@descope/node-sdk 1.5.0 → 1.5.2

package/README.md

@@ -15,10 +15,13 @@ Install the package with:
 npm i --save @descope/node-sdk
 ```
 
-## Setup
+## Authentication Functions
 
-A Descope `Project ID` is required to initialize the SDK. Find it on the
-[project page in the Descope Console](https://app.descope.com/settings/project).
+### Setup
+
+Before you can use authentication functions listed below, you must initialize `descopeClient` to use all of the built-in SDK functions.
+
+You'll need your Descope `Project ID` to create this, and you can find it on the [project page](https://app.descope.com/settings/project) in the Descope Console.
 
 ```typescript
 import DescopeClient from '@descope/node-sdk';
@@ -26,9 +29,53 @@ import DescopeClient from '@descope/node-sdk';
 const descopeClient = DescopeClient({ projectId: 'my-project-ID' });
 ```
 
-## Usage
+Once you've created a `descopeClient`, you can use that to work with the following functions:
+
+1. [OTP Authentication](#otp-authentication)
+2. [Magic Link](#magic-link)
+3. [Enchanted Link](#enchanted-link)
+4. [OAuth](#oauth)
+5. [SSO/SAML](#ssosaml)
+6. [TOTP Authentication](#totp-authentication)
+7. [Passwords](#passwords)
+8. [Session Validation](#session-validation)
+9. [Roles & Permission Validation](#roles--permission-validation)
+10. [Logging Out](#logging-out)
+
+## Management Functions
+
+### Setup
+
+Before you can use management functions listed below, you must initialize `descopeClient`.
+
+If you wish to also use management functions, you will need to initialize a new version of your `descopeClient`, but this time with a `ManagementKey` as well as your `Project ID`. Create a management key in the [Descope Console](https://app.descope.com/settings/company/managementkeys).
+
+```typescript
+import DescopeClient from '@descope/node-sdk';
+
+const descopeClient = DescopeClient({
+  projectId: 'my-project-ID',
+  managementKey: 'management-key',
+});
+```
+
+Then, you can use that to work with the following functions:
+
+1. [Manage Tenants](#manage-tenants)
+2. [Manage Users](#manage-users)
+3. [Manage Access Keys](#manage-access-keys)
+4. [Manage SSO Setting](#manage-sso-setting)
+5. [Manage Permissions](#manage-permissions)
+6. [Manage Roles](#manage-roles)
+7. [Query SSO Groups](#query-sso-groups)
+8. [Manage Flows](#manage-flows)
+9. [Manage JWTs](#manage-jwts)
+
+If you wish to run any of our code samples and play with them, check out our [Code Examples](#code-examples) section.
 
-Here are some examples how to manage and authenticate users:
+If you're performing end-to-end testing, check out the [Utils for your end to end (e2e) tests and integration tests](#utils-for-your-end-to-end-e2e-tests-and-integration-tests) section. You will need to use the `descopeClient` you created under the setup of [Management Functions](#management-functions).
+
+---
 
 ### OTP Authentication
 
@@ -399,10 +446,10 @@ invalidate all user's refresh tokens. After calling this function, you must inva
 await descopeClient.logoutAll(refreshToken);
 ```
 
-## Management API
+## Management Functions
 
 It is very common for some form of management or automation to be required. These can be performed
-using the management API. Please note that these actions are more sensitive as they are administrative
+using the management functions. Please note that these actions are more sensitive as they are administrative
 in nature. Please use responsibly.
 
 ### Setup
@@ -511,6 +558,20 @@ usersRes.data.forEach((user) => {
 });
 ```
 
+#### Set or Expire User Password
+
+You can set or expire a user's password.
+Note: When setting a password, it will automatically be set as expired.
+The user will not be able log-in using an expired password, and will be required replace it on next login.
+
+```typescript
+// Set a user's password
+await descopeClient.management.user.setPassword('<login-ID>', '<some-password>');
+
+// Or alternatively, expire a user password
+await descopeClient.management.user.expirePassword('<login-ID>');
+```
+
 ### Manage Access Keys
 
 You can create, update, delete or load access keys, as well as search according to filters:
@@ -572,7 +633,7 @@ await descopeClient.management.sso.configureMetadata(tenantID, 'https://idp.com/
 // This function overrides any previous mapping (even when empty). Use carefully.
 await descopeClient.management.sso.configureMapping(
    tenantId,
-   { groups: ['IDP_ADMIN'], role: 'Tenant Admin'}
+   [{ groups: ['IDP_ADMIN'], roleName: 'Tenant Admin'}]
    { name: 'IDP_NAME', phoneNumber: 'IDP_PHONE'},
 )
 ```
@@ -585,6 +646,9 @@ Certifcate contents
 -----END CERTIFICATE-----
 ```
 
+// You can delete SSO settings for a specific tenant ID
+await descopeClient.management.sso.deleteSettings("tenant-id")
+
 ### Manage Permissions
 
 You can create, update, delete or load permissions:
@@ -796,6 +860,27 @@ of the SDK.
    npm start
    ```
 
+## Providing Custom Public Key
+
+By default, the SDK will download the public key from Descope's servers. You can also provide your own public key. This is useful when the server you are running the SDK on does not have access to the internet.
+
+You can find your public key in the `https://api.descope.com/v2/keys/<project-id>` endpoint. For further information, please see the [Descope Documentation and API reference page](https://docs.descope.com/api/openapi/sessiongetkeys/operation/GetKeysV2).
+
+To provide your own public key, you can do so by providing the `publicKey` option when initializing the SDK:
+
+```typescript
+import DescopeClient from '@descope/node-sdk';
+
+const descopeClient = DescopeClient({
+  projectId: 'my-project-ID',
+  publicKey: '{"alg":"RS256", ... }',
+});
+
+// The public key will be used when validating jwt
+const sessionJWt = '<session-jwt>';
+await descopeClient.validateJwt(sessionJWt);
+```
+
 ## Learn More
 
 To learn more please see the [Descope Documentation and API reference page](https://docs.descope.com/).

package/dist/cjs/index.cjs.js

@@ -1,2 +1,2 @@
-"use strict";var e=require("tslib"),t=require("@descope/core-js-sdk"),s=require("jose"),n=require("node-fetch-commonjs");function o(e){return e&&"object"==typeof e&&"default"in e?e:{default:e}}var a=o(t),r=o(n);const i=t=>async(...s)=>{var n,o,a;const r=await t(...s);if(!r.data)return r;let i=r.data,{refreshJwt:l}=i,p=e.__rest(i,["refreshJwt"]);const d=[];var m;return l?d.push(`${"DSR"}=${l}; Domain=${(null==(m=p)?void 0:m.cookieDomain)||""}; Max-Age=${(null==m?void 0:m.cookieMaxAge)||""}; Path=${(null==m?void 0:m.cookiePath)||"/"}; HttpOnly; SameSite=Strict`):(null===(n=r.response)||void 0===n?void 0:n.headers.get("set-cookie"))&&(l=((e,t)=>{const s=null==e?void 0:e.match(RegExp(`(?:^|;\\s*)${t}=([^;]*)`));return s?s[1]:null})(null===(o=r.response)||void 0===o?void 0:o.headers.get("set-cookie"),"DSR"),d.push(null===(a=r.response)||void 0===a?void 0:a.headers.get("set-cookie"))),Object.assign(Object.assign({},r),{data:Object.assign(Object.assign({},r.data),{refreshJwt:l,cookies:d})})};function l(e,t,s){var n,o;const a=s?null===(o=null===(n=e.token.tenants)||void 0===n?void 0:n[s])||void 0===o?void 0:o[t]:e.token[t];return Array.isArray(a)?a:[]}var p={create:"/v1/mgmt/user/create",update:"/v1/mgmt/user/update",delete:"/v1/mgmt/user/delete",deleteAllTestUsers:"/v1/mgmt/user/test/delete/all",load:"/v1/mgmt/user",search:"/v1/mgmt/user/search",updateStatus:"/v1/mgmt/user/update/status",updateEmail:"/v1/mgmt/user/update/email",updatePhone:"/v1/mgmt/user/update/phone",updateDisplayName:"/v1/mgmt/user/update/name",updatePicture:"/v1/mgmt/user/update/picture",updateCustomAttribute:"/v1/mgmt/user/update/customAttribute",addRole:"/v1/mgmt/user/update/role/add",removeRole:"/v1/mgmt/user/update/role/remove",addTenant:"/v1/mgmt/user/update/tenant/add",removeTenant:"/v1/mgmt/user/update/tenant/remove",generateOTPForTest:"/v1/mgmt/tests/generate/otp",generateMagicLinkForTest:"/v1/mgmt/tests/generate/magiclink",generateEnchantedLinkForTest:"/v1/mgmt/tests/generate/enchantedlink"},d={create:"/v1/mgmt/accesskey/create",load:"/v1/mgmt/accesskey",search:"/v1/mgmt/accesskey/search",update:"/v1/mgmt/accesskey/update",deactivate:"/v1/mgmt/accesskey/deactivate",activate:"/v1/mgmt/accesskey/activate",delete:"/v1/mgmt/accesskey/delete"},m={create:"/v1/mgmt/tenant/create",update:"/v1/mgmt/tenant/update",delete:"/v1/mgmt/tenant/delete",loadAll:"/v1/mgmt/tenant/all"},u={settings:"/v1/mgmt/sso/settings",metadata:"/v1/mgmt/sso/metadata",mapping:"/v1/mgmt/sso/mapping"},c={update:"/v1/mgmt/jwt/update"},g={create:"/v1/mgmt/permission/create",update:"/v1/mgmt/permission/update",delete:"/v1/mgmt/permission/delete",loadAll:"/v1/mgmt/permission/all"},h={create:"/v1/mgmt/role/create",update:"/v1/mgmt/role/update",delete:"/v1/mgmt/role/delete",loadAll:"/v1/mgmt/role/all"},v={export:"/v1/mgmt/flow/export",import:"/v1/mgmt/flow/import"},f={export:"/v1/mgmt/theme/export",import:"/v1/mgmt/theme/import"},k={loadAllGroups:"/v1/mgmt/group/all",loadAllGroupsForMember:"/v1/mgmt/group/member/all",loadAllGroupMembers:"/v1/mgmt/group/members"};const R=(e,s)=>({create:(n,o,a,r,i,l,d,m)=>t.transformResponse(e.httpClient.post(p.create,{loginId:n,email:o,phone:a,displayName:r,roleNames:i,userTenants:l,customAttributes:d,picture:m},{token:s}),(e=>e.user)),createTestUser:(n,o,a,r,i,l,d,m)=>t.transformResponse(e.httpClient.post(p.create,{loginId:n,email:o,phone:a,displayName:r,roleNames:i,userTenants:l,test:!0,customAttributes:d,picture:m},{token:s}),(e=>e.user)),invite:(n,o,a,r,i,l,d,m)=>t.transformResponse(e.httpClient.post(p.create,{loginId:n,email:o,phone:a,displayName:r,roleNames:i,userTenants:l,invite:!0,customAttributes:d,picture:m},{token:s}),(e=>e.user)),update:(n,o,a,r,i,l,d,m)=>t.transformResponse(e.httpClient.post(p.update,{loginId:n,email:o,phone:a,displayName:r,roleNames:i,userTenants:l,customAttributes:d,picture:m},{token:s}),(e=>e.user)),delete:n=>t.transformResponse(e.httpClient.post(p.delete,{loginId:n},{token:s})),deleteAllTestUsers:()=>t.transformResponse(e.httpClient.delete(p.deleteAllTestUsers,{},{token:s})),load:n=>t.transformResponse(e.httpClient.get(p.load,{queryParams:{loginId:n},token:s}),(e=>e.user)),loadByUserId:n=>t.transformResponse(e.httpClient.get(p.load,{queryParams:{userId:n},token:s}),(e=>e.user)),searchAll:(n,o,a,r,i,l,d)=>t.transformResponse(e.httpClient.post(p.search,{tenantIds:n,roleNames:o,limit:a,page:r,testUsersOnly:i,withTestUser:l,customAttributes:d},{token:s}),(e=>e.users)),activate:n=>t.transformResponse(e.httpClient.post(p.updateStatus,{loginId:n,status:"enabled"},{token:s}),(e=>e.user)),deactivate:n=>t.transformResponse(e.httpClient.post(p.updateStatus,{loginId:n,status:"disabled"},{token:s}),(e=>e.user)),updateEmail:(n,o,a)=>t.transformResponse(e.httpClient.post(p.updateEmail,{loginId:n,email:o,verified:a},{token:s}),(e=>e.user)),updatePhone:(n,o,a)=>t.transformResponse(e.httpClient.post(p.updatePhone,{loginId:n,phone:o,verified:a},{token:s}),(e=>e.user)),updateDisplayName:(n,o)=>t.transformResponse(e.httpClient.post(p.updateDisplayName,{loginId:n,displayName:o},{token:s}),(e=>e.user)),updatePicture:(n,o)=>t.transformResponse(e.httpClient.post(p.updatePicture,{loginId:n,picture:o},{token:s}),(e=>e.user)),updateCustomAttribute:(n,o,a)=>t.transformResponse(e.httpClient.post(p.updateCustomAttribute,{loginId:n,attributeKey:o,attributeValue:a},{token:s}),(e=>e.user)),addRoles:(n,o)=>t.transformResponse(e.httpClient.post(p.addRole,{loginId:n,roleNames:o},{token:s}),(e=>e.user)),removeRoles:(n,o)=>t.transformResponse(e.httpClient.post(p.removeRole,{loginId:n,roleNames:o},{token:s}),(e=>e.user)),addTenant:(n,o)=>t.transformResponse(e.httpClient.post(p.addTenant,{loginId:n,tenantId:o},{token:s}),(e=>e.user)),removeTenant:(n,o)=>t.transformResponse(e.httpClient.post(p.removeTenant,{loginId:n,tenantId:o},{token:s}),(e=>e.user)),addTenantRoles:(n,o,a)=>t.transformResponse(e.httpClient.post(p.addRole,{loginId:n,tenantId:o,roleNames:a},{token:s}),(e=>e.user)),removeTenantRoles:(n,o,a)=>t.transformResponse(e.httpClient.post(p.removeRole,{loginId:n,tenantId:o,roleNames:a},{token:s}),(e=>e.user)),generateOTPForTestUser:(n,o)=>t.transformResponse(e.httpClient.post(p.generateOTPForTest,{deliveryMethod:n,loginId:o},{token:s}),(e=>e)),generateMagicLinkForTestUser:(n,o,a)=>t.transformResponse(e.httpClient.post(p.generateMagicLinkForTest,{deliveryMethod:n,loginId:o,URI:a},{token:s}),(e=>e)),generateEnchantedLinkForTestUser:(n,o)=>t.transformResponse(e.httpClient.post(p.generateEnchantedLinkForTest,{loginId:n,URI:o},{token:s}),(e=>e))}),y=(e,s)=>({create:(n,o)=>t.transformResponse(e.httpClient.post(m.create,{name:n,selfProvisioningDomains:o},{token:s})),createWithId:(n,o,a)=>t.transformResponse(e.httpClient.post(m.create,{id:n,name:o,selfProvisioningDomains:a},{token:s})),update:(n,o,a)=>t.transformResponse(e.httpClient.post(m.update,{id:n,name:o,selfProvisioningDomains:a},{token:s})),delete:n=>t.transformResponse(e.httpClient.post(m.delete,{id:n},{token:s})),loadAll:()=>t.transformResponse(e.httpClient.get(m.loadAll,{token:s}),(e=>e.tenants))}),C=(e,s)=>({update:(n,o)=>t.transformResponse(e.httpClient.post(c.update,{jwt:n,customClaims:o},{token:s}))}),w=(e,s)=>({create:(n,o)=>t.transformResponse(e.httpClient.post(g.create,{name:n,description:o},{token:s})),update:(n,o,a)=>t.transformResponse(e.httpClient.post(g.update,{name:n,newName:o,description:a},{token:s})),delete:n=>t.transformResponse(e.httpClient.post(g.delete,{name:n},{token:s})),loadAll:()=>t.transformResponse(e.httpClient.get(g.loadAll,{token:s}),(e=>e.permissions))}),I=(e,s)=>({create:(n,o,a)=>t.transformResponse(e.httpClient.post(h.create,{name:n,description:o,permissionNames:a},{token:s})),update:(n,o,a,r)=>t.transformResponse(e.httpClient.post(h.update,{name:n,newName:o,description:a,permissionNames:r},{token:s})),delete:n=>t.transformResponse(e.httpClient.post(h.delete,{name:n},{token:s})),loadAll:()=>t.transformResponse(e.httpClient.get(h.loadAll,{token:s}),(e=>e.roles))}),b=(e,s)=>({loadAllGroups:n=>t.transformResponse(e.httpClient.post(k.loadAllGroups,{tenantId:n},{token:s})),loadAllGroupsForMember:(n,o,a)=>t.transformResponse(e.httpClient.post(k.loadAllGroupsForMember,{tenantId:n,loginIds:a,userIds:o},{token:s})),loadAllGroupMembers:(n,o)=>t.transformResponse(e.httpClient.post(k.loadAllGroupMembers,{tenantId:n,groupId:o},{token:s}))}),T=(e,s)=>({getSettings:n=>t.transformResponse(e.httpClient.get(u.settings,{queryParams:{tenantId:n},token:s}),(e=>e)),configureSettings:(n,o,a,r,i,l)=>t.transformResponse(e.httpClient.post(u.settings,{tenantId:n,idpURL:o,entityId:r,idpCert:a,redirectURL:i,domain:l},{token:s})),configureMetadata:(n,o)=>t.transformResponse(e.httpClient.post(u.metadata,{tenantId:n,idpMetadataURL:o},{token:s})),configureMapping:(n,o,a)=>t.transformResponse(e.httpClient.post(u.mapping,{tenantId:n,roleMapping:o,attributeMapping:a},{token:s}))}),A=(e,s)=>({create:(n,o,a,r)=>t.transformResponse(e.httpClient.post(d.create,{name:n,expireTime:o,roleNames:a,keyTenants:r},{token:s})),load:n=>t.transformResponse(e.httpClient.get(d.load,{queryParams:{id:n},token:s}),(e=>e.key)),searchAll:n=>t.transformResponse(e.httpClient.post(d.search,{tenantIds:n},{token:s}),(e=>e.keys)),update:(n,o)=>t.transformResponse(e.httpClient.post(d.update,{id:n,name:o},{token:s}),(e=>e.key)),deactivate:n=>t.transformResponse(e.httpClient.post(d.deactivate,{id:n},{token:s})),activate:n=>t.transformResponse(e.httpClient.post(d.activate,{id:n},{token:s})),delete:n=>t.transformResponse(e.httpClient.post(d.delete,{id:n},{token:s}))}),j=(e,s)=>({export:n=>t.transformResponse(e.httpClient.post(v.export,{flowId:n},{token:s})),import:(n,o,a)=>t.transformResponse(e.httpClient.post(v.import,{flowId:n,flow:o,screens:a},{token:s}))}),x=(e,s)=>({export:()=>t.transformResponse(e.httpClient.post(f.export,{},{token:s})),import:n=>t.transformResponse(e.httpClient.post(f.import,{theme:n},{token:s}))});var N;null!==(N=globalThis.Headers)&&void 0!==N||(globalThis.Headers=n.Headers);const P=(...e)=>(e.forEach((e=>{var t,s;e&&(null!==(t=(s=e).highWaterMark)&&void 0!==t||(s.highWaterMark=31457280))})),r.default(...e)),M=n=>{var o,{managementKey:r}=n,p=e.__rest(n,["managementKey"]);const d=a.default(Object.assign(Object.assign({},p),{fetch:P,baseHeaders:Object.assign(Object.assign({},p.baseHeaders),{"x-descope-sdk-name":"nodejs","x-descope-sdk-node-version":(null===(o=null===process||void 0===process?void 0:process.versions)||void 0===o?void 0:o.node)||"","x-descope-sdk-version":"1.5.0"})})),{projectId:m,logger:u}=p,c={},g=((e,t)=>({user:R(e,t),accessKey:A(e,t),tenant:y(e,t),sso:T(e,t),jwt:C(e,t),permission:w(e,t),role:I(e,t),group:b(e,t),flow:j(e,t),theme:x(e,t)}))(d,r),h=Object.assign(Object.assign({},d),{management:g,async getKey(e){if(!(null==e?void 0:e.kid))throw Error("header.kid must not be empty");if(c[e.kid])return c[e.kid];if(Object.assign(c,await(async()=>{const e=(await d.httpClient.get(`v2/keys/${m}`).then((e=>e.json()))).keys;return Array.isArray(e)?(await Promise.all(e.map((async e=>[e.kid,await s.importJWK(e)])))).reduce(((e,[t,s])=>t?Object.assign(Object.assign({},e),{[t.toString()]:s}):e),{}):{}})()),!c[e.kid])throw Error("failed to fetch matching key");return c[e.kid]},async validateJwt(e){var t;const n=(await s.jwtVerify(e,h.getKey,{clockTolerance:5})).payload;if(n&&(n.iss=null===(t=n.iss)||void 0===t?void 0:t.split("/").pop(),n.iss!==m))throw new s.errors.JWTClaimValidationFailed('unexpected "iss" claim value',"iss","check_failed");return{jwt:e,token:n}},async validateSession(e){if(!e)throw Error("session token is required for validation");try{return await h.validateJwt(e)}catch(e){throw null==u||u.error("session validation failed",e),Error("session validation failed")}},async refreshSession(e){var t,s;if(!e)throw Error("refresh token is required to refresh a session");try{await h.validateJwt(e);const n=await h.refresh(e);if(n.ok){return await h.validateJwt(null===(t=n.data)||void 0===t?void 0:t.sessionJwt)}throw Error(null===(s=n.error)||void 0===s?void 0:s.errorMessage)}catch(e){throw null==u||u.error("refresh token validation failed",e),Error("refresh token validation failed")}},async validateAndRefreshSession(e,t){if(!e&&!t)throw Error("both session and refresh tokens are empty");try{return await h.validateSession(e)}catch(e){null==u||u.log("session validation failed - trying to refresh it")}return h.refreshSession(t)},async exchangeAccessKey(e){if(!e)throw Error("access key must not be empty");let t;try{t=await h.accessKey.exchange(e)}catch(e){throw null==u||u.error("failed to exchange access key",e),Error("could not exchange access key")}const{sessionJwt:s}=t.data;if(!s)throw null==u||u.error("failed to parse exchange access key response"),Error("could not exchange access key");try{return await h.validateJwt(s)}catch(e){throw null==u||u.error("failed to parse jwt from access key",e),Error("could not exchange access key")}},validatePermissions:(e,t)=>h.validateTenantPermissions(e,null,t),validateTenantPermissions(e,t,s){const n=l(e,"permissions",t);return s.every((e=>n.includes(e)))},validateRoles:(e,t)=>h.validateTenantRoles(e,null,t),validateTenantRoles(e,t,s){const n=l(e,"roles",t);return s.every((e=>n.includes(e)))}});return t.wrapWith(h,["otp.verify.email","otp.verify.sms","otp.verify.whatsapp","magicLink.verify","enchantedLink.signUp","enchantedLink.signIn","oauth.exchange","saml.exchange","totp.verify","webauthn.signIn.finish","webauthn.signUp.finish","refresh"],i)};M.RefreshTokenCookieName="DSR",M.SessionTokenCookieName="DS",module.exports=M;
+"use strict";var e=require("tslib"),t=require("@descope/core-js-sdk"),s=require("jose"),o=require("node-fetch-commonjs");function n(e){return e&&"object"==typeof e&&"default"in e?e:{default:e}}var r=n(t),a=n(o);const i=t=>async(...s)=>{var o,n,r;const a=await t(...s);if(!a.data)return a;let i=a.data,{refreshJwt:l}=i,p=e.__rest(i,["refreshJwt"]);const d=[];var m;return l?d.push(`${"DSR"}=${l}; Domain=${(null==(m=p)?void 0:m.cookieDomain)||""}; Max-Age=${(null==m?void 0:m.cookieMaxAge)||""}; Path=${(null==m?void 0:m.cookiePath)||"/"}; HttpOnly; SameSite=Strict`):(null===(o=a.response)||void 0===o?void 0:o.headers.get("set-cookie"))&&(l=((e,t)=>{const s=null==e?void 0:e.match(RegExp(`(?:^|;\\s*)${t}=([^;]*)`));return s?s[1]:null})(null===(n=a.response)||void 0===n?void 0:n.headers.get("set-cookie"),"DSR"),d.push(null===(r=a.response)||void 0===r?void 0:r.headers.get("set-cookie"))),Object.assign(Object.assign({},a),{data:Object.assign(Object.assign({},a.data),{refreshJwt:l,cookies:d})})};function l(e,t,s){var o,n;const r=s?null===(n=null===(o=e.token.tenants)||void 0===o?void 0:o[s])||void 0===n?void 0:n[t]:e.token[t];return Array.isArray(r)?r:[]}var p={create:"/v1/mgmt/user/create",update:"/v1/mgmt/user/update",delete:"/v1/mgmt/user/delete",deleteAllTestUsers:"/v1/mgmt/user/test/delete/all",load:"/v1/mgmt/user",search:"/v1/mgmt/user/search",getProviderToken:"/v1/mgmt/user/provider/token",updateStatus:"/v1/mgmt/user/update/status",updateEmail:"/v1/mgmt/user/update/email",updatePhone:"/v1/mgmt/user/update/phone",updateDisplayName:"/v1/mgmt/user/update/name",updatePicture:"/v1/mgmt/user/update/picture",updateCustomAttribute:"/v1/mgmt/user/update/customAttribute",addRole:"/v1/mgmt/user/update/role/add",removeRole:"/v1/mgmt/user/update/role/remove",addTenant:"/v1/mgmt/user/update/tenant/add",removeTenant:"/v1/mgmt/user/update/tenant/remove",setPassword:"/v1/mgmt/user/password/set",expirePassword:"/v1/mgmt/user/password/expire",generateOTPForTest:"/v1/mgmt/tests/generate/otp",generateMagicLinkForTest:"/v1/mgmt/tests/generate/magiclink",generateEnchantedLinkForTest:"/v1/mgmt/tests/generate/enchantedlink"},d={create:"/v1/mgmt/accesskey/create",load:"/v1/mgmt/accesskey",search:"/v1/mgmt/accesskey/search",update:"/v1/mgmt/accesskey/update",deactivate:"/v1/mgmt/accesskey/deactivate",activate:"/v1/mgmt/accesskey/activate",delete:"/v1/mgmt/accesskey/delete"},m={create:"/v1/mgmt/tenant/create",update:"/v1/mgmt/tenant/update",delete:"/v1/mgmt/tenant/delete",loadAll:"/v1/mgmt/tenant/all"},u={settings:"/v1/mgmt/sso/settings",metadata:"/v1/mgmt/sso/metadata",mapping:"/v1/mgmt/sso/mapping"},c={update:"/v1/mgmt/jwt/update"},g={create:"/v1/mgmt/permission/create",update:"/v1/mgmt/permission/update",delete:"/v1/mgmt/permission/delete",loadAll:"/v1/mgmt/permission/all"},h={create:"/v1/mgmt/role/create",update:"/v1/mgmt/role/update",delete:"/v1/mgmt/role/delete",loadAll:"/v1/mgmt/role/all"},v={export:"/v1/mgmt/flow/export",import:"/v1/mgmt/flow/import"},k={export:"/v1/mgmt/theme/export",import:"/v1/mgmt/theme/import"},f={loadAllGroups:"/v1/mgmt/group/all",loadAllGroupsForMember:"/v1/mgmt/group/member/all",loadAllGroupMembers:"/v1/mgmt/group/members"};const y=(e,s)=>({create:(o,n,r,a,i,l,d,m)=>t.transformResponse(e.httpClient.post(p.create,{loginId:o,email:n,phone:r,displayName:a,roleNames:i,userTenants:l,customAttributes:d,picture:m},{token:s}),(e=>e.user)),createTestUser:(o,n,r,a,i,l,d,m)=>t.transformResponse(e.httpClient.post(p.create,{loginId:o,email:n,phone:r,displayName:a,roleNames:i,userTenants:l,test:!0,customAttributes:d,picture:m},{token:s}),(e=>e.user)),invite:(o,n,r,a,i,l,d,m)=>t.transformResponse(e.httpClient.post(p.create,{loginId:o,email:n,phone:r,displayName:a,roleNames:i,userTenants:l,invite:!0,customAttributes:d,picture:m},{token:s}),(e=>e.user)),update:(o,n,r,a,i,l,d,m)=>t.transformResponse(e.httpClient.post(p.update,{loginId:o,email:n,phone:r,displayName:a,roleNames:i,userTenants:l,customAttributes:d,picture:m},{token:s}),(e=>e.user)),delete:o=>t.transformResponse(e.httpClient.post(p.delete,{loginId:o},{token:s})),deleteAllTestUsers:()=>t.transformResponse(e.httpClient.delete(p.deleteAllTestUsers,{token:s})),load:o=>t.transformResponse(e.httpClient.get(p.load,{queryParams:{loginId:o},token:s}),(e=>e.user)),loadByUserId:o=>t.transformResponse(e.httpClient.get(p.load,{queryParams:{userId:o},token:s}),(e=>e.user)),searchAll:(o,n,r,a,i,l,d)=>t.transformResponse(e.httpClient.post(p.search,{tenantIds:o,roleNames:n,limit:r,page:a,testUsersOnly:i,withTestUser:l,customAttributes:d},{token:s}),(e=>e.users)),getProviderToken:(o,n)=>t.transformResponse(e.httpClient.get(p.getProviderToken,{queryParams:{loginId:o,provider:n},token:s}),(e=>e)),activate:o=>t.transformResponse(e.httpClient.post(p.updateStatus,{loginId:o,status:"enabled"},{token:s}),(e=>e.user)),deactivate:o=>t.transformResponse(e.httpClient.post(p.updateStatus,{loginId:o,status:"disabled"},{token:s}),(e=>e.user)),updateEmail:(o,n,r)=>t.transformResponse(e.httpClient.post(p.updateEmail,{loginId:o,email:n,verified:r},{token:s}),(e=>e.user)),updatePhone:(o,n,r)=>t.transformResponse(e.httpClient.post(p.updatePhone,{loginId:o,phone:n,verified:r},{token:s}),(e=>e.user)),updateDisplayName:(o,n)=>t.transformResponse(e.httpClient.post(p.updateDisplayName,{loginId:o,displayName:n},{token:s}),(e=>e.user)),updatePicture:(o,n)=>t.transformResponse(e.httpClient.post(p.updatePicture,{loginId:o,picture:n},{token:s}),(e=>e.user)),updateCustomAttribute:(o,n,r)=>t.transformResponse(e.httpClient.post(p.updateCustomAttribute,{loginId:o,attributeKey:n,attributeValue:r},{token:s}),(e=>e.user)),addRoles:(o,n)=>t.transformResponse(e.httpClient.post(p.addRole,{loginId:o,roleNames:n},{token:s}),(e=>e.user)),removeRoles:(o,n)=>t.transformResponse(e.httpClient.post(p.removeRole,{loginId:o,roleNames:n},{token:s}),(e=>e.user)),addTenant:(o,n)=>t.transformResponse(e.httpClient.post(p.addTenant,{loginId:o,tenantId:n},{token:s}),(e=>e.user)),removeTenant:(o,n)=>t.transformResponse(e.httpClient.post(p.removeTenant,{loginId:o,tenantId:n},{token:s}),(e=>e.user)),addTenantRoles:(o,n,r)=>t.transformResponse(e.httpClient.post(p.addRole,{loginId:o,tenantId:n,roleNames:r},{token:s}),(e=>e.user)),removeTenantRoles:(o,n,r)=>t.transformResponse(e.httpClient.post(p.removeRole,{loginId:o,tenantId:n,roleNames:r},{token:s}),(e=>e.user)),generateOTPForTestUser:(o,n)=>t.transformResponse(e.httpClient.post(p.generateOTPForTest,{deliveryMethod:o,loginId:n},{token:s}),(e=>e)),generateMagicLinkForTestUser:(o,n,r)=>t.transformResponse(e.httpClient.post(p.generateMagicLinkForTest,{deliveryMethod:o,loginId:n,URI:r},{token:s}),(e=>e)),generateEnchantedLinkForTestUser:(o,n)=>t.transformResponse(e.httpClient.post(p.generateEnchantedLinkForTest,{loginId:o,URI:n},{token:s}),(e=>e)),setPassword:(o,n)=>t.transformResponse(e.httpClient.post(p.setPassword,{loginId:o,password:n},{token:s}),(e=>e)),expirePassword:o=>t.transformResponse(e.httpClient.post(p.expirePassword,{loginId:o},{token:s}),(e=>e))}),R=(e,s)=>({create:(o,n)=>t.transformResponse(e.httpClient.post(m.create,{name:o,selfProvisioningDomains:n},{token:s})),createWithId:(o,n,r)=>t.transformResponse(e.httpClient.post(m.create,{id:o,name:n,selfProvisioningDomains:r},{token:s})),update:(o,n,r)=>t.transformResponse(e.httpClient.post(m.update,{id:o,name:n,selfProvisioningDomains:r},{token:s})),delete:o=>t.transformResponse(e.httpClient.post(m.delete,{id:o},{token:s})),loadAll:()=>t.transformResponse(e.httpClient.get(m.loadAll,{token:s}),(e=>e.tenants))}),C=(e,s)=>({update:(o,n)=>t.transformResponse(e.httpClient.post(c.update,{jwt:o,customClaims:n},{token:s}))}),w=(e,s)=>({create:(o,n)=>t.transformResponse(e.httpClient.post(g.create,{name:o,description:n},{token:s})),update:(o,n,r)=>t.transformResponse(e.httpClient.post(g.update,{name:o,newName:n,description:r},{token:s})),delete:o=>t.transformResponse(e.httpClient.post(g.delete,{name:o},{token:s})),loadAll:()=>t.transformResponse(e.httpClient.get(g.loadAll,{token:s}),(e=>e.permissions))}),I=(e,s)=>({create:(o,n,r)=>t.transformResponse(e.httpClient.post(h.create,{name:o,description:n,permissionNames:r},{token:s})),update:(o,n,r,a)=>t.transformResponse(e.httpClient.post(h.update,{name:o,newName:n,description:r,permissionNames:a},{token:s})),delete:o=>t.transformResponse(e.httpClient.post(h.delete,{name:o},{token:s})),loadAll:()=>t.transformResponse(e.httpClient.get(h.loadAll,{token:s}),(e=>e.roles))}),b=(e,s)=>({loadAllGroups:o=>t.transformResponse(e.httpClient.post(f.loadAllGroups,{tenantId:o},{token:s})),loadAllGroupsForMember:(o,n,r)=>t.transformResponse(e.httpClient.post(f.loadAllGroupsForMember,{tenantId:o,loginIds:r,userIds:n},{token:s})),loadAllGroupMembers:(o,n)=>t.transformResponse(e.httpClient.post(f.loadAllGroupMembers,{tenantId:o,groupId:n},{token:s}))}),T=(e,s)=>({getSettings:o=>t.transformResponse(e.httpClient.get(u.settings,{queryParams:{tenantId:o},token:s}),(e=>e)),deleteSettings:o=>t.transformResponse(e.httpClient.delete(u.settings,{queryParams:{tenantId:o},token:s})),configureSettings:(o,n,r,a,i,l)=>t.transformResponse(e.httpClient.post(u.settings,{tenantId:o,idpURL:n,entityId:a,idpCert:r,redirectURL:i,domain:l},{token:s})),configureMetadata:(o,n)=>t.transformResponse(e.httpClient.post(u.metadata,{tenantId:o,idpMetadataURL:n},{token:s})),configureMapping:(o,n,r)=>t.transformResponse(e.httpClient.post(u.mapping,{tenantId:o,roleMappings:n,attributeMapping:r},{token:s}))}),A=(e,s)=>({create:(o,n,r,a)=>t.transformResponse(e.httpClient.post(d.create,{name:o,expireTime:n,roleNames:r,keyTenants:a},{token:s})),load:o=>t.transformResponse(e.httpClient.get(d.load,{queryParams:{id:o},token:s}),(e=>e.key)),searchAll:o=>t.transformResponse(e.httpClient.post(d.search,{tenantIds:o},{token:s}),(e=>e.keys)),update:(o,n)=>t.transformResponse(e.httpClient.post(d.update,{id:o,name:n},{token:s}),(e=>e.key)),deactivate:o=>t.transformResponse(e.httpClient.post(d.deactivate,{id:o},{token:s})),activate:o=>t.transformResponse(e.httpClient.post(d.activate,{id:o},{token:s})),delete:o=>t.transformResponse(e.httpClient.post(d.delete,{id:o},{token:s}))}),P=(e,s)=>({export:o=>t.transformResponse(e.httpClient.post(v.export,{flowId:o},{token:s})),import:(o,n,r)=>t.transformResponse(e.httpClient.post(v.import,{flowId:o,flow:n,screens:r},{token:s}))}),x=(e,s)=>({export:()=>t.transformResponse(e.httpClient.post(k.export,{},{token:s})),import:o=>t.transformResponse(e.httpClient.post(k.import,{theme:o},{token:s}))});var j;null!==(j=globalThis.Headers)&&void 0!==j||(globalThis.Headers=o.Headers);const N=(...e)=>(e.forEach((e=>{var t,s;e&&(null!==(t=(s=e).highWaterMark)&&void 0!==t||(s.highWaterMark=31457280))})),a.default(...e)),E=o=>{var n,{managementKey:a,publicKey:p}=o,d=e.__rest(o,["managementKey","publicKey"]);const m=r.default(Object.assign(Object.assign({},d),{fetch:N,baseHeaders:Object.assign(Object.assign({},d.baseHeaders),{"x-descope-sdk-name":"nodejs","x-descope-sdk-node-version":(null===(n=null===process||void 0===process?void 0:process.versions)||void 0===n?void 0:n.node)||"","x-descope-sdk-version":"1.5.2"})})),{projectId:u,logger:c}=d,g={},h=((e,t)=>({user:y(e,t),accessKey:A(e,t),tenant:R(e,t),sso:T(e,t),jwt:C(e,t),permission:w(e,t),role:I(e,t),group:b(e,t),flow:P(e,t),theme:x(e,t)}))(m,a),v=Object.assign(Object.assign({},m),{management:h,async getKey(e){if(!(null==e?void 0:e.kid))throw Error("header.kid must not be empty");if(g[e.kid])return g[e.kid];if(Object.assign(g,await(async()=>{if(p)try{const e=JSON.parse(p),t=await s.importJWK(e);return{[e.kid]:t}}catch(e){throw null==c||c.error("Failed to parse the provided public key",e),new Error("Failed to parse public key")}const e=(await m.httpClient.get(`v2/keys/${u}`).then((e=>e.json()))).keys;return Array.isArray(e)?(await Promise.all(e.map((async e=>[e.kid,await s.importJWK(e)])))).reduce(((e,[t,s])=>t?Object.assign(Object.assign({},e),{[t.toString()]:s}):e),{}):{}})()),!g[e.kid])throw Error("failed to fetch matching key");return g[e.kid]},async validateJwt(e){var t;const o=(await s.jwtVerify(e,v.getKey,{clockTolerance:5})).payload;if(o&&(o.iss=null===(t=o.iss)||void 0===t?void 0:t.split("/").pop(),o.iss!==u))throw new s.errors.JWTClaimValidationFailed('unexpected "iss" claim value',"iss","check_failed");return{jwt:e,token:o}},async validateSession(e){if(!e)throw Error("session token is required for validation");try{return await v.validateJwt(e)}catch(e){throw null==c||c.error("session validation failed",e),Error("session validation failed")}},async refreshSession(e){var t,s;if(!e)throw Error("refresh token is required to refresh a session");try{await v.validateJwt(e);const o=await v.refresh(e);if(o.ok){return await v.validateJwt(null===(t=o.data)||void 0===t?void 0:t.sessionJwt)}throw Error(null===(s=o.error)||void 0===s?void 0:s.errorMessage)}catch(e){throw null==c||c.error("refresh token validation failed",e),Error("refresh token validation failed")}},async validateAndRefreshSession(e,t){if(!e&&!t)throw Error("both session and refresh tokens are empty");try{return await v.validateSession(e)}catch(e){null==c||c.log("session validation failed - trying to refresh it")}return v.refreshSession(t)},async exchangeAccessKey(e){if(!e)throw Error("access key must not be empty");let t;try{t=await v.accessKey.exchange(e)}catch(e){throw null==c||c.error("failed to exchange access key",e),Error("could not exchange access key")}const{sessionJwt:s}=t.data;if(!s)throw null==c||c.error("failed to parse exchange access key response"),Error("could not exchange access key");try{return await v.validateJwt(s)}catch(e){throw null==c||c.error("failed to parse jwt from access key",e),Error("could not exchange access key")}},validatePermissions:(e,t)=>v.validateTenantPermissions(e,null,t),validateTenantPermissions(e,t,s){const o=l(e,"permissions",t);return s.every((e=>o.includes(e)))},validateRoles:(e,t)=>v.validateTenantRoles(e,null,t),validateTenantRoles(e,t,s){const o=l(e,"roles",t);return s.every((e=>o.includes(e)))}});return t.wrapWith(v,["otp.verify.email","otp.verify.sms","otp.verify.whatsapp","magicLink.verify","enchantedLink.signUp","enchantedLink.signIn","oauth.exchange","saml.exchange","totp.verify","webauthn.signIn.finish","webauthn.signUp.finish","refresh"],i)};E.RefreshTokenCookieName="DSR",E.SessionTokenCookieName="DS",module.exports=E;
 //# sourceMappingURL=index.cjs.js.map

