){return e&&"object"==typeof e&&"default"in e?e:{default:e}}var a=n(t),r=n(o);const i=t=>async(...s)=>{var o,n,a;const r=await t(...s);if(!r.data)return r;let i=r.data,{refreshJwt:l}=i,p=e.__rest(i,["refreshJwt"]);const d=[];var m;return l?d.push(`${"DSR"}=${l}; Domain=${(null==(m=p)?void 0:m.cookieDomain)||""}; Max-Age=${(null==m?void 0:m.cookieMaxAge)||""}; Path=${(null==m?void 0:m.cookiePath)||"/"}; HttpOnly; SameSite=Strict`):(null===(o=r.response)||void 0===o?void 0:o.headers.get("set-cookie"))&&(l=((e,t)=>{const s=null==e?void 0:e.match(RegExp(`(?:^|;\\s*)${t}=([^;]*)`));return s?s[1]:null})(null===(n=r.response)||void 0===n?void 0:n.headers.get("set-cookie"),"DSR"),d.push(null===(a=r.response)||void 0===a?void 0:a.headers.get("set-cookie"))),Object.assign(Object.assign({},r),{data:Object.assign(Object.assign({},r.data),{refreshJwt:l,cookies:d})})};function l(e,t,s){var o,n;const a=s?null===(n=null===(o=e.token.tenants)||void 0===o?void 0:o[s])||void 0===n?void 0:n[t]:e.token[t];return Array.isArray(a)?a:[]}var p={create:"/v1/mgmt/user/create",update:"/v1/mgmt/user/update",delete:"/v1/mgmt/user/delete",deleteAllTestUsers:"/v1/mgmt/user/test/delete/all",load:"/v1/mgmt/user",search:"/v1/mgmt/user/search",updateStatus:"/v1/mgmt/user/update/status",updateEmail:"/v1/mgmt/user/update/email",updatePhone:"/v1/mgmt/user/update/phone",updateDisplayName:"/v1/mgmt/user/update/name",updatePicture:"/v1/mgmt/user/update/picture",updateCustomAttribute:"/v1/mgmt/user/update/customAttribute",addRole:"/v1/mgmt/user/update/role/add",removeRole:"/v1/mgmt/user/update/role/remove",addTenant:"/v1/mgmt/user/update/tenant/add",removeTenant:"/v1/mgmt/user/update/tenant/remove",setPassword:"/v1/mgmt/user/password/set",expirePassword:"/v1/mgmt/user/password/expire",generateOTPForTest:"/v1/mgmt/tests/generate/otp",generateMagicLinkForTest:"/v1/mgmt/tests/generate/magiclink",generateEnchantedLinkForTest:"/v1/mgmt/tests/generate/enchantedlink"},d={create:"/v1/mgmt/accesskey/create",load:"/v1/mgmt/accesskey",search:"/v1/mgmt/accesskey/search",update:"/v1/mgmt/accesskey/update",deactivate:"/v1/mgmt/accesskey/deactivate",activate:"/v1/mgmt/accesskey/activate",delete:"/v1/mgmt/accesskey/delete"},m={create:"/v1/mgmt/tenant/create",update:"/v1/mgmt/tenant/update",delete:"/v1/mgmt/tenant/delete",loadAll:"/v1/mgmt/tenant/all"},u={settings:"/v1/mgmt/sso/settings",metadata:"/v1/mgmt/sso/metadata",mapping:"/v1/mgmt/sso/mapping"},c={update:"/v1/mgmt/jwt/update"},g={create:"/v1/mgmt/permission/create",update:"/v1/mgmt/permission/update",delete:"/v1/mgmt/permission/delete",loadAll:"/v1/mgmt/permission/all"},h={create:"/v1/mgmt/role/create",update:"/v1/mgmt/role/update",delete:"/v1/mgmt/role/delete",loadAll:"/v1/mgmt/role/all"},v={export:"/v1/mgmt/flow/export",import:"/v1/mgmt/flow/import"},f={export:"/v1/mgmt/theme/export",import:"/v1/mgmt/theme/import"},k={loadAllGroups:"/v1/mgmt/group/all",loadAllGroupsForMember:"/v1/mgmt/group/member/all",loadAllGroupMembers:"/v1/mgmt/group/members"};const R=(e,s)=>({create:(o,n,a,r,i,l,d,m)=>t.transformResponse(e.httpClient.post(p.create,{loginId:o,email:n,phone:a,displayName:r,roleNames:i,userTenants:l,customAttributes:d,picture:m},{token:s}),(e=>e.user)),createTestUser:(o,n,a,r,i,l,d,m)=>t.transformResponse(e.httpClient.post(p.create,{loginId:o,email:n,phone:a,displayName:r,roleNames:i,userTenants:l,test:!0,customAttributes:d,picture:m},{token:s}),(e=>e.user)),invite:(o,n,a,r,i,l,d,m)=>t.transformResponse(e.httpClient.post(p.create,{loginId:o,email:n,phone:a,displayName:r,roleNames:i,userTenants:l,invite:!0,customAttributes:d,picture:m},{token:s}),(e=>e.user)),update:(o,n,a,r,i,l,d,m)=>t.transformResponse(e.httpClient.post(p.update,{loginId:o,email:n,phone:a,displayName:r,roleNames:i,userTenants:l,customAttributes:d,picture:m},{token:s}),(e=>e.user)),delete:o=>t.transformResponse(e.httpClient.post(p.delete,{loginId:o},{token:s})),deleteAllTestUsers:()=>t.transformResponse(e.httpClient.delete(p.deleteAllTestUsers,{token:s})),load:o=>t.transformResponse(e.httpClient.get(p.load,{queryParams:{loginId:o},token:s}),(e=>e.user)),loadByUserId:o=>t.transformResponse(e.httpClient.get(p.load,{queryParams:{userId:o},token:s}),(e=>e.user)),searchAll:(o,n,a,r,i,l,d)=>t.transformResponse(e.httpClient.post(p.search,{tenantIds:o,roleNames:n,limit:a,page:r,testUsersOnly:i,withTestUser:l,customAttributes:d},{token:s}),(e=>e.users)),activate:o=>t.transformResponse(e.httpClient.post(p.updateStatus,{loginId:o,status:"enabled"},{token:s}),(e=>e.user)),deactivate:o=>t.transformResponse(e.httpClient.post(p.updateStatus,{loginId:o,status:"disabled"},{token:s}),(e=>e.user)),updateEmail:(o,n,a)=>t.transformResponse(e.httpClient.post(p.updateEmail,{loginId:o,email:n,verified:a},{token:s}),(e=>e.user)),updatePhone:(o,n,a)=>t.transformResponse(e.httpClient.post(p.updatePhone,{loginId:o,phone:n,verified:a},{token:s}),(e=>e.user)),updateDisplayName:(o,n)=>t.transformResponse(e.httpClient.post(p.updateDisplayName,{loginId:o,displayName:n},{token:s}),(e=>e.user)),updatePicture:(o,n)=>t.transformResponse(e.httpClient.post(p.updatePicture,{loginId:o,picture:n},{token:s}),(e=>e.user)),updateCustomAttribute:(o,n,a)=>t.transformResponse(e.httpClient.post(p.updateCustomAttribute,{loginId:o,attributeKey:n,attributeValue:a},{token:s}),(e=>e.user)),addRoles:(o,n)=>t.transformResponse(e.httpClient.post(p.addRole,{loginId:o,roleNames:n},{token:s}),(e=>e.user)),removeRoles:(o,n)=>t.transformResponse(e.httpClient.post(p.removeRole,{loginId:o,roleNames:n},{token:s}),(e=>e.user)),addTenant:(o,n)=>t.transformResponse(e.httpClient.post(p.addTenant,{loginId:o,tenantId:n},{token:s}),(e=>e.user)),removeTenant:(o,n)=>t.transformResponse(e.httpClient.post(p.removeTenant,{loginId:o,tenantId:n},{token:s}),(e=>e.user)),addTenantRoles:(o,n,a)=>t.transformResponse(e.httpClient.post(p.addRole,{loginId:o,tenantId:n,roleNames:a},{token:s}),(e=>e.user)),removeTenantRoles:(o,n,a)=>t.transformResponse(e.httpClient.post(p.removeRole,{loginId:o,tenantId:n,roleNames:a},{token:s}),(e=>e.user)),generateOTPForTestUser:(o,n)=>t.transformResponse(e.httpClient.post(p.generateOTPForTest,{deliveryMethod:o,loginId:n},{token:s}),(e=>e)),generateMagicLinkForTestUser:(o,n,a)=>t.transformResponse(e.httpClient.post(p.generateMagicLinkForTest,{deliveryMethod:o,loginId:n,URI:a},{token:s}),(e=>e)),generateEnchantedLinkForTestUser:(o,n)=>t.transformResponse(e.httpClient.post(p.generateEnchantedLinkForTest,{loginId:o,URI:n},{token:s}),(e=>e)),setPassword:(o,n)=>t.transformResponse(e.httpClient.post(p.setPassword,{loginId:o,password:n},{token:s}),(e=>e)),expirePassword:o=>t.transformResponse(e.httpClient.post(p.expirePassword,{loginId:o},{token:s}),(e=>e))}),y=(e,s)=>({create:(o,n)=>t.transformResponse(e.httpClient.post(m.create,{name:o,selfProvisioningDomains:n},{token:s})),createWithId:(o,n,a)=>t.transformResponse(e.httpClient.post(m.create,{id:o,name:n,selfProvisioningDomains:a},{token:s})),update:(o,n,a)=>t.transformResponse(e.httpClient.post(m.update,{id:o,name:n,selfProvisioningDomains:a},{token:s})),delete:o=>t.transformResponse(e.httpClient.post(m.delete,{id:o},{token:s})),loadAll:()=>t.transformResponse(e.httpClient.get(m.loadAll,{token:s}),(e=>e.tenants))}),C=(e,s)=>({update:(o,n)=>t.transformResponse(e.httpClient.post(c.update,{jwt:o,customClaims:n},{token:s}))}),w=(e,s)=>({create:(o,n)=>t.transformResponse(e.httpClient.post(g.create,{name:o,description:n},{token:s})),update:(o,n,a)=>t.transformResponse(e.httpClient.post(g.update,{name:o,newName:n,description:a},{token:s})),delete:o=>t.transformResponse(e.httpClient.post(g.delete,{name:o},{token:s})),loadAll:()=>t.transformResponse(e.httpClient.get(g.loadAll,{token:s}),(e=>e.permissions))}),I=(e,s)=>({create:(o,n,a)=>t.transformResponse(e.httpClient.post(h.create,{name:o,description:n,permissionNames:a},{token:s})),update:(o,n,a,r)=>t.transformResponse(e.httpClient.post(h.update,{name:o,newName:n,description:a,permissionNames:r},{token:s})),delete:o=>t.transformResponse(e.httpClient.post(h.delete,{name:o},{token:s})),loadAll:()=>t.transformResponse(e.httpClient.get(h.loadAll,{token:s}),(e=>e.roles))}),b=(e,s)=>({loadAllGroups:o=>t.transformResponse(e.httpClient.post(k.loadAllGroups,{tenantId:o},{token:s})),loadAllGroupsForMember:(o,n,a)=>t.transformResponse(e.httpClient.post(k.loadAllGroupsForMember,{tenantId:o,loginIds:a,userIds:n},{token:s})),loadAllGroupMembers:(o,n)=>t.transformResponse(e.httpClient.post(k.loadAllGroupMembers,{tenantId:o,groupId:n},{token:s}))}),T=(e,s)=>({getSettings:o=>t.transformResponse(e.httpClient.get(u.settings,{queryParams:{tenantId:o},token:s}),(e=>e)),deleteSettings:o=>t.transformResponse(e.httpClient.delete(u.settings,{queryParams:{tenantId:o},token:s})),configureSettings:(o,n,a,r,i,l)=>t.transformResponse(e.httpClient.post(u.settings,{tenantId:o,idpURL:n,entityId:r,idpCert:a,redirectURL:i,domain:l},{token:s})),configureMetadata:(o,n)=>t.transformResponse(e.httpClient.post(u.metadata,{tenantId:o,idpMetadataURL:n},{token:s})),configureMapping:(o,n,a)=>t.transformResponse(e.httpClient.post(u.mapping,{tenantId:o,roleMapping:n,attributeMapping:a},{token:s}))}),A=(e,s)=>({create:(o,n,a,r)=>t.transformResponse(e.httpClient.post(d.create,{name:o,expireTime:n,roleNames:a,keyTenants:r},{token:s})),load:o=>t.transformResponse(e.httpClient.get(d.load,{queryParams:{id:o},token:s}),(e=>e.key)),searchAll:o=>t.transformResponse(e.httpClient.post(d.search,{tenantIds:o},{token:s}),(e=>e.keys)),update:(o,n)=>t.transformResponse(e.httpClient.post(d.update,{id:o,name:n},{token:s}),(e=>e.key)),deactivate:o=>t.transformResponse(e.httpClient.post(d.deactivate,{id:o},{token:s})),activate:o=>t.transformResponse(e.httpClient.post(d.activate,{id:o},{token:s})),delete:o=>t.transformResponse(e.httpClient.post(d.delete,{id:o},{token:s}))}),x=(e,s)=>({export:o=>t.transformResponse(e.httpClient.post(v.export,{flowId:o},{token:s})),import:(o,n,a)=>t.transformResponse(e.httpClient.post(v.import,{flowId:o,flow:n,screens:a},{token:s}))}),P=(e,s)=>({export:()=>t.transformResponse(e.httpClient.post(f.export,{},{token:s})),import:o=>t.transformResponse(e.httpClient.post(f.import,{theme:o},{token:s}))});var j;null!==(j=globalThis.Headers)&&void 0!==j||(globalThis.Headers=o.Headers);const N=(...e)=>(e.forEach((e=>{var t,s;e&&(null!==(t=(s=e).highWaterMark)&&void 0!==t||(s.highWaterMark=31457280))})),r.default(...e)),M=o=>{var n,{managementKey:r}=o,p=e.__rest(o,["managementKey"]);const d=a.default(Object.assign(Object.assign({},p),{fetch:N,baseHeaders:Object.assign(Object.assign({},p.baseHeaders),{"x-descope-sdk-name":"nodejs","x-descope-sdk-node-version":(null===(n=null===process||void 0===process?void 0:process.versions)||void 0===n?void 0:n.node)||"","x-descope-sdk-version":"1.5.1"})})),{projectId:m,logger:u}=p,c={},g=((e,t)=>({user:R(e,t),accessKey:A(e,t),tenant:y(e,t),sso:T(e,t),jwt:C(e,t),permission:w(e,t),role:I(e,t),group:b(e,t),flow:x(e,t),theme:P(e,t)}))(d,r),h=Object.assign(Object.assign({},d),{management:g,async getKey(e){if(!(null==e?void 0:e.kid))throw Error("header.kid must not be empty");if(c[e.kid])return c[e.kid];if(Object.assign(c,await(async()=>{const e=(await d.httpClient.get(`v2/keys/${m}`).then((e=>e.json()))).keys;return Array.isArray(e)?(await Promise.all(e.map((async e=>[e.kid,await s.importJWK(e)])))).reduce(((e,[t,s])=>t?Object.assign(Object.assign({},e),{[t.toString()]:s}):e),{}):{}})()),!c[e.kid])throw Error("failed to fetch matching key");return c[e.kid]},async validateJwt(e){var t;const o=(await s.jwtVerify(e,h.getKey,{clockTolerance:5})).payload;if(o&&(o.iss=null===(t=o.iss)||void 0===t?void 0:t.split("/").pop(),o.iss!==m))throw new s.errors.JWTClaimValidationFailed('unexpected "iss" claim value',"iss","check_failed");return{jwt:e,token:o}},async validateSession(e){if(!e)throw Error("session token is required for validation");try{return await h.validateJwt(e)}catch(e){throw null==u||u.error("session validation failed",e),Error("session validation failed")}},async refreshSession(e){var t,s;if(!e)throw Error("refresh token is required to refresh a session");try{await h.validateJwt(e);const o=await h.refresh(e);if(o.ok){return await h.validateJwt(null===(t=o.data)||void 0===t?void 0:t.sessionJwt)}throw Error(null===(s=o.error)||void 0===s?void 0:s.errorMessage)}catch(e){throw null==u||u.error("refresh token validation failed",e),Error("refresh token validation failed")}},async validateAndRefreshSession(e,t){if(!e&&!t)throw Error("both session and refresh tokens are empty");try{return await h.validateSession(e)}catch(e){null==u||u.log("session validation failed - trying to refresh it")}return h.refreshSession(t)},async exchangeAccessKey(e){if(!e)throw Error("access key must not be empty");let t;try{t=await h.accessKey.exchange(e)}catch(e){throw null==u||u.error("failed to exchange access key",e),Error("could not exchange access key")}const{sessionJwt:s}=t.data;if(!s)throw null==u||u.error("failed to parse exchange access key response"),Error("could not exchange access key");try{return await h.validateJwt(s)}catch(e){throw null==u||u.error("failed to parse jwt from access key",e),Error("could not exchange access key")}},validatePermissions:(e,t)=>h.validateTenantPermissions(e,null,t),validateTenantPermissions(e,t,s){const o=l(e,"permissions",t);return s.every((e=>o.includes(e)))},validateRoles:(e,t)=>h.validateTenantRoles(e,null,t),validateTenantRoles(e,t,s){const o=l(e,"roles",t);return s.every((e=>o.includes(e)))}});return t.wrapWith(h,["otp.verify.email","otp.verify.sms","otp.verify.whatsapp","magicLink.verify","enchantedLink.signUp","enchantedLink.signIn","oauth.exchange","saml.exchange","totp.verify","webauthn.signIn.finish","webauthn.signUp.finish","refresh"],i)};M.RefreshTokenCookieName="DSR",M.SessionTokenCookieName="DS",module.exports=M;
 //# sourceMappingURL=index.cjs.js.map

package/dist/cjs/index.cjs.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.cjs.js","sources":["../../lib/constants.ts","../../lib/helpers.ts","../../lib/management/paths.ts","../../lib/management/user.ts","../../lib/management/tenant.ts","../../lib/management/jwt.ts","../../lib/management/permission.ts","../../lib/management/role.ts","../../lib/management/group.ts","../../lib/management/sso.ts","../../lib/management/accesskey.ts","../../lib/management/flow.ts","../../lib/management/theme.ts","../../lib/fetch-polyfill.ts","../../lib/index.ts","../../lib/management/index.ts"],"sourcesContent":["// eslint-disable-next-line import/prefer-default-export\n/** Refresh JWT cookie name */\nexport const refreshTokenCookieName = 'DSR';\n/** Session JWT cookie name */\nexport const sessionTokenCookieName = 'DS';\n/** The key of the tenants claims in the claims map */\nexport const authorizedTenantsClaimName = 'tenants';\n/** The key of the permissions claims in the claims map either under tenant or top level */\nexport const permissionsClaimName = 'permissions';\n/** The key of the roles claims in the claims map either under tenant or top level */\nexport const rolesClaimName = 'roles';\n","import type { SdkFnWrapper } from '@descope/core-js-sdk';\nimport { authorizedTenantsClaimName, refreshTokenCookieName } from './constants';\nimport { AuthenticationInfo } from './types';\n\n/**\n * Generate a cookie string from given parameters\n * @param name name of the cookie\n * @param value value of cookie that must be already encoded\n * @param options any options to put on the cookie like cookieDomain, cookieMaxAge, cookiePath\n * @returns Cookie string with all options on the string\n */\nconst generateCookie = (name: string, value: string, options?: Record<string, string | number>) =>\n  `${name}=${value}; Domain=${options?.cookieDomain || ''}; Max-Age=${\n    options?.cookieMaxAge || ''\n  }; Path=${options?.cookiePath || '/'}; HttpOnly; SameSite=Strict`;\n\n/**\n * Parse the cookie string and return the value of the cookie\n * @param cookie the raw cookie string\n * @param name the name of the cookie to get value for\n * @returns the value of the given cookie\n */\nconst getCookieValue = (cookie: string | null | undefined, name: string) => {\n  const match = cookie?.match(RegExp(`(?:^|;\\\\s*)${name}=([^;]*)`));\n  return match ? match[1] : null;\n};\n\n// eslint-disable-next-line import/prefer-default-export\n/**\n * Add cookie generation to core-js functions.\n * @param fn the function we are wrapping\n * @returns Wrapped function with cookie generation\n */\nexport const withCookie: SdkFnWrapper<{ refreshJwt?: string; cookies?: string[] }> =\n  (fn) =>\n  async (...args) => {\n    const resp = await fn(...args);\n\n    // istanbul ignore next\n    if (!resp.data) {\n      return resp;\n    }\n\n    // eslint-disable-next-line prefer-const\n    let { refreshJwt, ...rest } = resp.data;\n    const cookies: string[] = [];\n\n    if (!refreshJwt) {\n      if (resp.response?.headers.get('set-cookie')) {\n        refreshJwt = getCookieValue(\n          resp.response?.headers.get('set-cookie'),\n          refreshTokenCookieName,\n        );\n        cookies.push(resp.response?.headers.get('set-cookie')!);\n      }\n    } else {\n      cookies.push(generateCookie(refreshTokenCookieName, refreshJwt, rest));\n    }\n\n    return { ...resp, data: { ...resp.data, refreshJwt, cookies } };\n  };\n\n/**\n * Get the claim (used for permissions or roles) for a given tenant or top level if tenant is empty\n * @param authInfo The parsed authentication info from the JWT\n * @param claim name of the claim\n * @param tenant tenant to retrieve the claim for\n * @returns\n */\nexport function getAuthorizationClaimItems(\n  authInfo: AuthenticationInfo,\n  claim: string,\n  tenant?: string,\n): string[] {\n  const value = tenant\n    ? authInfo.token[authorizedTenantsClaimName]?.[tenant]?.[claim]\n    : authInfo.token[claim];\n  return Array.isArray(value) ? value : [];\n}\n","/** API paths for the Descope service Management APIs */\nexport default {\n  user: {\n    create: '/v1/mgmt/user/create',\n    update: '/v1/mgmt/user/update',\n    delete: '/v1/mgmt/user/delete',\n    deleteAllTestUsers: '/v1/mgmt/user/test/delete/all',\n    load: '/v1/mgmt/user',\n    search: '/v1/mgmt/user/search',\n    updateStatus: '/v1/mgmt/user/update/status',\n    updateEmail: '/v1/mgmt/user/update/email',\n    updatePhone: '/v1/mgmt/user/update/phone',\n    updateDisplayName: '/v1/mgmt/user/update/name',\n    updatePicture: '/v1/mgmt/user/update/picture',\n    updateCustomAttribute: '/v1/mgmt/user/update/customAttribute',\n    addRole: '/v1/mgmt/user/update/role/add',\n    removeRole: '/v1/mgmt/user/update/role/remove',\n    addTenant: '/v1/mgmt/user/update/tenant/add',\n    removeTenant: '/v1/mgmt/user/update/tenant/remove',\n    generateOTPForTest: '/v1/mgmt/tests/generate/otp',\n    generateMagicLinkForTest: '/v1/mgmt/tests/generate/magiclink',\n    generateEnchantedLinkForTest: '/v1/mgmt/tests/generate/enchantedlink',\n  },\n  accessKey: {\n    create: '/v1/mgmt/accesskey/create',\n    load: '/v1/mgmt/accesskey',\n    search: '/v1/mgmt/accesskey/search',\n    update: '/v1/mgmt/accesskey/update',\n    deactivate: '/v1/mgmt/accesskey/deactivate',\n    activate: '/v1/mgmt/accesskey/activate',\n    delete: '/v1/mgmt/accesskey/delete',\n  },\n  tenant: {\n    create: '/v1/mgmt/tenant/create',\n    update: '/v1/mgmt/tenant/update',\n    delete: '/v1/mgmt/tenant/delete',\n    loadAll: '/v1/mgmt/tenant/all',\n  },\n  sso: {\n    settings: '/v1/mgmt/sso/settings',\n    metadata: '/v1/mgmt/sso/metadata',\n    mapping: '/v1/mgmt/sso/mapping',\n  },\n  jwt: {\n    update: '/v1/mgmt/jwt/update',\n  },\n  permission: {\n    create: '/v1/mgmt/permission/create',\n    update: '/v1/mgmt/permission/update',\n    delete: '/v1/mgmt/permission/delete',\n    loadAll: '/v1/mgmt/permission/all',\n  },\n  role: {\n    create: '/v1/mgmt/role/create',\n    update: '/v1/mgmt/role/update',\n    delete: '/v1/mgmt/role/delete',\n    loadAll: '/v1/mgmt/role/all',\n  },\n  flow: {\n    export: '/v1/mgmt/flow/export',\n    import: '/v1/mgmt/flow/import',\n  },\n  theme: {\n    export: '/v1/mgmt/theme/export',\n    import: '/v1/mgmt/theme/import',\n  },\n  group: {\n    loadAllGroups: '/v1/mgmt/group/all',\n    loadAllGroupsForMember: '/v1/mgmt/group/member/all',\n    loadAllGroupMembers: '/v1/mgmt/group/members',\n  },\n};\n","import { DeliveryMethod, SdkResponse, transformResponse, UserResponse } from '@descope/core-js-sdk';\nimport { CoreSdk } from '../types';\nimport apiPaths from './paths';\nimport {\n  AssociatedTenant,\n  GenerateEnchantedLinkForTestResponse,\n  GenerateMagicLinkForTestResponse,\n  GenerateOTPForTestResponse,\n  AttributesTypes,\n} from './types';\n\ntype SingleUserResponse = {\n  user: UserResponse;\n};\n\ntype MultipleUsersResponse = {\n  users: UserResponse[];\n};\n\nconst withUser = (sdk: CoreSdk, managementKey?: string) => ({\n  create: (\n    loginId: string,\n    email?: string,\n    phone?: string,\n    displayName?: string,\n    roles?: string[],\n    userTenants?: AssociatedTenant[],\n    customAttributes?: Record<string, AttributesTypes>,\n    picture?: string,\n  ): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.create,\n        {\n          loginId,\n          email,\n          phone,\n          displayName,\n          roleNames: roles,\n          userTenants,\n          customAttributes,\n          picture,\n        },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  /**\n   * Create a new test user.\n   * The loginID is required and will determine what the user will use to sign in.\n   * Make sure the login id is unique for test. All other fields are optional.\n   *\n   * You can later generate OTP, Magic link and enchanted link to use in the test without the need\n   * of 3rd party messaging services.\n   * Those users are not counted as part of the monthly active users\n   * @returns The UserResponse if found, throws otherwise.\n   */\n  createTestUser: (\n    loginId: string,\n    email?: string,\n    phone?: string,\n    displayName?: string,\n    roles?: string[],\n    userTenants?: AssociatedTenant[],\n    customAttributes?: Record<string, AttributesTypes>,\n    picture?: string,\n  ): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.create,\n        {\n          loginId,\n          email,\n          phone,\n          displayName,\n          roleNames: roles,\n          userTenants,\n          test: true,\n          customAttributes,\n          picture,\n        },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  invite: (\n    loginId: string,\n    email?: string,\n    phone?: string,\n    displayName?: string,\n    roles?: string[],\n    userTenants?: AssociatedTenant[],\n    customAttributes?: Record<string, AttributesTypes>,\n    picture?: string,\n  ): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.create,\n        {\n          loginId,\n          email,\n          phone,\n          displayName,\n          roleNames: roles,\n          userTenants,\n          invite: true,\n          customAttributes,\n          picture,\n        },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  update: (\n    loginId: string,\n    email?: string,\n    phone?: string,\n    displayName?: string,\n    roles?: string[],\n    userTenants?: AssociatedTenant[],\n    customAttributes?: Record<string, AttributesTypes>,\n    picture?: string,\n  ): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.update,\n        {\n          loginId,\n          email,\n          phone,\n          displayName,\n          roleNames: roles,\n          userTenants,\n          customAttributes,\n          picture,\n        },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  delete: (loginId: string): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(apiPaths.user.delete, { loginId }, { token: managementKey }),\n    ),\n  /**\n   * Delete all test users in the project.\n   */\n  deleteAllTestUsers: (): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.delete(apiPaths.user.deleteAllTestUsers, {}, { token: managementKey }),\n    ),\n  load: (loginId: string): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.get(apiPaths.user.load, {\n        queryParams: { loginId },\n        token: managementKey,\n      }),\n      (data) => data.user,\n    ),\n  /**\n   * Load an existing user by user ID. The ID can be found\n   * on the user's JWT.\n   * @param userId load a user by this user ID field\n   * @returns The UserResponse if found, throws otherwise.\n   */\n  loadByUserId: (userId: string): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.get(apiPaths.user.load, {\n        queryParams: { userId },\n        token: managementKey,\n      }),\n      (data) => data.user,\n    ),\n  /**\n   * Search all users. Results can be filtered according to tenants and/or\n   * roles, and also paginated used the limit and page parameters.\n   * @param tenantIds optional list of tenant IDs to filter by\n   * @param roles optional list of roles to filter by\n   * @param limit optionally limit the response, leave out for default limit\n   * @param page optionally paginate over the response\n   * @param testUsersOnly optionally filter only test users\n   * @param withTestUser optionally include test users in search\n   * @returns An array of UserResponse found by the query\n   */\n  searchAll: (\n    tenantIds?: string[],\n    roles?: string[],\n    limit?: number,\n    page?: number,\n    testUsersOnly?: boolean,\n    withTestUser?: boolean,\n    customAttributes?: Record<string, AttributesTypes>,\n  ): Promise<SdkResponse<UserResponse[]>> =>\n    transformResponse<MultipleUsersResponse, UserResponse[]>(\n      sdk.httpClient.post(\n        apiPaths.user.search,\n        { tenantIds, roleNames: roles, limit, page, testUsersOnly, withTestUser, customAttributes },\n        { token: managementKey },\n      ),\n      (data) => data.users,\n    ),\n  activate: (loginId: string): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.updateStatus,\n        { loginId, status: 'enabled' },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  deactivate: (loginId: string): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.updateStatus,\n        { loginId, status: 'disabled' },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  updateEmail: (\n    loginId: string,\n    email: string,\n    isVerified: boolean,\n  ): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.updateEmail,\n        { loginId, email, verified: isVerified },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  updatePhone: (\n    loginId: string,\n    phone: string,\n    isVerified: boolean,\n  ): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.updatePhone,\n        { loginId, phone, verified: isVerified },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  updateDisplayName: (loginId: string, displayName: string): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.updateDisplayName,\n        { loginId, displayName },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  updatePicture: (loginId: string, picture: string): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.updatePicture,\n        { loginId, picture },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  updateCustomAttribute: (\n    loginId: string,\n    attributeKey: string,\n    attributeValue: AttributesTypes,\n  ): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.updateCustomAttribute,\n        { loginId, attributeKey, attributeValue },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  addRoles: (loginId: string, roles: string[]): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.addRole,\n        { loginId, roleNames: roles },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  removeRoles: (loginId: string, roles: string[]): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.removeRole,\n        { loginId, roleNames: roles },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  addTenant: (loginId: string, tenantId: string): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(apiPaths.user.addTenant, { loginId, tenantId }, { token: managementKey }),\n      (data) => data.user,\n    ),\n  removeTenant: (loginId: string, tenantId: string): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.removeTenant,\n        { loginId, tenantId },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  addTenantRoles: (\n    loginId: string,\n    tenantId: string,\n    roles: string[],\n  ): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.addRole,\n        { loginId, tenantId, roleNames: roles },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  removeTenantRoles: (\n    loginId: string,\n    tenantId: string,\n    roles: string[],\n  ): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.removeRole,\n        { loginId, tenantId, roleNames: roles },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n\n  /**\n   * Generate OTP for the given login ID of a test user.\n   * Choose the selected delivery method for verification.\n   * Returns the code for the login (exactly as it sent via Email or SMS)\n   * This is useful when running tests and don't want to use 3rd party messaging services\n   *\n   * @param deliveryMethod optional DeliveryMethod\n   * @param loginId login ID of a test user\n   * @returns GenerateOTPForTestResponse which includes the loginId and the OTP code\n   */\n  generateOTPForTestUser: (\n    deliveryMethod: DeliveryMethod,\n    loginId: string,\n  ): Promise<SdkResponse<GenerateOTPForTestResponse>> =>\n    transformResponse<GenerateOTPForTestResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.generateOTPForTest,\n        { deliveryMethod, loginId },\n        { token: managementKey },\n      ),\n      (data) => data,\n    ),\n\n  /**\n   * Generate Magic Link for the given login ID of a test user.\n   * Choose the selected delivery method for verification.\n   * It returns the link for the login (exactly as it sent via Email)\n   * This is useful when running tests and don't want to use 3rd party messaging services\n   *\n   * @param deliveryMethod optional DeliveryMethod\n   * @param loginId login ID of a test user\n   * @param uri optional redirect uri which will be used instead of any global configuration.\n   * @returns GenerateMagicLinkForTestResponse which includes the loginId and the magic link\n   */\n  generateMagicLinkForTestUser: (\n    deliveryMethod: DeliveryMethod,\n    loginId: string,\n    uri: string,\n  ): Promise<SdkResponse<GenerateMagicLinkForTestResponse>> =>\n    transformResponse<GenerateMagicLinkForTestResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.generateMagicLinkForTest,\n        { deliveryMethod, loginId, URI: uri },\n        { token: managementKey },\n      ),\n      (data) => data,\n    ),\n\n  /**\n   * Generate Enchanted Link for the given login ID of a test user.\n   * It returns the link for the login (exactly as it sent via Email)\n   * and pendingRef which is used to poll for a valid session\n   * This is useful when running tests and don't want to use 3rd party messaging services\n   *\n   * @param loginId login ID of a test user\n   * @param uri optional redirect uri which will be used instead of any global configuration.\n   * @returns GenerateEnchantedLinkForTestResponse which includes the loginId, the enchanted link and the pendingRef\n   */\n  generateEnchantedLinkForTestUser: (\n    loginId: string,\n    uri: string,\n  ): Promise<SdkResponse<GenerateEnchantedLinkForTestResponse>> =>\n    transformResponse<GenerateEnchantedLinkForTestResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.generateEnchantedLinkForTest,\n        { loginId, URI: uri },\n        { token: managementKey },\n      ),\n      (data) => data,\n    ),\n});\n\nexport default withUser;\n","import { SdkResponse, transformResponse } from '@descope/core-js-sdk';\nimport { CoreSdk } from '../types';\nimport apiPaths from './paths';\nimport { CreateTenantResponse, Tenant } from './types';\n\ntype MultipleTenantResponse = {\n  tenants: Tenant[];\n};\n\nconst withTenant = (sdk: CoreSdk, managementKey?: string) => ({\n  create: (\n    name: string,\n    selfProvisioningDomains?: string[],\n  ): Promise<SdkResponse<CreateTenantResponse>> =>\n    transformResponse(\n      sdk.httpClient.post(\n        apiPaths.tenant.create,\n        { name, selfProvisioningDomains },\n        { token: managementKey },\n      ),\n    ),\n  createWithId: (\n    id: string,\n    name: string,\n    selfProvisioningDomains?: string[],\n  ): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(\n        apiPaths.tenant.create,\n        { id, name, selfProvisioningDomains },\n        { token: managementKey },\n      ),\n    ),\n  update: (\n    id: string,\n    name: string,\n    selfProvisioningDomains?: string[],\n  ): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(\n        apiPaths.tenant.update,\n        { id, name, selfProvisioningDomains },\n        { token: managementKey },\n      ),\n    ),\n  delete: (id: string): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(apiPaths.tenant.delete, { id }, { token: managementKey }),\n    ),\n  loadAll: (): Promise<SdkResponse<Tenant[]>> =>\n    transformResponse<MultipleTenantResponse, Tenant[]>(\n      sdk.httpClient.get(apiPaths.tenant.loadAll, {\n        token: managementKey,\n      }),\n      (data) => data.tenants,\n    ),\n});\n\nexport default withTenant;\n","import { SdkResponse, transformResponse } from '@descope/core-js-sdk';\nimport { CoreSdk } from '../types';\nimport apiPaths from './paths';\nimport { UpdateJWTResponse } from './types';\n\nconst withJWT = (sdk: CoreSdk, managementKey?: string) => ({\n  update: (\n    jwt: string,\n    customClaims?: Record<string, any>,\n  ): Promise<SdkResponse<UpdateJWTResponse>> =>\n    transformResponse(\n      sdk.httpClient.post(apiPaths.jwt.update, { jwt, customClaims }, { token: managementKey }),\n    ),\n});\n\nexport default withJWT;\n","import { SdkResponse, transformResponse } from '@descope/core-js-sdk';\nimport { CoreSdk } from '../types';\nimport apiPaths from './paths';\nimport { Permission } from './types';\n\ntype MultiplePermissionResponse = {\n  permissions: Permission[];\n};\n\nconst withPermission = (sdk: CoreSdk, managementKey?: string) => ({\n  create: (name: string, description?: string): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(\n        apiPaths.permission.create,\n        { name, description },\n        { token: managementKey },\n      ),\n    ),\n  update: (name: string, newName: string, description?: string): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(\n        apiPaths.permission.update,\n        { name, newName, description },\n        { token: managementKey },\n      ),\n    ),\n  delete: (name: string): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(apiPaths.permission.delete, { name }, { token: managementKey }),\n    ),\n  loadAll: (): Promise<SdkResponse<Permission[]>> =>\n    transformResponse<MultiplePermissionResponse, Permission[]>(\n      sdk.httpClient.get(apiPaths.permission.loadAll, {\n        token: managementKey,\n      }),\n      (data) => data.permissions,\n    ),\n});\n\nexport default withPermission;\n","import { SdkResponse, transformResponse } from '@descope/core-js-sdk';\nimport { CoreSdk } from '../types';\nimport apiPaths from './paths';\nimport { Role } from './types';\n\ntype MultipleRoleResponse = {\n  roles: Role[];\n};\n\nconst withRole = (sdk: CoreSdk, managementKey?: string) => ({\n  create: (\n    name: string,\n    description?: string,\n    permissionNames?: string[],\n  ): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(\n        apiPaths.role.create,\n        { name, description, permissionNames },\n        { token: managementKey },\n      ),\n    ),\n  update: (\n    name: string,\n    newName: string,\n    description?: string,\n    permissionNames?: string[],\n  ): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(\n        apiPaths.role.update,\n        { name, newName, description, permissionNames },\n        { token: managementKey },\n      ),\n    ),\n  delete: (name: string): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(apiPaths.role.delete, { name }, { token: managementKey }),\n    ),\n  loadAll: (): Promise<SdkResponse<Role[]>> =>\n    transformResponse<MultipleRoleResponse, Role[]>(\n      sdk.httpClient.get(apiPaths.role.loadAll, {\n        token: managementKey,\n      }),\n      (data) => data.roles,\n    ),\n});\n\nexport default withRole;\n","import { SdkResponse, transformResponse } from '@descope/core-js-sdk';\nimport { CoreSdk } from '../types';\nimport apiPaths from './paths';\nimport { Group } from './types';\n\nconst withGroup = (sdk: CoreSdk, managementKey?: string) => ({\n  /**\n   * Load all groups for a specific tenant id.