package/dist/cjs/index.cjs.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.cjs.js","sources":["../../lib/constants.ts","../../lib/helpers.ts","../../lib/management/paths.ts","../../lib/management/user.ts","../../lib/management/tenant.ts","../../lib/management/jwt.ts","../../lib/management/permission.ts","../../lib/management/role.ts","../../lib/management/group.ts","../../lib/management/sso.ts","../../lib/management/accesskey.ts","../../lib/management/flow.ts","../../lib/management/theme.ts","../../lib/fetch-polyfill.ts","../../lib/index.ts","../../lib/management/index.ts"],"sourcesContent":["// eslint-disable-next-line import/prefer-default-export\n/** Refresh JWT cookie name */\nexport const refreshTokenCookieName = 'DSR';\n/** Session JWT cookie name */\nexport const sessionTokenCookieName = 'DS';\n/** The key of the tenants claims in the claims map */\nexport const authorizedTenantsClaimName = 'tenants';\n/** The key of the permissions claims in the claims map either under tenant or top level */\nexport const permissionsClaimName = 'permissions';\n/** The key of the roles claims in the claims map either under tenant or top level */\nexport const rolesClaimName = 'roles';\n","import type { SdkFnWrapper } from '@descope/core-js-sdk';\nimport { authorizedTenantsClaimName, refreshTokenCookieName } from './constants';\nimport { AuthenticationInfo } from './types';\n\n/**\n * Generate a cookie string from given parameters\n * @param name name of the cookie\n * @param value value of cookie that must be already encoded\n * @param options any options to put on the cookie like cookieDomain, cookieMaxAge, cookiePath\n * @returns Cookie string with all options on the string\n */\nconst generateCookie = (name: string, value: string, options?: Record<string, string | number>) =>\n  `${name}=${value}; Domain=${options?.cookieDomain || ''}; Max-Age=${\n    options?.cookieMaxAge || ''\n  }; Path=${options?.cookiePath || '/'}; HttpOnly; SameSite=Strict`;\n\n/**\n * Parse the cookie string and return the value of the cookie\n * @param cookie the raw cookie string\n * @param name the name of the cookie to get value for\n * @returns the value of the given cookie\n */\nconst getCookieValue = (cookie: string | null | undefined, name: string) => {\n  const match = cookie?.match(RegExp(`(?:^|;\\\\s*)${name}=([^;]*)`));\n  return match ? match[1] : null;\n};\n\n// eslint-disable-next-line import/prefer-default-export\n/**\n * Add cookie generation to core-js functions.\n * @param fn the function we are wrapping\n * @returns Wrapped function with cookie generation\n */\nexport const withCookie: SdkFnWrapper<{ refreshJwt?: string; cookies?: string[] }> =\n  (fn) =>\n  async (...args) => {\n    const resp = await fn(...args);\n\n    // istanbul ignore next\n    if (!resp.data) {\n      return resp;\n    }\n\n    // eslint-disable-next-line prefer-const\n    let { refreshJwt, ...rest } = resp.data;\n    const cookies: string[] = [];\n\n    if (!refreshJwt) {\n      if (resp.response?.headers.get('set-cookie')) {\n        refreshJwt = getCookieValue(\n          resp.response?.headers.get('set-cookie'),\n          refreshTokenCookieName,\n        );\n        cookies.push(resp.response?.headers.get('set-cookie')!);\n      }\n    } else {\n      cookies.push(generateCookie(refreshTokenCookieName, refreshJwt, rest));\n    }\n\n    return { ...resp, data: { ...resp.data, refreshJwt, cookies } };\n  };\n\n/**\n * Get the claim (used for permissions or roles) for a given tenant or top level if tenant is empty\n * @param authInfo The parsed authentication info from the JWT\n * @param claim name of the claim\n * @param tenant tenant to retrieve the claim for\n * @returns\n */\nexport function getAuthorizationClaimItems(\n  authInfo: AuthenticationInfo,\n  claim: string,\n  tenant?: string,\n): string[] {\n  const value = tenant\n    ? authInfo.token[authorizedTenantsClaimName]?.[tenant]?.[claim]\n    : authInfo.token[claim];\n  return Array.isArray(value) ? value : [];\n}\n","/** API paths for the Descope service Management APIs */\nexport default {\n  user: {\n    create: '/v1/mgmt/user/create',\n    update: '/v1/mgmt/user/update',\n    delete: '/v1/mgmt/user/delete',\n    deleteAllTestUsers: '/v1/mgmt/user/test/delete/all',\n    load: '/v1/mgmt/user',\n    search: '/v1/mgmt/user/search',\n    updateStatus: '/v1/mgmt/user/update/status',\n    updateEmail: '/v1/mgmt/user/update/email',\n    updatePhone: '/v1/mgmt/user/update/phone',\n    updateDisplayName: '/v1/mgmt/user/update/name',\n    updatePicture: '/v1/mgmt/user/update/picture',\n    updateCustomAttribute: '/v1/mgmt/user/update/customAttribute',\n    addRole: '/v1/mgmt/user/update/role/add',\n    removeRole: '/v1/mgmt/user/update/role/remove',\n    addTenant: '/v1/mgmt/user/update/tenant/add',\n    removeTenant: '/v1/mgmt/user/update/tenant/remove',\n    generateOTPForTest: '/v1/mgmt/tests/generate/otp',\n    generateMagicLinkForTest: '/v1/mgmt/tests/generate/magiclink',\n    generateEnchantedLinkForTest: '/v1/mgmt/tests/generate/enchantedlink',\n  },\n  accessKey: {\n    create: '/v1/mgmt/accesskey/create',\n    load: '/v1/mgmt/accesskey',\n    search: '/v1/mgmt/accesskey/search',\n    update: '/v1/mgmt/accesskey/update',\n    deactivate: '/v1/mgmt/accesskey/deactivate',\n    activate: '/v1/mgmt/accesskey/activate',\n    delete: '/v1/mgmt/accesskey/delete',\n  },\n  tenant: {\n    create: '/v1/mgmt/tenant/create',\n    update: '/v1/mgmt/tenant/update',\n    delete: '/v1/mgmt/tenant/delete',\n    loadAll: '/v1/mgmt/tenant/all',\n  },\n  sso: {\n    settings: '/v1/mgmt/sso/settings',\n    metadata: '/v1/mgmt/sso/metadata',\n    mapping: '/v1/mgmt/sso/mapping',\n  },\n  jwt: {\n    update: '/v1/mgmt/jwt/update',\n  },\n  permission: {\n    create: '/v1/mgmt/permission/create',\n    update: '/v1/mgmt/permission/update',\n    delete: '/v1/mgmt/permission/delete',\n    loadAll: '/v1/mgmt/permission/all',\n  },\n  role: {\n    create: '/v1/mgmt/role/create',\n    update: '/v1/mgmt/role/update',\n    delete: '/v1/mgmt/role/delete',\n    loadAll: '/v1/mgmt/role/all',\n  },\n  flow: {\n    export: '/v1/mgmt/flow/export',\n    import: '/v1/mgmt/flow/import',\n  },\n  theme: {\n    export: '/v1/mgmt/theme/export',\n    import: '/v1/mgmt/theme/import',\n  },\n  group: {\n    loadAllGroups: '/v1/mgmt/group/all',\n    loadAllGroupsForMember: '/v1/mgmt/group/member/all',\n    loadAllGroupMembers: '/v1/mgmt/group/members',\n  },\n};\n","import { DeliveryMethod, SdkResponse, transformResponse, UserResponse } from '@descope/core-js-sdk';\nimport { CoreSdk } from '../types';\nimport apiPaths from './paths';\nimport {\n  AssociatedTenant,\n  GenerateEnchantedLinkForTestResponse,\n  GenerateMagicLinkForTestResponse,\n  GenerateOTPForTestResponse,\n  AttributesTypes,\n} from './types';\n\ntype SingleUserResponse = {\n  user: UserResponse;\n};\n\ntype MultipleUsersResponse = {\n  users: UserResponse[];\n};\n\nconst withUser = (sdk: CoreSdk, managementKey?: string) => ({\n  create: (\n    loginId: string,\n    email?: string,\n    phone?: string,\n    displayName?: string,\n    roles?: string[],\n    userTenants?: AssociatedTenant[],\n    customAttributes?: Record<string, AttributesTypes>,\n    picture?: string,\n  ): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.create,\n        {\n          loginId,\n          email,\n          phone,\n          displayName,\n          roleNames: roles,\n          userTenants,\n          customAttributes,\n          picture,\n        },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  /**\n   * Create a new test user.\n   * The loginID is required and will determine what the user will use to sign in.\n   * Make sure the login id is unique for test. All other fields are optional.\n   *\n   * You can later generate OTP, Magic link and enchanted link to use in the test without the need\n   * of 3rd party messaging services.\n   * Those users are not counted as part of the monthly active users\n   * @returns The UserResponse if found, throws otherwise.\n   */\n  createTestUser: (\n    loginId: string,\n    email?: string,\n    phone?: string,\n    displayName?: string,\n    roles?: string[],\n    userTenants?: AssociatedTenant[],\n    customAttributes?: Record<string, AttributesTypes>,\n    picture?: string,\n  ): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.create,\n        {\n          loginId,\n          email,\n          phone,\n          displayName,\n          roleNames: roles,\n          userTenants,\n          test: true,\n          customAttributes,\n          picture,\n        },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  invite: (\n    loginId: string,\n    email?: string,\n    phone?: string,\n    displayName?: string,\n    roles?: string[],\n    userTenants?: AssociatedTenant[],\n    customAttributes?: Record<string, AttributesTypes>,\n    picture?: string,\n  ): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.create,\n        {\n          loginId,\n          email,\n          phone,\n          displayName,\n          roleNames: roles,\n          userTenants,\n          invite: true,\n          customAttributes,\n          picture,\n        },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  update: (\n    loginId: string,\n    email?: string,\n    phone?: string,\n    displayName?: string,\n    roles?: string[],\n    userTenants?: AssociatedTenant[],\n    customAttributes?: Record<string, AttributesTypes>,\n    picture?: string,\n  ): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.update,\n        {\n          loginId,\n          email,\n          phone,\n          displayName,\n          roleNames: roles,\n          userTenants,\n          customAttributes,\n          picture,\n        },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  delete: (loginId: string): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(apiPaths.user.delete, { loginId }, { token: managementKey }),\n    ),\n  /**\n   * Delete all test users in the project.\n   */\n  deleteAllTestUsers: (): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.delete(apiPaths.user.deleteAllTestUsers, {}, { token: managementKey }),\n    ),\n  load: (loginId: string): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.get(apiPaths.user.load, {\n        queryParams: { loginId },\n        token: managementKey,\n      }),\n      (data) => data.user,\n    ),\n  /**\n   * Load an existing user by user ID. The ID can be found\n   * on the user's JWT.\n   * @param userId load a user by this user ID field\n   * @returns The UserResponse if found, throws otherwise.\n   */\n  loadByUserId: (userId: string): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.get(apiPaths.user.load, {\n        queryParams: { userId },\n        token: managementKey,\n      }),\n      (data) => data.user,\n    ),\n  /**\n   * Search all users. Results can be filtered according to tenants and/or\n   * roles, and also paginated used the limit and page parameters.\n   * @param tenantIds optional list of tenant IDs to filter by\n   * @param roles optional list of roles to filter by\n   * @param limit optionally limit the response, leave out for default limit\n   * @param page optionally paginate over the response\n   * @param testUsersOnly optionally filter only test users\n   * @param withTestUser optionally include test users in search\n   * @returns An array of UserResponse found by the query\n   */\n  searchAll: (\n    tenantIds?: string[],\n    roles?: string[],\n    limit?: number,\n    page?: number,\n    testUsersOnly?: boolean,\n    withTestUser?: boolean,\n    customAttributes?: Record<string, AttributesTypes>,\n  ): Promise<SdkResponse<UserResponse[]>> =>\n    transformResponse<MultipleUsersResponse, UserResponse[]>(\n      sdk.httpClient.post(\n        apiPaths.user.search,\n        { tenantIds, roleNames: roles, limit, page, testUsersOnly, withTestUser, customAttributes },\n        { token: managementKey },\n      ),\n      (data) => data.users,\n    ),\n  activate: (loginId: string): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.updateStatus,\n        { loginId, status: 'enabled' },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  deactivate: (loginId: string): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.updateStatus,\n        { loginId, status: 'disabled' },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  updateEmail: (\n    loginId: string,\n    email: string,\n    isVerified: boolean,\n  ): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.updateEmail,\n        { loginId, email, verified: isVerified },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  updatePhone: (\n    loginId: string,\n    phone: string,\n    isVerified: boolean,\n  ): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.updatePhone,\n        { loginId, phone, verified: isVerified },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  updateDisplayName: (loginId: string, displayName: string): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.updateDisplayName,\n        { loginId, displayName },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  updatePicture: (loginId: string, picture: string): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.updatePicture,\n        { loginId, picture },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  updateCustomAttribute: (\n    loginId: string,\n    attributeKey: string,\n    attributeValue: AttributesTypes,\n  ): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.updateCustomAttribute,\n        { loginId, attributeKey, attributeValue },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  addRoles: (loginId: string, roles: string[]): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.addRole,\n        { loginId, roleNames: roles },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  removeRoles: (loginId: string, roles: string[]): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.removeRole,\n        { loginId, roleNames: roles },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  addTenant: (loginId: string, tenantId: string): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(apiPaths.user.addTenant, { loginId, tenantId }, { token: managementKey }),\n      (data) => data.user,\n    ),\n  removeTenant: (loginId: string, tenantId: string): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.removeTenant,\n        { loginId, tenantId },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  addTenantRoles: (\n    loginId: string,\n    tenantId: string,\n    roles: string[],\n  ): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.addRole,\n        { loginId, tenantId, roleNames: roles },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  removeTenantRoles: (\n    loginId: string,\n    tenantId: string,\n    roles: string[],\n  ): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.removeRole,\n        { loginId, tenantId, roleNames: roles },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n\n  /**\n   * Generate OTP for the given login ID of a test user.\n   * Choose the selected delivery method for verification.\n   * Returns the code for the login (exactly as it sent via Email or SMS)\n   * This is useful when running tests and don't want to use 3rd party messaging services\n   *\n   * @param deliveryMethod optional DeliveryMethod\n   * @param loginId login ID of a test user\n   * @returns GenerateOTPForTestResponse which includes the loginId and the OTP code\n   */\n  generateOTPForTestUser: (\n    deliveryMethod: DeliveryMethod,\n    loginId: string,\n  ): Promise<SdkResponse<GenerateOTPForTestResponse>> =>\n    transformResponse<GenerateOTPForTestResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.generateOTPForTest,\n        { deliveryMethod, loginId },\n        { token: managementKey },\n      ),\n      (data) => data,\n    ),\n\n  /**\n   * Generate Magic Link for the given login ID of a test user.\n   * Choose the selected delivery method for verification.\n   * It returns the link for the login (exactly as it sent via Email)\n   * This is useful when running tests and don't want to use 3rd party messaging services\n   *\n   * @param deliveryMethod optional DeliveryMethod\n   * @param loginId login ID of a test user\n   * @param uri optional redirect uri which will be used instead of any global configuration.\n   * @returns GenerateMagicLinkForTestResponse which includes the loginId and the magic link\n   */\n  generateMagicLinkForTestUser: (\n    deliveryMethod: DeliveryMethod,\n    loginId: string,\n    uri: string,\n  ): Promise<SdkResponse<GenerateMagicLinkForTestResponse>> =>\n    transformResponse<GenerateMagicLinkForTestResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.generateMagicLinkForTest,\n        { deliveryMethod, loginId, URI: uri },\n        { token: managementKey },\n      ),\n      (data) => data,\n    ),\n\n  /**\n   * Generate Enchanted Link for the given login ID of a test user.\n   * It returns the link for the login (exactly as it sent via Email)\n   * and pendingRef which is used to poll for a valid session\n   * This is useful when running tests and don't want to use 3rd party messaging services\n   *\n   * @param loginId login ID of a test user\n   * @param uri optional redirect uri which will be used instead of any global configuration.\n   * @returns GenerateEnchantedLinkForTestResponse which includes the loginId, the enchanted link and the pendingRef\n   */\n  generateEnchantedLinkForTestUser: (\n    loginId: string,\n    uri: string,\n  ): Promise<SdkResponse<GenerateEnchantedLinkForTestResponse>> =>\n    transformResponse<GenerateEnchantedLinkForTestResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.generateEnchantedLinkForTest,\n        { loginId, URI: uri },\n        { token: managementKey },\n      ),\n      (data) => data,\n    ),\n});\n\nexport default withUser;\n","import { SdkResponse, transformResponse } from '@descope/core-js-sdk';\nimport { CoreSdk } from '../types';\nimport apiPaths from './paths';\nimport { CreateTenantResponse, Tenant } from './types';\n\ntype MultipleTenantResponse = {\n  tenants: Tenant[];\n};\n\nconst withTenant = (sdk: CoreSdk, managementKey?: string) => ({\n  create: (\n    name: string,\n    selfProvisioningDomains?: string[],\n  ): Promise<SdkResponse<CreateTenantResponse>> =>\n    transformResponse(\n      sdk.httpClient.post(\n        apiPaths.tenant.create,\n        { name, selfProvisioningDomains },\n        { token: managementKey },\n      ),\n    ),\n  createWithId: (\n    id: string,\n    name: string,\n    selfProvisioningDomains?: string[],\n  ): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(\n        apiPaths.tenant.create,\n        { id, name, selfProvisioningDomains },\n        { token: managementKey },\n      ),\n    ),\n  update: (\n    id: string,\n    name: string,\n    selfProvisioningDomains?: string[],\n  ): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(\n        apiPaths.tenant.update,\n        { id, name, selfProvisioningDomains },\n        { token: managementKey },\n      ),\n    ),\n  delete: (id: string): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(apiPaths.tenant.delete, { id }, { token: managementKey }),\n    ),\n  loadAll: (): Promise<SdkResponse<Tenant[]>> =>\n    transformResponse<MultipleTenantResponse, Tenant[]>(\n      sdk.httpClient.get(apiPaths.tenant.loadAll, {\n        token: managementKey,\n      }),\n      (data) => data.tenants,\n    ),\n});\n\nexport default withTenant;\n","import { SdkResponse, transformResponse } from '@descope/core-js-sdk';\nimport { CoreSdk } from '../types';\nimport apiPaths from './paths';\nimport { UpdateJWTResponse } from './types';\n\nconst withJWT = (sdk: CoreSdk, managementKey?: string) => ({\n  update: (\n    jwt: string,\n    customClaims?: Record<string, any>,\n  ): Promise<SdkResponse<UpdateJWTResponse>> =>\n    transformResponse(\n      sdk.httpClient.post(apiPaths.jwt.update, { jwt, customClaims }, { token: managementKey }),\n    ),\n});\n\nexport default withJWT;\n","import { SdkResponse, transformResponse } from '@descope/core-js-sdk';\nimport { CoreSdk } from '../types';\nimport apiPaths from './paths';\nimport { Permission } from './types';\n\ntype MultiplePermissionResponse = {\n  permissions: Permission[];\n};\n\nconst withPermission = (sdk: CoreSdk, managementKey?: string) => ({\n  create: (name: string, description?: string): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(\n        apiPaths.permission.create,\n        { name, description },\n        { token: managementKey },\n      ),\n    ),\n  update: (name: string, newName: string, description?: string): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(\n        apiPaths.permission.update,\n        { name, newName, description },\n        { token: managementKey },\n      ),\n    ),\n  delete: (name: string): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(apiPaths.permission.delete, { name }, { token: managementKey }),\n    ),\n  loadAll: (): Promise<SdkResponse<Permission[]>> =>\n    transformResponse<MultiplePermissionResponse, Permission[]>(\n      sdk.httpClient.get(apiPaths.permission.loadAll, {\n        token: managementKey,\n      }),\n      (data) => data.permissions,\n    ),\n});\n\nexport default withPermission;\n","import { SdkResponse, transformResponse } from '@descope/core-js-sdk';\nimport { CoreSdk } from '../types';\nimport apiPaths from './paths';\nimport { Role } from './types';\n\ntype MultipleRoleResponse = {\n  roles: Role[];\n};\n\nconst withRole = (sdk: CoreSdk, managementKey?: string) => ({\n  create: (\n    name: string,\n    description?: string,\n    permissionNames?: string[],\n  ): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(\n        apiPaths.role.create,\n        { name, description, permissionNames },\n        { token: managementKey },\n      ),\n    ),\n  update: (\n    name: string,\n    newName: string,\n    description?: string,\n    permissionNames?: string[],\n  ): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(\n        apiPaths.role.update,\n        { name, newName, description, permissionNames },\n        { token: managementKey },\n      ),\n    ),\n  delete: (name: string): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(apiPaths.role.delete, { name }, { token: managementKey }),\n    ),\n  loadAll: (): Promise<SdkResponse<Role[]>> =>\n    transformResponse<MultipleRoleResponse, Role[]>(\n      sdk.httpClient.get(apiPaths.role.loadAll, {\n        token: managementKey,\n      }),\n      (data) => data.roles,\n    ),\n});\n\nexport default withRole;\n","import { SdkResponse, transformResponse } from '@descope/core-js-sdk';\nimport { CoreSdk } from '../types';\nimport apiPaths from './paths';\nimport { Group } from './types';\n\nconst withGroup = (sdk: CoreSdk, managementKey?: string) => ({\n  /**\n   * Load all groups for a specific tenant id.\n   * @param tenantId Tenant ID to load groups from.\n   * @returns Group[] list of groups\n   */\n  loadAllGroups: (tenantId: string): Promise<SdkResponse<Group[]>> =>\n    transformResponse<Group[]>(\n      sdk.httpClient.post(apiPaths.group.loadAllGroups, { tenantId }, { token: managementKey }),\n    ),\n\n  /**\n   * Load all groups for the provided user IDs or login IDs.\n   * @param tenantId Tenant ID to load groups from.\n   * @param userIds Optional List of user IDs, with the format of \"U2J5ES9S8TkvCgOvcrkpzUgVTEBM\" (example), which can be found on the user's JWT.\n   * @param loginIds Optional List of login IDs, how the user identifies when logging in.\n   * @returns Group[] list of groups\n   */\n  loadAllGroupsForMember: (\n    tenantId: string,\n    userIds: string[],\n    loginIds: string[],\n  ): Promise<SdkResponse<Group[]>> =>\n    transformResponse<Group[]>(\n      sdk.httpClient.post(\n        apiPaths.group.loadAllGroupsForMember,\n        { tenantId, loginIds, userIds },\n        { token: managementKey },\n      ),\n    ),\n\n  /**\n   * Load all members of the provided group id.\n   * @param tenantId Tenant ID to load groups from.\n   * @param groupId Group ID to load members for.\n   * @returns Group[] list of groups\n   */\n  loadAllGroupMembers: (tenantId: string, groupId: string): Promise<SdkResponse<Group[]>> =>\n    transformResponse<Group[]>(\n      sdk.httpClient.post(\n        apiPaths.group.loadAllGroupMembers,\n        { tenantId, groupId },\n        { token: managementKey },\n      ),\n    ),\n});\n\nexport default withGroup;\n","import { SdkResponse, transformResponse } from '@descope/core-js-sdk';\nimport { CoreSdk } from '../types';\nimport apiPaths from './paths';\nimport { RoleMapping, AttributeMapping, SSOSettingsResponse } from './types';\n\nconst withSSOSettings = (sdk: CoreSdk, managementKey?: string) => ({\n  getSettings: (tenantId: string): Promise<SdkResponse<SSOSettingsResponse>> =>\n    transformResponse<SSOSettingsResponse>(\n      sdk.httpClient.get(apiPaths.sso.settings, {\n        queryParams: { tenantId },\n        token: managementKey,\n      }),\n      (data) => data,\n    ),\n  configureSettings: (\n    tenantId: string,\n    idpURL: string,\n    idpCert: string,\n    entityId: string,\n    redirectURL?: string,\n    domain?: string,\n  ): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(\n        apiPaths.sso.settings,\n        { tenantId, idpURL, entityId, idpCert, redirectURL, domain },\n        { token: managementKey },\n      ),\n    ),\n  configureMetadata: (tenantId: string, idpMetadataURL: string): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(\n        apiPaths.sso.metadata,\n        { tenantId, idpMetadataURL },\n        { token: managementKey },\n      ),\n    ),\n  configureMapping: (\n    tenantId: string,\n    roleMapping?: RoleMapping,\n    attributeMapping?: AttributeMapping,\n  ): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(\n        apiPaths.sso.mapping,\n        { tenantId, roleMapping, attributeMapping },\n        { token: managementKey },\n      ),\n    ),\n});\n\nexport default withSSOSettings;\n","import { SdkResponse, transformResponse } from '@descope/core-js-sdk';\nimport { CoreSdk } from '../types';\nimport apiPaths from './paths';\nimport { AccessKey, AssociatedTenant, CreatedAccessKeyResponse } from './types';\n\ntype SingleKeyResponse = {\n  key: AccessKey;\n};\n\ntype MultipleKeysResponse = {\n  keys: AccessKey[];\n};\n\nconst withAccessKey = (sdk: CoreSdk, managementKey?: string) => ({\n  /**\n   * Create a new access key for a project.\n   * @param name Access key name\n   * @param expireTime When the access key expires. Keep at 0 to make it indefinite.\n   * @param roles Optional roles in the project. Does not apply for multi-tenants\n   * @param keyTenants Optional associated tenants for this key and its roles for each.\n   * @returns A newly created key and its cleartext. Make sure to save the cleartext securely.\n   */\n  create: (\n    name: string,\n    expireTime: number,\n    roles?: string[],\n    keyTenants?: AssociatedTenant[],\n  ): Promise<SdkResponse<CreatedAccessKeyResponse>> =>\n    transformResponse(\n      sdk.httpClient.post(\n        apiPaths.accessKey.create,\n        { name, expireTime, roleNames: roles, keyTenants },\n        { token: managementKey },\n      ),\n    ),\n  /**\n   * Load an access key.\n   * @param id Access key ID to load\n   * @returns The loaded access key.\n   */\n  load: (id: string): Promise<SdkResponse<AccessKey>> =>\n    transformResponse<SingleKeyResponse, AccessKey>(\n      sdk.httpClient.get(apiPaths.accessKey.load, {\n        queryParams: { id },\n        token: managementKey,\n      }),\n      (data) => data.key,\n    ),\n  /**\n   * Search all access keys\n   * @param tenantIds Optional tenant ID filter to apply on the search results\n   * @returns An array of found access keys\n   */\n  searchAll: (tenantIds?: string[]): Promise<SdkResponse<AccessKey[]>> =>\n    transformResponse<MultipleKeysResponse, AccessKey[]>(\n      sdk.httpClient.post(apiPaths.accessKey.search, { tenantIds }, { token: managementKey }),\n      (data) => data.keys,\n    ),\n  /**\n   * Update an access key.\n   * @param id Access key ID to load\n   * @param name The updated access key name\n   * @returns The updated access key\n   */\n  update: (id: string, name: string): Promise<SdkResponse<AccessKey>> =>\n    transformResponse<SingleKeyResponse, AccessKey>(\n      sdk.httpClient.post(apiPaths.accessKey.update, { id, name }, { token: managementKey }),\n      (data) => data.key,\n    ),\n  /**\n   * Deactivate an access key. Deactivated access keys cannot be used until they are\n   * activated again.\n   * @param id Access key ID to deactivate\n   */\n  deactivate: (id: string): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(apiPaths.accessKey.deactivate, { id }, { token: managementKey }),\n    ),\n  /**\n   * Activate an access key. Only deactivated access keys can be activated again.\n   * @param id Access key ID to activate\n   */\n  activate: (id: string): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(apiPaths.accessKey.activate, { id }, { token: managementKey }),\n    ),\n  /**\n   * Delete an access key. IMPORTANT: This cannot be undone. Use carefully.\n   * @param id Access key ID to delete\n   */\n  delete: (id: string): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(apiPaths.accessKey.delete, { id }, { token: managementKey }),\n    ),\n});\n\nexport default withAccessKey;\n","import { SdkResponse, transformResponse } from '@descope/core-js-sdk';\nimport { CoreSdk } from '../types';\nimport apiPaths from './paths';\nimport { FlowResponse, Screen, Flow } from './types';\n\nconst WithFlow = (sdk: CoreSdk, managementKey?: string) => ({\n  export: (flowId: string): Promise<SdkResponse<FlowResponse>> =>\n    transformResponse(\n      sdk.httpClient.post(apiPaths.flow.export, { flowId }, { token: managementKey }),\n    ),\n  import: (flowId: string, flow: Flow, screens?: Screen[]): Promise<SdkResponse<FlowResponse>> =>\n    transformResponse(\n      sdk.httpClient.post(\n        apiPaths.flow.import,\n        { flowId, flow, screens },\n        { token: managementKey },\n      ),\n    ),\n});\n\nexport default WithFlow;\n","import { SdkResponse, transformResponse } from '@descope/core-js-sdk';\nimport { CoreSdk } from '../types';\nimport apiPaths from './paths';\nimport { Theme, ThemeResponse } from './types';\n\nconst WithTheme = (sdk: CoreSdk, managementKey?: string) => ({\n  export: (): Promise<SdkResponse<ThemeResponse>> =>\n    transformResponse(sdk.httpClient.post(apiPaths.theme.export, {}, { token: managementKey })),\n  import: (theme: Theme): Promise<SdkResponse<ThemeResponse>> =>\n    transformResponse(\n      sdk.httpClient.post(apiPaths.theme.import, { theme }, { token: managementKey }),\n    ),\n});\n\nexport default WithTheme;\n","import nodeFetch, { Headers } from 'node-fetch-commonjs';\n\nglobalThis.Headers ??= Headers;\n\nconst highWaterMarkMb = 1024 * 1024 * 30; // 30MB\n\n// we are increasing the response buffer size due to an issue where node-fetch hangs when response is too big\nconst patchedFetch = (...args: Parameters<typeof nodeFetch>) => {\n  // we can get Request on the first arg, or RequestInfo on the second arg\n  // we want to make sure we are setting the \"highWaterMark\" so we are doing it on both args\n  args.forEach((arg) => {\n    // eslint-disable-next-line no-param-reassign, @typescript-eslint/no-unused-expressions\n    arg && ((arg as any).highWaterMark ??= highWaterMarkMb);\n  });\n\n  return nodeFetch(...args);\n};\n\nexport default patchedFetch as unknown as typeof fetch;\n","import createSdk, { ExchangeAccessKeyResponse, SdkResponse, wrapWith } from '@descope/core-js-sdk';\nimport { JWK, JWTHeaderParameters, KeyLike, errors, importJWK, jwtVerify } from 'jose';\nimport {\n  permissionsClaimName,\n  refreshTokenCookieName,\n  rolesClaimName,\n  sessionTokenCookieName,\n} from './constants';\nimport { getAuthorizationClaimItems, withCookie } from './helpers';\nimport withManagement from './management';\nimport { AuthenticationInfo } from './types';\nimport fetch from './fetch-polyfill';\n\ndeclare const BUILD_VERSION: string;\n\n/** Configuration arguments which include the Descope core SDK args and an optional management key */\ntype NodeSdkArgs = Parameters<typeof createSdk>[0] & {\n  managementKey?: string;\n};\n\nconst nodeSdk = ({ managementKey, ...config }: NodeSdkArgs) => {\n  const coreSdk = createSdk({\n    ...config,\n    fetch,\n    baseHeaders: {\n      ...config.baseHeaders,\n      'x-descope-sdk-name': 'nodejs',\n      'x-descope-sdk-node-version': process?.versions?.node || '',\n      'x-descope-sdk-version': BUILD_VERSION,\n    },\n  });\n\n  const { projectId, logger } = config;\n\n  const keys: Record<string, KeyLike | Uint8Array> = {};\n\n  /** Fetch the public keys (JWKs) from Descope for the configured project */\n  const fetchKeys = async () => {\n    const keysWrapper = await coreSdk.httpClient\n      .get(`v2/keys/${projectId}`)\n      .then((resp) => resp.json());\n    const publicKeys: JWK[] = keysWrapper.keys;\n    if (!Array.isArray(publicKeys)) return {};\n    const kidJwksPairs = await Promise.all(\n      publicKeys.map(async (key) => [key.kid, await importJWK(key)]),\n    );\n\n    return kidJwksPairs.reduce(\n      (acc, [kid, jwk]) => (kid ? { ...acc, [kid.toString()]: jwk } : acc),\n      {},\n    );\n  };\n\n  const management = withManagement(coreSdk, managementKey);\n\n  const sdk = {\n    ...coreSdk,\n\n    /**\n     * Provides various APIs for managing a Descope project programmatically. A management key must\n     * be provided as an argument when initializing the SDK to use these APIs. Management keys can be\n     * generated in the Descope console.\n     */\n    management,\n\n    /** Get the key that can validate the given JWT KID in the header. Can retrieve the public key from local cache or from Descope. */\n    async getKey(header: JWTHeaderParameters): Promise<KeyLike | Uint8Array> {\n      if (!header?.kid) throw Error('header.kid must not be empty');\n\n      if (keys[header.kid]) return keys[header.kid];\n\n      // do we need to fetch once or every time?\n      Object.assign(keys, await fetchKeys());\n\n      if (!keys[header.kid]) throw Error('failed to fetch matching key');\n\n      return keys[header.kid];\n    },\n\n    /**\n     * Validate the given JWT with the right key and make sure the issuer is correct\n     * @param jwt the JWT string to parse and validate\n     * @returns AuthenticationInfo with the parsed token and JWT. Will throw an error if validation fails.\n     */\n    async validateJwt(jwt: string): Promise<AuthenticationInfo> {\n      // Do not hard-code the algo because library does not support `None` so all are valid\n      const res = await jwtVerify(jwt, sdk.getKey, { clockTolerance: 5 });\n      const token = res.payload;\n\n      if (token) {\n        token.iss = token.iss?.split('/').pop(); // support both url and project id as issuer\n        if (token.iss !== projectId) {\n          // We must do the verification here, since issuer can be either project ID or URL\n          throw new errors.JWTClaimValidationFailed(\n            'unexpected \"iss\" claim value',\n            'iss',\n            'check_failed',\n          );\n        }\n      }\n\n      return { jwt, token };\n    },\n\n    /**\n     * Validate an active session\n     * @param sessionToken session JWT to validate\n     * @returns AuthenticationInfo promise or throws Error if there is an issue with JWTs\n     */\n    async validateSession(sessionToken: string): Promise<AuthenticationInfo> {\n      if (!sessionToken) throw Error('session token is required for validation');\n\n      try {\n        const token = await sdk.validateJwt(sessionToken);\n        return token;\n      } catch (error) {\n        /* istanbul ignore next */\n        logger?.error('session validation failed', error);\n        throw Error('session validation failed');\n      }\n    },\n\n    /**\n     * Refresh the session using a refresh token\n     * @param refreshToken refresh JWT to refresh the session with\n     * @returns AuthenticationInfo promise or throws Error if there is an issue with JWTs\n     */\n    async refreshSession(refreshToken: string): Promise<AuthenticationInfo> {\n      if (!refreshToken) throw Error('refresh token is required to refresh a session');\n\n      try {\n        await sdk.validateJwt(refreshToken);\n        const jwtResp = await sdk.refresh(refreshToken);\n        if (jwtResp.ok) {\n          const token = await sdk.validateJwt(jwtResp.data?.sessionJwt);\n          return token;\n        }\n        /* istanbul ignore next */\n        throw Error(jwtResp.error?.errorMessage);\n      } catch (refreshTokenErr) {\n        /* istanbul ignore next */\n        logger?.error('refresh token validation failed', refreshTokenErr);\n        throw Error('refresh token validation failed');\n      }\n    },\n\n    /**\n     * Validate session and refresh it if it expired\n     * @param sessionToken session JWT\n     * @param refreshToken refresh JWT\n     * @returns AuthenticationInfo promise or throws Error if there is an issue with JWTs\n     */\n    async validateAndRefreshSession(\n      sessionToken?: string,\n      refreshToken?: string,\n    ): Promise<AuthenticationInfo> {\n      if (!sessionToken && !refreshToken) throw Error('both session and refresh tokens are empty');\n\n      try {\n        const token = await sdk.validateSession(sessionToken);\n        return token;\n      } catch (error) {\n        /* istanbul ignore next */\n        logger?.log('session validation failed - trying to refresh it');\n      }\n\n      return sdk.refreshSession(refreshToken);\n    },\n\n    /**\n     * Exchange API key (access key) for a session key\n     * @param accessKey access key to exchange for a session JWT\n     * @returns AuthneticationInfo with session JWT data\n     */\n    async exchangeAccessKey(accessKey: string): Promise<AuthenticationInfo> {\n      if (!accessKey) throw Error('access key must not be empty');\n\n      let resp: SdkResponse<ExchangeAccessKeyResponse>;\n      try {\n        resp = await sdk.accessKey.exchange(accessKey);\n      } catch (error) {\n        logger?.error('failed to exchange access key', error);\n        throw Error('could not exchange access key');\n      }\n\n      const { sessionJwt } = resp.data;\n      if (!sessionJwt) {\n        logger?.error('failed to parse exchange access key response');\n        throw Error('could not exchange access key');\n      }\n\n      try {\n        const token = await sdk.validateJwt(sessionJwt);\n        return token;\n      } catch (error) {\n        logger?.error('failed to parse jwt from access key', error);\n        throw Error('could not exchange access key');\n      }\n    },\n\n    /**\n     * Make sure that all given permissions exist on the parsed JWT top level claims\n     * @param authInfo JWT parsed info\n     * @param permissions list of permissions to make sure they exist on te JWT claims\n     * @returns true if all permissions exist, false otherwise\n     */\n    validatePermissions(authInfo: AuthenticationInfo, permissions: string[]): boolean {\n      return sdk.validateTenantPermissions(authInfo, null, permissions);\n    },\n\n    /**\n     * Make sure that all given permissions exist on the parsed JWT tenant claims\n     * @param authInfo JWT parsed info\n     * @param permissions list of permissions to make sure they exist on te JWT claims\n     * @returns true if all permissions exist, false otherwise\n     */\n    validateTenantPermissions(\n      authInfo: AuthenticationInfo,\n      tenant: string,\n      permissions: string[],\n    ): boolean {\n      const granted = getAuthorizationClaimItems(authInfo, permissionsClaimName, tenant);\n      return permissions.every((perm) => granted.includes(perm));\n    },\n\n    /**\n     * Make sure that all given roles exist on the parsed JWT top level claims\n     * @param authInfo JWT parsed info\n     * @param roles list of roles to make sure they exist on te JWT claims\n     * @returns true if all roles exist, false otherwise\n     */\n    validateRoles(authInfo: AuthenticationInfo, roles: string[]): boolean {\n      return sdk.validateTenantRoles(authInfo, null, roles);\n    },\n\n    /**\n     * Make sure that all given roles exist on the parsed JWT tenant claims\n     * @param authInfo JWT parsed info\n     * @param roles list of roles to make sure they exist on te JWT claims\n     * @returns true if all roles exist, false otherwise\n     */\n    validateTenantRoles(authInfo: AuthenticationInfo, tenant: string, roles: string[]): boolean {\n      const membership = getAuthorizationClaimItems(authInfo, rolesClaimName, tenant);\n      return roles.every((role) => membership.includes(role));\n    },\n  };\n\n  return wrapWith(\n    sdk,\n    [\n      'otp.verify.email',\n      'otp.verify.sms',\n      'otp.verify.whatsapp',\n      'magicLink.verify',\n      'enchantedLink.signUp',\n      'enchantedLink.signIn',\n      'oauth.exchange',\n      'saml.exchange',\n      'totp.verify',\n      'webauthn.signIn.finish',\n      'webauthn.signUp.finish',\n      'refresh',\n    ] as const,\n    withCookie,\n  );\n};\n\n/** Descope SDK client with delivery methods enum.\n *\n * Please see full documentation at {@link https://docs.descope.com/guides Descope Docs}\n * @example Usage\n *\n * ```js\n * import descopeSdk from '@descope/node-sdk';\n *\n * const myProjectId = 'xxx';\n * const sdk = descopeSdk({ projectId: myProjectId });\n *\n * const userLoginId = 'loginId';\n * sdk.otp.signIn.email(userLoginId);\n * const jwtResponse = sdk.otp.verify.email(userLoginId, codeFromEmail);\n * ```\n */\n\nnodeSdk.RefreshTokenCookieName = refreshTokenCookieName;\nnodeSdk.SessionTokenCookieName = sessionTokenCookieName;\n\nexport default nodeSdk;\nexport type {\n  DeliveryMethod,\n  OAuthProvider,\n  ResponseData,\n  SdkResponse,\n} from '@descope/core-js-sdk';\n","import { CoreSdk } from '../types';\nimport withUser from './user';\nimport withTenant from './tenant';\nimport withJWT from './jwt';\nimport withPermission from './permission';\nimport withRole from './role';\nimport withGroup from './group';\nimport withSSOSettings from './sso';\nimport withAccessKey from './accesskey';\nimport WithFlow from './flow';\nimport WithTheme from './theme';\n\n/** Constructs a higher level Management API that wraps the functions from code-js-sdk */\nconst withManagement = (sdk: CoreSdk, managementKey?: string) => ({\n  user: withUser(sdk, managementKey),\n  accessKey: withAccessKey(sdk, managementKey),\n  tenant: withTenant(sdk, managementKey),\n  sso: withSSOSettings(sdk, managementKey),\n  jwt: withJWT(sdk, managementKey),\n  permission: withPermission(sdk, managementKey),\n  role: withRole(sdk, managementKey),\n  group: withGroup(sdk, managementKey),\n  flow: WithFlow(sdk, managementKey),\n  theme: WithTheme(sdk, managementKey),\n});\n\nexport default withManagement;\n"],"names":["withCookie","fn","async","args","resp","data","_d","refreshJwt","rest","__rest","cookies","options","push","cookieDomain","cookieMaxAge","cookiePath","_a","response","headers","get","cookie","name","match","RegExp","getCookieValue","_b","_c","Object","assign","getAuthorizationClaimItems","authInfo","claim","tenant","value","token","Array","isArray","apiPaths","create","update","delete","deleteAllTestUsers","load","search","updateStatus","updateEmail","updatePhone","updateDisplayName","updatePicture","updateCustomAttribute","addRole","removeRole","addTenant","removeTenant","generateOTPForTest","generateMagicLinkForTest","generateEnchantedLinkForTest","deactivate","activate","loadAll","settings","metadata","mapping","export","import","loadAllGroups","loadAllGroupsForMember","loadAllGroupMembers","withUser","sdk","managementKey","loginId","email","phone","displayName","roles","userTenants","customAttributes","picture","transformResponse","httpClient","post","roleNames","user","createTestUser","test","invite","queryParams","loadByUserId","userId","searchAll","tenantIds","limit","page","testUsersOnly","withTestUser","users","status","isVerified","verified","attributeKey","attributeValue","addRoles","removeRoles","tenantId","addTenantRoles","removeTenantRoles","generateOTPForTestUser","deliveryMethod","generateMagicLinkForTestUser","uri","URI","generateEnchantedLinkForTestUser","withTenant","selfProvisioningDomains","createWithId","id","tenants","withJWT","jwt","customClaims","withPermission","description","newName","permissions","withRole","permissionNames","withGroup","userIds","loginIds","groupId","withSSOSettings","getSettings","configureSettings","idpURL","idpCert","entityId","redirectURL","domain","configureMetadata","idpMetadataURL","configureMapping","roleMapping","attributeMapping","withAccessKey","expireTime","keyTenants","key","keys","WithFlow","flowId","flow","screens","WithTheme","theme","globalThis","Headers","patchedFetch","forEach","arg","highWaterMark","nodeFetch","nodeSdk","config","coreSdk","createSdk","fetch","baseHeaders","process","versions","node","projectId","logger","management","accessKey","sso","permission","role","group","withManagement","header","kid","Error","publicKeys","then","json","Promise","all","map","importJWK","reduce","acc","jwk","toString","fetchKeys","jwtVerify","getKey","clockTolerance","payload","iss","split","pop","errors","JWTClaimValidationFailed","sessionToken","validateJwt","error","refreshToken","jwtResp","refresh","ok","sessionJwt","errorMessage","refreshTokenErr","validateSession","log","refreshSession","exchange","validatePermissions","validateTenantPermissions","granted","every","perm","includes","validateRoles","validateTenantRoles","membership","wrapWith","RefreshTokenCookieName","SessionTokenCookieName"],"mappings":"mNAEO,MC+BMA,EACVC,GACDC,SAAUC,eACR,MAAMC,QAAaH,KAAME,GAGzB,IAAKC,EAAKC,KACR,OAAOD,EAIT,IAAIE,EAA0BF,EAAKC,MAA/BE,WAAEA,GAAUD,EAAKE,EAAjBC,EAAAA,OAAAH,EAAA,CAAA,eACJ,MAAMI,EAAoB,GAlCP,IAA8BC,EAgDjD,OAZKJ,EASHG,EAAQE,KA5CZ,GDVoC,SCsDoBL,cA5C5BI,OADuBA,EA6CiBH,QA5CxC,EAAAG,EAASE,eAAgB,gBACnDF,aAAA,EAAAA,EAASG,eAAgB,aACjBH,aAAA,EAAAA,EAASI,aAAc,mCAkCZ,QAAbC,EAAAZ,EAAKa,gBAAQ,IAAAD,OAAA,EAAAA,EAAEE,QAAQC,IAAI,iBAC7BZ,EA3Be,EAACa,EAAmCC,KACzD,MAAMC,EAAQF,eAAAA,EAAQE,MAAMC,OAAO,cAAcF,cACjD,OAAOC,EAAQA,EAAM,GAAK,IAAI,EAyBXE,CACE,QAAbC,EAAArB,EAAKa,gBAAQ,IAAAQ,OAAA,EAAAA,EAAEP,QAAQC,IAAI,cDhDC,OCmD9BT,EAAQE,KAAoB,QAAfc,EAAAtB,EAAKa,gBAAU,IAAAS,OAAA,EAAAA,EAAAR,QAAQC,IAAI,gBAMhCQ,OAAAC,OAAAD,OAAAC,OAAA,CAAA,EAAAxB,GAAM,CAAAC,KAAWsB,OAAAC,OAAAD,OAAAC,OAAA,GAAAxB,EAAKC,MAAM,CAAAE,aAAYG,aAAY,WAUpDmB,EACdC,EACAC,EACAC,WAEA,MAAMC,EAAQD,EAC0C,QAApDP,EAA6C,QAA7CT,EAAAc,EAASI,MAAgC,eAAI,IAAAlB,OAAA,EAAAA,EAAAgB,UAAO,IAAAP,OAAA,EAAAA,EAAGM,GACvDD,EAASI,MAAMH,GACnB,OAAOI,MAAMC,QAAQH,GAASA,EAAQ,EACxC,CC7EA,IAAeI,EACP,CACJC,OAAQ,uBACRC,OAAQ,uBACRC,OAAQ,uBACRC,mBAAoB,gCACpBC,KAAM,gBACNC,OAAQ,uBACRC,aAAc,8BACdC,YAAa,6BACbC,YAAa,6BACbC,kBAAmB,4BACnBC,cAAe,+BACfC,sBAAuB,uCACvBC,QAAS,gCACTC,WAAY,mCACZC,UAAW,kCACXC,aAAc,qCACdC,mBAAoB,8BACpBC,yBAA0B,oCAC1BC,6BAA8B,yCApBnBnB,EAsBF,CACTC,OAAQ,4BACRI,KAAM,qBACNC,OAAQ,4BACRJ,OAAQ,4BACRkB,WAAY,gCACZC,SAAU,8BACVlB,OAAQ,6BA7BGH,EA+BL,CACNC,OAAQ,yBACRC,OAAQ,yBACRC,OAAQ,yBACRmB,QAAS,uBAnCEtB,EAqCR,CACHuB,SAAU,wBACVC,SAAU,wBACVC,QAAS,wBAxCEzB,EA0CR,CACHE,OAAQ,uBA3CGF,EA6CD,CACVC,OAAQ,6BACRC,OAAQ,6BACRC,OAAQ,6BACRmB,QAAS,2BAjDEtB,EAmDP,CACJC,OAAQ,uBACRC,OAAQ,uBACRC,OAAQ,uBACRmB,QAAS,qBAvDEtB,EAyDP,CACJ0B,OAAQ,uBACRC,OAAQ,wBA3DG3B,EA6DN,CACL0B,OAAQ,wBACRC,OAAQ,yBA/DG3B,EAiEN,CACL4B,cAAe,qBACfC,uBAAwB,4BACxBC,oBAAqB,0BClDzB,MAAMC,EAAW,CAACC,EAAcC,KAA4B,CAC1DhC,OAAQ,CACNiC,EACAC,EACAC,EACAC,EACAC,EACAC,EACAC,EACAC,IAEAC,EAAAA,kBACEV,EAAIW,WAAWC,KACb5C,EAAcC,OACd,CACEiC,UACAC,QACAC,QACAC,cACAQ,UAAWP,EACXC,cACAC,mBACAC,WAEF,CAAE5C,MAAOoC,KAEVjE,GAASA,EAAK8E,OAYnBC,eAAgB,CACdb,EACAC,EACAC,EACAC,EACAC,EACAC,EACAC,EACAC,IAEAC,EAAAA,kBACEV,EAAIW,WAAWC,KACb5C,EAAcC,OACd,CACEiC,UACAC,QACAC,QACAC,cACAQ,UAAWP,EACXC,cACAS,MAAM,EACNR,mBACAC,WAEF,CAAE5C,MAAOoC,KAEVjE,GAASA,EAAK8E,OAEnBG,OAAQ,CACNf,EACAC,EACAC,EACAC,EACAC,EACAC,EACAC,EACAC,IAEAC,EAAAA,kBACEV,EAAIW,WAAWC,KACb5C,EAAcC,OACd,CACEiC,UACAC,QACAC,QACAC,cACAQ,UAAWP,EACXC,cACAU,QAAQ,EACRT,mBACAC,WAEF,CAAE5C,MAAOoC,KAEVjE,GAASA,EAAK8E,OAEnB5C,OAAQ,CACNgC,EACAC,EACAC,EACAC,EACAC,EACAC,EACAC,EACAC,IAEAC,EAAAA,kBACEV,EAAIW,WAAWC,KACb5C,EAAcE,OACd,CACEgC,UACAC,QACAC,QACAC,cACAQ,UAAWP,EACXC,cACAC,mBACAC,WAEF,CAAE5C,MAAOoC,KAEVjE,GAASA,EAAK8E,OAEnB3C,OAAS+B,GACPQ,EAAAA,kBACEV,EAAIW,WAAWC,KAAK5C,EAAcG,OAAQ,CAAE+B,WAAW,CAAErC,MAAOoC,KAKpE7B,mBAAoB,IAClBsC,EAAiBA,kBACfV,EAAIW,WAAWxC,OAAOH,EAAcI,mBAAoB,CAAE,EAAE,CAAEP,MAAOoC,KAEzE5B,KAAO6B,GACLQ,EAAAA,kBACEV,EAAIW,WAAW7D,IAAIkB,EAAcK,KAAM,CACrC6C,YAAa,CAAEhB,WACfrC,MAAOoC,KAERjE,GAASA,EAAK8E,OAQnBK,aAAeC,GACbV,EAAAA,kBACEV,EAAIW,WAAW7D,IAAIkB,EAAcK,KAAM,CACrC6C,YAAa,CAAEE,UACfvD,MAAOoC,KAERjE,GAASA,EAAK8E,OAanBO,UAAW,CACTC,EACAhB,EACAiB,EACAC,EACAC,EACAC,EACAlB,IAEAE,EAAAA,kBACEV,EAAIW,WAAWC,KACb5C,EAAcM,OACd,CAAEgD,YAAWT,UAAWP,EAAOiB,QAAOC,OAAMC,gBAAeC,eAAclB,oBACzE,CAAE3C,MAAOoC,KAEVjE,GAASA,EAAK2F,QAEnBtC,SAAWa,GACTQ,EAAAA,kBACEV,EAAIW,WAAWC,KACb5C,EAAcO,aACd,CAAE2B,UAAS0B,OAAQ,WACnB,CAAE/D,MAAOoC,KAEVjE,GAASA,EAAK8E,OAEnB1B,WAAac,GACXQ,EAAAA,kBACEV,EAAIW,WAAWC,KACb5C,EAAcO,aACd,CAAE2B,UAAS0B,OAAQ,YACnB,CAAE/D,MAAOoC,KAEVjE,GAASA,EAAK8E,OAEnBtC,YAAa,CACX0B,EACAC,EACA0B,IAEAnB,EAAAA,kBACEV,EAAIW,WAAWC,KACb5C,EAAcQ,YACd,CAAE0B,UAASC,QAAO2B,SAAUD,GAC5B,CAAEhE,MAAOoC,KAEVjE,GAASA,EAAK8E,OAEnBrC,YAAa,CACXyB,EACAE,EACAyB,IAEAnB,EAAAA,kBACEV,EAAIW,WAAWC,KACb5C,EAAcS,YACd,CAAEyB,UAASE,QAAO0B,SAAUD,GAC5B,CAAEhE,MAAOoC,KAEVjE,GAASA,EAAK8E,OAEnBpC,kBAAmB,CAACwB,EAAiBG,IACnCK,EAAiBA,kBACfV,EAAIW,WAAWC,KACb5C,EAAcU,kBACd,CAAEwB,UAASG,eACX,CAAExC,MAAOoC,KAEVjE,GAASA,EAAK8E,OAEnBnC,cAAe,CAACuB,EAAiBO,IAC/BC,EAAiBA,kBACfV,EAAIW,WAAWC,KACb5C,EAAcW,cACd,CAAEuB,UAASO,WACX,CAAE5C,MAAOoC,KAEVjE,GAASA,EAAK8E,OAEnBlC,sBAAuB,CACrBsB,EACA6B,EACAC,IAEAtB,EAAAA,kBACEV,EAAIW,WAAWC,KACb5C,EAAcY,sBACd,CAAEsB,UAAS6B,eAAcC,kBACzB,CAAEnE,MAAOoC,KAEVjE,GAASA,EAAK8E,OAEnBmB,SAAU,CAAC/B,EAAiBI,IAC1BI,EAAiBA,kBACfV,EAAIW,WAAWC,KACb5C,EAAca,QACd,CAAEqB,UAASW,UAAWP,GACtB,CAAEzC,MAAOoC,KAEVjE,GAASA,EAAK8E,OAEnBoB,YAAa,CAAChC,EAAiBI,IAC7BI,EAAiBA,kBACfV,EAAIW,WAAWC,KACb5C,EAAcc,WACd,CAAEoB,UAASW,UAAWP,GACtB,CAAEzC,MAAOoC,KAEVjE,GAASA,EAAK8E,OAEnB/B,UAAW,CAACmB,EAAiBiC,IAC3BzB,EAAiBA,kBACfV,EAAIW,WAAWC,KAAK5C,EAAce,UAAW,CAAEmB,UAASiC,YAAY,CAAEtE,MAAOoC,KAC5EjE,GAASA,EAAK8E,OAEnB9B,aAAc,CAACkB,EAAiBiC,IAC9BzB,EAAiBA,kBACfV,EAAIW,WAAWC,KACb5C,EAAcgB,aACd,CAAEkB,UAASiC,YACX,CAAEtE,MAAOoC,KAEVjE,GAASA,EAAK8E,OAEnBsB,eAAgB,CACdlC,EACAiC,EACA7B,IAEAI,EAAAA,kBACEV,EAAIW,WAAWC,KACb5C,EAAca,QACd,CAAEqB,UAASiC,WAAUtB,UAAWP,GAChC,CAAEzC,MAAOoC,KAEVjE,GAASA,EAAK8E,OAEnBuB,kBAAmB,CACjBnC,EACAiC,EACA7B,IAEAI,EAAAA,kBACEV,EAAIW,WAAWC,KACb5C,EAAcc,WACd,CAAEoB,UAASiC,WAAUtB,UAAWP,GAChC,CAAEzC,MAAOoC,KAEVjE,GAASA,EAAK8E,OAanBwB,uBAAwB,CACtBC,EACArC,IAEAQ,EAAAA,kBACEV,EAAIW,WAAWC,KACb5C,EAAciB,mBACd,CAAEsD,iBAAgBrC,WAClB,CAAErC,MAAOoC,KAEVjE,GAASA,IAcdwG,6BAA8B,CAC5BD,EACArC,EACAuC,IAEA/B,EAAAA,kBACEV,EAAIW,WAAWC,KACb5C,EAAckB,yBACd,CAAEqD,iBAAgBrC,UAASwC,IAAKD,GAChC,CAAE5E,MAAOoC,KAEVjE,GAASA,IAad2G,iCAAkC,CAChCzC,EACAuC,IAEA/B,EAAiBA,kBACfV,EAAIW,WAAWC,KACb5C,EAAcmB,6BACd,CAAEe,UAASwC,IAAKD,GAChB,CAAE5E,MAAOoC,KAEVjE,GAASA,MC1YV4G,EAAa,CAAC5C,EAAcC,KAA4B,CAC5DhC,OAAQ,CACNjB,EACA6F,IAEAnC,EAAiBA,kBACfV,EAAIW,WAAWC,KACb5C,EAAgBC,OAChB,CAAEjB,OAAM6F,2BACR,CAAEhF,MAAOoC,KAGf6C,aAAc,CACZC,EACA/F,EACA6F,IAEAnC,EAAAA,kBACEV,EAAIW,WAAWC,KACb5C,EAAgBC,OAChB,CAAE8E,KAAI/F,OAAM6F,2BACZ,CAAEhF,MAAOoC,KAGf/B,OAAQ,CACN6E,EACA/F,EACA6F,IAEAnC,EAAAA,kBACEV,EAAIW,WAAWC,KACb5C,EAAgBE,OAChB,CAAE6E,KAAI/F,OAAM6F,2BACZ,CAAEhF,MAAOoC,KAGf9B,OAAS4E,GACPrC,EAAAA,kBACEV,EAAIW,WAAWC,KAAK5C,EAAgBG,OAAQ,CAAE4E,MAAM,CAAElF,MAAOoC,KAEjEX,QAAS,IACPoB,EAAiBA,kBACfV,EAAIW,WAAW7D,IAAIkB,EAAgBsB,QAAS,CAC1CzB,MAAOoC,KAERjE,GAASA,EAAKgH,YCjDfC,EAAU,CAACjD,EAAcC,KAA4B,CACzD/B,OAAQ,CACNgF,EACAC,IAEAzC,EAAiBA,kBACfV,EAAIW,WAAWC,KAAK5C,EAAaE,OAAQ,CAAEgF,MAAKC,gBAAgB,CAAEtF,MAAOoC,OCFzEmD,EAAiB,CAACpD,EAAcC,KAA4B,CAChEhC,OAAQ,CAACjB,EAAcqG,IACrB3C,EAAiBA,kBACfV,EAAIW,WAAWC,KACb5C,EAAoBC,OACpB,CAAEjB,OAAMqG,eACR,CAAExF,MAAOoC,KAGf/B,OAAQ,CAAClB,EAAcsG,EAAiBD,IACtC3C,EAAAA,kBACEV,EAAIW,WAAWC,KACb5C,EAAoBE,OACpB,CAAElB,OAAMsG,UAASD,eACjB,CAAExF,MAAOoC,KAGf9B,OAASnB,GACP0D,EAAAA,kBACEV,EAAIW,WAAWC,KAAK5C,EAAoBG,OAAQ,CAAEnB,QAAQ,CAAEa,MAAOoC,KAEvEX,QAAS,IACPoB,EAAiBA,kBACfV,EAAIW,WAAW7D,IAAIkB,EAAoBsB,QAAS,CAC9CzB,MAAOoC,KAERjE,GAASA,EAAKuH,gBC1BfC,EAAW,CAACxD,EAAcC,KAA4B,CAC1DhC,OAAQ,CACNjB,EACAqG,EACAI,IAEA/C,EAAAA,kBACEV,EAAIW,WAAWC,KACb5C,EAAcC,OACd,CAAEjB,OAAMqG,cAAaI,mBACrB,CAAE5F,MAAOoC,KAGf/B,OAAQ,CACNlB,EACAsG,EACAD,EACAI,IAEA/C,oBACEV,EAAIW,WAAWC,KACb5C,EAAcE,OACd,CAAElB,OAAMsG,UAASD,cAAaI,mBAC9B,CAAE5F,MAAOoC,KAGf9B,OAASnB,GACP0D,EAAAA,kBACEV,EAAIW,WAAWC,KAAK5C,EAAcG,OAAQ,CAAEnB,QAAQ,CAAEa,MAAOoC,KAEjEX,QAAS,IACPoB,EAAiBA,kBACfV,EAAIW,WAAW7D,IAAIkB,EAAcsB,QAAS,CACxCzB,MAAOoC,KAERjE,GAASA,EAAKsE,UCvCfoD,EAAY,CAAC1D,EAAcC,KAA4B,CAM3DL,cAAgBuC,GACdzB,EAAAA,kBACEV,EAAIW,WAAWC,KAAK5C,EAAe4B,cAAe,CAAEuC,YAAY,CAAEtE,MAAOoC,KAU7EJ,uBAAwB,CACtBsC,EACAwB,EACAC,IAEAlD,EAAAA,kBACEV,EAAIW,WAAWC,KACb5C,EAAe6B,uBACf,CAAEsC,WAAUyB,WAAUD,WACtB,CAAE9F,MAAOoC,KAUfH,oBAAqB,CAACqC,EAAkB0B,IACtCnD,EAAiBA,kBACfV,EAAIW,WAAWC,KACb5C,EAAe8B,oBACf,CAAEqC,WAAU0B,WACZ,CAAEhG,MAAOoC,OC1CX6D,EAAkB,CAAC9D,EAAcC,KAA4B,CACjE8D,YAAc5B,GACZzB,EAAAA,kBACEV,EAAIW,WAAW7D,IAAIkB,EAAauB,SAAU,CACxC2B,YAAa,CAAEiB,YACftE,MAAOoC,KAERjE,GAASA,IAEdgI,kBAAmB,CACjB7B,EACA8B,EACAC,EACAC,EACAC,EACAC,IAEA3D,EAAiBA,kBACfV,EAAIW,WAAWC,KACb5C,EAAauB,SACb,CAAE4C,WAAU8B,SAAQE,WAAUD,UAASE,cAAaC,UACpD,CAAExG,MAAOoC,KAGfqE,kBAAmB,CAACnC,EAAkBoC,IACpC7D,EAAiBA,kBACfV,EAAIW,WAAWC,KACb5C,EAAawB,SACb,CAAE2C,WAAUoC,kBACZ,CAAE1G,MAAOoC,KAGfuE,iBAAkB,CAChBrC,EACAsC,EACAC,IAEAhE,EAAAA,kBACEV,EAAIW,WAAWC,KACb5C,EAAayB,QACb,CAAE0C,WAAUsC,cAAaC,oBACzB,CAAE7G,MAAOoC,OCjCX0E,EAAgB,CAAC3E,EAAcC,KAA4B,CAS/DhC,OAAQ,CACNjB,EACA4H,EACAtE,EACAuE,IAEAnE,EAAAA,kBACEV,EAAIW,WAAWC,KACb5C,EAAmBC,OACnB,CAAEjB,OAAM4H,aAAY/D,UAAWP,EAAOuE,cACtC,CAAEhH,MAAOoC,KAQf5B,KAAO0E,GACLrC,EAAAA,kBACEV,EAAIW,WAAW7D,IAAIkB,EAAmBK,KAAM,CAC1C6C,YAAa,CAAE6B,MACflF,MAAOoC,KAERjE,GAASA,EAAK8I,MAOnBzD,UAAYC,GACVZ,oBACEV,EAAIW,WAAWC,KAAK5C,EAAmBM,OAAQ,CAAEgD,aAAa,CAAEzD,MAAOoC,KACtEjE,GAASA,EAAK+I,OAQnB7G,OAAQ,CAAC6E,EAAY/F,IACnB0D,EAAiBA,kBACfV,EAAIW,WAAWC,KAAK5C,EAAmBE,OAAQ,CAAE6E,KAAI/F,QAAQ,CAAEa,MAAOoC,KACrEjE,GAASA,EAAK8I,MAOnB1F,WAAa2D,GACXrC,EAAAA,kBACEV,EAAIW,WAAWC,KAAK5C,EAAmBoB,WAAY,CAAE2D,MAAM,CAAElF,MAAOoC,KAMxEZ,SAAW0D,GACTrC,EAAAA,kBACEV,EAAIW,WAAWC,KAAK5C,EAAmBqB,SAAU,CAAE0D,MAAM,CAAElF,MAAOoC,KAMtE9B,OAAS4E,GACPrC,EAAAA,kBACEV,EAAIW,WAAWC,KAAK5C,EAAmBG,OAAQ,CAAE4E,MAAM,CAAElF,MAAOoC,OCvFhE+E,EAAW,CAAChF,EAAcC,KAA4B,CAC1DP,OAASuF,GACPvE,EAAAA,kBACEV,EAAIW,WAAWC,KAAK5C,EAAc0B,OAAQ,CAAEuF,UAAU,CAAEpH,MAAOoC,KAEnEN,OAAQ,CAACsF,EAAgBC,EAAYC,IACnCzE,EAAAA,kBACEV,EAAIW,WAAWC,KACb5C,EAAc2B,OACd,CAAEsF,SAAQC,OAAMC,WAChB,CAAEtH,MAAOoC,OCVXmF,EAAY,CAACpF,EAAcC,KAA4B,CAC3DP,OAAQ,IACNgB,EAAiBA,kBAACV,EAAIW,WAAWC,KAAK5C,EAAe0B,OAAQ,CAAE,EAAE,CAAE7B,MAAOoC,KAC5EN,OAAS0F,GACP3E,EAAAA,kBACEV,EAAIW,WAAWC,KAAK5C,EAAe2B,OAAQ,CAAE0F,SAAS,CAAExH,MAAOoC,aCRnD,QAAlBtD,EAAA2I,WAAWC,eAAO,IAAA5I,IAAlB2I,WAAWC,QAAYA,EAAOA,SAE9B,MAGMC,EAAe,IAAI1J,KAGvBA,EAAK2J,SAASC,YAEZA,YAAS/I,GAAAS,EAAAsI,GAAYC,+BAAAA,cARD,UAQmC,IAGlDC,EAAS,WAAI9J,ICKhB+J,EAAWlJ,WAAAsD,cAAEA,GAAuCtD,EAArBmJ,EAAM1J,EAAAA,OAAAO,EAA1B,mBACf,MAAMoJ,EAAUC,UACX1I,OAAAC,OAAAD,OAAAC,OAAA,CAAA,EAAAuI,UACHG,EACAC,YAAW5I,OAAAC,OAAAD,OAAAC,OAAA,CAAA,EACNuI,EAAOI,cACV,qBAAsB,SACtB,8BAAiD,UAAZ,OAAPC,cAAO,IAAPA,aAAO,EAAPA,QAASC,gBAAU,IAAAhJ,OAAA,EAAAA,EAAAiJ,OAAQ,GACzD,wBAAyB,cAIvBC,UAAEA,EAASC,OAAEA,GAAWT,EAExBf,EAA6C,CAAA,EAmB7CyB,ECxCe,EAACxG,EAAcC,KAA4B,CAChEa,KAAMf,EAASC,EAAKC,GACpBwG,UAAW9B,EAAc3E,EAAKC,GAC9BtC,OAAQiF,EAAW5C,EAAKC,GACxByG,IAAK5C,EAAgB9D,EAAKC,GAC1BiD,IAAKD,EAAQjD,EAAKC,GAClB0G,WAAYvD,EAAepD,EAAKC,GAChC2G,KAAMpD,EAASxD,EAAKC,GACpB4G,MAAOnD,EAAU1D,EAAKC,GACtBiF,KAAMF,EAAShF,EAAKC,GACpBoF,MAAOD,EAAUpF,EAAKC,KD8BH6G,CAAef,EAAS9F,GAErCD,iCACD+F,GAAO,CAOVS,aAGA3K,aAAakL,GACX,KAAKA,aAAA,EAAAA,EAAQC,KAAK,MAAMC,MAAM,gCAE9B,GAAIlC,EAAKgC,EAAOC,KAAM,OAAOjC,EAAKgC,EAAOC,KAKzC,GAFA1J,OAAOC,OAAOwH,OAnCAlJ,WAChB,MAGMqL,SAHoBnB,EAAQpF,WAC/B7D,IAAI,WAAWwJ,KACfa,MAAMpL,GAASA,EAAKqL,UACerC,KACtC,OAAKjH,MAAMC,QAAQmJ,UACQG,QAAQC,IACjCJ,EAAWK,KAAI1L,MAAOiJ,GAAQ,CAACA,EAAIkC,UAAWQ,EAAAA,UAAU1C,QAGtC2C,QAClB,CAACC,GAAMV,EAAKW,KAAUX,EAAW1J,OAAAC,OAAAD,OAAAC,OAAA,CAAA,EAAAmK,IAAK,CAACV,EAAIY,YAAaD,IAAQD,GAChE,CAAE,GAPmC,EAQtC,EAsB2BG,KAErB9C,EAAKgC,EAAOC,KAAM,MAAMC,MAAM,gCAEnC,OAAOlC,EAAKgC,EAAOC,IACpB,EAODnL,kBAAkBqH,SAEhB,MACMrF,SADYiK,EAASA,UAAC5E,EAAKlD,EAAI+H,OAAQ,CAAEC,eAAgB,KAC7CC,QAElB,GAAIpK,IACFA,EAAMqK,IAAe,QAATvL,EAAAkB,EAAMqK,WAAG,IAAAvL,OAAA,EAAAA,EAAEwL,MAAM,KAAKC,MAC9BvK,EAAMqK,MAAQ5B,GAEhB,MAAM,IAAI+B,EAAMA,OAACC,yBACf,+BACA,MACA,gBAKN,MAAO,CAAEpF,MAAKrF,QACf,EAODhC,sBAAsB0M,GACpB,IAAKA,EAAc,MAAMtB,MAAM,4CAE/B,IAEE,aADoBjH,EAAIwI,YAAYD,EAMrC,CAJC,MAAOE,GAGP,MADAlC,SAAAA,EAAQkC,MAAM,4BAA6BA,GACrCxB,MAAM,4BACb,CACF,EAODpL,qBAAqB6M,WACnB,IAAKA,EAAc,MAAMzB,MAAM,kDAE/B,UACQjH,EAAIwI,YAAYE,GACtB,MAAMC,QAAgB3I,EAAI4I,QAAQF,GAClC,GAAIC,EAAQE,GAAI,CAEd,aADoB7I,EAAIwI,YAA0B,QAAd7L,EAAAgM,EAAQ3M,YAAM,IAAAW,OAAA,EAAAA,EAAAmM,WAEnD,CAED,MAAM7B,MAAmB,QAAb7J,EAAAuL,EAAQF,aAAK,IAAArL,OAAA,EAAAA,EAAE2L,aAK5B,CAJC,MAAOC,GAGP,MADAzC,SAAAA,EAAQkC,MAAM,kCAAmCO,GAC3C/B,MAAM,kCACb,CACF,EAQDpL,gCACE0M,EACAG,GAEA,IAAKH,IAAiBG,EAAc,MAAMzB,MAAM,6CAEhD,IAEE,aADoBjH,EAAIiJ,gBAAgBV,EAKzC,CAHC,MAAOE,GAEPlC,SAAAA,EAAQ2C,IAAI,mDACb,CAED,OAAOlJ,EAAImJ,eAAeT,EAC3B,EAOD7M,wBAAwB4K,GACtB,IAAKA,EAAW,MAAMQ,MAAM,gCAE5B,IAAIlL,EACJ,IACEA,QAAaiE,EAAIyG,UAAU2C,SAAS3C,EAIrC,CAHC,MAAOgC,GAEP,MADAlC,SAAAA,EAAQkC,MAAM,gCAAiCA,GACzCxB,MAAM,gCACb,CAED,MAAM6B,WAAEA,GAAe/M,EAAKC,KAC5B,IAAK8M,EAEH,MADAvC,SAAAA,EAAQkC,MAAM,gDACRxB,MAAM,iCAGd,IAEE,aADoBjH,EAAIwI,YAAYM,EAKrC,CAHC,MAAOL,GAEP,MADAlC,SAAAA,EAAQkC,MAAM,sCAAuCA,GAC/CxB,MAAM,gCACb,CACF,EAQDoC,oBAAmB,CAAC5L,EAA8B8F,IACzCvD,EAAIsJ,0BAA0B7L,EAAU,KAAM8F,GASvD+F,0BACE7L,EACAE,EACA4F,GAEA,MAAMgG,EAAU/L,EAA2BC,EdrNb,ccqN6CE,GAC3E,OAAO4F,EAAYiG,OAAOC,GAASF,EAAQG,SAASD,IACrD,EAQDE,cAAa,CAAClM,EAA8B6C,IACnCN,EAAI4J,oBAAoBnM,EAAU,KAAM6C,GASjDsJ,oBAAoBnM,EAA8BE,EAAgB2C,GAChE,MAAMuJ,EAAarM,EAA2BC,EdxOtB,QcwOgDE,GACxE,OAAO2C,EAAMkJ,OAAO5C,GAASiD,EAAWH,SAAS9C,IAClD,IAGH,OAAOkD,EAAAA,SACL9J,EACA,CACE,mBACA,iBACA,sBACA,mBACA,uBACA,uBACA,iBACA,gBACA,cACA,yBACA,yBACA,WAEFrE,EACD,EAoBHkK,EAAQkE,uBd1R8B,Mc2RtClE,EAAQmE,uBdzR8B"}
+{"version":3,"file":"index.cjs.js","sources":["../../lib/constants.ts","../../lib/helpers.ts","../../lib/management/paths.ts","../../lib/management/user.ts","../../lib/management/tenant.ts","../../lib/management/jwt.ts","../../lib/management/permission.ts","../../lib/management/role.ts","../../lib/management/group.ts","../../lib/management/sso.ts","../../lib/management/accesskey.ts","../../lib/management/flow.ts","../../lib/management/theme.ts","../../lib/fetch-polyfill.ts","../../lib/index.ts","../../lib/management/index.ts"],"sourcesContent":["// eslint-disable-next-line import/prefer-default-export\n/** Refresh JWT cookie name */\nexport const refreshTokenCookieName = 'DSR';\n/** Session JWT cookie name */\nexport const sessionTokenCookieName = 'DS';\n/** The key of the tenants claims in the claims map */\nexport const authorizedTenantsClaimName = 'tenants';\n/** The key of the permissions claims in the claims map either under tenant or top level */\nexport const permissionsClaimName = 'permissions';\n/** The key of the roles claims in the claims map either under tenant or top level */\nexport const rolesClaimName = 'roles';\n","import type { SdkFnWrapper } from '@descope/core-js-sdk';\nimport { authorizedTenantsClaimName, refreshTokenCookieName } from './constants';\nimport { AuthenticationInfo } from './types';\n\n/**\n * Generate a cookie string from given parameters\n * @param name name of the cookie\n * @param value value of cookie that must be already encoded\n * @param options any options to put on the cookie like cookieDomain, cookieMaxAge, cookiePath\n * @returns Cookie string with all options on the string\n */\nconst generateCookie = (name: string, value: string, options?: Record<string, string | number>) =>\n  `${name}=${value}; Domain=${options?.cookieDomain || ''}; Max-Age=${\n    options?.cookieMaxAge || ''\n  }; Path=${options?.cookiePath || '/'}; HttpOnly; SameSite=Strict`;\n\n/**\n * Parse the cookie string and return the value of the cookie\n * @param cookie the raw cookie string\n * @param name the name of the cookie to get value for\n * @returns the value of the given cookie\n */\nconst getCookieValue = (cookie: string | null | undefined, name: string) => {\n  const match = cookie?.match(RegExp(`(?:^|;\\\\s*)${name}=([^;]*)`));\n  return match ? match[1] : null;\n};\n\n// eslint-disable-next-line import/prefer-default-export\n/**\n * Add cookie generation to core-js functions.\n * @param fn the function we are wrapping\n * @returns Wrapped function with cookie generation\n */\nexport const withCookie: SdkFnWrapper<{ refreshJwt?: string; cookies?: string[] }> =\n  (fn) =>\n  async (...args) => {\n    const resp = await fn(...args);\n\n    // istanbul ignore next\n    if (!resp.data) {\n      return resp;\n    }\n\n    // eslint-disable-next-line prefer-const\n    let { refreshJwt, ...rest } = resp.data;\n    const cookies: string[] = [];\n\n    if (!refreshJwt) {\n      if (resp.response?.headers.get('set-cookie')) {\n        refreshJwt = getCookieValue(\n          resp.response?.headers.get('set-cookie'),\n          refreshTokenCookieName,\n        );\n        cookies.push(resp.response?.headers.get('set-cookie')!);\n      }\n    } else {\n      cookies.push(generateCookie(refreshTokenCookieName, refreshJwt, rest));\n    }\n\n    return { ...resp, data: { ...resp.data, refreshJwt, cookies } };\n  };\n\n/**\n * Get the claim (used for permissions or roles) for a given tenant or top level if tenant is empty\n * @param authInfo The parsed authentication info from the JWT\n * @param claim name of the claim\n * @param tenant tenant to retrieve the claim for\n * @returns\n */\nexport function getAuthorizationClaimItems(\n  authInfo: AuthenticationInfo,\n  claim: string,\n  tenant?: string,\n): string[] {\n  const value = tenant\n    ? authInfo.token[authorizedTenantsClaimName]?.[tenant]?.[claim]\n    : authInfo.token[claim];\n  return Array.isArray(value) ? value : [];\n}\n","/** API paths for the Descope service Management APIs */\nexport default {\n  user: {\n    create: '/v1/mgmt/user/create',\n    update: '/v1/mgmt/user/update',\n    delete: '/v1/mgmt/user/delete',\n    deleteAllTestUsers: '/v1/mgmt/user/test/delete/all',\n    load: '/v1/mgmt/user',\n    search: '/v1/mgmt/user/search',\n    getProviderToken: '/v1/mgmt/user/provider/token',\n    updateStatus: '/v1/mgmt/user/update/status',\n    updateEmail: '/v1/mgmt/user/update/email',\n    updatePhone: '/v1/mgmt/user/update/phone',\n    updateDisplayName: '/v1/mgmt/user/update/name',\n    updatePicture: '/v1/mgmt/user/update/picture',\n    updateCustomAttribute: '/v1/mgmt/user/update/customAttribute',\n    addRole: '/v1/mgmt/user/update/role/add',\n    removeRole: '/v1/mgmt/user/update/role/remove',\n    addTenant: '/v1/mgmt/user/update/tenant/add',\n    removeTenant: '/v1/mgmt/user/update/tenant/remove',\n    setPassword: '/v1/mgmt/user/password/set',\n    expirePassword: '/v1/mgmt/user/password/expire',\n    generateOTPForTest: '/v1/mgmt/tests/generate/otp',\n    generateMagicLinkForTest: '/v1/mgmt/tests/generate/magiclink',\n    generateEnchantedLinkForTest: '/v1/mgmt/tests/generate/enchantedlink',\n  },\n  accessKey: {\n    create: '/v1/mgmt/accesskey/create',\n    load: '/v1/mgmt/accesskey',\n    search: '/v1/mgmt/accesskey/search',\n    update: '/v1/mgmt/accesskey/update',\n    deactivate: '/v1/mgmt/accesskey/deactivate',\n    activate: '/v1/mgmt/accesskey/activate',\n    delete: '/v1/mgmt/accesskey/delete',\n  },\n  tenant: {\n    create: '/v1/mgmt/tenant/create',\n    update: '/v1/mgmt/tenant/update',\n    delete: '/v1/mgmt/tenant/delete',\n    loadAll: '/v1/mgmt/tenant/all',\n  },\n  sso: {\n    settings: '/v1/mgmt/sso/settings',\n    metadata: '/v1/mgmt/sso/metadata',\n    mapping: '/v1/mgmt/sso/mapping',\n  },\n  jwt: {\n    update: '/v1/mgmt/jwt/update',\n  },\n  permission: {\n    create: '/v1/mgmt/permission/create',\n    update: '/v1/mgmt/permission/update',\n    delete: '/v1/mgmt/permission/delete',\n    loadAll: '/v1/mgmt/permission/all',\n  },\n  role: {\n    create: '/v1/mgmt/role/create',\n    update: '/v1/mgmt/role/update',\n    delete: '/v1/mgmt/role/delete',\n    loadAll: '/v1/mgmt/role/all',\n  },\n  flow: {\n    export: '/v1/mgmt/flow/export',\n    import: '/v1/mgmt/flow/import',\n  },\n  theme: {\n    export: '/v1/mgmt/theme/export',\n    import: '/v1/mgmt/theme/import',\n  },\n  group: {\n    loadAllGroups: '/v1/mgmt/group/all',\n    loadAllGroupsForMember: '/v1/mgmt/group/member/all',\n    loadAllGroupMembers: '/v1/mgmt/group/members',\n  },\n};\n","import { DeliveryMethod, SdkResponse, transformResponse, UserResponse } from '@descope/core-js-sdk';\nimport {\n  ProviderTokenResponse,\n  AssociatedTenant,\n  GenerateEnchantedLinkForTestResponse,\n  GenerateMagicLinkForTestResponse,\n  GenerateOTPForTestResponse,\n  AttributesTypes,\n} from './types';\nimport { CoreSdk } from '../types';\nimport apiPaths from './paths';\n\ntype SingleUserResponse = {\n  user: UserResponse;\n};\n\ntype MultipleUsersResponse = {\n  users: UserResponse[];\n};\n\nconst withUser = (sdk: CoreSdk, managementKey?: string) => ({\n  create: (\n    loginId: string,\n    email?: string,\n    phone?: string,\n    displayName?: string,\n    roles?: string[],\n    userTenants?: AssociatedTenant[],\n    customAttributes?: Record<string, AttributesTypes>,\n    picture?: string,\n  ): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.create,\n        {\n          loginId,\n          email,\n          phone,\n          displayName,\n          roleNames: roles,\n          userTenants,\n          customAttributes,\n          picture,\n        },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  /**\n   * Create a new test user.\n   * The loginID is required and will determine what the user will use to sign in.\n   * Make sure the login id is unique for test. All other fields are optional.\n   *\n   * You can later generate OTP, Magic link and enchanted link to use in the test without the need\n   * of 3rd party messaging services.\n   * Those users are not counted as part of the monthly active users\n   * @returns The UserResponse if found, throws otherwise.\n   */\n  createTestUser: (\n    loginId: string,\n    email?: string,\n    phone?: string,\n    displayName?: string,\n    roles?: string[],\n    userTenants?: AssociatedTenant[],\n    customAttributes?: Record<string, AttributesTypes>,\n    picture?: string,\n  ): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.create,\n        {\n          loginId,\n          email,\n          phone,\n          displayName,\n          roleNames: roles,\n          userTenants,\n          test: true,\n          customAttributes,\n          picture,\n        },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  invite: (\n    loginId: string,\n    email?: string,\n    phone?: string,\n    displayName?: string,\n    roles?: string[],\n    userTenants?: AssociatedTenant[],\n    customAttributes?: Record<string, AttributesTypes>,\n    picture?: string,\n  ): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.create,\n        {\n          loginId,\n          email,\n          phone,\n          displayName,\n          roleNames: roles,\n          userTenants,\n          invite: true,\n          customAttributes,\n          picture,\n        },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  update: (\n    loginId: string,\n    email?: string,\n    phone?: string,\n    displayName?: string,\n    roles?: string[],\n    userTenants?: AssociatedTenant[],\n    customAttributes?: Record<string, AttributesTypes>,\n    picture?: string,\n  ): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.update,\n        {\n          loginId,\n          email,\n          phone,\n          displayName,\n          roleNames: roles,\n          userTenants,\n          customAttributes,\n          picture,\n        },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  delete: (loginId: string): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(apiPaths.user.delete, { loginId }, { token: managementKey }),\n    ),\n  /**\n   * Delete all test users in the project.\n   */\n  deleteAllTestUsers: (): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.delete(apiPaths.user.deleteAllTestUsers, { token: managementKey }),\n    ),\n  load: (loginId: string): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.get(apiPaths.user.load, {\n        queryParams: { loginId },\n        token: managementKey,\n      }),\n      (data) => data.user,\n    ),\n  /**\n   * Load an existing user by user ID. The ID can be found\n   * on the user's JWT.\n   * @param userId load a user by this user ID field\n   * @returns The UserResponse if found, throws otherwise.\n   */\n  loadByUserId: (userId: string): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.get(apiPaths.user.load, {\n        queryParams: { userId },\n        token: managementKey,\n      }),\n      (data) => data.user,\n    ),\n  /**\n   * Search all users. Results can be filtered according to tenants and/or\n   * roles, and also paginated used the limit and page parameters.\n   * @param tenantIds optional list of tenant IDs to filter by\n   * @param roles optional list of roles to filter by\n   * @param limit optionally limit the response, leave out for default limit\n   * @param page optionally paginate over the response\n   * @param testUsersOnly optionally filter only test users\n   * @param withTestUser optionally include test users in search\n   * @returns An array of UserResponse found by the query\n   */\n  searchAll: (\n    tenantIds?: string[],\n    roles?: string[],\n    limit?: number,\n    page?: number,\n    testUsersOnly?: boolean,\n    withTestUser?: boolean,\n    customAttributes?: Record<string, AttributesTypes>,\n  ): Promise<SdkResponse<UserResponse[]>> =>\n    transformResponse<MultipleUsersResponse, UserResponse[]>(\n      sdk.httpClient.post(\n        apiPaths.user.search,\n        { tenantIds, roleNames: roles, limit, page, testUsersOnly, withTestUser, customAttributes },\n        { token: managementKey },\n      ),\n      (data) => data.users,\n    ),\n  /**\n   * Get the provider token for the given login ID.\n   * Only users that logged-in using social providers will have token.\n   * Note: The 'Manage tokens from provider' setting must be enabled.\n   * @param loginId the login ID of the user\n   * @param provider the provider name (google, facebook, etc.).\n   * @returns The ProviderTokenResponse of the given user and provider\n   */\n  getProviderToken: (\n    loginId: string,\n    provider: string,\n  ): Promise<SdkResponse<ProviderTokenResponse>> =>\n    transformResponse<ProviderTokenResponse>(\n      sdk.httpClient.get(apiPaths.user.getProviderToken, {\n        queryParams: { loginId, provider },\n        token: managementKey,\n      }),\n      (data) => data,\n    ),\n  activate: (loginId: string): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.updateStatus,\n        { loginId, status: 'enabled' },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  deactivate: (loginId: string): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.updateStatus,\n        { loginId, status: 'disabled' },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  updateEmail: (\n    loginId: string,\n    email: string,\n    isVerified: boolean,\n  ): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.updateEmail,\n        { loginId, email, verified: isVerified },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  updatePhone: (\n    loginId: string,\n    phone: string,\n    isVerified: boolean,\n  ): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.updatePhone,\n        { loginId, phone, verified: isVerified },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  updateDisplayName: (loginId: string, displayName: string): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.updateDisplayName,\n        { loginId, displayName },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  updatePicture: (loginId: string, picture: string): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.updatePicture,\n        { loginId, picture },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  updateCustomAttribute: (\n    loginId: string,\n    attributeKey: string,\n    attributeValue: AttributesTypes,\n  ): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.updateCustomAttribute,\n        { loginId, attributeKey, attributeValue },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  addRoles: (loginId: string, roles: string[]): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.addRole,\n        { loginId, roleNames: roles },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  removeRoles: (loginId: string, roles: string[]): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.removeRole,\n        { loginId, roleNames: roles },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  addTenant: (loginId: string, tenantId: string): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(apiPaths.user.addTenant, { loginId, tenantId }, { token: managementKey }),\n      (data) => data.user,\n    ),\n  removeTenant: (loginId: string, tenantId: string): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.removeTenant,\n        { loginId, tenantId },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  addTenantRoles: (\n    loginId: string,\n    tenantId: string,\n    roles: string[],\n  ): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.addRole,\n        { loginId, tenantId, roleNames: roles },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  removeTenantRoles: (\n    loginId: string,\n    tenantId: string,\n    roles: string[],\n  ): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.removeRole,\n        { loginId, tenantId, roleNames: roles },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n\n  /**\n   * Generate OTP for the given login ID of a test user.\n   * Choose the selected delivery method for verification.\n   * Returns the code for the login (exactly as it sent via Email or SMS)\n   * This is useful when running tests and don't want to use 3rd party messaging services\n   *\n   * @param deliveryMethod optional DeliveryMethod\n   * @param loginId login ID of a test user\n   * @returns GenerateOTPForTestResponse which includes the loginId and the OTP code\n   */\n  generateOTPForTestUser: (\n    deliveryMethod: DeliveryMethod,\n    loginId: string,\n  ): Promise<SdkResponse<GenerateOTPForTestResponse>> =>\n    transformResponse<GenerateOTPForTestResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.generateOTPForTest,\n        { deliveryMethod, loginId },\n        { token: managementKey },\n      ),\n      (data) => data,\n    ),\n\n  /**\n   * Generate Magic Link for the given login ID of a test user.\n   * Choose the selected delivery method for verification.\n   * It returns the link for the login (exactly as it sent via Email)\n   * This is useful when running tests and don't want to use 3rd party messaging services\n   *\n   * @param deliveryMethod optional DeliveryMethod\n   * @param loginId login ID of a test user\n   * @param uri optional redirect uri which will be used instead of any global configuration.\n   * @returns GenerateMagicLinkForTestResponse which includes the loginId and the magic link\n   */\n  generateMagicLinkForTestUser: (\n    deliveryMethod: DeliveryMethod,\n    loginId: string,\n    uri: string,\n  ): Promise<SdkResponse<GenerateMagicLinkForTestResponse>> =>\n    transformResponse<GenerateMagicLinkForTestResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.generateMagicLinkForTest,\n        { deliveryMethod, loginId, URI: uri },\n        { token: managementKey },\n      ),\n      (data) => data,\n    ),\n\n  /**\n   * Generate Enchanted Link for the given login ID of a test user.\n   * It returns the link for the login (exactly as it sent via Email)\n   * and pendingRef which is used to poll for a valid session\n   * This is useful when running tests and don't want to use 3rd party messaging services\n   *\n   * @param loginId login ID of a test user\n   * @param uri optional redirect uri which will be used instead of any global configuration.\n   * @returns GenerateEnchantedLinkForTestResponse which includes the loginId, the enchanted link and the pendingRef\n   */\n  generateEnchantedLinkForTestUser: (\n    loginId: string,\n    uri: string,\n  ): Promise<SdkResponse<GenerateEnchantedLinkForTestResponse>> =>\n    transformResponse<GenerateEnchantedLinkForTestResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.generateEnchantedLinkForTest,\n        { loginId, URI: uri },\n        { token: managementKey },\n      ),\n      (data) => data,\n    ),\n\n  /**\n   * Set password for the given login ID of user.\n   * Note: The password will automatically be set as expired.\n   * The user will not be able to log-in with this password, and will be required to replace it on next login.\n   * See also: expirePassword\n   * @param loginId login ID of a test user\n   * @param password The password to set for the user\n   */\n  setPassword: (loginId: string, password: string): Promise<SdkResponse<never>> =>\n    transformResponse<never>(\n      sdk.httpClient.post(\n        apiPaths.user.setPassword,\n        { loginId, password },\n        { token: managementKey },\n      ),\n      (data) => data,\n    ),\n\n  /**\n   * Expire password for the given login ID.\n   * Note: user sign-in with an expired password, the user will get an error with code.\n   * Use the `ResetPassword` or `ReplacePassword` methods to reset/replace the password.