\n   * @param tenantId Tenant ID to load groups from.\n   * @returns Group[] list of groups\n   */\n  loadAllGroups: (tenantId: string): Promise<SdkResponse<Group[]>> =>\n    transformResponse<Group[]>(\n      sdk.httpClient.post(apiPaths.group.loadAllGroups, { tenantId }, { token: managementKey }),\n    ),\n\n  /**\n   * Load all groups for the provided user IDs or login IDs.\n   * @param tenantId Tenant ID to load groups from.\n   * @param userIds Optional List of user IDs, with the format of \"U2J5ES9S8TkvCgOvcrkpzUgVTEBM\" (example), which can be found on the user's JWT.\n   * @param loginIds Optional List of login IDs, how the user identifies when logging in.\n   * @returns Group[] list of groups\n   */\n  loadAllGroupsForMember: (\n    tenantId: string,\n    userIds: string[],\n    loginIds: string[],\n  ): Promise<SdkResponse<Group[]>> =>\n    transformResponse<Group[]>(\n      sdk.httpClient.post(\n        apiPaths.group.loadAllGroupsForMember,\n        { tenantId, loginIds, userIds },\n        { token: managementKey },\n      ),\n    ),\n\n  /**\n   * Load all members of the provided group id.\n   * @param tenantId Tenant ID to load groups from.\n   * @param groupId Group ID to load members for.\n   * @returns Group[] list of groups\n   */\n  loadAllGroupMembers: (tenantId: string, groupId: string): Promise<SdkResponse<Group[]>> =>\n    transformResponse<Group[]>(\n      sdk.httpClient.post(\n        apiPaths.group.loadAllGroupMembers,\n        { tenantId, groupId },\n        { token: managementKey },\n      ),\n    ),\n});\n\nexport default withGroup;\n","import { SdkResponse, transformResponse } from '@descope/core-js-sdk';\nimport { CoreSdk } from '../types';\nimport apiPaths from './paths';\nimport { RoleMapping, AttributeMapping, SSOSettingsResponse } from './types';\n\nconst withSSOSettings = (sdk: CoreSdk, managementKey?: string) => ({\n  getSettings: (tenantId: string): Promise<SdkResponse<SSOSettingsResponse>> =>\n    transformResponse<SSOSettingsResponse>(\n      sdk.httpClient.get(apiPaths.sso.settings, {\n        queryParams: { tenantId },\n        token: managementKey,\n      }),\n      (data) => data,\n    ),\n  configureSettings: (\n    tenantId: string,\n    idpURL: string,\n    idpCert: string,\n    entityId: string,\n    redirectURL?: string,\n    domain?: string,\n  ): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(\n        apiPaths.sso.settings,\n        { tenantId, idpURL, entityId, idpCert, redirectURL, domain },\n        { token: managementKey },\n      ),\n    ),\n  configureMetadata: (tenantId: string, idpMetadataURL: string): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(\n        apiPaths.sso.metadata,\n        { tenantId, idpMetadataURL },\n        { token: managementKey },\n      ),\n    ),\n  configureMapping: (\n    tenantId: string,\n    roleMapping?: RoleMapping,\n    attributeMapping?: AttributeMapping,\n  ): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(\n        apiPaths.sso.mapping,\n        { tenantId, roleMapping, attributeMapping },\n        { token: managementKey },\n      ),\n    ),\n});\n\nexport default withSSOSettings;\n","import { SdkResponse, transformResponse } from '@descope/core-js-sdk';\nimport { CoreSdk } from '../types';\nimport apiPaths from './paths';\nimport { AccessKey, AssociatedTenant, CreatedAccessKeyResponse } from './types';\n\ntype SingleKeyResponse = {\n  key: AccessKey;\n};\n\ntype MultipleKeysResponse = {\n  keys: AccessKey[];\n};\n\nconst withAccessKey = (sdk: CoreSdk, managementKey?: string) => ({\n  /**\n   * Create a new access key for a project.\n   * @param name Access key name\n   * @param expireTime When the access key expires. Keep at 0 to make it indefinite.\n   * @param roles Optional roles in the project. Does not apply for multi-tenants\n   * @param keyTenants Optional associated tenants for this key and its roles for each.\n   * @returns A newly created key and its cleartext. Make sure to save the cleartext securely.\n   */\n  create: (\n    name: string,\n    expireTime: number,\n    roles?: string[],\n    keyTenants?: AssociatedTenant[],\n  ): Promise<SdkResponse<CreatedAccessKeyResponse>> =>\n    transformResponse(\n      sdk.httpClient.post(\n        apiPaths.accessKey.create,\n        { name, expireTime, roleNames: roles, keyTenants },\n        { token: managementKey },\n      ),\n    ),\n  /**\n   * Load an access key.\n   * @param id Access key ID to load\n   * @returns The loaded access key.\n   */\n  load: (id: string): Promise<SdkResponse<AccessKey>> =>\n    transformResponse<SingleKeyResponse, AccessKey>(\n      sdk.httpClient.get(apiPaths.accessKey.load, {\n        queryParams: { id },\n        token: managementKey,\n      }),\n      (data) => data.key,\n    ),\n  /**\n   * Search all access keys\n   * @param tenantIds Optional tenant ID filter to apply on the search results\n   * @returns An array of found access keys\n   */\n  searchAll: (tenantIds?: string[]): Promise<SdkResponse<AccessKey[]>> =>\n    transformResponse<MultipleKeysResponse, AccessKey[]>(\n      sdk.httpClient.post(apiPaths.accessKey.search, { tenantIds }, { token: managementKey }),\n      (data) => data.keys,\n    ),\n  /**\n   * Update an access key.\n   * @param id Access key ID to load\n   * @param name The updated access key name\n   * @returns The updated access key\n   */\n  update: (id: string, name: string): Promise<SdkResponse<AccessKey>> =>\n    transformResponse<SingleKeyResponse, AccessKey>(\n      sdk.httpClient.post(apiPaths.accessKey.update, { id, name }, { token: managementKey }),\n      (data) => data.key,\n    ),\n  /**\n   * Deactivate an access key. Deactivated access keys cannot be used until they are\n   * activated again.\n   * @param id Access key ID to deactivate\n   */\n  deactivate: (id: string): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(apiPaths.accessKey.deactivate, { id }, { token: managementKey }),\n    ),\n  /**\n   * Activate an access key. Only deactivated access keys can be activated again.\n   * @param id Access key ID to activate\n   */\n  activate: (id: string): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(apiPaths.accessKey.activate, { id }, { token: managementKey }),\n    ),\n  /**\n   * Delete an access key. IMPORTANT: This cannot be undone. Use carefully.\n   * @param id Access key ID to delete\n   */\n  delete: (id: string): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(apiPaths.accessKey.delete, { id }, { token: managementKey }),\n    ),\n});\n\nexport default withAccessKey;\n","import { SdkResponse, transformResponse } from '@descope/core-js-sdk';\nimport { CoreSdk } from '../types';\nimport apiPaths from './paths';\nimport { FlowResponse, Screen, Flow } from './types';\n\nconst WithFlow = (sdk: CoreSdk, managementKey?: string) => ({\n  export: (flowId: string): Promise<SdkResponse<FlowResponse>> =>\n    transformResponse(\n      sdk.httpClient.post(apiPaths.flow.export, { flowId }, { token: managementKey }),\n    ),\n  import: (flowId: string, flow: Flow, screens?: Screen[]): Promise<SdkResponse<FlowResponse>> =>\n    transformResponse(\n      sdk.httpClient.post(\n        apiPaths.flow.import,\n        { flowId, flow, screens },\n        { token: managementKey },\n      ),\n    ),\n});\n\nexport default WithFlow;\n","import { SdkResponse, transformResponse } from '@descope/core-js-sdk';\nimport { CoreSdk } from '../types';\nimport apiPaths from './paths';\nimport { Theme, ThemeResponse } from './types';\n\nconst WithTheme = (sdk: CoreSdk, managementKey?: string) => ({\n  export: (): Promise<SdkResponse<ThemeResponse>> =>\n    transformResponse(sdk.httpClient.post(apiPaths.theme.export, {}, { token: managementKey })),\n  import: (theme: Theme): Promise<SdkResponse<ThemeResponse>> =>\n    transformResponse(\n      sdk.httpClient.post(apiPaths.theme.import, { theme }, { token: managementKey }),\n    ),\n});\n\nexport default WithTheme;\n","import nodeFetch, { Headers } from 'node-fetch-commonjs';\n\nglobalThis.Headers ??= Headers;\n\nconst highWaterMarkMb = 1024 * 1024 * 30; // 30MB\n\n// we are increasing the response buffer size due to an issue where node-fetch hangs when response is too big\nconst patchedFetch = (...args: Parameters<typeof nodeFetch>) => {\n  // we can get Request on the first arg, or RequestInfo on the second arg\n  // we want to make sure we are setting the \"highWaterMark\" so we are doing it on both args\n  args.forEach((arg) => {\n    // eslint-disable-next-line no-param-reassign, @typescript-eslint/no-unused-expressions\n    arg && ((arg as any).highWaterMark ??= highWaterMarkMb);\n  });\n\n  return nodeFetch(...args);\n};\n\nexport default patchedFetch as unknown as typeof fetch;\n","import createSdk, { ExchangeAccessKeyResponse, SdkResponse, wrapWith } from '@descope/core-js-sdk';\nimport { JWK, JWTHeaderParameters, KeyLike, errors, importJWK, jwtVerify } from 'jose';\nimport {\n  permissionsClaimName,\n  refreshTokenCookieName,\n  rolesClaimName,\n  sessionTokenCookieName,\n} from './constants';\nimport { getAuthorizationClaimItems, withCookie } from './helpers';\nimport withManagement from './management';\nimport { AuthenticationInfo } from './types';\nimport fetch from './fetch-polyfill';\n\ndeclare const BUILD_VERSION: string;\n\n/** Configuration arguments which include the Descope core SDK args and an optional management key */\ntype NodeSdkArgs = Parameters<typeof createSdk>[0] & {\n  managementKey?: string;\n};\n\nconst nodeSdk = ({ managementKey, ...config }: NodeSdkArgs) => {\n  const coreSdk = createSdk({\n    ...config,\n    fetch,\n    baseHeaders: {\n      ...config.baseHeaders,\n      'x-descope-sdk-name': 'nodejs',\n      'x-descope-sdk-node-version': process?.versions?.node || '',\n      'x-descope-sdk-version': BUILD_VERSION,\n    },\n  });\n\n  const { projectId, logger } = config;\n\n  const keys: Record<string, KeyLike | Uint8Array> = {};\n\n  /** Fetch the public keys (JWKs) from Descope for the configured project */\n  const fetchKeys = async () => {\n    const keysWrapper = await coreSdk.httpClient\n      .get(`v2/keys/${projectId}`)\n      .then((resp) => resp.json());\n    const publicKeys: JWK[] = keysWrapper.keys;\n    if (!Array.isArray(publicKeys)) return {};\n    const kidJwksPairs = await Promise.all(\n      publicKeys.map(async (key) => [key.kid, await importJWK(key)]),\n    );\n\n    return kidJwksPairs.reduce(\n      (acc, [kid, jwk]) => (kid ? { ...acc, [kid.toString()]: jwk } : acc),\n      {},\n    );\n  };\n\n  const management = withManagement(coreSdk, managementKey);\n\n  const sdk = {\n    ...coreSdk,\n\n    /**\n     * Provides various APIs for managing a Descope project programmatically. A management key must\n     * be provided as an argument when initializing the SDK to use these APIs. Management keys can be\n     * generated in the Descope console.\n     */\n    management,\n\n    /** Get the key that can validate the given JWT KID in the header. Can retrieve the public key from local cache or from Descope. */\n    async getKey(header: JWTHeaderParameters): Promise<KeyLike | Uint8Array> {\n      if (!header?.kid) throw Error('header.kid must not be empty');\n\n      if (keys[header.kid]) return keys[header.kid];\n\n      // do we need to fetch once or every time?\n      Object.assign(keys, await fetchKeys());\n\n      if (!keys[header.kid]) throw Error('failed to fetch matching key');\n\n      return keys[header.kid];\n    },\n\n    /**\n     * Validate the given JWT with the right key and make sure the issuer is correct\n     * @param jwt the JWT string to parse and validate\n     * @returns AuthenticationInfo with the parsed token and JWT. Will throw an error if validation fails.\n     */\n    async validateJwt(jwt: string): Promise<AuthenticationInfo> {\n      // Do not hard-code the algo because library does not support `None` so all are valid\n      const res = await jwtVerify(jwt, sdk.getKey, { clockTolerance: 5 });\n      const token = res.payload;\n\n      if (token) {\n        token.iss = token.iss?.split('/').pop(); // support both url and project id as issuer\n        if (token.iss !== projectId) {\n          // We must do the verification here, since issuer can be either project ID or URL\n          throw new errors.JWTClaimValidationFailed(\n            'unexpected \"iss\" claim value',\n            'iss',\n            'check_failed',\n          );\n        }\n      }\n\n      return { jwt, token };\n    },\n\n    /**\n     * Validate an active session\n     * @param sessionToken session JWT to validate\n     * @returns AuthenticationInfo promise or throws Error if there is an issue with JWTs\n     */\n    async validateSession(sessionToken: string): Promise<AuthenticationInfo> {\n      if (!sessionToken) throw Error('session token is required for validation');\n\n      try {\n        const token = await sdk.validateJwt(sessionToken);\n        return token;\n      } catch (error) {\n        /* istanbul ignore next */\n        logger?.error('session validation failed', error);\n        throw Error('session validation failed');\n      }\n    },\n\n    /**\n     * Refresh the session using a refresh token\n     * @param refreshToken refresh JWT to refresh the session with\n     * @returns AuthenticationInfo promise or throws Error if there is an issue with JWTs\n     */\n    async refreshSession(refreshToken: string): Promise<AuthenticationInfo> {\n      if (!refreshToken) throw Error('refresh token is required to refresh a session');\n\n      try {\n        await sdk.validateJwt(refreshToken);\n        const jwtResp = await sdk.refresh(refreshToken);\n        if (jwtResp.ok) {\n          const token = await sdk.validateJwt(jwtResp.data?.sessionJwt);\n          return token;\n        }\n        /* istanbul ignore next */\n        throw Error(jwtResp.error?.errorMessage);\n      } catch (refreshTokenErr) {\n        /* istanbul ignore next */\n        logger?.error('refresh token validation failed', refreshTokenErr);\n        throw Error('refresh token validation failed');\n      }\n    },\n\n    /**\n     * Validate session and refresh it if it expired\n     * @param sessionToken session JWT\n     * @param refreshToken refresh JWT\n     * @returns AuthenticationInfo promise or throws Error if there is an issue with JWTs\n     */\n    async validateAndRefreshSession(\n      sessionToken?: string,\n      refreshToken?: string,\n    ): Promise<AuthenticationInfo> {\n      if (!sessionToken && !refreshToken) throw Error('both session and refresh tokens are empty');\n\n      try {\n        const token = await sdk.validateSession(sessionToken);\n        return token;\n      } catch (error) {\n        /* istanbul ignore next */\n        logger?.log('session validation failed - trying to refresh it');\n      }\n\n      return sdk.refreshSession(refreshToken);\n    },\n\n    /**\n     * Exchange API key (access key) for a session key\n     * @param accessKey access key to exchange for a session JWT\n     * @returns AuthneticationInfo with session JWT data\n     */\n    async exchangeAccessKey(accessKey: string): Promise<AuthenticationInfo> {\n      if (!accessKey) throw Error('access key must not be empty');\n\n      let resp: SdkResponse<ExchangeAccessKeyResponse>;\n      try {\n        resp = await sdk.accessKey.exchange(accessKey);\n      } catch (error) {\n        logger?.error('failed to exchange access key', error);\n        throw Error('could not exchange access key');\n      }\n\n      const { sessionJwt } = resp.data;\n      if (!sessionJwt) {\n        logger?.error('failed to parse exchange access key response');\n        throw Error('could not exchange access key');\n      }\n\n      try {\n        const token = await sdk.validateJwt(sessionJwt);\n        return token;\n      } catch (error) {\n        logger?.error('failed to parse jwt from access key', error);\n        throw Error('could not exchange access key');\n      }\n    },\n\n    /**\n     * Make sure that all given permissions exist on the parsed JWT top level claims\n     * @param authInfo JWT parsed info\n     * @param permissions list of permissions to make sure they exist on te JWT claims\n     * @returns true if all permissions exist, false otherwise\n     */\n    validatePermissions(authInfo: AuthenticationInfo, permissions: string[]): boolean {\n      return sdk.validateTenantPermissions(authInfo, null, permissions);\n    },\n\n    /**\n     * Make sure that all given permissions exist on the parsed JWT tenant claims\n     * @param authInfo JWT parsed info\n     * @param permissions list of permissions to make sure they exist on te JWT claims\n     * @returns true if all permissions exist, false otherwise\n     */\n    validateTenantPermissions(\n      authInfo: AuthenticationInfo,\n      tenant: string,\n      permissions: string[],\n    ): boolean {\n      const granted = getAuthorizationClaimItems(authInfo, permissionsClaimName, tenant);\n      return permissions.every((perm) => granted.includes(perm));\n    },\n\n    /**\n     * Make sure that all given roles exist on the parsed JWT top level claims\n     * @param authInfo JWT parsed info\n     * @param roles list of roles to make sure they exist on te JWT claims\n     * @returns true if all roles exist, false otherwise\n     */\n    validateRoles(authInfo: AuthenticationInfo, roles: string[]): boolean {\n      return sdk.validateTenantRoles(authInfo, null, roles);\n    },\n\n    /**\n     * Make sure that all given roles exist on the parsed JWT tenant claims\n     * @param authInfo JWT parsed info\n     * @param roles list of roles to make sure they exist on te JWT claims\n     * @returns true if all roles exist, false otherwise\n     */\n    validateTenantRoles(authInfo: AuthenticationInfo, tenant: string, roles: string[]): boolean {\n      const membership = getAuthorizationClaimItems(authInfo, rolesClaimName, tenant);\n      return roles.every((role) => membership.includes(role));\n    },\n  };\n\n  return wrapWith(\n    sdk,\n    [\n      'otp.verify.email',\n      'otp.verify.sms',\n      'otp.verify.whatsapp',\n      'magicLink.verify',\n      'enchantedLink.signUp',\n      'enchantedLink.signIn',\n      'oauth.exchange',\n      'saml.exchange',\n      'totp.verify',\n      'webauthn.signIn.finish',\n      'webauthn.signUp.finish',\n      'refresh',\n    ] as const,\n    withCookie,\n  );\n};\n\n/** Descope SDK client with delivery methods enum.\n *\n * Please see full documentation at {@link https://docs.descope.com/guides Descope Docs}\n * @example Usage\n *\n * ```js\n * import descopeSdk from '@descope/node-sdk';\n *\n * const myProjectId = 'xxx';\n * const sdk = descopeSdk({ projectId: myProjectId });\n *\n * const userLoginId = 'loginId';\n * sdk.otp.signIn.email(userLoginId);\n * const jwtResponse = sdk.otp.verify.email(userLoginId, codeFromEmail);\n * ```\n */\n\nnodeSdk.RefreshTokenCookieName = refreshTokenCookieName;\nnodeSdk.SessionTokenCookieName = sessionTokenCookieName;\n\nexport default nodeSdk;\nexport type {\n  DeliveryMethod,\n  OAuthProvider,\n  ResponseData,\n  SdkResponse,\n} from '@descope/core-js-sdk';\n","import { CoreSdk } from '../types';\nimport withUser from './user';\nimport withTenant from './tenant';\nimport withJWT from './jwt';\nimport withPermission from './permission';\nimport withRole from './role';\nimport withGroup from './group';\nimport withSSOSettings from './sso';\nimport withAccessKey from './accesskey';\nimport WithFlow from './flow';\nimport WithTheme from './theme';\n\n/** Constructs a higher level Management API that wraps the functions from code-js-sdk */\nconst withManagement = (sdk: CoreSdk, managementKey?: string) => ({\n  user: withUser(sdk, managementKey),\n  accessKey: withAccessKey(sdk, managementKey),\n  tenant: withTenant(sdk, managementKey),\n  sso: withSSOSettings(sdk, managementKey),\n  jwt: withJWT(sdk, managementKey),\n  permission: withPermission(sdk, managementKey),\n  role: withRole(sdk, managementKey),\n  group: withGroup(sdk, managementKey),\n  flow: WithFlow(sdk, managementKey),\n  theme: WithTheme(sdk, managementKey),\n});\n\nexport default withManagement;\n"],"names":["withCookie","fn","async","args","resp","data","_d","refreshJwt","rest","__rest","cookies","options","push","cookieDomain","cookieMaxAge","cookiePath","_a","response","headers","get","cookie","name","match","RegExp","getCookieValue","_b","_c","Object","assign","getAuthorizationClaimItems","authInfo","claim","tenant","value","token","Array","isArray","apiPaths","create","update","delete","deleteAllTestUsers","load","search","updateStatus","updateEmail","updatePhone","updateDisplayName","updatePicture","updateCustomAttribute","addRole","removeRole","addTenant","removeTenant","generateOTPForTest","generateMagicLinkForTest","generateEnchantedLinkForTest","deactivate","activate","loadAll","settings","metadata","mapping","export","import","loadAllGroups","loadAllGroupsForMember","loadAllGroupMembers","withUser","sdk","managementKey","loginId","email","phone","displayName","roles","userTenants","customAttributes","picture","transformResponse","httpClient","post","roleNames","user","createTestUser","test","invite","queryParams","loadByUserId","userId","searchAll","tenantIds","limit","page","testUsersOnly","withTestUser","users","status","isVerified","verified","attributeKey","attributeValue","addRoles","removeRoles","tenantId","addTenantRoles","removeTenantRoles","generateOTPForTestUser","deliveryMethod","generateMagicLinkForTestUser","uri","URI","generateEnchantedLinkForTestUser","withTenant","selfProvisioningDomains","createWithId","id","tenants","withJWT","jwt","customClaims","withPermission","description","newName","permissions","withRole","permissionNames","withGroup","userIds","loginIds","groupId","withSSOSettings","getSettings","configureSettings","idpURL","idpCert","entityId","redirectURL","domain","configureMetadata","idpMetadataURL","configureMapping","roleMapping","attributeMapping","withAccessKey","expireTime","keyTenants","key","keys","WithFlow","flowId","flow","screens","WithTheme","theme","globalThis","Headers","patchedFetch","forEach","arg","highWaterMark","nodeFetch","nodeSdk","config","coreSdk","createSdk","fetch","baseHeaders","process","versions","node","projectId","logger","management","accessKey","sso","permission","role","group","withManagement","header","kid","Error","publicKeys","then","json","Promise","all","map","importJWK","reduce","acc","jwk","toString","fetchKeys","jwtVerify","getKey","clockTolerance","payload","iss","split","pop","errors","JWTClaimValidationFailed","sessionToken","validateJwt","error","refreshToken","jwtResp","refresh","ok","sessionJwt","errorMessage","refreshTokenErr","validateSession","log","refreshSession","exchange","validatePermissions","validateTenantPermissions","granted","every","perm","includes","validateRoles","validateTenantRoles","membership","wrapWith","RefreshTokenCookieName","SessionTokenCookieName"],"mappings":"mNAEO,MC+BMA,EACVC,GACDC,SAAUC,eACR,MAAMC,QAAaH,KAAME,GAGzB,IAAKC,EAAKC,KACR,OAAOD,EAIT,IAAIE,EAA0BF,EAAKC,MAA/BE,WAAEA,GAAUD,EAAKE,EAAjBC,EAAAA,OAAAH,EAAA,CAAA,eACJ,MAAMI,EAAoB,GAlCP,IAA8BC,EAgDjD,OAZKJ,EASHG,EAAQE,KA5CZ,GDVoC,SCsDoBL,cA5C5BI,OADuBA,EA6CiBH,QA5CxC,EAAAG,EAASE,eAAgB,gBACnDF,aAAA,EAAAA,EAASG,eAAgB,aACjBH,aAAA,EAAAA,EAASI,aAAc,mCAkCZ,QAAbC,EAAAZ,EAAKa,gBAAQ,IAAAD,OAAA,EAAAA,EAAEE,QAAQC,IAAI,iBAC7BZ,EA3Be,EAACa,EAAmCC,KACzD,MAAMC,EAAQF,eAAAA,EAAQE,MAAMC,OAAO,cAAcF,cACjD,OAAOC,EAAQA,EAAM,GAAK,IAAI,EAyBXE,CACE,QAAbC,EAAArB,EAAKa,gBAAQ,IAAAQ,OAAA,EAAAA,EAAEP,QAAQC,IAAI,cDhDC,OCmD9BT,EAAQE,KAAoB,QAAfc,EAAAtB,EAAKa,gBAAU,IAAAS,OAAA,EAAAA,EAAAR,QAAQC,IAAI,gBAMhCQ,OAAAC,OAAAD,OAAAC,OAAA,CAAA,EAAAxB,GAAM,CAAAC,KAAWsB,OAAAC,OAAAD,OAAAC,OAAA,GAAAxB,EAAKC,MAAM,CAAAE,aAAYG,aAAY,WAUpDmB,EACdC,EACAC,EACAC,WAEA,MAAMC,EAAQD,EAC0C,QAApDP,EAA6C,QAA7CT,EAAAc,EAASI,MAAgC,eAAI,IAAAlB,OAAA,EAAAA,EAAAgB,UAAO,IAAAP,OAAA,EAAAA,EAAGM,GACvDD,EAASI,MAAMH,GACnB,OAAOI,MAAMC,QAAQH,GAASA,EAAQ,EACxC,CC7EA,IAAeI,EACP,CACJC,OAAQ,uBACRC,OAAQ,uBACRC,OAAQ,uBACRC,mBAAoB,gCACpBC,KAAM,gBACNC,OAAQ,uBACRC,aAAc,8BACdC,YAAa,6BACbC,YAAa,6BACbC,kBAAmB,4BACnBC,cAAe,+BACfC,sBAAuB,uCACvBC,QAAS,gCACTC,WAAY,mCACZC,UAAW,kCACXC,aAAc,qCACdC,mBAAoB,8BACpBC,yBAA0B,oCAC1BC,6BAA8B,yCApBnBnB,EAsBF,CACTC,OAAQ,4BACRI,KAAM,qBACNC,OAAQ,4BACRJ,OAAQ,4BACRkB,WAAY,gCACZC,SAAU,8BACVlB,OAAQ,6BA7BGH,EA+BL,CACNC,OAAQ,yBACRC,OAAQ,yBACRC,OAAQ,yBACRmB,QAAS,uBAnCEtB,EAqCR,CACHuB,SAAU,wBACVC,SAAU,wBACVC,QAAS,wBAxCEzB,EA0CR,CACHE,OAAQ,uBA3CGF,EA6CD,CACVC,OAAQ,6BACRC,OAAQ,6BACRC,OAAQ,6BACRmB,QAAS,2BAjDEtB,EAmDP,CACJC,OAAQ,uBACRC,OAAQ,uBACRC,OAAQ,uBACRmB,QAAS,qBAvDEtB,EAyDP,CACJ0B,OAAQ,uBACRC,OAAQ,wBA3DG3B,EA6DN,CACL0B,OAAQ,wBACRC,OAAQ,yBA/DG3B,EAiEN,CACL4B,cAAe,qBACfC,uBAAwB,4BACxBC,oBAAqB,0BClDzB,MAAMC,EAAW,CAACC,EAAcC,KAA4B,CAC1DhC,OAAQ,CACNiC,EACAC,EACAC,EACAC,EACAC,EACAC,EACAC,EACAC,IAEAC,EAAAA,kBACEV,EAAIW,WAAWC,KACb5C,EAAcC,OACd,CACEiC,UACAC,QACAC,QACAC,cACAQ,UAAWP,EACXC,cACAC,mBACAC,WAEF,CAAE5C,MAAOoC,KAEVjE,GAASA,EAAK8E,OAYnBC,eAAgB,CACdb,EACAC,EACAC,EACAC,EACAC,EACAC,EACAC,EACAC,IAEAC,EAAAA,kBACEV,EAAIW,WAAWC,KACb5C,EAAcC,OACd,CACEiC,UACAC,QACAC,QACAC,cACAQ,UAAWP,EACXC,cACAS,MAAM,EACNR,mBACAC,WAEF,CAAE5C,MAAOoC,KAEVjE,GAASA,EAAK8E,OAEnBG,OAAQ,CACNf,EACAC,EACAC,EACAC,EACAC,EACAC,EACAC,EACAC,IAEAC,EAAAA,kBACEV,EAAIW,WAAWC,KACb5C,EAAcC,OACd,CACEiC,UACAC,QACAC,QACAC,cACAQ,UAAWP,EACXC,cACAU,QAAQ,EACRT,mBACAC,WAEF,CAAE5C,MAAOoC,KAEVjE,GAASA,EAAK8E,OAEnB5C,OAAQ,CACNgC,EACAC,EACAC,EACAC,EACAC,EACAC,EACAC,EACAC,IAEAC,EAAAA,kBACEV,EAAIW,WAAWC,KACb5C,EAAcE,OACd,CACEgC,UACAC,QACAC,QACAC,cACAQ,UAAWP,EACXC,cACAC,mBACAC,WAEF,CAAE5C,MAAOoC,KAEVjE,GAASA,EAAK8E,OAEnB3C,OAAS+B,GACPQ,EAAAA,kBACEV,EAAIW,WAAWC,KAAK5C,EAAcG,OAAQ,CAAE+B,WAAW,CAAErC,MAAOoC,KAKpE7B,mBAAoB,IAClBsC,EAAiBA,kBACfV,EAAIW,WAAWxC,OAAOH,EAAcI,mBAAoB,CAAE,EAAE,CAAEP,MAAOoC,KAEzE5B,KAAO6B,GACLQ,EAAAA,kBACEV,EAAIW,WAAW7D,IAAIkB,EAAcK,KAAM,CACrC6C,YAAa,CAAEhB,WACfrC,MAAOoC,KAERjE,GAASA,EAAK8E,OAQnBK,aAAeC,GACbV,EAAAA,kBACEV,EAAIW,WAAW7D,IAAIkB,EAAcK,KAAM,CACrC6C,YAAa,CAAEE,UACfvD,MAAOoC,KAERjE,GAASA,EAAK8E,OAanBO,UAAW,CACTC,EACAhB,EACAiB,EACAC,EACAC,EACAC,EACAlB,IAEAE,EAAAA,kBACEV,EAAIW,WAAWC,KACb5C,EAAcM,OACd,CAAEgD,YAAWT,UAAWP,EAAOiB,QAAOC,OAAMC,gBAAeC,eAAclB,oBACzE,CAAE3C,MAAOoC,KAEVjE,GAASA,EAAK2F,QAEnBtC,SAAWa,GACTQ,EAAAA,kBACEV,EAAIW,WAAWC,KACb5C,EAAcO,aACd,CAAE2B,UAAS0B,OAAQ,WACnB,CAAE/D,MAAOoC,KAEVjE,GAASA,EAAK8E,OAEnB1B,WAAac,GACXQ,EAAAA,kBACEV,EAAIW,WAAWC,KACb5C,EAAcO,aACd,CAAE2B,UAAS0B,OAAQ,YACnB,CAAE/D,MAAOoC,KAEVjE,GAASA,EAAK8E,OAEnBtC,YAAa,CACX0B,EACAC,EACA0B,IAEAnB,EAAAA,kBACEV,EAAIW,WAAWC,KACb5C,EAAcQ,YACd,CAAE0B,UAASC,QAAO2B,SAAUD,GAC5B,CAAEhE,MAAOoC,KAEVjE,GAASA,EAAK8E,OAEnBrC,YAAa,CACXyB,EACAE,EACAyB,IAEAnB,EAAAA,kBACEV,EAAIW,WAAWC,KACb5C,EAAcS,YACd,CAAEyB,UAASE,QAAO0B,SAAUD,GAC5B,CAAEhE,MAAOoC,KAEVjE,GAASA,EAAK8E,OAEnBpC,kBAAmB,CAACwB,EAAiBG,IACnCK,EAAiBA,kBACfV,EAAIW,WAAWC,KACb5C,EAAcU,kBACd,CAAEwB,UAASG,eACX,CAAExC,MAAOoC,KAEVjE,GAASA,EAAK8E,OAEnBnC,cAAe,CAACuB,EAAiBO,IAC/BC,EAAiBA,kBACfV,EAAIW,WAAWC,KACb5C,EAAcW,cACd,CAAEuB,UAASO,WACX,CAAE5C,MAAOoC,KAEVjE,GAASA,EAAK8E,OAEnBlC,sBAAuB,CACrBsB,EACA6B,EACAC,IAEAtB,EAAAA,kBACEV,EAAIW,WAAWC,KACb5C,EAAcY,sBACd,CAAEsB,UAAS6B,eAAcC,kBACzB,CAAEnE,MAAOoC,KAEVjE,GAASA,EAAK8E,OAEnBmB,SAAU,CAAC/B,EAAiBI,IAC1BI,EAAiBA,kBACfV,EAAIW,WAAWC,KACb5C,EAAca,QACd,CAAEqB,UAASW,UAAWP,GACtB,CAAEzC,MAAOoC,KAEVjE,GAASA,EAAK8E,OAEnBoB,YAAa,CAAChC,EAAiBI,IAC7BI,EAAiBA,kBACfV,EAAIW,WAAWC,KACb5C,EAAcc,WACd,CAAEoB,UAASW,UAAWP,GACtB,CAAEzC,MAAOoC,KAEVjE,GAASA,EAAK8E,OAEnB/B,UAAW,CAACmB,EAAiBiC,IAC3BzB,EAAiBA,kBACfV,EAAIW,WAAWC,KAAK5C,EAAce,UAAW,CAAEmB,UAASiC,YAAY,CAAEtE,MAAOoC,KAC5EjE,GAASA,EAAK8E,OAEnB9B,aAAc,CAACkB,EAAiBiC,IAC9BzB,EAAiBA,kBACfV,EAAIW,WAAWC,KACb5C,EAAcgB,aACd,CAAEkB,UAASiC,YACX,CAAEtE,MAAOoC,KAEVjE,GAASA,EAAK8E,OAEnBsB,eAAgB,CACdlC,EACAiC,EACA7B,IAEAI,EAAAA,kBACEV,EAAIW,WAAWC,KACb5C,EAAca,QACd,CAAEqB,UAASiC,WAAUtB,UAAWP,GAChC,CAAEzC,MAAOoC,KAEVjE,GAASA,EAAK8E,OAEnBuB,kBAAmB,CACjBnC,EACAiC,EACA7B,IAEAI,EAAAA,kBACEV,EAAIW,WAAWC,KACb5C,EAAcc,WACd,CAAEoB,UAASiC,WAAUtB,UAAWP,GAChC,CAAEzC,MAAOoC,KAEVjE,GAASA,EAAK8E,OAanBwB,uBAAwB,CACtBC,EACArC,IAEAQ,EAAAA,kBACEV,EAAIW,WAAWC,KACb5C,EAAciB,mBACd,CAAEsD,iBAAgBrC,WAClB,CAAErC,MAAOoC,KAEVjE,GAASA,IAcdwG,6BAA8B,CAC5BD,EACArC,EACAuC,IAEA/B,EAAAA,kBACEV,EAAIW,WAAWC,KACb5C,EAAckB,yBACd,CAAEqD,iBAAgBrC,UAASwC,IAAKD,GAChC,CAAE5E,MAAOoC,KAEVjE,GAASA,IAad2G,iCAAkC,CAChCzC,EACAuC,IAEA/B,EAAiBA,kBACfV,EAAIW,WAAWC,KACb5C,EAAcmB,6BACd,CAAEe,UAASwC,IAAKD,GAChB,CAAE5E,MAAOoC,KAEVjE,GAASA,MC1YV4G,EAAa,CAAC5C,EAAcC,KAA4B,CAC5DhC,OAAQ,CACNjB,EACA6F,IAEAnC,EAAiBA,kBACfV,EAAIW,WAAWC,KACb5C,EAAgBC,OAChB,CAAEjB,OAAM6F,2BACR,CAAEhF,MAAOoC,KAGf6C,aAAc,CACZC,EACA/F,EACA6F,IAEAnC,EAAAA,kBACEV,EAAIW,WAAWC,KACb5C,EAAgBC,OAChB,CAAE8E,KAAI/F,OAAM6F,2BACZ,CAAEhF,MAAOoC,KAGf/B,OAAQ,CACN6E,EACA/F,EACA6F,IAEAnC,EAAAA,kBACEV,EAAIW,WAAWC,KACb5C,EAAgBE,OAChB,CAAE6E,KAAI/F,OAAM6F,2BACZ,CAAEhF,MAAOoC,KAGf9B,OAAS4E,GACPrC,EAAAA,kBACEV,EAAIW,WAAWC,KAAK5C,EAAgBG,OAAQ,CAAE4E,MAAM,CAAElF,MAAOoC,KAEjEX,QAAS,IACPoB,EAAiBA,kBACfV,EAAIW,WAAW7D,IAAIkB,EAAgBsB,QAAS,CAC1CzB,MAAOoC,KAERjE,GAASA,EAAKgH,YCjDfC,EAAU,CAACjD,EAAcC,KAA4B,CACzD/B,OAAQ,CACNgF,EACAC,IAEAzC,EAAiBA,kBACfV,EAAIW,WAAWC,KAAK5C,EAAaE,OAAQ,CAAEgF,MAAKC,gBAAgB,CAAEtF,MAAOoC,OCFzEmD,EAAiB,CAACpD,EAAcC,KAA4B,CAChEhC,OAAQ,CAACjB,EAAcqG,IACrB3C,EAAiBA,kBACfV,EAAIW,WAAWC,KACb5C,EAAoBC,OACpB,CAAEjB,OAAMqG,eACR,CAAExF,MAAOoC,KAGf/B,OAAQ,CAAClB,EAAcsG,EAAiBD,IACtC3C,EAAAA,kBACEV,EAAIW,WAAWC,KACb5C,EAAoBE,OACpB,CAAElB,OAAMsG,UAASD,eACjB,CAAExF,MAAOoC,KAGf9B,OAASnB,GACP0D,EAAAA,kBACEV,EAAIW,WAAWC,KAAK5C,EAAoBG,OAAQ,CAAEnB,QAAQ,CAAEa,MAAOoC,KAEvEX,QAAS,IACPoB,EAAiBA,kBACfV,EAAIW,WAAW7D,IAAIkB,EAAoBsB,QAAS,CAC9CzB,MAAOoC,KAERjE,GAASA,EAAKuH,gBC1BfC,EAAW,CAACxD,EAAcC,KAA4B,CAC1DhC,OAAQ,CACNjB,EACAqG,EACAI,IAEA/C,EAAAA,kBACEV,EAAIW,WAAWC,KACb5C,EAAcC,OACd,CAAEjB,OAAMqG,cAAaI,mBACrB,CAAE5F,MAAOoC,KAGf/B,OAAQ,CACNlB,EACAsG,EACAD,EACAI,IAEA/C,oBACEV,EAAIW,WAAWC,KACb5C,EAAcE,OACd,CAAElB,OAAMsG,UAASD,cAAaI,mBAC9B,CAAE5F,MAAOoC,KAGf9B,OAASnB,GACP0D,EAAAA,kBACEV,EAAIW,WAAWC,KAAK5C,EAAcG,OAAQ,CAAEnB,QAAQ,CAAEa,MAAOoC,KAEjEX,QAAS,IACPoB,EAAiBA,kBACfV,EAAIW,WAAW7D,IAAIkB,EAAcsB,QAAS,CACxCzB,MAAOoC,KAERjE,GAASA,EAAKsE,UCvCfoD,EAAY,CAAC1D,EAAcC,KAA4B,CAM3DL,cAAgBuC,GACdzB,EAAAA,kBACEV,EAAIW,WAAWC,KAAK5C,EAAe4B,cAAe,CAAEuC,YAAY,CAAEtE,MAAOoC,KAU7EJ,uBAAwB,CACtBsC,EACAwB,EACAC,IAEAlD,EAAAA,kBACEV,EAAIW,WAAWC,KACb5C,EAAe6B,uBACf,CAAEsC,WAAUyB,WAAUD,WACtB,CAAE9F,MAAOoC,KAUfH,oBAAqB,CAACqC,EAAkB0B,IACtCnD,EAAiBA,kBACfV,EAAIW,WAAWC,KACb5C,EAAe8B,oBACf,CAAEqC,WAAU0B,WACZ,CAAEhG,MAAOoC,OC1CX6D,EAAkB,CAAC9D,EAAcC,KAA4B,CACjE8D,YAAc5B,GACZzB,EAAAA,kBACEV,EAAIW,WAAW7D,IAAIkB,EAAauB,SAAU,CACxC2B,YAAa,CAAEiB,YACftE,MAAOoC,KAERjE,GAASA,IAEdgI,kBAAmB,CACjB7B,EACA8B,EACAC,EACAC,EACAC,EACAC,IAEA3D,EAAiBA,kBACfV,EAAIW,WAAWC,KACb5C,EAAauB,SACb,CAAE4C,WAAU8B,SAAQE,WAAUD,UAASE,cAAaC,UACpD,CAAExG,MAAOoC,KAGfqE,kBAAmB,CAACnC,EAAkBoC,IACpC7D,EAAiBA,kBACfV,EAAIW,WAAWC,KACb5C,EAAawB,SACb,CAAE2C,WAAUoC,kBACZ,CAAE1G,MAAOoC,KAGfuE,iBAAkB,CAChBrC,EACAsC,EACAC,IAEAhE,EAAAA,kBACEV,EAAIW,WAAWC,KACb5C,EAAayB,QACb,CAAE0C,WAAUsC,cAAaC,oBACzB,CAAE7G,MAAOoC,OCjCX0E,EAAgB,CAAC3E,EAAcC,KAA4B,CAS/DhC,OAAQ,CACNjB,EACA4H,EACAtE,EACAuE,IAEAnE,EAAAA,kBACEV,EAAIW,WAAWC,KACb5C,EAAmBC,OACnB,CAAEjB,OAAM4H,aAAY/D,UAAWP,EAAOuE,cACtC,CAAEhH,MAAOoC,KAQf5B,KAAO0E,GACLrC,EAAAA,kBACEV,EAAIW,WAAW7D,IAAIkB,EAAmBK,KAAM,CAC1C6C,YAAa,CAAE6B,MACflF,MAAOoC,KAERjE,GAASA,EAAK8I,MAOnBzD,UAAYC,GACVZ,oBACEV,EAAIW,WAAWC,KAAK5C,EAAmBM,OAAQ,CAAEgD,aAAa,CAAEzD,MAAOoC,KACtEjE,GAASA,EAAK+I,OAQnB7G,OAAQ,CAAC6E,EAAY/F,IACnB0D,EAAiBA,kBACfV,EAAIW,WAAWC,KAAK5C,EAAmBE,OAAQ,CAAE6E,KAAI/F,QAAQ,CAAEa,MAAOoC,KACrEjE,GAASA,EAAK8I,MAOnB1F,WAAa2D,GACXrC,EAAAA,kBACEV,EAAIW,WAAWC,KAAK5C,EAAmBoB,WAAY,CAAE2D,MAAM,CAAElF,MAAOoC,KAMxEZ,SAAW0D,GACTrC,EAAAA,kBACEV,EAAIW,WAAWC,KAAK5C,EAAmBqB,SAAU,CAAE0D,MAAM,CAAElF,MAAOoC,KAMtE9B,OAAS4E,GACPrC,EAAAA,kBACEV,EAAIW,WAAWC,KAAK5C,EAAmBG,OAAQ,CAAE4E,MAAM,CAAElF,MAAOoC,OCvFhE+E,EAAW,CAAChF,EAAcC,KAA4B,CAC1DP,OAASuF,GACPvE,EAAAA,kBACEV,EAAIW,WAAWC,KAAK5C,EAAc0B,OAAQ,CAAEuF,UAAU,CAAEpH,MAAOoC,KAEnEN,OAAQ,CAACsF,EAAgBC,EAAYC,IACnCzE,EAAAA,kBACEV,EAAIW,WAAWC,KACb5C,EAAc2B,OACd,CAAEsF,SAAQC,OAAMC,WAChB,CAAEtH,MAAOoC,OCVXmF,EAAY,CAACpF,EAAcC,KAA4B,CAC3DP,OAAQ,IACNgB,EAAiBA,kBAACV,EAAIW,WAAWC,KAAK5C,EAAe0B,OAAQ,CAAE,EAAE,CAAE7B,MAAOoC,KAC5EN,OAAS0F,GACP3E,EAAAA,kBACEV,EAAIW,WAAWC,KAAK5C,EAAe2B,OAAQ,CAAE0F,SAAS,CAAExH,MAAOoC,aCRnD,QAAlBtD,EAAA2I,WAAWC,eAAO,IAAA5I,IAAlB2I,WAAWC,QAAYA,EAAOA,SAE9B,MAGMC,EAAe,IAAI1J,KAGvBA,EAAK2J,SAASC,YAEZA,YAAS/I,GAAAS,EAAAsI,GAAYC,+BAAAA,cARD,UAQmC,IAGlDC,EAAS,WAAI9J,ICKhB+J,EAAWlJ,WAAAsD,cAAEA,GAAuCtD,EAArBmJ,EAAM1J,EAAAA,OAAAO,EAA1B,mBACf,MAAMoJ,EAAUC,UACX1I,OAAAC,OAAAD,OAAAC,OAAA,CAAA,EAAAuI,UACHG,EACAC,YAAW5I,OAAAC,OAAAD,OAAAC,OAAA,CAAA,EACNuI,EAAOI,cACV,qBAAsB,SACtB,8BAAiD,UAAZ,OAAPC,cAAO,IAAPA,aAAO,EAAPA,QAASC,gBAAU,IAAAhJ,OAAA,EAAAA,EAAAiJ,OAAQ,GACzD,wBAAyB,cAIvBC,UAAEA,EAASC,OAAEA,GAAWT,EAExBf,EAA6C,CAAA,EAmB7CyB,ECxCe,EAACxG,EAAcC,KAA4B,CAChEa,KAAMf,EAASC,EAAKC,GACpBwG,UAAW9B,EAAc3E,EAAKC,GAC9BtC,OAAQiF,EAAW5C,EAAKC,GACxByG,IAAK5C,EAAgB9D,EAAKC,GAC1BiD,IAAKD,EAAQjD,EAAKC,GAClB0G,WAAYvD,EAAepD,EAAKC,GAChC2G,KAAMpD,EAASxD,EAAKC,GACpB4G,MAAOnD,EAAU1D,EAAKC,GACtBiF,KAAMF,EAAShF,EAAKC,GACpBoF,MAAOD,EAAUpF,EAAKC,KD8BH6G,CAAef,EAAS9F,GAErCD,iCACD+F,GAAO,CAOVS,aAGA3K,aAAakL,GACX,KAAKA,aAAA,EAAAA,EAAQC,KAAK,MAAMC,MAAM,gCAE9B,GAAIlC,EAAKgC,EAAOC,KAAM,OAAOjC,EAAKgC,EAAOC,KAKzC,GAFA1J,OAAOC,OAAOwH,OAnCAlJ,WAChB,MAGMqL,SAHoBnB,EAAQpF,WAC/B7D,IAAI,WAAWwJ,KACfa,MAAMpL,GAASA,EAAKqL,UACerC,KACtC,OAAKjH,MAAMC,QAAQmJ,UACQG,QAAQC,IACjCJ,EAAWK,KAAI1L,MAAOiJ,GAAQ,CAACA,EAAIkC,UAAWQ,EAAAA,UAAU1C,QAGtC2C,QAClB,CAACC,GAAMV,EAAKW,KAAUX,EAAW1J,OAAAC,OAAAD,OAAAC,OAAA,CAAA,EAAAmK,IAAK,CAACV,EAAIY,YAAaD,IAAQD,GAChE,CAAE,GAPmC,EAQtC,EAsB2BG,KAErB9C,EAAKgC,EAAOC,KAAM,MAAMC,MAAM,gCAEnC,OAAOlC,EAAKgC,EAAOC,IACpB,EAODnL,kBAAkBqH,SAEhB,MACMrF,SADYiK,EAASA,UAAC5E,EAAKlD,EAAI+H,OAAQ,CAAEC,eAAgB,KAC7CC,QAElB,GAAIpK,IACFA,EAAMqK,IAAe,QAATvL,EAAAkB,EAAMqK,WAAG,IAAAvL,OAAA,EAAAA,EAAEwL,MAAM,KAAKC,MAC9BvK,EAAMqK,MAAQ5B,GAEhB,MAAM,IAAI+B,EAAMA,OAACC,yBACf,+BACA,MACA,gBAKN,MAAO,CAAEpF,MAAKrF,QACf,EAODhC,sBAAsB0M,GACpB,IAAKA,EAAc,MAAMtB,MAAM,4CAE/B,IAEE,aADoBjH,EAAIwI,YAAYD,EAMrC,CAJC,MAAOE,GAGP,MADAlC,SAAAA,EAAQkC,MAAM,4BAA6BA,GACrCxB,MAAM,4BACb,CACF,EAODpL,qBAAqB6M,WACnB,IAAKA,EAAc,MAAMzB,MAAM,kDAE/B,UACQjH,EAAIwI,YAAYE,GACtB,MAAMC,QAAgB3I,EAAI4I,QAAQF,GAClC,GAAIC,EAAQE,GAAI,CAEd,aADoB7I,EAAIwI,YAA0B,QAAd7L,EAAAgM,EAAQ3M,YAAM,IAAAW,OAAA,EAAAA,EAAAmM,WAEnD,CAED,MAAM7B,MAAmB,QAAb7J,EAAAuL,EAAQF,aAAK,IAAArL,OAAA,EAAAA,EAAE2L,aAK5B,CAJC,MAAOC,GAGP,MADAzC,SAAAA,EAAQkC,MAAM,kCAAmCO,GAC3C/B,MAAM,kCACb,CACF,EAQDpL,gCACE0M,EACAG,GAEA,IAAKH,IAAiBG,EAAc,MAAMzB,MAAM,6CAEhD,IAEE,aADoBjH,EAAIiJ,gBAAgBV,EAKzC,CAHC,MAAOE,GAEPlC,SAAAA,EAAQ2C,IAAI,mDACb,CAED,OAAOlJ,EAAImJ,eAAeT,EAC3B,EAOD7M,wBAAwB4K,GACtB,IAAKA,EAAW,MAAMQ,MAAM,gCAE5B,IAAIlL,EACJ,IACEA,QAAaiE,EAAIyG,UAAU2C,SAAS3C,EAIrC,CAHC,MAAOgC,GAEP,MADAlC,SAAAA,EAAQkC,MAAM,gCAAiCA,GACzCxB,MAAM,gCACb,CAED,MAAM6B,WAAEA,GAAe/M,EAAKC,KAC5B,IAAK8M,EAEH,MADAvC,SAAAA,EAAQkC,MAAM,gDACRxB,MAAM,iCAGd,IAEE,aADoBjH,EAAIwI,YAAYM,EAKrC,CAHC,MAAOL,GAEP,MADAlC,SAAAA,EAAQkC,MAAM,sCAAuCA,GAC/CxB,MAAM,gCACb,CACF,EAQDoC,oBAAmB,CAAC5L,EAA8B8F,IACzCvD,EAAIsJ,0BAA0B7L,EAAU,KAAM8F,GASvD+F,0BACE7L,EACAE,EACA4F,GAEA,MAAMgG,EAAU/L,EAA2BC,EdrNb,ccqN6CE,GAC3E,OAAO4F,EAAYiG,OAAOC,GAASF,EAAQG,SAASD,IACrD,EAQDE,cAAa,CAAClM,EAA8B6C,IACnCN,EAAI4J,oBAAoBnM,EAAU,KAAM6C,GASjDsJ,oBAAoBnM,EAA8BE,EAAgB2C,GAChE,MAAMuJ,EAAarM,EAA2BC,EdxOtB,QcwOgDE,GACxE,OAAO2C,EAAMkJ,OAAO5C,GAASiD,EAAWH,SAAS9C,IAClD,IAGH,OAAOkD,EAAAA,SACL9J,EACA,CACE,mBACA,iBACA,sBACA,mBACA,uBACA,uBACA,iBACA,gBACA,cACA,yBACA,yBACA,WAEFrE,EACD,EAoBHkK,EAAQkE,uBd1R8B,Mc2RtClE,EAAQmE,uBdzR8B"}