\n   * @param loginId login ID of a test user\n   */\n  expirePassword: (loginId: string): Promise<SdkResponse<never>> =>\n    transformResponse<never>(\n      sdk.httpClient.post(apiPaths.user.expirePassword, { loginId }, { token: managementKey }),\n      (data) => data,\n    ),\n});\n\nexport default withUser;\n","import { SdkResponse, transformResponse } from '@descope/core-js-sdk';\nimport { CoreSdk } from '../types';\nimport apiPaths from './paths';\nimport { CreateTenantResponse, Tenant } from './types';\n\ntype MultipleTenantResponse = {\n  tenants: Tenant[];\n};\n\nconst withTenant = (sdk: CoreSdk, managementKey?: string) => ({\n  create: (\n    name: string,\n    selfProvisioningDomains?: string[],\n  ): Promise<SdkResponse<CreateTenantResponse>> =>\n    transformResponse(\n      sdk.httpClient.post(\n        apiPaths.tenant.create,\n        { name, selfProvisioningDomains },\n        { token: managementKey },\n      ),\n    ),\n  createWithId: (\n    id: string,\n    name: string,\n    selfProvisioningDomains?: string[],\n  ): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(\n        apiPaths.tenant.create,\n        { id, name, selfProvisioningDomains },\n        { token: managementKey },\n      ),\n    ),\n  update: (\n    id: string,\n    name: string,\n    selfProvisioningDomains?: string[],\n  ): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(\n        apiPaths.tenant.update,\n        { id, name, selfProvisioningDomains },\n        { token: managementKey },\n      ),\n    ),\n  delete: (id: string): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(apiPaths.tenant.delete, { id }, { token: managementKey }),\n    ),\n  loadAll: (): Promise<SdkResponse<Tenant[]>> =>\n    transformResponse<MultipleTenantResponse, Tenant[]>(\n      sdk.httpClient.get(apiPaths.tenant.loadAll, {\n        token: managementKey,\n      }),\n      (data) => data.tenants,\n    ),\n});\n\nexport default withTenant;\n","import { SdkResponse, transformResponse } from '@descope/core-js-sdk';\nimport { CoreSdk } from '../types';\nimport apiPaths from './paths';\nimport { UpdateJWTResponse } from './types';\n\nconst withJWT = (sdk: CoreSdk, managementKey?: string) => ({\n  update: (\n    jwt: string,\n    customClaims?: Record<string, any>,\n  ): Promise<SdkResponse<UpdateJWTResponse>> =>\n    transformResponse(\n      sdk.httpClient.post(apiPaths.jwt.update, { jwt, customClaims }, { token: managementKey }),\n    ),\n});\n\nexport default withJWT;\n","import { SdkResponse, transformResponse } from '@descope/core-js-sdk';\nimport { CoreSdk } from '../types';\nimport apiPaths from './paths';\nimport { Permission } from './types';\n\ntype MultiplePermissionResponse = {\n  permissions: Permission[];\n};\n\nconst withPermission = (sdk: CoreSdk, managementKey?: string) => ({\n  create: (name: string, description?: string): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(\n        apiPaths.permission.create,\n        { name, description },\n        { token: managementKey },\n      ),\n    ),\n  update: (name: string, newName: string, description?: string): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(\n        apiPaths.permission.update,\n        { name, newName, description },\n        { token: managementKey },\n      ),\n    ),\n  delete: (name: string): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(apiPaths.permission.delete, { name }, { token: managementKey }),\n    ),\n  loadAll: (): Promise<SdkResponse<Permission[]>> =>\n    transformResponse<MultiplePermissionResponse, Permission[]>(\n      sdk.httpClient.get(apiPaths.permission.loadAll, {\n        token: managementKey,\n      }),\n      (data) => data.permissions,\n    ),\n});\n\nexport default withPermission;\n","import { SdkResponse, transformResponse } from '@descope/core-js-sdk';\nimport { CoreSdk } from '../types';\nimport apiPaths from './paths';\nimport { Role } from './types';\n\ntype MultipleRoleResponse = {\n  roles: Role[];\n};\n\nconst withRole = (sdk: CoreSdk, managementKey?: string) => ({\n  create: (\n    name: string,\n    description?: string,\n    permissionNames?: string[],\n  ): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(\n        apiPaths.role.create,\n        { name, description, permissionNames },\n        { token: managementKey },\n      ),\n    ),\n  update: (\n    name: string,\n    newName: string,\n    description?: string,\n    permissionNames?: string[],\n  ): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(\n        apiPaths.role.update,\n        { name, newName, description, permissionNames },\n        { token: managementKey },\n      ),\n    ),\n  delete: (name: string): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(apiPaths.role.delete, { name }, { token: managementKey }),\n    ),\n  loadAll: (): Promise<SdkResponse<Role[]>> =>\n    transformResponse<MultipleRoleResponse, Role[]>(\n      sdk.httpClient.get(apiPaths.role.loadAll, {\n        token: managementKey,\n      }),\n      (data) => data.roles,\n    ),\n});\n\nexport default withRole;\n","import { SdkResponse, transformResponse } from '@descope/core-js-sdk';\nimport { CoreSdk } from '../types';\nimport apiPaths from './paths';\nimport { Group } from './types';\n\nconst withGroup = (sdk: CoreSdk, managementKey?: string) => ({\n  /**\n   * Load all groups for a specific tenant id.\n   * @param tenantId Tenant ID to load groups from.\n   * @returns Group[] list of groups\n   */\n  loadAllGroups: (tenantId: string): Promise<SdkResponse<Group[]>> =>\n    transformResponse<Group[]>(\n      sdk.httpClient.post(apiPaths.group.loadAllGroups, { tenantId }, { token: managementKey }),\n    ),\n\n  /**\n   * Load all groups for the provided user IDs or login IDs.\n   * @param tenantId Tenant ID to load groups from.\n   * @param userIds Optional List of user IDs, with the format of \"U2J5ES9S8TkvCgOvcrkpzUgVTEBM\" (example), which can be found on the user's JWT.\n   * @param loginIds Optional List of login IDs, how the user identifies when logging in.\n   * @returns Group[] list of groups\n   */\n  loadAllGroupsForMember: (\n    tenantId: string,\n    userIds: string[],\n    loginIds: string[],\n  ): Promise<SdkResponse<Group[]>> =>\n    transformResponse<Group[]>(\n      sdk.httpClient.post(\n        apiPaths.group.loadAllGroupsForMember,\n        { tenantId, loginIds, userIds },\n        { token: managementKey },\n      ),\n    ),\n\n  /**\n   * Load all members of the provided group id.\n   * @param tenantId Tenant ID to load groups from.\n   * @param groupId Group ID to load members for.\n   * @returns Group[] list of groups\n   */\n  loadAllGroupMembers: (tenantId: string, groupId: string): Promise<SdkResponse<Group[]>> =>\n    transformResponse<Group[]>(\n      sdk.httpClient.post(\n        apiPaths.group.loadAllGroupMembers,\n        { tenantId, groupId },\n        { token: managementKey },\n      ),\n    ),\n});\n\nexport default withGroup;\n","import { SdkResponse, transformResponse } from '@descope/core-js-sdk';\nimport { CoreSdk } from '../types';\nimport apiPaths from './paths';\nimport { RoleMappings, AttributeMapping, SSOSettingsResponse } from './types';\n\nconst withSSOSettings = (sdk: CoreSdk, managementKey?: string) => ({\n  getSettings: (tenantId: string): Promise<SdkResponse<SSOSettingsResponse>> =>\n    transformResponse<SSOSettingsResponse>(\n      sdk.httpClient.get(apiPaths.sso.settings, {\n        queryParams: { tenantId },\n        token: managementKey,\n      }),\n      (data) => data,\n    ),\n  deleteSettings: (tenantId: string): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.delete(apiPaths.sso.settings, {\n        queryParams: { tenantId },\n        token: managementKey,\n      }),\n    ),\n  configureSettings: (\n    tenantId: string,\n    idpURL: string,\n    idpCert: string,\n    entityId: string,\n    redirectURL?: string,\n    domain?: string,\n  ): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(\n        apiPaths.sso.settings,\n        { tenantId, idpURL, entityId, idpCert, redirectURL, domain },\n        { token: managementKey },\n      ),\n    ),\n  configureMetadata: (tenantId: string, idpMetadataURL: string): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(\n        apiPaths.sso.metadata,\n        { tenantId, idpMetadataURL },\n        { token: managementKey },\n      ),\n    ),\n  configureMapping: (\n    tenantId: string,\n    roleMappings?: RoleMappings,\n    attributeMapping?: AttributeMapping,\n  ): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(\n        apiPaths.sso.mapping,\n        { tenantId, roleMappings, attributeMapping },\n        { token: managementKey },\n      ),\n    ),\n});\n\nexport default withSSOSettings;\n","import { SdkResponse, transformResponse } from '@descope/core-js-sdk';\nimport { CoreSdk } from '../types';\nimport apiPaths from './paths';\nimport { AccessKey, AssociatedTenant, CreatedAccessKeyResponse } from './types';\n\ntype SingleKeyResponse = {\n  key: AccessKey;\n};\n\ntype MultipleKeysResponse = {\n  keys: AccessKey[];\n};\n\nconst withAccessKey = (sdk: CoreSdk, managementKey?: string) => ({\n  /**\n   * Create a new access key for a project.\n   * @param name Access key name\n   * @param expireTime When the access key expires. Keep at 0 to make it indefinite.\n   * @param roles Optional roles in the project. Does not apply for multi-tenants\n   * @param keyTenants Optional associated tenants for this key and its roles for each.\n   * @returns A newly created key and its cleartext. Make sure to save the cleartext securely.\n   */\n  create: (\n    name: string,\n    expireTime: number,\n    roles?: string[],\n    keyTenants?: AssociatedTenant[],\n  ): Promise<SdkResponse<CreatedAccessKeyResponse>> =>\n    transformResponse(\n      sdk.httpClient.post(\n        apiPaths.accessKey.create,\n        { name, expireTime, roleNames: roles, keyTenants },\n        { token: managementKey },\n      ),\n    ),\n  /**\n   * Load an access key.\n   * @param id Access key ID to load\n   * @returns The loaded access key.\n   */\n  load: (id: string): Promise<SdkResponse<AccessKey>> =>\n    transformResponse<SingleKeyResponse, AccessKey>(\n      sdk.httpClient.get(apiPaths.accessKey.load, {\n        queryParams: { id },\n        token: managementKey,\n      }),\n      (data) => data.key,\n    ),\n  /**\n   * Search all access keys\n   * @param tenantIds Optional tenant ID filter to apply on the search results\n   * @returns An array of found access keys\n   */\n  searchAll: (tenantIds?: string[]): Promise<SdkResponse<AccessKey[]>> =>\n    transformResponse<MultipleKeysResponse, AccessKey[]>(\n      sdk.httpClient.post(apiPaths.accessKey.search, { tenantIds }, { token: managementKey }),\n      (data) => data.keys,\n    ),\n  /**\n   * Update an access key.\n   * @param id Access key ID to load\n   * @param name The updated access key name\n   * @returns The updated access key\n   */\n  update: (id: string, name: string): Promise<SdkResponse<AccessKey>> =>\n    transformResponse<SingleKeyResponse, AccessKey>(\n      sdk.httpClient.post(apiPaths.accessKey.update, { id, name }, { token: managementKey }),\n      (data) => data.key,\n    ),\n  /**\n   * Deactivate an access key. Deactivated access keys cannot be used until they are\n   * activated again.\n   * @param id Access key ID to deactivate\n   */\n  deactivate: (id: string): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(apiPaths.accessKey.deactivate, { id }, { token: managementKey }),\n    ),\n  /**\n   * Activate an access key. Only deactivated access keys can be activated again.\n   * @param id Access key ID to activate\n   */\n  activate: (id: string): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(apiPaths.accessKey.activate, { id }, { token: managementKey }),\n    ),\n  /**\n   * Delete an access key. IMPORTANT: This cannot be undone. Use carefully.\n   * @param id Access key ID to delete\n   */\n  delete: (id: string): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(apiPaths.accessKey.delete, { id }, { token: managementKey }),\n    ),\n});\n\nexport default withAccessKey;\n","import { SdkResponse, transformResponse } from '@descope/core-js-sdk';\nimport { CoreSdk } from '../types';\nimport apiPaths from './paths';\nimport { FlowResponse, Screen, Flow } from './types';\n\nconst WithFlow = (sdk: CoreSdk, managementKey?: string) => ({\n  export: (flowId: string): Promise<SdkResponse<FlowResponse>> =>\n    transformResponse(\n      sdk.httpClient.post(apiPaths.flow.export, { flowId }, { token: managementKey }),\n    ),\n  import: (flowId: string, flow: Flow, screens?: Screen[]): Promise<SdkResponse<FlowResponse>> =>\n    transformResponse(\n      sdk.httpClient.post(\n        apiPaths.flow.import,\n        { flowId, flow, screens },\n        { token: managementKey },\n      ),\n    ),\n});\n\nexport default WithFlow;\n","import { SdkResponse, transformResponse } from '@descope/core-js-sdk';\nimport { CoreSdk } from '../types';\nimport apiPaths from './paths';\nimport { Theme, ThemeResponse } from './types';\n\nconst WithTheme = (sdk: CoreSdk, managementKey?: string) => ({\n  export: (): Promise<SdkResponse<ThemeResponse>> =>\n    transformResponse(sdk.httpClient.post(apiPaths.theme.export, {}, { token: managementKey })),\n  import: (theme: Theme): Promise<SdkResponse<ThemeResponse>> =>\n    transformResponse(\n      sdk.httpClient.post(apiPaths.theme.import, { theme }, { token: managementKey }),\n    ),\n});\n\nexport default WithTheme;\n","import nodeFetch, { Headers } from 'node-fetch-commonjs';\n\nglobalThis.Headers ??= Headers;\n\nconst highWaterMarkMb = 1024 * 1024 * 30; // 30MB\n\n// we are increasing the response buffer size due to an issue where node-fetch hangs when response is too big\nconst patchedFetch = (...args: Parameters<typeof nodeFetch>) => {\n  // we can get Request on the first arg, or RequestInfo on the second arg\n  // we want to make sure we are setting the \"highWaterMark\" so we are doing it on both args\n  args.forEach((arg) => {\n    // eslint-disable-next-line no-param-reassign, @typescript-eslint/no-unused-expressions\n    arg && ((arg as any).highWaterMark ??= highWaterMarkMb);\n  });\n\n  return nodeFetch(...args);\n};\n\nexport default patchedFetch as unknown as typeof fetch;\n","import createSdk, { ExchangeAccessKeyResponse, SdkResponse, wrapWith } from '@descope/core-js-sdk';\nimport { JWK, JWTHeaderParameters, KeyLike, errors, importJWK, jwtVerify } from 'jose';\nimport {\n  permissionsClaimName,\n  refreshTokenCookieName,\n  rolesClaimName,\n  sessionTokenCookieName,\n} from './constants';\nimport { getAuthorizationClaimItems, withCookie } from './helpers';\nimport withManagement from './management';\nimport { AuthenticationInfo } from './types';\nimport fetch from './fetch-polyfill';\n\ndeclare const BUILD_VERSION: string;\n\n/** Configuration arguments which include the Descope core SDK args and an optional management key */\ntype NodeSdkArgs = Parameters<typeof createSdk>[0] & {\n  managementKey?: string;\n  publicKey?: string;\n};\n\nconst nodeSdk = ({ managementKey, publicKey, ...config }: NodeSdkArgs) => {\n  const coreSdk = createSdk({\n    ...config,\n    fetch,\n    baseHeaders: {\n      ...config.baseHeaders,\n      'x-descope-sdk-name': 'nodejs',\n      'x-descope-sdk-node-version': process?.versions?.node || '',\n      'x-descope-sdk-version': BUILD_VERSION,\n    },\n  });\n\n  const { projectId, logger } = config;\n\n  const keys: Record<string, KeyLike | Uint8Array> = {};\n\n  /** Fetch the public keys (JWKs) from Descope for the configured project */\n  const fetchKeys = async () => {\n    if (publicKey) {\n      try {\n        const parsedKey = JSON.parse(publicKey);\n        const key = await importJWK(parsedKey);\n        return {\n          [parsedKey.kid]: key,\n        };\n      } catch (e) {\n        logger?.error('Failed to parse the provided public key', e);\n        throw new Error('Failed to parse public key');\n      }\n    }\n\n    const keysWrapper = await coreSdk.httpClient\n      .get(`v2/keys/${projectId}`)\n      .then((resp) => resp.json());\n    const publicKeys: JWK[] = keysWrapper.keys;\n    if (!Array.isArray(publicKeys)) return {};\n    const kidJwksPairs = await Promise.all(\n      publicKeys.map(async (key) => [key.kid, await importJWK(key)]),\n    );\n\n    return kidJwksPairs.reduce(\n      (acc, [kid, jwk]) => (kid ? { ...acc, [kid.toString()]: jwk } : acc),\n      {},\n    );\n  };\n\n  const management = withManagement(coreSdk, managementKey);\n\n  const sdk = {\n    ...coreSdk,\n\n    /**\n     * Provides various APIs for managing a Descope project programmatically. A management key must\n     * be provided as an argument when initializing the SDK to use these APIs. Management keys can be\n     * generated in the Descope console.\n     */\n    management,\n\n    /** Get the key that can validate the given JWT KID in the header. Can retrieve the public key from local cache or from Descope. */\n    async getKey(header: JWTHeaderParameters): Promise<KeyLike | Uint8Array> {\n      if (!header?.kid) throw Error('header.kid must not be empty');\n\n      if (keys[header.kid]) return keys[header.kid];\n\n      // do we need to fetch once or every time?\n      Object.assign(keys, await fetchKeys());\n\n      if (!keys[header.kid]) throw Error('failed to fetch matching key');\n\n      return keys[header.kid];\n    },\n\n    /**\n     * Validate the given JWT with the right key and make sure the issuer is correct\n     * @param jwt the JWT string to parse and validate\n     * @returns AuthenticationInfo with the parsed token and JWT. Will throw an error if validation fails.\n     */\n    async validateJwt(jwt: string): Promise<AuthenticationInfo> {\n      // Do not hard-code the algo because library does not support `None` so all are valid\n      const res = await jwtVerify(jwt, sdk.getKey, { clockTolerance: 5 });\n      const token = res.payload;\n\n      if (token) {\n        token.iss = token.iss?.split('/').pop(); // support both url and project id as issuer\n        if (token.iss !== projectId) {\n          // We must do the verification here, since issuer can be either project ID or URL\n          throw new errors.JWTClaimValidationFailed(\n            'unexpected \"iss\" claim value',\n            'iss',\n            'check_failed',\n          );\n        }\n      }\n\n      return { jwt, token };\n    },\n\n    /**\n     * Validate an active session\n     * @param sessionToken session JWT to validate\n     * @returns AuthenticationInfo promise or throws Error if there is an issue with JWTs\n     */\n    async validateSession(sessionToken: string): Promise<AuthenticationInfo> {\n      if (!sessionToken) throw Error('session token is required for validation');\n\n      try {\n        const token = await sdk.validateJwt(sessionToken);\n        return token;\n      } catch (error) {\n        /* istanbul ignore next */\n        logger?.error('session validation failed', error);\n        throw Error('session validation failed');\n      }\n    },\n\n    /**\n     * Refresh the session using a refresh token\n     * @param refreshToken refresh JWT to refresh the session with\n     * @returns AuthenticationInfo promise or throws Error if there is an issue with JWTs\n     */\n    async refreshSession(refreshToken: string): Promise<AuthenticationInfo> {\n      if (!refreshToken) throw Error('refresh token is required to refresh a session');\n\n      try {\n        await sdk.validateJwt(refreshToken);\n        const jwtResp = await sdk.refresh(refreshToken);\n        if (jwtResp.ok) {\n          const token = await sdk.validateJwt(jwtResp.data?.sessionJwt);\n          return token;\n        }\n        /* istanbul ignore next */\n        throw Error(jwtResp.error?.errorMessage);\n      } catch (refreshTokenErr) {\n        /* istanbul ignore next */\n        logger?.error('refresh token validation failed', refreshTokenErr);\n        throw Error('refresh token validation failed');\n      }\n    },\n\n    /**\n     * Validate session and refresh it if it expired\n     * @param sessionToken session JWT\n     * @param refreshToken refresh JWT\n     * @returns AuthenticationInfo promise or throws Error if there is an issue with JWTs\n     */\n    async validateAndRefreshSession(\n      sessionToken?: string,\n      refreshToken?: string,\n    ): Promise<AuthenticationInfo> {\n      if (!sessionToken && !refreshToken) throw Error('both session and refresh tokens are empty');\n\n      try {\n        const token = await sdk.validateSession(sessionToken);\n        return token;\n      } catch (error) {\n        /* istanbul ignore next */\n        logger?.log('session validation failed - trying to refresh it');\n      }\n\n      return sdk.refreshSession(refreshToken);\n    },\n\n    /**\n     * Exchange API key (access key) for a session key\n     * @param accessKey access key to exchange for a session JWT\n     * @returns AuthneticationInfo with session JWT data\n     */\n    async exchangeAccessKey(accessKey: string): Promise<AuthenticationInfo> {\n      if (!accessKey) throw Error('access key must not be empty');\n\n      let resp: SdkResponse<ExchangeAccessKeyResponse>;\n      try {\n        resp = await sdk.accessKey.exchange(accessKey);\n      } catch (error) {\n        logger?.error('failed to exchange access key', error);\n        throw Error('could not exchange access key');\n      }\n\n      const { sessionJwt } = resp.data;\n      if (!sessionJwt) {\n        logger?.error('failed to parse exchange access key response');\n        throw Error('could not exchange access key');\n      }\n\n      try {\n        const token = await sdk.validateJwt(sessionJwt);\n        return token;\n      } catch (error) {\n        logger?.error('failed to parse jwt from access key', error);\n        throw Error('could not exchange access key');\n      }\n    },\n\n    /**\n     * Make sure that all given permissions exist on the parsed JWT top level claims\n     * @param authInfo JWT parsed info\n     * @param permissions list of permissions to make sure they exist on te JWT claims\n     * @returns true if all permissions exist, false otherwise\n     */\n    validatePermissions(authInfo: AuthenticationInfo, permissions: string[]): boolean {\n      return sdk.validateTenantPermissions(authInfo, null, permissions);\n    },\n\n    /**\n     * Make sure that all given permissions exist on the parsed JWT tenant claims\n     * @param authInfo JWT parsed info\n     * @param permissions list of permissions to make sure they exist on te JWT claims\n     * @returns true if all permissions exist, false otherwise\n     */\n    validateTenantPermissions(\n      authInfo: AuthenticationInfo,\n      tenant: string,\n      permissions: string[],\n    ): boolean {\n      const granted = getAuthorizationClaimItems(authInfo, permissionsClaimName, tenant);\n      return permissions.every((perm) => granted.includes(perm));\n    },\n\n    /**\n     * Make sure that all given roles exist on the parsed JWT top level claims\n     * @param authInfo JWT parsed info\n     * @param roles list of roles to make sure they exist on te JWT claims\n     * @returns true if all roles exist, false otherwise\n     */\n    validateRoles(authInfo: AuthenticationInfo, roles: string[]): boolean {\n      return sdk.validateTenantRoles(authInfo, null, roles);\n    },\n\n    /**\n     * Make sure that all given roles exist on the parsed JWT tenant claims\n     * @param authInfo JWT parsed info\n     * @param roles list of roles to make sure they exist on te JWT claims\n     * @returns true if all roles exist, false otherwise\n     */\n    validateTenantRoles(authInfo: AuthenticationInfo, tenant: string, roles: string[]): boolean {\n      const membership = getAuthorizationClaimItems(authInfo, rolesClaimName, tenant);\n      return roles.every((role) => membership.includes(role));\n    },\n  };\n\n  return wrapWith(\n    sdk,\n    [\n      'otp.verify.email',\n      'otp.verify.sms',\n      'otp.verify.whatsapp',\n      'magicLink.verify',\n      'enchantedLink.signUp',\n      'enchantedLink.signIn',\n      'oauth.exchange',\n      'saml.exchange',\n      'totp.verify',\n      'webauthn.signIn.finish',\n      'webauthn.signUp.finish',\n      'refresh',\n    ] as const,\n    withCookie,\n  );\n};\n\n/** Descope SDK client with delivery methods enum.\n *\n * Please see full documentation at {@link https://docs.descope.com/guides Descope Docs}\n * @example Usage\n *\n * ```js\n * import descopeSdk from '@descope/node-sdk';\n *\n * const myProjectId = 'xxx';\n * const sdk = descopeSdk({ projectId: myProjectId });\n *\n * const userLoginId = 'loginId';\n * sdk.otp.signIn.email(userLoginId);\n * const jwtResponse = sdk.otp.verify.email(userLoginId, codeFromEmail);\n * ```\n */\n\nnodeSdk.RefreshTokenCookieName = refreshTokenCookieName;\nnodeSdk.SessionTokenCookieName = sessionTokenCookieName;\n\nexport default nodeSdk;\nexport type {\n  DeliveryMethod,\n  OAuthProvider,\n  ResponseData,\n  SdkResponse,\n  JWTResponse,\n} from '@descope/core-js-sdk';\nexport type { AuthenticationInfo };\n","import { CoreSdk } from '../types';\nimport withUser from './user';\nimport withTenant from './tenant';\nimport withJWT from './jwt';\nimport withPermission from './permission';\nimport withRole from './role';\nimport withGroup from './group';\nimport withSSOSettings from './sso';\nimport withAccessKey from './accesskey';\nimport WithFlow from './flow';\nimport WithTheme from './theme';\n\n/** Constructs a higher level Management API that wraps the functions from code-js-sdk */\nconst withManagement = (sdk: CoreSdk, managementKey?: string) => ({\n  user: withUser(sdk, managementKey),\n  accessKey: withAccessKey(sdk, managementKey),\n  tenant: withTenant(sdk, managementKey),\n  sso: withSSOSettings(sdk, managementKey),\n  jwt: withJWT(sdk, managementKey),\n  permission: withPermission(sdk, managementKey),\n  role: withRole(sdk, managementKey),\n  group: withGroup(sdk, managementKey),\n  flow: WithFlow(sdk, managementKey),\n  theme: WithTheme(sdk, managementKey),\n});\n\nexport default withManagement;\n"],"names":["withCookie","fn","async","args","resp","data","_d","refreshJwt","rest","__rest","cookies","options","push","cookieDomain","cookieMaxAge","cookiePath","_a","response","headers","get","cookie","name","match","RegExp","getCookieValue","_b","_c","Object","assign","getAuthorizationClaimItems","authInfo","claim","tenant","value","token","Array","isArray","apiPaths","create","update","delete","deleteAllTestUsers","load","search","getProviderToken","updateStatus","updateEmail","updatePhone","updateDisplayName","updatePicture","updateCustomAttribute","addRole","removeRole","addTenant","removeTenant","setPassword","expirePassword","generateOTPForTest","generateMagicLinkForTest","generateEnchantedLinkForTest","deactivate","activate","loadAll","settings","metadata","mapping","export","import","loadAllGroups","loadAllGroupsForMember","loadAllGroupMembers","withUser","sdk","managementKey","loginId","email","phone","displayName","roles","userTenants","customAttributes","picture","transformResponse","httpClient","post","roleNames","user","createTestUser","test","invite","queryParams","loadByUserId","userId","searchAll","tenantIds","limit","page","testUsersOnly","withTestUser","users","provider","status","isVerified","verified","attributeKey","attributeValue","addRoles","removeRoles","tenantId","addTenantRoles","removeTenantRoles","generateOTPForTestUser","deliveryMethod","generateMagicLinkForTestUser","uri","URI","generateEnchantedLinkForTestUser","password","withTenant","selfProvisioningDomains","createWithId","id","tenants","withJWT","jwt","customClaims","withPermission","description","newName","permissions","withRole","permissionNames","withGroup","userIds","loginIds","groupId","withSSOSettings","getSettings","deleteSettings","configureSettings","idpURL","idpCert","entityId","redirectURL","domain","configureMetadata","idpMetadataURL","configureMapping","roleMappings","attributeMapping","withAccessKey","expireTime","keyTenants","key","keys","WithFlow","flowId","flow","screens","WithTheme","theme","globalThis","Headers","patchedFetch","forEach","arg","highWaterMark","nodeFetch","nodeSdk","publicKey","config","coreSdk","createSdk","fetch","baseHeaders","process","versions","node","projectId","logger","management","accessKey","sso","permission","role","group","withManagement","header","kid","Error","parsedKey","JSON","parse","importJWK","e","error","publicKeys","then","json","Promise","all","map","reduce","acc","jwk","toString","fetchKeys","jwtVerify","getKey","clockTolerance","payload","iss","split","pop","errors","JWTClaimValidationFailed","sessionToken","validateJwt","refreshToken","jwtResp","refresh","ok","sessionJwt","errorMessage","refreshTokenErr","validateSession","log","refreshSession","exchange","validatePermissions","validateTenantPermissions","granted","every","perm","includes","validateRoles","validateTenantRoles","membership","wrapWith","RefreshTokenCookieName","SessionTokenCookieName"],"mappings":"mNAEO,MC+BMA,EACVC,GACDC,SAAUC,eACR,MAAMC,QAAaH,KAAME,GAGzB,IAAKC,EAAKC,KACR,OAAOD,EAIT,IAAIE,EAA0BF,EAAKC,MAA/BE,WAAEA,GAAUD,EAAKE,EAAjBC,EAAAA,OAAAH,EAAA,CAAA,eACJ,MAAMI,EAAoB,GAlCP,IAA8BC,EAgDjD,OAZKJ,EASHG,EAAQE,KA5CZ,GDVoC,SCsDoBL,cA5C5BI,OADuBA,EA6CiBH,QA5CxC,EAAAG,EAASE,eAAgB,gBACnDF,aAAA,EAAAA,EAASG,eAAgB,aACjBH,aAAA,EAAAA,EAASI,aAAc,mCAkCZ,QAAbC,EAAAZ,EAAKa,gBAAQ,IAAAD,OAAA,EAAAA,EAAEE,QAAQC,IAAI,iBAC7BZ,EA3Be,EAACa,EAAmCC,KACzD,MAAMC,EAAQF,eAAAA,EAAQE,MAAMC,OAAO,cAAcF,cACjD,OAAOC,EAAQA,EAAM,GAAK,IAAI,EAyBXE,CACE,QAAbC,EAAArB,EAAKa,gBAAQ,IAAAQ,OAAA,EAAAA,EAAEP,QAAQC,IAAI,cDhDC,OCmD9BT,EAAQE,KAAoB,QAAfc,EAAAtB,EAAKa,gBAAU,IAAAS,OAAA,EAAAA,EAAAR,QAAQC,IAAI,gBAMhCQ,OAAAC,OAAAD,OAAAC,OAAA,CAAA,EAAAxB,GAAM,CAAAC,KAAWsB,OAAAC,OAAAD,OAAAC,OAAA,GAAAxB,EAAKC,MAAM,CAAAE,aAAYG,aAAY,WAUpDmB,EACdC,EACAC,EACAC,WAEA,MAAMC,EAAQD,EAC0C,QAApDP,EAA6C,QAA7CT,EAAAc,EAASI,MAAgC,eAAI,IAAAlB,OAAA,EAAAA,EAAAgB,UAAO,IAAAP,OAAA,EAAAA,EAAGM,GACvDD,EAASI,MAAMH,GACnB,OAAOI,MAAMC,QAAQH,GAASA,EAAQ,EACxC,CC7EA,IAAeI,EACP,CACJC,OAAQ,uBACRC,OAAQ,uBACRC,OAAQ,uBACRC,mBAAoB,gCACpBC,KAAM,gBACNC,OAAQ,uBACRC,iBAAkB,+BAClBC,aAAc,8BACdC,YAAa,6BACbC,YAAa,6BACbC,kBAAmB,4BACnBC,cAAe,+BACfC,sBAAuB,uCACvBC,QAAS,gCACTC,WAAY,mCACZC,UAAW,kCACXC,aAAc,qCACdC,YAAa,6BACbC,eAAgB,gCAChBC,mBAAoB,8BACpBC,yBAA0B,oCAC1BC,6BAA8B,yCAvBnBtB,EAyBF,CACTC,OAAQ,4BACRI,KAAM,qBACNC,OAAQ,4BACRJ,OAAQ,4BACRqB,WAAY,gCACZC,SAAU,8BACVrB,OAAQ,6BAhCGH,EAkCL,CACNC,OAAQ,yBACRC,OAAQ,yBACRC,OAAQ,yBACRsB,QAAS,uBAtCEzB,EAwCR,CACH0B,SAAU,wBACVC,SAAU,wBACVC,QAAS,wBA3CE5B,EA6CR,CACHE,OAAQ,uBA9CGF,EAgDD,CACVC,OAAQ,6BACRC,OAAQ,6BACRC,OAAQ,6BACRsB,QAAS,2BApDEzB,EAsDP,CACJC,OAAQ,uBACRC,OAAQ,uBACRC,OAAQ,uBACRsB,QAAS,qBA1DEzB,EA4DP,CACJ6B,OAAQ,uBACRC,OAAQ,wBA9DG9B,EAgEN,CACL6B,OAAQ,wBACRC,OAAQ,yBAlEG9B,EAoEN,CACL+B,cAAe,qBACfC,uBAAwB,4BACxBC,oBAAqB,0BCpDzB,MAAMC,EAAW,CAACC,EAAcC,KAA4B,CAC1DnC,OAAQ,CACNoC,EACAC,EACAC,EACAC,EACAC,EACAC,EACAC,EACAC,IAEAC,EAAAA,kBACEV,EAAIW,WAAWC,KACb/C,EAAcC,OACd,CACEoC,UACAC,QACAC,QACAC,cACAQ,UAAWP,EACXC,cACAC,mBACAC,WAEF,CAAE/C,MAAOuC,KAEVpE,GAASA,EAAKiF,OAYnBC,eAAgB,CACdb,EACAC,EACAC,EACAC,EACAC,EACAC,EACAC,EACAC,IAEAC,EAAAA,kBACEV,EAAIW,WAAWC,KACb/C,EAAcC,OACd,CACEoC,UACAC,QACAC,QACAC,cACAQ,UAAWP,EACXC,cACAS,MAAM,EACNR,mBACAC,WAEF,CAAE/C,MAAOuC,KAEVpE,GAASA,EAAKiF,OAEnBG,OAAQ,CACNf,EACAC,EACAC,EACAC,EACAC,EACAC,EACAC,EACAC,IAEAC,EAAAA,kBACEV,EAAIW,WAAWC,KACb/C,EAAcC,OACd,CACEoC,UACAC,QACAC,QACAC,cACAQ,UAAWP,EACXC,cACAU,QAAQ,EACRT,mBACAC,WAEF,CAAE/C,MAAOuC,KAEVpE,GAASA,EAAKiF,OAEnB/C,OAAQ,CACNmC,EACAC,EACAC,EACAC,EACAC,EACAC,EACAC,EACAC,IAEAC,EAAAA,kBACEV,EAAIW,WAAWC,KACb/C,EAAcE,OACd,CACEmC,UACAC,QACAC,QACAC,cACAQ,UAAWP,EACXC,cACAC,mBACAC,WAEF,CAAE/C,MAAOuC,KAEVpE,GAASA,EAAKiF,OAEnB9C,OAASkC,GACPQ,EAAAA,kBACEV,EAAIW,WAAWC,KAAK/C,EAAcG,OAAQ,CAAEkC,WAAW,CAAExC,MAAOuC,KAKpEhC,mBAAoB,IAClByC,EAAAA,kBACEV,EAAIW,WAAW3C,OAAOH,EAAcI,mBAAoB,CAAEP,MAAOuC,KAErE/B,KAAOgC,GACLQ,EAAAA,kBACEV,EAAIW,WAAWhE,IAAIkB,EAAcK,KAAM,CACrCgD,YAAa,CAAEhB,WACfxC,MAAOuC,KAERpE,GAASA,EAAKiF,OAQnBK,aAAeC,GACbV,EAAAA,kBACEV,EAAIW,WAAWhE,IAAIkB,EAAcK,KAAM,CACrCgD,YAAa,CAAEE,UACf1D,MAAOuC,KAERpE,GAASA,EAAKiF,OAanBO,UAAW,CACTC,EACAhB,EACAiB,EACAC,EACAC,EACAC,EACAlB,IAEAE,EAAAA,kBACEV,EAAIW,WAAWC,KACb/C,EAAcM,OACd,CAAEmD,YAAWT,UAAWP,EAAOiB,QAAOC,OAAMC,gBAAeC,eAAclB,oBACzE,CAAE9C,MAAOuC,KAEVpE,GAASA,EAAK8F,QAUnBvD,iBAAkB,CAChB8B,EACA0B,IAEAlB,oBACEV,EAAIW,WAAWhE,IAAIkB,EAAcO,iBAAkB,CACjD8C,YAAa,CAAEhB,UAAS0B,YACxBlE,MAAOuC,KAERpE,GAASA,IAEdwD,SAAWa,GACTQ,EAAAA,kBACEV,EAAIW,WAAWC,KACb/C,EAAcQ,aACd,CAAE6B,UAAS2B,OAAQ,WACnB,CAAEnE,MAAOuC,KAEVpE,GAASA,EAAKiF,OAEnB1B,WAAac,GACXQ,EAAAA,kBACEV,EAAIW,WAAWC,KACb/C,EAAcQ,aACd,CAAE6B,UAAS2B,OAAQ,YACnB,CAAEnE,MAAOuC,KAEVpE,GAASA,EAAKiF,OAEnBxC,YAAa,CACX4B,EACAC,EACA2B,IAEApB,EAAAA,kBACEV,EAAIW,WAAWC,KACb/C,EAAcS,YACd,CAAE4B,UAASC,QAAO4B,SAAUD,GAC5B,CAAEpE,MAAOuC,KAEVpE,GAASA,EAAKiF,OAEnBvC,YAAa,CACX2B,EACAE,EACA0B,IAEApB,EAAAA,kBACEV,EAAIW,WAAWC,KACb/C,EAAcU,YACd,CAAE2B,UAASE,QAAO2B,SAAUD,GAC5B,CAAEpE,MAAOuC,KAEVpE,GAASA,EAAKiF,OAEnBtC,kBAAmB,CAAC0B,EAAiBG,IACnCK,EAAiBA,kBACfV,EAAIW,WAAWC,KACb/C,EAAcW,kBACd,CAAE0B,UAASG,eACX,CAAE3C,MAAOuC,KAEVpE,GAASA,EAAKiF,OAEnBrC,cAAe,CAACyB,EAAiBO,IAC/BC,EAAiBA,kBACfV,EAAIW,WAAWC,KACb/C,EAAcY,cACd,CAAEyB,UAASO,WACX,CAAE/C,MAAOuC,KAEVpE,GAASA,EAAKiF,OAEnBpC,sBAAuB,CACrBwB,EACA8B,EACAC,IAEAvB,EAAAA,kBACEV,EAAIW,WAAWC,KACb/C,EAAca,sBACd,CAAEwB,UAAS8B,eAAcC,kBACzB,CAAEvE,MAAOuC,KAEVpE,GAASA,EAAKiF,OAEnBoB,SAAU,CAAChC,EAAiBI,IAC1BI,EAAiBA,kBACfV,EAAIW,WAAWC,KACb/C,EAAcc,QACd,CAAEuB,UAASW,UAAWP,GACtB,CAAE5C,MAAOuC,KAEVpE,GAASA,EAAKiF,OAEnBqB,YAAa,CAACjC,EAAiBI,IAC7BI,EAAiBA,kBACfV,EAAIW,WAAWC,KACb/C,EAAce,WACd,CAAEsB,UAASW,UAAWP,GACtB,CAAE5C,MAAOuC,KAEVpE,GAASA,EAAKiF,OAEnBjC,UAAW,CAACqB,EAAiBkC,IAC3B1B,EAAiBA,kBACfV,EAAIW,WAAWC,KAAK/C,EAAcgB,UAAW,CAAEqB,UAASkC,YAAY,CAAE1E,MAAOuC,KAC5EpE,GAASA,EAAKiF,OAEnBhC,aAAc,CAACoB,EAAiBkC,IAC9B1B,EAAiBA,kBACfV,EAAIW,WAAWC,KACb/C,EAAciB,aACd,CAAEoB,UAASkC,YACX,CAAE1E,MAAOuC,KAEVpE,GAASA,EAAKiF,OAEnBuB,eAAgB,CACdnC,EACAkC,EACA9B,IAEAI,EAAAA,kBACEV,EAAIW,WAAWC,KACb/C,EAAcc,QACd,CAAEuB,UAASkC,WAAUvB,UAAWP,GAChC,CAAE5C,MAAOuC,KAEVpE,GAASA,EAAKiF,OAEnBwB,kBAAmB,CACjBpC,EACAkC,EACA9B,IAEAI,EAAAA,kBACEV,EAAIW,WAAWC,KACb/C,EAAce,WACd,CAAEsB,UAASkC,WAAUvB,UAAWP,GAChC,CAAE5C,MAAOuC,KAEVpE,GAASA,EAAKiF,OAanByB,uBAAwB,CACtBC,EACAtC,IAEAQ,EAAAA,kBACEV,EAAIW,WAAWC,KACb/C,EAAcoB,mBACd,CAAEuD,iBAAgBtC,WAClB,CAAExC,MAAOuC,KAEVpE,GAASA,IAcd4G,6BAA8B,CAC5BD,EACAtC,EACAwC,IAEAhC,EAAAA,kBACEV,EAAIW,WAAWC,KACb/C,EAAcqB,yBACd,CAAEsD,iBAAgBtC,UAASyC,IAAKD,GAChC,CAAEhF,MAAOuC,KAEVpE,GAASA,IAad+G,iCAAkC,CAChC1C,EACAwC,IAEAhC,EAAiBA,kBACfV,EAAIW,WAAWC,KACb/C,EAAcsB,6BACd,CAAEe,UAASyC,IAAKD,GAChB,CAAEhF,MAAOuC,KAEVpE,GAASA,IAWdkD,YAAa,CAACmB,EAAiB2C,IAC7BnC,EAAAA,kBACEV,EAAIW,WAAWC,KACb/C,EAAckB,YACd,CAAEmB,UAAS2C,YACX,CAAEnF,MAAOuC,KAEVpE,GAASA,IASdmD,eAAiBkB,GACfQ,EAAiBA,kBACfV,EAAIW,WAAWC,KAAK/C,EAAcmB,eAAgB,CAAEkB,WAAW,CAAExC,MAAOuC,KACvEpE,GAASA,MC5bViH,EAAa,CAAC9C,EAAcC,KAA4B,CAC5DnC,OAAQ,CACNjB,EACAkG,IAEArC,EAAiBA,kBACfV,EAAIW,WAAWC,KACb/C,EAAgBC,OAChB,CAAEjB,OAAMkG,2BACR,CAAErF,MAAOuC,KAGf+C,aAAc,CACZC,EACApG,EACAkG,IAEArC,EAAAA,kBACEV,EAAIW,WAAWC,KACb/C,EAAgBC,OAChB,CAAEmF,KAAIpG,OAAMkG,2BACZ,CAAErF,MAAOuC,KAGflC,OAAQ,CACNkF,EACApG,EACAkG,IAEArC,EAAAA,kBACEV,EAAIW,WAAWC,KACb/C,EAAgBE,OAChB,CAAEkF,KAAIpG,OAAMkG,2BACZ,CAAErF,MAAOuC,KAGfjC,OAASiF,GACPvC,EAAAA,kBACEV,EAAIW,WAAWC,KAAK/C,EAAgBG,OAAQ,CAAEiF,MAAM,CAAEvF,MAAOuC,KAEjEX,QAAS,IACPoB,EAAiBA,kBACfV,EAAIW,WAAWhE,IAAIkB,EAAgByB,QAAS,CAC1C5B,MAAOuC,KAERpE,GAASA,EAAKqH,YCjDfC,EAAU,CAACnD,EAAcC,KAA4B,CACzDlC,OAAQ,CACNqF,EACAC,IAEA3C,EAAiBA,kBACfV,EAAIW,WAAWC,KAAK/C,EAAaE,OAAQ,CAAEqF,MAAKC,gBAAgB,CAAE3F,MAAOuC,OCFzEqD,EAAiB,CAACtD,EAAcC,KAA4B,CAChEnC,OAAQ,CAACjB,EAAc0G,IACrB7C,EAAiBA,kBACfV,EAAIW,WAAWC,KACb/C,EAAoBC,OACpB,CAAEjB,OAAM0G,eACR,CAAE7F,MAAOuC,KAGflC,OAAQ,CAAClB,EAAc2G,EAAiBD,IACtC7C,EAAAA,kBACEV,EAAIW,WAAWC,KACb/C,EAAoBE,OACpB,CAAElB,OAAM2G,UAASD,eACjB,CAAE7F,MAAOuC,KAGfjC,OAASnB,GACP6D,EAAAA,kBACEV,EAAIW,WAAWC,KAAK/C,EAAoBG,OAAQ,CAAEnB,QAAQ,CAAEa,MAAOuC,KAEvEX,QAAS,IACPoB,EAAiBA,kBACfV,EAAIW,WAAWhE,IAAIkB,EAAoByB,QAAS,CAC9C5B,MAAOuC,KAERpE,GAASA,EAAK4H,gBC1BfC,EAAW,CAAC1D,EAAcC,KAA4B,CAC1DnC,OAAQ,CACNjB,EACA0G,EACAI,IAEAjD,EAAAA,kBACEV,EAAIW,WAAWC,KACb/C,EAAcC,OACd,CAAEjB,OAAM0G,cAAaI,mBACrB,CAAEjG,MAAOuC,KAGflC,OAAQ,CACNlB,EACA2G,EACAD,EACAI,IAEAjD,oBACEV,EAAIW,WAAWC,KACb/C,EAAcE,OACd,CAAElB,OAAM2G,UAASD,cAAaI,mBAC9B,CAAEjG,MAAOuC,KAGfjC,OAASnB,GACP6D,EAAAA,kBACEV,EAAIW,WAAWC,KAAK/C,EAAcG,OAAQ,CAAEnB,QAAQ,CAAEa,MAAOuC,KAEjEX,QAAS,IACPoB,EAAiBA,kBACfV,EAAIW,WAAWhE,IAAIkB,EAAcyB,QAAS,CACxC5B,MAAOuC,KAERpE,GAASA,EAAKyE,UCvCfsD,EAAY,CAAC5D,EAAcC,KAA4B,CAM3DL,cAAgBwC,GACd1B,EAAAA,kBACEV,EAAIW,WAAWC,KAAK/C,EAAe+B,cAAe,CAAEwC,YAAY,CAAE1E,MAAOuC,KAU7EJ,uBAAwB,CACtBuC,EACAyB,EACAC,IAEApD,EAAAA,kBACEV,EAAIW,WAAWC,KACb/C,EAAegC,uBACf,CAAEuC,WAAU0B,WAAUD,WACtB,CAAEnG,MAAOuC,KAUfH,oBAAqB,CAACsC,EAAkB2B,IACtCrD,EAAiBA,kBACfV,EAAIW,WAAWC,KACb/C,EAAeiC,oBACf,CAAEsC,WAAU2B,WACZ,CAAErG,MAAOuC,OC1CX+D,EAAkB,CAAChE,EAAcC,KAA4B,CACjEgE,YAAc7B,GACZ1B,EAAAA,kBACEV,EAAIW,WAAWhE,IAAIkB,EAAa0B,SAAU,CACxC2B,YAAa,CAAEkB,YACf1E,MAAOuC,KAERpE,GAASA,IAEdqI,eAAiB9B,GACf1B,EAAAA,kBACEV,EAAIW,WAAW3C,OAAOH,EAAa0B,SAAU,CAC3C2B,YAAa,CAAEkB,YACf1E,MAAOuC,KAGbkE,kBAAmB,CACjB/B,EACAgC,EACAC,EACAC,EACAC,EACAC,IAEA9D,EAAiBA,kBACfV,EAAIW,WAAWC,KACb/C,EAAa0B,SACb,CAAE6C,WAAUgC,SAAQE,WAAUD,UAASE,cAAaC,UACpD,CAAE9G,MAAOuC,KAGfwE,kBAAmB,CAACrC,EAAkBsC,IACpChE,EAAiBA,kBACfV,EAAIW,WAAWC,KACb/C,EAAa2B,SACb,CAAE4C,WAAUsC,kBACZ,CAAEhH,MAAOuC,KAGf0E,iBAAkB,CAChBvC,EACAwC,EACAC,IAEAnE,EAAAA,kBACEV,EAAIW,WAAWC,KACb/C,EAAa4B,QACb,CAAE2C,WAAUwC,eAAcC,oBAC1B,CAAEnH,MAAOuC,OCxCX6E,EAAgB,CAAC9E,EAAcC,KAA4B,CAS/DnC,OAAQ,CACNjB,EACAkI,EACAzE,EACA0E,IAEAtE,EAAAA,kBACEV,EAAIW,WAAWC,KACb/C,EAAmBC,OACnB,CAAEjB,OAAMkI,aAAYlE,UAAWP,EAAO0E,cACtC,CAAEtH,MAAOuC,KAQf/B,KAAO+E,GACLvC,EAAAA,kBACEV,EAAIW,WAAWhE,IAAIkB,EAAmBK,KAAM,CAC1CgD,YAAa,CAAE+B,MACfvF,MAAOuC,KAERpE,GAASA,EAAKoJ,MAOnB5D,UAAYC,GACVZ,oBACEV,EAAIW,WAAWC,KAAK/C,EAAmBM,OAAQ,CAAEmD,aAAa,CAAE5D,MAAOuC,KACtEpE,GAASA,EAAKqJ,OAQnBnH,OAAQ,CAACkF,EAAYpG,IACnB6D,EAAiBA,kBACfV,EAAIW,WAAWC,KAAK/C,EAAmBE,OAAQ,CAAEkF,KAAIpG,QAAQ,CAAEa,MAAOuC,KACrEpE,GAASA,EAAKoJ,MAOnB7F,WAAa6D,GACXvC,EAAAA,kBACEV,EAAIW,WAAWC,KAAK/C,EAAmBuB,WAAY,CAAE6D,MAAM,CAAEvF,MAAOuC,KAMxEZ,SAAW4D,GACTvC,EAAAA,kBACEV,EAAIW,WAAWC,KAAK/C,EAAmBwB,SAAU,CAAE4D,MAAM,CAAEvF,MAAOuC,KAMtEjC,OAASiF,GACPvC,EAAAA,kBACEV,EAAIW,WAAWC,KAAK/C,EAAmBG,OAAQ,CAAEiF,MAAM,CAAEvF,MAAOuC,OCvFhEkF,EAAW,CAACnF,EAAcC,KAA4B,CAC1DP,OAAS0F,GACP1E,EAAAA,kBACEV,EAAIW,WAAWC,KAAK/C,EAAc6B,OAAQ,CAAE0F,UAAU,CAAE1H,MAAOuC,KAEnEN,OAAQ,CAACyF,EAAgBC,EAAYC,IACnC5E,EAAAA,kBACEV,EAAIW,WAAWC,KACb/C,EAAc8B,OACd,CAAEyF,SAAQC,OAAMC,WAChB,CAAE5H,MAAOuC,OCVXsF,EAAY,CAACvF,EAAcC,KAA4B,CAC3DP,OAAQ,IACNgB,EAAiBA,kBAACV,EAAIW,WAAWC,KAAK/C,EAAe6B,OAAQ,CAAE,EAAE,CAAEhC,MAAOuC,KAC5EN,OAAS6F,GACP9E,EAAAA,kBACEV,EAAIW,WAAWC,KAAK/C,EAAe8B,OAAQ,CAAE6F,SAAS,CAAE9H,MAAOuC,aCRnD,QAAlBzD,EAAAiJ,WAAWC,eAAO,IAAAlJ,IAAlBiJ,WAAWC,QAAYA,EAAOA,SAE9B,MAGMC,EAAe,IAAIhK,KAGvBA,EAAKiK,SAASC,YAEZA,YAASrJ,GAAAS,EAAA4I,GAAYC,+BAAAA,cARD,UAQmC,IAGlDC,EAAS,WAAIpK,ICMhBqK,EAAWxJ,WAAAyD,cAAEA,EAAagG,UAAEA,GAASzJ,EAAK0J,EAAMjK,EAAAA,OAAAO,EAArC,+BACf,MAAM2J,EAAUC,UACXjJ,OAAAC,OAAAD,OAAAC,OAAA,CAAA,EAAA8I,UACHG,EACAC,YAAWnJ,OAAAC,OAAAD,OAAAC,OAAA,CAAA,EACN8I,EAAOI,cACV,qBAAsB,SACtB,8BAAiD,UAAZ,OAAPC,cAAO,IAAPA,aAAO,EAAPA,QAASC,gBAAU,IAAAvJ,OAAA,EAAAA,EAAAwJ,OAAQ,GACzD,wBAAyB,cAIvBC,UAAEA,EAASC,OAAEA,GAAWT,EAExBhB,EAA6C,CAAA,EAgC7C0B,ECtDe,EAAC5G,EAAcC,KAA4B,CAChEa,KAAMf,EAASC,EAAKC,GACpB4G,UAAW/B,EAAc9E,EAAKC,GAC9BzC,OAAQsF,EAAW9C,EAAKC,GACxB6G,IAAK9C,EAAgBhE,EAAKC,GAC1BmD,IAAKD,EAAQnD,EAAKC,GAClB8G,WAAYzD,EAAetD,EAAKC,GAChC+G,KAAMtD,EAAS1D,EAAKC,GACpBgH,MAAOrD,EAAU5D,EAAKC,GACtBoF,KAAMF,EAASnF,EAAKC,GACpBuF,MAAOD,EAAUvF,EAAKC,KD4CHiH,CAAef,EAASlG,GAErCD,iCACDmG,GAAO,CAOVS,aAGAlL,aAAayL,GACX,KAAKA,aAAA,EAAAA,EAAQC,KAAK,MAAMC,MAAM,gCAE9B,GAAInC,EAAKiC,EAAOC,KAAM,OAAOlC,EAAKiC,EAAOC,KAKzC,GAFAjK,OAAOC,OAAO8H,OAhDAxJ,WAChB,GAAIuK,EACF,IACE,MAAMqB,EAAYC,KAAKC,MAAMvB,GACvBhB,QAAYwC,YAAUH,GAC5B,MAAO,CACL,CAACA,EAAUF,KAAMnC,EAKpB,CAHC,MAAOyC,GAEP,MADAf,SAAAA,EAAQgB,MAAM,0CAA2CD,GACnD,IAAIL,MAAM,6BACjB,CAGH,MAGMO,SAHoBzB,EAAQxF,WAC/BhE,IAAI,WAAW+J,KACfmB,MAAMjM,GAASA,EAAKkM,UACe5C,KACtC,OAAKvH,MAAMC,QAAQgK,UACQG,QAAQC,IACjCJ,EAAWK,KAAIvM,MAAOuJ,GAAQ,CAACA,EAAImC,UAAWK,EAAAA,UAAUxC,QAGtCiD,QAClB,CAACC,GAAMf,EAAKgB,KAAUhB,EAAWjK,OAAAC,OAAAD,OAAAC,OAAA,CAAA,EAAA+K,IAAK,CAACf,EAAIiB,YAAaD,IAAQD,GAChE,CAAE,GAPmC,EAQtC,EAsB2BG,KAErBpD,EAAKiC,EAAOC,KAAM,MAAMC,MAAM,gCAEnC,OAAOnC,EAAKiC,EAAOC,IACpB,EAOD1L,kBAAkB0H,SAEhB,MACM1F,SADY6K,EAASA,UAACnF,EAAKpD,EAAIwI,OAAQ,CAAEC,eAAgB,KAC7CC,QAElB,GAAIhL,IACFA,EAAMiL,IAAe,QAATnM,EAAAkB,EAAMiL,WAAG,IAAAnM,OAAA,EAAAA,EAAEoM,MAAM,KAAKC,MAC9BnL,EAAMiL,MAAQjC,GAEhB,MAAM,IAAIoC,EAAMA,OAACC,yBACf,+BACA,MACA,gBAKN,MAAO,CAAE3F,MAAK1F,QACf,EAODhC,sBAAsBsN,GACpB,IAAKA,EAAc,MAAM3B,MAAM,4CAE/B,IAEE,aADoBrH,EAAIiJ,YAAYD,EAMrC,CAJC,MAAOrB,GAGP,MADAhB,SAAAA,EAAQgB,MAAM,4BAA6BA,GACrCN,MAAM,4BACb,CACF,EAOD3L,qBAAqBwN,WACnB,IAAKA,EAAc,MAAM7B,MAAM,kDAE/B,UACQrH,EAAIiJ,YAAYC,GACtB,MAAMC,QAAgBnJ,EAAIoJ,QAAQF,GAClC,GAAIC,EAAQE,GAAI,CAEd,aADoBrJ,EAAIiJ,YAA0B,QAAdzM,EAAA2M,EAAQtN,YAAM,IAAAW,OAAA,EAAAA,EAAA8M,WAEnD,CAED,MAAMjC,MAAmB,QAAbpK,EAAAkM,EAAQxB,aAAK,IAAA1K,OAAA,EAAAA,EAAEsM,aAK5B,CAJC,MAAOC,GAGP,MADA7C,SAAAA,EAAQgB,MAAM,kCAAmC6B,GAC3CnC,MAAM,kCACb,CACF,EAQD3L,gCACEsN,EACAE,GAEA,IAAKF,IAAiBE,EAAc,MAAM7B,MAAM,6CAEhD,IAEE,aADoBrH,EAAIyJ,gBAAgBT,EAKzC,CAHC,MAAOrB,GAEPhB,SAAAA,EAAQ+C,IAAI,mDACb,CAED,OAAO1J,EAAI2J,eAAeT,EAC3B,EAODxN,wBAAwBmL,GACtB,IAAKA,EAAW,MAAMQ,MAAM,gCAE5B,IAAIzL,EACJ,IACEA,QAAaoE,EAAI6G,UAAU+C,SAAS/C,EAIrC,CAHC,MAAOc,GAEP,MADAhB,SAAAA,EAAQgB,MAAM,gCAAiCA,GACzCN,MAAM,gCACb,CAED,MAAMiC,WAAEA,GAAe1N,EAAKC,KAC5B,IAAKyN,EAEH,MADA3C,SAAAA,EAAQgB,MAAM,gDACRN,MAAM,iCAGd,IAEE,aADoBrH,EAAIiJ,YAAYK,EAKrC,CAHC,MAAO3B,GAEP,MADAhB,SAAAA,EAAQgB,MAAM,sCAAuCA,GAC/CN,MAAM,gCACb,CACF,EAQDwC,oBAAmB,CAACvM,EAA8BmG,IACzCzD,EAAI8J,0BAA0BxM,EAAU,KAAMmG,GASvDqG,0BACExM,EACAE,EACAiG,GAEA,MAAMsG,EAAU1M,EAA2BC,EdnOb,ccmO6CE,GAC3E,OAAOiG,EAAYuG,OAAOC,GAASF,EAAQG,SAASD,IACrD,EAQDE,cAAa,CAAC7M,EAA8BgD,IACnCN,EAAIoK,oBAAoB9M,EAAU,KAAMgD,GASjD8J,oBAAoB9M,EAA8BE,EAAgB8C,GAChE,MAAM+J,EAAahN,EAA2BC,EdtPtB,QcsPgDE,GACxE,OAAO8C,EAAM0J,OAAOhD,GAASqD,EAAWH,SAASlD,IAClD,IAGH,OAAOsD,EAAAA,SACLtK,EACA,CACE,mBACA,iBACA,sBACA,mBACA,uBACA,uBACA,iBACA,gBACA,cACA,yBACA,yBACA,WAEFxE,EACD,EAoBHwK,EAAQuE,uBdxS8B,McyStCvE,EAAQwE,uBdvS8B"}