+{"version":3,"file":"index.cjs.js","sources":["../../lib/constants.ts","../../lib/helpers.ts","../../lib/management/paths.ts","../../lib/management/user.ts","../../lib/management/tenant.ts","../../lib/management/jwt.ts","../../lib/management/permission.ts","../../lib/management/role.ts","../../lib/management/group.ts","../../lib/management/sso.ts","../../lib/management/accesskey.ts","../../lib/management/flow.ts","../../lib/management/theme.ts","../../lib/fetch-polyfill.ts","../../lib/index.ts","../../lib/management/index.ts"],"sourcesContent":["// eslint-disable-next-line import/prefer-default-export\n/** Refresh JWT cookie name */\nexport const refreshTokenCookieName = 'DSR';\n/** Session JWT cookie name */\nexport const sessionTokenCookieName = 'DS';\n/** The key of the tenants claims in the claims map */\nexport const authorizedTenantsClaimName = 'tenants';\n/** The key of the permissions claims in the claims map either under tenant or top level */\nexport const permissionsClaimName = 'permissions';\n/** The key of the roles claims in the claims map either under tenant or top level */\nexport const rolesClaimName = 'roles';\n","import type { SdkFnWrapper } from '@descope/core-js-sdk';\nimport { authorizedTenantsClaimName, refreshTokenCookieName } from './constants';\nimport { AuthenticationInfo } from './types';\n\n/**\n * Generate a cookie string from given parameters\n * @param name name of the cookie\n * @param value value of cookie that must be already encoded\n * @param options any options to put on the cookie like cookieDomain, cookieMaxAge, cookiePath\n * @returns Cookie string with all options on the string\n */\nconst generateCookie = (name: string, value: string, options?: Record<string, string | number>) =>\n  `${name}=${value}; Domain=${options?.cookieDomain || ''}; Max-Age=${\n    options?.cookieMaxAge || ''\n  }; Path=${options?.cookiePath || '/'}; HttpOnly; SameSite=Strict`;\n\n/**\n * Parse the cookie string and return the value of the cookie\n * @param cookie the raw cookie string\n * @param name the name of the cookie to get value for\n * @returns the value of the given cookie\n */\nconst getCookieValue = (cookie: string | null | undefined, name: string) => {\n  const match = cookie?.match(RegExp(`(?:^|;\\\\s*)${name}=([^;]*)`));\n  return match ? match[1] : null;\n};\n\n// eslint-disable-next-line import/prefer-default-export\n/**\n * Add cookie generation to core-js functions.\n * @param fn the function we are wrapping\n * @returns Wrapped function with cookie generation\n */\nexport const withCookie: SdkFnWrapper<{ refreshJwt?: string; cookies?: string[] }> =\n  (fn) =>\n  async (...args) => {\n    const resp = await fn(...args);\n\n    // istanbul ignore next\n    if (!resp.data) {\n      return resp;\n    }\n\n    // eslint-disable-next-line prefer-const\n    let { refreshJwt, ...rest } = resp.data;\n    const cookies: string[] = [];\n\n    if (!refreshJwt) {\n      if (resp.response?.headers.get('set-cookie')) {\n        refreshJwt = getCookieValue(\n          resp.response?.headers.get('set-cookie'),\n          refreshTokenCookieName,\n        );\n        cookies.push(resp.response?.headers.get('set-cookie')!);\n      }\n    } else {\n      cookies.push(generateCookie(refreshTokenCookieName, refreshJwt, rest));\n    }\n\n    return { ...resp, data: { ...resp.data, refreshJwt, cookies } };\n  };\n\n/**\n * Get the claim (used for permissions or roles) for a given tenant or top level if tenant is empty\n * @param authInfo The parsed authentication info from the JWT\n * @param claim name of the claim\n * @param tenant tenant to retrieve the claim for\n * @returns\n */\nexport function getAuthorizationClaimItems(\n  authInfo: AuthenticationInfo,\n  claim: string,\n  tenant?: string,\n): string[] {\n  const value = tenant\n    ? authInfo.token[authorizedTenantsClaimName]?.[tenant]?.[claim]\n    : authInfo.token[claim];\n  return Array.isArray(value) ? value : [];\n}\n","/** API paths for the Descope service Management APIs */\nexport default {\n  user: {\n    create: '/v1/mgmt/user/create',\n    update: '/v1/mgmt/user/update',\n    delete: '/v1/mgmt/user/delete',\n    deleteAllTestUsers: '/v1/mgmt/user/test/delete/all',\n    load: '/v1/mgmt/user',\n    search: '/v1/mgmt/user/search',\n    updateStatus: '/v1/mgmt/user/update/status',\n    updateEmail: '/v1/mgmt/user/update/email',\n    updatePhone: '/v1/mgmt/user/update/phone',\n    updateDisplayName: '/v1/mgmt/user/update/name',\n    updatePicture: '/v1/mgmt/user/update/picture',\n    updateCustomAttribute: '/v1/mgmt/user/update/customAttribute',\n    addRole: '/v1/mgmt/user/update/role/add',\n    removeRole: '/v1/mgmt/user/update/role/remove',\n    addTenant: '/v1/mgmt/user/update/tenant/add',\n    removeTenant: '/v1/mgmt/user/update/tenant/remove',\n    setPassword: '/v1/mgmt/user/password/set',\n    expirePassword: '/v1/mgmt/user/password/expire',\n    generateOTPForTest: '/v1/mgmt/tests/generate/otp',\n    generateMagicLinkForTest: '/v1/mgmt/tests/generate/magiclink',\n    generateEnchantedLinkForTest: '/v1/mgmt/tests/generate/enchantedlink',\n  },\n  accessKey: {\n    create: '/v1/mgmt/accesskey/create',\n    load: '/v1/mgmt/accesskey',\n    search: '/v1/mgmt/accesskey/search',\n    update: '/v1/mgmt/accesskey/update',\n    deactivate: '/v1/mgmt/accesskey/deactivate',\n    activate: '/v1/mgmt/accesskey/activate',\n    delete: '/v1/mgmt/accesskey/delete',\n  },\n  tenant: {\n    create: '/v1/mgmt/tenant/create',\n    update: '/v1/mgmt/tenant/update',\n    delete: '/v1/mgmt/tenant/delete',\n    loadAll: '/v1/mgmt/tenant/all',\n  },\n  sso: {\n    settings: '/v1/mgmt/sso/settings',\n    metadata: '/v1/mgmt/sso/metadata',\n    mapping: '/v1/mgmt/sso/mapping',\n  },\n  jwt: {\n    update: '/v1/mgmt/jwt/update',\n  },\n  permission: {\n    create: '/v1/mgmt/permission/create',\n    update: '/v1/mgmt/permission/update',\n    delete: '/v1/mgmt/permission/delete',\n    loadAll: '/v1/mgmt/permission/all',\n  },\n  role: {\n    create: '/v1/mgmt/role/create',\n    update: '/v1/mgmt/role/update',\n    delete: '/v1/mgmt/role/delete',\n    loadAll: '/v1/mgmt/role/all',\n  },\n  flow: {\n    export: '/v1/mgmt/flow/export',\n    import: '/v1/mgmt/flow/import',\n  },\n  theme: {\n    export: '/v1/mgmt/theme/export',\n    import: '/v1/mgmt/theme/import',\n  },\n  group: {\n    loadAllGroups: '/v1/mgmt/group/all',\n    loadAllGroupsForMember: '/v1/mgmt/group/member/all',\n    loadAllGroupMembers: '/v1/mgmt/group/members',\n  },\n};\n","import { DeliveryMethod, SdkResponse, transformResponse, UserResponse } from '@descope/core-js-sdk';\nimport { CoreSdk } from '../types';\nimport apiPaths from './paths';\nimport {\n  AssociatedTenant,\n  GenerateEnchantedLinkForTestResponse,\n  GenerateMagicLinkForTestResponse,\n  GenerateOTPForTestResponse,\n  AttributesTypes,\n} from './types';\n\ntype SingleUserResponse = {\n  user: UserResponse;\n};\n\ntype MultipleUsersResponse = {\n  users: UserResponse[];\n};\n\nconst withUser = (sdk: CoreSdk, managementKey?: string) => ({\n  create: (\n    loginId: string,\n    email?: string,\n    phone?: string,\n    displayName?: string,\n    roles?: string[],\n    userTenants?: AssociatedTenant[],\n    customAttributes?: Record<string, AttributesTypes>,\n    picture?: string,\n  ): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.create,\n        {\n          loginId,\n          email,\n          phone,\n          displayName,\n          roleNames: roles,\n          userTenants,\n          customAttributes,\n          picture,\n        },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  /**\n   * Create a new test user.\n   * The loginID is required and will determine what the user will use to sign in.\n   * Make sure the login id is unique for test. All other fields are optional.\n   *\n   * You can later generate OTP, Magic link and enchanted link to use in the test without the need\n   * of 3rd party messaging services.\n   * Those users are not counted as part of the monthly active users\n   * @returns The UserResponse if found, throws otherwise.\n   */\n  createTestUser: (\n    loginId: string,\n    email?: string,\n    phone?: string,\n    displayName?: string,\n    roles?: string[],\n    userTenants?: AssociatedTenant[],\n    customAttributes?: Record<string, AttributesTypes>,\n    picture?: string,\n  ): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.create,\n        {\n          loginId,\n          email,\n          phone,\n          displayName,\n          roleNames: roles,\n          userTenants,\n          test: true,\n          customAttributes,\n          picture,\n        },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  invite: (\n    loginId: string,\n    email?: string,\n    phone?: string,\n    displayName?: string,\n    roles?: string[],\n    userTenants?: AssociatedTenant[],\n    customAttributes?: Record<string, AttributesTypes>,\n    picture?: string,\n  ): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.create,\n        {\n          loginId,\n          email,\n          phone,\n          displayName,\n          roleNames: roles,\n          userTenants,\n          invite: true,\n          customAttributes,\n          picture,\n        },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  update: (\n    loginId: string,\n    email?: string,\n    phone?: string,\n    displayName?: string,\n    roles?: string[],\n    userTenants?: AssociatedTenant[],\n    customAttributes?: Record<string, AttributesTypes>,\n    picture?: string,\n  ): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.update,\n        {\n          loginId,\n          email,\n          phone,\n          displayName,\n          roleNames: roles,\n          userTenants,\n          customAttributes,\n          picture,\n        },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  delete: (loginId: string): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(apiPaths.user.delete, { loginId }, { token: managementKey }),\n    ),\n  /**\n   * Delete all test users in the project.\n   */\n  deleteAllTestUsers: (): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.delete(apiPaths.user.deleteAllTestUsers, { token: managementKey }),\n    ),\n  load: (loginId: string): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.get(apiPaths.user.load, {\n        queryParams: { loginId },\n        token: managementKey,\n      }),\n      (data) => data.user,\n    ),\n  /**\n   * Load an existing user by user ID. The ID can be found\n   * on the user's JWT.\n   * @param userId load a user by this user ID field\n   * @returns The UserResponse if found, throws otherwise.\n   */\n  loadByUserId: (userId: string): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.get(apiPaths.user.load, {\n        queryParams: { userId },\n        token: managementKey,\n      }),\n      (data) => data.user,\n    ),\n  /**\n   * Search all users. Results can be filtered according to tenants and/or\n   * roles, and also paginated used the limit and page parameters.\n   * @param tenantIds optional list of tenant IDs to filter by\n   * @param roles optional list of roles to filter by\n   * @param limit optionally limit the response, leave out for default limit\n   * @param page optionally paginate over the response\n   * @param testUsersOnly optionally filter only test users\n   * @param withTestUser optionally include test users in search\n   * @returns An array of UserResponse found by the query\n   */\n  searchAll: (\n    tenantIds?: string[],\n    roles?: string[],\n    limit?: number,\n    page?: number,\n    testUsersOnly?: boolean,\n    withTestUser?: boolean,\n    customAttributes?: Record<string, AttributesTypes>,\n  ): Promise<SdkResponse<UserResponse[]>> =>\n    transformResponse<MultipleUsersResponse, UserResponse[]>(\n      sdk.httpClient.post(\n        apiPaths.user.search,\n        { tenantIds, roleNames: roles, limit, page, testUsersOnly, withTestUser, customAttributes },\n        { token: managementKey },\n      ),\n      (data) => data.users,\n    ),\n  activate: (loginId: string): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.updateStatus,\n        { loginId, status: 'enabled' },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  deactivate: (loginId: string): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.updateStatus,\n        { loginId, status: 'disabled' },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  updateEmail: (\n    loginId: string,\n    email: string,\n    isVerified: boolean,\n  ): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.updateEmail,\n        { loginId, email, verified: isVerified },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  updatePhone: (\n    loginId: string,\n    phone: string,\n    isVerified: boolean,\n  ): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.updatePhone,\n        { loginId, phone, verified: isVerified },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  updateDisplayName: (loginId: string, displayName: string): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.updateDisplayName,\n        { loginId, displayName },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  updatePicture: (loginId: string, picture: string): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.updatePicture,\n        { loginId, picture },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  updateCustomAttribute: (\n    loginId: string,\n    attributeKey: string,\n    attributeValue: AttributesTypes,\n  ): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.updateCustomAttribute,\n        { loginId, attributeKey, attributeValue },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  addRoles: (loginId: string, roles: string[]): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.addRole,\n        { loginId, roleNames: roles },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  removeRoles: (loginId: string, roles: string[]): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.removeRole,\n        { loginId, roleNames: roles },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  addTenant: (loginId: string, tenantId: string): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(apiPaths.user.addTenant, { loginId, tenantId }, { token: managementKey }),\n      (data) => data.user,\n    ),\n  removeTenant: (loginId: string, tenantId: string): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.removeTenant,\n        { loginId, tenantId },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  addTenantRoles: (\n    loginId: string,\n    tenantId: string,\n    roles: string[],\n  ): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.addRole,\n        { loginId, tenantId, roleNames: roles },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  removeTenantRoles: (\n    loginId: string,\n    tenantId: string,\n    roles: string[],\n  ): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.removeRole,\n        { loginId, tenantId, roleNames: roles },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n\n  /**\n   * Generate OTP for the given login ID of a test user.\n   * Choose the selected delivery method for verification.\n   * Returns the code for the login (exactly as it sent via Email or SMS)\n   * This is useful when running tests and don't want to use 3rd party messaging services\n   *\n   * @param deliveryMethod optional DeliveryMethod\n   * @param loginId login ID of a test user\n   * @returns GenerateOTPForTestResponse which includes the loginId and the OTP code\n   */\n  generateOTPForTestUser: (\n    deliveryMethod: DeliveryMethod,\n    loginId: string,\n  ): Promise<SdkResponse<GenerateOTPForTestResponse>> =>\n    transformResponse<GenerateOTPForTestResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.generateOTPForTest,\n        { deliveryMethod, loginId },\n        { token: managementKey },\n      ),\n      (data) => data,\n    ),\n\n  /**\n   * Generate Magic Link for the given login ID of a test user.\n   * Choose the selected delivery method for verification.\n   * It returns the link for the login (exactly as it sent via Email)\n   * This is useful when running tests and don't want to use 3rd party messaging services\n   *\n   * @param deliveryMethod optional DeliveryMethod\n   * @param loginId login ID of a test user\n   * @param uri optional redirect uri which will be used instead of any global configuration.\n   * @returns GenerateMagicLinkForTestResponse which includes the loginId and the magic link\n   */\n  generateMagicLinkForTestUser: (\n    deliveryMethod: DeliveryMethod,\n    loginId: string,\n    uri: string,\n  ): Promise<SdkResponse<GenerateMagicLinkForTestResponse>> =>\n    transformResponse<GenerateMagicLinkForTestResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.generateMagicLinkForTest,\n        { deliveryMethod, loginId, URI: uri },\n        { token: managementKey },\n      ),\n      (data) => data,\n    ),\n\n  /**\n   * Generate Enchanted Link for the given login ID of a test user.\n   * It returns the link for the login (exactly as it sent via Email)\n   * and pendingRef which is used to poll for a valid session\n   * This is useful when running tests and don't want to use 3rd party messaging services\n   *\n   * @param loginId login ID of a test user\n   * @param uri optional redirect uri which will be used instead of any global configuration.\n   * @returns GenerateEnchantedLinkForTestResponse which includes the loginId, the enchanted link and the pendingRef\n   */\n  generateEnchantedLinkForTestUser: (\n    loginId: string,\n    uri: string,\n  ): Promise<SdkResponse<GenerateEnchantedLinkForTestResponse>> =>\n    transformResponse<GenerateEnchantedLinkForTestResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.generateEnchantedLinkForTest,\n        { loginId, URI: uri },\n        { token: managementKey },\n      ),\n      (data) => data,\n    ),\n\n  /**\n   * Set password for the given login ID of user.\n   * Note: The password will automatically be set as expired.\n   * The user will not be able to log-in with this password, and will be required to replace it on next login.\n   * See also: expirePassword\n   * @param loginId login ID of a test user\n   * @param password The password to set for the user\n   */\n  setPassword: (loginId: string, password: string): Promise<SdkResponse<never>> =>\n    transformResponse<never>(\n      sdk.httpClient.post(\n        apiPaths.user.setPassword,\n        { loginId, password },\n        { token: managementKey },\n      ),\n      (data) => data,\n    ),\n\n  /**\n   * Expire password for the given login ID.\n   * Note: user sign-in with an expired password, the user will get an error with code.\n   * Use the `ResetPassword` or `ReplacePassword` methods to reset/replace the password.\n   * @param loginId login ID of a test user\n   */\n  expirePassword: (loginId: string): Promise<SdkResponse<never>> =>\n    transformResponse<never>(\n      sdk.httpClient.post(apiPaths.user.expirePassword, { loginId }, { token: managementKey }),\n      (data) => data,\n    ),\n});\n\nexport default withUser;\n","import { SdkResponse, transformResponse } from '@descope/core-js-sdk';\nimport { CoreSdk } from '../types';\nimport apiPaths from './paths';\nimport { CreateTenantResponse, Tenant } from './types';\n\ntype MultipleTenantResponse = {\n  tenants: Tenant[];\n};\n\nconst withTenant = (sdk: CoreSdk, managementKey?: string) => ({\n  create: (\n    name: string,\n    selfProvisioningDomains?: string[],\n  ): Promise<SdkResponse<CreateTenantResponse>> =>\n    transformResponse(\n      sdk.httpClient.post(\n        apiPaths.tenant.create,\n        { name, selfProvisioningDomains },\n        { token: managementKey },\n      ),\n    ),\n  createWithId: (\n    id: string,\n    name: string,\n    selfProvisioningDomains?: string[],\n  ): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(\n        apiPaths.tenant.create,\n        { id, name, selfProvisioningDomains },\n        { token: managementKey },\n      ),\n    ),\n  update: (\n    id: string,\n    name: string,\n    selfProvisioningDomains?: string[],\n  ): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(\n        apiPaths.tenant.update,\n        { id, name, selfProvisioningDomains },\n        { token: managementKey },\n      ),\n    ),\n  delete: (id: string): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(apiPaths.tenant.delete, { id }, { token: managementKey }),\n    ),\n  loadAll: (): Promise<SdkResponse<Tenant[]>> =>\n    transformResponse<MultipleTenantResponse, Tenant[]>(\n      sdk.httpClient.get(apiPaths.tenant.loadAll, {\n        token: managementKey,\n      }),\n      (data) => data.tenants,\n    ),\n});\n\nexport default withTenant;\n","import { SdkResponse, transformResponse } from '@descope/core-js-sdk';\nimport { CoreSdk } from '../types';\nimport apiPaths from './paths';\nimport { UpdateJWTResponse } from './types';\n\nconst withJWT = (sdk: CoreSdk, managementKey?: string) => ({\n  update: (\n    jwt: string,\n    customClaims?: Record<string, any>,\n  ): Promise<SdkResponse<UpdateJWTResponse>> =>\n    transformResponse(\n      sdk.httpClient.post(apiPaths.jwt.update, { jwt, customClaims }, { token: managementKey }),\n    ),\n});\n\nexport default withJWT;\n","import { SdkResponse, transformResponse } from '@descope/core-js-sdk';\nimport { CoreSdk } from '../types';\nimport apiPaths from './paths';\nimport { Permission } from './types';\n\ntype MultiplePermissionResponse = {\n  permissions: Permission[];\n};\n\nconst withPermission = (sdk: CoreSdk, managementKey?: string) => ({\n  create: (name: string, description?: string): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(\n        apiPaths.permission.create,\n        { name, description },\n        { token: managementKey },\n      ),\n    ),\n  update: (name: string, newName: string, description?: string): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(\n        apiPaths.permission.update,\n        { name, newName, description },\n        { token: managementKey },\n      ),\n    ),\n  delete: (name: string): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(apiPaths.permission.delete, { name }, { token: managementKey }),\n    ),\n  loadAll: (): Promise<SdkResponse<Permission[]>> =>\n    transformResponse<MultiplePermissionResponse, Permission[]>(\n      sdk.httpClient.get(apiPaths.permission.loadAll, {\n        token: managementKey,\n      }),\n      (data) => data.permissions,\n    ),\n});\n\nexport default withPermission;\n","import { SdkResponse, transformResponse } from '@descope/core-js-sdk';\nimport { CoreSdk } from '../types';\nimport apiPaths from './paths';\nimport { Role } from './types';\n\ntype MultipleRoleResponse = {\n  roles: Role[];\n};\n\nconst withRole = (sdk: CoreSdk, managementKey?: string) => ({\n  create: (\n    name: string,\n    description?: string,\n    permissionNames?: string[],\n  ): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(\n        apiPaths.role.create,\n        { name, description, permissionNames },\n        { token: managementKey },\n      ),\n    ),\n  update: (\n    name: string,\n    newName: string,\n    description?: string,\n    permissionNames?: string[],\n  ): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(\n        apiPaths.role.update,\n        { name, newName, description, permissionNames },\n        { token: managementKey },\n      ),\n    ),\n  delete: (name: string): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(apiPaths.role.delete, { name }, { token: managementKey }),\n    ),\n  loadAll: (): Promise<SdkResponse<Role[]>> =>\n    transformResponse<MultipleRoleResponse, Role[]>(\n      sdk.httpClient.get(apiPaths.role.loadAll, {\n        token: managementKey,\n      }),\n      (data) => data.roles,\n    ),\n});\n\nexport default withRole;\n","import { SdkResponse, transformResponse } from '@descope/core-js-sdk';\nimport { CoreSdk } from '../types';\nimport apiPaths from './paths';\nimport { Group } from './types';\n\nconst withGroup = (sdk: CoreSdk, managementKey?: string) => ({\n  /**\n   * Load all groups for a specific tenant id.\n   * @param tenantId Tenant ID to load groups from.\n   * @returns Group[] list of groups\n   */\n  loadAllGroups: (tenantId: string): Promise<SdkResponse<Group[]>> =>\n    transformResponse<Group[]>(\n      sdk.httpClient.post(apiPaths.group.loadAllGroups, { tenantId }, { token: managementKey }),\n    ),\n\n  /**\n   * Load all groups for the provided user IDs or login IDs.\n   * @param tenantId Tenant ID to load groups from.\n   * @param userIds Optional List of user IDs, with the format of \"U2J5ES9S8TkvCgOvcrkpzUgVTEBM\" (example), which can be found on the user's JWT.\n   * @param loginIds Optional List of login IDs, how the user identifies when logging in.\n   * @returns Group[] list of groups\n   */\n  loadAllGroupsForMember: (\n    tenantId: string,\n    userIds: string[],\n    loginIds: string[],\n  ): Promise<SdkResponse<Group[]>> =>\n    transformResponse<Group[]>(\n      sdk.httpClient.post(\n        apiPaths.group.loadAllGroupsForMember,\n        { tenantId, loginIds, userIds },\n        { token: managementKey },\n      ),\n    ),\n\n  /**\n   * Load all members of the provided group id.\n   * @param tenantId Tenant ID to load groups from.\n   * @param groupId Group ID to load members for.\n   * @returns Group[] list of groups\n   */\n  loadAllGroupMembers: (tenantId: string, groupId: string): Promise<SdkResponse<Group[]>> =>\n    transformResponse<Group[]>(\n      sdk.httpClient.post(\n        apiPaths.group.loadAllGroupMembers,\n        { tenantId, groupId },\n        { token: managementKey },\n      ),\n    ),\n});\n\nexport default withGroup;\n","import { SdkResponse, transformResponse } from '@descope/core-js-sdk';\nimport { CoreSdk } from '../types';\nimport apiPaths from './paths';\nimport { RoleMapping, AttributeMapping, SSOSettingsResponse } from './types';\n\nconst withSSOSettings = (sdk: CoreSdk, managementKey?: string) => ({\n  getSettings: (tenantId: string): Promise<SdkResponse<SSOSettingsResponse>> =>\n    transformResponse<SSOSettingsResponse>(\n      sdk.httpClient.get(apiPaths.sso.settings, {\n        queryParams: { tenantId },\n        token: managementKey,\n      }),\n      (data) => data,\n    ),\n  deleteSettings: (tenantId: string): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.delete(apiPaths.sso.settings, {\n        queryParams: { tenantId },\n        token: managementKey,\n      }),\n    ),\n  configureSettings: (\n    tenantId: string,\n    idpURL: string,\n    idpCert: string,\n    entityId: string,\n    redirectURL?: string,\n    domain?: string,\n  ): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(\n        apiPaths.sso.settings,\n        { tenantId, idpURL, entityId, idpCert, redirectURL, domain },\n        { token: managementKey },\n      ),\n    ),\n  configureMetadata: (tenantId: string, idpMetadataURL: string): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(\n        apiPaths.sso.metadata,\n        { tenantId, idpMetadataURL },\n        { token: managementKey },\n      ),\n    ),\n  configureMapping: (\n    tenantId: string,\n    roleMapping?: RoleMapping,\n    attributeMapping?: AttributeMapping,\n  ): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(\n        apiPaths.sso.mapping,\n        { tenantId, roleMapping, attributeMapping },\n        { token: managementKey },\n      ),\n    ),\n});\n\nexport default withSSOSettings;\n","import { SdkResponse, transformResponse } from '@descope/core-js-sdk';\nimport { CoreSdk } from '../types';\nimport apiPaths from './paths';\nimport { AccessKey, AssociatedTenant, CreatedAccessKeyResponse } from './types';\n\ntype SingleKeyResponse = {\n  key: AccessKey;\n};\n\ntype MultipleKeysResponse = {\n  keys: AccessKey[];\n};\n\nconst withAccessKey = (sdk: CoreSdk, managementKey?: string) => ({\n  /**\n   * Create a new access key for a project.\n   * @param name Access key name\n   * @param expireTime When the access key expires. Keep at 0 to make it indefinite.\n   * @param roles Optional roles in the project. Does not apply for multi-tenants\n   * @param keyTenants Optional associated tenants for this key and its roles for each.\n   * @returns A newly created key and its cleartext. Make sure to save the cleartext securely.\n   */\n  create: (\n    name: string,\n    expireTime: number,\n    roles?: string[],\n    keyTenants?: AssociatedTenant[],\n  ): Promise<SdkResponse<CreatedAccessKeyResponse>> =>\n    transformResponse(\n      sdk.httpClient.post(\n        apiPaths.accessKey.create,\n        { name, expireTime, roleNames: roles, keyTenants },\n        { token: managementKey },\n      ),\n    ),\n  /**\n   * Load an access key.\n   * @param id Access key ID to load\n   * @returns The loaded access key.\n   */\n  load: (id: string): Promise<SdkResponse<AccessKey>> =>\n    transformResponse<SingleKeyResponse, AccessKey>(\n      sdk.httpClient.get(apiPaths.accessKey.load, {\n        queryParams: { id },\n        token: managementKey,\n      }),\n      (data) => data.key,\n    ),\n  /**\n   * Search all access keys\n   * @param tenantIds Optional tenant ID filter to apply on the search results\n   * @returns An array of found access keys\n   */\n  searchAll: (tenantIds?: string[]): Promise<SdkResponse<AccessKey[]>> =>\n    transformResponse<MultipleKeysResponse, AccessKey[]>(\n      sdk.httpClient.post(apiPaths.accessKey.search, { tenantIds }, { token: managementKey }),\n      (data) => data.keys,\n    ),\n  /**\n   * Update an access key.\n   * @param id Access key ID to load\n   * @param name The updated access key name\n   * @returns The updated access key\n   */\n  update: (id: string, name: string): Promise<SdkResponse<AccessKey>> =>\n    transformResponse<SingleKeyResponse, AccessKey>(\n      sdk.httpClient.post(apiPaths.accessKey.update, { id, name }, { token: managementKey }),\n      (data) => data.key,\n    ),\n  /**\n   * Deactivate an access key. Deactivated access keys cannot be used until they are\n   * activated again.\n   * @param id Access key ID to deactivate\n   */\n  deactivate: (id: string): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(apiPaths.accessKey.deactivate, { id }, { token: managementKey }),\n    ),\n  /**\n   * Activate an access key. Only deactivated access keys can be activated again.\n   * @param id Access key ID to activate\n   */\n  activate: (id: string): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(apiPaths.accessKey.activate, { id }, { token: managementKey }),\n    ),\n  /**\n   * Delete an access key. IMPORTANT: This cannot be undone. Use carefully.\n   * @param id Access key ID to delete\n   */\n  delete: (id: string): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(apiPaths.accessKey.delete, { id }, { token: managementKey }),\n    ),\n});\n\nexport default withAccessKey;\n","import { SdkResponse, transformResponse } from '@descope/core-js-sdk';\nimport { CoreSdk } from '../types';\nimport apiPaths from './paths';\nimport { FlowResponse, Screen, Flow } from './types';\n\nconst WithFlow = (sdk: CoreSdk, managementKey?: string) => ({\n  export: (flowId: string): Promise<SdkResponse<FlowResponse>> =>\n    transformResponse(\n      sdk.httpClient.post(apiPaths.flow.export, { flowId }, { token: managementKey }),\n    ),\n  import: (flowId: string, flow: Flow, screens?: Screen[]): Promise<SdkResponse<FlowResponse>> =>\n    transformResponse(\n      sdk.httpClient.post(\n        apiPaths.flow.import,\n        { flowId, flow, screens },\n        { token: managementKey },\n      ),\n    ),\n});\n\nexport default WithFlow;\n","import { SdkResponse, transformResponse } from '@descope/core-js-sdk';\nimport { CoreSdk } from '../types';\nimport apiPaths from './paths';\nimport { Theme, ThemeResponse } from './types';\n\nconst WithTheme = (sdk: CoreSdk, managementKey?: string) => ({\n  export: (): Promise<SdkResponse<ThemeResponse>> =>\n    transformResponse(sdk.httpClient.post(apiPaths.theme.export, {}, { token: managementKey })),\n  import: (theme: Theme): Promise<SdkResponse<ThemeResponse>> =>\n    transformResponse(\n      sdk.httpClient.post(apiPaths.theme.import, { theme }, { token: managementKey }),\n    ),\n});\n\nexport default WithTheme;\n","import nodeFetch, { Headers } from 'node-fetch-commonjs';\n\nglobalThis.Headers ??= Headers;\n\nconst highWaterMarkMb = 1024 * 1024 * 30; // 30MB\n\n// we are increasing the response buffer size due to an issue where node-fetch hangs when response is too big\nconst patchedFetch = (...args: Parameters<typeof nodeFetch>) => {\n  // we can get Request on the first arg, or RequestInfo on the second arg\n  // we want to make sure we are setting the \"highWaterMark\" so we are doing it on both args\n  args.forEach((arg) => {\n    // eslint-disable-next-line no-param-reassign, @typescript-eslint/no-unused-expressions\n    arg && ((arg as any).highWaterMark ??= highWaterMarkMb);\n  });\n\n  return nodeFetch(...args);\n};\n\nexport default patchedFetch as unknown as typeof fetch;\n","import createSdk, { ExchangeAccessKeyResponse, SdkResponse, wrapWith } from '@descope/core-js-sdk';\nimport { JWK, JWTHeaderParameters, KeyLike, errors, importJWK, jwtVerify } from 'jose';\nimport {\n  permissionsClaimName,\n  refreshTokenCookieName,\n  rolesClaimName,\n  sessionTokenCookieName,\n} from './constants';\nimport { getAuthorizationClaimItems, withCookie } from './helpers';\nimport withManagement from './management';\nimport { AuthenticationInfo } from './types';\nimport fetch from './fetch-polyfill';\n\ndeclare const BUILD_VERSION: string;\n\n/** Configuration arguments which include the Descope core SDK args and an optional management key */\ntype NodeSdkArgs = Parameters<typeof createSdk>[0] & {\n  managementKey?: string;\n};\n\nconst nodeSdk = ({ managementKey, ...config }: NodeSdkArgs) => {\n  const coreSdk = createSdk({\n    ...config,\n    fetch,\n    baseHeaders: {\n      ...config.baseHeaders,\n      'x-descope-sdk-name': 'nodejs',\n      'x-descope-sdk-node-version': process?.versions?.node || '',\n      'x-descope-sdk-version': BUILD_VERSION,\n    },\n  });\n\n  const { projectId, logger } = config;\n\n  const keys: Record<string, KeyLike | Uint8Array> = {};\n\n  /** Fetch the public keys (JWKs) from Descope for the configured project */\n  const fetchKeys = async () => {\n    const keysWrapper = await coreSdk.httpClient\n      .get(`v2/keys/${projectId}`)\n      .then((resp) => resp.json());\n    const publicKeys: JWK[] = keysWrapper.keys;\n    if (!Array.isArray(publicKeys)) return {};\n    const kidJwksPairs = await Promise.all(\n      publicKeys.map(async (key) => [key.kid, await importJWK(key)]),\n    );\n\n    return kidJwksPairs.reduce(\n      (acc, [kid, jwk]) => (kid ? { ...acc, [kid.toString()]: jwk } : acc),\n      {},\n    );\n  };\n\n  const management = withManagement(coreSdk, managementKey);\n\n  const sdk = {\n    ...coreSdk,\n\n    /**\n     * Provides various APIs for managing a Descope project programmatically. A management key must\n     * be provided as an argument when initializing the SDK to use these APIs. Management keys can be\n     * generated in the Descope console.\n     */\n    management,\n\n    /** Get the key that can validate the given JWT KID in the header. Can retrieve the public key from local cache or from Descope. */\n    async getKey(header: JWTHeaderParameters): Promise<KeyLike | Uint8Array> {\n      if (!header?.kid) throw Error('header.kid must not be empty');\n\n      if (keys[header.kid]) return keys[header.kid];\n\n      // do we need to fetch once or every time?\n      Object.assign(keys, await fetchKeys());\n\n      if (!keys[header.kid]) throw Error('failed to fetch matching key');\n\n      return keys[header.kid];\n    },\n\n    /**\n     * Validate the given JWT with the right key and make sure the issuer is correct\n     * @param jwt the JWT string to parse and validate\n     * @returns AuthenticationInfo with the parsed token and JWT. Will throw an error if validation fails.\n     */\n    async validateJwt(jwt: string): Promise<AuthenticationInfo> {\n      // Do not hard-code the algo because library does not support `None` so all are valid\n      const res = await jwtVerify(jwt, sdk.getKey, { clockTolerance: 5 });\n      const token = res.payload;\n\n      if (token) {\n        token.iss = token.iss?.split('/').pop(); // support both url and project id as issuer\n        if (token.iss !== projectId) {\n          // We must do the verification here, since issuer can be either project ID or URL\n          throw new errors.JWTClaimValidationFailed(\n            'unexpected \"iss\" claim value',\n            'iss',\n            'check_failed',\n          );\n        }\n      }\n\n      return { jwt, token };\n    },\n\n    /**\n     * Validate an active session\n     * @param sessionToken session JWT to validate\n     * @returns AuthenticationInfo promise or throws Error if there is an issue with JWTs\n     */\n    async validateSession(sessionToken: string): Promise<AuthenticationInfo> {\n      if (!sessionToken) throw Error('session token is required for validation');\n\n      try {\n        const token = await sdk.validateJwt(sessionToken);\n        return token;\n      } catch (error) {\n        /* istanbul ignore next */\n        logger?.error('session validation failed', error);\n        throw Error('session validation failed');\n      }\n    },\n\n    /**\n     * Refresh the session using a refresh token\n     * @param refreshToken refresh JWT to refresh the session with\n     * @returns AuthenticationInfo promise or throws Error if there is an issue with JWTs\n     */\n    async refreshSession(refreshToken: string): Promise<AuthenticationInfo> {\n      if (!refreshToken) throw Error('refresh token is required to refresh a session');\n\n      try {\n        await sdk.validateJwt(refreshToken);\n        const jwtResp = await sdk.refresh(refreshToken);\n        if (jwtResp.ok) {\n          const token = await sdk.validateJwt(jwtResp.data?.sessionJwt);\n          return token;\n        }\n        /* istanbul ignore next */\n        throw Error(jwtResp.error?.errorMessage);\n      } catch (refreshTokenErr) {\n        /* istanbul ignore next */\n        logger?.error('refresh token validation failed', refreshTokenErr);\n        throw Error('refresh token validation failed');\n      }\n    },\n\n    /**\n     * Validate session and refresh it if it expired\n     * @param sessionToken session JWT\n     * @param refreshToken refresh JWT\n     * @returns AuthenticationInfo promise or throws Error if there is an issue with JWTs\n     */\n    async validateAndRefreshSession(\n      sessionToken?: string,\n      refreshToken?: string,\n    ): Promise<AuthenticationInfo> {\n      if (!sessionToken && !refreshToken) throw Error('both session and refresh tokens are empty');\n\n      try {\n        const token = await sdk.validateSession(sessionToken);\n        return token;\n      } catch (error) {\n        /* istanbul ignore next */\n        logger?.log('session validation failed - trying to refresh it');\n      }\n\n      return sdk.refreshSession(refreshToken);\n    },\n\n    /**\n     * Exchange API key (access key) for a session key\n     * @param accessKey access key to exchange for a session JWT\n     * @returns AuthneticationInfo with session JWT data\n     */\n    async exchangeAccessKey(accessKey: string): Promise<AuthenticationInfo> {\n      if (!accessKey) throw Error('access key must not be empty');\n\n      let resp: SdkResponse<ExchangeAccessKeyResponse>;\n      try {\n        resp = await sdk.accessKey.exchange(accessKey);\n      } catch (error) {\n        logger?.error('failed to exchange access key', error);\n        throw Error('could not exchange access key');\n      }\n\n      const { sessionJwt } = resp.data;\n      if (!sessionJwt) {\n        logger?.error('failed to parse exchange access key response');\n        throw Error('could not exchange access key');\n      }\n\n      try {\n        const token = await sdk.validateJwt(sessionJwt);\n        return token;\n      } catch (error) {\n        logger?.error('failed to parse jwt from access key', error);\n        throw Error('could not exchange access key');\n      }\n    },\n\n    /**\n     * Make sure that all given permissions exist on the parsed JWT top level claims\n     * @param authInfo JWT parsed info\n     * @param permissions list of permissions to make sure they exist on te JWT claims\n     * @returns true if all permissions exist, false otherwise\n     */\n    validatePermissions(authInfo: AuthenticationInfo, permissions: string[]): boolean {\n      return sdk.validateTenantPermissions(authInfo, null, permissions);\n    },\n\n    /**\n     * Make sure that all given permissions exist on the parsed JWT tenant claims\n     * @param authInfo JWT parsed info\n     * @param permissions list of permissions to make sure they exist on te JWT claims\n     * @returns true if all permissions exist, false otherwise\n     */\n    validateTenantPermissions(\n      authInfo: AuthenticationInfo,\n      tenant: string,\n      permissions: string[],\n    ): boolean {\n      const granted = getAuthorizationClaimItems(authInfo, permissionsClaimName, tenant);\n      return permissions.every((perm) => granted.includes(perm));\n    },\n\n    /**\n     * Make sure that all given roles exist on the parsed JWT top level claims\n     * @param authInfo JWT parsed info\n     * @param roles list of roles to make sure they exist on te JWT claims\n     * @returns true if all roles exist, false otherwise\n     */\n    validateRoles(authInfo: AuthenticationInfo, roles: string[]): boolean {\n      return sdk.validateTenantRoles(authInfo, null, roles);\n    },\n\n    /**\n     * Make sure that all given roles exist on the parsed JWT tenant claims\n     * @param authInfo JWT parsed info\n     * @param roles list of roles to make sure they exist on te JWT claims\n     * @returns true if all roles exist, false otherwise\n     */\n    validateTenantRoles(authInfo: AuthenticationInfo, tenant: string, roles: string[]): boolean {\n      const membership = getAuthorizationClaimItems(authInfo, rolesClaimName, tenant);\n      return roles.every((role) => membership.includes(role));\n    },\n  };\n\n  return wrapWith(\n    sdk,\n    [\n      'otp.verify.email',\n      'otp.verify.sms',\n      'otp.verify.whatsapp',\n      'magicLink.verify',\n      'enchantedLink.signUp',\n      'enchantedLink.signIn',\n      'oauth.exchange',\n      'saml.exchange',\n      'totp.verify',\n      'webauthn.signIn.finish',\n      'webauthn.signUp.finish',\n      'refresh',\n    ] as const,\n    withCookie,\n  );\n};\n\n/** Descope SDK client with delivery methods enum.\n *\n * Please see full documentation at {@link https://docs.descope.com/guides Descope Docs}\n * @example Usage\n *\n * ```js\n * import descopeSdk from '@descope/node-sdk';\n *\n * const myProjectId = 'xxx';\n * const sdk = descopeSdk({ projectId: myProjectId });\n *\n * const userLoginId = 'loginId';\n * sdk.otp.signIn.email(userLoginId);\n * const jwtResponse = sdk.otp.verify.email(userLoginId, codeFromEmail);\n * ```\n */\n\nnodeSdk.RefreshTokenCookieName = refreshTokenCookieName;\nnodeSdk.SessionTokenCookieName = sessionTokenCookieName;\n\nexport default nodeSdk;\nexport type {\n  DeliveryMethod,\n  OAuthProvider,\n  ResponseData,\n  SdkResponse,\n} from '@descope/core-js-sdk';\n","import { CoreSdk } from '../types';\nimport withUser from './user';\nimport withTenant from './tenant';\nimport withJWT from './jwt';\nimport withPermission from './permission';\nimport withRole from './role';\nimport withGroup from './group';\nimport withSSOSettings from './sso';\nimport withAccessKey from './accesskey';\nimport WithFlow from './flow';\nimport WithTheme from './theme';\n\n/** Constructs a higher level Management API that wraps the functions from code-js-sdk */\nconst withManagement = (sdk: CoreSdk, managementKey?: string) => ({\n  user: withUser(sdk, managementKey),\n  accessKey: withAccessKey(sdk, managementKey),\n  tenant: withTenant(sdk, managementKey),\n  sso: withSSOSettings(sdk, managementKey),\n  jwt: withJWT(sdk, managementKey),\n  permission: withPermission(sdk, managementKey),\n  role: withRole(sdk, managementKey),\n  group: withGroup(sdk, managementKey),\n  flow: WithFlow(sdk, managementKey),\n  theme: WithTheme(sdk, managementKey),\n});\n\nexport default withManagement;\n"],"names":["withCookie","fn","async","args","resp","data","_d","refreshJwt","rest","__rest","cookies","options","push","cookieDomain","cookieMaxAge","cookiePath","_a","response","headers","get","cookie","name","match","RegExp","getCookieValue","_b","_c","Object","assign","getAuthorizationClaimItems","authInfo","claim","tenant","value","token","Array","isArray","apiPaths","create","update","delete","deleteAllTestUsers","load","search","updateStatus","updateEmail","updatePhone","updateDisplayName","updatePicture","updateCustomAttribute","addRole","removeRole","addTenant","removeTenant","setPassword","expirePassword","generateOTPForTest","generateMagicLinkForTest","generateEnchantedLinkForTest","deactivate","activate","loadAll","settings","metadata","mapping","export","import","loadAllGroups","loadAllGroupsForMember","loadAllGroupMembers","withUser","sdk","managementKey","loginId","email","phone","displayName","roles","userTenants","customAttributes","picture","transformResponse","httpClient","post","roleNames","user","createTestUser","test","invite","queryParams","loadByUserId","userId","searchAll","tenantIds","limit","page","testUsersOnly","withTestUser","users","status","isVerified","verified","attributeKey","attributeValue","addRoles","removeRoles","tenantId","addTenantRoles","removeTenantRoles","generateOTPForTestUser","deliveryMethod","generateMagicLinkForTestUser","uri","URI","generateEnchantedLinkForTestUser","password","withTenant","selfProvisioningDomains","createWithId","id","tenants","withJWT","jwt","customClaims","withPermission","description","newName","permissions","withRole","permissionNames","withGroup","userIds","loginIds","groupId","withSSOSettings","getSettings","deleteSettings","configureSettings","idpURL","idpCert","entityId","redirectURL","domain","configureMetadata","idpMetadataURL","configureMapping","roleMapping","attributeMapping","withAccessKey","expireTime","keyTenants","key","keys","WithFlow","flowId","flow","screens","WithTheme","theme","globalThis","Headers","patchedFetch","forEach","arg","highWaterMark","nodeFetch","nodeSdk","config","coreSdk","createSdk","fetch","baseHeaders","process","versions","node","projectId","logger","management","accessKey","sso","permission","role","group","withManagement","header","kid","Error","publicKeys","then","json","Promise","all","map","importJWK","reduce","acc","jwk","toString","fetchKeys","jwtVerify","getKey","clockTolerance","payload","iss","split","pop","errors","JWTClaimValidationFailed","sessionToken","validateJwt","error","refreshToken","jwtResp","refresh","ok","sessionJwt","errorMessage","refreshTokenErr","validateSession","log","refreshSession","exchange","validatePermissions","validateTenantPermissions","granted","every","perm","includes","validateRoles","validateTenantRoles","membership","wrapWith","RefreshTokenCookieName","SessionTokenCookieName"],"mappings":"mNAEO,MC+BMA,EACVC,GACDC,SAAUC,eACR,MAAMC,QAAaH,KAAME,GAGzB,IAAKC,EAAKC,KACR,OAAOD,EAIT,IAAIE,EAA0BF,EAAKC,MAA/BE,WAAEA,GAAUD,EAAKE,EAAjBC,EAAAA,OAAAH,EAAA,CAAA,eACJ,MAAMI,EAAoB,GAlCP,IAA8BC,EAgDjD,OAZKJ,EASHG,EAAQE,KA5CZ,GDVoC,SCsDoBL,cA5C5BI,OADuBA,EA6CiBH,QA5CxC,EAAAG,EAASE,eAAgB,gBACnDF,aAAA,EAAAA,EAASG,eAAgB,aACjBH,aAAA,EAAAA,EAASI,aAAc,mCAkCZ,QAAbC,EAAAZ,EAAKa,gBAAQ,IAAAD,OAAA,EAAAA,EAAEE,QAAQC,IAAI,iBAC7BZ,EA3Be,EAACa,EAAmCC,KACzD,MAAMC,EAAQF,eAAAA,EAAQE,MAAMC,OAAO,cAAcF,cACjD,OAAOC,EAAQA,EAAM,GAAK,IAAI,EAyBXE,CACE,QAAbC,EAAArB,EAAKa,gBAAQ,IAAAQ,OAAA,EAAAA,EAAEP,QAAQC,IAAI,cDhDC,OCmD9BT,EAAQE,KAAoB,QAAfc,EAAAtB,EAAKa,gBAAU,IAAAS,OAAA,EAAAA,EAAAR,QAAQC,IAAI,gBAMhCQ,OAAAC,OAAAD,OAAAC,OAAA,CAAA,EAAAxB,GAAM,CAAAC,KAAWsB,OAAAC,OAAAD,OAAAC,OAAA,GAAAxB,EAAKC,MAAM,CAAAE,aAAYG,aAAY,WAUpDmB,EACdC,EACAC,EACAC,WAEA,MAAMC,EAAQD,EAC0C,QAApDP,EAA6C,QAA7CT,EAAAc,EAASI,MAAgC,eAAI,IAAAlB,OAAA,EAAAA,EAAAgB,UAAO,IAAAP,OAAA,EAAAA,EAAGM,GACvDD,EAASI,MAAMH,GACnB,OAAOI,MAAMC,QAAQH,GAASA,EAAQ,EACxC,CC7EA,IAAeI,EACP,CACJC,OAAQ,uBACRC,OAAQ,uBACRC,OAAQ,uBACRC,mBAAoB,gCACpBC,KAAM,gBACNC,OAAQ,uBACRC,aAAc,8BACdC,YAAa,6BACbC,YAAa,6BACbC,kBAAmB,4BACnBC,cAAe,+BACfC,sBAAuB,uCACvBC,QAAS,gCACTC,WAAY,mCACZC,UAAW,kCACXC,aAAc,qCACdC,YAAa,6BACbC,eAAgB,gCAChBC,mBAAoB,8BACpBC,yBAA0B,oCAC1BC,6BAA8B,yCAtBnBrB,EAwBF,CACTC,OAAQ,4BACRI,KAAM,qBACNC,OAAQ,4BACRJ,OAAQ,4BACRoB,WAAY,gCACZC,SAAU,8BACVpB,OAAQ,6BA/BGH,EAiCL,CACNC,OAAQ,yBACRC,OAAQ,yBACRC,OAAQ,yBACRqB,QAAS,uBArCExB,EAuCR,CACHyB,SAAU,wBACVC,SAAU,wBACVC,QAAS,wBA1CE3B,EA4CR,CACHE,OAAQ,uBA7CGF,EA+CD,CACVC,OAAQ,6BACRC,OAAQ,6BACRC,OAAQ,6BACRqB,QAAS,2BAnDExB,EAqDP,CACJC,OAAQ,uBACRC,OAAQ,uBACRC,OAAQ,uBACRqB,QAAS,qBAzDExB,EA2DP,CACJ4B,OAAQ,uBACRC,OAAQ,wBA7DG7B,EA+DN,CACL4B,OAAQ,wBACRC,OAAQ,yBAjEG7B,EAmEN,CACL8B,cAAe,qBACfC,uBAAwB,4BACxBC,oBAAqB,0BCpDzB,MAAMC,EAAW,CAACC,EAAcC,KAA4B,CAC1DlC,OAAQ,CACNmC,EACAC,EACAC,EACAC,EACAC,EACAC,EACAC,EACAC,IAEAC,EAAAA,kBACEV,EAAIW,WAAWC,KACb9C,EAAcC,OACd,CACEmC,UACAC,QACAC,QACAC,cACAQ,UAAWP,EACXC,cACAC,mBACAC,WAEF,CAAE9C,MAAOsC,KAEVnE,GAASA,EAAKgF,OAYnBC,eAAgB,CACdb,EACAC,EACAC,EACAC,EACAC,EACAC,EACAC,EACAC,IAEAC,EAAAA,kBACEV,EAAIW,WAAWC,KACb9C,EAAcC,OACd,CACEmC,UACAC,QACAC,QACAC,cACAQ,UAAWP,EACXC,cACAS,MAAM,EACNR,mBACAC,WAEF,CAAE9C,MAAOsC,KAEVnE,GAASA,EAAKgF,OAEnBG,OAAQ,CACNf,EACAC,EACAC,EACAC,EACAC,EACAC,EACAC,EACAC,IAEAC,EAAAA,kBACEV,EAAIW,WAAWC,KACb9C,EAAcC,OACd,CACEmC,UACAC,QACAC,QACAC,cACAQ,UAAWP,EACXC,cACAU,QAAQ,EACRT,mBACAC,WAEF,CAAE9C,MAAOsC,KAEVnE,GAASA,EAAKgF,OAEnB9C,OAAQ,CACNkC,EACAC,EACAC,EACAC,EACAC,EACAC,EACAC,EACAC,IAEAC,EAAAA,kBACEV,EAAIW,WAAWC,KACb9C,EAAcE,OACd,CACEkC,UACAC,QACAC,QACAC,cACAQ,UAAWP,EACXC,cACAC,mBACAC,WAEF,CAAE9C,MAAOsC,KAEVnE,GAASA,EAAKgF,OAEnB7C,OAASiC,GACPQ,EAAAA,kBACEV,EAAIW,WAAWC,KAAK9C,EAAcG,OAAQ,CAAEiC,WAAW,CAAEvC,MAAOsC,KAKpE/B,mBAAoB,IAClBwC,EAAAA,kBACEV,EAAIW,WAAW1C,OAAOH,EAAcI,mBAAoB,CAAEP,MAAOsC,KAErE9B,KAAO+B,GACLQ,EAAAA,kBACEV,EAAIW,WAAW/D,IAAIkB,EAAcK,KAAM,CACrC+C,YAAa,CAAEhB,WACfvC,MAAOsC,KAERnE,GAASA,EAAKgF,OAQnBK,aAAeC,GACbV,EAAAA,kBACEV,EAAIW,WAAW/D,IAAIkB,EAAcK,KAAM,CACrC+C,YAAa,CAAEE,UACfzD,MAAOsC,KAERnE,GAASA,EAAKgF,OAanBO,UAAW,CACTC,EACAhB,EACAiB,EACAC,EACAC,EACAC,EACAlB,IAEAE,EAAAA,kBACEV,EAAIW,WAAWC,KACb9C,EAAcM,OACd,CAAEkD,YAAWT,UAAWP,EAAOiB,QAAOC,OAAMC,gBAAeC,eAAclB,oBACzE,CAAE7C,MAAOsC,KAEVnE,GAASA,EAAK6F,QAEnBtC,SAAWa,GACTQ,EAAAA,kBACEV,EAAIW,WAAWC,KACb9C,EAAcO,aACd,CAAE6B,UAAS0B,OAAQ,WACnB,CAAEjE,MAAOsC,KAEVnE,GAASA,EAAKgF,OAEnB1B,WAAac,GACXQ,EAAAA,kBACEV,EAAIW,WAAWC,KACb9C,EAAcO,aACd,CAAE6B,UAAS0B,OAAQ,YACnB,CAAEjE,MAAOsC,KAEVnE,GAASA,EAAKgF,OAEnBxC,YAAa,CACX4B,EACAC,EACA0B,IAEAnB,EAAAA,kBACEV,EAAIW,WAAWC,KACb9C,EAAcQ,YACd,CAAE4B,UAASC,QAAO2B,SAAUD,GAC5B,CAAElE,MAAOsC,KAEVnE,GAASA,EAAKgF,OAEnBvC,YAAa,CACX2B,EACAE,EACAyB,IAEAnB,EAAAA,kBACEV,EAAIW,WAAWC,KACb9C,EAAcS,YACd,CAAE2B,UAASE,QAAO0B,SAAUD,GAC5B,CAAElE,MAAOsC,KAEVnE,GAASA,EAAKgF,OAEnBtC,kBAAmB,CAAC0B,EAAiBG,IACnCK,EAAiBA,kBACfV,EAAIW,WAAWC,KACb9C,EAAcU,kBACd,CAAE0B,UAASG,eACX,CAAE1C,MAAOsC,KAEVnE,GAASA,EAAKgF,OAEnBrC,cAAe,CAACyB,EAAiBO,IAC/BC,EAAiBA,kBACfV,EAAIW,WAAWC,KACb9C,EAAcW,cACd,CAAEyB,UAASO,WACX,CAAE9C,MAAOsC,KAEVnE,GAASA,EAAKgF,OAEnBpC,sBAAuB,CACrBwB,EACA6B,EACAC,IAEAtB,EAAAA,kBACEV,EAAIW,WAAWC,KACb9C,EAAcY,sBACd,CAAEwB,UAAS6B,eAAcC,kBACzB,CAAErE,MAAOsC,KAEVnE,GAASA,EAAKgF,OAEnBmB,SAAU,CAAC/B,EAAiBI,IAC1BI,EAAiBA,kBACfV,EAAIW,WAAWC,KACb9C,EAAca,QACd,CAAEuB,UAASW,UAAWP,GACtB,CAAE3C,MAAOsC,KAEVnE,GAASA,EAAKgF,OAEnBoB,YAAa,CAAChC,EAAiBI,IAC7BI,EAAiBA,kBACfV,EAAIW,WAAWC,KACb9C,EAAcc,WACd,CAAEsB,UAASW,UAAWP,GACtB,CAAE3C,MAAOsC,KAEVnE,GAASA,EAAKgF,OAEnBjC,UAAW,CAACqB,EAAiBiC,IAC3BzB,EAAiBA,kBACfV,EAAIW,WAAWC,KAAK9C,EAAce,UAAW,CAAEqB,UAASiC,YAAY,CAAExE,MAAOsC,KAC5EnE,GAASA,EAAKgF,OAEnBhC,aAAc,CAACoB,EAAiBiC,IAC9BzB,EAAiBA,kBACfV,EAAIW,WAAWC,KACb9C,EAAcgB,aACd,CAAEoB,UAASiC,YACX,CAAExE,MAAOsC,KAEVnE,GAASA,EAAKgF,OAEnBsB,eAAgB,CACdlC,EACAiC,EACA7B,IAEAI,EAAAA,kBACEV,EAAIW,WAAWC,KACb9C,EAAca,QACd,CAAEuB,UAASiC,WAAUtB,UAAWP,GAChC,CAAE3C,MAAOsC,KAEVnE,GAASA,EAAKgF,OAEnBuB,kBAAmB,CACjBnC,EACAiC,EACA7B,IAEAI,EAAAA,kBACEV,EAAIW,WAAWC,KACb9C,EAAcc,WACd,CAAEsB,UAASiC,WAAUtB,UAAWP,GAChC,CAAE3C,MAAOsC,KAEVnE,GAASA,EAAKgF,OAanBwB,uBAAwB,CACtBC,EACArC,IAEAQ,EAAAA,kBACEV,EAAIW,WAAWC,KACb9C,EAAcmB,mBACd,CAAEsD,iBAAgBrC,WAClB,CAAEvC,MAAOsC,KAEVnE,GAASA,IAcd0G,6BAA8B,CAC5BD,EACArC,EACAuC,IAEA/B,EAAAA,kBACEV,EAAIW,WAAWC,KACb9C,EAAcoB,yBACd,CAAEqD,iBAAgBrC,UAASwC,IAAKD,GAChC,CAAE9E,MAAOsC,KAEVnE,GAASA,IAad6G,iCAAkC,CAChCzC,EACAuC,IAEA/B,EAAiBA,kBACfV,EAAIW,WAAWC,KACb9C,EAAcqB,6BACd,CAAEe,UAASwC,IAAKD,GAChB,CAAE9E,MAAOsC,KAEVnE,GAASA,IAWdiD,YAAa,CAACmB,EAAiB0C,IAC7BlC,EAAAA,kBACEV,EAAIW,WAAWC,KACb9C,EAAciB,YACd,CAAEmB,UAAS0C,YACX,CAAEjF,MAAOsC,KAEVnE,GAASA,IASdkD,eAAiBkB,GACfQ,EAAiBA,kBACfV,EAAIW,WAAWC,KAAK9C,EAAckB,eAAgB,CAAEkB,WAAW,CAAEvC,MAAOsC,KACvEnE,GAASA,MCxaV+G,EAAa,CAAC7C,EAAcC,KAA4B,CAC5DlC,OAAQ,CACNjB,EACAgG,IAEApC,EAAiBA,kBACfV,EAAIW,WAAWC,KACb9C,EAAgBC,OAChB,CAAEjB,OAAMgG,2BACR,CAAEnF,MAAOsC,KAGf8C,aAAc,CACZC,EACAlG,EACAgG,IAEApC,EAAAA,kBACEV,EAAIW,WAAWC,KACb9C,EAAgBC,OAChB,CAAEiF,KAAIlG,OAAMgG,2BACZ,CAAEnF,MAAOsC,KAGfjC,OAAQ,CACNgF,EACAlG,EACAgG,IAEApC,EAAAA,kBACEV,EAAIW,WAAWC,KACb9C,EAAgBE,OAChB,CAAEgF,KAAIlG,OAAMgG,2BACZ,CAAEnF,MAAOsC,KAGfhC,OAAS+E,GACPtC,EAAAA,kBACEV,EAAIW,WAAWC,KAAK9C,EAAgBG,OAAQ,CAAE+E,MAAM,CAAErF,MAAOsC,KAEjEX,QAAS,IACPoB,EAAiBA,kBACfV,EAAIW,WAAW/D,IAAIkB,EAAgBwB,QAAS,CAC1C3B,MAAOsC,KAERnE,GAASA,EAAKmH,YCjDfC,EAAU,CAAClD,EAAcC,KAA4B,CACzDjC,OAAQ,CACNmF,EACAC,IAEA1C,EAAiBA,kBACfV,EAAIW,WAAWC,KAAK9C,EAAaE,OAAQ,CAAEmF,MAAKC,gBAAgB,CAAEzF,MAAOsC,OCFzEoD,EAAiB,CAACrD,EAAcC,KAA4B,CAChElC,OAAQ,CAACjB,EAAcwG,IACrB5C,EAAiBA,kBACfV,EAAIW,WAAWC,KACb9C,EAAoBC,OACpB,CAAEjB,OAAMwG,eACR,CAAE3F,MAAOsC,KAGfjC,OAAQ,CAAClB,EAAcyG,EAAiBD,IACtC5C,EAAAA,kBACEV,EAAIW,WAAWC,KACb9C,EAAoBE,OACpB,CAAElB,OAAMyG,UAASD,eACjB,CAAE3F,MAAOsC,KAGfhC,OAASnB,GACP4D,EAAAA,kBACEV,EAAIW,WAAWC,KAAK9C,EAAoBG,OAAQ,CAAEnB,QAAQ,CAAEa,MAAOsC,KAEvEX,QAAS,IACPoB,EAAiBA,kBACfV,EAAIW,WAAW/D,IAAIkB,EAAoBwB,QAAS,CAC9C3B,MAAOsC,KAERnE,GAASA,EAAK0H,gBC1BfC,EAAW,CAACzD,EAAcC,KAA4B,CAC1DlC,OAAQ,CACNjB,EACAwG,EACAI,IAEAhD,EAAAA,kBACEV,EAAIW,WAAWC,KACb9C,EAAcC,OACd,CAAEjB,OAAMwG,cAAaI,mBACrB,CAAE/F,MAAOsC,KAGfjC,OAAQ,CACNlB,EACAyG,EACAD,EACAI,IAEAhD,oBACEV,EAAIW,WAAWC,KACb9C,EAAcE,OACd,CAAElB,OAAMyG,UAASD,cAAaI,mBAC9B,CAAE/F,MAAOsC,KAGfhC,OAASnB,GACP4D,EAAAA,kBACEV,EAAIW,WAAWC,KAAK9C,EAAcG,OAAQ,CAAEnB,QAAQ,CAAEa,MAAOsC,KAEjEX,QAAS,IACPoB,EAAiBA,kBACfV,EAAIW,WAAW/D,IAAIkB,EAAcwB,QAAS,CACxC3B,MAAOsC,KAERnE,GAASA,EAAKwE,UCvCfqD,EAAY,CAAC3D,EAAcC,KAA4B,CAM3DL,cAAgBuC,GACdzB,EAAAA,kBACEV,EAAIW,WAAWC,KAAK9C,EAAe8B,cAAe,CAAEuC,YAAY,CAAExE,MAAOsC,KAU7EJ,uBAAwB,CACtBsC,EACAyB,EACAC,IAEAnD,EAAAA,kBACEV,EAAIW,WAAWC,KACb9C,EAAe+B,uBACf,CAAEsC,WAAU0B,WAAUD,WACtB,CAAEjG,MAAOsC,KAUfH,oBAAqB,CAACqC,EAAkB2B,IACtCpD,EAAiBA,kBACfV,EAAIW,WAAWC,KACb9C,EAAegC,oBACf,CAAEqC,WAAU2B,WACZ,CAAEnG,MAAOsC,OC1CX8D,EAAkB,CAAC/D,EAAcC,KAA4B,CACjE+D,YAAc7B,GACZzB,EAAAA,kBACEV,EAAIW,WAAW/D,IAAIkB,EAAayB,SAAU,CACxC2B,YAAa,CAAEiB,YACfxE,MAAOsC,KAERnE,GAASA,IAEdmI,eAAiB9B,GACfzB,EAAAA,kBACEV,EAAIW,WAAW1C,OAAOH,EAAayB,SAAU,CAC3C2B,YAAa,CAAEiB,YACfxE,MAAOsC,KAGbiE,kBAAmB,CACjB/B,EACAgC,EACAC,EACAC,EACAC,EACAC,IAEA7D,EAAiBA,kBACfV,EAAIW,WAAWC,KACb9C,EAAayB,SACb,CAAE4C,WAAUgC,SAAQE,WAAUD,UAASE,cAAaC,UACpD,CAAE5G,MAAOsC,KAGfuE,kBAAmB,CAACrC,EAAkBsC,IACpC/D,EAAiBA,kBACfV,EAAIW,WAAWC,KACb9C,EAAa0B,SACb,CAAE2C,WAAUsC,kBACZ,CAAE9G,MAAOsC,KAGfyE,iBAAkB,CAChBvC,EACAwC,EACAC,IAEAlE,EAAAA,kBACEV,EAAIW,WAAWC,KACb9C,EAAa2B,QACb,CAAE0C,WAAUwC,cAAaC,oBACzB,CAAEjH,MAAOsC,OCxCX4E,EAAgB,CAAC7E,EAAcC,KAA4B,CAS/DlC,OAAQ,CACNjB,EACAgI,EACAxE,EACAyE,IAEArE,EAAAA,kBACEV,EAAIW,WAAWC,KACb9C,EAAmBC,OACnB,CAAEjB,OAAMgI,aAAYjE,UAAWP,EAAOyE,cACtC,CAAEpH,MAAOsC,KAQf9B,KAAO6E,GACLtC,EAAAA,kBACEV,EAAIW,WAAW/D,IAAIkB,EAAmBK,KAAM,CAC1C+C,YAAa,CAAE8B,MACfrF,MAAOsC,KAERnE,GAASA,EAAKkJ,MAOnB3D,UAAYC,GACVZ,oBACEV,EAAIW,WAAWC,KAAK9C,EAAmBM,OAAQ,CAAEkD,aAAa,CAAE3D,MAAOsC,KACtEnE,GAASA,EAAKmJ,OAQnBjH,OAAQ,CAACgF,EAAYlG,IACnB4D,EAAiBA,kBACfV,EAAIW,WAAWC,KAAK9C,EAAmBE,OAAQ,CAAEgF,KAAIlG,QAAQ,CAAEa,MAAOsC,KACrEnE,GAASA,EAAKkJ,MAOnB5F,WAAa4D,GACXtC,EAAAA,kBACEV,EAAIW,WAAWC,KAAK9C,EAAmBsB,WAAY,CAAE4D,MAAM,CAAErF,MAAOsC,KAMxEZ,SAAW2D,GACTtC,EAAAA,kBACEV,EAAIW,WAAWC,KAAK9C,EAAmBuB,SAAU,CAAE2D,MAAM,CAAErF,MAAOsC,KAMtEhC,OAAS+E,GACPtC,EAAAA,kBACEV,EAAIW,WAAWC,KAAK9C,EAAmBG,OAAQ,CAAE+E,MAAM,CAAErF,MAAOsC,OCvFhEiF,EAAW,CAAClF,EAAcC,KAA4B,CAC1DP,OAASyF,GACPzE,EAAAA,kBACEV,EAAIW,WAAWC,KAAK9C,EAAc4B,OAAQ,CAAEyF,UAAU,CAAExH,MAAOsC,KAEnEN,OAAQ,CAACwF,EAAgBC,EAAYC,IACnC3E,EAAAA,kBACEV,EAAIW,WAAWC,KACb9C,EAAc6B,OACd,CAAEwF,SAAQC,OAAMC,WAChB,CAAE1H,MAAOsC,OCVXqF,EAAY,CAACtF,EAAcC,KAA4B,CAC3DP,OAAQ,IACNgB,EAAiBA,kBAACV,EAAIW,WAAWC,KAAK9C,EAAe4B,OAAQ,CAAE,EAAE,CAAE/B,MAAOsC,KAC5EN,OAAS4F,GACP7E,EAAAA,kBACEV,EAAIW,WAAWC,KAAK9C,EAAe6B,OAAQ,CAAE4F,SAAS,CAAE5H,MAAOsC,aCRnD,QAAlBxD,EAAA+I,WAAWC,eAAO,IAAAhJ,IAAlB+I,WAAWC,QAAYA,EAAOA,SAE9B,MAGMC,EAAe,IAAI9J,KAGvBA,EAAK+J,SAASC,YAEZA,YAASnJ,GAAAS,EAAA0I,GAAYC,+BAAAA,cARD,UAQmC,IAGlDC,EAAS,WAAIlK,ICKhBmK,EAAWtJ,WAAAwD,cAAEA,GAAuCxD,EAArBuJ,EAAM9J,EAAAA,OAAAO,EAA1B,mBACf,MAAMwJ,EAAUC,UACX9I,OAAAC,OAAAD,OAAAC,OAAA,CAAA,EAAA2I,UACHG,EACAC,YAAWhJ,OAAAC,OAAAD,OAAAC,OAAA,CAAA,EACN2I,EAAOI,cACV,qBAAsB,SACtB,8BAAiD,UAAZ,OAAPC,cAAO,IAAPA,aAAO,EAAPA,QAASC,gBAAU,IAAApJ,OAAA,EAAAA,EAAAqJ,OAAQ,GACzD,wBAAyB,cAIvBC,UAAEA,EAASC,OAAEA,GAAWT,EAExBf,EAA6C,CAAA,EAmB7CyB,ECxCe,EAAC1G,EAAcC,KAA4B,CAChEa,KAAMf,EAASC,EAAKC,GACpB0G,UAAW9B,EAAc7E,EAAKC,GAC9BxC,OAAQoF,EAAW7C,EAAKC,GACxB2G,IAAK7C,EAAgB/D,EAAKC,GAC1BkD,IAAKD,EAAQlD,EAAKC,GAClB4G,WAAYxD,EAAerD,EAAKC,GAChC6G,KAAMrD,EAASzD,EAAKC,GACpB8G,MAAOpD,EAAU3D,EAAKC,GACtBmF,KAAMF,EAASlF,EAAKC,GACpBsF,MAAOD,EAAUtF,EAAKC,KD8BH+G,CAAef,EAAShG,GAErCD,iCACDiG,GAAO,CAOVS,aAGA/K,aAAasL,GACX,KAAKA,aAAA,EAAAA,EAAQC,KAAK,MAAMC,MAAM,gCAE9B,GAAIlC,EAAKgC,EAAOC,KAAM,OAAOjC,EAAKgC,EAAOC,KAKzC,GAFA9J,OAAOC,OAAO4H,OAnCAtJ,WAChB,MAGMyL,SAHoBnB,EAAQtF,WAC/B/D,IAAI,WAAW4J,KACfa,MAAMxL,GAASA,EAAKyL,UACerC,KACtC,OAAKrH,MAAMC,QAAQuJ,UACQG,QAAQC,IACjCJ,EAAWK,KAAI9L,MAAOqJ,GAAQ,CAACA,EAAIkC,UAAWQ,EAAAA,UAAU1C,QAGtC2C,QAClB,CAACC,GAAMV,EAAKW,KAAUX,EAAW9J,OAAAC,OAAAD,OAAAC,OAAA,CAAA,EAAAuK,IAAK,CAACV,EAAIY,YAAaD,IAAQD,GAChE,CAAE,GAPmC,EAQtC,EAsB2BG,KAErB9C,EAAKgC,EAAOC,KAAM,MAAMC,MAAM,gCAEnC,OAAOlC,EAAKgC,EAAOC,IACpB,EAODvL,kBAAkBwH,SAEhB,MACMxF,SADYqK,EAASA,UAAC7E,EAAKnD,EAAIiI,OAAQ,CAAEC,eAAgB,KAC7CC,QAElB,GAAIxK,IACFA,EAAMyK,IAAe,QAAT3L,EAAAkB,EAAMyK,WAAG,IAAA3L,OAAA,EAAAA,EAAE4L,MAAM,KAAKC,MAC9B3K,EAAMyK,MAAQ5B,GAEhB,MAAM,IAAI+B,EAAMA,OAACC,yBACf,+BACA,MACA,gBAKN,MAAO,CAAErF,MAAKxF,QACf,EAODhC,sBAAsB8M,GACpB,IAAKA,EAAc,MAAMtB,MAAM,4CAE/B,IAEE,aADoBnH,EAAI0I,YAAYD,EAMrC,CAJC,MAAOE,GAGP,MADAlC,SAAAA,EAAQkC,MAAM,4BAA6BA,GACrCxB,MAAM,4BACb,CACF,EAODxL,qBAAqBiN,WACnB,IAAKA,EAAc,MAAMzB,MAAM,kDAE/B,UACQnH,EAAI0I,YAAYE,GACtB,MAAMC,QAAgB7I,EAAI8I,QAAQF,GAClC,GAAIC,EAAQE,GAAI,CAEd,aADoB/I,EAAI0I,YAA0B,QAAdjM,EAAAoM,EAAQ/M,YAAM,IAAAW,OAAA,EAAAA,EAAAuM,WAEnD,CAED,MAAM7B,MAAmB,QAAbjK,EAAA2L,EAAQF,aAAK,IAAAzL,OAAA,EAAAA,EAAE+L,aAK5B,CAJC,MAAOC,GAGP,MADAzC,SAAAA,EAAQkC,MAAM,kCAAmCO,GAC3C/B,MAAM,kCACb,CACF,EAQDxL,gCACE8M,EACAG,GAEA,IAAKH,IAAiBG,EAAc,MAAMzB,MAAM,6CAEhD,IAEE,aADoBnH,EAAImJ,gBAAgBV,EAKzC,CAHC,MAAOE,GAEPlC,SAAAA,EAAQ2C,IAAI,mDACb,CAED,OAAOpJ,EAAIqJ,eAAeT,EAC3B,EAODjN,wBAAwBgL,GACtB,IAAKA,EAAW,MAAMQ,MAAM,gCAE5B,IAAItL,EACJ,IACEA,QAAamE,EAAI2G,UAAU2C,SAAS3C,EAIrC,CAHC,MAAOgC,GAEP,MADAlC,SAAAA,EAAQkC,MAAM,gCAAiCA,GACzCxB,MAAM,gCACb,CAED,MAAM6B,WAAEA,GAAenN,EAAKC,KAC5B,IAAKkN,EAEH,MADAvC,SAAAA,EAAQkC,MAAM,gDACRxB,MAAM,iCAGd,IAEE,aADoBnH,EAAI0I,YAAYM,EAKrC,CAHC,MAAOL,GAEP,MADAlC,SAAAA,EAAQkC,MAAM,sCAAuCA,GAC/CxB,MAAM,gCACb,CACF,EAQDoC,oBAAmB,CAAChM,EAA8BiG,IACzCxD,EAAIwJ,0BAA0BjM,EAAU,KAAMiG,GASvDgG,0BACEjM,EACAE,EACA+F,GAEA,MAAMiG,EAAUnM,EAA2BC,EdrNb,ccqN6CE,GAC3E,OAAO+F,EAAYkG,OAAOC,GAASF,EAAQG,SAASD,IACrD,EAQDE,cAAa,CAACtM,EAA8B+C,IACnCN,EAAI8J,oBAAoBvM,EAAU,KAAM+C,GASjDwJ,oBAAoBvM,EAA8BE,EAAgB6C,GAChE,MAAMyJ,EAAazM,EAA2BC,EdxOtB,QcwOgDE,GACxE,OAAO6C,EAAMoJ,OAAO5C,GAASiD,EAAWH,SAAS9C,IAClD,IAGH,OAAOkD,EAAAA,SACLhK,EACA,CACE,mBACA,iBACA,sBACA,mBACA,uBACA,uBACA,iBACA,gBACA,cACA,yBACA,yBACA,WAEFvE,EACD,EAoBHsK,EAAQkE,uBd1R8B,Mc2RtClE,EAAQmE,uBdzR8B"}

package/dist/index.d.ts

@@ -202,6 +202,8 @@ declare const nodeSdk: {
                 generateOTPForTestUser: (deliveryMethod: "email" | "sms" | "whatsapp", loginId: string) => Promise<SdkResponse<GenerateOTPForTestResponse>>;
                 generateMagicLinkForTestUser: (deliveryMethod: "email" | "sms" | "whatsapp", loginId: string, uri: string) => Promise<SdkResponse<GenerateMagicLinkForTestResponse>>;
                 generateEnchantedLinkForTestUser: (loginId: string, uri: string) => Promise<SdkResponse<GenerateEnchantedLinkForTestResponse>>;
+                setPassword: (loginId: string, password: string) => Promise<SdkResponse<never>>;
+                expirePassword: (loginId: string) => Promise<SdkResponse<never>>;
             };
             accessKey: {
                 create: (name: string, expireTime: number, roles?: string[], keyTenants?: AssociatedTenant[]) => Promise<SdkResponse<CreatedAccessKeyResponse>>;
@@ -221,6 +223,7 @@ declare const nodeSdk: {
             };
             sso: {
                 getSettings: (tenantId: string) => Promise<SdkResponse<SSOSettingsResponse>>;
+                deleteSettings: (tenantId: string) => Promise<SdkResponse<never>>;
                 configureSettings: (tenantId: string, idpURL: string, idpCert: string, entityId: string, redirectURL?: string, domain?: string) => Promise<SdkResponse<never>>;
                 configureMetadata: (tenantId: string, idpMetadataURL: string) => Promise<SdkResponse<never>>;
                 configureMapping: (tenantId: string, roleMapping?: RoleMapping, attributeMapping?: AttributeMapping) => Promise<SdkResponse<never>>;
@@ -482,7 +485,7 @@ declare const nodeSdk: {
             }>>;
         };
         saml: {
-            start: (tenantNameOrEmail: string, redirectUrl?: string, loginOptions?: {
+            start: (tenantIdOrEmail: string, redirectUrl?: string, loginOptions?: {
                 stepup?: boolean;
                 mfa?: boolean;
                 customClaims?: Record<string, any>;
@@ -513,7 +516,7 @@ declare const nodeSdk: {
                 start: (loginId: string, origin: string, name: string) => Promise<SdkResponse<{
                     transactionId: string;
                     options: string;
-                    create: boolean; /** Get the key that can validate the given JWT KID in the header. Can retrieve the public key from local cache or from Descope. */
+                    create: boolean;
                 }>>;
                 finish: (transactionId: string, response: string) => Promise<SdkResponse<_descope_core_js_sdk.JWTResponse & {
                     refreshJwt?: string;
@@ -528,7 +531,7 @@ declare const nodeSdk: {
                 }, token?: string) => Promise<SdkResponse<{
                     transactionId: string;
                     options: string;
-                    create: boolean; /** Get the key that can validate the given JWT KID in the header. Can retrieve the public key from local cache or from Descope. */
+                    create: boolean;
                 }>>;
                 finish: (transactionId: string, response: string) => Promise<SdkResponse<_descope_core_js_sdk.JWTResponse & {
                     refreshJwt?: string;
@@ -539,14 +542,14 @@ declare const nodeSdk: {
                 start: (loginId: string, origin: string) => Promise<SdkResponse<{
                     transactionId: string;
                     options: string;
-                    create: boolean; /** Get the key that can validate the given JWT KID in the header. Can retrieve the public key from local cache or from Descope. */
+                    create: boolean;
                 }>>;
             };
             update: {
                 start: (loginId: string, origin: string, token: string) => Promise<SdkResponse<{
                     transactionId: string;
                     options: string;
-                    create: boolean; /** Get the key that can validate the given JWT KID in the header. Can retrieve the public key from local cache or from Descope. */
+                    create: boolean;
                 }>>;
                 finish: (transactionId: string, response: string) => Promise<SdkResponse<_descope_core_js_sdk.ResponseData>>;
             };
@@ -630,7 +633,7 @@ declare const nodeSdk: {
                 };
                 token?: string;
             }) => Promise<Response>;
-            delete: (path: string, body?: any, config?: {
+            delete: (path: string, config?: {
                 headers?: HeadersInit;
                 queryParams?: {
                     [key: string]: string;

package/dist/index.esm.js

@@ -1,2 +1,2 @@