package/dist/index.d.ts

@@ -1,6 +1,6 @@
 import * as _descope_core_js_sdk from '@descope/core-js-sdk';
 import _descope_core_js_sdk__default, { SdkResponse, ExchangeAccessKeyResponse } from '@descope/core-js-sdk';
-export { DeliveryMethod, OAuthProvider, ResponseData, SdkResponse } from '@descope/core-js-sdk';
+export { DeliveryMethod, JWTResponse, OAuthProvider, ResponseData, SdkResponse } from '@descope/core-js-sdk';
 import { JWTHeaderParameters, KeyLike } from 'jose';
 
 /** Represents a tenant association for a User or Access Key. The tenantId is required to denote
@@ -35,8 +35,9 @@ declare type CreatedAccessKeyResponse = {
 /** Represents a mapping between a set of groups of users and a role that will be assigned to them */
 declare type RoleMapping = {
     groups: string[];
-    role: string;
+    roleName: string;
 };
+declare type RoleMappings = RoleMapping[];
 /** Represents a mapping between Descope and IDP user attributes */
 declare type AttributeMapping = {
     name?: string;
@@ -154,6 +155,13 @@ declare type SSOSettingsResponse = {
     redirectUrl: string;
     domain: string;
 };
+declare type ProviderTokenResponse = {
+    provider: string;
+    providerUserId: string;
+    accessToken: string;
+    expiration: number;
+    scopes: string[];
+};
 
 /** Parsed JWT token */
 interface Token {
@@ -172,9 +180,10 @@ interface AuthenticationInfo {
 /** Configuration arguments which include the Descope core SDK args and an optional management key */
 declare type NodeSdkArgs = Parameters<typeof _descope_core_js_sdk__default>[0] & {
     managementKey?: string;
+    publicKey?: string;
 };
 declare const nodeSdk: {
-    ({ managementKey, ...config }: NodeSdkArgs): {
+    ({ managementKey, publicKey, ...config }: NodeSdkArgs): {
         management: {
             user: {
                 create: (loginId: string, email?: string, phone?: string, displayName?: string, roles?: string[], userTenants?: AssociatedTenant[], customAttributes?: Record<string, AttributesTypes>, picture?: string) => Promise<SdkResponse<_descope_core_js_sdk.UserResponse>>;
@@ -186,6 +195,7 @@ declare const nodeSdk: {
                 load: (loginId: string) => Promise<SdkResponse<_descope_core_js_sdk.UserResponse>>;
                 loadByUserId: (userId: string) => Promise<SdkResponse<_descope_core_js_sdk.UserResponse>>;
                 searchAll: (tenantIds?: string[], roles?: string[], limit?: number, page?: number, testUsersOnly?: boolean, withTestUser?: boolean, customAttributes?: Record<string, AttributesTypes>) => Promise<SdkResponse<_descope_core_js_sdk.UserResponse[]>>;
+                getProviderToken: (loginId: string, provider: string) => Promise<SdkResponse<ProviderTokenResponse>>;
                 activate: (loginId: string) => Promise<SdkResponse<_descope_core_js_sdk.UserResponse>>;
                 deactivate: (loginId: string) => Promise<SdkResponse<_descope_core_js_sdk.UserResponse>>;
                 updateEmail: (loginId: string, email: string, isVerified: boolean) => Promise<SdkResponse<_descope_core_js_sdk.UserResponse>>;
@@ -202,6 +212,8 @@ declare const nodeSdk: {
                 generateOTPForTestUser: (deliveryMethod: "email" | "sms" | "whatsapp", loginId: string) => Promise<SdkResponse<GenerateOTPForTestResponse>>;
                 generateMagicLinkForTestUser: (deliveryMethod: "email" | "sms" | "whatsapp", loginId: string, uri: string) => Promise<SdkResponse<GenerateMagicLinkForTestResponse>>;
                 generateEnchantedLinkForTestUser: (loginId: string, uri: string) => Promise<SdkResponse<GenerateEnchantedLinkForTestResponse>>;
+                setPassword: (loginId: string, password: string) => Promise<SdkResponse<never>>;
+                expirePassword: (loginId: string) => Promise<SdkResponse<never>>;
             };
             accessKey: {
                 create: (name: string, expireTime: number, roles?: string[], keyTenants?: AssociatedTenant[]) => Promise<SdkResponse<CreatedAccessKeyResponse>>;
@@ -221,9 +233,10 @@ declare const nodeSdk: {
             };
             sso: {
                 getSettings: (tenantId: string) => Promise<SdkResponse<SSOSettingsResponse>>;
+                deleteSettings: (tenantId: string) => Promise<SdkResponse<never>>;
                 configureSettings: (tenantId: string, idpURL: string, idpCert: string, entityId: string, redirectURL?: string, domain?: string) => Promise<SdkResponse<never>>;
                 configureMetadata: (tenantId: string, idpMetadataURL: string) => Promise<SdkResponse<never>>;
-                configureMapping: (tenantId: string, roleMapping?: RoleMapping, attributeMapping?: AttributeMapping) => Promise<SdkResponse<never>>;
+                configureMapping: (tenantId: string, roleMappings?: RoleMappings, attributeMapping?: AttributeMapping) => Promise<SdkResponse<never>>;
             };
             jwt: {
                 update: (jwt: string, customClaims?: Record<string, any>) => Promise<SdkResponse<UpdateJWTResponse>>;
@@ -330,20 +343,32 @@ declare const nodeSdk: {
             update: {
                 email: <T extends boolean>(loginId: string, email: string, token?: string, updateOptions?: {
                     addToLoginIDs?: T;
-                    onMergeUseExisting?: T extends true ? boolean : never;
+                    onMergeUseExisting?: T extends true ? boolean : never; /**
+                     * Exchange API key (access key) for a session key
+                     * @param accessKey access key to exchange for a session JWT
+                     * @returns AuthneticationInfo with session JWT data
+                     */
                 }) => Promise<SdkResponse<{
                     maskedEmail: string;
                 }>>;
                 phone: {
                     sms: <T_1 extends boolean>(loginId: string, phone: string, token?: string, updateOptions?: {
                         addToLoginIDs?: T_1;
-                        onMergeUseExisting?: T_1 extends true ? boolean : never;
+                        onMergeUseExisting?: T_1 extends true ? boolean : never; /**
+                         * Exchange API key (access key) for a session key
+                         * @param accessKey access key to exchange for a session JWT
+                         * @returns AuthneticationInfo with session JWT data
+                         */
                     }) => Promise<SdkResponse<{
                         maskedPhone: string;
                     }>>;
                     whatsapp: <T_1 extends boolean>(loginId: string, phone: string, token?: string, updateOptions?: {
                         addToLoginIDs?: T_1;
-                        onMergeUseExisting?: T_1 extends true ? boolean : never;
+                        onMergeUseExisting?: T_1 extends true ? boolean : never; /**
+                         * Exchange API key (access key) for a session key
+                         * @param accessKey access key to exchange for a session JWT
+                         * @returns AuthneticationInfo with session JWT data
+                         */
                     }) => Promise<SdkResponse<{
                         maskedPhone: string;
                     }>>;
@@ -403,20 +428,32 @@ declare const nodeSdk: {
             update: {
                 email: <T_2 extends boolean>(loginId: string, email: string, URI?: string, token?: string, updateOptions?: {
                     addToLoginIDs?: T_2;
-                    onMergeUseExisting?: T_2 extends true ? boolean : never;
+                    onMergeUseExisting?: T_2 extends true ? boolean : never; /**
+                     * Exchange API key (access key) for a session key
+                     * @param accessKey access key to exchange for a session JWT
+                     * @returns AuthneticationInfo with session JWT data
+                     */
                 }) => Promise<SdkResponse<{
                     maskedEmail: string;
                 }>>;
                 phone: {
                     sms: <T_3 extends boolean>(loginId: string, phone: string, URI?: string, token?: string, updateOptions?: {
                         addToLoginIDs?: T_3;
-                        onMergeUseExisting?: T_3 extends true ? boolean : never;
+                        onMergeUseExisting?: T_3 extends true ? boolean : never; /**
+                         * Exchange API key (access key) for a session key
+                         * @param accessKey access key to exchange for a session JWT
+                         * @returns AuthneticationInfo with session JWT data
+                         */
                     }) => Promise<SdkResponse<{
                         maskedPhone: string;
                     }>>;
                     whatsapp: <T_3 extends boolean>(loginId: string, phone: string, URI?: string, token?: string, updateOptions?: {
                         addToLoginIDs?: T_3;
-                        onMergeUseExisting?: T_3 extends true ? boolean : never;
+                        onMergeUseExisting?: T_3 extends true ? boolean : never; /**
+                         * Exchange API key (access key) for a session key
+                         * @param accessKey access key to exchange for a session JWT
+                         * @returns AuthneticationInfo with session JWT data
+                         */
                     }) => Promise<SdkResponse<{
                         maskedPhone: string;
                     }>>;
@@ -445,7 +482,11 @@ declare const nodeSdk: {
             update: {
                 email: <T_4 extends boolean>(loginId: string, email: string, URI?: string, token?: string, updateOptions?: {
                     addToLoginIDs?: T_4;
-                    onMergeUseExisting?: T_4 extends true ? boolean : never;
+                    onMergeUseExisting?: T_4 extends true ? boolean : never; /**
+                     * Exchange API key (access key) for a session key
+                     * @param accessKey access key to exchange for a session JWT
+                     * @returns AuthneticationInfo with session JWT data
+                     */
                 }) => Promise<SdkResponse<_descope_core_js_sdk.EnchantedLinkResponse>>;
             };
         };
@@ -482,7 +523,7 @@ declare const nodeSdk: {
             }>>;
         };
         saml: {
-            start: (tenantNameOrEmail: string, redirectUrl?: string, loginOptions?: {
+            start: (tenantIdOrEmail: string, redirectUrl?: string, loginOptions?: {
                 stepup?: boolean;
                 mfa?: boolean;
                 customClaims?: Record<string, any>;
@@ -513,7 +554,7 @@ declare const nodeSdk: {
                 start: (loginId: string, origin: string, name: string) => Promise<SdkResponse<{
                     transactionId: string;
                     options: string;
-                    create: boolean; /** Get the key that can validate the given JWT KID in the header. Can retrieve the public key from local cache or from Descope. */
+                    create: boolean;
                 }>>;
                 finish: (transactionId: string, response: string) => Promise<SdkResponse<_descope_core_js_sdk.JWTResponse & {
                     refreshJwt?: string;
@@ -528,7 +569,7 @@ declare const nodeSdk: {
                 }, token?: string) => Promise<SdkResponse<{
                     transactionId: string;
                     options: string;
-                    create: boolean; /** Get the key that can validate the given JWT KID in the header. Can retrieve the public key from local cache or from Descope. */
+                    create: boolean;
                 }>>;
                 finish: (transactionId: string, response: string) => Promise<SdkResponse<_descope_core_js_sdk.JWTResponse & {
                     refreshJwt?: string;
@@ -539,14 +580,14 @@ declare const nodeSdk: {
                 start: (loginId: string, origin: string) => Promise<SdkResponse<{
                     transactionId: string;
                     options: string;
-                    create: boolean; /** Get the key that can validate the given JWT KID in the header. Can retrieve the public key from local cache or from Descope. */
+                    create: boolean;
                 }>>;
             };
             update: {
                 start: (loginId: string, origin: string, token: string) => Promise<SdkResponse<{
                     transactionId: string;
                     options: string;
-                    create: boolean; /** Get the key that can validate the given JWT KID in the header. Can retrieve the public key from local cache or from Descope. */
+                    create: boolean;
                 }>>;
                 finish: (transactionId: string, response: string) => Promise<SdkResponse<_descope_core_js_sdk.ResponseData>>;
             };
@@ -630,7 +671,7 @@ declare const nodeSdk: {
                 };
                 token?: string;
             }) => Promise<Response>;
-            delete: (path: string, body?: any, config?: {
+            delete: (path: string, config?: {
                 headers?: HeadersInit;
                 queryParams?: {
                     [key: string]: string;
@@ -663,4 +704,4 @@ declare const nodeSdk: {
     SessionTokenCookieName: string;
 };
 
-export { nodeSdk as default };
+export { AuthenticationInfo, nodeSdk as default };

package/dist/index.esm.js

@@ -1,2 +1,2 @@
-import{__rest as e}from"tslib";import t,{transformResponse as a,wrapWith as s}from"@descope/core-js-sdk";import{jwtVerify as o,errors as n,importJWK as r}from"jose";import i,{Headers as l}from"node-fetch-commonjs";const d=t=>async(...a)=>{var s,o,n;const r=await t(...a);if(!r.data)return r;let i=r.data,{refreshJwt:l}=i,d=e(i,["refreshJwt"]);const p=[];var m;return l?p.push(`${"DSR"}=${l}; Domain=${(null==(m=d)?void 0:m.cookieDomain)||""}; Max-Age=${(null==m?void 0:m.cookieMaxAge)||""}; Path=${(null==m?void 0:m.cookiePath)||"/"}; HttpOnly; SameSite=Strict`):(null===(s=r.response)||void 0===s?void 0:s.headers.get("set-cookie"))&&(l=((e,t)=>{const a=null==e?void 0:e.match(RegExp(`(?:^|;\\s*)${t}=([^;]*)`));return a?a[1]:null})(null===(o=r.response)||void 0===o?void 0:o.headers.get("set-cookie"),"DSR"),p.push(null===(n=r.response)||void 0===n?void 0:n.headers.get("set-cookie"))),Object.assign(Object.assign({},r),{data:Object.assign(Object.assign({},r.data),{refreshJwt:l,cookies:p})})};function p(e,t,a){var s,o;const n=a?null===(o=null===(s=e.token.tenants)||void 0===s?void 0:s[a])||void 0===o?void 0:o[t]:e.token[t];return Array.isArray(n)?n:[]}var m={create:"/v1/mgmt/user/create",update:"/v1/mgmt/user/update",delete:"/v1/mgmt/user/delete",deleteAllTestUsers:"/v1/mgmt/user/test/delete/all",load:"/v1/mgmt/user",search:"/v1/mgmt/user/search",updateStatus:"/v1/mgmt/user/update/status",updateEmail:"/v1/mgmt/user/update/email",updatePhone:"/v1/mgmt/user/update/phone",updateDisplayName:"/v1/mgmt/user/update/name",updatePicture:"/v1/mgmt/user/update/picture",updateCustomAttribute:"/v1/mgmt/user/update/customAttribute",addRole:"/v1/mgmt/user/update/role/add",removeRole:"/v1/mgmt/user/update/role/remove",addTenant:"/v1/mgmt/user/update/tenant/add",removeTenant:"/v1/mgmt/user/update/tenant/remove",generateOTPForTest:"/v1/mgmt/tests/generate/otp",generateMagicLinkForTest:"/v1/mgmt/tests/generate/magiclink",generateEnchantedLinkForTest:"/v1/mgmt/tests/generate/enchantedlink"},u={create:"/v1/mgmt/accesskey/create",load:"/v1/mgmt/accesskey",search:"/v1/mgmt/accesskey/search",update:"/v1/mgmt/accesskey/update",deactivate:"/v1/mgmt/accesskey/deactivate",activate:"/v1/mgmt/accesskey/activate",delete:"/v1/mgmt/accesskey/delete"},c={create:"/v1/mgmt/tenant/create",update:"/v1/mgmt/tenant/update",delete:"/v1/mgmt/tenant/delete",loadAll:"/v1/mgmt/tenant/all"},g={settings:"/v1/mgmt/sso/settings",metadata:"/v1/mgmt/sso/metadata",mapping:"/v1/mgmt/sso/mapping"},h={update:"/v1/mgmt/jwt/update"},v={create:"/v1/mgmt/permission/create",update:"/v1/mgmt/permission/update",delete:"/v1/mgmt/permission/delete",loadAll:"/v1/mgmt/permission/all"},k={create:"/v1/mgmt/role/create",update:"/v1/mgmt/role/update",delete:"/v1/mgmt/role/delete",loadAll:"/v1/mgmt/role/all"},y={export:"/v1/mgmt/flow/export",import:"/v1/mgmt/flow/import"},f={export:"/v1/mgmt/theme/export",import:"/v1/mgmt/theme/import"},C={loadAllGroups:"/v1/mgmt/group/all",loadAllGroupsForMember:"/v1/mgmt/group/member/all",loadAllGroupMembers:"/v1/mgmt/group/members"};const w=(e,t)=>({create:(s,o,n,r,i,l,d,p)=>a(e.httpClient.post(m.create,{loginId:s,email:o,phone:n,displayName:r,roleNames:i,userTenants:l,customAttributes:d,picture:p},{token:t}),(e=>e.user)),createTestUser:(s,o,n,r,i,l,d,p)=>a(e.httpClient.post(m.create,{loginId:s,email:o,phone:n,displayName:r,roleNames:i,userTenants:l,test:!0,customAttributes:d,picture:p},{token:t}),(e=>e.user)),invite:(s,o,n,r,i,l,d,p)=>a(e.httpClient.post(m.create,{loginId:s,email:o,phone:n,displayName:r,roleNames:i,userTenants:l,invite:!0,customAttributes:d,picture:p},{token:t}),(e=>e.user)),update:(s,o,n,r,i,l,d,p)=>a(e.httpClient.post(m.update,{loginId:s,email:o,phone:n,displayName:r,roleNames:i,userTenants:l,customAttributes:d,picture:p},{token:t}),(e=>e.user)),delete:s=>a(e.httpClient.post(m.delete,{loginId:s},{token:t})),deleteAllTestUsers:()=>a(e.httpClient.delete(m.deleteAllTestUsers,{},{token:t})),load:s=>a(e.httpClient.get(m.load,{queryParams:{loginId:s},token:t}),(e=>e.user)),loadByUserId:s=>a(e.httpClient.get(m.load,{queryParams:{userId:s},token:t}),(e=>e.user)),searchAll:(s,o,n,r,i,l,d)=>a(e.httpClient.post(m.search,{tenantIds:s,roleNames:o,limit:n,page:r,testUsersOnly:i,withTestUser:l,customAttributes:d},{token:t}),(e=>e.users)),activate:s=>a(e.httpClient.post(m.updateStatus,{loginId:s,status:"enabled"},{token:t}),(e=>e.user)),deactivate:s=>a(e.httpClient.post(m.updateStatus,{loginId:s,status:"disabled"},{token:t}),(e=>e.user)),updateEmail:(s,o,n)=>a(e.httpClient.post(m.updateEmail,{loginId:s,email:o,verified:n},{token:t}),(e=>e.user)),updatePhone:(s,o,n)=>a(e.httpClient.post(m.updatePhone,{loginId:s,phone:o,verified:n},{token:t}),(e=>e.user)),updateDisplayName:(s,o)=>a(e.httpClient.post(m.updateDisplayName,{loginId:s,displayName:o},{token:t}),(e=>e.user)),updatePicture:(s,o)=>a(e.httpClient.post(m.updatePicture,{loginId:s,picture:o},{token:t}),(e=>e.user)),updateCustomAttribute:(s,o,n)=>a(e.httpClient.post(m.updateCustomAttribute,{loginId:s,attributeKey:o,attributeValue:n},{token:t}),(e=>e.user)),addRoles:(s,o)=>a(e.httpClient.post(m.addRole,{loginId:s,roleNames:o},{token:t}),(e=>e.user)),removeRoles:(s,o)=>a(e.httpClient.post(m.removeRole,{loginId:s,roleNames:o},{token:t}),(e=>e.user)),addTenant:(s,o)=>a(e.httpClient.post(m.addTenant,{loginId:s,tenantId:o},{token:t}),(e=>e.user)),removeTenant:(s,o)=>a(e.httpClient.post(m.removeTenant,{loginId:s,tenantId:o},{token:t}),(e=>e.user)),addTenantRoles:(s,o,n)=>a(e.httpClient.post(m.addRole,{loginId:s,tenantId:o,roleNames:n},{token:t}),(e=>e.user)),removeTenantRoles:(s,o,n)=>a(e.httpClient.post(m.removeRole,{loginId:s,tenantId:o,roleNames:n},{token:t}),(e=>e.user)),generateOTPForTestUser:(s,o)=>a(e.httpClient.post(m.generateOTPForTest,{deliveryMethod:s,loginId:o},{token:t}),(e=>e)),generateMagicLinkForTestUser:(s,o,n)=>a(e.httpClient.post(m.generateMagicLinkForTest,{deliveryMethod:s,loginId:o,URI:n},{token:t}),(e=>e)),generateEnchantedLinkForTestUser:(s,o)=>a(e.httpClient.post(m.generateEnchantedLinkForTest,{loginId:s,URI:o},{token:t}),(e=>e))}),I=(e,t)=>({create:(s,o)=>a(e.httpClient.post(c.create,{name:s,selfProvisioningDomains:o},{token:t})),createWithId:(s,o,n)=>a(e.httpClient.post(c.create,{id:s,name:o,selfProvisioningDomains:n},{token:t})),update:(s,o,n)=>a(e.httpClient.post(c.update,{id:s,name:o,selfProvisioningDomains:n},{token:t})),delete:s=>a(e.httpClient.post(c.delete,{id:s},{token:t})),loadAll:()=>a(e.httpClient.get(c.loadAll,{token:t}),(e=>e.tenants))}),b=(e,t)=>({update:(s,o)=>a(e.httpClient.post(h.update,{jwt:s,customClaims:o},{token:t}))}),T=(e,t)=>({create:(s,o)=>a(e.httpClient.post(v.create,{name:s,description:o},{token:t})),update:(s,o,n)=>a(e.httpClient.post(v.update,{name:s,newName:o,description:n},{token:t})),delete:s=>a(e.httpClient.post(v.delete,{name:s},{token:t})),loadAll:()=>a(e.httpClient.get(v.loadAll,{token:t}),(e=>e.permissions))}),A=(e,t)=>({create:(s,o,n)=>a(e.httpClient.post(k.create,{name:s,description:o,permissionNames:n},{token:t})),update:(s,o,n,r)=>a(e.httpClient.post(k.update,{name:s,newName:o,description:n,permissionNames:r},{token:t})),delete:s=>a(e.httpClient.post(k.delete,{name:s},{token:t})),loadAll:()=>a(e.httpClient.get(k.loadAll,{token:t}),(e=>e.roles))}),x=(e,t)=>({loadAllGroups:s=>a(e.httpClient.post(C.loadAllGroups,{tenantId:s},{token:t})),loadAllGroupsForMember:(s,o,n)=>a(e.httpClient.post(C.loadAllGroupsForMember,{tenantId:s,loginIds:n,userIds:o},{token:t})),loadAllGroupMembers:(s,o)=>a(e.httpClient.post(C.loadAllGroupMembers,{tenantId:s,groupId:o},{token:t}))}),j=(e,t)=>({getSettings:s=>a(e.httpClient.get(g.settings,{queryParams:{tenantId:s},token:t}),(e=>e)),configureSettings:(s,o,n,r,i,l)=>a(e.httpClient.post(g.settings,{tenantId:s,idpURL:o,entityId:r,idpCert:n,redirectURL:i,domain:l},{token:t})),configureMetadata:(s,o)=>a(e.httpClient.post(g.metadata,{tenantId:s,idpMetadataURL:o},{token:t})),configureMapping:(s,o,n)=>a(e.httpClient.post(g.mapping,{tenantId:s,roleMapping:o,attributeMapping:n},{token:t}))}),N=(e,t)=>({create:(s,o,n,r)=>a(e.httpClient.post(u.create,{name:s,expireTime:o,roleNames:n,keyTenants:r},{token:t})),load:s=>a(e.httpClient.get(u.load,{queryParams:{id:s},token:t}),(e=>e.key)),searchAll:s=>a(e.httpClient.post(u.search,{tenantIds:s},{token:t}),(e=>e.keys)),update:(s,o)=>a(e.httpClient.post(u.update,{id:s,name:o},{token:t}),(e=>e.key)),deactivate:s=>a(e.httpClient.post(u.deactivate,{id:s},{token:t})),activate:s=>a(e.httpClient.post(u.activate,{id:s},{token:t})),delete:s=>a(e.httpClient.post(u.delete,{id:s},{token:t}))}),R=(e,t)=>({export:s=>a(e.httpClient.post(y.export,{flowId:s},{token:t})),import:(s,o,n)=>a(e.httpClient.post(y.import,{flowId:s,flow:o,screens:n},{token:t}))}),P=(e,t)=>({export:()=>a(e.httpClient.post(f.export,{},{token:t})),import:s=>a(e.httpClient.post(f.import,{theme:s},{token:t}))});var M;null!==(M=globalThis.Headers)&&void 0!==M||(globalThis.Headers=l);const E=(...e)=>(e.forEach((e=>{var t,a;e&&(null!==(t=(a=e).highWaterMark)&&void 0!==t||(a.highWaterMark=31457280))})),i(...e)),S=a=>{var i,{managementKey:l}=a,m=e(a,["managementKey"]);const u=t(Object.assign(Object.assign({},m),{fetch:E,baseHeaders:Object.assign(Object.assign({},m.baseHeaders),{"x-descope-sdk-name":"nodejs","x-descope-sdk-node-version":(null===(i=null===process||void 0===process?void 0:process.versions)||void 0===i?void 0:i.node)||"","x-descope-sdk-version":"1.5.0"})})),{projectId:c,logger:g}=m,h={},v=((e,t)=>({user:w(e,t),accessKey:N(e,t),tenant:I(e,t),sso:j(e,t),jwt:b(e,t),permission:T(e,t),role:A(e,t),group:x(e,t),flow:R(e,t),theme:P(e,t)}))(u,l),k=Object.assign(Object.assign({},u),{management:v,async getKey(e){if(!(null==e?void 0:e.kid))throw Error("header.kid must not be empty");if(h[e.kid])return h[e.kid];if(Object.assign(h,await(async()=>{const e=(await u.httpClient.get(`v2/keys/${c}`).then((e=>e.json()))).keys;return Array.isArray(e)?(await Promise.all(e.map((async e=>[e.kid,await r(e)])))).reduce(((e,[t,a])=>t?Object.assign(Object.assign({},e),{[t.toString()]:a}):e),{}):{}})()),!h[e.kid])throw Error("failed to fetch matching key");return h[e.kid]},async validateJwt(e){var t;const a=(await o(e,k.getKey,{clockTolerance:5})).payload;if(a&&(a.iss=null===(t=a.iss)||void 0===t?void 0:t.split("/").pop(),a.iss!==c))throw new n.JWTClaimValidationFailed('unexpected "iss" claim value',"iss","check_failed");return{jwt:e,token:a}},async validateSession(e){if(!e)throw Error("session token is required for validation");try{return await k.validateJwt(e)}catch(e){throw null==g||g.error("session validation failed",e),Error("session validation failed")}},async refreshSession(e){var t,a;if(!e)throw Error("refresh token is required to refresh a session");try{await k.validateJwt(e);const s=await k.refresh(e);if(s.ok){return await k.validateJwt(null===(t=s.data)||void 0===t?void 0:t.sessionJwt)}throw Error(null===(a=s.error)||void 0===a?void 0:a.errorMessage)}catch(e){throw null==g||g.error("refresh token validation failed",e),Error("refresh token validation failed")}},async validateAndRefreshSession(e,t){if(!e&&!t)throw Error("both session and refresh tokens are empty");try{return await k.validateSession(e)}catch(e){null==g||g.log("session validation failed - trying to refresh it")}return k.refreshSession(t)},async exchangeAccessKey(e){if(!e)throw Error("access key must not be empty");let t;try{t=await k.accessKey.exchange(e)}catch(e){throw null==g||g.error("failed to exchange access key",e),Error("could not exchange access key")}const{sessionJwt:a}=t.data;if(!a)throw null==g||g.error("failed to parse exchange access key response"),Error("could not exchange access key");try{return await k.validateJwt(a)}catch(e){throw null==g||g.error("failed to parse jwt from access key",e),Error("could not exchange access key")}},validatePermissions:(e,t)=>k.validateTenantPermissions(e,null,t),validateTenantPermissions(e,t,a){const s=p(e,"permissions",t);return a.every((e=>s.includes(e)))},validateRoles:(e,t)=>k.validateTenantRoles(e,null,t),validateTenantRoles(e,t,a){const s=p(e,"roles",t);return a.every((e=>s.includes(e)))}});return s(k,["otp.verify.email","otp.verify.sms","otp.verify.whatsapp","magicLink.verify","enchantedLink.signUp","enchantedLink.signIn","oauth.exchange","saml.exchange","totp.verify","webauthn.signIn.finish","webauthn.signUp.finish","refresh"],d)};S.RefreshTokenCookieName="DSR",S.SessionTokenCookieName="DS";export{S as default};
+import{__rest as e}from"tslib";import t,{transformResponse as a,wrapWith as s}from"@descope/core-js-sdk";import{jwtVerify as o,errors as n,importJWK as r}from"jose";import i,{Headers as l}from"node-fetch-commonjs";const d=t=>async(...a)=>{var s,o,n;const r=await t(...a);if(!r.data)return r;let i=r.data,{refreshJwt:l}=i,d=e(i,["refreshJwt"]);const p=[];var m;return l?p.push(`${"DSR"}=${l}; Domain=${(null==(m=d)?void 0:m.cookieDomain)||""}; Max-Age=${(null==m?void 0:m.cookieMaxAge)||""}; Path=${(null==m?void 0:m.cookiePath)||"/"}; HttpOnly; SameSite=Strict`):(null===(s=r.response)||void 0===s?void 0:s.headers.get("set-cookie"))&&(l=((e,t)=>{const a=null==e?void 0:e.match(RegExp(`(?:^|;\\s*)${t}=([^;]*)`));return a?a[1]:null})(null===(o=r.response)||void 0===o?void 0:o.headers.get("set-cookie"),"DSR"),p.push(null===(n=r.response)||void 0===n?void 0:n.headers.get("set-cookie"))),Object.assign(Object.assign({},r),{data:Object.assign(Object.assign({},r.data),{refreshJwt:l,cookies:p})})};function p(e,t,a){var s,o;const n=a?null===(o=null===(s=e.token.tenants)||void 0===s?void 0:s[a])||void 0===o?void 0:o[t]:e.token[t];return Array.isArray(n)?n:[]}var m={create:"/v1/mgmt/user/create",update:"/v1/mgmt/user/update",delete:"/v1/mgmt/user/delete",deleteAllTestUsers:"/v1/mgmt/user/test/delete/all",load:"/v1/mgmt/user",search:"/v1/mgmt/user/search",getProviderToken:"/v1/mgmt/user/provider/token",updateStatus:"/v1/mgmt/user/update/status",updateEmail:"/v1/mgmt/user/update/email",updatePhone:"/v1/mgmt/user/update/phone",updateDisplayName:"/v1/mgmt/user/update/name",updatePicture:"/v1/mgmt/user/update/picture",updateCustomAttribute:"/v1/mgmt/user/update/customAttribute",addRole:"/v1/mgmt/user/update/role/add",removeRole:"/v1/mgmt/user/update/role/remove",addTenant:"/v1/mgmt/user/update/tenant/add",removeTenant:"/v1/mgmt/user/update/tenant/remove",setPassword:"/v1/mgmt/user/password/set",expirePassword:"/v1/mgmt/user/password/expire",generateOTPForTest:"/v1/mgmt/tests/generate/otp",generateMagicLinkForTest:"/v1/mgmt/tests/generate/magiclink",generateEnchantedLinkForTest:"/v1/mgmt/tests/generate/enchantedlink"},u={create:"/v1/mgmt/accesskey/create",load:"/v1/mgmt/accesskey",search:"/v1/mgmt/accesskey/search",update:"/v1/mgmt/accesskey/update",deactivate:"/v1/mgmt/accesskey/deactivate",activate:"/v1/mgmt/accesskey/activate",delete:"/v1/mgmt/accesskey/delete"},c={create:"/v1/mgmt/tenant/create",update:"/v1/mgmt/tenant/update",delete:"/v1/mgmt/tenant/delete",loadAll:"/v1/mgmt/tenant/all"},g={settings:"/v1/mgmt/sso/settings",metadata:"/v1/mgmt/sso/metadata",mapping:"/v1/mgmt/sso/mapping"},h={update:"/v1/mgmt/jwt/update"},v={create:"/v1/mgmt/permission/create",update:"/v1/mgmt/permission/update",delete:"/v1/mgmt/permission/delete",loadAll:"/v1/mgmt/permission/all"},k={create:"/v1/mgmt/role/create",update:"/v1/mgmt/role/update",delete:"/v1/mgmt/role/delete",loadAll:"/v1/mgmt/role/all"},y={export:"/v1/mgmt/flow/export",import:"/v1/mgmt/flow/import"},f={export:"/v1/mgmt/theme/export",import:"/v1/mgmt/theme/import"},C={loadAllGroups:"/v1/mgmt/group/all",loadAllGroupsForMember:"/v1/mgmt/group/member/all",loadAllGroupMembers:"/v1/mgmt/group/members"};const w=(e,t)=>({create:(s,o,n,r,i,l,d,p)=>a(e.httpClient.post(m.create,{loginId:s,email:o,phone:n,displayName:r,roleNames:i,userTenants:l,customAttributes:d,picture:p},{token:t}),(e=>e.user)),createTestUser:(s,o,n,r,i,l,d,p)=>a(e.httpClient.post(m.create,{loginId:s,email:o,phone:n,displayName:r,roleNames:i,userTenants:l,test:!0,customAttributes:d,picture:p},{token:t}),(e=>e.user)),invite:(s,o,n,r,i,l,d,p)=>a(e.httpClient.post(m.create,{loginId:s,email:o,phone:n,displayName:r,roleNames:i,userTenants:l,invite:!0,customAttributes:d,picture:p},{token:t}),(e=>e.user)),update:(s,o,n,r,i,l,d,p)=>a(e.httpClient.post(m.update,{loginId:s,email:o,phone:n,displayName:r,roleNames:i,userTenants:l,customAttributes:d,picture:p},{token:t}),(e=>e.user)),delete:s=>a(e.httpClient.post(m.delete,{loginId:s},{token:t})),deleteAllTestUsers:()=>a(e.httpClient.delete(m.deleteAllTestUsers,{token:t})),load:s=>a(e.httpClient.get(m.load,{queryParams:{loginId:s},token:t}),(e=>e.user)),loadByUserId:s=>a(e.httpClient.get(m.load,{queryParams:{userId:s},token:t}),(e=>e.user)),searchAll:(s,o,n,r,i,l,d)=>a(e.httpClient.post(m.search,{tenantIds:s,roleNames:o,limit:n,page:r,testUsersOnly:i,withTestUser:l,customAttributes:d},{token:t}),(e=>e.users)),getProviderToken:(s,o)=>a(e.httpClient.get(m.getProviderToken,{queryParams:{loginId:s,provider:o},token:t}),(e=>e)),activate:s=>a(e.httpClient.post(m.updateStatus,{loginId:s,status:"enabled"},{token:t}),(e=>e.user)),deactivate:s=>a(e.httpClient.post(m.updateStatus,{loginId:s,status:"disabled"},{token:t}),(e=>e.user)),updateEmail:(s,o,n)=>a(e.httpClient.post(m.updateEmail,{loginId:s,email:o,verified:n},{token:t}),(e=>e.user)),updatePhone:(s,o,n)=>a(e.httpClient.post(m.updatePhone,{loginId:s,phone:o,verified:n},{token:t}),(e=>e.user)),updateDisplayName:(s,o)=>a(e.httpClient.post(m.updateDisplayName,{loginId:s,displayName:o},{token:t}),(e=>e.user)),updatePicture:(s,o)=>a(e.httpClient.post(m.updatePicture,{loginId:s,picture:o},{token:t}),(e=>e.user)),updateCustomAttribute:(s,o,n)=>a(e.httpClient.post(m.updateCustomAttribute,{loginId:s,attributeKey:o,attributeValue:n},{token:t}),(e=>e.user)),addRoles:(s,o)=>a(e.httpClient.post(m.addRole,{loginId:s,roleNames:o},{token:t}),(e=>e.user)),removeRoles:(s,o)=>a(e.httpClient.post(m.removeRole,{loginId:s,roleNames:o},{token:t}),(e=>e.user)),addTenant:(s,o)=>a(e.httpClient.post(m.addTenant,{loginId:s,tenantId:o},{token:t}),(e=>e.user)),removeTenant:(s,o)=>a(e.httpClient.post(m.removeTenant,{loginId:s,tenantId:o},{token:t}),(e=>e.user)),addTenantRoles:(s,o,n)=>a(e.httpClient.post(m.addRole,{loginId:s,tenantId:o,roleNames:n},{token:t}),(e=>e.user)),removeTenantRoles:(s,o,n)=>a(e.httpClient.post(m.removeRole,{loginId:s,tenantId:o,roleNames:n},{token:t}),(e=>e.user)),generateOTPForTestUser:(s,o)=>a(e.httpClient.post(m.generateOTPForTest,{deliveryMethod:s,loginId:o},{token:t}),(e=>e)),generateMagicLinkForTestUser:(s,o,n)=>a(e.httpClient.post(m.generateMagicLinkForTest,{deliveryMethod:s,loginId:o,URI:n},{token:t}),(e=>e)),generateEnchantedLinkForTestUser:(s,o)=>a(e.httpClient.post(m.generateEnchantedLinkForTest,{loginId:s,URI:o},{token:t}),(e=>e)),setPassword:(s,o)=>a(e.httpClient.post(m.setPassword,{loginId:s,password:o},{token:t}),(e=>e)),expirePassword:s=>a(e.httpClient.post(m.expirePassword,{loginId:s},{token:t}),(e=>e))}),I=(e,t)=>({create:(s,o)=>a(e.httpClient.post(c.create,{name:s,selfProvisioningDomains:o},{token:t})),createWithId:(s,o,n)=>a(e.httpClient.post(c.create,{id:s,name:o,selfProvisioningDomains:n},{token:t})),update:(s,o,n)=>a(e.httpClient.post(c.update,{id:s,name:o,selfProvisioningDomains:n},{token:t})),delete:s=>a(e.httpClient.post(c.delete,{id:s},{token:t})),loadAll:()=>a(e.httpClient.get(c.loadAll,{token:t}),(e=>e.tenants))}),b=(e,t)=>({update:(s,o)=>a(e.httpClient.post(h.update,{jwt:s,customClaims:o},{token:t}))}),T=(e,t)=>({create:(s,o)=>a(e.httpClient.post(v.create,{name:s,description:o},{token:t})),update:(s,o,n)=>a(e.httpClient.post(v.update,{name:s,newName:o,description:n},{token:t})),delete:s=>a(e.httpClient.post(v.delete,{name:s},{token:t})),loadAll:()=>a(e.httpClient.get(v.loadAll,{token:t}),(e=>e.permissions))}),A=(e,t)=>({create:(s,o,n)=>a(e.httpClient.post(k.create,{name:s,description:o,permissionNames:n},{token:t})),update:(s,o,n,r)=>a(e.httpClient.post(k.update,{name:s,newName:o,description:n,permissionNames:r},{token:t})),delete:s=>a(e.httpClient.post(k.delete,{name:s},{token:t})),loadAll:()=>a(e.httpClient.get(k.loadAll,{token:t}),(e=>e.roles))}),P=(e,t)=>({loadAllGroups:s=>a(e.httpClient.post(C.loadAllGroups,{tenantId:s},{token:t})),loadAllGroupsForMember:(s,o,n)=>a(e.httpClient.post(C.loadAllGroupsForMember,{tenantId:s,loginIds:n,userIds:o},{token:t})),loadAllGroupMembers:(s,o)=>a(e.httpClient.post(C.loadAllGroupMembers,{tenantId:s,groupId:o},{token:t}))}),x=(e,t)=>({getSettings:s=>a(e.httpClient.get(g.settings,{queryParams:{tenantId:s},token:t}),(e=>e)),deleteSettings:s=>a(e.httpClient.delete(g.settings,{queryParams:{tenantId:s},token:t})),configureSettings:(s,o,n,r,i,l)=>a(e.httpClient.post(g.settings,{tenantId:s,idpURL:o,entityId:r,idpCert:n,redirectURL:i,domain:l},{token:t})),configureMetadata:(s,o)=>a(e.httpClient.post(g.metadata,{tenantId:s,idpMetadataURL:o},{token:t})),configureMapping:(s,o,n)=>a(e.httpClient.post(g.mapping,{tenantId:s,roleMappings:o,attributeMapping:n},{token:t}))}),N=(e,t)=>({create:(s,o,n,r)=>a(e.httpClient.post(u.create,{name:s,expireTime:o,roleNames:n,keyTenants:r},{token:t})),load:s=>a(e.httpClient.get(u.load,{queryParams:{id:s},token:t}),(e=>e.key)),searchAll:s=>a(e.httpClient.post(u.search,{tenantIds:s},{token:t}),(e=>e.keys)),update:(s,o)=>a(e.httpClient.post(u.update,{id:s,name:o},{token:t}),(e=>e.key)),deactivate:s=>a(e.httpClient.post(u.deactivate,{id:s},{token:t})),activate:s=>a(e.httpClient.post(u.activate,{id:s},{token:t})),delete:s=>a(e.httpClient.post(u.delete,{id:s},{token:t}))}),j=(e,t)=>({export:s=>a(e.httpClient.post(y.export,{flowId:s},{token:t})),import:(s,o,n)=>a(e.httpClient.post(y.import,{flowId:s,flow:o,screens:n},{token:t}))}),R=(e,t)=>({export:()=>a(e.httpClient.post(f.export,{},{token:t})),import:s=>a(e.httpClient.post(f.import,{theme:s},{token:t}))});var E;null!==(E=globalThis.Headers)&&void 0!==E||(globalThis.Headers=l);const M=(...e)=>(e.forEach((e=>{var t,a;e&&(null!==(t=(a=e).highWaterMark)&&void 0!==t||(a.highWaterMark=31457280))})),i(...e)),S=a=>{var i,{managementKey:l,publicKey:m}=a,u=e(a,["managementKey","publicKey"]);const c=t(Object.assign(Object.assign({},u),{fetch:M,baseHeaders:Object.assign(Object.assign({},u.baseHeaders),{"x-descope-sdk-name":"nodejs","x-descope-sdk-node-version":(null===(i=null===process||void 0===process?void 0:process.versions)||void 0===i?void 0:i.node)||"","x-descope-sdk-version":"1.5.2"})})),{projectId:g,logger:h}=u,v={},k=((e,t)=>({user:w(e,t),accessKey:N(e,t),tenant:I(e,t),sso:x(e,t),jwt:b(e,t),permission:T(e,t),role:A(e,t),group:P(e,t),flow:j(e,t),theme:R(e,t)}))(c,l),y=Object.assign(Object.assign({},c),{management:k,async getKey(e){if(!(null==e?void 0:e.kid))throw Error("header.kid must not be empty");if(v[e.kid])return v[e.kid];if(Object.assign(v,await(async()=>{if(m)try{const e=JSON.parse(m),t=await r(e);return{[e.kid]:t}}catch(e){throw null==h||h.error("Failed to parse the provided public key",e),new Error("Failed to parse public key")}const e=(await c.httpClient.get(`v2/keys/${g}`).then((e=>e.json()))).keys;return Array.isArray(e)?(await Promise.all(e.map((async e=>[e.kid,await r(e)])))).reduce(((e,[t,a])=>t?Object.assign(Object.assign({},e),{[t.toString()]:a}):e),{}):{}})()),!v[e.kid])throw Error("failed to fetch matching key");return v[e.kid]},async validateJwt(e){var t;const a=(await o(e,y.getKey,{clockTolerance:5})).payload;if(a&&(a.iss=null===(t=a.iss)||void 0===t?void 0:t.split("/").pop(),a.iss!==g))throw new n.JWTClaimValidationFailed('unexpected "iss" claim value',"iss","check_failed");return{jwt:e,token:a}},async validateSession(e){if(!e)throw Error("session token is required for validation");try{return await y.validateJwt(e)}catch(e){throw null==h||h.error("session validation failed",e),Error("session validation failed")}},async refreshSession(e){var t,a;if(!e)throw Error("refresh token is required to refresh a session");try{await y.validateJwt(e);const s=await y.refresh(e);if(s.ok){return await y.validateJwt(null===(t=s.data)||void 0===t?void 0:t.sessionJwt)}throw Error(null===(a=s.error)||void 0===a?void 0:a.errorMessage)}catch(e){throw null==h||h.error("refresh token validation failed",e),Error("refresh token validation failed")}},async validateAndRefreshSession(e,t){if(!e&&!t)throw Error("both session and refresh tokens are empty");try{return await y.validateSession(e)}catch(e){null==h||h.log("session validation failed - trying to refresh it")}return y.refreshSession(t)},async exchangeAccessKey(e){if(!e)throw Error("access key must not be empty");let t;try{t=await y.accessKey.exchange(e)}catch(e){throw null==h||h.error("failed to exchange access key",e),Error("could not exchange access key")}const{sessionJwt:a}=t.data;if(!a)throw null==h||h.error("failed to parse exchange access key response"),Error("could not exchange access key");try{return await y.validateJwt(a)}catch(e){throw null==h||h.error("failed to parse jwt from access key",e),Error("could not exchange access key")}},validatePermissions:(e,t)=>y.validateTenantPermissions(e,null,t),validateTenantPermissions(e,t,a){const s=p(e,"permissions",t);return a.every((e=>s.includes(e)))},validateRoles:(e,t)=>y.validateTenantRoles(e,null,t),validateTenantRoles(e,t,a){const s=p(e,"roles",t);return a.every((e=>s.includes(e)))}});return s(y,["otp.verify.email","otp.verify.sms","otp.verify.whatsapp","magicLink.verify","enchantedLink.signUp","enchantedLink.signIn","oauth.exchange","saml.exchange","totp.verify","webauthn.signIn.finish","webauthn.signUp.finish","refresh"],d)};S.RefreshTokenCookieName="DSR",S.SessionTokenCookieName="DS";export{S as default};