-import{__rest as e}from"tslib";import t,{transformResponse as a,wrapWith as s}from"@descope/core-js-sdk";import{jwtVerify as o,errors as n,importJWK as r}from"jose";import i,{Headers as l}from"node-fetch-commonjs";const d=t=>async(...a)=>{var s,o,n;const r=await t(...a);if(!r.data)return r;let i=r.data,{refreshJwt:l}=i,d=e(i,["refreshJwt"]);const p=[];var m;return l?p.push(`${"DSR"}=${l}; Domain=${(null==(m=d)?void 0:m.cookieDomain)||""}; Max-Age=${(null==m?void 0:m.cookieMaxAge)||""}; Path=${(null==m?void 0:m.cookiePath)||"/"}; HttpOnly; SameSite=Strict`):(null===(s=r.response)||void 0===s?void 0:s.headers.get("set-cookie"))&&(l=((e,t)=>{const a=null==e?void 0:e.match(RegExp(`(?:^|;\\s*)${t}=([^;]*)`));return a?a[1]:null})(null===(o=r.response)||void 0===o?void 0:o.headers.get("set-cookie"),"DSR"),p.push(null===(n=r.response)||void 0===n?void 0:n.headers.get("set-cookie"))),Object.assign(Object.assign({},r),{data:Object.assign(Object.assign({},r.data),{refreshJwt:l,cookies:p})})};function p(e,t,a){var s,o;const n=a?null===(o=null===(s=e.token.tenants)||void 0===s?void 0:s[a])||void 0===o?void 0:o[t]:e.token[t];return Array.isArray(n)?n:[]}var m={create:"/v1/mgmt/user/create",update:"/v1/mgmt/user/update",delete:"/v1/mgmt/user/delete",deleteAllTestUsers:"/v1/mgmt/user/test/delete/all",load:"/v1/mgmt/user",search:"/v1/mgmt/user/search",updateStatus:"/v1/mgmt/user/update/status",updateEmail:"/v1/mgmt/user/update/email",updatePhone:"/v1/mgmt/user/update/phone",updateDisplayName:"/v1/mgmt/user/update/name",updatePicture:"/v1/mgmt/user/update/picture",updateCustomAttribute:"/v1/mgmt/user/update/customAttribute",addRole:"/v1/mgmt/user/update/role/add",removeRole:"/v1/mgmt/user/update/role/remove",addTenant:"/v1/mgmt/user/update/tenant/add",removeTenant:"/v1/mgmt/user/update/tenant/remove",generateOTPForTest:"/v1/mgmt/tests/generate/otp",generateMagicLinkForTest:"/v1/mgmt/tests/generate/magiclink",generateEnchantedLinkForTest:"/v1/mgmt/tests/generate/enchantedlink"},u={create:"/v1/mgmt/accesskey/create",load:"/v1/mgmt/accesskey",search:"/v1/mgmt/accesskey/search",update:"/v1/mgmt/accesskey/update",deactivate:"/v1/mgmt/accesskey/deactivate",activate:"/v1/mgmt/accesskey/activate",delete:"/v1/mgmt/accesskey/delete"},c={create:"/v1/mgmt/tenant/create",update:"/v1/mgmt/tenant/update",delete:"/v1/mgmt/tenant/delete",loadAll:"/v1/mgmt/tenant/all"},g={settings:"/v1/mgmt/sso/settings",metadata:"/v1/mgmt/sso/metadata",mapping:"/v1/mgmt/sso/mapping"},h={update:"/v1/mgmt/jwt/update"},v={create:"/v1/mgmt/permission/create",update:"/v1/mgmt/permission/update",delete:"/v1/mgmt/permission/delete",loadAll:"/v1/mgmt/permission/all"},k={create:"/v1/mgmt/role/create",update:"/v1/mgmt/role/update",delete:"/v1/mgmt/role/delete",loadAll:"/v1/mgmt/role/all"},y={export:"/v1/mgmt/flow/export",import:"/v1/mgmt/flow/import"},f={export:"/v1/mgmt/theme/export",import:"/v1/mgmt/theme/import"},C={loadAllGroups:"/v1/mgmt/group/all",loadAllGroupsForMember:"/v1/mgmt/group/member/all",loadAllGroupMembers:"/v1/mgmt/group/members"};const w=(e,t)=>({create:(s,o,n,r,i,l,d,p)=>a(e.httpClient.post(m.create,{loginId:s,email:o,phone:n,displayName:r,roleNames:i,userTenants:l,customAttributes:d,picture:p},{token:t}),(e=>e.user)),createTestUser:(s,o,n,r,i,l,d,p)=>a(e.httpClient.post(m.create,{loginId:s,email:o,phone:n,displayName:r,roleNames:i,userTenants:l,test:!0,customAttributes:d,picture:p},{token:t}),(e=>e.user)),invite:(s,o,n,r,i,l,d,p)=>a(e.httpClient.post(m.create,{loginId:s,email:o,phone:n,displayName:r,roleNames:i,userTenants:l,invite:!0,customAttributes:d,picture:p},{token:t}),(e=>e.user)),update:(s,o,n,r,i,l,d,p)=>a(e.httpClient.post(m.update,{loginId:s,email:o,phone:n,displayName:r,roleNames:i,userTenants:l,customAttributes:d,picture:p},{token:t}),(e=>e.user)),delete:s=>a(e.httpClient.post(m.delete,{loginId:s},{token:t})),deleteAllTestUsers:()=>a(e.httpClient.delete(m.deleteAllTestUsers,{},{token:t})),load:s=>a(e.httpClient.get(m.load,{queryParams:{loginId:s},token:t}),(e=>e.user)),loadByUserId:s=>a(e.httpClient.get(m.load,{queryParams:{userId:s},token:t}),(e=>e.user)),searchAll:(s,o,n,r,i,l,d)=>a(e.httpClient.post(m.search,{tenantIds:s,roleNames:o,limit:n,page:r,testUsersOnly:i,withTestUser:l,customAttributes:d},{token:t}),(e=>e.users)),activate:s=>a(e.httpClient.post(m.updateStatus,{loginId:s,status:"enabled"},{token:t}),(e=>e.user)),deactivate:s=>a(e.httpClient.post(m.updateStatus,{loginId:s,status:"disabled"},{token:t}),(e=>e.user)),updateEmail:(s,o,n)=>a(e.httpClient.post(m.updateEmail,{loginId:s,email:o,verified:n},{token:t}),(e=>e.user)),updatePhone:(s,o,n)=>a(e.httpClient.post(m.updatePhone,{loginId:s,phone:o,verified:n},{token:t}),(e=>e.user)),updateDisplayName:(s,o)=>a(e.httpClient.post(m.updateDisplayName,{loginId:s,displayName:o},{token:t}),(e=>e.user)),updatePicture:(s,o)=>a(e.httpClient.post(m.updatePicture,{loginId:s,picture:o},{token:t}),(e=>e.user)),updateCustomAttribute:(s,o,n)=>a(e.httpClient.post(m.updateCustomAttribute,{loginId:s,attributeKey:o,attributeValue:n},{token:t}),(e=>e.user)),addRoles:(s,o)=>a(e.httpClient.post(m.addRole,{loginId:s,roleNames:o},{token:t}),(e=>e.user)),removeRoles:(s,o)=>a(e.httpClient.post(m.removeRole,{loginId:s,roleNames:o},{token:t}),(e=>e.user)),addTenant:(s,o)=>a(e.httpClient.post(m.addTenant,{loginId:s,tenantId:o},{token:t}),(e=>e.user)),removeTenant:(s,o)=>a(e.httpClient.post(m.removeTenant,{loginId:s,tenantId:o},{token:t}),(e=>e.user)),addTenantRoles:(s,o,n)=>a(e.httpClient.post(m.addRole,{loginId:s,tenantId:o,roleNames:n},{token:t}),(e=>e.user)),removeTenantRoles:(s,o,n)=>a(e.httpClient.post(m.removeRole,{loginId:s,tenantId:o,roleNames:n},{token:t}),(e=>e.user)),generateOTPForTestUser:(s,o)=>a(e.httpClient.post(m.generateOTPForTest,{deliveryMethod:s,loginId:o},{token:t}),(e=>e)),generateMagicLinkForTestUser:(s,o,n)=>a(e.httpClient.post(m.generateMagicLinkForTest,{deliveryMethod:s,loginId:o,URI:n},{token:t}),(e=>e)),generateEnchantedLinkForTestUser:(s,o)=>a(e.httpClient.post(m.generateEnchantedLinkForTest,{loginId:s,URI:o},{token:t}),(e=>e))}),I=(e,t)=>({create:(s,o)=>a(e.httpClient.post(c.create,{name:s,selfProvisioningDomains:o},{token:t})),createWithId:(s,o,n)=>a(e.httpClient.post(c.create,{id:s,name:o,selfProvisioningDomains:n},{token:t})),update:(s,o,n)=>a(e.httpClient.post(c.update,{id:s,name:o,selfProvisioningDomains:n},{token:t})),delete:s=>a(e.httpClient.post(c.delete,{id:s},{token:t})),loadAll:()=>a(e.httpClient.get(c.loadAll,{token:t}),(e=>e.tenants))}),b=(e,t)=>({update:(s,o)=>a(e.httpClient.post(h.update,{jwt:s,customClaims:o},{token:t}))}),T=(e,t)=>({create:(s,o)=>a(e.httpClient.post(v.create,{name:s,description:o},{token:t})),update:(s,o,n)=>a(e.httpClient.post(v.update,{name:s,newName:o,description:n},{token:t})),delete:s=>a(e.httpClient.post(v.delete,{name:s},{token:t})),loadAll:()=>a(e.httpClient.get(v.loadAll,{token:t}),(e=>e.permissions))}),A=(e,t)=>({create:(s,o,n)=>a(e.httpClient.post(k.create,{name:s,description:o,permissionNames:n},{token:t})),update:(s,o,n,r)=>a(e.httpClient.post(k.update,{name:s,newName:o,description:n,permissionNames:r},{token:t})),delete:s=>a(e.httpClient.post(k.delete,{name:s},{token:t})),loadAll:()=>a(e.httpClient.get(k.loadAll,{token:t}),(e=>e.roles))}),x=(e,t)=>({loadAllGroups:s=>a(e.httpClient.post(C.loadAllGroups,{tenantId:s},{token:t})),loadAllGroupsForMember:(s,o,n)=>a(e.httpClient.post(C.loadAllGroupsForMember,{tenantId:s,loginIds:n,userIds:o},{token:t})),loadAllGroupMembers:(s,o)=>a(e.httpClient.post(C.loadAllGroupMembers,{tenantId:s,groupId:o},{token:t}))}),j=(e,t)=>({getSettings:s=>a(e.httpClient.get(g.settings,{queryParams:{tenantId:s},token:t}),(e=>e)),configureSettings:(s,o,n,r,i,l)=>a(e.httpClient.post(g.settings,{tenantId:s,idpURL:o,entityId:r,idpCert:n,redirectURL:i,domain:l},{token:t})),configureMetadata:(s,o)=>a(e.httpClient.post(g.metadata,{tenantId:s,idpMetadataURL:o},{token:t})),configureMapping:(s,o,n)=>a(e.httpClient.post(g.mapping,{tenantId:s,roleMapping:o,attributeMapping:n},{token:t}))}),N=(e,t)=>({create:(s,o,n,r)=>a(e.httpClient.post(u.create,{name:s,expireTime:o,roleNames:n,keyTenants:r},{token:t})),load:s=>a(e.httpClient.get(u.load,{queryParams:{id:s},token:t}),(e=>e.key)),searchAll:s=>a(e.httpClient.post(u.search,{tenantIds:s},{token:t}),(e=>e.keys)),update:(s,o)=>a(e.httpClient.post(u.update,{id:s,name:o},{token:t}),(e=>e.key)),deactivate:s=>a(e.httpClient.post(u.deactivate,{id:s},{token:t})),activate:s=>a(e.httpClient.post(u.activate,{id:s},{token:t})),delete:s=>a(e.httpClient.post(u.delete,{id:s},{token:t}))}),R=(e,t)=>({export:s=>a(e.httpClient.post(y.export,{flowId:s},{token:t})),import:(s,o,n)=>a(e.httpClient.post(y.import,{flowId:s,flow:o,screens:n},{token:t}))}),P=(e,t)=>({export:()=>a(e.httpClient.post(f.export,{},{token:t})),import:s=>a(e.httpClient.post(f.import,{theme:s},{token:t}))});var M;null!==(M=globalThis.Headers)&&void 0!==M||(globalThis.Headers=l);const E=(...e)=>(e.forEach((e=>{var t,a;e&&(null!==(t=(a=e).highWaterMark)&&void 0!==t||(a.highWaterMark=31457280))})),i(...e)),S=a=>{var i,{managementKey:l}=a,m=e(a,["managementKey"]);const u=t(Object.assign(Object.assign({},m),{fetch:E,baseHeaders:Object.assign(Object.assign({},m.baseHeaders),{"x-descope-sdk-name":"nodejs","x-descope-sdk-node-version":(null===(i=null===process||void 0===process?void 0:process.versions)||void 0===i?void 0:i.node)||"","x-descope-sdk-version":"1.5.0"})})),{projectId:c,logger:g}=m,h={},v=((e,t)=>({user:w(e,t),accessKey:N(e,t),tenant:I(e,t),sso:j(e,t),jwt:b(e,t),permission:T(e,t),role:A(e,t),group:x(e,t),flow:R(e,t),theme:P(e,t)}))(u,l),k=Object.assign(Object.assign({},u),{management:v,async getKey(e){if(!(null==e?void 0:e.kid))throw Error("header.kid must not be empty");if(h[e.kid])return h[e.kid];if(Object.assign(h,await(async()=>{const e=(await u.httpClient.get(`v2/keys/${c}`).then((e=>e.json()))).keys;return Array.isArray(e)?(await Promise.all(e.map((async e=>[e.kid,await r(e)])))).reduce(((e,[t,a])=>t?Object.assign(Object.assign({},e),{[t.toString()]:a}):e),{}):{}})()),!h[e.kid])throw Error("failed to fetch matching key");return h[e.kid]},async validateJwt(e){var t;const a=(await o(e,k.getKey,{clockTolerance:5})).payload;if(a&&(a.iss=null===(t=a.iss)||void 0===t?void 0:t.split("/").pop(),a.iss!==c))throw new n.JWTClaimValidationFailed('unexpected "iss" claim value',"iss","check_failed");return{jwt:e,token:a}},async validateSession(e){if(!e)throw Error("session token is required for validation");try{return await k.validateJwt(e)}catch(e){throw null==g||g.error("session validation failed",e),Error("session validation failed")}},async refreshSession(e){var t,a;if(!e)throw Error("refresh token is required to refresh a session");try{await k.validateJwt(e);const s=await k.refresh(e);if(s.ok){return await k.validateJwt(null===(t=s.data)||void 0===t?void 0:t.sessionJwt)}throw Error(null===(a=s.error)||void 0===a?void 0:a.errorMessage)}catch(e){throw null==g||g.error("refresh token validation failed",e),Error("refresh token validation failed")}},async validateAndRefreshSession(e,t){if(!e&&!t)throw Error("both session and refresh tokens are empty");try{return await k.validateSession(e)}catch(e){null==g||g.log("session validation failed - trying to refresh it")}return k.refreshSession(t)},async exchangeAccessKey(e){if(!e)throw Error("access key must not be empty");let t;try{t=await k.accessKey.exchange(e)}catch(e){throw null==g||g.error("failed to exchange access key",e),Error("could not exchange access key")}const{sessionJwt:a}=t.data;if(!a)throw null==g||g.error("failed to parse exchange access key response"),Error("could not exchange access key");try{return await k.validateJwt(a)}catch(e){throw null==g||g.error("failed to parse jwt from access key",e),Error("could not exchange access key")}},validatePermissions:(e,t)=>k.validateTenantPermissions(e,null,t),validateTenantPermissions(e,t,a){const s=p(e,"permissions",t);return a.every((e=>s.includes(e)))},validateRoles:(e,t)=>k.validateTenantRoles(e,null,t),validateTenantRoles(e,t,a){const s=p(e,"roles",t);return a.every((e=>s.includes(e)))}});return s(k,["otp.verify.email","otp.verify.sms","otp.verify.whatsapp","magicLink.verify","enchantedLink.signUp","enchantedLink.signIn","oauth.exchange","saml.exchange","totp.verify","webauthn.signIn.finish","webauthn.signUp.finish","refresh"],d)};S.RefreshTokenCookieName="DSR",S.SessionTokenCookieName="DS";export{S as default};
+import{__rest as e}from"tslib";import t,{transformResponse as a,wrapWith as s}from"@descope/core-js-sdk";import{jwtVerify as o,errors as n,importJWK as r}from"jose";import i,{Headers as l}from"node-fetch-commonjs";const d=t=>async(...a)=>{var s,o,n;const r=await t(...a);if(!r.data)return r;let i=r.data,{refreshJwt:l}=i,d=e(i,["refreshJwt"]);const p=[];var m;return l?p.push(`${"DSR"}=${l}; Domain=${(null==(m=d)?void 0:m.cookieDomain)||""}; Max-Age=${(null==m?void 0:m.cookieMaxAge)||""}; Path=${(null==m?void 0:m.cookiePath)||"/"}; HttpOnly; SameSite=Strict`):(null===(s=r.response)||void 0===s?void 0:s.headers.get("set-cookie"))&&(l=((e,t)=>{const a=null==e?void 0:e.match(RegExp(`(?:^|;\\s*)${t}=([^;]*)`));return a?a[1]:null})(null===(o=r.response)||void 0===o?void 0:o.headers.get("set-cookie"),"DSR"),p.push(null===(n=r.response)||void 0===n?void 0:n.headers.get("set-cookie"))),Object.assign(Object.assign({},r),{data:Object.assign(Object.assign({},r.data),{refreshJwt:l,cookies:p})})};function p(e,t,a){var s,o;const n=a?null===(o=null===(s=e.token.tenants)||void 0===s?void 0:s[a])||void 0===o?void 0:o[t]:e.token[t];return Array.isArray(n)?n:[]}var m={create:"/v1/mgmt/user/create",update:"/v1/mgmt/user/update",delete:"/v1/mgmt/user/delete",deleteAllTestUsers:"/v1/mgmt/user/test/delete/all",load:"/v1/mgmt/user",search:"/v1/mgmt/user/search",updateStatus:"/v1/mgmt/user/update/status",updateEmail:"/v1/mgmt/user/update/email",updatePhone:"/v1/mgmt/user/update/phone",updateDisplayName:"/v1/mgmt/user/update/name",updatePicture:"/v1/mgmt/user/update/picture",updateCustomAttribute:"/v1/mgmt/user/update/customAttribute",addRole:"/v1/mgmt/user/update/role/add",removeRole:"/v1/mgmt/user/update/role/remove",addTenant:"/v1/mgmt/user/update/tenant/add",removeTenant:"/v1/mgmt/user/update/tenant/remove",setPassword:"/v1/mgmt/user/password/set",expirePassword:"/v1/mgmt/user/password/expire",generateOTPForTest:"/v1/mgmt/tests/generate/otp",generateMagicLinkForTest:"/v1/mgmt/tests/generate/magiclink",generateEnchantedLinkForTest:"/v1/mgmt/tests/generate/enchantedlink"},u={create:"/v1/mgmt/accesskey/create",load:"/v1/mgmt/accesskey",search:"/v1/mgmt/accesskey/search",update:"/v1/mgmt/accesskey/update",deactivate:"/v1/mgmt/accesskey/deactivate",activate:"/v1/mgmt/accesskey/activate",delete:"/v1/mgmt/accesskey/delete"},c={create:"/v1/mgmt/tenant/create",update:"/v1/mgmt/tenant/update",delete:"/v1/mgmt/tenant/delete",loadAll:"/v1/mgmt/tenant/all"},g={settings:"/v1/mgmt/sso/settings",metadata:"/v1/mgmt/sso/metadata",mapping:"/v1/mgmt/sso/mapping"},h={update:"/v1/mgmt/jwt/update"},v={create:"/v1/mgmt/permission/create",update:"/v1/mgmt/permission/update",delete:"/v1/mgmt/permission/delete",loadAll:"/v1/mgmt/permission/all"},k={create:"/v1/mgmt/role/create",update:"/v1/mgmt/role/update",delete:"/v1/mgmt/role/delete",loadAll:"/v1/mgmt/role/all"},y={export:"/v1/mgmt/flow/export",import:"/v1/mgmt/flow/import"},f={export:"/v1/mgmt/theme/export",import:"/v1/mgmt/theme/import"},C={loadAllGroups:"/v1/mgmt/group/all",loadAllGroupsForMember:"/v1/mgmt/group/member/all",loadAllGroupMembers:"/v1/mgmt/group/members"};const w=(e,t)=>({create:(s,o,n,r,i,l,d,p)=>a(e.httpClient.post(m.create,{loginId:s,email:o,phone:n,displayName:r,roleNames:i,userTenants:l,customAttributes:d,picture:p},{token:t}),(e=>e.user)),createTestUser:(s,o,n,r,i,l,d,p)=>a(e.httpClient.post(m.create,{loginId:s,email:o,phone:n,displayName:r,roleNames:i,userTenants:l,test:!0,customAttributes:d,picture:p},{token:t}),(e=>e.user)),invite:(s,o,n,r,i,l,d,p)=>a(e.httpClient.post(m.create,{loginId:s,email:o,phone:n,displayName:r,roleNames:i,userTenants:l,invite:!0,customAttributes:d,picture:p},{token:t}),(e=>e.user)),update:(s,o,n,r,i,l,d,p)=>a(e.httpClient.post(m.update,{loginId:s,email:o,phone:n,displayName:r,roleNames:i,userTenants:l,customAttributes:d,picture:p},{token:t}),(e=>e.user)),delete:s=>a(e.httpClient.post(m.delete,{loginId:s},{token:t})),deleteAllTestUsers:()=>a(e.httpClient.delete(m.deleteAllTestUsers,{token:t})),load:s=>a(e.httpClient.get(m.load,{queryParams:{loginId:s},token:t}),(e=>e.user)),loadByUserId:s=>a(e.httpClient.get(m.load,{queryParams:{userId:s},token:t}),(e=>e.user)),searchAll:(s,o,n,r,i,l,d)=>a(e.httpClient.post(m.search,{tenantIds:s,roleNames:o,limit:n,page:r,testUsersOnly:i,withTestUser:l,customAttributes:d},{token:t}),(e=>e.users)),activate:s=>a(e.httpClient.post(m.updateStatus,{loginId:s,status:"enabled"},{token:t}),(e=>e.user)),deactivate:s=>a(e.httpClient.post(m.updateStatus,{loginId:s,status:"disabled"},{token:t}),(e=>e.user)),updateEmail:(s,o,n)=>a(e.httpClient.post(m.updateEmail,{loginId:s,email:o,verified:n},{token:t}),(e=>e.user)),updatePhone:(s,o,n)=>a(e.httpClient.post(m.updatePhone,{loginId:s,phone:o,verified:n},{token:t}),(e=>e.user)),updateDisplayName:(s,o)=>a(e.httpClient.post(m.updateDisplayName,{loginId:s,displayName:o},{token:t}),(e=>e.user)),updatePicture:(s,o)=>a(e.httpClient.post(m.updatePicture,{loginId:s,picture:o},{token:t}),(e=>e.user)),updateCustomAttribute:(s,o,n)=>a(e.httpClient.post(m.updateCustomAttribute,{loginId:s,attributeKey:o,attributeValue:n},{token:t}),(e=>e.user)),addRoles:(s,o)=>a(e.httpClient.post(m.addRole,{loginId:s,roleNames:o},{token:t}),(e=>e.user)),removeRoles:(s,o)=>a(e.httpClient.post(m.removeRole,{loginId:s,roleNames:o},{token:t}),(e=>e.user)),addTenant:(s,o)=>a(e.httpClient.post(m.addTenant,{loginId:s,tenantId:o},{token:t}),(e=>e.user)),removeTenant:(s,o)=>a(e.httpClient.post(m.removeTenant,{loginId:s,tenantId:o},{token:t}),(e=>e.user)),addTenantRoles:(s,o,n)=>a(e.httpClient.post(m.addRole,{loginId:s,tenantId:o,roleNames:n},{token:t}),(e=>e.user)),removeTenantRoles:(s,o,n)=>a(e.httpClient.post(m.removeRole,{loginId:s,tenantId:o,roleNames:n},{token:t}),(e=>e.user)),generateOTPForTestUser:(s,o)=>a(e.httpClient.post(m.generateOTPForTest,{deliveryMethod:s,loginId:o},{token:t}),(e=>e)),generateMagicLinkForTestUser:(s,o,n)=>a(e.httpClient.post(m.generateMagicLinkForTest,{deliveryMethod:s,loginId:o,URI:n},{token:t}),(e=>e)),generateEnchantedLinkForTestUser:(s,o)=>a(e.httpClient.post(m.generateEnchantedLinkForTest,{loginId:s,URI:o},{token:t}),(e=>e)),setPassword:(s,o)=>a(e.httpClient.post(m.setPassword,{loginId:s,password:o},{token:t}),(e=>e)),expirePassword:s=>a(e.httpClient.post(m.expirePassword,{loginId:s},{token:t}),(e=>e))}),I=(e,t)=>({create:(s,o)=>a(e.httpClient.post(c.create,{name:s,selfProvisioningDomains:o},{token:t})),createWithId:(s,o,n)=>a(e.httpClient.post(c.create,{id:s,name:o,selfProvisioningDomains:n},{token:t})),update:(s,o,n)=>a(e.httpClient.post(c.update,{id:s,name:o,selfProvisioningDomains:n},{token:t})),delete:s=>a(e.httpClient.post(c.delete,{id:s},{token:t})),loadAll:()=>a(e.httpClient.get(c.loadAll,{token:t}),(e=>e.tenants))}),b=(e,t)=>({update:(s,o)=>a(e.httpClient.post(h.update,{jwt:s,customClaims:o},{token:t}))}),T=(e,t)=>({create:(s,o)=>a(e.httpClient.post(v.create,{name:s,description:o},{token:t})),update:(s,o,n)=>a(e.httpClient.post(v.update,{name:s,newName:o,description:n},{token:t})),delete:s=>a(e.httpClient.post(v.delete,{name:s},{token:t})),loadAll:()=>a(e.httpClient.get(v.loadAll,{token:t}),(e=>e.permissions))}),A=(e,t)=>({create:(s,o,n)=>a(e.httpClient.post(k.create,{name:s,description:o,permissionNames:n},{token:t})),update:(s,o,n,r)=>a(e.httpClient.post(k.update,{name:s,newName:o,description:n,permissionNames:r},{token:t})),delete:s=>a(e.httpClient.post(k.delete,{name:s},{token:t})),loadAll:()=>a(e.httpClient.get(k.loadAll,{token:t}),(e=>e.roles))}),x=(e,t)=>({loadAllGroups:s=>a(e.httpClient.post(C.loadAllGroups,{tenantId:s},{token:t})),loadAllGroupsForMember:(s,o,n)=>a(e.httpClient.post(C.loadAllGroupsForMember,{tenantId:s,loginIds:n,userIds:o},{token:t})),loadAllGroupMembers:(s,o)=>a(e.httpClient.post(C.loadAllGroupMembers,{tenantId:s,groupId:o},{token:t}))}),P=(e,t)=>({getSettings:s=>a(e.httpClient.get(g.settings,{queryParams:{tenantId:s},token:t}),(e=>e)),deleteSettings:s=>a(e.httpClient.delete(g.settings,{queryParams:{tenantId:s},token:t})),configureSettings:(s,o,n,r,i,l)=>a(e.httpClient.post(g.settings,{tenantId:s,idpURL:o,entityId:r,idpCert:n,redirectURL:i,domain:l},{token:t})),configureMetadata:(s,o)=>a(e.httpClient.post(g.metadata,{tenantId:s,idpMetadataURL:o},{token:t})),configureMapping:(s,o,n)=>a(e.httpClient.post(g.mapping,{tenantId:s,roleMapping:o,attributeMapping:n},{token:t}))}),j=(e,t)=>({create:(s,o,n,r)=>a(e.httpClient.post(u.create,{name:s,expireTime:o,roleNames:n,keyTenants:r},{token:t})),load:s=>a(e.httpClient.get(u.load,{queryParams:{id:s},token:t}),(e=>e.key)),searchAll:s=>a(e.httpClient.post(u.search,{tenantIds:s},{token:t}),(e=>e.keys)),update:(s,o)=>a(e.httpClient.post(u.update,{id:s,name:o},{token:t}),(e=>e.key)),deactivate:s=>a(e.httpClient.post(u.deactivate,{id:s},{token:t})),activate:s=>a(e.httpClient.post(u.activate,{id:s},{token:t})),delete:s=>a(e.httpClient.post(u.delete,{id:s},{token:t}))}),N=(e,t)=>({export:s=>a(e.httpClient.post(y.export,{flowId:s},{token:t})),import:(s,o,n)=>a(e.httpClient.post(y.import,{flowId:s,flow:o,screens:n},{token:t}))}),R=(e,t)=>({export:()=>a(e.httpClient.post(f.export,{},{token:t})),import:s=>a(e.httpClient.post(f.import,{theme:s},{token:t}))});var M;null!==(M=globalThis.Headers)&&void 0!==M||(globalThis.Headers=l);const E=(...e)=>(e.forEach((e=>{var t,a;e&&(null!==(t=(a=e).highWaterMark)&&void 0!==t||(a.highWaterMark=31457280))})),i(...e)),S=a=>{var i,{managementKey:l}=a,m=e(a,["managementKey"]);const u=t(Object.assign(Object.assign({},m),{fetch:E,baseHeaders:Object.assign(Object.assign({},m.baseHeaders),{"x-descope-sdk-name":"nodejs","x-descope-sdk-node-version":(null===(i=null===process||void 0===process?void 0:process.versions)||void 0===i?void 0:i.node)||"","x-descope-sdk-version":"1.5.1"})})),{projectId:c,logger:g}=m,h={},v=((e,t)=>({user:w(e,t),accessKey:j(e,t),tenant:I(e,t),sso:P(e,t),jwt:b(e,t),permission:T(e,t),role:A(e,t),group:x(e,t),flow:N(e,t),theme:R(e,t)}))(u,l),k=Object.assign(Object.assign({},u),{management:v,async getKey(e){if(!(null==e?void 0:e.kid))throw Error("header.kid must not be empty");if(h[e.kid])return h[e.kid];if(Object.assign(h,await(async()=>{const e=(await u.httpClient.get(`v2/keys/${c}`).then((e=>e.json()))).keys;return Array.isArray(e)?(await Promise.all(e.map((async e=>[e.kid,await r(e)])))).reduce(((e,[t,a])=>t?Object.assign(Object.assign({},e),{[t.toString()]:a}):e),{}):{}})()),!h[e.kid])throw Error("failed to fetch matching key");return h[e.kid]},async validateJwt(e){var t;const a=(await o(e,k.getKey,{clockTolerance:5})).payload;if(a&&(a.iss=null===(t=a.iss)||void 0===t?void 0:t.split("/").pop(),a.iss!==c))throw new n.JWTClaimValidationFailed('unexpected "iss" claim value',"iss","check_failed");return{jwt:e,token:a}},async validateSession(e){if(!e)throw Error("session token is required for validation");try{return await k.validateJwt(e)}catch(e){throw null==g||g.error("session validation failed",e),Error("session validation failed")}},async refreshSession(e){var t,a;if(!e)throw Error("refresh token is required to refresh a session");try{await k.validateJwt(e);const s=await k.refresh(e);if(s.ok){return await k.validateJwt(null===(t=s.data)||void 0===t?void 0:t.sessionJwt)}throw Error(null===(a=s.error)||void 0===a?void 0:a.errorMessage)}catch(e){throw null==g||g.error("refresh token validation failed",e),Error("refresh token validation failed")}},async validateAndRefreshSession(e,t){if(!e&&!t)throw Error("both session and refresh tokens are empty");try{return await k.validateSession(e)}catch(e){null==g||g.log("session validation failed - trying to refresh it")}return k.refreshSession(t)},async exchangeAccessKey(e){if(!e)throw Error("access key must not be empty");let t;try{t=await k.accessKey.exchange(e)}catch(e){throw null==g||g.error("failed to exchange access key",e),Error("could not exchange access key")}const{sessionJwt:a}=t.data;if(!a)throw null==g||g.error("failed to parse exchange access key response"),Error("could not exchange access key");try{return await k.validateJwt(a)}catch(e){throw null==g||g.error("failed to parse jwt from access key",e),Error("could not exchange access key")}},validatePermissions:(e,t)=>k.validateTenantPermissions(e,null,t),validateTenantPermissions(e,t,a){const s=p(e,"permissions",t);return a.every((e=>s.includes(e)))},validateRoles:(e,t)=>k.validateTenantRoles(e,null,t),validateTenantRoles(e,t,a){const s=p(e,"roles",t);return a.every((e=>s.includes(e)))}});return s(k,["otp.verify.email","otp.verify.sms","otp.verify.whatsapp","magicLink.verify","enchantedLink.signUp","enchantedLink.signIn","oauth.exchange","saml.exchange","totp.verify","webauthn.signIn.finish","webauthn.signUp.finish","refresh"],d)};S.RefreshTokenCookieName="DSR",S.SessionTokenCookieName="DS";export{S as default};
 //# sourceMappingURL=index.esm.js.map

package/dist/index.esm.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.esm.js","sources":["../lib/constants.ts","../lib/helpers.ts","../lib/management/paths.ts","../lib/management/user.ts","../lib/management/tenant.ts","../lib/management/jwt.ts","../lib/management/permission.ts","../lib/management/role.ts","../lib/management/group.ts","../lib/management/sso.ts","../lib/management/accesskey.ts","../lib/management/flow.ts","../lib/management/theme.ts","../lib/fetch-polyfill.ts","../lib/index.ts","../lib/management/index.ts"],"sourcesContent":["// eslint-disable-next-line import/prefer-default-export\n/** Refresh JWT cookie name */\nexport const refreshTokenCookieName = 'DSR';\n/** Session JWT cookie name */\nexport const sessionTokenCookieName = 'DS';\n/** The key of the tenants claims in the claims map */\nexport const authorizedTenantsClaimName = 'tenants';\n/** The key of the permissions claims in the claims map either under tenant or top level */\nexport const permissionsClaimName = 'permissions';\n/** The key of the roles claims in the claims map either under tenant or top level */\nexport const rolesClaimName = 'roles';\n","import type { SdkFnWrapper } from '@descope/core-js-sdk';\nimport { authorizedTenantsClaimName, refreshTokenCookieName } from './constants';\nimport { AuthenticationInfo } from './types';\n\n/**\n * Generate a cookie string from given parameters\n * @param name name of the cookie\n * @param value value of cookie that must be already encoded\n * @param options any options to put on the cookie like cookieDomain, cookieMaxAge, cookiePath\n * @returns Cookie string with all options on the string\n */\nconst generateCookie = (name: string, value: string, options?: Record<string, string | number>) =>\n  `${name}=${value}; Domain=${options?.cookieDomain || ''}; Max-Age=${\n    options?.cookieMaxAge || ''\n  }; Path=${options?.cookiePath || '/'}; HttpOnly; SameSite=Strict`;\n\n/**\n * Parse the cookie string and return the value of the cookie\n * @param cookie the raw cookie string\n * @param name the name of the cookie to get value for\n * @returns the value of the given cookie\n */\nconst getCookieValue = (cookie: string | null | undefined, name: string) => {\n  const match = cookie?.match(RegExp(`(?:^|;\\\\s*)${name}=([^;]*)`));\n  return match ? match[1] : null;\n};\n\n// eslint-disable-next-line import/prefer-default-export\n/**\n * Add cookie generation to core-js functions.\n * @param fn the function we are wrapping\n * @returns Wrapped function with cookie generation\n */\nexport const withCookie: SdkFnWrapper<{ refreshJwt?: string; cookies?: string[] }> =\n  (fn) =>\n  async (...args) => {\n    const resp = await fn(...args);\n\n    // istanbul ignore next\n    if (!resp.data) {\n      return resp;\n    }\n\n    // eslint-disable-next-line prefer-const\n    let { refreshJwt, ...rest } = resp.data;\n    const cookies: string[] = [];\n\n    if (!refreshJwt) {\n      if (resp.response?.headers.get('set-cookie')) {\n        refreshJwt = getCookieValue(\n          resp.response?.headers.get('set-cookie'),\n          refreshTokenCookieName,\n        );\n        cookies.push(resp.response?.headers.get('set-cookie')!);\n      }\n    } else {\n      cookies.push(generateCookie(refreshTokenCookieName, refreshJwt, rest));\n    }\n\n    return { ...resp, data: { ...resp.data, refreshJwt, cookies } };\n  };\n\n/**\n * Get the claim (used for permissions or roles) for a given tenant or top level if tenant is empty\n * @param authInfo The parsed authentication info from the JWT\n * @param claim name of the claim\n * @param tenant tenant to retrieve the claim for\n * @returns\n */\nexport function getAuthorizationClaimItems(\n  authInfo: AuthenticationInfo,\n  claim: string,\n  tenant?: string,\n): string[] {\n  const value = tenant\n    ? authInfo.token[authorizedTenantsClaimName]?.[tenant]?.[claim]\n    : authInfo.token[claim];\n  return Array.isArray(value) ? value : [];\n}\n","/** API paths for the Descope service Management APIs */\nexport default {\n  user: {\n    create: '/v1/mgmt/user/create',\n    update: '/v1/mgmt/user/update',\n    delete: '/v1/mgmt/user/delete',\n    deleteAllTestUsers: '/v1/mgmt/user/test/delete/all',\n    load: '/v1/mgmt/user',\n    search: '/v1/mgmt/user/search',\n    updateStatus: '/v1/mgmt/user/update/status',\n    updateEmail: '/v1/mgmt/user/update/email',\n    updatePhone: '/v1/mgmt/user/update/phone',\n    updateDisplayName: '/v1/mgmt/user/update/name',\n    updatePicture: '/v1/mgmt/user/update/picture',\n    updateCustomAttribute: '/v1/mgmt/user/update/customAttribute',\n    addRole: '/v1/mgmt/user/update/role/add',\n    removeRole: '/v1/mgmt/user/update/role/remove',\n    addTenant: '/v1/mgmt/user/update/tenant/add',\n    removeTenant: '/v1/mgmt/user/update/tenant/remove',\n    generateOTPForTest: '/v1/mgmt/tests/generate/otp',\n    generateMagicLinkForTest: '/v1/mgmt/tests/generate/magiclink',\n    generateEnchantedLinkForTest: '/v1/mgmt/tests/generate/enchantedlink',\n  },\n  accessKey: {\n    create: '/v1/mgmt/accesskey/create',\n    load: '/v1/mgmt/accesskey',\n    search: '/v1/mgmt/accesskey/search',\n    update: '/v1/mgmt/accesskey/update',\n    deactivate: '/v1/mgmt/accesskey/deactivate',\n    activate: '/v1/mgmt/accesskey/activate',\n    delete: '/v1/mgmt/accesskey/delete',\n  },\n  tenant: {\n    create: '/v1/mgmt/tenant/create',\n    update: '/v1/mgmt/tenant/update',\n    delete: '/v1/mgmt/tenant/delete',\n    loadAll: '/v1/mgmt/tenant/all',\n  },\n  sso: {\n    settings: '/v1/mgmt/sso/settings',\n    metadata: '/v1/mgmt/sso/metadata',\n    mapping: '/v1/mgmt/sso/mapping',\n  },\n  jwt: {\n    update: '/v1/mgmt/jwt/update',\n  },\n  permission: {\n    create: '/v1/mgmt/permission/create',\n    update: '/v1/mgmt/permission/update',\n    delete: '/v1/mgmt/permission/delete',\n    loadAll: '/v1/mgmt/permission/all',\n  },\n  role: {\n    create: '/v1/mgmt/role/create',\n    update: '/v1/mgmt/role/update',\n    delete: '/v1/mgmt/role/delete',\n    loadAll: '/v1/mgmt/role/all',\n  },\n  flow: {\n    export: '/v1/mgmt/flow/export',\n    import: '/v1/mgmt/flow/import',\n  },\n  theme: {\n    export: '/v1/mgmt/theme/export',\n    import: '/v1/mgmt/theme/import',\n  },\n  group: {\n    loadAllGroups: '/v1/mgmt/group/all',\n    loadAllGroupsForMember: '/v1/mgmt/group/member/all',\n    loadAllGroupMembers: '/v1/mgmt/group/members',\n  },\n};\n","import { DeliveryMethod, SdkResponse, transformResponse, UserResponse } from '@descope/core-js-sdk';\nimport { CoreSdk } from '../types';\nimport apiPaths from './paths';\nimport {\n  AssociatedTenant,\n  GenerateEnchantedLinkForTestResponse,\n  GenerateMagicLinkForTestResponse,\n  GenerateOTPForTestResponse,\n  AttributesTypes,\n} from './types';\n\ntype SingleUserResponse = {\n  user: UserResponse;\n};\n\ntype MultipleUsersResponse = {\n  users: UserResponse[];\n};\n\nconst withUser = (sdk: CoreSdk, managementKey?: string) => ({\n  create: (\n    loginId: string,\n    email?: string,\n    phone?: string,\n    displayName?: string,\n    roles?: string[],\n    userTenants?: AssociatedTenant[],\n    customAttributes?: Record<string, AttributesTypes>,\n    picture?: string,\n  ): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.create,\n        {\n          loginId,\n          email,\n          phone,\n          displayName,\n          roleNames: roles,\n          userTenants,\n          customAttributes,\n          picture,\n        },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  /**\n   * Create a new test user.\n   * The loginID is required and will determine what the user will use to sign in.\n   * Make sure the login id is unique for test. All other fields are optional.\n   *\n   * You can later generate OTP, Magic link and enchanted link to use in the test without the need\n   * of 3rd party messaging services.\n   * Those users are not counted as part of the monthly active users\n   * @returns The UserResponse if found, throws otherwise.\n   */\n  createTestUser: (\n    loginId: string,\n    email?: string,\n    phone?: string,\n    displayName?: string,\n    roles?: string[],\n    userTenants?: AssociatedTenant[],\n    customAttributes?: Record<string, AttributesTypes>,\n    picture?: string,\n  ): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.create,\n        {\n          loginId,\n          email,\n          phone,\n          displayName,\n          roleNames: roles,\n          userTenants,\n          test: true,\n          customAttributes,\n          picture,\n        },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  invite: (\n    loginId: string,\n    email?: string,\n    phone?: string,\n    displayName?: string,\n    roles?: string[],\n    userTenants?: AssociatedTenant[],\n    customAttributes?: Record<string, AttributesTypes>,\n    picture?: string,\n  ): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.create,\n        {\n          loginId,\n          email,\n          phone,\n          displayName,\n          roleNames: roles,\n          userTenants,\n          invite: true,\n          customAttributes,\n          picture,\n        },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  update: (\n    loginId: string,\n    email?: string,\n    phone?: string,\n    displayName?: string,\n    roles?: string[],\n    userTenants?: AssociatedTenant[],\n    customAttributes?: Record<string, AttributesTypes>,\n    picture?: string,\n  ): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.update,\n        {\n          loginId,\n          email,\n          phone,\n          displayName,\n          roleNames: roles,\n          userTenants,\n          customAttributes,\n          picture,\n        },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  delete: (loginId: string): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(apiPaths.user.delete, { loginId }, { token: managementKey }),\n    ),\n  /**\n   * Delete all test users in the project.\n   */\n  deleteAllTestUsers: (): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.delete(apiPaths.user.deleteAllTestUsers, {}, { token: managementKey }),\n    ),\n  load: (loginId: string): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.get(apiPaths.user.load, {\n        queryParams: { loginId },\n        token: managementKey,\n      }),\n      (data) => data.user,\n    ),\n  /**\n   * Load an existing user by user ID. The ID can be found\n   * on the user's JWT.\n   * @param userId load a user by this user ID field\n   * @returns The UserResponse if found, throws otherwise.\n   */\n  loadByUserId: (userId: string): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.get(apiPaths.user.load, {\n        queryParams: { userId },\n        token: managementKey,\n      }),\n      (data) => data.user,\n    ),\n  /**\n   * Search all users. Results can be filtered according to tenants and/or\n   * roles, and also paginated used the limit and page parameters.\n   * @param tenantIds optional list of tenant IDs to filter by\n   * @param roles optional list of roles to filter by\n   * @param limit optionally limit the response, leave out for default limit\n   * @param page optionally paginate over the response\n   * @param testUsersOnly optionally filter only test users\n   * @param withTestUser optionally include test users in search\n   * @returns An array of UserResponse found by the query\n   */\n  searchAll: (\n    tenantIds?: string[],\n    roles?: string[],\n    limit?: number,\n    page?: number,\n    testUsersOnly?: boolean,\n    withTestUser?: boolean,\n    customAttributes?: Record<string, AttributesTypes>,\n  ): Promise<SdkResponse<UserResponse[]>> =>\n    transformResponse<MultipleUsersResponse, UserResponse[]>(\n      sdk.httpClient.post(\n        apiPaths.user.search,\n        { tenantIds, roleNames: roles, limit, page, testUsersOnly, withTestUser, customAttributes },\n        { token: managementKey },\n      ),\n      (data) => data.users,\n    ),\n  activate: (loginId: string): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.updateStatus,\n        { loginId, status: 'enabled' },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  deactivate: (loginId: string): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.updateStatus,\n        { loginId, status: 'disabled' },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  updateEmail: (\n    loginId: string,\n    email: string,\n    isVerified: boolean,\n  ): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.updateEmail,\n        { loginId, email, verified: isVerified },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  updatePhone: (\n    loginId: string,\n    phone: string,\n    isVerified: boolean,\n  ): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.updatePhone,\n        { loginId, phone, verified: isVerified },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  updateDisplayName: (loginId: string, displayName: string): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.updateDisplayName,\n        { loginId, displayName },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  updatePicture: (loginId: string, picture: string): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.updatePicture,\n        { loginId, picture },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  updateCustomAttribute: (\n    loginId: string,\n    attributeKey: string,\n    attributeValue: AttributesTypes,\n  ): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.updateCustomAttribute,\n        { loginId, attributeKey, attributeValue },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  addRoles: (loginId: string, roles: string[]): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.addRole,\n        { loginId, roleNames: roles },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  removeRoles: (loginId: string, roles: string[]): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.removeRole,\n        { loginId, roleNames: roles },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  addTenant: (loginId: string, tenantId: string): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(apiPaths.user.addTenant, { loginId, tenantId }, { token: managementKey }),\n      (data) => data.user,\n    ),\n  removeTenant: (loginId: string, tenantId: string): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.removeTenant,\n        { loginId, tenantId },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  addTenantRoles: (\n    loginId: string,\n    tenantId: string,\n    roles: string[],\n  ): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.addRole,\n        { loginId, tenantId, roleNames: roles },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  removeTenantRoles: (\n    loginId: string,\n    tenantId: string,\n    roles: string[],\n  ): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.removeRole,\n        { loginId, tenantId, roleNames: roles },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n\n  /**\n   * Generate OTP for the given login ID of a test user.