 //# sourceMappingURL=index.esm.js.map

package/dist/index.esm.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.esm.js","sources":["../lib/constants.ts","../lib/helpers.ts","../lib/management/paths.ts","../lib/management/user.ts","../lib/management/tenant.ts","../lib/management/jwt.ts","../lib/management/permission.ts","../lib/management/role.ts","../lib/management/group.ts","../lib/management/sso.ts","../lib/management/accesskey.ts","../lib/management/flow.ts","../lib/management/theme.ts","../lib/fetch-polyfill.ts","../lib/index.ts","../lib/management/index.ts"],"sourcesContent":["// eslint-disable-next-line import/prefer-default-export\n/** Refresh JWT cookie name */\nexport const refreshTokenCookieName = 'DSR';\n/** Session JWT cookie name */\nexport const sessionTokenCookieName = 'DS';\n/** The key of the tenants claims in the claims map */\nexport const authorizedTenantsClaimName = 'tenants';\n/** The key of the permissions claims in the claims map either under tenant or top level */\nexport const permissionsClaimName = 'permissions';\n/** The key of the roles claims in the claims map either under tenant or top level */\nexport const rolesClaimName = 'roles';\n","import type { SdkFnWrapper } from '@descope/core-js-sdk';\nimport { authorizedTenantsClaimName, refreshTokenCookieName } from './constants';\nimport { AuthenticationInfo } from './types';\n\n/**\n * Generate a cookie string from given parameters\n * @param name name of the cookie\n * @param value value of cookie that must be already encoded\n * @param options any options to put on the cookie like cookieDomain, cookieMaxAge, cookiePath\n * @returns Cookie string with all options on the string\n */\nconst generateCookie = (name: string, value: string, options?: Record<string, string | number>) =>\n  `${name}=${value}; Domain=${options?.cookieDomain || ''}; Max-Age=${\n    options?.cookieMaxAge || ''\n  }; Path=${options?.cookiePath || '/'}; HttpOnly; SameSite=Strict`;\n\n/**\n * Parse the cookie string and return the value of the cookie\n * @param cookie the raw cookie string\n * @param name the name of the cookie to get value for\n * @returns the value of the given cookie\n */\nconst getCookieValue = (cookie: string | null | undefined, name: string) => {\n  const match = cookie?.match(RegExp(`(?:^|;\\\\s*)${name}=([^;]*)`));\n  return match ? match[1] : null;\n};\n\n// eslint-disable-next-line import/prefer-default-export\n/**\n * Add cookie generation to core-js functions.\n * @param fn the function we are wrapping\n * @returns Wrapped function with cookie generation\n */\nexport const withCookie: SdkFnWrapper<{ refreshJwt?: string; cookies?: string[] }> =\n  (fn) =>\n  async (...args) => {\n    const resp = await fn(...args);\n\n    // istanbul ignore next\n    if (!resp.data) {\n      return resp;\n    }\n\n    // eslint-disable-next-line prefer-const\n    let { refreshJwt, ...rest } = resp.data;\n    const cookies: string[] = [];\n\n    if (!refreshJwt) {\n      if (resp.response?.headers.get('set-cookie')) {\n        refreshJwt = getCookieValue(\n          resp.response?.headers.get('set-cookie'),\n          refreshTokenCookieName,\n        );\n        cookies.push(resp.response?.headers.get('set-cookie')!);\n      }\n    } else {\n      cookies.push(generateCookie(refreshTokenCookieName, refreshJwt, rest));\n    }\n\n    return { ...resp, data: { ...resp.data, refreshJwt, cookies } };\n  };\n\n/**\n * Get the claim (used for permissions or roles) for a given tenant or top level if tenant is empty\n * @param authInfo The parsed authentication info from the JWT\n * @param claim name of the claim\n * @param tenant tenant to retrieve the claim for\n * @returns\n */\nexport function getAuthorizationClaimItems(\n  authInfo: AuthenticationInfo,\n  claim: string,\n  tenant?: string,\n): string[] {\n  const value = tenant\n    ? authInfo.token[authorizedTenantsClaimName]?.[tenant]?.[claim]\n    : authInfo.token[claim];\n  return Array.isArray(value) ? value : [];\n}\n","/** API paths for the Descope service Management APIs */\nexport default {\n  user: {\n    create: '/v1/mgmt/user/create',\n    update: '/v1/mgmt/user/update',\n    delete: '/v1/mgmt/user/delete',\n    deleteAllTestUsers: '/v1/mgmt/user/test/delete/all',\n    load: '/v1/mgmt/user',\n    search: '/v1/mgmt/user/search',\n    updateStatus: '/v1/mgmt/user/update/status',\n    updateEmail: '/v1/mgmt/user/update/email',\n    updatePhone: '/v1/mgmt/user/update/phone',\n    updateDisplayName: '/v1/mgmt/user/update/name',\n    updatePicture: '/v1/mgmt/user/update/picture',\n    updateCustomAttribute: '/v1/mgmt/user/update/customAttribute',\n    addRole: '/v1/mgmt/user/update/role/add',\n    removeRole: '/v1/mgmt/user/update/role/remove',\n    addTenant: '/v1/mgmt/user/update/tenant/add',\n    removeTenant: '/v1/mgmt/user/update/tenant/remove',\n    generateOTPForTest: '/v1/mgmt/tests/generate/otp',\n    generateMagicLinkForTest: '/v1/mgmt/tests/generate/magiclink',\n    generateEnchantedLinkForTest: '/v1/mgmt/tests/generate/enchantedlink',\n  },\n  accessKey: {\n    create: '/v1/mgmt/accesskey/create',\n    load: '/v1/mgmt/accesskey',\n    search: '/v1/mgmt/accesskey/search',\n    update: '/v1/mgmt/accesskey/update',\n    deactivate: '/v1/mgmt/accesskey/deactivate',\n    activate: '/v1/mgmt/accesskey/activate',\n    delete: '/v1/mgmt/accesskey/delete',\n  },\n  tenant: {\n    create: '/v1/mgmt/tenant/create',\n    update: '/v1/mgmt/tenant/update',\n    delete: '/v1/mgmt/tenant/delete',\n    loadAll: '/v1/mgmt/tenant/all',\n  },\n  sso: {\n    settings: '/v1/mgmt/sso/settings',\n    metadata: '/v1/mgmt/sso/metadata',\n    mapping: '/v1/mgmt/sso/mapping',\n  },\n  jwt: {\n    update: '/v1/mgmt/jwt/update',\n  },\n  permission: {\n    create: '/v1/mgmt/permission/create',\n    update: '/v1/mgmt/permission/update',\n    delete: '/v1/mgmt/permission/delete',\n    loadAll: '/v1/mgmt/permission/all',\n  },\n  role: {\n    create: '/v1/mgmt/role/create',\n    update: '/v1/mgmt/role/update',\n    delete: '/v1/mgmt/role/delete',\n    loadAll: '/v1/mgmt/role/all',\n  },\n  flow: {\n    export: '/v1/mgmt/flow/export',\n    import: '/v1/mgmt/flow/import',\n  },\n  theme: {\n    export: '/v1/mgmt/theme/export',\n    import: '/v1/mgmt/theme/import',\n  },\n  group: {\n    loadAllGroups: '/v1/mgmt/group/all',\n    loadAllGroupsForMember: '/v1/mgmt/group/member/all',\n    loadAllGroupMembers: '/v1/mgmt/group/members',\n  },\n};\n","import { DeliveryMethod, SdkResponse, transformResponse, UserResponse } from '@descope/core-js-sdk';\nimport { CoreSdk } from '../types';\nimport apiPaths from './paths';\nimport {\n  AssociatedTenant,\n  GenerateEnchantedLinkForTestResponse,\n  GenerateMagicLinkForTestResponse,\n  GenerateOTPForTestResponse,\n  AttributesTypes,\n} from './types';\n\ntype SingleUserResponse = {\n  user: UserResponse;\n};\n\ntype MultipleUsersResponse = {\n  users: UserResponse[];\n};\n\nconst withUser = (sdk: CoreSdk, managementKey?: string) => ({\n  create: (\n    loginId: string,\n    email?: string,\n    phone?: string,\n    displayName?: string,\n    roles?: string[],\n    userTenants?: AssociatedTenant[],\n    customAttributes?: Record<string, AttributesTypes>,\n    picture?: string,\n  ): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.create,\n        {\n          loginId,\n          email,\n          phone,\n          displayName,\n          roleNames: roles,\n          userTenants,\n          customAttributes,\n          picture,\n        },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  /**\n   * Create a new test user.\n   * The loginID is required and will determine what the user will use to sign in.\n   * Make sure the login id is unique for test. All other fields are optional.\n   *\n   * You can later generate OTP, Magic link and enchanted link to use in the test without the need\n   * of 3rd party messaging services.\n   * Those users are not counted as part of the monthly active users\n   * @returns The UserResponse if found, throws otherwise.\n   */\n  createTestUser: (\n    loginId: string,\n    email?: string,\n    phone?: string,\n    displayName?: string,\n    roles?: string[],\n    userTenants?: AssociatedTenant[],\n    customAttributes?: Record<string, AttributesTypes>,\n    picture?: string,\n  ): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.create,\n        {\n          loginId,\n          email,\n          phone,\n          displayName,\n          roleNames: roles,\n          userTenants,\n          test: true,\n          customAttributes,\n          picture,\n        },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  invite: (\n    loginId: string,\n    email?: string,\n    phone?: string,\n    displayName?: string,\n    roles?: string[],\n    userTenants?: AssociatedTenant[],\n    customAttributes?: Record<string, AttributesTypes>,\n    picture?: string,\n  ): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.create,\n        {\n          loginId,\n          email,\n          phone,\n          displayName,\n          roleNames: roles,\n          userTenants,\n          invite: true,\n          customAttributes,\n          picture,\n        },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  update: (\n    loginId: string,\n    email?: string,\n    phone?: string,\n    displayName?: string,\n    roles?: string[],\n    userTenants?: AssociatedTenant[],\n    customAttributes?: Record<string, AttributesTypes>,\n    picture?: string,\n  ): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.update,\n        {\n          loginId,\n          email,\n          phone,\n          displayName,\n          roleNames: roles,\n          userTenants,\n          customAttributes,\n          picture,\n        },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  delete: (loginId: string): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(apiPaths.user.delete, { loginId }, { token: managementKey }),\n    ),\n  /**\n   * Delete all test users in the project.\n   */\n  deleteAllTestUsers: (): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.delete(apiPaths.user.deleteAllTestUsers, {}, { token: managementKey }),\n    ),\n  load: (loginId: string): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.get(apiPaths.user.load, {\n        queryParams: { loginId },\n        token: managementKey,\n      }),\n      (data) => data.user,\n    ),\n  /**\n   * Load an existing user by user ID. The ID can be found\n   * on the user's JWT.\n   * @param userId load a user by this user ID field\n   * @returns The UserResponse if found, throws otherwise.\n   */\n  loadByUserId: (userId: string): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.get(apiPaths.user.load, {\n        queryParams: { userId },\n        token: managementKey,\n      }),\n      (data) => data.user,\n    ),\n  /**\n   * Search all users. Results can be filtered according to tenants and/or\n   * roles, and also paginated used the limit and page parameters.\n   * @param tenantIds optional list of tenant IDs to filter by\n   * @param roles optional list of roles to filter by\n   * @param limit optionally limit the response, leave out for default limit\n   * @param page optionally paginate over the response\n   * @param testUsersOnly optionally filter only test users\n   * @param withTestUser optionally include test users in search\n   * @returns An array of UserResponse found by the query\n   */\n  searchAll: (\n    tenantIds?: string[],\n    roles?: string[],\n    limit?: number,\n    page?: number,\n    testUsersOnly?: boolean,\n    withTestUser?: boolean,\n    customAttributes?: Record<string, AttributesTypes>,\n  ): Promise<SdkResponse<UserResponse[]>> =>\n    transformResponse<MultipleUsersResponse, UserResponse[]>(\n      sdk.httpClient.post(\n        apiPaths.user.search,\n        { tenantIds, roleNames: roles, limit, page, testUsersOnly, withTestUser, customAttributes },\n        { token: managementKey },\n      ),\n      (data) => data.users,\n    ),\n  activate: (loginId: string): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.updateStatus,\n        { loginId, status: 'enabled' },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  deactivate: (loginId: string): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.updateStatus,\n        { loginId, status: 'disabled' },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  updateEmail: (\n    loginId: string,\n    email: string,\n    isVerified: boolean,\n  ): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.updateEmail,\n        { loginId, email, verified: isVerified },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  updatePhone: (\n    loginId: string,\n    phone: string,\n    isVerified: boolean,\n  ): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.updatePhone,\n        { loginId, phone, verified: isVerified },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  updateDisplayName: (loginId: string, displayName: string): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.updateDisplayName,\n        { loginId, displayName },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  updatePicture: (loginId: string, picture: string): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.updatePicture,\n        { loginId, picture },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  updateCustomAttribute: (\n    loginId: string,\n    attributeKey: string,\n    attributeValue: AttributesTypes,\n  ): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.updateCustomAttribute,\n        { loginId, attributeKey, attributeValue },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  addRoles: (loginId: string, roles: string[]): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.addRole,\n        { loginId, roleNames: roles },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  removeRoles: (loginId: string, roles: string[]): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.removeRole,\n        { loginId, roleNames: roles },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  addTenant: (loginId: string, tenantId: string): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(apiPaths.user.addTenant, { loginId, tenantId }, { token: managementKey }),\n      (data) => data.user,\n    ),\n  removeTenant: (loginId: string, tenantId: string): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.removeTenant,\n        { loginId, tenantId },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  addTenantRoles: (\n    loginId: string,\n    tenantId: string,\n    roles: string[],\n  ): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.addRole,\n        { loginId, tenantId, roleNames: roles },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  removeTenantRoles: (\n    loginId: string,\n    tenantId: string,\n    roles: string[],\n  ): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.removeRole,\n        { loginId, tenantId, roleNames: roles },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n\n  /**\n   * Generate OTP for the given login ID of a test user.\n   * Choose the selected delivery method for verification.\n   * Returns the code for the login (exactly as it sent via Email or SMS)\n   * This is useful when running tests and don't want to use 3rd party messaging services\n   *\n   * @param deliveryMethod optional DeliveryMethod\n   * @param loginId login ID of a test user\n   * @returns GenerateOTPForTestResponse which includes the loginId and the OTP code\n   */\n  generateOTPForTestUser: (\n    deliveryMethod: DeliveryMethod,\n    loginId: string,\n  ): Promise<SdkResponse<GenerateOTPForTestResponse>> =>\n    transformResponse<GenerateOTPForTestResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.generateOTPForTest,\n        { deliveryMethod, loginId },\n        { token: managementKey },\n      ),\n      (data) => data,\n    ),\n\n  /**\n   * Generate Magic Link for the given login ID of a test user.\n   * Choose the selected delivery method for verification.\n   * It returns the link for the login (exactly as it sent via Email)\n   * This is useful when running tests and don't want to use 3rd party messaging services\n   *\n   * @param deliveryMethod optional DeliveryMethod\n   * @param loginId login ID of a test user\n   * @param uri optional redirect uri which will be used instead of any global configuration.\n   * @returns GenerateMagicLinkForTestResponse which includes the loginId and the magic link\n   */\n  generateMagicLinkForTestUser: (\n    deliveryMethod: DeliveryMethod,\n    loginId: string,\n    uri: string,\n  ): Promise<SdkResponse<GenerateMagicLinkForTestResponse>> =>\n    transformResponse<GenerateMagicLinkForTestResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.generateMagicLinkForTest,\n        { deliveryMethod, loginId, URI: uri },\n        { token: managementKey },\n      ),\n      (data) => data,\n    ),\n\n  /**\n   * Generate Enchanted Link for the given login ID of a test user.\n   * It returns the link for the login (exactly as it sent via Email)\n   * and pendingRef which is used to poll for a valid session\n   * This is useful when running tests and don't want to use 3rd party messaging services\n   *\n   * @param loginId login ID of a test user\n   * @param uri optional redirect uri which will be used instead of any global configuration.\n   * @returns GenerateEnchantedLinkForTestResponse which includes the loginId, the enchanted link and the pendingRef\n   */\n  generateEnchantedLinkForTestUser: (\n    loginId: string,\n    uri: string,\n  ): Promise<SdkResponse<GenerateEnchantedLinkForTestResponse>> =>\n    transformResponse<GenerateEnchantedLinkForTestResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.generateEnchantedLinkForTest,\n        { loginId, URI: uri },\n        { token: managementKey },\n      ),\n      (data) => data,\n    ),\n});\n\nexport default withUser;\n","import { SdkResponse, transformResponse } from '@descope/core-js-sdk';\nimport { CoreSdk } from '../types';\nimport apiPaths from './paths';\nimport { CreateTenantResponse, Tenant } from './types';\n\ntype MultipleTenantResponse = {\n  tenants: Tenant[];\n};\n\nconst withTenant = (sdk: CoreSdk, managementKey?: string) => ({\n  create: (\n    name: string,\n    selfProvisioningDomains?: string[],\n  ): Promise<SdkResponse<CreateTenantResponse>> =>\n    transformResponse(\n      sdk.httpClient.post(\n        apiPaths.tenant.create,\n        { name, selfProvisioningDomains },\n        { token: managementKey },\n      ),\n    ),\n  createWithId: (\n    id: string,\n    name: string,\n    selfProvisioningDomains?: string[],\n  ): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(\n        apiPaths.tenant.create,\n        { id, name, selfProvisioningDomains },\n        { token: managementKey },\n      ),\n    ),\n  update: (\n    id: string,\n    name: string,\n    selfProvisioningDomains?: string[],\n  ): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(\n        apiPaths.tenant.update,\n        { id, name, selfProvisioningDomains },\n        { token: managementKey },\n      ),\n    ),\n  delete: (id: string): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(apiPaths.tenant.delete, { id }, { token: managementKey }),\n    ),\n  loadAll: (): Promise<SdkResponse<Tenant[]>> =>\n    transformResponse<MultipleTenantResponse, Tenant[]>(\n      sdk.httpClient.get(apiPaths.tenant.loadAll, {\n        token: managementKey,\n      }),\n      (data) => data.tenants,\n    ),\n});\n\nexport default withTenant;\n","import { SdkResponse, transformResponse } from '@descope/core-js-sdk';\nimport { CoreSdk } from '../types';\nimport apiPaths from './paths';\nimport { UpdateJWTResponse } from './types';\n\nconst withJWT = (sdk: CoreSdk, managementKey?: string) => ({\n  update: (\n    jwt: string,\n    customClaims?: Record<string, any>,\n  ): Promise<SdkResponse<UpdateJWTResponse>> =>\n    transformResponse(\n      sdk.httpClient.post(apiPaths.jwt.update, { jwt, customClaims }, { token: managementKey }),\n    ),\n});\n\nexport default withJWT;\n","import { SdkResponse, transformResponse } from '@descope/core-js-sdk';\nimport { CoreSdk } from '../types';\nimport apiPaths from './paths';\nimport { Permission } from './types';\n\ntype MultiplePermissionResponse = {\n  permissions: Permission[];\n};\n\nconst withPermission = (sdk: CoreSdk, managementKey?: string) => ({\n  create: (name: string, description?: string): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(\n        apiPaths.permission.create,\n        { name, description },\n        { token: managementKey },\n      ),\n    ),\n  update: (name: string, newName: string, description?: string): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(\n        apiPaths.permission.update,\n        { name, newName, description },\n        { token: managementKey },\n      ),\n    ),\n  delete: (name: string): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(apiPaths.permission.delete, { name }, { token: managementKey }),\n    ),\n  loadAll: (): Promise<SdkResponse<Permission[]>> =>\n    transformResponse<MultiplePermissionResponse, Permission[]>(\n      sdk.httpClient.get(apiPaths.permission.loadAll, {\n        token: managementKey,\n      }),\n      (data) => data.permissions,\n    ),\n});\n\nexport default withPermission;\n","import { SdkResponse, transformResponse } from '@descope/core-js-sdk';\nimport { CoreSdk } from '../types';\nimport apiPaths from './paths';\nimport { Role } from './types';\n\ntype MultipleRoleResponse = {\n  roles: Role[];\n};\n\nconst withRole = (sdk: CoreSdk, managementKey?: string) => ({\n  create: (\n    name: string,\n    description?: string,\n    permissionNames?: string[],\n  ): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(\n        apiPaths.role.create,\n        { name, description, permissionNames },\n        { token: managementKey },\n      ),\n    ),\n  update: (\n    name: string,\n    newName: string,\n    description?: string,\n    permissionNames?: string[],\n  ): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(\n        apiPaths.role.update,\n        { name, newName, description, permissionNames },\n        { token: managementKey },\n      ),\n    ),\n  delete: (name: string): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(apiPaths.role.delete, { name }, { token: managementKey }),\n    ),\n  loadAll: (): Promise<SdkResponse<Role[]>> =>\n    transformResponse<MultipleRoleResponse, Role[]>(\n      sdk.httpClient.get(apiPaths.role.loadAll, {\n        token: managementKey,\n      }),\n      (data) => data.roles,\n    ),\n});\n\nexport default withRole;\n","import { SdkResponse, transformResponse } from '@descope/core-js-sdk';\nimport { CoreSdk } from '../types';\nimport apiPaths from './paths';\nimport { Group } from './types';\n\nconst withGroup = (sdk: CoreSdk, managementKey?: string) => ({\n  /**\n   * Load all groups for a specific tenant id.\n   * @param tenantId Tenant ID to load groups from.\n   * @returns Group[] list of groups\n   */\n  loadAllGroups: (tenantId: string): Promise<SdkResponse<Group[]>> =>\n    transformResponse<Group[]>(\n      sdk.httpClient.post(apiPaths.group.loadAllGroups, { tenantId }, { token: managementKey }),\n    ),\n\n  /**\n   * Load all groups for the provided user IDs or login IDs.\n   * @param tenantId Tenant ID to load groups from.\n   * @param userIds Optional List of user IDs, with the format of \"U2J5ES9S8TkvCgOvcrkpzUgVTEBM\" (example), which can be found on the user's JWT.\n   * @param loginIds Optional List of login IDs, how the user identifies when logging in.\n   * @returns Group[] list of groups\n   */\n  loadAllGroupsForMember: (\n    tenantId: string,\n    userIds: string[],\n    loginIds: string[],\n  ): Promise<SdkResponse<Group[]>> =>\n    transformResponse<Group[]>(\n      sdk.httpClient.post(\n        apiPaths.group.loadAllGroupsForMember,\n        { tenantId, loginIds, userIds },\n        { token: managementKey },\n      ),\n    ),\n\n  /**\n   * Load all members of the provided group id.\n   * @param tenantId Tenant ID to load groups from.\n   * @param groupId Group ID to load members for.\n   * @returns Group[] list of groups\n   */\n  loadAllGroupMembers: (tenantId: string, groupId: string): Promise<SdkResponse<Group[]>> =>\n    transformResponse<Group[]>(\n      sdk.httpClient.post(\n        apiPaths.group.loadAllGroupMembers,\n        { tenantId, groupId },\n        { token: managementKey },\n      ),\n    ),\n});\n\nexport default withGroup;\n","import { SdkResponse, transformResponse } from '@descope/core-js-sdk';\nimport { CoreSdk } from '../types';\nimport apiPaths from './paths';\nimport { RoleMapping, AttributeMapping, SSOSettingsResponse } from './types';\n\nconst withSSOSettings = (sdk: CoreSdk, managementKey?: string) => ({\n  getSettings: (tenantId: string): Promise<SdkResponse<SSOSettingsResponse>> =>\n    transformResponse<SSOSettingsResponse>(\n      sdk.httpClient.get(apiPaths.sso.settings, {\n        queryParams: { tenantId },\n        token: managementKey,\n      }),\n      (data) => data,\n    ),\n  configureSettings: (\n    tenantId: string,\n    idpURL: string,\n    idpCert: string,\n    entityId: string,\n    redirectURL?: string,\n    domain?: string,\n  ): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(\n        apiPaths.sso.settings,\n        { tenantId, idpURL, entityId, idpCert, redirectURL, domain },\n        { token: managementKey },\n      ),\n    ),\n  configureMetadata: (tenantId: string, idpMetadataURL: string): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(\n        apiPaths.sso.metadata,\n        { tenantId, idpMetadataURL },\n        { token: managementKey },\n      ),\n    ),\n  configureMapping: (\n    tenantId: string,\n    roleMapping?: RoleMapping,\n    attributeMapping?: AttributeMapping,\n  ): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(\n        apiPaths.sso.mapping,\n        { tenantId, roleMapping, attributeMapping },\n        { token: managementKey },\n      ),\n    ),\n});\n\nexport default withSSOSettings;\n","import { SdkResponse, transformResponse } from '@descope/core-js-sdk';\nimport { CoreSdk } from '../types';\nimport apiPaths from './paths';\nimport { AccessKey, AssociatedTenant, CreatedAccessKeyResponse } from './types';\n\ntype SingleKeyResponse = {\n  key: AccessKey;\n};\n\ntype MultipleKeysResponse = {\n  keys: AccessKey[];\n};\n\nconst withAccessKey = (sdk: CoreSdk, managementKey?: string) => ({\n  /**\n   * Create a new access key for a project.\n   * @param name Access key name\n   * @param expireTime When the access key expires. Keep at 0 to make it indefinite.\n   * @param roles Optional roles in the project. Does not apply for multi-tenants\n   * @param keyTenants Optional associated tenants for this key and its roles for each.\n   * @returns A newly created key and its cleartext. Make sure to save the cleartext securely.\n   */\n  create: (\n    name: string,\n    expireTime: number,\n    roles?: string[],\n    keyTenants?: AssociatedTenant[],\n  ): Promise<SdkResponse<CreatedAccessKeyResponse>> =>\n    transformResponse(\n      sdk.httpClient.post(\n        apiPaths.accessKey.create,\n        { name, expireTime, roleNames: roles, keyTenants },\n        { token: managementKey },\n      ),\n    ),\n  /**\n   * Load an access key.\n   * @param id Access key ID to load\n   * @returns The loaded access key.\n   */\n  load: (id: string): Promise<SdkResponse<AccessKey>> =>\n    transformResponse<SingleKeyResponse, AccessKey>(\n      sdk.httpClient.get(apiPaths.accessKey.load, {\n        queryParams: { id },\n        token: managementKey,\n      }),\n      (data) => data.key,\n    ),\n  /**\n   * Search all access keys\n   * @param tenantIds Optional tenant ID filter to apply on the search results\n   * @returns An array of found access keys\n   */\n  searchAll: (tenantIds?: string[]): Promise<SdkResponse<AccessKey[]>> =>\n    transformResponse<MultipleKeysResponse, AccessKey[]>(\n      sdk.httpClient.post(apiPaths.accessKey.search, { tenantIds }, { token: managementKey }),\n      (data) => data.keys,\n    ),\n  /**\n   * Update an access key.\n   * @param id Access key ID to load\n   * @param name The updated access key name\n   * @returns The updated access key\n   */\n  update: (id: string, name: string): Promise<SdkResponse<AccessKey>> =>\n    transformResponse<SingleKeyResponse, AccessKey>(\n      sdk.httpClient.post(apiPaths.accessKey.update, { id, name }, { token: managementKey }),\n      (data) => data.key,\n    ),\n  /**\n   * Deactivate an access key. Deactivated access keys cannot be used until they are\n   * activated again.\n   * @param id Access key ID to deactivate\n   */\n  deactivate: (id: string): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(apiPaths.accessKey.deactivate, { id }, { token: managementKey }),\n    ),\n  /**\n   * Activate an access key. Only deactivated access keys can be activated again.\n   * @param id Access key ID to activate\n   */\n  activate: (id: string): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(apiPaths.accessKey.activate, { id }, { token: managementKey }),\n    ),\n  /**\n   * Delete an access key. IMPORTANT: This cannot be undone. Use carefully.\n   * @param id Access key ID to delete\n   */\n  delete: (id: string): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(apiPaths.accessKey.delete, { id }, { token: managementKey }),\n    ),\n});\n\nexport default withAccessKey;\n","import { SdkResponse, transformResponse } from '@descope/core-js-sdk';\nimport { CoreSdk } from '../types';\nimport apiPaths from './paths';\nimport { FlowResponse, Screen, Flow } from './types';\n\nconst WithFlow = (sdk: CoreSdk, managementKey?: string) => ({\n  export: (flowId: string): Promise<SdkResponse<FlowResponse>> =>\n    transformResponse(\n      sdk.httpClient.post(apiPaths.flow.export, { flowId }, { token: managementKey }),\n    ),\n  import: (flowId: string, flow: Flow, screens?: Screen[]): Promise<SdkResponse<FlowResponse>> =>\n    transformResponse(\n      sdk.httpClient.post(\n        apiPaths.flow.import,\n        { flowId, flow, screens },\n        { token: managementKey },\n      ),\n    ),\n});\n\nexport default WithFlow;\n","import { SdkResponse, transformResponse } from '@descope/core-js-sdk';\nimport { CoreSdk } from '../types';\nimport apiPaths from './paths';\nimport { Theme, ThemeResponse } from './types';\n\nconst WithTheme = (sdk: CoreSdk, managementKey?: string) => ({\n  export: (): Promise<SdkResponse<ThemeResponse>> =>\n    transformResponse(sdk.httpClient.post(apiPaths.theme.export, {}, { token: managementKey })),\n  import: (theme: Theme): Promise<SdkResponse<ThemeResponse>> =>\n    transformResponse(\n      sdk.httpClient.post(apiPaths.theme.import, { theme }, { token: managementKey }),\n    ),\n});\n\nexport default WithTheme;\n","import nodeFetch, { Headers } from 'node-fetch-commonjs';\n\nglobalThis.Headers ??= Headers;\n\nconst highWaterMarkMb = 1024 * 1024 * 30; // 30MB\n\n// we are increasing the response buffer size due to an issue where node-fetch hangs when response is too big\nconst patchedFetch = (...args: Parameters<typeof nodeFetch>) => {\n  // we can get Request on the first arg, or RequestInfo on the second arg\n  // we want to make sure we are setting the \"highWaterMark\" so we are doing it on both args\n  args.forEach((arg) => {\n    // eslint-disable-next-line no-param-reassign, @typescript-eslint/no-unused-expressions\n    arg && ((arg as any).highWaterMark ??= highWaterMarkMb);\n  });\n\n  return nodeFetch(...args);\n};\n\nexport default patchedFetch as unknown as typeof fetch;\n","import createSdk, { ExchangeAccessKeyResponse, SdkResponse, wrapWith } from '@descope/core-js-sdk';\nimport { JWK, JWTHeaderParameters, KeyLike, errors, importJWK, jwtVerify } from 'jose';\nimport {\n  permissionsClaimName,\n  refreshTokenCookieName,\n  rolesClaimName,\n  sessionTokenCookieName,\n} from './constants';\nimport { getAuthorizationClaimItems, withCookie } from './helpers';\nimport withManagement from './management';\nimport { AuthenticationInfo } from './types';\nimport fetch from './fetch-polyfill';\n\ndeclare const BUILD_VERSION: string;\n\n/** Configuration arguments which include the Descope core SDK args and an optional management key */\ntype NodeSdkArgs = Parameters<typeof createSdk>[0] & {\n  managementKey?: string;\n};\n\nconst nodeSdk = ({ managementKey, ...config }: NodeSdkArgs) => {\n  const coreSdk = createSdk({\n    ...config,\n    fetch,\n    baseHeaders: {\n      ...config.baseHeaders,\n      'x-descope-sdk-name': 'nodejs',\n      'x-descope-sdk-node-version': process?.versions?.node || '',\n      'x-descope-sdk-version': BUILD_VERSION,\n    },\n  });\n\n  const { projectId, logger } = config;\n\n  const keys: Record<string, KeyLike | Uint8Array> = {};\n\n  /** Fetch the public keys (JWKs) from Descope for the configured project */\n  const fetchKeys = async () => {\n    const keysWrapper = await coreSdk.httpClient\n      .get(`v2/keys/${projectId}`)\n      .then((resp) => resp.json());\n    const publicKeys: JWK[] = keysWrapper.keys;\n    if (!Array.isArray(publicKeys)) return {};\n    const kidJwksPairs = await Promise.all(\n      publicKeys.map(async (key) => [key.kid, await importJWK(key)]),\n    );\n\n    return kidJwksPairs.reduce(\n      (acc, [kid, jwk]) => (kid ? { ...acc, [kid.toString()]: jwk } : acc),\n      {},\n    );\n  };\n\n  const management = withManagement(coreSdk, managementKey);\n\n  const sdk = {\n    ...coreSdk,\n\n    /**\n     * Provides various APIs for managing a Descope project programmatically. A management key must\n     * be provided as an argument when initializing the SDK to use these APIs. Management keys can be\n     * generated in the Descope console.\n     */\n    management,\n\n    /** Get the key that can validate the given JWT KID in the header. Can retrieve the public key from local cache or from Descope. */\n    async getKey(header: JWTHeaderParameters): Promise<KeyLike | Uint8Array> {\n      if (!header?.kid) throw Error('header.kid must not be empty');\n\n      if (keys[header.kid]) return keys[header.kid];\n\n      // do we need to fetch once or every time?\n      Object.assign(keys, await fetchKeys());\n\n      if (!keys[header.kid]) throw Error('failed to fetch matching key');\n\n      return keys[header.kid];\n    },\n\n    /**\n     * Validate the given JWT with the right key and make sure the issuer is correct\n     * @param jwt the JWT string to parse and validate\n     * @returns AuthenticationInfo with the parsed token and JWT. Will throw an error if validation fails.\n     */\n    async validateJwt(jwt: string): Promise<AuthenticationInfo> {\n      // Do not hard-code the algo because library does not support `None` so all are valid\n      const res = await jwtVerify(jwt, sdk.getKey, { clockTolerance: 5 });\n      const token = res.payload;\n\n      if (token) {\n        token.iss = token.iss?.split('/').pop(); // support both url and project id as issuer\n        if (token.iss !== projectId) {\n          // We must do the verification here, since issuer can be either project ID or URL\n          throw new errors.JWTClaimValidationFailed(\n            'unexpected \"iss\" claim value',\n            'iss',\n            'check_failed',\n          );\n        }\n      }\n\n      return { jwt, token };\n    },\n\n    /**\n     * Validate an active session\n     * @param sessionToken session JWT to validate\n     * @returns AuthenticationInfo promise or throws Error if there is an issue with JWTs\n     */\n    async validateSession(sessionToken: string): Promise<AuthenticationInfo> {\n      if (!sessionToken) throw Error('session token is required for validation');\n\n      try {\n        const token = await sdk.validateJwt(sessionToken);\n        return token;\n      } catch (error) {\n        /* istanbul ignore next */\n        logger?.error('session validation failed', error);\n        throw Error('session validation failed');\n      }\n    },\n\n    /**\n     * Refresh the session using a refresh token\n     * @param refreshToken refresh JWT to refresh the session with\n     * @returns AuthenticationInfo promise or throws Error if there is an issue with JWTs\n     */\n    async refreshSession(refreshToken: string): Promise<AuthenticationInfo> {\n      if (!refreshToken) throw Error('refresh token is required to refresh a session');\n\n      try {\n        await sdk.validateJwt(refreshToken);\n        const jwtResp = await sdk.refresh(refreshToken);\n        if (jwtResp.ok) {\n          const token = await sdk.validateJwt(jwtResp.data?.sessionJwt);\n          return token;\n        }\n        /* istanbul ignore next */\n        throw Error(jwtResp.error?.errorMessage);\n      } catch (refreshTokenErr) {\n        /* istanbul ignore next */\n        logger?.error('refresh token validation failed', refreshTokenErr);\n        throw Error('refresh token validation failed');\n      }\n    },\n\n    /**\n     * Validate session and refresh it if it expired\n     * @param sessionToken session JWT\n     * @param refreshToken refresh JWT\n     * @returns AuthenticationInfo promise or throws Error if there is an issue with JWTs\n     */\n    async validateAndRefreshSession(\n      sessionToken?: string,\n      refreshToken?: string,\n    ): Promise<AuthenticationInfo> {\n      if (!sessionToken && !refreshToken) throw Error('both session and refresh tokens are empty');\n\n      try {\n        const token = await sdk.validateSession(sessionToken);\n        return token;\n      } catch (error) {\n        /* istanbul ignore next */\n        logger?.log('session validation failed - trying to refresh it');\n      }\n\n      return sdk.refreshSession(refreshToken);\n    },\n\n    /**\n     * Exchange API key (access key) for a session key\n     * @param accessKey access key to exchange for a session JWT\n     * @returns AuthneticationInfo with session JWT data\n     */\n    async exchangeAccessKey(accessKey: string): Promise<AuthenticationInfo> {\n      if (!accessKey) throw Error('access key must not be empty');\n\n      let resp: SdkResponse<ExchangeAccessKeyResponse>;\n      try {\n        resp = await sdk.accessKey.exchange(accessKey);\n      } catch (error) {\n        logger?.error('failed to exchange access key', error);\n        throw Error('could not exchange access key');\n      }\n\n      const { sessionJwt } = resp.data;\n      if (!sessionJwt) {\n        logger?.error('failed to parse exchange access key response');\n        throw Error('could not exchange access key');\n      }\n\n      try {\n        const token = await sdk.validateJwt(sessionJwt);\n        return token;\n      } catch (error) {\n        logger?.error('failed to parse jwt from access key', error);\n        throw Error('could not exchange access key');\n      }\n    },\n\n    /**\n     * Make sure that all given permissions exist on the parsed JWT top level claims\n     * @param authInfo JWT parsed info\n     * @param permissions list of permissions to make sure they exist on te JWT claims\n     * @returns true if all permissions exist, false otherwise\n     */\n    validatePermissions(authInfo: AuthenticationInfo, permissions: string[]): boolean {\n      return sdk.validateTenantPermissions(authInfo, null, permissions);\n    },\n\n    /**\n     * Make sure that all given permissions exist on the parsed JWT tenant claims\n     * @param authInfo JWT parsed info\n     * @param permissions list of permissions to make sure they exist on te JWT claims\n     * @returns true if all permissions exist, false otherwise\n     */\n    validateTenantPermissions(\n      authInfo: AuthenticationInfo,\n      tenant: string,\n      permissions: string[],\n    ): boolean {\n      const granted = getAuthorizationClaimItems(authInfo, permissionsClaimName, tenant);\n      return permissions.every((perm) => granted.includes(perm));\n    },\n\n    /**\n     * Make sure that all given roles exist on the parsed JWT top level claims\n     * @param authInfo JWT parsed info\n     * @param roles list of roles to make sure they exist on te JWT claims\n     * @returns true if all roles exist, false otherwise\n     */\n    validateRoles(authInfo: AuthenticationInfo, roles: string[]): boolean {\n      return sdk.validateTenantRoles(authInfo, null, roles);\n    },\n\n    /**\n     * Make sure that all given roles exist on the parsed JWT tenant claims\n     * @param authInfo JWT parsed info\n     * @param roles list of roles to make sure they exist on te JWT claims\n     * @returns true if all roles exist, false otherwise\n     */\n    validateTenantRoles(authInfo: AuthenticationInfo, tenant: string, roles: string[]): boolean {\n      const membership = getAuthorizationClaimItems(authInfo, rolesClaimName, tenant);\n      return roles.every((role) => membership.includes(role));\n    },\n  };\n\n  return wrapWith(\n    sdk,\n    [\n      'otp.verify.email',\n      'otp.verify.sms',\n      'otp.verify.whatsapp',\n      'magicLink.verify',\n      'enchantedLink.signUp',\n      'enchantedLink.signIn',\n      'oauth.exchange',\n      'saml.exchange',\n      'totp.verify',\n      'webauthn.signIn.finish',\n      'webauthn.signUp.finish',\n      'refresh',\n    ] as const,\n    withCookie,\n  );\n};\n\n/** Descope SDK client with delivery methods enum.\n *\n * Please see full documentation at {@link https://docs.descope.com/guides Descope Docs}\n * @example Usage\n *\n * ```js\n * import descopeSdk from '@descope/node-sdk';\n *\n * const myProjectId = 'xxx';\n * const sdk = descopeSdk({ projectId: myProjectId });\n *\n * const userLoginId = 'loginId';\n * sdk.otp.signIn.email(userLoginId);\n * const jwtResponse = sdk.otp.verify.email(userLoginId, codeFromEmail);\n * ```\n */\n\nnodeSdk.RefreshTokenCookieName = refreshTokenCookieName;\nnodeSdk.SessionTokenCookieName = sessionTokenCookieName;\n\nexport default nodeSdk;\nexport type {\n  DeliveryMethod,\n  OAuthProvider,\n  ResponseData,\n  SdkResponse,\n} from '@descope/core-js-sdk';\n","import { CoreSdk } from '../types';\nimport withUser from './user';\nimport withTenant from './tenant';\nimport withJWT from './jwt';\nimport withPermission from './permission';\nimport withRole from './role';\nimport withGroup from './group';\nimport withSSOSettings from './sso';\nimport withAccessKey from './accesskey';\nimport WithFlow from './flow';\nimport WithTheme from './theme';\n\n/** Constructs a higher level Management API that wraps the functions from code-js-sdk */\nconst withManagement = (sdk: CoreSdk, managementKey?: string) => ({\n  user: withUser(sdk, managementKey),\n  accessKey: withAccessKey(sdk, managementKey),\n  tenant: withTenant(sdk, managementKey),\n  sso: withSSOSettings(sdk, managementKey),\n  jwt: withJWT(sdk, managementKey),\n  permission: withPermission(sdk, managementKey),\n  role: withRole(sdk, managementKey),\n  group: withGroup(sdk, managementKey),\n  flow: WithFlow(sdk, managementKey),\n  theme: WithTheme(sdk, managementKey),\n});\n\nexport default withManagement;\n"],"names":["withCookie","fn","async","args","resp","data","_d","refreshJwt","rest","__rest","cookies","options","push","cookieDomain","cookieMaxAge","cookiePath","_a","response","headers","get","cookie","name","match","RegExp","getCookieValue","_b","_c","Object","assign","getAuthorizationClaimItems","authInfo","claim","tenant","value","token","Array","isArray","apiPaths","create","update","delete","deleteAllTestUsers","load","search","updateStatus","updateEmail","updatePhone","updateDisplayName","updatePicture","updateCustomAttribute","addRole","removeRole","addTenant","removeTenant","generateOTPForTest","generateMagicLinkForTest","generateEnchantedLinkForTest","deactivate","activate","loadAll","settings","metadata","mapping","export","import","loadAllGroups","loadAllGroupsForMember","loadAllGroupMembers","withUser","sdk","managementKey","loginId","email","phone","displayName","roles","userTenants","customAttributes","picture","transformResponse","httpClient","post","roleNames","user","createTestUser","test","invite","queryParams","loadByUserId","userId","searchAll","tenantIds","limit","page","testUsersOnly","withTestUser","users","status","isVerified","verified","attributeKey","attributeValue","addRoles","removeRoles","tenantId","addTenantRoles","removeTenantRoles","generateOTPForTestUser","deliveryMethod","generateMagicLinkForTestUser","uri","URI","generateEnchantedLinkForTestUser","withTenant","selfProvisioningDomains","createWithId","id","tenants","withJWT","jwt","customClaims","withPermission","description","newName","permissions","withRole","permissionNames","withGroup","userIds","loginIds","groupId","withSSOSettings","getSettings","configureSettings","idpURL","idpCert","entityId","redirectURL","domain","configureMetadata","idpMetadataURL","configureMapping","roleMapping","attributeMapping","withAccessKey","expireTime","keyTenants","key","keys","WithFlow","flowId","flow","screens","WithTheme","theme","globalThis","Headers","patchedFetch","forEach","arg","highWaterMark","nodeFetch","nodeSdk","config","coreSdk","createSdk","fetch","baseHeaders","process","versions","node","projectId","logger","management","accessKey","sso","permission","role","group","withManagement","header","kid","Error","publicKeys","then","json","Promise","all","map","importJWK","reduce","acc","jwk","toString","fetchKeys","jwtVerify","getKey","clockTolerance","payload","iss","split","pop","errors","JWTClaimValidationFailed","sessionToken","validateJwt","error","refreshToken","jwtResp","refresh","ok","sessionJwt","errorMessage","refreshTokenErr","validateSession","log","refreshSession","exchange","validatePermissions","validateTenantPermissions","granted","every","perm","includes","validateRoles","validateTenantRoles","membership","wrapWith","RefreshTokenCookieName","SessionTokenCookieName"],"mappings":"sNAEO,MC+BMA,EACVC,GACDC,SAAUC,eACR,MAAMC,QAAaH,KAAME,GAGzB,IAAKC,EAAKC,KACR,OAAOD,EAIT,IAAIE,EAA0BF,EAAKC,MAA/BE,WAAEA,GAAUD,EAAKE,EAAjBC,EAAAH,EAAA,CAAA,eACJ,MAAMI,EAAoB,GAlCP,IAA8BC,EAgDjD,OAZKJ,EASHG,EAAQE,KA5CZ,GDVoC,SCsDoBL,cA5C5BI,OADuBA,EA6CiBH,QA5CxC,EAAAG,EAASE,eAAgB,gBACnDF,aAAA,EAAAA,EAASG,eAAgB,aACjBH,aAAA,EAAAA,EAASI,aAAc,mCAkCZ,QAAbC,EAAAZ,EAAKa,gBAAQ,IAAAD,OAAA,EAAAA,EAAEE,QAAQC,IAAI,iBAC7BZ,EA3Be,EAACa,EAAmCC,KACzD,MAAMC,EAAQF,eAAAA,EAAQE,MAAMC,OAAO,cAAcF,cACjD,OAAOC,EAAQA,EAAM,GAAK,IAAI,EAyBXE,CACE,QAAbC,EAAArB,EAAKa,gBAAQ,IAAAQ,OAAA,EAAAA,EAAEP,QAAQC,IAAI,cDhDC,OCmD9BT,EAAQE,KAAoB,QAAfc,EAAAtB,EAAKa,gBAAU,IAAAS,OAAA,EAAAA,EAAAR,QAAQC,IAAI,gBAMhCQ,OAAAC,OAAAD,OAAAC,OAAA,CAAA,EAAAxB,GAAM,CAAAC,KAAWsB,OAAAC,OAAAD,OAAAC,OAAA,GAAAxB,EAAKC,MAAM,CAAAE,aAAYG,aAAY,WAUpDmB,EACdC,EACAC,EACAC,WAEA,MAAMC,EAAQD,EAC0C,QAApDP,EAA6C,QAA7CT,EAAAc,EAASI,MAAgC,eAAI,IAAAlB,OAAA,EAAAA,EAAAgB,UAAO,IAAAP,OAAA,EAAAA,EAAGM,GACvDD,EAASI,MAAMH,GACnB,OAAOI,MAAMC,QAAQH,GAASA,EAAQ,EACxC,CC7EA,IAAeI,EACP,CACJC,OAAQ,uBACRC,OAAQ,uBACRC,OAAQ,uBACRC,mBAAoB,gCACpBC,KAAM,gBACNC,OAAQ,uBACRC,aAAc,8BACdC,YAAa,6BACbC,YAAa,6BACbC,kBAAmB,4BACnBC,cAAe,+BACfC,sBAAuB,uCACvBC,QAAS,gCACTC,WAAY,mCACZC,UAAW,kCACXC,aAAc,qCACdC,mBAAoB,8BACpBC,yBAA0B,oCAC1BC,6BAA8B,yCApBnBnB,EAsBF,CACTC,OAAQ,4BACRI,KAAM,qBACNC,OAAQ,4BACRJ,OAAQ,4BACRkB,WAAY,gCACZC,SAAU,8BACVlB,OAAQ,6BA7BGH,EA+BL,CACNC,OAAQ,yBACRC,OAAQ,yBACRC,OAAQ,yBACRmB,QAAS,uBAnCEtB,EAqCR,CACHuB,SAAU,wBACVC,SAAU,wBACVC,QAAS,wBAxCEzB,EA0CR,CACHE,OAAQ,uBA3CGF,EA6CD,CACVC,OAAQ,6BACRC,OAAQ,6BACRC,OAAQ,6BACRmB,QAAS,2BAjDEtB,EAmDP,CACJC,OAAQ,uBACRC,OAAQ,uBACRC,OAAQ,uBACRmB,QAAS,qBAvDEtB,EAyDP,CACJ0B,OAAQ,uBACRC,OAAQ,wBA3DG3B,EA6DN,CACL0B,OAAQ,wBACRC,OAAQ,yBA/DG3B,EAiEN,CACL4B,cAAe,qBACfC,uBAAwB,4BACxBC,oBAAqB,0BClDzB,MAAMC,EAAW,CAACC,EAAcC,KAA4B,CAC1DhC,OAAQ,CACNiC,EACAC,EACAC,EACAC,EACAC,EACAC,EACAC,EACAC,IAEAC,EACEV,EAAIW,WAAWC,KACb5C,EAAcC,OACd,CACEiC,UACAC,QACAC,QACAC,cACAQ,UAAWP,EACXC,cACAC,mBACAC,WAEF,CAAE5C,MAAOoC,KAEVjE,GAASA,EAAK8E,OAYnBC,eAAgB,CACdb,EACAC,EACAC,EACAC,EACAC,EACAC,EACAC,EACAC,IAEAC,EACEV,EAAIW,WAAWC,KACb5C,EAAcC,OACd,CACEiC,UACAC,QACAC,QACAC,cACAQ,UAAWP,EACXC,cACAS,MAAM,EACNR,mBACAC,WAEF,CAAE5C,MAAOoC,KAEVjE,GAASA,EAAK8E,OAEnBG,OAAQ,CACNf,EACAC,EACAC,EACAC,EACAC,EACAC,EACAC,EACAC,IAEAC,EACEV,EAAIW,WAAWC,KACb5C,EAAcC,OACd,CACEiC,UACAC,QACAC,QACAC,cACAQ,UAAWP,EACXC,cACAU,QAAQ,EACRT,mBACAC,WAEF,CAAE5C,MAAOoC,KAEVjE,GAASA,EAAK8E,OAEnB5C,OAAQ,CACNgC,EACAC,EACAC,EACAC,EACAC,EACAC,EACAC,EACAC,IAEAC,EACEV,EAAIW,WAAWC,KACb5C,EAAcE,OACd,CACEgC,UACAC,QACAC,QACAC,cACAQ,UAAWP,EACXC,cACAC,mBACAC,WAEF,CAAE5C,MAAOoC,KAEVjE,GAASA,EAAK8E,OAEnB3C,OAAS+B,GACPQ,EACEV,EAAIW,WAAWC,KAAK5C,EAAcG,OAAQ,CAAE+B,WAAW,CAAErC,MAAOoC,KAKpE7B,mBAAoB,IAClBsC,EACEV,EAAIW,WAAWxC,OAAOH,EAAcI,mBAAoB,CAAE,EAAE,CAAEP,MAAOoC,KAEzE5B,KAAO6B,GACLQ,EACEV,EAAIW,WAAW7D,IAAIkB,EAAcK,KAAM,CACrC6C,YAAa,CAAEhB,WACfrC,MAAOoC,KAERjE,GAASA,EAAK8E,OAQnBK,aAAeC,GACbV,EACEV,EAAIW,WAAW7D,IAAIkB,EAAcK,KAAM,CACrC6C,YAAa,CAAEE,UACfvD,MAAOoC,KAERjE,GAASA,EAAK8E,OAanBO,UAAW,CACTC,EACAhB,EACAiB,EACAC,EACAC,EACAC,EACAlB,IAEAE,EACEV,EAAIW,WAAWC,KACb5C,EAAcM,OACd,CAAEgD,YAAWT,UAAWP,EAAOiB,QAAOC,OAAMC,gBAAeC,eAAclB,oBACzE,CAAE3C,MAAOoC,KAEVjE,GAASA,EAAK2F,QAEnBtC,SAAWa,GACTQ,EACEV,EAAIW,WAAWC,KACb5C,EAAcO,aACd,CAAE2B,UAAS0B,OAAQ,WACnB,CAAE/D,MAAOoC,KAEVjE,GAASA,EAAK8E,OAEnB1B,WAAac,GACXQ,EACEV,EAAIW,WAAWC,KACb5C,EAAcO,aACd,CAAE2B,UAAS0B,OAAQ,YACnB,CAAE/D,MAAOoC,KAEVjE,GAASA,EAAK8E,OAEnBtC,YAAa,CACX0B,EACAC,EACA0B,IAEAnB,EACEV,EAAIW,WAAWC,KACb5C,EAAcQ,YACd,CAAE0B,UAASC,QAAO2B,SAAUD,GAC5B,CAAEhE,MAAOoC,KAEVjE,GAASA,EAAK8E,OAEnBrC,YAAa,CACXyB,EACAE,EACAyB,IAEAnB,EACEV,EAAIW,WAAWC,KACb5C,EAAcS,YACd,CAAEyB,UAASE,QAAO0B,SAAUD,GAC5B,CAAEhE,MAAOoC,KAEVjE,GAASA,EAAK8E,OAEnBpC,kBAAmB,CAACwB,EAAiBG,IACnCK,EACEV,EAAIW,WAAWC,KACb5C,EAAcU,kBACd,CAAEwB,UAASG,eACX,CAAExC,MAAOoC,KAEVjE,GAASA,EAAK8E,OAEnBnC,cAAe,CAACuB,EAAiBO,IAC/BC,EACEV,EAAIW,WAAWC,KACb5C,EAAcW,cACd,CAAEuB,UAASO,WACX,CAAE5C,MAAOoC,KAEVjE,GAASA,EAAK8E,OAEnBlC,sBAAuB,CACrBsB,EACA6B,EACAC,IAEAtB,EACEV,EAAIW,WAAWC,KACb5C,EAAcY,sBACd,CAAEsB,UAAS6B,eAAcC,kBACzB,CAAEnE,MAAOoC,KAEVjE,GAASA,EAAK8E,OAEnBmB,SAAU,CAAC/B,EAAiBI,IAC1BI,EACEV,EAAIW,WAAWC,KACb5C,EAAca,QACd,CAAEqB,UAASW,UAAWP,GACtB,CAAEzC,MAAOoC,KAEVjE,GAASA,EAAK8E,OAEnBoB,YAAa,CAAChC,EAAiBI,IAC7BI,EACEV,EAAIW,WAAWC,KACb5C,EAAcc,WACd,CAAEoB,UAASW,UAAWP,GACtB,CAAEzC,MAAOoC,KAEVjE,GAASA,EAAK8E,OAEnB/B,UAAW,CAACmB,EAAiBiC,IAC3BzB,EACEV,EAAIW,WAAWC,KAAK5C,EAAce,UAAW,CAAEmB,UAASiC,YAAY,CAAEtE,MAAOoC,KAC5EjE,GAASA,EAAK8E,OAEnB9B,aAAc,CAACkB,EAAiBiC,IAC9BzB,EACEV,EAAIW,WAAWC,KACb5C,EAAcgB,aACd,CAAEkB,UAASiC,YACX,CAAEtE,MAAOoC,KAEVjE,GAASA,EAAK8E,OAEnBsB,eAAgB,CACdlC,EACAiC,EACA7B,IAEAI,EACEV,EAAIW,WAAWC,KACb5C,EAAca,QACd,CAAEqB,UAASiC,WAAUtB,UAAWP,GAChC,CAAEzC,MAAOoC,KAEVjE,GAASA,EAAK8E,OAEnBuB,kBAAmB,CACjBnC,EACAiC,EACA7B,IAEAI,EACEV,EAAIW,WAAWC,KACb5C,EAAcc,WACd,CAAEoB,UAASiC,WAAUtB,UAAWP,GAChC,CAAEzC,MAAOoC,KAEVjE,GAASA,EAAK8E,OAanBwB,uBAAwB,CACtBC,EACArC,IAEAQ,EACEV,EAAIW,WAAWC,KACb5C,EAAciB,mBACd,CAAEsD,iBAAgBrC,WAClB,CAAErC,MAAOoC,KAEVjE,GAASA,IAcdwG,6BAA8B,CAC5BD,EACArC,EACAuC,IAEA/B,EACEV,EAAIW,WAAWC,KACb5C,EAAckB,yBACd,CAAEqD,iBAAgBrC,UAASwC,IAAKD,GAChC,CAAE5E,MAAOoC,KAEVjE,GAASA,IAad2G,iCAAkC,CAChCzC,EACAuC,IAEA/B,EACEV,EAAIW,WAAWC,KACb5C,EAAcmB,6BACd,CAAEe,UAASwC,IAAKD,GAChB,CAAE5E,MAAOoC,KAEVjE,GAASA,MC1YV4G,EAAa,CAAC5C,EAAcC,KAA4B,CAC5DhC,OAAQ,CACNjB,EACA6F,IAEAnC,EACEV,EAAIW,WAAWC,KACb5C,EAAgBC,OAChB,CAAEjB,OAAM6F,2BACR,CAAEhF,MAAOoC,KAGf6C,aAAc,CACZC,EACA/F,EACA6F,IAEAnC,EACEV,EAAIW,WAAWC,KACb5C,EAAgBC,OAChB,CAAE8E,KAAI/F,OAAM6F,2BACZ,CAAEhF,MAAOoC,KAGf/B,OAAQ,CACN6E,EACA/F,EACA6F,IAEAnC,EACEV,EAAIW,WAAWC,KACb5C,EAAgBE,OAChB,CAAE6E,KAAI/F,OAAM6F,2BACZ,CAAEhF,MAAOoC,KAGf9B,OAAS4E,GACPrC,EACEV,EAAIW,WAAWC,KAAK5C,EAAgBG,OAAQ,CAAE4E,MAAM,CAAElF,MAAOoC,KAEjEX,QAAS,IACPoB,EACEV,EAAIW,WAAW7D,IAAIkB,EAAgBsB,QAAS,CAC1CzB,MAAOoC,KAERjE,GAASA,EAAKgH,YCjDfC,EAAU,CAACjD,EAAcC,KAA4B,CACzD/B,OAAQ,CACNgF,EACAC,IAEAzC,EACEV,EAAIW,WAAWC,KAAK5C,EAAaE,OAAQ,CAAEgF,MAAKC,gBAAgB,CAAEtF,MAAOoC,OCFzEmD,EAAiB,CAACpD,EAAcC,KAA4B,CAChEhC,OAAQ,CAACjB,EAAcqG,IACrB3C,EACEV,EAAIW,WAAWC,KACb5C,EAAoBC,OACpB,CAAEjB,OAAMqG,eACR,CAAExF,MAAOoC,KAGf/B,OAAQ,CAAClB,EAAcsG,EAAiBD,IACtC3C,EACEV,EAAIW,WAAWC,KACb5C,EAAoBE,OACpB,CAAElB,OAAMsG,UAASD,eACjB,CAAExF,MAAOoC,KAGf9B,OAASnB,GACP0D,EACEV,EAAIW,WAAWC,KAAK5C,EAAoBG,OAAQ,CAAEnB,QAAQ,CAAEa,MAAOoC,KAEvEX,QAAS,IACPoB,EACEV,EAAIW,WAAW7D,IAAIkB,EAAoBsB,QAAS,CAC9CzB,MAAOoC,KAERjE,GAASA,EAAKuH,gBC1BfC,EAAW,CAACxD,EAAcC,KAA4B,CAC1DhC,OAAQ,CACNjB,EACAqG,EACAI,IAEA/C,EACEV,EAAIW,WAAWC,KACb5C,EAAcC,OACd,CAAEjB,OAAMqG,cAAaI,mBACrB,CAAE5F,MAAOoC,KAGf/B,OAAQ,CACNlB,EACAsG,EACAD,EACAI,IAEA/C,EACEV,EAAIW,WAAWC,KACb5C,EAAcE,OACd,CAAElB,OAAMsG,UAASD,cAAaI,mBAC9B,CAAE5F,MAAOoC,KAGf9B,OAASnB,GACP0D,EACEV,EAAIW,WAAWC,KAAK5C,EAAcG,OAAQ,CAAEnB,QAAQ,CAAEa,MAAOoC,KAEjEX,QAAS,IACPoB,EACEV,EAAIW,WAAW7D,IAAIkB,EAAcsB,QAAS,CACxCzB,MAAOoC,KAERjE,GAASA,EAAKsE,UCvCfoD,EAAY,CAAC1D,EAAcC,KAA4B,CAM3DL,cAAgBuC,GACdzB,EACEV,EAAIW,WAAWC,KAAK5C,EAAe4B,cAAe,CAAEuC,YAAY,CAAEtE,MAAOoC,KAU7EJ,uBAAwB,CACtBsC,EACAwB,EACAC,IAEAlD,EACEV,EAAIW,WAAWC,KACb5C,EAAe6B,uBACf,CAAEsC,WAAUyB,WAAUD,WACtB,CAAE9F,MAAOoC,KAUfH,oBAAqB,CAACqC,EAAkB0B,IACtCnD,EACEV,EAAIW,WAAWC,KACb5C,EAAe8B,oBACf,CAAEqC,WAAU0B,WACZ,CAAEhG,MAAOoC,OC1CX6D,EAAkB,CAAC9D,EAAcC,KAA4B,CACjE8D,YAAc5B,GACZzB,EACEV,EAAIW,WAAW7D,IAAIkB,EAAauB,SAAU,CACxC2B,YAAa,CAAEiB,YACftE,MAAOoC,KAERjE,GAASA,IAEdgI,kBAAmB,CACjB7B,EACA8B,EACAC,EACAC,EACAC,EACAC,IAEA3D,EACEV,EAAIW,WAAWC,KACb5C,EAAauB,SACb,CAAE4C,WAAU8B,SAAQE,WAAUD,UAASE,cAAaC,UACpD,CAAExG,MAAOoC,KAGfqE,kBAAmB,CAACnC,EAAkBoC,IACpC7D,EACEV,EAAIW,WAAWC,KACb5C,EAAawB,SACb,CAAE2C,WAAUoC,kBACZ,CAAE1G,MAAOoC,KAGfuE,iBAAkB,CAChBrC,EACAsC,EACAC,IAEAhE,EACEV,EAAIW,WAAWC,KACb5C,EAAayB,QACb,CAAE0C,WAAUsC,cAAaC,oBACzB,CAAE7G,MAAOoC,OCjCX0E,EAAgB,CAAC3E,EAAcC,KAA4B,CAS/DhC,OAAQ,CACNjB,EACA4H,EACAtE,EACAuE,IAEAnE,EACEV,EAAIW,WAAWC,KACb5C,EAAmBC,OACnB,CAAEjB,OAAM4H,aAAY/D,UAAWP,EAAOuE,cACtC,CAAEhH,MAAOoC,KAQf5B,KAAO0E,GACLrC,EACEV,EAAIW,WAAW7D,IAAIkB,EAAmBK,KAAM,CAC1C6C,YAAa,CAAE6B,MACflF,MAAOoC,KAERjE,GAASA,EAAK8I,MAOnBzD,UAAYC,GACVZ,EACEV,EAAIW,WAAWC,KAAK5C,EAAmBM,OAAQ,CAAEgD,aAAa,CAAEzD,MAAOoC,KACtEjE,GAASA,EAAK+I,OAQnB7G,OAAQ,CAAC6E,EAAY/F,IACnB0D,EACEV,EAAIW,WAAWC,KAAK5C,EAAmBE,OAAQ,CAAE6E,KAAI/F,QAAQ,CAAEa,MAAOoC,KACrEjE,GAASA,EAAK8I,MAOnB1F,WAAa2D,GACXrC,EACEV,EAAIW,WAAWC,KAAK5C,EAAmBoB,WAAY,CAAE2D,MAAM,CAAElF,MAAOoC,KAMxEZ,SAAW0D,GACTrC,EACEV,EAAIW,WAAWC,KAAK5C,EAAmBqB,SAAU,CAAE0D,MAAM,CAAElF,MAAOoC,KAMtE9B,OAAS4E,GACPrC,EACEV,EAAIW,WAAWC,KAAK5C,EAAmBG,OAAQ,CAAE4E,MAAM,CAAElF,MAAOoC,OCvFhE+E,EAAW,CAAChF,EAAcC,KAA4B,CAC1DP,OAASuF,GACPvE,EACEV,EAAIW,WAAWC,KAAK5C,EAAc0B,OAAQ,CAAEuF,UAAU,CAAEpH,MAAOoC,KAEnEN,OAAQ,CAACsF,EAAgBC,EAAYC,IACnCzE,EACEV,EAAIW,WAAWC,KACb5C,EAAc2B,OACd,CAAEsF,SAAQC,OAAMC,WAChB,CAAEtH,MAAOoC,OCVXmF,EAAY,CAACpF,EAAcC,KAA4B,CAC3DP,OAAQ,IACNgB,EAAkBV,EAAIW,WAAWC,KAAK5C,EAAe0B,OAAQ,CAAE,EAAE,CAAE7B,MAAOoC,KAC5EN,OAAS0F,GACP3E,EACEV,EAAIW,WAAWC,KAAK5C,EAAe2B,OAAQ,CAAE0F,SAAS,CAAExH,MAAOoC,aCRnD,QAAlBtD,EAAA2I,WAAWC,eAAO,IAAA5I,IAAlB2I,WAAWC,QAAYA,GAEvB,MAGMC,EAAe,IAAI1J,KAGvBA,EAAK2J,SAASC,YAEZA,YAAS/I,GAAAS,EAAAsI,GAAYC,+BAAAA,cARD,UAQmC,IAGlDC,KAAa9J,ICKhB+J,EAAWlJ,WAAAsD,cAAEA,GAAuCtD,EAArBmJ,EAAM1J,EAAAO,EAA1B,mBACf,MAAMoJ,EAAUC,EACX1I,OAAAC,OAAAD,OAAAC,OAAA,CAAA,EAAAuI,UACHG,EACAC,YAAW5I,OAAAC,OAAAD,OAAAC,OAAA,CAAA,EACNuI,EAAOI,cACV,qBAAsB,SACtB,8BAAiD,UAAZ,OAAPC,cAAO,IAAPA,aAAO,EAAPA,QAASC,gBAAU,IAAAhJ,OAAA,EAAAA,EAAAiJ,OAAQ,GACzD,wBAAyB,cAIvBC,UAAEA,EAASC,OAAEA,GAAWT,EAExBf,EAA6C,CAAA,EAmB7CyB,ECxCe,EAACxG,EAAcC,KAA4B,CAChEa,KAAMf,EAASC,EAAKC,GACpBwG,UAAW9B,EAAc3E,EAAKC,GAC9BtC,OAAQiF,EAAW5C,EAAKC,GACxByG,IAAK5C,EAAgB9D,EAAKC,GAC1BiD,IAAKD,EAAQjD,EAAKC,GAClB0G,WAAYvD,EAAepD,EAAKC,GAChC2G,KAAMpD,EAASxD,EAAKC,GACpB4G,MAAOnD,EAAU1D,EAAKC,GACtBiF,KAAMF,EAAShF,EAAKC,GACpBoF,MAAOD,EAAUpF,EAAKC,KD8BH6G,CAAef,EAAS9F,GAErCD,iCACD+F,GAAO,CAOVS,aAGA3K,aAAakL,GACX,KAAKA,aAAA,EAAAA,EAAQC,KAAK,MAAMC,MAAM,gCAE9B,GAAIlC,EAAKgC,EAAOC,KAAM,OAAOjC,EAAKgC,EAAOC,KAKzC,GAFA1J,OAAOC,OAAOwH,OAnCAlJ,WAChB,MAGMqL,SAHoBnB,EAAQpF,WAC/B7D,IAAI,WAAWwJ,KACfa,MAAMpL,GAASA,EAAKqL,UACerC,KACtC,OAAKjH,MAAMC,QAAQmJ,UACQG,QAAQC,IACjCJ,EAAWK,KAAI1L,MAAOiJ,GAAQ,CAACA,EAAIkC,UAAWQ,EAAU1C,QAGtC2C,QAClB,CAACC,GAAMV,EAAKW,KAAUX,EAAW1J,OAAAC,OAAAD,OAAAC,OAAA,CAAA,EAAAmK,IAAK,CAACV,EAAIY,YAAaD,IAAQD,GAChE,CAAE,GAPmC,EAQtC,EAsB2BG,KAErB9C,EAAKgC,EAAOC,KAAM,MAAMC,MAAM,gCAEnC,OAAOlC,EAAKgC,EAAOC,IACpB,EAODnL,kBAAkBqH,SAEhB,MACMrF,SADYiK,EAAU5E,EAAKlD,EAAI+H,OAAQ,CAAEC,eAAgB,KAC7CC,QAElB,GAAIpK,IACFA,EAAMqK,IAAe,QAATvL,EAAAkB,EAAMqK,WAAG,IAAAvL,OAAA,EAAAA,EAAEwL,MAAM,KAAKC,MAC9BvK,EAAMqK,MAAQ5B,GAEhB,MAAM,IAAI+B,EAAOC,yBACf,+BACA,MACA,gBAKN,MAAO,CAAEpF,MAAKrF,QACf,EAODhC,sBAAsB0M,GACpB,IAAKA,EAAc,MAAMtB,MAAM,4CAE/B,IAEE,aADoBjH,EAAIwI,YAAYD,EAMrC,CAJC,MAAOE,GAGP,MADAlC,SAAAA,EAAQkC,MAAM,4BAA6BA,GACrCxB,MAAM,4BACb,CACF,EAODpL,qBAAqB6M,WACnB,IAAKA,EAAc,MAAMzB,MAAM,kDAE/B,UACQjH,EAAIwI,YAAYE,GACtB,MAAMC,QAAgB3I,EAAI4I,QAAQF,GAClC,GAAIC,EAAQE,GAAI,CAEd,aADoB7I,EAAIwI,YAA0B,QAAd7L,EAAAgM,EAAQ3M,YAAM,IAAAW,OAAA,EAAAA,EAAAmM,WAEnD,CAED,MAAM7B,MAAmB,QAAb7J,EAAAuL,EAAQF,aAAK,IAAArL,OAAA,EAAAA,EAAE2L,aAK5B,CAJC,MAAOC,GAGP,MADAzC,SAAAA,EAAQkC,MAAM,kCAAmCO,GAC3C/B,MAAM,kCACb,CACF,EAQDpL,gCACE0M,EACAG,GAEA,IAAKH,IAAiBG,EAAc,MAAMzB,MAAM,6CAEhD,IAEE,aADoBjH,EAAIiJ,gBAAgBV,EAKzC,CAHC,MAAOE,GAEPlC,SAAAA,EAAQ2C,IAAI,mDACb,CAED,OAAOlJ,EAAImJ,eAAeT,EAC3B,EAOD7M,wBAAwB4K,GACtB,IAAKA,EAAW,MAAMQ,MAAM,gCAE5B,IAAIlL,EACJ,IACEA,QAAaiE,EAAIyG,UAAU2C,SAAS3C,EAIrC,CAHC,MAAOgC,GAEP,MADAlC,SAAAA,EAAQkC,MAAM,gCAAiCA,GACzCxB,MAAM,gCACb,CAED,MAAM6B,WAAEA,GAAe/M,EAAKC,KAC5B,IAAK8M,EAEH,MADAvC,SAAAA,EAAQkC,MAAM,gDACRxB,MAAM,iCAGd,IAEE,aADoBjH,EAAIwI,YAAYM,EAKrC,CAHC,MAAOL,GAEP,MADAlC,SAAAA,EAAQkC,MAAM,sCAAuCA,GAC/CxB,MAAM,gCACb,CACF,EAQDoC,oBAAmB,CAAC5L,EAA8B8F,IACzCvD,EAAIsJ,0BAA0B7L,EAAU,KAAM8F,GASvD+F,0BACE7L,EACAE,EACA4F,GAEA,MAAMgG,EAAU/L,EAA2BC,EdrNb,ccqN6CE,GAC3E,OAAO4F,EAAYiG,OAAOC,GAASF,EAAQG,SAASD,IACrD,EAQDE,cAAa,CAAClM,EAA8B6C,IACnCN,EAAI4J,oBAAoBnM,EAAU,KAAM6C,GASjDsJ,oBAAoBnM,EAA8BE,EAAgB2C,GAChE,MAAMuJ,EAAarM,EAA2BC,EdxOtB,QcwOgDE,GACxE,OAAO2C,EAAMkJ,OAAO5C,GAASiD,EAAWH,SAAS9C,IAClD,IAGH,OAAOkD,EACL9J,EACA,CACE,mBACA,iBACA,sBACA,mBACA,uBACA,uBACA,iBACA,gBACA,cACA,yBACA,yBACA,WAEFrE,EACD,EAoBHkK,EAAQkE,uBd1R8B,Mc2RtClE,EAAQmE,uBdzR8B"}
+{"version":3,"file":"index.esm.js","sources":["../lib/constants.ts","../lib/helpers.ts","../lib/management/paths.ts","../lib/management/user.ts","../lib/management/tenant.ts","../lib/management/jwt.ts","../lib/management/permission.ts","../lib/management/role.ts","../lib/management/group.ts","../lib/management/sso.ts","../lib/management/accesskey.ts","../lib/management/flow.ts","../lib/management/theme.ts","../lib/fetch-polyfill.ts","../lib/index.ts","../lib/management/index.ts"],"sourcesContent":["// eslint-disable-next-line import/prefer-default-export\n/** Refresh JWT cookie name */\nexport const refreshTokenCookieName = 'DSR';\n/** Session JWT cookie name */\nexport const sessionTokenCookieName = 'DS';\n/** The key of the tenants claims in the claims map */\nexport const authorizedTenantsClaimName = 'tenants';\n/** The key of the permissions claims in the claims map either under tenant or top level */\nexport const permissionsClaimName = 'permissions';\n/** The key of the roles claims in the claims map either under tenant or top level */\nexport const rolesClaimName = 'roles';\n","import type { SdkFnWrapper } from '@descope/core-js-sdk';\nimport { authorizedTenantsClaimName, refreshTokenCookieName } from './constants';\nimport { AuthenticationInfo } from './types';\n\n/**\n * Generate a cookie string from given parameters\n * @param name name of the cookie\n * @param value value of cookie that must be already encoded\n * @param options any options to put on the cookie like cookieDomain, cookieMaxAge, cookiePath\n * @returns Cookie string with all options on the string\n */\nconst generateCookie = (name: string, value: string, options?: Record<string, string | number>) =>\n  `${name}=${value}; Domain=${options?.cookieDomain || ''}; Max-Age=${\n    options?.cookieMaxAge || ''\n  }; Path=${options?.cookiePath || '/'}; HttpOnly; SameSite=Strict`;\n\n/**\n * Parse the cookie string and return the value of the cookie\n * @param cookie the raw cookie string\n * @param name the name of the cookie to get value for\n * @returns the value of the given cookie\n */\nconst getCookieValue = (cookie: string | null | undefined, name: string) => {\n  const match = cookie?.match(RegExp(`(?:^|;\\\\s*)${name}=([^;]*)`));\n  return match ? match[1] : null;\n};\n\n// eslint-disable-next-line import/prefer-default-export\n/**\n * Add cookie generation to core-js functions.\n * @param fn the function we are wrapping\n * @returns Wrapped function with cookie generation\n */\nexport const withCookie: SdkFnWrapper<{ refreshJwt?: string; cookies?: string[] }> =\n  (fn) =>\n  async (...args) => {\n    const resp = await fn(...args);\n\n    // istanbul ignore next\n    if (!resp.data) {\n      return resp;\n    }\n\n    // eslint-disable-next-line prefer-const\n    let { refreshJwt, ...rest } = resp.data;\n    const cookies: string[] = [];\n\n    if (!refreshJwt) {\n      if (resp.response?.headers.get('set-cookie')) {\n        refreshJwt = getCookieValue(\n          resp.response?.headers.get('set-cookie'),\n          refreshTokenCookieName,\n        );\n        cookies.push(resp.response?.headers.get('set-cookie')!);\n      }\n    } else {\n      cookies.push(generateCookie(refreshTokenCookieName, refreshJwt, rest));\n    }\n\n    return { ...resp, data: { ...resp.data, refreshJwt, cookies } };\n  };\n\n/**\n * Get the claim (used for permissions or roles) for a given tenant or top level if tenant is empty\n * @param authInfo The parsed authentication info from the JWT\n * @param claim name of the claim\n * @param tenant tenant to retrieve the claim for\n * @returns\n */\nexport function getAuthorizationClaimItems(\n  authInfo: AuthenticationInfo,\n  claim: string,\n  tenant?: string,\n): string[] {\n  const value = tenant\n    ? authInfo.token[authorizedTenantsClaimName]?.[tenant]?.[claim]\n    : authInfo.token[claim];\n  return Array.isArray(value) ? value : [];\n}\n","/** API paths for the Descope service Management APIs */\nexport default {\n  user: {\n    create: '/v1/mgmt/user/create',\n    update: '/v1/mgmt/user/update',\n    delete: '/v1/mgmt/user/delete',\n    deleteAllTestUsers: '/v1/mgmt/user/test/delete/all',\n    load: '/v1/mgmt/user',\n    search: '/v1/mgmt/user/search',\n    getProviderToken: '/v1/mgmt/user/provider/token',\n    updateStatus: '/v1/mgmt/user/update/status',\n    updateEmail: '/v1/mgmt/user/update/email',\n    updatePhone: '/v1/mgmt/user/update/phone',\n    updateDisplayName: '/v1/mgmt/user/update/name',\n    updatePicture: '/v1/mgmt/user/update/picture',\n    updateCustomAttribute: '/v1/mgmt/user/update/customAttribute',\n    addRole: '/v1/mgmt/user/update/role/add',\n    removeRole: '/v1/mgmt/user/update/role/remove',\n    addTenant: '/v1/mgmt/user/update/tenant/add',\n    removeTenant: '/v1/mgmt/user/update/tenant/remove',\n    setPassword: '/v1/mgmt/user/password/set',\n    expirePassword: '/v1/mgmt/user/password/expire',\n    generateOTPForTest: '/v1/mgmt/tests/generate/otp',\n    generateMagicLinkForTest: '/v1/mgmt/tests/generate/magiclink',\n    generateEnchantedLinkForTest: '/v1/mgmt/tests/generate/enchantedlink',\n  },\n  accessKey: {\n    create: '/v1/mgmt/accesskey/create',\n    load: '/v1/mgmt/accesskey',\n    search: '/v1/mgmt/accesskey/search',\n    update: '/v1/mgmt/accesskey/update',\n    deactivate: '/v1/mgmt/accesskey/deactivate',\n    activate: '/v1/mgmt/accesskey/activate',\n    delete: '/v1/mgmt/accesskey/delete',\n  },\n  tenant: {\n    create: '/v1/mgmt/tenant/create',\n    update: '/v1/mgmt/tenant/update',\n    delete: '/v1/mgmt/tenant/delete',\n    loadAll: '/v1/mgmt/tenant/all',\n  },\n  sso: {\n    settings: '/v1/mgmt/sso/settings',\n    metadata: '/v1/mgmt/sso/metadata',\n    mapping: '/v1/mgmt/sso/mapping',\n  },\n  jwt: {\n    update: '/v1/mgmt/jwt/update',\n  },\n  permission: {\n    create: '/v1/mgmt/permission/create',\n    update: '/v1/mgmt/permission/update',\n    delete: '/v1/mgmt/permission/delete',\n    loadAll: '/v1/mgmt/permission/all',\n  },\n  role: {\n    create: '/v1/mgmt/role/create',\n    update: '/v1/mgmt/role/update',\n    delete: '/v1/mgmt/role/delete',\n    loadAll: '/v1/mgmt/role/all',\n  },\n  flow: {\n    export: '/v1/mgmt/flow/export',\n    import: '/v1/mgmt/flow/import',\n  },\n  theme: {\n    export: '/v1/mgmt/theme/export',\n    import: '/v1/mgmt/theme/import',\n  },\n  group: {\n    loadAllGroups: '/v1/mgmt/group/all',\n    loadAllGroupsForMember: '/v1/mgmt/group/member/all',\n    loadAllGroupMembers: '/v1/mgmt/group/members',\n  },\n};\n","import { DeliveryMethod, SdkResponse, transformResponse, UserResponse } from '@descope/core-js-sdk';\nimport {\n  ProviderTokenResponse,\n  AssociatedTenant,\n  GenerateEnchantedLinkForTestResponse,\n  GenerateMagicLinkForTestResponse,\n  GenerateOTPForTestResponse,\n  AttributesTypes,\n} from './types';\nimport { CoreSdk } from '../types';\nimport apiPaths from './paths';\n\ntype SingleUserResponse = {\n  user: UserResponse;\n};\n\ntype MultipleUsersResponse = {\n  users: UserResponse[];\n};\n\nconst withUser = (sdk: CoreSdk, managementKey?: string) => ({\n  create: (\n    loginId: string,\n    email?: string,\n    phone?: string,\n    displayName?: string,\n    roles?: string[],\n    userTenants?: AssociatedTenant[],\n    customAttributes?: Record<string, AttributesTypes>,\n    picture?: string,\n  ): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.create,\n        {\n          loginId,\n          email,\n          phone,\n          displayName,\n          roleNames: roles,\n          userTenants,\n          customAttributes,\n          picture,\n        },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  /**\n   * Create a new test user.\n   * The loginID is required and will determine what the user will use to sign in.\n   * Make sure the login id is unique for test. All other fields are optional.\n   *\n   * You can later generate OTP, Magic link and enchanted link to use in the test without the need\n   * of 3rd party messaging services.\n   * Those users are not counted as part of the monthly active users\n   * @returns The UserResponse if found, throws otherwise.\n   */\n  createTestUser: (\n    loginId: string,\n    email?: string,\n    phone?: string,\n    displayName?: string,\n    roles?: string[],\n    userTenants?: AssociatedTenant[],\n    customAttributes?: Record<string, AttributesTypes>,\n    picture?: string,\n  ): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.create,\n        {\n          loginId,\n          email,\n          phone,\n          displayName,\n          roleNames: roles,\n          userTenants,\n          test: true,\n          customAttributes,\n          picture,\n        },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  invite: (\n    loginId: string,\n    email?: string,\n    phone?: string,\n    displayName?: string,\n    roles?: string[],\n    userTenants?: AssociatedTenant[],\n    customAttributes?: Record<string, AttributesTypes>,\n    picture?: string,\n  ): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.create,\n        {\n          loginId,\n          email,\n          phone,\n          displayName,\n          roleNames: roles,\n          userTenants,\n          invite: true,\n          customAttributes,\n          picture,\n        },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  update: (\n    loginId: string,\n    email?: string,\n    phone?: string,\n    displayName?: string,\n    roles?: string[],\n    userTenants?: AssociatedTenant[],\n    customAttributes?: Record<string, AttributesTypes>,\n    picture?: string,\n  ): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.update,\n        {\n          loginId,\n          email,\n          phone,\n          displayName,\n          roleNames: roles,\n          userTenants,\n          customAttributes,\n          picture,\n        },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  delete: (loginId: string): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(apiPaths.user.delete, { loginId }, { token: managementKey }),\n    ),\n  /**\n   * Delete all test users in the project.\n   */\n  deleteAllTestUsers: (): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.delete(apiPaths.user.deleteAllTestUsers, { token: managementKey }),\n    ),\n  load: (loginId: string): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.get(apiPaths.user.load, {\n        queryParams: { loginId },\n        token: managementKey,\n      }),\n      (data) => data.user,\n    ),\n  /**\n   * Load an existing user by user ID. The ID can be found\n   * on the user's JWT.\n   * @param userId load a user by this user ID field\n   * @returns The UserResponse if found, throws otherwise.\n   */\n  loadByUserId: (userId: string): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.get(apiPaths.user.load, {\n        queryParams: { userId },\n        token: managementKey,\n      }),\n      (data) => data.user,\n    ),\n  /**\n   * Search all users. Results can be filtered according to tenants and/or\n   * roles, and also paginated used the limit and page parameters.\n   * @param tenantIds optional list of tenant IDs to filter by\n   * @param roles optional list of roles to filter by\n   * @param limit optionally limit the response, leave out for default limit\n   * @param page optionally paginate over the response\n   * @param testUsersOnly optionally filter only test users\n   * @param withTestUser optionally include test users in search\n   * @returns An array of UserResponse found by the query\n   */\n  searchAll: (\n    tenantIds?: string[],\n    roles?: string[],\n    limit?: number,\n    page?: number,\n    testUsersOnly?: boolean,\n    withTestUser?: boolean,\n    customAttributes?: Record<string, AttributesTypes>,\n  ): Promise<SdkResponse<UserResponse[]>> =>\n    transformResponse<MultipleUsersResponse, UserResponse[]>(\n      sdk.httpClient.post(\n        apiPaths.user.search,\n        { tenantIds, roleNames: roles, limit, page, testUsersOnly, withTestUser, customAttributes },\n        { token: managementKey },\n      ),\n      (data) => data.users,\n    ),\n  /**\n   * Get the provider token for the given login ID.\n   * Only users that logged-in using social providers will have token.\n   * Note: The 'Manage tokens from provider' setting must be enabled.\n   * @param loginId the login ID of the user\n   * @param provider the provider name (google, facebook, etc.).\n   * @returns The ProviderTokenResponse of the given user and provider\n   */\n  getProviderToken: (\n    loginId: string,\n    provider: string,\n  ): Promise<SdkResponse<ProviderTokenResponse>> =>\n    transformResponse<ProviderTokenResponse>(\n      sdk.httpClient.get(apiPaths.user.getProviderToken, {\n        queryParams: { loginId, provider },\n        token: managementKey,\n      }),\n      (data) => data,\n    ),\n  activate: (loginId: string): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.updateStatus,\n        { loginId, status: 'enabled' },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  deactivate: (loginId: string): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.updateStatus,\n        { loginId, status: 'disabled' },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  updateEmail: (\n    loginId: string,\n    email: string,\n    isVerified: boolean,\n  ): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.updateEmail,\n        { loginId, email, verified: isVerified },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  updatePhone: (\n    loginId: string,\n    phone: string,\n    isVerified: boolean,\n  ): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.updatePhone,\n        { loginId, phone, verified: isVerified },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  updateDisplayName: (loginId: string, displayName: string): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.updateDisplayName,\n        { loginId, displayName },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  updatePicture: (loginId: string, picture: string): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.updatePicture,\n        { loginId, picture },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  updateCustomAttribute: (\n    loginId: string,\n    attributeKey: string,\n    attributeValue: AttributesTypes,\n  ): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.updateCustomAttribute,\n        { loginId, attributeKey, attributeValue },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  addRoles: (loginId: string, roles: string[]): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.addRole,\n        { loginId, roleNames: roles },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  removeRoles: (loginId: string, roles: string[]): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.removeRole,\n        { loginId, roleNames: roles },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  addTenant: (loginId: string, tenantId: string): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(apiPaths.user.addTenant, { loginId, tenantId }, { token: managementKey }),\n      (data) => data.user,\n    ),\n  removeTenant: (loginId: string, tenantId: string): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.removeTenant,\n        { loginId, tenantId },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  addTenantRoles: (\n    loginId: string,\n    tenantId: string,\n    roles: string[],\n  ): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.addRole,\n        { loginId, tenantId, roleNames: roles },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n  removeTenantRoles: (\n    loginId: string,\n    tenantId: string,\n    roles: string[],\n  ): Promise<SdkResponse<UserResponse>> =>\n    transformResponse<SingleUserResponse, UserResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.removeRole,\n        { loginId, tenantId, roleNames: roles },\n        { token: managementKey },\n      ),\n      (data) => data.user,\n    ),\n\n  /**\n   * Generate OTP for the given login ID of a test user.