\n   * Choose the selected delivery method for verification.\n   * Returns the code for the login (exactly as it sent via Email or SMS)\n   * This is useful when running tests and don't want to use 3rd party messaging services\n   *\n   * @param deliveryMethod optional DeliveryMethod\n   * @param loginId login ID of a test user\n   * @returns GenerateOTPForTestResponse which includes the loginId and the OTP code\n   */\n  generateOTPForTestUser: (\n    deliveryMethod: DeliveryMethod,\n    loginId: string,\n  ): Promise<SdkResponse<GenerateOTPForTestResponse>> =>\n    transformResponse<GenerateOTPForTestResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.generateOTPForTest,\n        { deliveryMethod, loginId },\n        { token: managementKey },\n      ),\n      (data) => data,\n    ),\n\n  /**\n   * Generate Magic Link for the given login ID of a test user.\n   * Choose the selected delivery method for verification.\n   * It returns the link for the login (exactly as it sent via Email)\n   * This is useful when running tests and don't want to use 3rd party messaging services\n   *\n   * @param deliveryMethod optional DeliveryMethod\n   * @param loginId login ID of a test user\n   * @param uri optional redirect uri which will be used instead of any global configuration.\n   * @returns GenerateMagicLinkForTestResponse which includes the loginId and the magic link\n   */\n  generateMagicLinkForTestUser: (\n    deliveryMethod: DeliveryMethod,\n    loginId: string,\n    uri: string,\n  ): Promise<SdkResponse<GenerateMagicLinkForTestResponse>> =>\n    transformResponse<GenerateMagicLinkForTestResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.generateMagicLinkForTest,\n        { deliveryMethod, loginId, URI: uri },\n        { token: managementKey },\n      ),\n      (data) => data,\n    ),\n\n  /**\n   * Generate Enchanted Link for the given login ID of a test user.\n   * It returns the link for the login (exactly as it sent via Email)\n   * and pendingRef which is used to poll for a valid session\n   * This is useful when running tests and don't want to use 3rd party messaging services\n   *\n   * @param loginId login ID of a test user\n   * @param uri optional redirect uri which will be used instead of any global configuration.\n   * @returns GenerateEnchantedLinkForTestResponse which includes the loginId, the enchanted link and the pendingRef\n   */\n  generateEnchantedLinkForTestUser: (\n    loginId: string,\n    uri: string,\n  ): Promise<SdkResponse<GenerateEnchantedLinkForTestResponse>> =>\n    transformResponse<GenerateEnchantedLinkForTestResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.generateEnchantedLinkForTest,\n        { loginId, URI: uri },\n        { token: managementKey },\n      ),\n      (data) => data,\n    ),\n});\n\nexport default withUser;\n","import { SdkResponse, transformResponse } from '@descope/core-js-sdk';\nimport { CoreSdk } from '../types';\nimport apiPaths from './paths';\nimport { CreateTenantResponse, Tenant } from './types';\n\ntype MultipleTenantResponse = {\n  tenants: Tenant[];\n};\n\nconst withTenant = (sdk: CoreSdk, managementKey?: string) => ({\n  create: (\n    name: string,\n    selfProvisioningDomains?: string[],\n  ): Promise<SdkResponse<CreateTenantResponse>> =>\n    transformResponse(\n      sdk.httpClient.post(\n        apiPaths.tenant.create,\n        { name, selfProvisioningDomains },\n        { token: managementKey },\n      ),\n    ),\n  createWithId: (\n    id: string,\n    name: string,\n    selfProvisioningDomains?: string[],\n  ): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(\n        apiPaths.tenant.create,\n        { id, name, selfProvisioningDomains },\n        { token: managementKey },\n      ),\n    ),\n  update: (\n    id: string,\n    name: string,\n    selfProvisioningDomains?: string[],\n  ): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(\n        apiPaths.tenant.update,\n        { id, name, selfProvisioningDomains },\n        { token: managementKey },\n      ),\n    ),\n  delete: (id: string): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(apiPaths.tenant.delete, { id }, { token: managementKey }),\n    ),\n  loadAll: (): Promise<SdkResponse<Tenant[]>> =>\n    transformResponse<MultipleTenantResponse, Tenant[]>(\n      sdk.httpClient.get(apiPaths.tenant.loadAll, {\n        token: managementKey,\n      }),\n      (data) => data.tenants,\n    ),\n});\n\nexport default withTenant;\n","import { SdkResponse, transformResponse } from '@descope/core-js-sdk';\nimport { CoreSdk } from '../types';\nimport apiPaths from './paths';\nimport { UpdateJWTResponse } from './types';\n\nconst withJWT = (sdk: CoreSdk, managementKey?: string) => ({\n  update: (\n    jwt: string,\n    customClaims?: Record<string, any>,\n  ): Promise<SdkResponse<UpdateJWTResponse>> =>\n    transformResponse(\n      sdk.httpClient.post(apiPaths.jwt.update, { jwt, customClaims }, { token: managementKey }),\n    ),\n});\n\nexport default withJWT;\n","import { SdkResponse, transformResponse } from '@descope/core-js-sdk';\nimport { CoreSdk } from '../types';\nimport apiPaths from './paths';\nimport { Permission } from './types';\n\ntype MultiplePermissionResponse = {\n  permissions: Permission[];\n};\n\nconst withPermission = (sdk: CoreSdk, managementKey?: string) => ({\n  create: (name: string, description?: string): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(\n        apiPaths.permission.create,\n        { name, description },\n        { token: managementKey },\n      ),\n    ),\n  update: (name: string, newName: string, description?: string): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(\n        apiPaths.permission.update,\n        { name, newName, description },\n        { token: managementKey },\n      ),\n    ),\n  delete: (name: string): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(apiPaths.permission.delete, { name }, { token: managementKey }),\n    ),\n  loadAll: (): Promise<SdkResponse<Permission[]>> =>\n    transformResponse<MultiplePermissionResponse, Permission[]>(\n      sdk.httpClient.get(apiPaths.permission.loadAll, {\n        token: managementKey,\n      }),\n      (data) => data.permissions,\n    ),\n});\n\nexport default withPermission;\n","import { SdkResponse, transformResponse } from '@descope/core-js-sdk';\nimport { CoreSdk } from '../types';\nimport apiPaths from './paths';\nimport { Role } from './types';\n\ntype MultipleRoleResponse = {\n  roles: Role[];\n};\n\nconst withRole = (sdk: CoreSdk, managementKey?: string) => ({\n  create: (\n    name: string,\n    description?: string,\n    permissionNames?: string[],\n  ): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(\n        apiPaths.role.create,\n        { name, description, permissionNames },\n        { token: managementKey },\n      ),\n    ),\n  update: (\n    name: string,\n    newName: string,\n    description?: string,\n    permissionNames?: string[],\n  ): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(\n        apiPaths.role.update,\n        { name, newName, description, permissionNames },\n        { token: managementKey },\n      ),\n    ),\n  delete: (name: string): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(apiPaths.role.delete, { name }, { token: managementKey }),\n    ),\n  loadAll: (): Promise<SdkResponse<Role[]>> =>\n    transformResponse<MultipleRoleResponse, Role[]>(\n      sdk.httpClient.get(apiPaths.role.loadAll, {\n        token: managementKey,\n      }),\n      (data) => data.roles,\n    ),\n});\n\nexport default withRole;\n","import { SdkResponse, transformResponse } from '@descope/core-js-sdk';\nimport { CoreSdk } from '../types';\nimport apiPaths from './paths';\nimport { Group } from './types';\n\nconst withGroup = (sdk: CoreSdk, managementKey?: string) => ({\n  /**\n   * Load all groups for a specific tenant id.\n   * @param tenantId Tenant ID to load groups from.\n   * @returns Group[] list of groups\n   */\n  loadAllGroups: (tenantId: string): Promise<SdkResponse<Group[]>> =>\n    transformResponse<Group[]>(\n      sdk.httpClient.post(apiPaths.group.loadAllGroups, { tenantId }, { token: managementKey }),\n    ),\n\n  /**\n   * Load all groups for the provided user IDs or login IDs.\n   * @param tenantId Tenant ID to load groups from.\n   * @param userIds Optional List of user IDs, with the format of \"U2J5ES9S8TkvCgOvcrkpzUgVTEBM\" (example), which can be found on the user's JWT.\n   * @param loginIds Optional List of login IDs, how the user identifies when logging in.\n   * @returns Group[] list of groups\n   */\n  loadAllGroupsForMember: (\n    tenantId: string,\n    userIds: string[],\n    loginIds: string[],\n  ): Promise<SdkResponse<Group[]>> =>\n    transformResponse<Group[]>(\n      sdk.httpClient.post(\n        apiPaths.group.loadAllGroupsForMember,\n        { tenantId, loginIds, userIds },\n        { token: managementKey },\n      ),\n    ),\n\n  /**\n   * Load all members of the provided group id.\n   * @param tenantId Tenant ID to load groups from.\n   * @param groupId Group ID to load members for.\n   * @returns Group[] list of groups\n   */\n  loadAllGroupMembers: (tenantId: string, groupId: string): Promise<SdkResponse<Group[]>> =>\n    transformResponse<Group[]>(\n      sdk.httpClient.post(\n        apiPaths.group.loadAllGroupMembers,\n        { tenantId, groupId },\n        { token: managementKey },\n      ),\n    ),\n});\n\nexport default withGroup;\n","import { SdkResponse, transformResponse } from '@descope/core-js-sdk';\nimport { CoreSdk } from '../types';\nimport apiPaths from './paths';\nimport { RoleMapping, AttributeMapping, SSOSettingsResponse } from './types';\n\nconst withSSOSettings = (sdk: CoreSdk, managementKey?: string) => ({\n  getSettings: (tenantId: string): Promise<SdkResponse<SSOSettingsResponse>> =>\n    transformResponse<SSOSettingsResponse>(\n      sdk.httpClient.get(apiPaths.sso.settings, {\n        queryParams: { tenantId },\n        token: managementKey,\n      }),\n      (data) => data,\n    ),\n  configureSettings: (\n    tenantId: string,\n    idpURL: string,\n    idpCert: string,\n    entityId: string,\n    redirectURL?: string,\n    domain?: string,\n  ): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(\n        apiPaths.sso.settings,\n        { tenantId, idpURL, entityId, idpCert, redirectURL, domain },\n        { token: managementKey },\n      ),\n    ),\n  configureMetadata: (tenantId: string, idpMetadataURL: string): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(\n        apiPaths.sso.metadata,\n        { tenantId, idpMetadataURL },\n        { token: managementKey },\n      ),\n    ),\n  configureMapping: (\n    tenantId: string,\n    roleMapping?: RoleMapping,\n    attributeMapping?: AttributeMapping,\n  ): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(\n        apiPaths.sso.mapping,\n        { tenantId, roleMapping, attributeMapping },\n        { token: managementKey },\n      ),\n    ),\n});\n\nexport default withSSOSettings;\n","import { SdkResponse, transformResponse } from '@descope/core-js-sdk';\nimport { CoreSdk } from '../types';\nimport apiPaths from './paths';\nimport { AccessKey, AssociatedTenant, CreatedAccessKeyResponse } from './types';\n\ntype SingleKeyResponse = {\n  key: AccessKey;\n};\n\ntype MultipleKeysResponse = {\n  keys: AccessKey[];\n};\n\nconst withAccessKey = (sdk: CoreSdk, managementKey?: string) => ({\n  /**\n   * Create a new access key for a project.\n   * @param name Access key name\n   * @param expireTime When the access key expires. Keep at 0 to make it indefinite.\n   * @param roles Optional roles in the project. Does not apply for multi-tenants\n   * @param keyTenants Optional associated tenants for this key and its roles for each.\n   * @returns A newly created key and its cleartext. Make sure to save the cleartext securely.\n   */\n  create: (\n    name: string,\n    expireTime: number,\n    roles?: string[],\n    keyTenants?: AssociatedTenant[],\n  ): Promise<SdkResponse<CreatedAccessKeyResponse>> =>\n    transformResponse(\n      sdk.httpClient.post(\n        apiPaths.accessKey.create,\n        { name, expireTime, roleNames: roles, keyTenants },\n        { token: managementKey },\n      ),\n    ),\n  /**\n   * Load an access key.\n   * @param id Access key ID to load\n   * @returns The loaded access key.\n   */\n  load: (id: string): Promise<SdkResponse<AccessKey>> =>\n    transformResponse<SingleKeyResponse, AccessKey>(\n      sdk.httpClient.get(apiPaths.accessKey.load, {\n        queryParams: { id },\n        token: managementKey,\n      }),\n      (data) => data.key,\n    ),\n  /**\n   * Search all access keys\n   * @param tenantIds Optional tenant ID filter to apply on the search results\n   * @returns An array of found access keys\n   */\n  searchAll: (tenantIds?: string[]): Promise<SdkResponse<AccessKey[]>> =>\n    transformResponse<MultipleKeysResponse, AccessKey[]>(\n      sdk.httpClient.post(apiPaths.accessKey.search, { tenantIds }, { token: managementKey }),\n      (data) => data.keys,\n    ),\n  /**\n   * Update an access key.\n   * @param id Access key ID to load\n   * @param name The updated access key name\n   * @returns The updated access key\n   */\n  update: (id: string, name: string): Promise<SdkResponse<AccessKey>> =>\n    transformResponse<SingleKeyResponse, AccessKey>(\n      sdk.httpClient.post(apiPaths.accessKey.update, { id, name }, { token: managementKey }),\n      (data) => data.key,\n    ),\n  /**\n   * Deactivate an access key. Deactivated access keys cannot be used until they are\n   * activated again.\n   * @param id Access key ID to deactivate\n   */\n  deactivate: (id: string): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(apiPaths.accessKey.deactivate, { id }, { token: managementKey }),\n    ),\n  /**\n   * Activate an access key. Only deactivated access keys can be activated again.\n   * @param id Access key ID to activate\n   */\n  activate: (id: string): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(apiPaths.accessKey.activate, { id }, { token: managementKey }),\n    ),\n  /**\n   * Delete an access key. IMPORTANT: This cannot be undone. Use carefully.\n   * @param id Access key ID to delete\n   */\n  delete: (id: string): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(apiPaths.accessKey.delete, { id }, { token: managementKey }),\n    ),\n});\n\nexport default withAccessKey;\n","import { SdkResponse, transformResponse } from '@descope/core-js-sdk';\nimport { CoreSdk } from '../types';\nimport apiPaths from './paths';\nimport { FlowResponse, Screen, Flow } from './types';\n\nconst WithFlow = (sdk: CoreSdk, managementKey?: string) => ({\n  export: (flowId: string): Promise<SdkResponse<FlowResponse>> =>\n    transformResponse(\n      sdk.httpClient.post(apiPaths.flow.export, { flowId }, { token: managementKey }),\n    ),\n  import: (flowId: string, flow: Flow, screens?: Screen[]): Promise<SdkResponse<FlowResponse>> =>\n    transformResponse(\n      sdk.httpClient.post(\n        apiPaths.flow.import,\n        { flowId, flow, screens },\n        { token: managementKey },\n      ),\n    ),\n});\n\nexport default WithFlow;\n","import { SdkResponse, transformResponse } from '@descope/core-js-sdk';\nimport { CoreSdk } from '../types';\nimport apiPaths from './paths';\nimport { Theme, ThemeResponse } from './types';\n\nconst WithTheme = (sdk: CoreSdk, managementKey?: string) => ({\n  export: (): Promise<SdkResponse<ThemeResponse>> =>\n    transformResponse(sdk.httpClient.post(apiPaths.theme.export, {}, { token: managementKey })),\n  import: (theme: Theme): Promise<SdkResponse<ThemeResponse>> =>\n    transformResponse(\n      sdk.httpClient.post(apiPaths.theme.import, { theme }, { token: managementKey }),\n    ),\n});\n\nexport default WithTheme;\n","import nodeFetch, { Headers } from 'node-fetch-commonjs';\n\nglobalThis.Headers ??= Headers;\n\nconst highWaterMarkMb = 1024 * 1024 * 30; // 30MB\n\n// we are increasing the response buffer size due to an issue where node-fetch hangs when response is too big\nconst patchedFetch = (...args: Parameters<typeof nodeFetch>) => {\n  // we can get Request on the first arg, or RequestInfo on the second arg\n  // we want to make sure we are setting the \"highWaterMark\" so we are doing it on both args\n  args.forEach((arg) => {\n    // eslint-disable-next-line no-param-reassign, @typescript-eslint/no-unused-expressions\n    arg && ((arg as any).highWaterMark ??= highWaterMarkMb);\n  });\n\n  return nodeFetch(...args);\n};\n\nexport default patchedFetch as unknown as typeof fetch;\n","import createSdk, { ExchangeAccessKeyResponse, SdkResponse, wrapWith } from '@descope/core-js-sdk';\nimport { JWK, JWTHeaderParameters, KeyLike, errors, importJWK, jwtVerify } from 'jose';\nimport {\n  permissionsClaimName,\n  refreshTokenCookieName,\n  rolesClaimName,\n  sessionTokenCookieName,\n} from './constants';\nimport { getAuthorizationClaimItems, withCookie } from './helpers';\nimport withManagement from './management';\nimport { AuthenticationInfo } from './types';\nimport fetch from './fetch-polyfill';\n\ndeclare const BUILD_VERSION: string;\n\n/** Configuration arguments which include the Descope core SDK args and an optional management key */\ntype NodeSdkArgs = Parameters<typeof createSdk>[0] & {\n  managementKey?: string;\n};\n\nconst nodeSdk = ({ managementKey, ...config }: NodeSdkArgs) => {\n  const coreSdk = createSdk({\n    ...config,\n    fetch,\n    baseHeaders: {\n      ...config.baseHeaders,\n      'x-descope-sdk-name': 'nodejs',\n      'x-descope-sdk-node-version': process?.versions?.node || '',\n      'x-descope-sdk-version': BUILD_VERSION,\n    },\n  });\n\n  const { projectId, logger } = config;\n\n  const keys: Record<string, KeyLike | Uint8Array> = {};\n\n  /** Fetch the public keys (JWKs) from Descope for the configured project */\n  const fetchKeys = async () => {\n    const keysWrapper = await coreSdk.httpClient\n      .get(`v2/keys/${projectId}`)\n      .then((resp) => resp.json());\n    const publicKeys: JWK[] = keysWrapper.keys;\n    if (!Array.isArray(publicKeys)) return {};\n    const kidJwksPairs = await Promise.all(\n      publicKeys.map(async (key) => [key.kid, await importJWK(key)]),\n    );\n\n    return kidJwksPairs.reduce(\n      (acc, [kid, jwk]) => (kid ? { ...acc, [kid.toString()]: jwk } : acc),\n      {},\n    );\n  };\n\n  const management = withManagement(coreSdk, managementKey);\n\n  const sdk = {\n    ...coreSdk,\n\n    /**\n     * Provides various APIs for managing a Descope project programmatically. A management key must\n     * be provided as an argument when initializing the SDK to use these APIs. Management keys can be\n     * generated in the Descope console.\n     */\n    management,\n\n    /** Get the key that can validate the given JWT KID in the header. Can retrieve the public key from local cache or from Descope. */\n    async getKey(header: JWTHeaderParameters): Promise<KeyLike | Uint8Array> {\n      if (!header?.kid) throw Error('header.kid must not be empty');\n\n      if (keys[header.kid]) return keys[header.kid];\n\n      // do we need to fetch once or every time?\n      Object.assign(keys, await fetchKeys());\n\n      if (!keys[header.kid]) throw Error('failed to fetch matching key');\n\n      return keys[header.kid];\n    },\n\n    /**\n     * Validate the given JWT with the right key and make sure the issuer is correct\n     * @param jwt the JWT string to parse and validate\n     * @returns AuthenticationInfo with the parsed token and JWT. Will throw an error if validation fails.\n     */\n    async validateJwt(jwt: string): Promise<AuthenticationInfo> {\n      // Do not hard-code the algo because library does not support `None` so all are valid\n      const res = await jwtVerify(jwt, sdk.getKey, { clockTolerance: 5 });\n      const token = res.payload;\n\n      if (token) {\n        token.iss = token.iss?.split('/').pop(); // support both url and project id as issuer\n        if (token.iss !== projectId) {\n          // We must do the verification here, since issuer can be either project ID or URL\n          throw new errors.JWTClaimValidationFailed(\n            'unexpected \"iss\" claim value',\n            'iss',\n            'check_failed',\n          );\n        }\n      }\n\n      return { jwt, token };\n    },\n\n    /**\n     * Validate an active session\n     * @param sessionToken session JWT to validate\n     * @returns AuthenticationInfo promise or throws Error if there is an issue with JWTs\n     */\n    async validateSession(sessionToken: string): Promise<AuthenticationInfo> {\n      if (!sessionToken) throw Error('session token is required for validation');\n\n      try {\n        const token = await sdk.validateJwt(sessionToken);\n        return token;\n      } catch (error) {\n        /* istanbul ignore next */\n        logger?.error('session validation failed', error);\n        throw Error('session validation failed');\n      }\n    },\n\n    /**\n     * Refresh the session using a refresh token\n     * @param refreshToken refresh JWT to refresh the session with\n     * @returns AuthenticationInfo promise or throws Error if there is an issue with JWTs\n     */\n    async refreshSession(refreshToken: string): Promise<AuthenticationInfo> {\n      if (!refreshToken) throw Error('refresh token is required to refresh a session');\n\n      try {\n        await sdk.validateJwt(refreshToken);\n        const jwtResp = await sdk.refresh(refreshToken);\n        if (jwtResp.ok) {\n          const token = await sdk.validateJwt(jwtResp.data?.sessionJwt);\n          return token;\n        }\n        /* istanbul ignore next */\n        throw Error(jwtResp.error?.errorMessage);\n      } catch (refreshTokenErr) {\n        /* istanbul ignore next */\n        logger?.error('refresh token validation failed', refreshTokenErr);\n        throw Error('refresh token validation failed');\n      }\n    },\n\n    /**\n     * Validate session and refresh it if it expired\n     * @param sessionToken session JWT\n     * @param refreshToken refresh JWT\n     * @returns AuthenticationInfo promise or throws Error if there is an issue with JWTs\n     */\n    async validateAndRefreshSession(\n      sessionToken?: string,\n      refreshToken?: string,\n    ): Promise<AuthenticationInfo> {\n      if (!sessionToken && !refreshToken) throw Error('both session and refresh tokens are empty');\n\n      try {\n        const token = await sdk.validateSession(sessionToken);\n        return token;\n      } catch (error) {\n        /* istanbul ignore next */\n        logger?.log('session validation failed - trying to refresh it');\n      }\n\n      return sdk.refreshSession(refreshToken);\n    },\n\n    /**\n     * Exchange API key (access key) for a session key\n     * @param accessKey access key to exchange for a session JWT\n     * @returns AuthneticationInfo with session JWT data\n     */\n    async exchangeAccessKey(accessKey: string): Promise<AuthenticationInfo> {\n      if (!accessKey) throw Error('access key must not be empty');\n\n      let resp: SdkResponse<ExchangeAccessKeyResponse>;\n      try {\n        resp = await sdk.accessKey.exchange(accessKey);\n      } catch (error) {\n        logger?.error('failed to exchange access key', error);\n        throw Error('could not exchange access key');\n      }\n\n      const { sessionJwt } = resp.data;\n      if (!sessionJwt) {\n        logger?.error('failed to parse exchange access key response');\n        throw Error('could not exchange access key');\n      }\n\n      try {\n        const token = await sdk.validateJwt(sessionJwt);\n        return token;\n      } catch (error) {\n        logger?.error('failed to parse jwt from access key', error);\n        throw Error('could not exchange access key');\n      }\n    },\n\n    /**\n     * Make sure that all given permissions exist on the parsed JWT top level claims\n     * @param authInfo JWT parsed info\n     * @param permissions list of permissions to make sure they exist on te JWT claims\n     * @returns true if all permissions exist, false otherwise\n     */\n    validatePermissions(authInfo: AuthenticationInfo, permissions: string[]): boolean {\n      return sdk.validateTenantPermissions(authInfo, null, permissions);\n    },\n\n    /**\n     * Make sure that all given permissions exist on the parsed JWT tenant claims\n     * @param authInfo JWT parsed info\n     * @param permissions list of permissions to make sure they exist on te JWT claims\n     * @returns true if all permissions exist, false otherwise\n     */\n    validateTenantPermissions(\n      authInfo: AuthenticationInfo,\n      tenant: string,\n      permissions: string[],\n    ): boolean {\n      const granted = getAuthorizationClaimItems(authInfo, permissionsClaimName, tenant);\n      return permissions.every((perm) => granted.includes(perm));\n    },\n\n    /**\n     * Make sure that all given roles exist on the parsed JWT top level claims\n     * @param authInfo JWT parsed info\n     * @param roles list of roles to make sure they exist on te JWT claims\n     * @returns true if all roles exist, false otherwise\n     */\n    validateRoles(authInfo: AuthenticationInfo, roles: string[]): boolean {\n      return sdk.validateTenantRoles(authInfo, null, roles);\n    },\n\n    /**\n     * Make sure that all given roles exist on the parsed JWT tenant claims\n     * @param authInfo JWT parsed info\n     * @param roles list of roles to make sure they exist on te JWT claims\n     * @returns true if all roles exist, false otherwise\n     */\n    validateTenantRoles(authInfo: AuthenticationInfo, tenant: string, roles: string[]): boolean {\n      const membership = getAuthorizationClaimItems(authInfo, rolesClaimName, tenant);\n      return roles.every((role) => membership.includes(role));\n    },\n  };\n\n  return wrapWith(\n    sdk,\n    [\n      'otp.verify.email',\n      'otp.verify.sms',\n      'otp.verify.whatsapp',\n      'magicLink.verify',\n      'enchantedLink.signUp',\n      'enchantedLink.signIn',\n      'oauth.exchange',\n      'saml.exchange',\n      'totp.verify',\n      'webauthn.signIn.finish',\n      'webauthn.signUp.finish',\n      'refresh',\n    ] as const,\n    withCookie,\n  );\n};\n\n/** Descope SDK client with delivery methods enum.\n *\n * Please see full documentation at {@link https://docs.descope.com/guides Descope Docs}\n * @example Usage\n *\n * ```js\n * import descopeSdk from '@descope/node-sdk';\n *\n * const myProjectId = 'xxx';\n * const sdk = descopeSdk({ projectId: myProjectId });\n *\n * const userLoginId = 'loginId';\n * sdk.otp.signIn.email(userLoginId);\n * const jwtResponse = sdk.otp.verify.email(userLoginId, codeFromEmail);\n * ```\n */\n\nnodeSdk.RefreshTokenCookieName = refreshTokenCookieName;\nnodeSdk.SessionTokenCookieName = sessionTokenCookieName;\n\nexport default nodeSdk;\nexport type {\n  DeliveryMethod,\n  OAuthProvider,\n  ResponseData,\n  SdkResponse,\n} from '@descope/core-js-sdk';\n","import { CoreSdk } from '../types';\nimport withUser from './user';\nimport withTenant from './tenant';\nimport withJWT from './jwt';\nimport withPermission from './permission';\nimport withRole from './role';\nimport withGroup from './group';\nimport withSSOSettings from './sso';\nimport withAccessKey from './accesskey';\nimport WithFlow from './flow';\nimport WithTheme from './theme';\n\n/** Constructs a higher level Management API that wraps the functions from code-js-sdk */\nconst withManagement = (sdk: CoreSdk, managementKey?: string) => ({\n  user: withUser(sdk, managementKey),\n  accessKey: withAccessKey(sdk, managementKey),\n  tenant: withTenant(sdk, managementKey),\n  sso: withSSOSettings(sdk, managementKey),\n  jwt: withJWT(sdk, managementKey),\n  permission: withPermission(sdk, managementKey),\n  role: withRole(sdk, managementKey),\n  group: withGroup(sdk, managementKey),\n  flow: WithFlow(sdk, managementKey),\n  theme: WithTheme(sdk, managementKey),\n});\n\nexport default withManagement;\n"],"names":["withCookie","fn","async","args","resp","data","_d","refreshJwt","rest","__rest","cookies","options","push","cookieDomain","cookieMaxAge","cookiePath","_a","response","headers","get","cookie","name","match","RegExp","getCookieValue","_b","_c","Object","assign","getAuthorizationClaimItems","authInfo","claim","tenant","value","token","Array","isArray","apiPaths","create","update","delete","deleteAllTestUsers","load","search","updateStatus","updateEmail","updatePhone","updateDisplayName","updatePicture","updateCustomAttribute","addRole","removeRole","addTenant","removeTenant","generateOTPForTest","generateMagicLinkForTest","generateEnchantedLinkForTest","deactivate","activate","loadAll","settings","metadata","mapping","export","import","loadAllGroups","loadAllGroupsForMember","loadAllGroupMembers","withUser","sdk","managementKey","loginId","email","phone","displayName","roles","userTenants","customAttributes","picture","transformResponse","httpClient","post","roleNames","user","createTestUser","test","invite","queryParams","loadByUserId","userId","searchAll","tenantIds","limit","page","testUsersOnly","withTestUser","users","status","isVerified","verified","attributeKey","attributeValue","addRoles","removeRoles","tenantId","addTenantRoles","removeTenantRoles","generateOTPForTestUser","deliveryMethod","generateMagicLinkForTestUser","uri","URI","generateEnchantedLinkForTestUser","withTenant","selfProvisioningDomains","createWithId","id","tenants","withJWT","jwt","customClaims","withPermission","description","newName","permissions","withRole","permissionNames","withGroup","userIds","loginIds","groupId","withSSOSettings","getSettings","configureSettings","idpURL","idpCert","entityId","redirectURL","domain","configureMetadata","idpMetadataURL","configureMapping","roleMapping","attributeMapping","withAccessKey","expireTime","keyTenants","key","keys","WithFlow","flowId","flow","screens","WithTheme","theme","globalThis","Headers","patchedFetch","forEach","arg","highWaterMark","nodeFetch","nodeSdk","config","coreSdk","createSdk","fetch","baseHeaders","process","versions","node","projectId","logger","management","accessKey","sso","permission","role","group","withManagement","header","kid","Error","publicKeys","then","json","Promise","all","map","importJWK","reduce","acc","jwk","toString","fetchKeys","jwtVerify","getKey","clockTolerance","payload","iss","split","pop","errors","JWTClaimValidationFailed","sessionToken","validateJwt","error","refreshToken","jwtResp","refresh","ok","sessionJwt","errorMessage","refreshTokenErr","validateSession","log","refreshSession","exchange","validatePermissions","validateTenantPermissions","granted","every","perm","includes","validateRoles","validateTenantRoles","membership","wrapWith","RefreshTokenCookieName","SessionTokenCookieName"],"mappings":"sNAEO,MC+BMA,EACVC,GACDC,SAAUC,eACR,MAAMC,QAAaH,KAAME,GAGzB,IAAKC,EAAKC,KACR,OAAOD,EAIT,IAAIE,EAA0BF,EAAKC,MAA/BE,WAAEA,GAAUD,EAAKE,EAAjBC,EAAAH,EAAA,CAAA,eACJ,MAAMI,EAAoB,GAlCP,IAA8BC,EAgDjD,OAZKJ,EASHG,EAAQE,KA5CZ,GDVoC,SCsDoBL,cA5C5BI,OADuBA,EA6CiBH,QA5CxC,EAAAG,EAASE,eAAgB,gBACnDF,aAAA,EAAAA,EAASG,eAAgB,aACjBH,aAAA,EAAAA,EAASI,aAAc,mCAkCZ,QAAbC,EAAAZ,EAAKa,gBAAQ,IAAAD,OAAA,EAAAA,EAAEE,QAAQC,IAAI,iBAC7BZ,EA3Be,EAACa,EAAmCC,KACzD,MAAMC,EAAQF,eAAAA,EAAQE,MAAMC,OAAO,cAAcF,cACjD,OAAOC,EAAQA,EAAM,GAAK,IAAI,EAyBXE,CACE,QAAbC,EAAArB,EAAKa,gBAAQ,IAAAQ,OAAA,EAAAA,EAAEP,QAAQC,IAAI,cDhDC,OCmD9BT,EAAQE,KAAoB,QAAfc,EAAAtB,EAAKa,gBAAU,IAAAS,OAAA,EAAAA,EAAAR,QAAQC,IAAI,gBAMhCQ,OAAAC,OAAAD,OAAAC,OAAA,CAAA,EAAAxB,GAAM,CAAAC,KAAWsB,OAAAC,OAAAD,OAAAC,OAAA,GAAAxB,EAAKC,MAAM,CAAAE,aAAYG,aAAY,WAUpDmB,EACdC,EACAC,EACAC,WAEA,MAAMC,EAAQD,EAC0C,QAApDP,EAA6C,QAA7CT,EAAAc,EAASI,MAAgC,eAAI,IAAAlB,OAAA,EAAAA,EAAAgB,UAAO,IAAAP,OAAA,EAAAA,EAAGM,GACvDD,EAASI,MAAMH,GACnB,OAAOI,MAAMC,QAAQH,GAASA,EAAQ,EACxC,CC7EA,IAAeI,EACP,CACJC,OAAQ,uBACRC,OAAQ,uBACRC,OAAQ,uBACRC,mBAAoB,gCACpBC,KAAM,gBACNC,OAAQ,uBACRC,aAAc,8BACdC,YAAa,6BACbC,YAAa,6BACbC,kBAAmB,4BACnBC,cAAe,+BACfC,sBAAuB,uCACvBC,QAAS,gCACTC,WAAY,mCACZC,UAAW,kCACXC,aAAc,qCACdC,mBAAoB,8BACpBC,yBAA0B,oCAC1BC,6BAA8B,yCApBnBnB,EAsBF,CACTC,OAAQ,4BACRI,KAAM,qBACNC,OAAQ,4BACRJ,OAAQ,4BACRkB,WAAY,gCACZC,SAAU,8BACVlB,OAAQ,6BA7BGH,EA+BL,CACNC,OAAQ,yBACRC,OAAQ,yBACRC,OAAQ,yBACRmB,QAAS,uBAnCEtB,EAqCR,CACHuB,SAAU,wBACVC,SAAU,wBACVC,QAAS,wBAxCEzB,EA0CR,CACHE,OAAQ,uBA3CGF,EA6CD,CACVC,OAAQ,6BACRC,OAAQ,6BACRC,OAAQ,6BACRmB,QAAS,2BAjDEtB,EAmDP,CACJC,OAAQ,uBACRC,OAAQ,uBACRC,OAAQ,uBACRmB,QAAS,qBAvDEtB,EAyDP,CACJ0B,OAAQ,uBACRC,OAAQ,wBA3DG3B,EA6DN,CACL0B,OAAQ,wBACRC,OAAQ,yBA/DG3B,EAiEN,CACL4B,cAAe,qBACfC,uBAAwB,4BACxBC,oBAAqB,0BClDzB,MAAMC,EAAW,CAACC,EAAcC,KAA4B,CAC1DhC,OAAQ,CACNiC,EACAC,EACAC,EACAC,EACAC,EACAC,EACAC,EACAC,IAEAC,EACEV,EAAIW,WAAWC,KACb5C,EAAcC,OACd,CACEiC,UACAC,QACAC,QACAC,cACAQ,UAAWP,EACXC,cACAC,mBACAC,WAEF,CAAE5C,MAAOoC,KAEVjE,GAASA,EAAK8E,OAYnBC,eAAgB,CACdb,EACAC,EACAC,EACAC,EACAC,EACAC,EACAC,EACAC,IAEAC,EACEV,EAAIW,WAAWC,KACb5C,EAAcC,OACd,CACEiC,UACAC,QACAC,QACAC,cACAQ,UAAWP,EACXC,cACAS,MAAM,EACNR,mBACAC,WAEF,CAAE5C,MAAOoC,KAEVjE,GAASA,EAAK8E,OAEnBG,OAAQ,CACNf,EACAC,EACAC,EACAC,EACAC,EACAC,EACAC,EACAC,IAEAC,EACEV,EAAIW,WAAWC,KACb5C,EAAcC,OACd,CACEiC,UACAC,QACAC,QACAC,cACAQ,UAAWP,EACXC,cACAU,QAAQ,EACRT,mBACAC,WAEF,CAAE5C,MAAOoC,KAEVjE,GAASA,EAAK8E,OAEnB5C,OAAQ,CACNgC,EACAC,EACAC,EACAC,EACAC,EACAC,EACAC,EACAC,IAEAC,EACEV,EAAIW,WAAWC,KACb5C,EAAcE,OACd,CACEgC,UACAC,QACAC,QACAC,cACAQ,UAAWP,EACXC,cACAC,mBACAC,WAEF,CAAE5C,MAAOoC,KAEVjE,GAASA,EAAK8E,OAEnB3C,OAAS+B,GACPQ,EACEV,EAAIW,WAAWC,KAAK5C,EAAcG,OAAQ,CAAE+B,WAAW,CAAErC,MAAOoC,KAKpE7B,mBAAoB,IAClBsC,EACEV,EAAIW,WAAWxC,OAAOH,EAAcI,mBAAoB,CAAE,EAAE,CAAEP,MAAOoC,KAEzE5B,KAAO6B,GACLQ,EACEV,EAAIW,WAAW7D,IAAIkB,EAAcK,KAAM,CACrC6C,YAAa,CAAEhB,WACfrC,MAAOoC,KAERjE,GAASA,EAAK8E,OAQnBK,aAAeC,GACbV,EACEV,EAAIW,WAAW7D,IAAIkB,EAAcK,KAAM,CACrC6C,YAAa,CAAEE,UACfvD,MAAOoC,KAERjE,GAASA,EAAK8E,OAanBO,UAAW,CACTC,EACAhB,EACAiB,EACAC,EACAC,EACAC,EACAlB,IAEAE,EACEV,EAAIW,WAAWC,KACb5C,EAAcM,OACd,CAAEgD,YAAWT,UAAWP,EAAOiB,QAAOC,OAAMC,gBAAeC,eAAclB,oBACzE,CAAE3C,MAAOoC,KAEVjE,GAASA,EAAK2F,QAEnBtC,SAAWa,GACTQ,EACEV,EAAIW,WAAWC,KACb5C,EAAcO,aACd,CAAE2B,UAAS0B,OAAQ,WACnB,CAAE/D,MAAOoC,KAEVjE,GAASA,EAAK8E,OAEnB1B,WAAac,GACXQ,EACEV,EAAIW,WAAWC,KACb5C,EAAcO,aACd,CAAE2B,UAAS0B,OAAQ,YACnB,CAAE/D,MAAOoC,KAEVjE,GAASA,EAAK8E,OAEnBtC,YAAa,CACX0B,EACAC,EACA0B,IAEAnB,EACEV,EAAIW,WAAWC,KACb5C,EAAcQ,YACd,CAAE0B,UAASC,QAAO2B,SAAUD,GAC5B,CAAEhE,MAAOoC,KAEVjE,GAASA,EAAK8E,OAEnBrC,YAAa,CACXyB,EACAE,EACAyB,IAEAnB,EACEV,EAAIW,WAAWC,KACb5C,EAAcS,YACd,CAAEyB,UAASE,QAAO0B,SAAUD,GAC5B,CAAEhE,MAAOoC,KAEVjE,GAASA,EAAK8E,OAEnBpC,kBAAmB,CAACwB,EAAiBG,IACnCK,EACEV,EAAIW,WAAWC,KACb5C,EAAcU,kBACd,CAAEwB,UAASG,eACX,CAAExC,MAAOoC,KAEVjE,GAASA,EAAK8E,OAEnBnC,cAAe,CAACuB,EAAiBO,IAC/BC,EACEV,EAAIW,WAAWC,KACb5C,EAAcW,cACd,CAAEuB,UAASO,WACX,CAAE5C,MAAOoC,KAEVjE,GAASA,EAAK8E,OAEnBlC,sBAAuB,CACrBsB,EACA6B,EACAC,IAEAtB,EACEV,EAAIW,WAAWC,KACb5C,EAAcY,sBACd,CAAEsB,UAAS6B,eAAcC,kBACzB,CAAEnE,MAAOoC,KAEVjE,GAASA,EAAK8E,OAEnBmB,SAAU,CAAC/B,EAAiBI,IAC1BI,EACEV,EAAIW,WAAWC,KACb5C,EAAca,QACd,CAAEqB,UAASW,UAAWP,GACtB,CAAEzC,MAAOoC,KAEVjE,GAASA,EAAK8E,OAEnBoB,YAAa,CAAChC,EAAiBI,IAC7BI,EACEV,EAAIW,WAAWC,KACb5C,EAAcc,WACd,CAAEoB,UAASW,UAAWP,GACtB,CAAEzC,MAAOoC,KAEVjE,GAASA,EAAK8E,OAEnB/B,UAAW,CAACmB,EAAiBiC,IAC3BzB,EACEV,EAAIW,WAAWC,KAAK5C,EAAce,UAAW,CAAEmB,UAASiC,YAAY,CAAEtE,MAAOoC,KAC5EjE,GAASA,EAAK8E,OAEnB9B,aAAc,CAACkB,EAAiBiC,IAC9BzB,EACEV,EAAIW,WAAWC,KACb5C,EAAcgB,aACd,CAAEkB,UAASiC,YACX,CAAEtE,MAAOoC,KAEVjE,GAASA,EAAK8E,OAEnBsB,eAAgB,CACdlC,EACAiC,EACA7B,IAEAI,EACEV,EAAIW,WAAWC,KACb5C,EAAca,QACd,CAAEqB,UAASiC,WAAUtB,UAAWP,GAChC,CAAEzC,MAAOoC,KAEVjE,GAASA,EAAK8E,OAEnBuB,kBAAmB,CACjBnC,EACAiC,EACA7B,IAEAI,EACEV,EAAIW,WAAWC,KACb5C,EAAcc,WACd,CAAEoB,UAASiC,WAAUtB,UAAWP,GAChC,CAAEzC,MAAOoC,KAEVjE,GAASA,EAAK8E,OAanBwB,uBAAwB,CACtBC,EACArC,IAEAQ,EACEV,EAAIW,WAAWC,KACb5C,EAAciB,mBACd,CAAEsD,iBAAgBrC,WAClB,CAAErC,MAAOoC,KAEVjE,GAASA,IAcdwG,6BAA8B,CAC5BD,EACArC,EACAuC,IAEA/B,EACEV,EAAIW,WAAWC,KACb5C,EAAckB,yBACd,CAAEqD,iBAAgBrC,UAASwC,IAAKD,GAChC,CAAE5E,MAAOoC,KAEVjE,GAASA,IAad2G,iCAAkC,CAChCzC,EACAuC,IAEA/B,EACEV,EAAIW,WAAWC,KACb5C,EAAcmB,6BACd,CAAEe,UAASwC,IAAKD,GAChB,CAAE5E,MAAOoC,KAEVjE,GAASA,MC1YV4G,EAAa,CAAC5C,EAAcC,KAA4B,CAC5DhC,OAAQ,CACNjB,EACA6F,IAEAnC,EACEV,EAAIW,WAAWC,KACb5C,EAAgBC,OAChB,CAAEjB,OAAM6F,2BACR,CAAEhF,MAAOoC,KAGf6C,aAAc,CACZC,EACA/F,EACA6F,IAEAnC,EACEV,EAAIW,WAAWC,KACb5C,EAAgBC,OAChB,CAAE8E,KAAI/F,OAAM6F,2BACZ,CAAEhF,MAAOoC,KAGf/B,OAAQ,CACN6E,EACA/F,EACA6F,IAEAnC,EACEV,EAAIW,WAAWC,KACb5C,EAAgBE,OAChB,CAAE6E,KAAI/F,OAAM6F,2BACZ,CAAEhF,MAAOoC,KAGf9B,OAAS4E,GACPrC,EACEV,EAAIW,WAAWC,KAAK5C,EAAgBG,OAAQ,CAAE4E,MAAM,CAAElF,MAAOoC,KAEjEX,QAAS,IACPoB,EACEV,EAAIW,WAAW7D,IAAIkB,EAAgBsB,QAAS,CAC1CzB,MAAOoC,KAERjE,GAASA,EAAKgH,YCjDfC,EAAU,CAACjD,EAAcC,KAA4B,CACzD/B,OAAQ,CACNgF,EACAC,IAEAzC,EACEV,EAAIW,WAAWC,KAAK5C,EAAaE,OAAQ,CAAEgF,MAAKC,gBAAgB,CAAEtF,MAAOoC,OCFzEmD,EAAiB,CAACpD,EAAcC,KAA4B,CAChEhC,OAAQ,CAACjB,EAAcqG,IACrB3C,EACEV,EAAIW,WAAWC,KACb5C,EAAoBC,OACpB,CAAEjB,OAAMqG,eACR,CAAExF,MAAOoC,KAGf/B,OAAQ,CAAClB,EAAcsG,EAAiBD,IACtC3C,EACEV,EAAIW,WAAWC,KACb5C,EAAoBE,OACpB,CAAElB,OAAMsG,UAASD,eACjB,CAAExF,MAAOoC,KAGf9B,OAASnB,GACP0D,EACEV,EAAIW,WAAWC,KAAK5C,EAAoBG,OAAQ,CAAEnB,QAAQ,CAAEa,MAAOoC,KAEvEX,QAAS,IACPoB,EACEV,EAAIW,WAAW7D,IAAIkB,EAAoBsB,QAAS,CAC9CzB,MAAOoC,KAERjE,GAASA,EAAKuH,gBC1BfC,EAAW,CAACxD,EAAcC,KAA4B,CAC1DhC,OAAQ,CACNjB,EACAqG,EACAI,IAEA/C,EACEV,EAAIW,WAAWC,KACb5C,EAAcC,OACd,CAAEjB,OAAMqG,cAAaI,mBACrB,CAAE5F,MAAOoC,KAGf/B,OAAQ,CACNlB,EACAsG,EACAD,EACAI,IAEA/C,EACEV,EAAIW,WAAWC,KACb5C,EAAcE,OACd,CAAElB,OAAMsG,UAASD,cAAaI,mBAC9B,CAAE5F,MAAOoC,KAGf9B,OAASnB,GACP0D,EACEV,EAAIW,WAAWC,KAAK5C,EAAcG,OAAQ,CAAEnB,QAAQ,CAAEa,MAAOoC,KAEjEX,QAAS,IACPoB,EACEV,EAAIW,WAAW7D,IAAIkB,EAAcsB,QAAS,CACxCzB,MAAOoC,KAERjE,GAASA,EAAKsE,UCvCfoD,EAAY,CAAC1D,EAAcC,KAA4B,CAM3DL,cAAgBuC,GACdzB,EACEV,EAAIW,WAAWC,KAAK5C,EAAe4B,cAAe,CAAEuC,YAAY,CAAEtE,MAAOoC,KAU7EJ,uBAAwB,CACtBsC,EACAwB,EACAC,IAEAlD,EACEV,EAAIW,WAAWC,KACb5C,EAAe6B,uBACf,CAAEsC,WAAUyB,WAAUD,WACtB,CAAE9F,MAAOoC,KAUfH,oBAAqB,CAACqC,EAAkB0B,IACtCnD,EACEV,EAAIW,WAAWC,KACb5C,EAAe8B,oBACf,CAAEqC,WAAU0B,WACZ,CAAEhG,MAAOoC,OC1CX6D,EAAkB,CAAC9D,EAAcC,KAA4B,CACjE8D,YAAc5B,GACZzB,EACEV,EAAIW,WAAW7D,IAAIkB,EAAauB,SAAU,CACxC2B,YAAa,CAAEiB,YACftE,MAAOoC,KAERjE,GAASA,IAEdgI,kBAAmB,CACjB7B,EACA8B,EACAC,EACAC,EACAC,EACAC,IAEA3D,EACEV,EAAIW,WAAWC,KACb5C,EAAauB,SACb,CAAE4C,WAAU8B,SAAQE,WAAUD,UAASE,cAAaC,UACpD,CAAExG,MAAOoC,KAGfqE,kBAAmB,CAACnC,EAAkBoC,IACpC7D,EACEV,EAAIW,WAAWC,KACb5C,EAAawB,SACb,CAAE2C,WAAUoC,kBACZ,CAAE1G,MAAOoC,KAGfuE,iBAAkB,CAChBrC,EACAsC,EACAC,IAEAhE,EACEV,EAAIW,WAAWC,KACb5C,EAAayB,QACb,CAAE0C,WAAUsC,cAAaC,oBACzB,CAAE7G,MAAOoC,OCjCX0E,EAAgB,CAAC3E,EAAcC,KAA4B,CAS/DhC,OAAQ,CACNjB,EACA4H,EACAtE,EACAuE,IAEAnE,EACEV,EAAIW,WAAWC,KACb5C,EAAmBC,OACnB,CAAEjB,OAAM4H,aAAY/D,UAAWP,EAAOuE,cACtC,CAAEhH,MAAOoC,KAQf5B,KAAO0E,GACLrC,EACEV,EAAIW,WAAW7D,IAAIkB,EAAmBK,KAAM,CAC1C6C,YAAa,CAAE6B,MACflF,MAAOoC,KAERjE,GAASA,EAAK8I,MAOnBzD,UAAYC,GACVZ,EACEV,EAAIW,WAAWC,KAAK5C,EAAmBM,OAAQ,CAAEgD,aAAa,CAAEzD,MAAOoC,KACtEjE,GAASA,EAAK+I,OAQnB7G,OAAQ,CAAC6E,EAAY/F,IACnB0D,EACEV,EAAIW,WAAWC,KAAK5C,EAAmBE,OAAQ,CAAE6E,KAAI/F,QAAQ,CAAEa,MAAOoC,KACrEjE,GAASA,EAAK8I,MAOnB1F,WAAa2D,GACXrC,EACEV,EAAIW,WAAWC,KAAK5C,EAAmBoB,WAAY,CAAE2D,MAAM,CAAElF,MAAOoC,KAMxEZ,SAAW0D,GACTrC,EACEV,EAAIW,WAAWC,KAAK5C,EAAmBqB,SAAU,CAAE0D,MAAM,CAAElF,MAAOoC,KAMtE9B,OAAS4E,GACPrC,EACEV,EAAIW,WAAWC,KAAK5C,EAAmBG,OAAQ,CAAE4E,MAAM,CAAElF,MAAOoC,OCvFhE+E,EAAW,CAAChF,EAAcC,KAA4B,CAC1DP,OAASuF,GACPvE,EACEV,EAAIW,WAAWC,KAAK5C,EAAc0B,OAAQ,CAAEuF,UAAU,CAAEpH,MAAOoC,KAEnEN,OAAQ,CAACsF,EAAgBC,EAAYC,IACnCzE,EACEV,EAAIW,WAAWC,KACb5C,EAAc2B,OACd,CAAEsF,SAAQC,OAAMC,WAChB,CAAEtH,MAAOoC,OCVXmF,EAAY,CAACpF,EAAcC,KAA4B,CAC3DP,OAAQ,IACNgB,EAAkBV,EAAIW,WAAWC,KAAK5C,EAAe0B,OAAQ,CAAE,EAAE,CAAE7B,MAAOoC,KAC5EN,OAAS0F,GACP3E,EACEV,EAAIW,WAAWC,KAAK5C,EAAe2B,OAAQ,CAAE0F,SAAS,CAAExH,MAAOoC,aCRnD,QAAlBtD,EAAA2I,WAAWC,eAAO,IAAA5I,IAAlB2I,WAAWC,QAAYA,GAEvB,MAGMC,EAAe,IAAI1J,KAGvBA,EAAK2J,SAASC,YAEZA,YAAS/I,GAAAS,EAAAsI,GAAYC,+BAAAA,cARD,UAQmC,IAGlDC,KAAa9J,ICKhB+J,EAAWlJ,WAAAsD,cAAEA,GAAuCtD,EAArBmJ,EAAM1J,EAAAO,EAA1B,mBACf,MAAMoJ,EAAUC,EACX1I,OAAAC,OAAAD,OAAAC,OAAA,CAAA,EAAAuI,UACHG,EACAC,YAAW5I,OAAAC,OAAAD,OAAAC,OAAA,CAAA,EACNuI,EAAOI,cACV,qBAAsB,SACtB,8BAAiD,UAAZ,OAAPC,cAAO,IAAPA,aAAO,EAAPA,QAASC,gBAAU,IAAAhJ,OAAA,EAAAA,EAAAiJ,OAAQ,GACzD,wBAAyB,cAIvBC,UAAEA,EAASC,OAAEA,GAAWT,EAExBf,EAA6C,CAAA,EAmB7CyB,ECxCe,EAACxG,EAAcC,KAA4B,CAChEa,KAAMf,EAASC,EAAKC,GACpBwG,UAAW9B,EAAc3E,EAAKC,GAC9BtC,OAAQiF,EAAW5C,EAAKC,GACxByG,IAAK5C,EAAgB9D,EAAKC,GAC1BiD,IAAKD,EAAQjD,EAAKC,GAClB0G,WAAYvD,EAAepD,EAAKC,GAChC2G,KAAMpD,EAASxD,EAAKC,GACpB4G,MAAOnD,EAAU1D,EAAKC,GACtBiF,KAAMF,EAAShF,EAAKC,GACpBoF,MAAOD,EAAUpF,EAAKC,KD8BH6G,CAAef,EAAS9F,GAErCD,iCACD+F,GAAO,CAOVS,aAGA3K,aAAakL,GACX,KAAKA,aAAA,EAAAA,EAAQC,KAAK,MAAMC,MAAM,gCAE9B,GAAIlC,EAAKgC,EAAOC,KAAM,OAAOjC,EAAKgC,EAAOC,KAKzC,GAFA1J,OAAOC,OAAOwH,OAnCAlJ,WAChB,MAGMqL,SAHoBnB,EAAQpF,WAC/B7D,IAAI,WAAWwJ,KACfa,MAAMpL,GAASA,EAAKqL,UACerC,KACtC,OAAKjH,MAAMC,QAAQmJ,UACQG,QAAQC,IACjCJ,EAAWK,KAAI1L,MAAOiJ,GAAQ,CAACA,EAAIkC,UAAWQ,EAAU1C,QAGtC2C,QAClB,CAACC,GAAMV,EAAKW,KAAUX,EAAW1J,OAAAC,OAAAD,OAAAC,OAAA,CAAA,EAAAmK,IAAK,CAACV,EAAIY,YAAaD,IAAQD,GAChE,CAAE,GAPmC,EAQtC,EAsB2BG,KAErB9C,EAAKgC,EAAOC,KAAM,MAAMC,MAAM,gCAEnC,OAAOlC,EAAKgC,EAAOC,IACpB,EAODnL,kBAAkBqH,SAEhB,MACMrF,SADYiK,EAAU5E,EAAKlD,EAAI+H,OAAQ,CAAEC,eAAgB,KAC7CC,QAElB,GAAIpK,IACFA,EAAMqK,IAAe,QAATvL,EAAAkB,EAAMqK,WAAG,IAAAvL,OAAA,EAAAA,EAAEwL,MAAM,KAAKC,MAC9BvK,EAAMqK,MAAQ5B,GAEhB,MAAM,IAAI+B,EAAOC,yBACf,+BACA,MACA,gBAKN,MAAO,CAAEpF,MAAKrF,QACf,EAODhC,sBAAsB0M,GACpB,IAAKA,EAAc,MAAMtB,MAAM,4CAE/B,IAEE,aADoBjH,EAAIwI,YAAYD,EAMrC,CAJC,MAAOE,GAGP,MADAlC,SAAAA,EAAQkC,MAAM,4BAA6BA,GACrCxB,MAAM,4BACb,CACF,EAODpL,qBAAqB6M,WACnB,IAAKA,EAAc,MAAMzB,MAAM,kDAE/B,UACQjH,EAAIwI,YAAYE,GACtB,MAAMC,QAAgB3I,EAAI4I,QAAQF,GAClC,GAAIC,EAAQE,GAAI,CAEd,aADoB7I,EAAIwI,YAA0B,QAAd7L,EAAAgM,EAAQ3M,YAAM,IAAAW,OAAA,EAAAA,EAAAmM,WAEnD,CAED,MAAM7B,MAAmB,QAAb7J,EAAAuL,EAAQF,aAAK,IAAArL,OAAA,EAAAA,EAAE2L,aAK5B,CAJC,MAAOC,GAGP,MADAzC,SAAAA,EAAQkC,MAAM,kCAAmCO,GAC3C/B,MAAM,kCACb,CACF,EAQDpL,gCACE0M,EACAG,GAEA,IAAKH,IAAiBG,EAAc,MAAMzB,MAAM,6CAEhD,IAEE,aADoBjH,EAAIiJ,gBAAgBV,EAKzC,CAHC,MAAOE,GAEPlC,SAAAA,EAAQ2C,IAAI,mDACb,CAED,OAAOlJ,EAAImJ,eAAeT,EAC3B,EAOD7M,wBAAwB4K,GACtB,IAAKA,EAAW,MAAMQ,MAAM,gCAE5B,IAAIlL,EACJ,IACEA,QAAaiE,EAAIyG,UAAU2C,SAAS3C,EAIrC,CAHC,MAAOgC,GAEP,MADAlC,SAAAA,EAAQkC,MAAM,gCAAiCA,GACzCxB,MAAM,gCACb,CAED,MAAM6B,WAAEA,GAAe/M,EAAKC,KAC5B,IAAK8M,EAEH,MADAvC,SAAAA,EAAQkC,MAAM,gDACRxB,MAAM,iCAGd,IAEE,aADoBjH,EAAIwI,YAAYM,EAKrC,CAHC,MAAOL,GAEP,MADAlC,SAAAA,EAAQkC,MAAM,sCAAuCA,GAC/CxB,MAAM,gCACb,CACF,EAQDoC,oBAAmB,CAAC5L,EAA8B8F,IACzCvD,EAAIsJ,0BAA0B7L,EAAU,KAAM8F,GASvD+F,0BACE7L,EACAE,EACA4F,GAEA,MAAMgG,EAAU/L,EAA2BC,EdrNb,ccqN6CE,GAC3E,OAAO4F,EAAYiG,OAAOC,GAASF,EAAQG,SAASD,IACrD,EAQDE,cAAa,CAAClM,EAA8B6C,IACnCN,EAAI4J,oBAAoBnM,EAAU,KAAM6C,GASjDsJ,oBAAoBnM,EAA8BE,EAAgB2C,GAChE,MAAMuJ,EAAarM,EAA2BC,EdxOtB,QcwOgDE,GACxE,OAAO2C,EAAMkJ,OAAO5C,GAASiD,EAAWH,SAAS9C,IAClD,IAGH,OAAOkD,EACL9J,EACA,CACE,mBACA,iBACA,sBACA,mBACA,uBACA,uBACA,iBACA,gBACA,cACA,yBACA,yBACA,WAEFrE,EACD,EAoBHkK,EAAQkE,uBd1R8B,Mc2RtClE,EAAQmE,uBdzR8B"}
+{"version":3,"file":"index.esm.js","sources":["../lib/constants.ts","../lib/helpers.ts","../lib/management/paths.ts","../lib/management/user.ts","../lib/management/tenant.ts","../lib/management/jwt.ts","../lib/management/permission.ts","../lib/management/role.ts","../lib/management/group.ts","../lib/management/sso.ts","../lib/management/accesskey.ts","../lib/management/flow.ts","../lib/management/theme.ts","../lib/fetch-polyfill.ts","../lib/index.ts","../lib/management/index.ts"],"sourcesContent":["// eslint-disable-next-line import/prefer-default-export\n/** Refresh JWT cookie name */\nexport const refreshTokenCookieName = 'DSR';\n/** Session JWT cookie name */\nexport const sessionTokenCookieName = 'DS';\n/** The key of the tenants claims in the claims map */\nexport const authorizedTenantsClaimName = 'tenants';\n/** The key of the permissions claims in the claims map either under tenant or top level */\nexport const permissionsClaimName = 'permissions';\n/** The key of the roles claims in the claims map either under tenant or top level */\nexport const rolesClaimName = 'roles';\n","import type { SdkFnWrapper } from '@descope/core-js-sdk';\nimport { authorizedTenantsClaimName, refreshTokenCookieName } from './constants';\nimport { AuthenticationInfo } from './types';\n\n/**\n * Generate a cookie string from given parameters\n * @param name name of the cookie\n * @param value value of cookie that must be already encoded\n * @param options any options to put on the cookie like cookieDomain, cookieMaxAge, cookiePath\n * @returns Cookie string with all options on the string\n */\nconst generateCookie = (name: string, value: string, options?: Record<string, string | number>) =>\n  `${name}=${value}; Domain=${options?.cookieDomain || ''}; Max-Age=${\n    options?.cookieMaxAge || ''\n  }; Path=${options?.cookiePath || '/'}; HttpOnly; SameSite=Strict`;\n\n/**\n * Parse the cookie string and return the value of the cookie\n * @param cookie the raw cookie string\n * @param name the name of the cookie to get value for\n * @returns the value of the given cookie\n */\nconst getCookieValue = (cookie: string | null | undefined, name: string) => {\n  const match = cookie?.match(RegExp(`(?:^|;\\\\s*)${name}=([^;]*)`));\n  return match ? match[1] : null;\n};\n\n// eslint-disable-next-line import/prefer-default-export\n/**\n * Add cookie generation to core-js functions.\n * @param fn the function we are wrapping\n * @returns Wrapped function with cookie generation\n */\nexport const withCookie: SdkFnWrapper<{ refreshJwt?: string; cookies?: string[] }> =\n  (fn) =>\n  async (...args) => {\n    const resp = await fn(...args);\n\n    // istanbul ignore next\n    if (!resp.data) {\n      return resp;\n    }\n\n    // eslint-disable-next-line prefer-const\n    let { refreshJwt, ...rest } = resp.data;\n    const cookies: string[] = [];\n\n    if (!refreshJwt) {\n      if (resp.response?.headers.get('set-cookie')) {\n        refreshJwt = getCookieValue(\n          resp.response?.headers.get('set-cookie'),\n          refreshTokenCookieName,\n        );\n        cookies.push(resp.response?.headers.get('set-cookie')!);\n      }\n    } else {\n      cookies.push(generateCookie(refreshTokenCookieName, refreshJwt, rest));\n    }\n\n    return { ...resp, data: { ...resp.data, refreshJwt, cookies } };\n  };\n\n/**\n * Get the claim (used for permissions or roles) for a given tenant or top level if tenant is empty\n * @param authInfo The parsed authentication info from the JWT\n * @param claim name of the claim\n * @param tenant tenant to retrieve the claim for\n * @returns\n */\nexport function getAuthorizationClaimItems(\n  authInfo: AuthenticationInfo,\n  claim: string,\n  tenant?: string,\n): string[] {\n  const value = tenant\n    ? authInfo.token[authorizedTenantsClaimName]?.[tenant]?.[claim]\n    : authInfo.token[claim];\n  return Array.isArray(value) ? value : [];\n}\n","/** API paths for the Descope service Management APIs */\nexport default {\n  user: {\n    create: '/v1/mgmt/user/create',\n    update: '/v1/mgmt/user/update',\n    delete: '/v1/mgmt/user/delete',\n    deleteAllTestUsers: '/v1/mgmt/user/test/delete/all',\n    load: '/v1/mgmt/user',\n    search: '/v1/mgmt/user/search',\n    updateStatus: '/v1/mgmt/user/update/status',\n    updateEmail: '/v1/mgmt/user/update/email',\n    updatePhone: '/v1/mgmt/user/update/phone',\n    updateDisplayName: '/v1/mgmt/user/update/name',\n    updatePicture: '/v1/mgmt/user/update/picture',\n    updateCustomAttribute: '/v1/mgmt/user/update/customAttribute',\n    addRole: '/v1/mgmt/user/update/role/add',\n    removeRole: '/v1/mgmt/user/update/role/remove',\n    addTenant: '/v1/mgmt/user/update/tenant/add',\n    removeTenant: '/v1/mgmt/user/update/tenant/remove',\n    setPassword: '/v1/mgmt/user/password/set',\n    expirePassword: '/v1/mgmt/user/password/expire',\n    generateOTPForTest: '/v1/mgmt/tests/generate/otp',\n    generateMagicLinkForTest: '/v1/mgmt/tests/generate/magiclink',\n    generateEnchantedLinkForTest: '/v1/mgmt/tests/generate/enchantedlink',\n  },\n  accessKey: {\n    create: '/v1/mgmt/accesskey/create',\n    load: '/v1/mgmt/accesskey',\n    search: '/v1/mgmt/accesskey/search',\n    update: '/v1/mgmt/accesskey/update',\n    deactivate: '/v1/mgmt/accesskey/deactivate',\n    activate: '/v1/mgmt/accesskey/activate',\n    delete: '/v1/mgmt/accesskey/delete',\n  },\n  tenant: {\n    create: '/v1/mgmt/tenant/create',\n    update: '/v1/mgmt/tenant/update',\n    delete: '/v1/mgmt/tenant/delete',\n    loadAll: '/v1/mgmt/tenant/all',\n  },\n  sso: {\n    settings: '/v1/mgmt/sso/settings',\n    metadata: '/v1/mgmt/sso/metadata',\n    mapping: '/v1/mgmt/sso/mapping',\n  },\n  jwt: {\n    update: '/v1/mgmt/jwt/update',\n  },\n  permission: {\n    create: '/v1/mgmt/permission/create',\n    update: '/v1/mgmt/permission/update',\n    delete: '/v1/mgmt/permission/delete',\n    loadAll: '/v1/mgmt/permission/all',\n  },\n  role: {\n    create: '/v1/mgmt/role/create',\n    update: '/v1/mgmt/role/update',\n    delete: '/v1/mgmt/role/delete',\n    loadAll: '/v1/mgmt/role/all',\n  },\n  flow: {\n    export: '/v1/mgmt/flow/export',\n    import: '/v1/mgmt/flow/import',\n  },\n  theme: {\n    export: '/v1/mgmt/theme/export',\n    import: '/v1/mgmt/theme/import',\n  },\n  group: {\n    loadAllGroups: '/v1/mgmt/group/all',\n    loadAllGroupsForMember: '/v1/mgmt/group/member/all',\n    loadAllGroupMembers: '/v1/mgmt/group/members',\n  },\n};\n","import { DeliveryMethod, SdkResponse, transformResponse, UserResponse } from '@descope/core-js-sdk';\nimport { CoreSdk } from '../types';\nimport apiPaths from './paths';\nimport {\n  AssociatedTenant,\n  GenerateEnchantedLinkForTestResponse,\n  GenerateMagicLinkForTestResponse,\n  GenerateOTPForTestResponse,\n  AttributesTypes,\n} from './types';\n\ntype SingleUserResponse = {\n  user: UserResponse;\n};\n\ntype MultipleUsersResponse = {\n  users: UserResponse[];\n};\n\nconst withUser = (sdk: CoreSdk, managementKey?: string) => ({\n  create: (\n    loginId: string,\n    email?: string,\n    phone?: string,\n    displayName?: string,\n    roles?: string[],\n    userTenants?: AssociatedTenant[],\n    customAttributes?: Record<string, AttributesTypes>,\n    picture?: string,\n  ): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.create,\n        {\n          loginId,\n          email,\n          phone,\n          displayName,\n          roleNames: roles,\n          userTenants,\n          customAttributes,\n          picture,\n        },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  /**\n   * Create a new test user.\n   * The loginID is required and will determine what the user will use to sign in.\n   * Make sure the login id is unique for test. All other fields are optional.\n   *\n   * You can later generate OTP, Magic link and enchanted link to use in the test without the need\n   * of 3rd party messaging services.\n   * Those users are not counted as part of the monthly active users\n   * @returns The UserResponse if found, throws otherwise.\n   */\n  createTestUser: (\n    loginId: string,\n    email?: string,\n    phone?: string,\n    displayName?: string,\n    roles?: string[],\n    userTenants?: AssociatedTenant[],\n    customAttributes?: Record<string, AttributesTypes>,\n    picture?: string,\n  ): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.create,\n        {\n          loginId,\n          email,\n          phone,\n          displayName,\n          roleNames: roles,\n          userTenants,\n          test: true,\n          customAttributes,\n          picture,\n        },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  invite: (\n    loginId: string,\n    email?: string,\n    phone?: string,\n    displayName?: string,\n    roles?: string[],\n    userTenants?: AssociatedTenant[],\n    customAttributes?: Record<string, AttributesTypes>,\n    picture?: string,\n  ): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.create,\n        {\n          loginId,\n          email,\n          phone,\n          displayName,\n          roleNames: roles,\n          userTenants,\n          invite: true,\n          customAttributes,\n          picture,\n        },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  update: (\n    loginId: string,\n    email?: string,\n    phone?: string,\n    displayName?: string,\n    roles?: string[],\n    userTenants?: AssociatedTenant[],\n    customAttributes?: Record<string, AttributesTypes>,\n    picture?: string,\n  ): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.update,\n        {\n          loginId,\n          email,\n          phone,\n          displayName,\n          roleNames: roles,\n          userTenants,\n          customAttributes,\n          picture,\n        },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  delete: (loginId: string): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(apiPaths.user.delete, { loginId }, { token: managementKey }),\n    ),\n  /**\n   * Delete all test users in the project.\n   */\n  deleteAllTestUsers: (): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.delete(apiPaths.user.deleteAllTestUsers, { token: managementKey }),\n    ),\n  load: (loginId: string): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.get(apiPaths.user.load, {\n        queryParams: { loginId },\n        token: managementKey,\n      }),\n      (data) => data.user,\n    ),\n  /**\n   * Load an existing user by user ID. The ID can be found\n   * on the user's JWT.\n   * @param userId load a user by this user ID field\n   * @returns The UserResponse if found, throws otherwise.\n   */\n  loadByUserId: (userId: string): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.get(apiPaths.user.load, {\n        queryParams: { userId },\n        token: managementKey,\n      }),\n      (data) => data.user,\n    ),\n  /**\n   * Search all users. Results can be filtered according to tenants and/or\n   * roles, and also paginated used the limit and page parameters.\n   * @param tenantIds optional list of tenant IDs to filter by\n   * @param roles optional list of roles to filter by\n   * @param limit optionally limit the response, leave out for default limit\n   * @param page optionally paginate over the response\n   * @param testUsersOnly optionally filter only test users\n   * @param withTestUser optionally include test users in search\n   * @returns An array of UserResponse found by the query\n   */\n  searchAll: (\n    tenantIds?: string[],\n    roles?: string[],\n    limit?: number,\n    page?: number,\n    testUsersOnly?: boolean,\n    withTestUser?: boolean,\n    customAttributes?: Record<string, AttributesTypes>,\n  ): Promise<SdkResponse<UserResponse[]>> =>\n    transformResponse<MultipleUsersResponse, UserResponse[]>(\n      sdk.httpClient.post(\n        apiPaths.user.search,\n        { tenantIds, roleNames: roles, limit, page, testUsersOnly, withTestUser, customAttributes },\n        { token: managementKey },\n      ),\n      (data) => data.users,\n    ),\n  activate: (loginId: string): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.updateStatus,\n        { loginId, status: 'enabled' },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  deactivate: (loginId: string): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.updateStatus,\n        { loginId, status: 'disabled' },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  updateEmail: (\n    loginId: string,\n    email: string,\n    isVerified: boolean,\n  ): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.updateEmail,\n        { loginId, email, verified: isVerified },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  updatePhone: (\n    loginId: string,\n    phone: string,\n    isVerified: boolean,\n  ): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.updatePhone,\n        { loginId, phone, verified: isVerified },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  updateDisplayName: (loginId: string, displayName: string): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.updateDisplayName,\n        { loginId, displayName },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  updatePicture: (loginId: string, picture: string): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.updatePicture,\n        { loginId, picture },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  updateCustomAttribute: (\n    loginId: string,\n    attributeKey: string,\n    attributeValue: AttributesTypes,\n  ): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.updateCustomAttribute,\n        { loginId, attributeKey, attributeValue },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  addRoles: (loginId: string, roles: string[]): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.addRole,\n        { loginId, roleNames: roles },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  removeRoles: (loginId: string, roles: string[]): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.removeRole,\n        { loginId, roleNames: roles },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  addTenant: (loginId: string, tenantId: string): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(apiPaths.user.addTenant, { loginId, tenantId }, { token: managementKey }),\n      (data) => data.user,\n    ),\n  removeTenant: (loginId: string, tenantId: string): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.removeTenant,\n        { loginId, tenantId },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  addTenantRoles: (\n    loginId: string,\n    tenantId: string,\n    roles: string[],\n  ): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.addRole,\n        { loginId, tenantId, roleNames: roles },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  removeTenantRoles: (\n    loginId: string,\n    tenantId: string,\n    roles: string[],\n  ): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.removeRole,\n        { loginId, tenantId, roleNames: roles },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n\n  /**\n   * Generate OTP for the given login ID of a test user.\n   * Choose the selected delivery method for verification.\n   * Returns the code for the login (exactly as it sent via Email or SMS)\n   * This is useful when running tests and don't want to use 3rd party messaging services\n   *\n   * @param deliveryMethod optional DeliveryMethod\n   * @param loginId login ID of a test user\n   * @returns GenerateOTPForTestResponse which includes the loginId and the OTP code\n   */\n  generateOTPForTestUser: (\n    deliveryMethod: DeliveryMethod,\n    loginId: string,\n  ): Promise<SdkResponse<GenerateOTPForTestResponse>> =>\n    transformResponse<GenerateOTPForTestResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.generateOTPForTest,\n        { deliveryMethod, loginId },\n        { token: managementKey },\n      ),\n      (data) => data,\n    ),\n\n  /**\n   * Generate Magic Link for the given login ID of a test user.\n   * Choose the selected delivery method for verification.\n   * It returns the link for the login (exactly as it sent via Email)\n   * This is useful when running tests and don't want to use 3rd party messaging services\n   *\n   * @param deliveryMethod optional DeliveryMethod\n   * @param loginId login ID of a test user\n   * @param uri optional redirect uri which will be used instead of any global configuration.\n   * @returns GenerateMagicLinkForTestResponse which includes the loginId and the magic link\n   */\n  generateMagicLinkForTestUser: (\n    deliveryMethod: DeliveryMethod,\n    loginId: string,\n    uri: string,\n  ): Promise<SdkResponse<GenerateMagicLinkForTestResponse>> =>\n    transformResponse<GenerateMagicLinkForTestResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.generateMagicLinkForTest,\n        { deliveryMethod, loginId, URI: uri },\n        { token: managementKey },\n      ),\n      (data) => data,\n    ),\n\n  /**\n   * Generate Enchanted Link for the given login ID of a test user.\n   * It returns the link for the login (exactly as it sent via Email)\n   * and pendingRef which is used to poll for a valid session\n   * This is useful when running tests and don't want to use 3rd party messaging services\n   *\n   * @param loginId login ID of a test user\n   * @param uri optional redirect uri which will be used instead of any global configuration.\n   * @returns GenerateEnchantedLinkForTestResponse which includes the loginId, the enchanted link and the pendingRef\n   */\n  generateEnchantedLinkForTestUser: (\n    loginId: string,\n    uri: string,\n  ): Promise<SdkResponse<GenerateEnchantedLinkForTestResponse>> =>\n    transformResponse<GenerateEnchantedLinkForTestResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.generateEnchantedLinkForTest,\n        { loginId, URI: uri },\n        { token: managementKey },\n      ),\n      (data) => data,\n    ),\n\n  /**\n   * Set password for the given login ID of user.\n   * Note: The password will automatically be set as expired.\n   * The user will not be able to log-in with this password, and will be required to replace it on next login.\n   * See also: expirePassword\n   * @param loginId login ID of a test user\n   * @param password The password to set for the user\n   */\n  setPassword: (loginId: string, password: string): Promise<SdkResponse<never>> =>\n    transformResponse<never>(\n      sdk.httpClient.post(\n        apiPaths.user.setPassword,\n        { loginId, password },\n        { token: managementKey },\n      ),\n      (data) => data,\n    ),\n\n  /**\n   * Expire password for the given login ID.\n   * Note: user sign-in with an expired password, the user will get an error with code.\n   * Use the `ResetPassword` or `ReplacePassword` methods to reset/replace the password.\n   * @param loginId login ID of a test user\n   */\n  expirePassword: (loginId: string): Promise<SdkResponse<never>> =>\n    transformResponse<never>(\n      sdk.httpClient.post(apiPaths.user.expirePassword, { loginId }, { token: managementKey }),\n      (data) => data,\n    ),\n});\n\nexport default withUser;\n","import { SdkResponse, transformResponse } from '@descope/core-js-sdk';\nimport { CoreSdk } from '../types';\nimport apiPaths from './paths';\nimport { CreateTenantResponse, Tenant } from './types';\n\ntype MultipleTenantResponse = {\n  tenants: Tenant[];\n};\n\nconst withTenant = (sdk: CoreSdk, managementKey?: string) => ({\n  create: (\n    name: string,\n    selfProvisioningDomains?: string[],\n  ): Promise<SdkResponse<CreateTenantResponse>> =>\n    transformResponse(\n      sdk.httpClient.post(\n        apiPaths.tenant.create,\n        { name, selfProvisioningDomains },\n        { token: managementKey },\n      ),\n    ),\n  createWithId: (\n    id: string,\n    name: string,\n    selfProvisioningDomains?: string[],\n  ): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(\n        apiPaths.tenant.create,\n        { id, name, selfProvisioningDomains },\n        { token: managementKey },\n      ),\n    ),\n  update: (\n    id: string,\n    name: string,\n    selfProvisioningDomains?: string[],\n  ): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(\n        apiPaths.tenant.update,\n        { id, name, selfProvisioningDomains },\n        { token: managementKey },\n      ),\n    ),\n  delete: (id: string): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(apiPaths.tenant.delete, { id }, { token: managementKey }),\n    ),\n  loadAll: (): Promise<SdkResponse<Tenant[]>> =>\n    transformResponse<MultipleTenantResponse, Tenant[]>(\n      sdk.httpClient.get(apiPaths.tenant.loadAll, {\n        token: managementKey,\n      }),\n      (data) => data.tenants,\n    ),\n});\n\nexport default withTenant;\n","import { SdkResponse, transformResponse } from '@descope/core-js-sdk';\nimport { CoreSdk } from '../types';\nimport apiPaths from './paths';\nimport { UpdateJWTResponse } from './types';\n\nconst withJWT = (sdk: CoreSdk, managementKey?: string) => ({\n  update: (\n    jwt: string,\n    customClaims?: Record<string, any>,\n  ): Promise<SdkResponse<UpdateJWTResponse>> =>\n    transformResponse(\n      sdk.httpClient.post(apiPaths.jwt.update, { jwt, customClaims }, { token: managementKey }),\n    ),\n});\n\nexport default withJWT;\n","import { SdkResponse, transformResponse } from '@descope/core-js-sdk';\nimport { CoreSdk } from '../types';\nimport apiPaths from './paths';\nimport { Permission } from './types';\n\ntype MultiplePermissionResponse = {\n  permissions: Permission[];\n};\n\nconst withPermission = (sdk: CoreSdk, managementKey?: string) => ({\n  create: (name: string, description?: string): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(\n        apiPaths.permission.create,\n        { name, description },\n        { token: managementKey },\n      ),\n    ),\n  update: (name: string, newName: string, description?: string): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(\n        apiPaths.permission.update,\n        { name, newName, description },\n        { token: managementKey },\n      ),\n    ),\n  delete: (name: string): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(apiPaths.permission.delete, { name }, { token: managementKey }),\n    ),\n  loadAll: (): Promise<SdkResponse<Permission[]>> =>\n    transformResponse<MultiplePermissionResponse, Permission[]>(\n      sdk.httpClient.get(apiPaths.permission.loadAll, {\n        token: managementKey,\n      }),\n      (data) => data.permissions,\n    ),\n});\n\nexport default withPermission;\n","import { SdkResponse, transformResponse } from '@descope/core-js-sdk';\nimport { CoreSdk } from '../types';\nimport apiPaths from './paths';\nimport { Role } from './types';\n\ntype MultipleRoleResponse = {\n  roles: Role[];\n};\n\nconst withRole = (sdk: CoreSdk, managementKey?: string) => ({\n  create: (\n    name: string,\n    description?: string,\n    permissionNames?: string[],\n  ): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(\n        apiPaths.role.create,\n        { name, description, permissionNames },\n        { token: managementKey },\n      ),\n    ),\n  update: (\n    name: string,\n    newName: string,\n    description?: string,\n    permissionNames?: string[],\n  ): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(\n        apiPaths.role.update,\n        { name, newName, description, permissionNames },\n        { token: managementKey },\n      ),\n    ),\n  delete: (name: string): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(apiPaths.role.delete, { name }, { token: managementKey }),\n    ),\n  loadAll: (): Promise<SdkResponse<Role[]>> =>\n    transformResponse<MultipleRoleResponse, Role[]>(\n      sdk.httpClient.get(apiPaths.role.loadAll, {\n        token: managementKey,\n      }),\n      (data) => data.roles,\n    ),\n});\n\nexport default withRole;\n","import { SdkResponse, transformResponse } from '@descope/core-js-sdk';\nimport { CoreSdk } from '../types';\nimport apiPaths from './paths';\nimport { Group } from './types';\n\nconst withGroup = (sdk: CoreSdk, managementKey?: string) => ({\n  /**\n   * Load all groups for a specific tenant id.\n   * @param tenantId Tenant ID to load groups from.\n   * @returns Group[] list of groups\n   */\n  loadAllGroups: (tenantId: string): Promise<SdkResponse<Group[]>> =>\n    transformResponse<Group[]>(\n      sdk.httpClient.post(apiPaths.group.loadAllGroups, { tenantId }, { token: managementKey }),\n    ),\n\n  /**\n   * Load all groups for the provided user IDs or login IDs.\n   * @param tenantId Tenant ID to load groups from.\n   * @param userIds Optional List of user IDs, with the format of \"U2J5ES9S8TkvCgOvcrkpzUgVTEBM\" (example), which can be found on the user's JWT.\n   * @param loginIds Optional List of login IDs, how the user identifies when logging in.\n   * @returns Group[] list of groups\n   */\n  loadAllGroupsForMember: (\n    tenantId: string,\n    userIds: string[],\n    loginIds: string[],\n  ): Promise<SdkResponse<Group[]>> =>\n    transformResponse<Group[]>(\n      sdk.httpClient.post(\n        apiPaths.group.loadAllGroupsForMember,\n        { tenantId, loginIds, userIds },\n        { token: managementKey },\n      ),\n    ),\n\n  /**\n   * Load all members of the provided group id.\n   * @param tenantId Tenant ID to load groups from.\n   * @param groupId Group ID to load members for.\n   * @returns Group[] list of groups\n   */\n  loadAllGroupMembers: (tenantId: string, groupId: string): Promise<SdkResponse<Group[]>> =>\n    transformResponse<Group[]>(\n      sdk.httpClient.post(\n        apiPaths.group.loadAllGroupMembers,\n        { tenantId, groupId },\n        { token: managementKey },\n      ),\n    ),\n});\n\nexport default withGroup;\n","import { SdkResponse, transformResponse } from '@descope/core-js-sdk';\nimport { CoreSdk } from '../types';\nimport apiPaths from './paths';\nimport { RoleMapping, AttributeMapping, SSOSettingsResponse } from './types';\n\nconst withSSOSettings = (sdk: CoreSdk, managementKey?: string) => ({\n  getSettings: (tenantId: string): Promise<SdkResponse<SSOSettingsResponse>> =>\n    transformResponse<SSOSettingsResponse>(\n      sdk.httpClient.get(apiPaths.sso.settings, {\n        queryParams: { tenantId },\n        token: managementKey,\n      }),\n      (data) => data,\n    ),\n  deleteSettings: (tenantId: string): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.delete(apiPaths.sso.settings, {\n        queryParams: { tenantId },\n        token: managementKey,\n      }),\n    ),\n  configureSettings: (\n    tenantId: string,\n    idpURL: string,\n    idpCert: string,\n    entityId: string,\n    redirectURL?: string,\n    domain?: string,\n  ): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(\n        apiPaths.sso.settings,\n        { tenantId, idpURL, entityId, idpCert, redirectURL, domain },\n        { token: managementKey },\n      ),\n    ),\n  configureMetadata: (tenantId: string, idpMetadataURL: string): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(\n        apiPaths.sso.metadata,\n        { tenantId, idpMetadataURL },\n        { token: managementKey },\n      ),\n    ),\n  configureMapping: (\n    tenantId: string,\n    roleMapping?: RoleMapping,\n    attributeMapping?: AttributeMapping,\n  ): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(\n        apiPaths.sso.mapping,\n        { tenantId, roleMapping, attributeMapping },\n        { token: managementKey },\n      ),\n    ),\n});\n\nexport default withSSOSettings;\n","import { SdkResponse, transformResponse } from '@descope/core-js-sdk';\nimport { CoreSdk } from '../types';\nimport apiPaths from './paths';\nimport { AccessKey, AssociatedTenant, CreatedAccessKeyResponse } from './types';\n\ntype SingleKeyResponse = {\n  key: AccessKey;\n};\n\ntype MultipleKeysResponse = {\n  keys: AccessKey[];\n};\n\nconst withAccessKey = (sdk: CoreSdk, managementKey?: string) => ({\n  /**\n   * Create a new access key for a project.\n   * @param name Access key name\n   * @param expireTime When the access key expires. Keep at 0 to make it indefinite.\n   * @param roles Optional roles in the project. Does not apply for multi-tenants\n   * @param keyTenants Optional associated tenants for this key and its roles for each.\n   * @returns A newly created key and its cleartext. Make sure to save the cleartext securely.\n   */\n  create: (\n    name: string,\n    expireTime: number,\n    roles?: string[],\n    keyTenants?: AssociatedTenant[],\n  ): Promise<SdkResponse<CreatedAccessKeyResponse>> =>\n    transformResponse(\n      sdk.httpClient.post(\n        apiPaths.accessKey.create,\n        { name, expireTime, roleNames: roles, keyTenants },\n        { token: managementKey },\n      ),\n    ),\n  /**\n   * Load an access key.\n   * @param id Access key ID to load\n   * @returns The loaded access key.\n   */\n  load: (id: string): Promise<SdkResponse<AccessKey>> =>\n    transformResponse<SingleKeyResponse, AccessKey>(\n      sdk.httpClient.get(apiPaths.accessKey.load, {\n        queryParams: { id },\n        token: managementKey,\n      }),\n      (data) => data.key,\n    ),\n  /**\n   * Search all access keys\n   * @param tenantIds Optional tenant ID filter to apply on the search results\n   * @returns An array of found access keys\n   */\n  searchAll: (tenantIds?: string[]): Promise<SdkResponse<AccessKey[]>> =>\n    transformResponse<MultipleKeysResponse, AccessKey[]>(\n      sdk.httpClient.post(apiPaths.accessKey.search, { tenantIds }, { token: managementKey }),\n      (data) => data.keys,\n    ),\n  /**\n   * Update an access key.\n   * @param id Access key ID to load\n   * @param name The updated access key name\n   * @returns The updated access key\n   */\n  update: (id: string, name: string): Promise<SdkResponse<AccessKey>> =>\n    transformResponse<SingleKeyResponse, AccessKey>(\n      sdk.httpClient.post(apiPaths.accessKey.update, { id, name }, { token: managementKey }),\n      (data) => data.key,\n    ),\n  /**\n   * Deactivate an access key. Deactivated access keys cannot be used until they are\n   * activated again.\n   * @param id Access key ID to deactivate\n   */\n  deactivate: (id: string): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(apiPaths.accessKey.deactivate, { id }, { token: managementKey }),\n    ),\n  /**\n   * Activate an access key. Only deactivated access keys can be activated again.\n   * @param id Access key ID to activate\n   */\n  activate: (id: string): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(apiPaths.accessKey.activate, { id }, { token: managementKey }),\n    ),\n  /**\n   * Delete an access key. IMPORTANT: This cannot be undone. Use carefully.\n   * @param id Access key ID to delete\n   */\n  delete: (id: string): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(apiPaths.accessKey.delete, { id }, { token: managementKey }),\n    ),\n});\n\nexport default withAccessKey;\n","import { SdkResponse, transformResponse } from '@descope/core-js-sdk';\nimport { CoreSdk } from '../types';\nimport apiPaths from './paths';\nimport { FlowResponse, Screen, Flow } from './types';\n\nconst WithFlow = (sdk: CoreSdk, managementKey?: string) => ({\n  export: (flowId: string): Promise<SdkResponse<FlowResponse>> =>\n    transformResponse(\n      sdk.httpClient.post(apiPaths.flow.export, { flowId }, { token: managementKey }),\n    ),\n  import: (flowId: string, flow: Flow, screens?: Screen[]): Promise<SdkResponse<FlowResponse>> =>\n    transformResponse(\n      sdk.httpClient.post(\n        apiPaths.flow.import,\n        { flowId, flow, screens },\n        { token: managementKey },\n      ),\n    ),\n});\n\nexport default WithFlow;\n","import { SdkResponse, transformResponse } from '@descope/core-js-sdk';\nimport { CoreSdk } from '../types';\nimport apiPaths from './paths';\nimport { Theme, ThemeResponse } from './types';\n\nconst WithTheme = (sdk: CoreSdk, managementKey?: string) => ({\n  export: (): Promise<SdkResponse<ThemeResponse>> =>\n    transformResponse(sdk.httpClient.post(apiPaths.theme.export, {}, { token: managementKey })),\n  import: (theme: Theme): Promise<SdkResponse<ThemeResponse>> =>\n    transformResponse(\n      sdk.httpClient.post(apiPaths.theme.import, { theme }, { token: managementKey }),\n    ),\n});\n\nexport default WithTheme;\n","import nodeFetch, { Headers } from 'node-fetch-commonjs';\n\nglobalThis.Headers ??= Headers;\n\nconst highWaterMarkMb = 1024 * 1024 * 30; // 30MB\n\n// we are increasing the response buffer size due to an issue where node-fetch hangs when response is too big\nconst patchedFetch = (...args: Parameters<typeof nodeFetch>) => {\n  // we can get Request on the first arg, or RequestInfo on the second arg\n  // we want to make sure we are setting the \"highWaterMark\" so we are doing it on both args\n  args.forEach((arg) => {\n    // eslint-disable-next-line no-param-reassign, @typescript-eslint/no-unused-expressions\n    arg && ((arg as any).highWaterMark ??= highWaterMarkMb);\n  });\n\n  return nodeFetch(...args);\n};\n\nexport default patchedFetch as unknown as typeof fetch;\n","import createSdk, { ExchangeAccessKeyResponse, SdkResponse, wrapWith } from '@descope/core-js-sdk';\nimport { JWK, JWTHeaderParameters, KeyLike, errors, importJWK, jwtVerify } from 'jose';\nimport {\n  permissionsClaimName,\n  refreshTokenCookieName,\n  rolesClaimName,\n  sessionTokenCookieName,\n} from './constants';\nimport { getAuthorizationClaimItems, withCookie } from './helpers';\nimport withManagement from './management';\nimport { AuthenticationInfo } from './types';\nimport fetch from './fetch-polyfill';\n\ndeclare const BUILD_VERSION: string;\n\n/** Configuration arguments which include the Descope core SDK args and an optional management key */\ntype NodeSdkArgs = Parameters<typeof createSdk>[0] & {\n  managementKey?: string;\n};\n\nconst nodeSdk = ({ managementKey, ...config }: NodeSdkArgs) => {\n  const coreSdk = createSdk({\n    ...config,\n    fetch,\n    baseHeaders: {\n      ...config.baseHeaders,\n      'x-descope-sdk-name': 'nodejs',\n      'x-descope-sdk-node-version': process?.versions?.node || '',\n      'x-descope-sdk-version': BUILD_VERSION,\n    },\n  });\n\n  const { projectId, logger } = config;\n\n  const keys: Record<string, KeyLike | Uint8Array> = {};\n\n  /** Fetch the public keys (JWKs) from Descope for the configured project */\n  const fetchKeys = async () => {\n    const keysWrapper = await coreSdk.httpClient\n      .get(`v2/keys/${projectId}`)\n      .then((resp) => resp.json());\n    const publicKeys: JWK[] = keysWrapper.keys;\n    if (!Array.isArray(publicKeys)) return {};\n    const kidJwksPairs = await Promise.all(\n      publicKeys.map(async (key) => [key.kid, await importJWK(key)]),\n    );\n\n    return kidJwksPairs.reduce(\n      (acc, [kid, jwk]) => (kid ? { ...acc, [kid.toString()]: jwk } : acc),\n      {},\n    );\n  };\n\n  const management = withManagement(coreSdk, managementKey);\n\n  const sdk = {\n    ...coreSdk,\n\n    /**\n     * Provides various APIs for managing a Descope project programmatically. A management key must\n     * be provided as an argument when initializing the SDK to use these APIs. Management keys can be\n     * generated in the Descope console.\n     */\n    management,\n\n    /** Get the key that can validate the given JWT KID in the header. Can retrieve the public key from local cache or from Descope. */\n    async getKey(header: JWTHeaderParameters): Promise<KeyLike | Uint8Array> {\n      if (!header?.kid) throw Error('header.kid must not be empty');\n\n      if (keys[header.kid]) return keys[header.kid];\n\n      // do we need to fetch once or every time?\n      Object.assign(keys, await fetchKeys());\n\n      if (!keys[header.kid]) throw Error('failed to fetch matching key');\n\n      return keys[header.kid];\n    },\n\n    /**\n     * Validate the given JWT with the right key and make sure the issuer is correct\n     * @param jwt the JWT string to parse and validate\n     * @returns AuthenticationInfo with the parsed token and JWT. Will throw an error if validation fails.\n     */\n    async validateJwt(jwt: string): Promise<AuthenticationInfo> {\n      // Do not hard-code the algo because library does not support `None` so all are valid\n      const res = await jwtVerify(jwt, sdk.getKey, { clockTolerance: 5 });\n      const token = res.payload;\n\n      if (token) {\n        token.iss = token.iss?.split('/').pop(); // support both url and project id as issuer\n        if (token.iss !== projectId) {\n          // We must do the verification here, since issuer can be either project ID or URL\n          throw new errors.JWTClaimValidationFailed(\n            'unexpected \"iss\" claim value',\n            'iss',\n            'check_failed',\n          );\n        }\n      }\n\n      return { jwt, token };\n    },\n\n    /**\n     * Validate an active session\n     * @param sessionToken session JWT to validate\n     * @returns AuthenticationInfo promise or throws Error if there is an issue with JWTs\n     */\n    async validateSession(sessionToken: string): Promise<AuthenticationInfo> {\n      if (!sessionToken) throw Error('session token is required for validation');\n\n      try {\n        const token = await sdk.validateJwt(sessionToken);\n        return token;\n      } catch (error) {\n        /* istanbul ignore next */\n        logger?.error('session validation failed', error);\n        throw Error('session validation failed');\n      }\n    },\n\n    /**\n     * Refresh the session using a refresh token\n     * @param refreshToken refresh JWT to refresh the session with\n     * @returns AuthenticationInfo promise or throws Error if there is an issue with JWTs\n     */\n    async refreshSession(refreshToken: string): Promise<AuthenticationInfo> {\n      if (!refreshToken) throw Error('refresh token is required to refresh a session');\n\n      try {\n        await sdk.validateJwt(refreshToken);\n        const jwtResp = await sdk.refresh(refreshToken);\n        if (jwtResp.ok) {\n          const token = await sdk.validateJwt(jwtResp.data?.sessionJwt);\n          return token;\n        }\n        /* istanbul ignore next */\n        throw Error(jwtResp.error?.errorMessage);\n      } catch (refreshTokenErr) {\n        /* istanbul ignore next */\n        logger?.error('refresh token validation failed', refreshTokenErr);\n        throw Error('refresh token validation failed');\n      }\n    },\n\n    /**\n     * Validate session and refresh it if it expired\n     * @param sessionToken session JWT\n     * @param refreshToken refresh JWT\n     * @returns AuthenticationInfo promise or throws Error if there is an issue with JWTs\n     */\n    async validateAndRefreshSession(\n      sessionToken?: string,\n      refreshToken?: string,\n    ): Promise<AuthenticationInfo> {\n      if (!sessionToken && !refreshToken) throw Error('both session and refresh tokens are empty');\n\n      try {\n        const token = await sdk.validateSession(sessionToken);\n        return token;\n      } catch (error) {\n        /* istanbul ignore next */\n        logger?.log('session validation failed - trying to refresh it');\n      }\n\n      return sdk.refreshSession(refreshToken);\n    },\n\n    /**\n     * Exchange API key (access key) for a session key\n     * @param accessKey access key to exchange for a session JWT\n     * @returns AuthneticationInfo with session JWT data\n     */\n    async exchangeAccessKey(accessKey: string): Promise<AuthenticationInfo> {\n      if (!accessKey) throw Error('access key must not be empty');\n\n      let resp: SdkResponse<ExchangeAccessKeyResponse>;\n      try {\n        resp = await sdk.accessKey.exchange(accessKey);\n      } catch (error) {\n        logger?.error('failed to exchange access key', error);\n        throw Error('could not exchange access key');\n      }\n\n      const { sessionJwt } = resp.data;\n      if (!sessionJwt) {\n        logger?.error('failed to parse exchange access key response');\n        throw Error('could not exchange access key');\n      }\n\n      try {\n        const token = await sdk.validateJwt(sessionJwt);\n        return token;\n      } catch (error) {\n        logger?.error('failed to parse jwt from access key', error);\n        throw Error('could not exchange access key');\n      }\n    },\n\n    /**\n     * Make sure that all given permissions exist on the parsed JWT top level claims\n     * @param authInfo JWT parsed info\n     * @param permissions list of permissions to make sure they exist on te JWT claims\n     * @returns true if all permissions exist, false otherwise\n     */\n    validatePermissions(authInfo: AuthenticationInfo, permissions: string[]): boolean {\n      return sdk.validateTenantPermissions(authInfo, null, permissions);\n    },\n\n    /**\n     * Make sure that all given permissions exist on the parsed JWT tenant claims\n     * @param authInfo JWT parsed info\n     * @param permissions list of permissions to make sure they exist on te JWT claims\n     * @returns true if all permissions exist, false otherwise\n     */\n    validateTenantPermissions(\n      authInfo: AuthenticationInfo,\n      tenant: string,\n      permissions: string[],\n    ): boolean {\n      const granted = getAuthorizationClaimItems(authInfo, permissionsClaimName, tenant);\n      return permissions.every((perm) => granted.includes(perm));\n    },\n\n    /**\n     * Make sure that all given roles exist on the parsed JWT top level claims\n     * @param authInfo JWT parsed info\n     * @param roles list of roles to make sure they exist on te JWT claims\n     * @returns true if all roles exist, false otherwise\n     */\n    validateRoles(authInfo: AuthenticationInfo, roles: string[]): boolean {\n      return sdk.validateTenantRoles(authInfo, null, roles);\n    },\n\n    /**\n     * Make sure that all given roles exist on the parsed JWT tenant claims\n     * @param authInfo JWT parsed info\n     * @param roles list of roles to make sure they exist on te JWT claims\n     * @returns true if all roles exist, false otherwise\n     */\n    validateTenantRoles(authInfo: AuthenticationInfo, tenant: string, roles: string[]): boolean {\n      const membership = getAuthorizationClaimItems(authInfo, rolesClaimName, tenant);\n      return roles.every((role) => membership.includes(role));\n    },\n  };\n\n  return wrapWith(\n    sdk,\n    [\n      'otp.verify.email',\n      'otp.verify.sms',\n      'otp.verify.whatsapp',\n      'magicLink.verify',\n      'enchantedLink.signUp',\n      'enchantedLink.signIn',\n      'oauth.exchange',\n      'saml.exchange',\n      'totp.verify',\n      'webauthn.signIn.finish',\n      'webauthn.signUp.finish',\n      'refresh',\n    ] as const,\n    withCookie,\n  );\n};\n\n/** Descope SDK client with delivery methods enum.\n *\n * Please see full documentation at {@link https://docs.descope.com/guides Descope Docs}\n * @example Usage\n *\n * ```js\n * import descopeSdk from '@descope/node-sdk';\n *\n * const myProjectId = 'xxx';\n * const sdk = descopeSdk({ projectId: myProjectId });\n *\n * const userLoginId = 'loginId';\n * sdk.otp.signIn.email(userLoginId);\n * const jwtResponse = sdk.otp.verify.email(userLoginId, codeFromEmail);\n * ```\n */\n\nnodeSdk.RefreshTokenCookieName = refreshTokenCookieName;\nnodeSdk.SessionTokenCookieName = sessionTokenCookieName;\n\nexport default nodeSdk;\nexport type {\n  DeliveryMethod,\n  OAuthProvider,\n  ResponseData,\n  SdkResponse,\n} from '@descope/core-js-sdk';\n","import { CoreSdk } from '../types';\nimport withUser from './user';\nimport withTenant from './tenant';\nimport withJWT from './jwt';\nimport withPermission from './permission';\nimport withRole from './role';\nimport withGroup from './group';\nimport withSSOSettings from './sso';\nimport withAccessKey from './accesskey';\nimport WithFlow from './flow';\nimport WithTheme from './theme';\n\n/** Constructs a higher level Management API that wraps the functions from code-js-sdk */\nconst withManagement = (sdk: CoreSdk, managementKey?: string) => ({\n  user: withUser(sdk, managementKey),\n  accessKey: withAccessKey(sdk, managementKey),\n  tenant: withTenant(sdk, managementKey),\n  sso: withSSOSettings(sdk, managementKey),\n  jwt: withJWT(sdk, managementKey),\n  permission: withPermission(sdk, managementKey),\n  role: withRole(sdk, managementKey),\n  group: withGroup(sdk, managementKey),\n  flow: WithFlow(sdk, managementKey),\n  theme: WithTheme(sdk, managementKey),\n});\n\nexport default withManagement;\n"],"names":["withCookie","fn","async","args","resp","data","_d","refreshJwt","rest","__rest","cookies","options","push","cookieDomain","cookieMaxAge","cookiePath","_a","response","headers","get","cookie","name","match","RegExp","getCookieValue","_b","_c","Object","assign","getAuthorizationClaimItems","authInfo","claim","tenant","value","token","Array","isArray","apiPaths","create","update","delete","deleteAllTestUsers","load","search","updateStatus","updateEmail","updatePhone","updateDisplayName","updatePicture","updateCustomAttribute","addRole","removeRole","addTenant","removeTenant","setPassword","expirePassword","generateOTPForTest","generateMagicLinkForTest","generateEnchantedLinkForTest","deactivate","activate","loadAll","settings","metadata","mapping","export","import","loadAllGroups","loadAllGroupsForMember","loadAllGroupMembers","withUser","sdk","managementKey","loginId","email","phone","displayName","roles","userTenants","customAttributes","picture","transformResponse","httpClient","post","roleNames","user","createTestUser","test","invite","queryParams","loadByUserId","userId","searchAll","tenantIds","limit","page","testUsersOnly","withTestUser","users","status","isVerified","verified","attributeKey","attributeValue","addRoles","removeRoles","tenantId","addTenantRoles","removeTenantRoles","generateOTPForTestUser","deliveryMethod","generateMagicLinkForTestUser","uri","URI","generateEnchantedLinkForTestUser","password","withTenant","selfProvisioningDomains","createWithId","id","tenants","withJWT","jwt","customClaims","withPermission","description","newName","permissions","withRole","permissionNames","withGroup","userIds","loginIds","groupId","withSSOSettings","getSettings","deleteSettings","configureSettings","idpURL","idpCert","entityId","redirectURL","domain","configureMetadata","idpMetadataURL","configureMapping","roleMapping","attributeMapping","withAccessKey","expireTime","keyTenants","key","keys","WithFlow","flowId","flow","screens","WithTheme","theme","globalThis","Headers","patchedFetch","forEach","arg","highWaterMark","nodeFetch","nodeSdk","config","coreSdk","createSdk","fetch","baseHeaders","process","versions","node","projectId","logger","management","accessKey","sso","permission","role","group","withManagement","header","kid","Error","publicKeys","then","json","Promise","all","map","importJWK","reduce","acc","jwk","toString","fetchKeys","jwtVerify","getKey","clockTolerance","payload","iss","split","pop","errors","JWTClaimValidationFailed","sessionToken","validateJwt","error","refreshToken","jwtResp","refresh","ok","sessionJwt","errorMessage","refreshTokenErr","validateSession","log","refreshSession","exchange","validatePermissions","validateTenantPermissions","granted","every","perm","includes","validateRoles","validateTenantRoles","membership","wrapWith","RefreshTokenCookieName","SessionTokenCookieName"],"mappings":"sNAEO,MC+BMA,EACVC,GACDC,SAAUC,eACR,MAAMC,QAAaH,KAAME,GAGzB,IAAKC,EAAKC,KACR,OAAOD,EAIT,IAAIE,EAA0BF,EAAKC,MAA/BE,WAAEA,GAAUD,EAAKE,EAAjBC,EAAAH,EAAA,CAAA,eACJ,MAAMI,EAAoB,GAlCP,IAA8BC,EAgDjD,OAZKJ,EASHG,EAAQE,KA5CZ,GDVoC,SCsDoBL,cA5C5BI,OADuBA,EA6CiBH,QA5CxC,EAAAG,EAASE,eAAgB,gBACnDF,aAAA,EAAAA,EAASG,eAAgB,aACjBH,aAAA,EAAAA,EAASI,aAAc,mCAkCZ,QAAbC,EAAAZ,EAAKa,gBAAQ,IAAAD,OAAA,EAAAA,EAAEE,QAAQC,IAAI,iBAC7BZ,EA3Be,EAACa,EAAmCC,KACzD,MAAMC,EAAQF,eAAAA,EAAQE,MAAMC,OAAO,cAAcF,cACjD,OAAOC,EAAQA,EAAM,GAAK,IAAI,EAyBXE,CACE,QAAbC,EAAArB,EAAKa,gBAAQ,IAAAQ,OAAA,EAAAA,EAAEP,QAAQC,IAAI,cDhDC,OCmD9BT,EAAQE,KAAoB,QAAfc,EAAAtB,EAAKa,gBAAU,IAAAS,OAAA,EAAAA,EAAAR,QAAQC,IAAI,gBAMhCQ,OAAAC,OAAAD,OAAAC,OAAA,CAAA,EAAAxB,GAAM,CAAAC,KAAWsB,OAAAC,OAAAD,OAAAC,OAAA,GAAAxB,EAAKC,MAAM,CAAAE,aAAYG,aAAY,WAUpDmB,EACdC,EACAC,EACAC,WAEA,MAAMC,EAAQD,EAC0C,QAApDP,EAA6C,QAA7CT,EAAAc,EAASI,MAAgC,eAAI,IAAAlB,OAAA,EAAAA,EAAAgB,UAAO,IAAAP,OAAA,EAAAA,EAAGM,GACvDD,EAASI,MAAMH,GACnB,OAAOI,MAAMC,QAAQH,GAASA,EAAQ,EACxC,CC7EA,IAAeI,EACP,CACJC,OAAQ,uBACRC,OAAQ,uBACRC,OAAQ,uBACRC,mBAAoB,gCACpBC,KAAM,gBACNC,OAAQ,uBACRC,aAAc,8BACdC,YAAa,6BACbC,YAAa,6BACbC,kBAAmB,4BACnBC,cAAe,+BACfC,sBAAuB,uCACvBC,QAAS,gCACTC,WAAY,mCACZC,UAAW,kCACXC,aAAc,qCACdC,YAAa,6BACbC,eAAgB,gCAChBC,mBAAoB,8BACpBC,yBAA0B,oCAC1BC,6BAA8B,yCAtBnBrB,EAwBF,CACTC,OAAQ,4BACRI,KAAM,qBACNC,OAAQ,4BACRJ,OAAQ,4BACRoB,WAAY,gCACZC,SAAU,8BACVpB,OAAQ,6BA/BGH,EAiCL,CACNC,OAAQ,yBACRC,OAAQ,yBACRC,OAAQ,yBACRqB,QAAS,uBArCExB,EAuCR,CACHyB,SAAU,wBACVC,SAAU,wBACVC,QAAS,wBA1CE3B,EA4CR,CACHE,OAAQ,uBA7CGF,EA+CD,CACVC,OAAQ,6BACRC,OAAQ,6BACRC,OAAQ,6BACRqB,QAAS,2BAnDExB,EAqDP,CACJC,OAAQ,uBACRC,OAAQ,uBACRC,OAAQ,uBACRqB,QAAS,qBAzDExB,EA2DP,CACJ4B,OAAQ,uBACRC,OAAQ,wBA7DG7B,EA+DN,CACL4B,OAAQ,wBACRC,OAAQ,yBAjEG7B,EAmEN,CACL8B,cAAe,qBACfC,uBAAwB,4BACxBC,oBAAqB,0BCpDzB,MAAMC,EAAW,CAACC,EAAcC,KAA4B,CAC1DlC,OAAQ,CACNmC,EACAC,EACAC,EACAC,EACAC,EACAC,EACAC,EACAC,IAEAC,EACEV,EAAIW,WAAWC,KACb9C,EAAcC,OACd,CACEmC,UACAC,QACAC,QACAC,cACAQ,UAAWP,EACXC,cACAC,mBACAC,WAEF,CAAE9C,MAAOsC,KAEVnE,GAASA,EAAKgF,OAYnBC,eAAgB,CACdb,EACAC,EACAC,EACAC,EACAC,EACAC,EACAC,EACAC,IAEAC,EACEV,EAAIW,WAAWC,KACb9C,EAAcC,OACd,CACEmC,UACAC,QACAC,QACAC,cACAQ,UAAWP,EACXC,cACAS,MAAM,EACNR,mBACAC,WAEF,CAAE9C,MAAOsC,KAEVnE,GAASA,EAAKgF,OAEnBG,OAAQ,CACNf,EACAC,EACAC,EACAC,EACAC,EACAC,EACAC,EACAC,IAEAC,EACEV,EAAIW,WAAWC,KACb9C,EAAcC,OACd,CACEmC,UACAC,QACAC,QACAC,cACAQ,UAAWP,EACXC,cACAU,QAAQ,EACRT,mBACAC,WAEF,CAAE9C,MAAOsC,KAEVnE,GAASA,EAAKgF,OAEnB9C,OAAQ,CACNkC,EACAC,EACAC,EACAC,EACAC,EACAC,EACAC,EACAC,IAEAC,EACEV,EAAIW,WAAWC,KACb9C,EAAcE,OACd,CACEkC,UACAC,QACAC,QACAC,cACAQ,UAAWP,EACXC,cACAC,mBACAC,WAEF,CAAE9C,MAAOsC,KAEVnE,GAASA,EAAKgF,OAEnB7C,OAASiC,GACPQ,EACEV,EAAIW,WAAWC,KAAK9C,EAAcG,OAAQ,CAAEiC,WAAW,CAAEvC,MAAOsC,KAKpE/B,mBAAoB,IAClBwC,EACEV,EAAIW,WAAW1C,OAAOH,EAAcI,mBAAoB,CAAEP,MAAOsC,KAErE9B,KAAO+B,GACLQ,EACEV,EAAIW,WAAW/D,IAAIkB,EAAcK,KAAM,CACrC+C,YAAa,CAAEhB,WACfvC,MAAOsC,KAERnE,GAASA,EAAKgF,OAQnBK,aAAeC,GACbV,EACEV,EAAIW,WAAW/D,IAAIkB,EAAcK,KAAM,CACrC+C,YAAa,CAAEE,UACfzD,MAAOsC,KAERnE,GAASA,EAAKgF,OAanBO,UAAW,CACTC,EACAhB,EACAiB,EACAC,EACAC,EACAC,EACAlB,IAEAE,EACEV,EAAIW,WAAWC,KACb9C,EAAcM,OACd,CAAEkD,YAAWT,UAAWP,EAAOiB,QAAOC,OAAMC,gBAAeC,eAAclB,oBACzE,CAAE7C,MAAOsC,KAEVnE,GAASA,EAAK6F,QAEnBtC,SAAWa,GACTQ,EACEV,EAAIW,WAAWC,KACb9C,EAAcO,aACd,CAAE6B,UAAS0B,OAAQ,WACnB,CAAEjE,MAAOsC,KAEVnE,GAASA,EAAKgF,OAEnB1B,WAAac,GACXQ,EACEV,EAAIW,WAAWC,KACb9C,EAAcO,aACd,CAAE6B,UAAS0B,OAAQ,YACnB,CAAEjE,MAAOsC,KAEVnE,GAASA,EAAKgF,OAEnBxC,YAAa,CACX4B,EACAC,EACA0B,IAEAnB,EACEV,EAAIW,WAAWC,KACb9C,EAAcQ,YACd,CAAE4B,UAASC,QAAO2B,SAAUD,GAC5B,CAAElE,MAAOsC,KAEVnE,GAASA,EAAKgF,OAEnBvC,YAAa,CACX2B,EACAE,EACAyB,IAEAnB,EACEV,EAAIW,WAAWC,KACb9C,EAAcS,YACd,CAAE2B,UAASE,QAAO0B,SAAUD,GAC5B,CAAElE,MAAOsC,KAEVnE,GAASA,EAAKgF,OAEnBtC,kBAAmB,CAAC0B,EAAiBG,IACnCK,EACEV,EAAIW,WAAWC,KACb9C,EAAcU,kBACd,CAAE0B,UAASG,eACX,CAAE1C,MAAOsC,KAEVnE,GAASA,EAAKgF,OAEnBrC,cAAe,CAACyB,EAAiBO,IAC/BC,EACEV,EAAIW,WAAWC,KACb9C,EAAcW,cACd,CAAEyB,UAASO,WACX,CAAE9C,MAAOsC,KAEVnE,GAASA,EAAKgF,OAEnBpC,sBAAuB,CACrBwB,EACA6B,EACAC,IAEAtB,EACEV,EAAIW,WAAWC,KACb9C,EAAcY,sBACd,CAAEwB,UAAS6B,eAAcC,kBACzB,CAAErE,MAAOsC,KAEVnE,GAASA,EAAKgF,OAEnBmB,SAAU,CAAC/B,EAAiBI,IAC1BI,EACEV,EAAIW,WAAWC,KACb9C,EAAca,QACd,CAAEuB,UAASW,UAAWP,GACtB,CAAE3C,MAAOsC,KAEVnE,GAASA,EAAKgF,OAEnBoB,YAAa,CAAChC,EAAiBI,IAC7BI,EACEV,EAAIW,WAAWC,KACb9C,EAAcc,WACd,CAAEsB,UAASW,UAAWP,GACtB,CAAE3C,MAAOsC,KAEVnE,GAASA,EAAKgF,OAEnBjC,UAAW,CAACqB,EAAiBiC,IAC3BzB,EACEV,EAAIW,WAAWC,KAAK9C,EAAce,UAAW,CAAEqB,UAASiC,YAAY,CAAExE,MAAOsC,KAC5EnE,GAASA,EAAKgF,OAEnBhC,aAAc,CAACoB,EAAiBiC,IAC9BzB,EACEV,EAAIW,WAAWC,KACb9C,EAAcgB,aACd,CAAEoB,UAASiC,YACX,CAAExE,MAAOsC,KAEVnE,GAASA,EAAKgF,OAEnBsB,eAAgB,CACdlC,EACAiC,EACA7B,IAEAI,EACEV,EAAIW,WAAWC,KACb9C,EAAca,QACd,CAAEuB,UAASiC,WAAUtB,UAAWP,GAChC,CAAE3C,MAAOsC,KAEVnE,GAASA,EAAKgF,OAEnBuB,kBAAmB,CACjBnC,EACAiC,EACA7B,IAEAI,EACEV,EAAIW,WAAWC,KACb9C,EAAcc,WACd,CAAEsB,UAASiC,WAAUtB,UAAWP,GAChC,CAAE3C,MAAOsC,KAEVnE,GAASA,EAAKgF,OAanBwB,uBAAwB,CACtBC,EACArC,IAEAQ,EACEV,EAAIW,WAAWC,KACb9C,EAAcmB,mBACd,CAAEsD,iBAAgBrC,WAClB,CAAEvC,MAAOsC,KAEVnE,GAASA,IAcd0G,6BAA8B,CAC5BD,EACArC,EACAuC,IAEA/B,EACEV,EAAIW,WAAWC,KACb9C,EAAcoB,yBACd,CAAEqD,iBAAgBrC,UAASwC,IAAKD,GAChC,CAAE9E,MAAOsC,KAEVnE,GAASA,IAad6G,iCAAkC,CAChCzC,EACAuC,IAEA/B,EACEV,EAAIW,WAAWC,KACb9C,EAAcqB,6BACd,CAAEe,UAASwC,IAAKD,GAChB,CAAE9E,MAAOsC,KAEVnE,GAASA,IAWdiD,YAAa,CAACmB,EAAiB0C,IAC7BlC,EACEV,EAAIW,WAAWC,KACb9C,EAAciB,YACd,CAAEmB,UAAS0C,YACX,CAAEjF,MAAOsC,KAEVnE,GAASA,IASdkD,eAAiBkB,GACfQ,EACEV,EAAIW,WAAWC,KAAK9C,EAAckB,eAAgB,CAAEkB,WAAW,CAAEvC,MAAOsC,KACvEnE,GAASA,MCxaV+G,EAAa,CAAC7C,EAAcC,KAA4B,CAC5DlC,OAAQ,CACNjB,EACAgG,IAEApC,EACEV,EAAIW,WAAWC,KACb9C,EAAgBC,OAChB,CAAEjB,OAAMgG,2BACR,CAAEnF,MAAOsC,KAGf8C,aAAc,CACZC,EACAlG,EACAgG,IAEApC,EACEV,EAAIW,WAAWC,KACb9C,EAAgBC,OAChB,CAAEiF,KAAIlG,OAAMgG,2BACZ,CAAEnF,MAAOsC,KAGfjC,OAAQ,CACNgF,EACAlG,EACAgG,IAEApC,EACEV,EAAIW,WAAWC,KACb9C,EAAgBE,OAChB,CAAEgF,KAAIlG,OAAMgG,2BACZ,CAAEnF,MAAOsC,KAGfhC,OAAS+E,GACPtC,EACEV,EAAIW,WAAWC,KAAK9C,EAAgBG,OAAQ,CAAE+E,MAAM,CAAErF,MAAOsC,KAEjEX,QAAS,IACPoB,EACEV,EAAIW,WAAW/D,IAAIkB,EAAgBwB,QAAS,CAC1C3B,MAAOsC,KAERnE,GAASA,EAAKmH,YCjDfC,EAAU,CAAClD,EAAcC,KAA4B,CACzDjC,OAAQ,CACNmF,EACAC,IAEA1C,EACEV,EAAIW,WAAWC,KAAK9C,EAAaE,OAAQ,CAAEmF,MAAKC,gBAAgB,CAAEzF,MAAOsC,OCFzEoD,EAAiB,CAACrD,EAAcC,KAA4B,CAChElC,OAAQ,CAACjB,EAAcwG,IACrB5C,EACEV,EAAIW,WAAWC,KACb9C,EAAoBC,OACpB,CAAEjB,OAAMwG,eACR,CAAE3F,MAAOsC,KAGfjC,OAAQ,CAAClB,EAAcyG,EAAiBD,IACtC5C,EACEV,EAAIW,WAAWC,KACb9C,EAAoBE,OACpB,CAAElB,OAAMyG,UAASD,eACjB,CAAE3F,MAAOsC,KAGfhC,OAASnB,GACP4D,EACEV,EAAIW,WAAWC,KAAK9C,EAAoBG,OAAQ,CAAEnB,QAAQ,CAAEa,MAAOsC,KAEvEX,QAAS,IACPoB,EACEV,EAAIW,WAAW/D,IAAIkB,EAAoBwB,QAAS,CAC9C3B,MAAOsC,KAERnE,GAASA,EAAK0H,gBC1BfC,EAAW,CAACzD,EAAcC,KAA4B,CAC1DlC,OAAQ,CACNjB,EACAwG,EACAI,IAEAhD,EACEV,EAAIW,WAAWC,KACb9C,EAAcC,OACd,CAAEjB,OAAMwG,cAAaI,mBACrB,CAAE/F,MAAOsC,KAGfjC,OAAQ,CACNlB,EACAyG,EACAD,EACAI,IAEAhD,EACEV,EAAIW,WAAWC,KACb9C,EAAcE,OACd,CAAElB,OAAMyG,UAASD,cAAaI,mBAC9B,CAAE/F,MAAOsC,KAGfhC,OAASnB,GACP4D,EACEV,EAAIW,WAAWC,KAAK9C,EAAcG,OAAQ,CAAEnB,QAAQ,CAAEa,MAAOsC,KAEjEX,QAAS,IACPoB,EACEV,EAAIW,WAAW/D,IAAIkB,EAAcwB,QAAS,CACxC3B,MAAOsC,KAERnE,GAASA,EAAKwE,UCvCfqD,EAAY,CAAC3D,EAAcC,KAA4B,CAM3DL,cAAgBuC,GACdzB,EACEV,EAAIW,WAAWC,KAAK9C,EAAe8B,cAAe,CAAEuC,YAAY,CAAExE,MAAOsC,KAU7EJ,uBAAwB,CACtBsC,EACAyB,EACAC,IAEAnD,EACEV,EAAIW,WAAWC,KACb9C,EAAe+B,uBACf,CAAEsC,WAAU0B,WAAUD,WACtB,CAAEjG,MAAOsC,KAUfH,oBAAqB,CAACqC,EAAkB2B,IACtCpD,EACEV,EAAIW,WAAWC,KACb9C,EAAegC,oBACf,CAAEqC,WAAU2B,WACZ,CAAEnG,MAAOsC,OC1CX8D,EAAkB,CAAC/D,EAAcC,KAA4B,CACjE+D,YAAc7B,GACZzB,EACEV,EAAIW,WAAW/D,IAAIkB,EAAayB,SAAU,CACxC2B,YAAa,CAAEiB,YACfxE,MAAOsC,KAERnE,GAASA,IAEdmI,eAAiB9B,GACfzB,EACEV,EAAIW,WAAW1C,OAAOH,EAAayB,SAAU,CAC3C2B,YAAa,CAAEiB,YACfxE,MAAOsC,KAGbiE,kBAAmB,CACjB/B,EACAgC,EACAC,EACAC,EACAC,EACAC,IAEA7D,EACEV,EAAIW,WAAWC,KACb9C,EAAayB,SACb,CAAE4C,WAAUgC,SAAQE,WAAUD,UAASE,cAAaC,UACpD,CAAE5G,MAAOsC,KAGfuE,kBAAmB,CAACrC,EAAkBsC,IACpC/D,EACEV,EAAIW,WAAWC,KACb9C,EAAa0B,SACb,CAAE2C,WAAUsC,kBACZ,CAAE9G,MAAOsC,KAGfyE,iBAAkB,CAChBvC,EACAwC,EACAC,IAEAlE,EACEV,EAAIW,WAAWC,KACb9C,EAAa2B,QACb,CAAE0C,WAAUwC,cAAaC,oBACzB,CAAEjH,MAAOsC,OCxCX4E,EAAgB,CAAC7E,EAAcC,KAA4B,CAS/DlC,OAAQ,CACNjB,EACAgI,EACAxE,EACAyE,IAEArE,EACEV,EAAIW,WAAWC,KACb9C,EAAmBC,OACnB,CAAEjB,OAAMgI,aAAYjE,UAAWP,EAAOyE,cACtC,CAAEpH,MAAOsC,KAQf9B,KAAO6E,GACLtC,EACEV,EAAIW,WAAW/D,IAAIkB,EAAmBK,KAAM,CAC1C+C,YAAa,CAAE8B,MACfrF,MAAOsC,KAERnE,GAASA,EAAKkJ,MAOnB3D,UAAYC,GACVZ,EACEV,EAAIW,WAAWC,KAAK9C,EAAmBM,OAAQ,CAAEkD,aAAa,CAAE3D,MAAOsC,KACtEnE,GAASA,EAAKmJ,OAQnBjH,OAAQ,CAACgF,EAAYlG,IACnB4D,EACEV,EAAIW,WAAWC,KAAK9C,EAAmBE,OAAQ,CAAEgF,KAAIlG,QAAQ,CAAEa,MAAOsC,KACrEnE,GAASA,EAAKkJ,MAOnB5F,WAAa4D,GACXtC,EACEV,EAAIW,WAAWC,KAAK9C,EAAmBsB,WAAY,CAAE4D,MAAM,CAAErF,MAAOsC,KAMxEZ,SAAW2D,GACTtC,EACEV,EAAIW,WAAWC,KAAK9C,EAAmBuB,SAAU,CAAE2D,MAAM,CAAErF,MAAOsC,KAMtEhC,OAAS+E,GACPtC,EACEV,EAAIW,WAAWC,KAAK9C,EAAmBG,OAAQ,CAAE+E,MAAM,CAAErF,MAAOsC,OCvFhEiF,EAAW,CAAClF,EAAcC,KAA4B,CAC1DP,OAASyF,GACPzE,EACEV,EAAIW,WAAWC,KAAK9C,EAAc4B,OAAQ,CAAEyF,UAAU,CAAExH,MAAOsC,KAEnEN,OAAQ,CAACwF,EAAgBC,EAAYC,IACnC3E,EACEV,EAAIW,WAAWC,KACb9C,EAAc6B,OACd,CAAEwF,SAAQC,OAAMC,WAChB,CAAE1H,MAAOsC,OCVXqF,EAAY,CAACtF,EAAcC,KAA4B,CAC3DP,OAAQ,IACNgB,EAAkBV,EAAIW,WAAWC,KAAK9C,EAAe4B,OAAQ,CAAE,EAAE,CAAE/B,MAAOsC,KAC5EN,OAAS4F,GACP7E,EACEV,EAAIW,WAAWC,KAAK9C,EAAe6B,OAAQ,CAAE4F,SAAS,CAAE5H,MAAOsC,aCRnD,QAAlBxD,EAAA+I,WAAWC,eAAO,IAAAhJ,IAAlB+I,WAAWC,QAAYA,GAEvB,MAGMC,EAAe,IAAI9J,KAGvBA,EAAK+J,SAASC,YAEZA,YAASnJ,GAAAS,EAAA0I,GAAYC,+BAAAA,cARD,UAQmC,IAGlDC,KAAalK,ICKhBmK,EAAWtJ,WAAAwD,cAAEA,GAAuCxD,EAArBuJ,EAAM9J,EAAAO,EAA1B,mBACf,MAAMwJ,EAAUC,EACX9I,OAAAC,OAAAD,OAAAC,OAAA,CAAA,EAAA2I,UACHG,EACAC,YAAWhJ,OAAAC,OAAAD,OAAAC,OAAA,CAAA,EACN2I,EAAOI,cACV,qBAAsB,SACtB,8BAAiD,UAAZ,OAAPC,cAAO,IAAPA,aAAO,EAAPA,QAASC,gBAAU,IAAApJ,OAAA,EAAAA,EAAAqJ,OAAQ,GACzD,wBAAyB,cAIvBC,UAAEA,EAASC,OAAEA,GAAWT,EAExBf,EAA6C,CAAA,EAmB7CyB,ECxCe,EAAC1G,EAAcC,KAA4B,CAChEa,KAAMf,EAASC,EAAKC,GACpB0G,UAAW9B,EAAc7E,EAAKC,GAC9BxC,OAAQoF,EAAW7C,EAAKC,GACxB2G,IAAK7C,EAAgB/D,EAAKC,GAC1BkD,IAAKD,EAAQlD,EAAKC,GAClB4G,WAAYxD,EAAerD,EAAKC,GAChC6G,KAAMrD,EAASzD,EAAKC,GACpB8G,MAAOpD,EAAU3D,EAAKC,GACtBmF,KAAMF,EAASlF,EAAKC,GACpBsF,MAAOD,EAAUtF,EAAKC,KD8BH+G,CAAef,EAAShG,GAErCD,iCACDiG,GAAO,CAOVS,aAGA/K,aAAasL,GACX,KAAKA,aAAA,EAAAA,EAAQC,KAAK,MAAMC,MAAM,gCAE9B,GAAIlC,EAAKgC,EAAOC,KAAM,OAAOjC,EAAKgC,EAAOC,KAKzC,GAFA9J,OAAOC,OAAO4H,OAnCAtJ,WAChB,MAGMyL,SAHoBnB,EAAQtF,WAC/B/D,IAAI,WAAW4J,KACfa,MAAMxL,GAASA,EAAKyL,UACerC,KACtC,OAAKrH,MAAMC,QAAQuJ,UACQG,QAAQC,IACjCJ,EAAWK,KAAI9L,MAAOqJ,GAAQ,CAACA,EAAIkC,UAAWQ,EAAU1C,QAGtC2C,QAClB,CAACC,GAAMV,EAAKW,KAAUX,EAAW9J,OAAAC,OAAAD,OAAAC,OAAA,CAAA,EAAAuK,IAAK,CAACV,EAAIY,YAAaD,IAAQD,GAChE,CAAE,GAPmC,EAQtC,EAsB2BG,KAErB9C,EAAKgC,EAAOC,KAAM,MAAMC,MAAM,gCAEnC,OAAOlC,EAAKgC,EAAOC,IACpB,EAODvL,kBAAkBwH,SAEhB,MACMxF,SADYqK,EAAU7E,EAAKnD,EAAIiI,OAAQ,CAAEC,eAAgB,KAC7CC,QAElB,GAAIxK,IACFA,EAAMyK,IAAe,QAAT3L,EAAAkB,EAAMyK,WAAG,IAAA3L,OAAA,EAAAA,EAAE4L,MAAM,KAAKC,MAC9B3K,EAAMyK,MAAQ5B,GAEhB,MAAM,IAAI+B,EAAOC,yBACf,+BACA,MACA,gBAKN,MAAO,CAAErF,MAAKxF,QACf,EAODhC,sBAAsB8M,GACpB,IAAKA,EAAc,MAAMtB,MAAM,4CAE/B,IAEE,aADoBnH,EAAI0I,YAAYD,EAMrC,CAJC,MAAOE,GAGP,MADAlC,SAAAA,EAAQkC,MAAM,4BAA6BA,GACrCxB,MAAM,4BACb,CACF,EAODxL,qBAAqBiN,WACnB,IAAKA,EAAc,MAAMzB,MAAM,kDAE/B,UACQnH,EAAI0I,YAAYE,GACtB,MAAMC,QAAgB7I,EAAI8I,QAAQF,GAClC,GAAIC,EAAQE,GAAI,CAEd,aADoB/I,EAAI0I,YAA0B,QAAdjM,EAAAoM,EAAQ/M,YAAM,IAAAW,OAAA,EAAAA,EAAAuM,WAEnD,CAED,MAAM7B,MAAmB,QAAbjK,EAAA2L,EAAQF,aAAK,IAAAzL,OAAA,EAAAA,EAAE+L,aAK5B,CAJC,MAAOC,GAGP,MADAzC,SAAAA,EAAQkC,MAAM,kCAAmCO,GAC3C/B,MAAM,kCACb,CACF,EAQDxL,gCACE8M,EACAG,GAEA,IAAKH,IAAiBG,EAAc,MAAMzB,MAAM,6CAEhD,IAEE,aADoBnH,EAAImJ,gBAAgBV,EAKzC,CAHC,MAAOE,GAEPlC,SAAAA,EAAQ2C,IAAI,mDACb,CAED,OAAOpJ,EAAIqJ,eAAeT,EAC3B,EAODjN,wBAAwBgL,GACtB,IAAKA,EAAW,MAAMQ,MAAM,gCAE5B,IAAItL,EACJ,IACEA,QAAamE,EAAI2G,UAAU2C,SAAS3C,EAIrC,CAHC,MAAOgC,GAEP,MADAlC,SAAAA,EAAQkC,MAAM,gCAAiCA,GACzCxB,MAAM,gCACb,CAED,MAAM6B,WAAEA,GAAenN,EAAKC,KAC5B,IAAKkN,EAEH,MADAvC,SAAAA,EAAQkC,MAAM,gDACRxB,MAAM,iCAGd,IAEE,aADoBnH,EAAI0I,YAAYM,EAKrC,CAHC,MAAOL,GAEP,MADAlC,SAAAA,EAAQkC,MAAM,sCAAuCA,GAC/CxB,MAAM,gCACb,CACF,EAQDoC,oBAAmB,CAAChM,EAA8BiG,IACzCxD,EAAIwJ,0BAA0BjM,EAAU,KAAMiG,GASvDgG,0BACEjM,EACAE,EACA+F,GAEA,MAAMiG,EAAUnM,EAA2BC,EdrNb,ccqN6CE,GAC3E,OAAO+F,EAAYkG,OAAOC,GAASF,EAAQG,SAASD,IACrD,EAQDE,cAAa,CAACtM,EAA8B+C,IACnCN,EAAI8J,oBAAoBvM,EAAU,KAAM+C,GASjDwJ,oBAAoBvM,EAA8BE,EAAgB6C,GAChE,MAAMyJ,EAAazM,EAA2BC,EdxOtB,QcwOgDE,GACxE,OAAO6C,EAAMoJ,OAAO5C,GAASiD,EAAWH,SAAS9C,IAClD,IAGH,OAAOkD,EACLhK,EACA,CACE,mBACA,iBACA,sBACA,mBACA,uBACA,uBACA,iBACA,gBACA,cACA,yBACA,yBACA,WAEFvE,EACD,EAoBHsK,EAAQkE,uBd1R8B,Mc2RtClE,EAAQmE,uBdzR8B"}

package/package.json

@@ -1,14 +1,20 @@
 {
   "name": "@descope/node-sdk",
-  "version": "1.5.0",
+  "version": "1.5.1",
   "description": "Node.js library used to integrate with Descope",
   "typings": "./dist/index.d.ts",
   "main": "dist/cjs/index.cjs.js",
   "module": "./dist/index.esm.js",
   "types": "dist/index.d.ts",
   "exports": {
-    "require": "./dist/cjs/index.cjs.js",
-    "import": "./dist/index.esm.js"
+    "require": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/cjs/index.cjs.js"
+    },
+    "import": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.esm.js"
+    }
   },
   "type": "module",
   "files": [
@@ -95,8 +101,8 @@
     "typescript": "^4.6.4"
   },
   "dependencies": {
-    "@descope/core-js-sdk": "1.2.1",
-    "jose": "4.14.1",
+    "@descope/core-js-sdk": "1.3.4",
+    "jose": "4.14.4",
     "node-fetch-commonjs": "3.2.4"
   },
   "peerDependencies": {