\n   * Choose the selected delivery method for verification.\n   * Returns the code for the login (exactly as it sent via Email or SMS)\n   * This is useful when running tests and don't want to use 3rd party messaging services\n   *\n   * @param deliveryMethod optional DeliveryMethod\n   * @param loginId login ID of a test user\n   * @returns GenerateOTPForTestResponse which includes the loginId and the OTP code\n   */\n  generateOTPForTestUser: (\n    deliveryMethod: DeliveryMethod,\n    loginId: string,\n  ): Promise<SdkResponse<GenerateOTPForTestResponse>> =>\n    transformResponse<GenerateOTPForTestResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.generateOTPForTest,\n        { deliveryMethod, loginId },\n        { token: managementKey },\n      ),\n      (data) => data,\n    ),\n\n  /**\n   * Generate Magic Link for the given login ID of a test user.\n   * Choose the selected delivery method for verification.\n   * It returns the link for the login (exactly as it sent via Email)\n   * This is useful when running tests and don't want to use 3rd party messaging services\n   *\n   * @param deliveryMethod optional DeliveryMethod\n   * @param loginId login ID of a test user\n   * @param uri optional redirect uri which will be used instead of any global configuration.\n   * @returns GenerateMagicLinkForTestResponse which includes the loginId and the magic link\n   */\n  generateMagicLinkForTestUser: (\n    deliveryMethod: DeliveryMethod,\n    loginId: string,\n    uri: string,\n  ): Promise<SdkResponse<GenerateMagicLinkForTestResponse>> =>\n    transformResponse<GenerateMagicLinkForTestResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.generateMagicLinkForTest,\n        { deliveryMethod, loginId, URI: uri },\n        { token: managementKey },\n      ),\n      (data) => data,\n    ),\n\n  /**\n   * Generate Enchanted Link for the given login ID of a test user.\n   * It returns the link for the login (exactly as it sent via Email)\n   * and pendingRef which is used to poll for a valid session\n   * This is useful when running tests and don't want to use 3rd party messaging services\n   *\n   * @param loginId login ID of a test user\n   * @param uri optional redirect uri which will be used instead of any global configuration.\n   * @returns GenerateEnchantedLinkForTestResponse which includes the loginId, the enchanted link and the pendingRef\n   */\n  generateEnchantedLinkForTestUser: (\n    loginId: string,\n    uri: string,\n  ): Promise<SdkResponse<GenerateEnchantedLinkForTestResponse>> =>\n    transformResponse<GenerateEnchantedLinkForTestResponse>(\n      sdk.httpClient.post(\n        apiPaths.user.generateEnchantedLinkForTest,\n        { loginId, URI: uri },\n        { token: managementKey },\n      ),\n      (data) => data,\n    ),\n\n  /**\n   * Set password for the given login ID of user.\n   * Note: The password will automatically be set as expired.\n   * The user will not be able to log-in with this password, and will be required to replace it on next login.\n   * See also: expirePassword\n   * @param loginId login ID of a test user\n   * @param password The password to set for the user\n   */\n  setPassword: (loginId: string, password: string): Promise<SdkResponse<never>> =>\n    transformResponse<never>(\n      sdk.httpClient.post(\n        apiPaths.user.setPassword,\n        { loginId, password },\n        { token: managementKey },\n      ),\n      (data) => data,\n    ),\n\n  /**\n   * Expire password for the given login ID.\n   * Note: user sign-in with an expired password, the user will get an error with code.\n   * Use the `ResetPassword` or `ReplacePassword` methods to reset/replace the password.\n   * @param loginId login ID of a test user\n   */\n  expirePassword: (loginId: string): Promise<SdkResponse<never>> =>\n    transformResponse<never>(\n      sdk.httpClient.post(apiPaths.user.expirePassword, { loginId }, { token: managementKey }),\n      (data) => data,\n    ),\n});\n\nexport default withUser;\n","import { SdkResponse, transformResponse } from '@descope/core-js-sdk';\nimport { CoreSdk } from '../types';\nimport apiPaths from './paths';\nimport { CreateTenantResponse, Tenant } from './types';\n\ntype MultipleTenantResponse = {\n  tenants: Tenant[];\n};\n\nconst withTenant = (sdk: CoreSdk, managementKey?: string) => ({\n  create: (\n    name: string,\n    selfProvisioningDomains?: string[],\n  ): Promise<SdkResponse<CreateTenantResponse>> =>\n    transformResponse(\n      sdk.httpClient.post(\n        apiPaths.tenant.create,\n        { name, selfProvisioningDomains },\n        { token: managementKey },\n      ),\n    ),\n  createWithId: (\n    id: string,\n    name: string,\n    selfProvisioningDomains?: string[],\n  ): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(\n        apiPaths.tenant.create,\n        { id, name, selfProvisioningDomains },\n        { token: managementKey },\n      ),\n    ),\n  update: (\n    id: string,\n    name: string,\n    selfProvisioningDomains?: string[],\n  ): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(\n        apiPaths.tenant.update,\n        { id, name, selfProvisioningDomains },\n        { token: managementKey },\n      ),\n    ),\n  delete: (id: string): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(apiPaths.tenant.delete, { id }, { token: managementKey }),\n    ),\n  loadAll: (): Promise<SdkResponse<Tenant[]>> =>\n    transformResponse<MultipleTenantResponse, Tenant[]>(\n      sdk.httpClient.get(apiPaths.tenant.loadAll, {\n        token: managementKey,\n      }),\n      (data) => data.tenants,\n    ),\n});\n\nexport default withTenant;\n","import { SdkResponse, transformResponse } from '@descope/core-js-sdk';\nimport { CoreSdk } from '../types';\nimport apiPaths from './paths';\nimport { UpdateJWTResponse } from './types';\n\nconst withJWT = (sdk: CoreSdk, managementKey?: string) => ({\n  update: (\n    jwt: string,\n    customClaims?: Record<string, any>,\n  ): Promise<SdkResponse<UpdateJWTResponse>> =>\n    transformResponse(\n      sdk.httpClient.post(apiPaths.jwt.update, { jwt, customClaims }, { token: managementKey }),\n    ),\n});\n\nexport default withJWT;\n","import { SdkResponse, transformResponse } from '@descope/core-js-sdk';\nimport { CoreSdk } from '../types';\nimport apiPaths from './paths';\nimport { Permission } from './types';\n\ntype MultiplePermissionResponse = {\n  permissions: Permission[];\n};\n\nconst withPermission = (sdk: CoreSdk, managementKey?: string) => ({\n  create: (name: string, description?: string): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(\n        apiPaths.permission.create,\n        { name, description },\n        { token: managementKey },\n      ),\n    ),\n  update: (name: string, newName: string, description?: string): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(\n        apiPaths.permission.update,\n        { name, newName, description },\n        { token: managementKey },\n      ),\n    ),\n  delete: (name: string): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(apiPaths.permission.delete, { name }, { token: managementKey }),\n    ),\n  loadAll: (): Promise<SdkResponse<Permission[]>> =>\n    transformResponse<MultiplePermissionResponse, Permission[]>(\n      sdk.httpClient.get(apiPaths.permission.loadAll, {\n        token: managementKey,\n      }),\n      (data) => data.permissions,\n    ),\n});\n\nexport default withPermission;\n","import { SdkResponse, transformResponse } from '@descope/core-js-sdk';\nimport { CoreSdk } from '../types';\nimport apiPaths from './paths';\nimport { Role } from './types';\n\ntype MultipleRoleResponse = {\n  roles: Role[];\n};\n\nconst withRole = (sdk: CoreSdk, managementKey?: string) => ({\n  create: (\n    name: string,\n    description?: string,\n    permissionNames?: string[],\n  ): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(\n        apiPaths.role.create,\n        { name, description, permissionNames },\n        { token: managementKey },\n      ),\n    ),\n  update: (\n    name: string,\n    newName: string,\n    description?: string,\n    permissionNames?: string[],\n  ): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(\n        apiPaths.role.update,\n        { name, newName, description, permissionNames },\n        { token: managementKey },\n      ),\n    ),\n  delete: (name: string): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(apiPaths.role.delete, { name }, { token: managementKey }),\n    ),\n  loadAll: (): Promise<SdkResponse<Role[]>> =>\n    transformResponse<MultipleRoleResponse, Role[]>(\n      sdk.httpClient.get(apiPaths.role.loadAll, {\n        token: managementKey,\n      }),\n      (data) => data.roles,\n    ),\n});\n\nexport default withRole;\n","import { SdkResponse, transformResponse } from '@descope/core-js-sdk';\nimport { CoreSdk } from '../types';\nimport apiPaths from './paths';\nimport { Group } from './types';\n\nconst withGroup = (sdk: CoreSdk, managementKey?: string) => ({\n  /**\n   * Load all groups for a specific tenant id.\n   * @param tenantId Tenant ID to load groups from.\n   * @returns Group[] list of groups\n   */\n  loadAllGroups: (tenantId: string): Promise<SdkResponse<Group[]>> =>\n    transformResponse<Group[]>(\n      sdk.httpClient.post(apiPaths.group.loadAllGroups, { tenantId }, { token: managementKey }),\n    ),\n\n  /**\n   * Load all groups for the provided user IDs or login IDs.\n   * @param tenantId Tenant ID to load groups from.\n   * @param userIds Optional List of user IDs, with the format of \"U2J5ES9S8TkvCgOvcrkpzUgVTEBM\" (example), which can be found on the user's JWT.\n   * @param loginIds Optional List of login IDs, how the user identifies when logging in.\n   * @returns Group[] list of groups\n   */\n  loadAllGroupsForMember: (\n    tenantId: string,\n    userIds: string[],\n    loginIds: string[],\n  ): Promise<SdkResponse<Group[]>> =>\n    transformResponse<Group[]>(\n      sdk.httpClient.post(\n        apiPaths.group.loadAllGroupsForMember,\n        { tenantId, loginIds, userIds },\n        { token: managementKey },\n      ),\n    ),\n\n  /**\n   * Load all members of the provided group id.\n   * @param tenantId Tenant ID to load groups from.\n   * @param groupId Group ID to load members for.\n   * @returns Group[] list of groups\n   */\n  loadAllGroupMembers: (tenantId: string, groupId: string): Promise<SdkResponse<Group[]>> =>\n    transformResponse<Group[]>(\n      sdk.httpClient.post(\n        apiPaths.group.loadAllGroupMembers,\n        { tenantId, groupId },\n        { token: managementKey },\n      ),\n    ),\n});\n\nexport default withGroup;\n","import { SdkResponse, transformResponse } from '@descope/core-js-sdk';\nimport { CoreSdk } from '../types';\nimport apiPaths from './paths';\nimport { RoleMappings, AttributeMapping, SSOSettingsResponse } from './types';\n\nconst withSSOSettings = (sdk: CoreSdk, managementKey?: string) => ({\n  getSettings: (tenantId: string): Promise<SdkResponse<SSOSettingsResponse>> =>\n    transformResponse<SSOSettingsResponse>(\n      sdk.httpClient.get(apiPaths.sso.settings, {\n        queryParams: { tenantId },\n        token: managementKey,\n      }),\n      (data) => data,\n    ),\n  deleteSettings: (tenantId: string): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.delete(apiPaths.sso.settings, {\n        queryParams: { tenantId },\n        token: managementKey,\n      }),\n    ),\n  configureSettings: (\n    tenantId: string,\n    idpURL: string,\n    idpCert: string,\n    entityId: string,\n    redirectURL?: string,\n    domain?: string,\n  ): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(\n        apiPaths.sso.settings,\n        { tenantId, idpURL, entityId, idpCert, redirectURL, domain },\n        { token: managementKey },\n      ),\n    ),\n  configureMetadata: (tenantId: string, idpMetadataURL: string): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(\n        apiPaths.sso.metadata,\n        { tenantId, idpMetadataURL },\n        { token: managementKey },\n      ),\n    ),\n  configureMapping: (\n    tenantId: string,\n    roleMappings?: RoleMappings,\n    attributeMapping?: AttributeMapping,\n  ): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(\n        apiPaths.sso.mapping,\n        { tenantId, roleMappings, attributeMapping },\n        { token: managementKey },\n      ),\n    ),\n});\n\nexport default withSSOSettings;\n","import { SdkResponse, transformResponse } from '@descope/core-js-sdk';\nimport { CoreSdk } from '../types';\nimport apiPaths from './paths';\nimport { AccessKey, AssociatedTenant, CreatedAccessKeyResponse } from './types';\n\ntype SingleKeyResponse = {\n  key: AccessKey;\n};\n\ntype MultipleKeysResponse = {\n  keys: AccessKey[];\n};\n\nconst withAccessKey = (sdk: CoreSdk, managementKey?: string) => ({\n  /**\n   * Create a new access key for a project.\n   * @param name Access key name\n   * @param expireTime When the access key expires. Keep at 0 to make it indefinite.\n   * @param roles Optional roles in the project. Does not apply for multi-tenants\n   * @param keyTenants Optional associated tenants for this key and its roles for each.\n   * @returns A newly created key and its cleartext. Make sure to save the cleartext securely.\n   */\n  create: (\n    name: string,\n    expireTime: number,\n    roles?: string[],\n    keyTenants?: AssociatedTenant[],\n  ): Promise<SdkResponse<CreatedAccessKeyResponse>> =>\n    transformResponse(\n      sdk.httpClient.post(\n        apiPaths.accessKey.create,\n        { name, expireTime, roleNames: roles, keyTenants },\n        { token: managementKey },\n      ),\n    ),\n  /**\n   * Load an access key.\n   * @param id Access key ID to load\n   * @returns The loaded access key.\n   */\n  load: (id: string): Promise<SdkResponse<AccessKey>> =>\n    transformResponse<SingleKeyResponse, AccessKey>(\n      sdk.httpClient.get(apiPaths.accessKey.load, {\n        queryParams: { id },\n        token: managementKey,\n      }),\n      (data) => data.key,\n    ),\n  /**\n   * Search all access keys\n   * @param tenantIds Optional tenant ID filter to apply on the search results\n   * @returns An array of found access keys\n   */\n  searchAll: (tenantIds?: string[]): Promise<SdkResponse<AccessKey[]>> =>\n    transformResponse<MultipleKeysResponse, AccessKey[]>(\n      sdk.httpClient.post(apiPaths.accessKey.search, { tenantIds }, { token: managementKey }),\n      (data) => data.keys,\n    ),\n  /**\n   * Update an access key.\n   * @param id Access key ID to load\n   * @param name The updated access key name\n   * @returns The updated access key\n   */\n  update: (id: string, name: string): Promise<SdkResponse<AccessKey>> =>\n    transformResponse<SingleKeyResponse, AccessKey>(\n      sdk.httpClient.post(apiPaths.accessKey.update, { id, name }, { token: managementKey }),\n      (data) => data.key,\n    ),\n  /**\n   * Deactivate an access key. Deactivated access keys cannot be used until they are\n   * activated again.\n   * @param id Access key ID to deactivate\n   */\n  deactivate: (id: string): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(apiPaths.accessKey.deactivate, { id }, { token: managementKey }),\n    ),\n  /**\n   * Activate an access key. Only deactivated access keys can be activated again.\n   * @param id Access key ID to activate\n   */\n  activate: (id: string): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(apiPaths.accessKey.activate, { id }, { token: managementKey }),\n    ),\n  /**\n   * Delete an access key. IMPORTANT: This cannot be undone. Use carefully.\n   * @param id Access key ID to delete\n   */\n  delete: (id: string): Promise<SdkResponse<never>> =>\n    transformResponse(\n      sdk.httpClient.post(apiPaths.accessKey.delete, { id }, { token: managementKey }),\n    ),\n});\n\nexport default withAccessKey;\n","import { SdkResponse, transformResponse } from '@descope/core-js-sdk';\nimport { CoreSdk } from '../types';\nimport apiPaths from './paths';\nimport { FlowResponse, Screen, Flow } from './types';\n\nconst WithFlow = (sdk: CoreSdk, managementKey?: string) => ({\n  export: (flowId: string): Promise<SdkResponse<FlowResponse>> =>\n    transformResponse(\n      sdk.httpClient.post(apiPaths.flow.export, { flowId }, { token: managementKey }),\n    ),\n  import: (flowId: string, flow: Flow, screens?: Screen[]): Promise<SdkResponse<FlowResponse>> =>\n    transformResponse(\n      sdk.httpClient.post(\n        apiPaths.flow.import,\n        { flowId, flow, screens },\n        { token: managementKey },\n      ),\n    ),\n});\n\nexport default WithFlow;\n","import { SdkResponse, transformResponse } from '@descope/core-js-sdk';\nimport { CoreSdk } from '../types';\nimport apiPaths from './paths';\nimport { Theme, ThemeResponse } from './types';\n\nconst WithTheme = (sdk: CoreSdk, managementKey?: string) => ({\n  export: (): Promise<SdkResponse<ThemeResponse>> =>\n    transformResponse(sdk.httpClient.post(apiPaths.theme.export, {}, { token: managementKey })),\n  import: (theme: Theme): Promise<SdkResponse<ThemeResponse>> =>\n    transformResponse(\n      sdk.httpClient.post(apiPaths.theme.import, { theme }, { token: managementKey }),\n    ),\n});\n\nexport default WithTheme;\n","import nodeFetch, { Headers } from 'node-fetch-commonjs';\n\nglobalThis.Headers ??= Headers;\n\nconst highWaterMarkMb = 1024 * 1024 * 30; // 30MB\n\n// we are increasing the response buffer size due to an issue where node-fetch hangs when response is too big\nconst patchedFetch = (...args: Parameters<typeof nodeFetch>) => {\n  // we can get Request on the first arg, or RequestInfo on the second arg\n  // we want to make sure we are setting the \"highWaterMark\" so we are doing it on both args\n  args.forEach((arg) => {\n    // eslint-disable-next-line no-param-reassign, @typescript-eslint/no-unused-expressions\n    arg && ((arg as any).highWaterMark ??= highWaterMarkMb);\n  });\n\n  return nodeFetch(...args);\n};\n\nexport default patchedFetch as unknown as typeof fetch;\n","import createSdk, { ExchangeAccessKeyResponse, SdkResponse, wrapWith } from '@descope/core-js-sdk';\nimport { JWK, JWTHeaderParameters, KeyLike, errors, importJWK, jwtVerify } from 'jose';\nimport {\n  permissionsClaimName,\n  refreshTokenCookieName,\n  rolesClaimName,\n  sessionTokenCookieName,\n} from './constants';\nimport { getAuthorizationClaimItems, withCookie } from './helpers';\nimport withManagement from './management';\nimport { AuthenticationInfo } from './types';\nimport fetch from './fetch-polyfill';\n\ndeclare const BUILD_VERSION: string;\n\n/** Configuration arguments which include the Descope core SDK args and an optional management key */\ntype NodeSdkArgs = Parameters<typeof createSdk>[0] & {\n  managementKey?: string;\n  publicKey?: string;\n};\n\nconst nodeSdk = ({ managementKey, publicKey, ...config }: NodeSdkArgs) => {\n  const coreSdk = createSdk({\n    ...config,\n    fetch,\n    baseHeaders: {\n      ...config.baseHeaders,\n      'x-descope-sdk-name': 'nodejs',\n      'x-descope-sdk-node-version': process?.versions?.node || '',\n      'x-descope-sdk-version': BUILD_VERSION,\n    },\n  });\n\n  const { projectId, logger } = config;\n\n  const keys: Record<string, KeyLike | Uint8Array> = {};\n\n  /** Fetch the public keys (JWKs) from Descope for the configured project */\n  const fetchKeys = async () => {\n    if (publicKey) {\n      try {\n        const parsedKey = JSON.parse(publicKey);\n        const key = await importJWK(parsedKey);\n        return {\n          [parsedKey.kid]: key,\n        };\n      } catch (e) {\n        logger?.error('Failed to parse the provided public key', e);\n        throw new Error('Failed to parse public key');\n      }\n    }\n\n    const keysWrapper = await coreSdk.httpClient\n      .get(`v2/keys/${projectId}`)\n      .then((resp) => resp.json());\n    const publicKeys: JWK[] = keysWrapper.keys;\n    if (!Array.isArray(publicKeys)) return {};\n    const kidJwksPairs = await Promise.all(\n      publicKeys.map(async (key) => [key.kid, await importJWK(key)]),\n    );\n\n    return kidJwksPairs.reduce(\n      (acc, [kid, jwk]) => (kid ? { ...acc, [kid.toString()]: jwk } : acc),\n      {},\n    );\n  };\n\n  const management = withManagement(coreSdk, managementKey);\n\n  const sdk = {\n    ...coreSdk,\n\n    /**\n     * Provides various APIs for managing a Descope project programmatically. A management key must\n     * be provided as an argument when initializing the SDK to use these APIs. Management keys can be\n     * generated in the Descope console.\n     */\n    management,\n\n    /** Get the key that can validate the given JWT KID in the header. Can retrieve the public key from local cache or from Descope. */\n    async getKey(header: JWTHeaderParameters): Promise<KeyLike | Uint8Array> {\n      if (!header?.kid) throw Error('header.kid must not be empty');\n\n      if (keys[header.kid]) return keys[header.kid];\n\n      // do we need to fetch once or every time?\n      Object.assign(keys, await fetchKeys());\n\n      if (!keys[header.kid]) throw Error('failed to fetch matching key');\n\n      return keys[header.kid];\n    },\n\n    /**\n     * Validate the given JWT with the right key and make sure the issuer is correct\n     * @param jwt the JWT string to parse and validate\n     * @returns AuthenticationInfo with the parsed token and JWT. Will throw an error if validation fails.\n     */\n    async validateJwt(jwt: string): Promise<AuthenticationInfo> {\n      // Do not hard-code the algo because library does not support `None` so all are valid\n      const res = await jwtVerify(jwt, sdk.getKey, { clockTolerance: 5 });\n      const token = res.payload;\n\n      if (token) {\n        token.iss = token.iss?.split('/').pop(); // support both url and project id as issuer\n        if (token.iss !== projectId) {\n          // We must do the verification here, since issuer can be either project ID or URL\n          throw new errors.JWTClaimValidationFailed(\n            'unexpected \"iss\" claim value',\n            'iss',\n            'check_failed',\n          );\n        }\n      }\n\n      return { jwt, token };\n    },\n\n    /**\n     * Validate an active session\n     * @param sessionToken session JWT to validate\n     * @returns AuthenticationInfo promise or throws Error if there is an issue with JWTs\n     */\n    async validateSession(sessionToken: string): Promise<AuthenticationInfo> {\n      if (!sessionToken) throw Error('session token is required for validation');\n\n      try {\n        const token = await sdk.validateJwt(sessionToken);\n        return token;\n      } catch (error) {\n        /* istanbul ignore next */\n        logger?.error('session validation failed', error);\n        throw Error('session validation failed');\n      }\n    },\n\n    /**\n     * Refresh the session using a refresh token\n     * @param refreshToken refresh JWT to refresh the session with\n     * @returns AuthenticationInfo promise or throws Error if there is an issue with JWTs\n     */\n    async refreshSession(refreshToken: string): Promise<AuthenticationInfo> {\n      if (!refreshToken) throw Error('refresh token is required to refresh a session');\n\n      try {\n        await sdk.validateJwt(refreshToken);\n        const jwtResp = await sdk.refresh(refreshToken);\n        if (jwtResp.ok) {\n          const token = await sdk.validateJwt(jwtResp.data?.sessionJwt);\n          return token;\n        }\n        /* istanbul ignore next */\n        throw Error(jwtResp.error?.errorMessage);\n      } catch (refreshTokenErr) {\n        /* istanbul ignore next */\n        logger?.error('refresh token validation failed', refreshTokenErr);\n        throw Error('refresh token validation failed');\n      }\n    },\n\n    /**\n     * Validate session and refresh it if it expired\n     * @param sessionToken session JWT\n     * @param refreshToken refresh JWT\n     * @returns AuthenticationInfo promise or throws Error if there is an issue with JWTs\n     */\n    async validateAndRefreshSession(\n      sessionToken?: string,\n      refreshToken?: string,\n    ): Promise<AuthenticationInfo> {\n      if (!sessionToken && !refreshToken) throw Error('both session and refresh tokens are empty');\n\n      try {\n        const token = await sdk.validateSession(sessionToken);\n        return token;\n      } catch (error) {\n        /* istanbul ignore next */\n        logger?.log('session validation failed - trying to refresh it');\n      }\n\n      return sdk.refreshSession(refreshToken);\n    },\n\n    /**\n     * Exchange API key (access key) for a session key\n     * @param accessKey access key to exchange for a session JWT\n     * @returns AuthneticationInfo with session JWT data\n     */\n    async exchangeAccessKey(accessKey: string): Promise<AuthenticationInfo> {\n      if (!accessKey) throw Error('access key must not be empty');\n\n      let resp: SdkResponse<ExchangeAccessKeyResponse>;\n      try {\n        resp = await sdk.accessKey.exchange(accessKey);\n      } catch (error) {\n        logger?.error('failed to exchange access key', error);\n        throw Error('could not exchange access key');\n      }\n\n      const { sessionJwt } = resp.data;\n      if (!sessionJwt) {\n        logger?.error('failed to parse exchange access key response');\n        throw Error('could not exchange access key');\n      }\n\n      try {\n        const token = await sdk.validateJwt(sessionJwt);\n        return token;\n      } catch (error) {\n        logger?.error('failed to parse jwt from access key', error);\n        throw Error('could not exchange access key');\n      }\n    },\n\n    /**\n     * Make sure that all given permissions exist on the parsed JWT top level claims\n     * @param authInfo JWT parsed info\n     * @param permissions list of permissions to make sure they exist on te JWT claims\n     * @returns true if all permissions exist, false otherwise\n     */\n    validatePermissions(authInfo: AuthenticationInfo, permissions: string[]): boolean {\n      return sdk.validateTenantPermissions(authInfo, null, permissions);\n    },\n\n    /**\n     * Make sure that all given permissions exist on the parsed JWT tenant claims\n     * @param authInfo JWT parsed info\n     * @param permissions list of permissions to make sure they exist on te JWT claims\n     * @returns true if all permissions exist, false otherwise\n     */\n    validateTenantPermissions(\n      authInfo: AuthenticationInfo,\n      tenant: string,\n      permissions: string[],\n    ): boolean {\n      const granted = getAuthorizationClaimItems(authInfo, permissionsClaimName, tenant);\n      return permissions.every((perm) => granted.includes(perm));\n    },\n\n    /**\n     * Make sure that all given roles exist on the parsed JWT top level claims\n     * @param authInfo JWT parsed info\n     * @param roles list of roles to make sure they exist on te JWT claims\n     * @returns true if all roles exist, false otherwise\n     */\n    validateRoles(authInfo: AuthenticationInfo, roles: string[]): boolean {\n      return sdk.validateTenantRoles(authInfo, null, roles);\n    },\n\n    /**\n     * Make sure that all given roles exist on the parsed JWT tenant claims\n     * @param authInfo JWT parsed info\n     * @param roles list of roles to make sure they exist on te JWT claims\n     * @returns true if all roles exist, false otherwise\n     */\n    validateTenantRoles(authInfo: AuthenticationInfo, tenant: string, roles: string[]): boolean {\n      const membership = getAuthorizationClaimItems(authInfo, rolesClaimName, tenant);\n      return roles.every((role) => membership.includes(role));\n    },\n  };\n\n  return wrapWith(\n    sdk,\n    [\n      'otp.verify.email',\n      'otp.verify.sms',\n      'otp.verify.whatsapp',\n      'magicLink.verify',\n      'enchantedLink.signUp',\n      'enchantedLink.signIn',\n      'oauth.exchange',\n      'saml.exchange',\n      'totp.verify',\n      'webauthn.signIn.finish',\n      'webauthn.signUp.finish',\n      'refresh',\n    ] as const,\n    withCookie,\n  );\n};\n\n/** Descope SDK client with delivery methods enum.\n *\n * Please see full documentation at {@link https://docs.descope.com/guides Descope Docs}\n * @example Usage\n *\n * ```js\n * import descopeSdk from '@descope/node-sdk';\n *\n * const myProjectId = 'xxx';\n * const sdk = descopeSdk({ projectId: myProjectId });\n *\n * const userLoginId = 'loginId';\n * sdk.otp.signIn.email(userLoginId);\n * const jwtResponse = sdk.otp.verify.email(userLoginId, codeFromEmail);\n * ```\n */\n\nnodeSdk.RefreshTokenCookieName = refreshTokenCookieName;\nnodeSdk.SessionTokenCookieName = sessionTokenCookieName;\n\nexport default nodeSdk;\nexport type {\n  DeliveryMethod,\n  OAuthProvider,\n  ResponseData,\n  SdkResponse,\n  JWTResponse,\n} from '@descope/core-js-sdk';\nexport type { AuthenticationInfo };\n","import { CoreSdk } from '../types';\nimport withUser from './user';\nimport withTenant from './tenant';\nimport withJWT from './jwt';\nimport withPermission from './permission';\nimport withRole from './role';\nimport withGroup from './group';\nimport withSSOSettings from './sso';\nimport withAccessKey from './accesskey';\nimport WithFlow from './flow';\nimport WithTheme from './theme';\n\n/** Constructs a higher level Management API that wraps the functions from code-js-sdk */\nconst withManagement = (sdk: CoreSdk, managementKey?: string) => ({\n  user: withUser(sdk, managementKey),\n  accessKey: withAccessKey(sdk, managementKey),\n  tenant: withTenant(sdk, managementKey),\n  sso: withSSOSettings(sdk, managementKey),\n  jwt: withJWT(sdk, managementKey),\n  permission: withPermission(sdk, managementKey),\n  role: withRole(sdk, managementKey),\n  group: withGroup(sdk, managementKey),\n  flow: WithFlow(sdk, managementKey),\n  theme: WithTheme(sdk, managementKey),\n});\n\nexport default withManagement;\n"],"names":["withCookie","fn","async","args","resp","data","_d","refreshJwt","rest","__rest","cookies","options","push","cookieDomain","cookieMaxAge","cookiePath","_a","response","headers","get","cookie","name","match","RegExp","getCookieValue","_b","_c","Object","assign","getAuthorizationClaimItems","authInfo","claim","tenant","value","token","Array","isArray","apiPaths","create","update","delete","deleteAllTestUsers","load","search","getProviderToken","updateStatus","updateEmail","updatePhone","updateDisplayName","updatePicture","updateCustomAttribute","addRole","removeRole","addTenant","removeTenant","setPassword","expirePassword","generateOTPForTest","generateMagicLinkForTest","generateEnchantedLinkForTest","deactivate","activate","loadAll","settings","metadata","mapping","export","import","loadAllGroups","loadAllGroupsForMember","loadAllGroupMembers","withUser","sdk","managementKey","loginId","email","phone","displayName","roles","userTenants","customAttributes","picture","transformResponse","httpClient","post","roleNames","user","createTestUser","test","invite","queryParams","loadByUserId","userId","searchAll","tenantIds","limit","page","testUsersOnly","withTestUser","users","provider","status","isVerified","verified","attributeKey","attributeValue","addRoles","removeRoles","tenantId","addTenantRoles","removeTenantRoles","generateOTPForTestUser","deliveryMethod","generateMagicLinkForTestUser","uri","URI","generateEnchantedLinkForTestUser","password","withTenant","selfProvisioningDomains","createWithId","id","tenants","withJWT","jwt","customClaims","withPermission","description","newName","permissions","withRole","permissionNames","withGroup","userIds","loginIds","groupId","withSSOSettings","getSettings","deleteSettings","configureSettings","idpURL","idpCert","entityId","redirectURL","domain","configureMetadata","idpMetadataURL","configureMapping","roleMappings","attributeMapping","withAccessKey","expireTime","keyTenants","key","keys","WithFlow","flowId","flow","screens","WithTheme","theme","globalThis","Headers","patchedFetch","forEach","arg","highWaterMark","nodeFetch","nodeSdk","publicKey","config","coreSdk","createSdk","fetch","baseHeaders","process","versions","node","projectId","logger","management","accessKey","sso","permission","role","group","withManagement","header","kid","Error","parsedKey","JSON","parse","importJWK","e","error","publicKeys","then","json","Promise","all","map","reduce","acc","jwk","toString","fetchKeys","jwtVerify","getKey","clockTolerance","payload","iss","split","pop","errors","JWTClaimValidationFailed","sessionToken","validateJwt","refreshToken","jwtResp","refresh","ok","sessionJwt","errorMessage","refreshTokenErr","validateSession","log","refreshSession","exchange","validatePermissions","validateTenantPermissions","granted","every","perm","includes","validateRoles","validateTenantRoles","membership","wrapWith","RefreshTokenCookieName","SessionTokenCookieName"],"mappings":"sNAEO,MC+BMA,EACVC,GACDC,SAAUC,eACR,MAAMC,QAAaH,KAAME,GAGzB,IAAKC,EAAKC,KACR,OAAOD,EAIT,IAAIE,EAA0BF,EAAKC,MAA/BE,WAAEA,GAAUD,EAAKE,EAAjBC,EAAAH,EAAA,CAAA,eACJ,MAAMI,EAAoB,GAlCP,IAA8BC,EAgDjD,OAZKJ,EASHG,EAAQE,KA5CZ,GDVoC,SCsDoBL,cA5C5BI,OADuBA,EA6CiBH,QA5CxC,EAAAG,EAASE,eAAgB,gBACnDF,aAAA,EAAAA,EAASG,eAAgB,aACjBH,aAAA,EAAAA,EAASI,aAAc,mCAkCZ,QAAbC,EAAAZ,EAAKa,gBAAQ,IAAAD,OAAA,EAAAA,EAAEE,QAAQC,IAAI,iBAC7BZ,EA3Be,EAACa,EAAmCC,KACzD,MAAMC,EAAQF,eAAAA,EAAQE,MAAMC,OAAO,cAAcF,cACjD,OAAOC,EAAQA,EAAM,GAAK,IAAI,EAyBXE,CACE,QAAbC,EAAArB,EAAKa,gBAAQ,IAAAQ,OAAA,EAAAA,EAAEP,QAAQC,IAAI,cDhDC,OCmD9BT,EAAQE,KAAoB,QAAfc,EAAAtB,EAAKa,gBAAU,IAAAS,OAAA,EAAAA,EAAAR,QAAQC,IAAI,gBAMhCQ,OAAAC,OAAAD,OAAAC,OAAA,CAAA,EAAAxB,GAAM,CAAAC,KAAWsB,OAAAC,OAAAD,OAAAC,OAAA,GAAAxB,EAAKC,MAAM,CAAAE,aAAYG,aAAY,WAUpDmB,EACdC,EACAC,EACAC,WAEA,MAAMC,EAAQD,EAC0C,QAApDP,EAA6C,QAA7CT,EAAAc,EAASI,MAAgC,eAAI,IAAAlB,OAAA,EAAAA,EAAAgB,UAAO,IAAAP,OAAA,EAAAA,EAAGM,GACvDD,EAASI,MAAMH,GACnB,OAAOI,MAAMC,QAAQH,GAASA,EAAQ,EACxC,CC7EA,IAAeI,EACP,CACJC,OAAQ,uBACRC,OAAQ,uBACRC,OAAQ,uBACRC,mBAAoB,gCACpBC,KAAM,gBACNC,OAAQ,uBACRC,iBAAkB,+BAClBC,aAAc,8BACdC,YAAa,6BACbC,YAAa,6BACbC,kBAAmB,4BACnBC,cAAe,+BACfC,sBAAuB,uCACvBC,QAAS,gCACTC,WAAY,mCACZC,UAAW,kCACXC,aAAc,qCACdC,YAAa,6BACbC,eAAgB,gCAChBC,mBAAoB,8BACpBC,yBAA0B,oCAC1BC,6BAA8B,yCAvBnBtB,EAyBF,CACTC,OAAQ,4BACRI,KAAM,qBACNC,OAAQ,4BACRJ,OAAQ,4BACRqB,WAAY,gCACZC,SAAU,8BACVrB,OAAQ,6BAhCGH,EAkCL,CACNC,OAAQ,yBACRC,OAAQ,yBACRC,OAAQ,yBACRsB,QAAS,uBAtCEzB,EAwCR,CACH0B,SAAU,wBACVC,SAAU,wBACVC,QAAS,wBA3CE5B,EA6CR,CACHE,OAAQ,uBA9CGF,EAgDD,CACVC,OAAQ,6BACRC,OAAQ,6BACRC,OAAQ,6BACRsB,QAAS,2BApDEzB,EAsDP,CACJC,OAAQ,uBACRC,OAAQ,uBACRC,OAAQ,uBACRsB,QAAS,qBA1DEzB,EA4DP,CACJ6B,OAAQ,uBACRC,OAAQ,wBA9DG9B,EAgEN,CACL6B,OAAQ,wBACRC,OAAQ,yBAlEG9B,EAoEN,CACL+B,cAAe,qBACfC,uBAAwB,4BACxBC,oBAAqB,0BCpDzB,MAAMC,EAAW,CAACC,EAAcC,KAA4B,CAC1DnC,OAAQ,CACNoC,EACAC,EACAC,EACAC,EACAC,EACAC,EACAC,EACAC,IAEAC,EACEV,EAAIW,WAAWC,KACb/C,EAAcC,OACd,CACEoC,UACAC,QACAC,QACAC,cACAQ,UAAWP,EACXC,cACAC,mBACAC,WAEF,CAAE/C,MAAOuC,KAEVpE,GAASA,EAAKiF,OAYnBC,eAAgB,CACdb,EACAC,EACAC,EACAC,EACAC,EACAC,EACAC,EACAC,IAEAC,EACEV,EAAIW,WAAWC,KACb/C,EAAcC,OACd,CACEoC,UACAC,QACAC,QACAC,cACAQ,UAAWP,EACXC,cACAS,MAAM,EACNR,mBACAC,WAEF,CAAE/C,MAAOuC,KAEVpE,GAASA,EAAKiF,OAEnBG,OAAQ,CACNf,EACAC,EACAC,EACAC,EACAC,EACAC,EACAC,EACAC,IAEAC,EACEV,EAAIW,WAAWC,KACb/C,EAAcC,OACd,CACEoC,UACAC,QACAC,QACAC,cACAQ,UAAWP,EACXC,cACAU,QAAQ,EACRT,mBACAC,WAEF,CAAE/C,MAAOuC,KAEVpE,GAASA,EAAKiF,OAEnB/C,OAAQ,CACNmC,EACAC,EACAC,EACAC,EACAC,EACAC,EACAC,EACAC,IAEAC,EACEV,EAAIW,WAAWC,KACb/C,EAAcE,OACd,CACEmC,UACAC,QACAC,QACAC,cACAQ,UAAWP,EACXC,cACAC,mBACAC,WAEF,CAAE/C,MAAOuC,KAEVpE,GAASA,EAAKiF,OAEnB9C,OAASkC,GACPQ,EACEV,EAAIW,WAAWC,KAAK/C,EAAcG,OAAQ,CAAEkC,WAAW,CAAExC,MAAOuC,KAKpEhC,mBAAoB,IAClByC,EACEV,EAAIW,WAAW3C,OAAOH,EAAcI,mBAAoB,CAAEP,MAAOuC,KAErE/B,KAAOgC,GACLQ,EACEV,EAAIW,WAAWhE,IAAIkB,EAAcK,KAAM,CACrCgD,YAAa,CAAEhB,WACfxC,MAAOuC,KAERpE,GAASA,EAAKiF,OAQnBK,aAAeC,GACbV,EACEV,EAAIW,WAAWhE,IAAIkB,EAAcK,KAAM,CACrCgD,YAAa,CAAEE,UACf1D,MAAOuC,KAERpE,GAASA,EAAKiF,OAanBO,UAAW,CACTC,EACAhB,EACAiB,EACAC,EACAC,EACAC,EACAlB,IAEAE,EACEV,EAAIW,WAAWC,KACb/C,EAAcM,OACd,CAAEmD,YAAWT,UAAWP,EAAOiB,QAAOC,OAAMC,gBAAeC,eAAclB,oBACzE,CAAE9C,MAAOuC,KAEVpE,GAASA,EAAK8F,QAUnBvD,iBAAkB,CAChB8B,EACA0B,IAEAlB,EACEV,EAAIW,WAAWhE,IAAIkB,EAAcO,iBAAkB,CACjD8C,YAAa,CAAEhB,UAAS0B,YACxBlE,MAAOuC,KAERpE,GAASA,IAEdwD,SAAWa,GACTQ,EACEV,EAAIW,WAAWC,KACb/C,EAAcQ,aACd,CAAE6B,UAAS2B,OAAQ,WACnB,CAAEnE,MAAOuC,KAEVpE,GAASA,EAAKiF,OAEnB1B,WAAac,GACXQ,EACEV,EAAIW,WAAWC,KACb/C,EAAcQ,aACd,CAAE6B,UAAS2B,OAAQ,YACnB,CAAEnE,MAAOuC,KAEVpE,GAASA,EAAKiF,OAEnBxC,YAAa,CACX4B,EACAC,EACA2B,IAEApB,EACEV,EAAIW,WAAWC,KACb/C,EAAcS,YACd,CAAE4B,UAASC,QAAO4B,SAAUD,GAC5B,CAAEpE,MAAOuC,KAEVpE,GAASA,EAAKiF,OAEnBvC,YAAa,CACX2B,EACAE,EACA0B,IAEApB,EACEV,EAAIW,WAAWC,KACb/C,EAAcU,YACd,CAAE2B,UAASE,QAAO2B,SAAUD,GAC5B,CAAEpE,MAAOuC,KAEVpE,GAASA,EAAKiF,OAEnBtC,kBAAmB,CAAC0B,EAAiBG,IACnCK,EACEV,EAAIW,WAAWC,KACb/C,EAAcW,kBACd,CAAE0B,UAASG,eACX,CAAE3C,MAAOuC,KAEVpE,GAASA,EAAKiF,OAEnBrC,cAAe,CAACyB,EAAiBO,IAC/BC,EACEV,EAAIW,WAAWC,KACb/C,EAAcY,cACd,CAAEyB,UAASO,WACX,CAAE/C,MAAOuC,KAEVpE,GAASA,EAAKiF,OAEnBpC,sBAAuB,CACrBwB,EACA8B,EACAC,IAEAvB,EACEV,EAAIW,WAAWC,KACb/C,EAAca,sBACd,CAAEwB,UAAS8B,eAAcC,kBACzB,CAAEvE,MAAOuC,KAEVpE,GAASA,EAAKiF,OAEnBoB,SAAU,CAAChC,EAAiBI,IAC1BI,EACEV,EAAIW,WAAWC,KACb/C,EAAcc,QACd,CAAEuB,UAASW,UAAWP,GACtB,CAAE5C,MAAOuC,KAEVpE,GAASA,EAAKiF,OAEnBqB,YAAa,CAACjC,EAAiBI,IAC7BI,EACEV,EAAIW,WAAWC,KACb/C,EAAce,WACd,CAAEsB,UAASW,UAAWP,GACtB,CAAE5C,MAAOuC,KAEVpE,GAASA,EAAKiF,OAEnBjC,UAAW,CAACqB,EAAiBkC,IAC3B1B,EACEV,EAAIW,WAAWC,KAAK/C,EAAcgB,UAAW,CAAEqB,UAASkC,YAAY,CAAE1E,MAAOuC,KAC5EpE,GAASA,EAAKiF,OAEnBhC,aAAc,CAACoB,EAAiBkC,IAC9B1B,EACEV,EAAIW,WAAWC,KACb/C,EAAciB,aACd,CAAEoB,UAASkC,YACX,CAAE1E,MAAOuC,KAEVpE,GAASA,EAAKiF,OAEnBuB,eAAgB,CACdnC,EACAkC,EACA9B,IAEAI,EACEV,EAAIW,WAAWC,KACb/C,EAAcc,QACd,CAAEuB,UAASkC,WAAUvB,UAAWP,GAChC,CAAE5C,MAAOuC,KAEVpE,GAASA,EAAKiF,OAEnBwB,kBAAmB,CACjBpC,EACAkC,EACA9B,IAEAI,EACEV,EAAIW,WAAWC,KACb/C,EAAce,WACd,CAAEsB,UAASkC,WAAUvB,UAAWP,GAChC,CAAE5C,MAAOuC,KAEVpE,GAASA,EAAKiF,OAanByB,uBAAwB,CACtBC,EACAtC,IAEAQ,EACEV,EAAIW,WAAWC,KACb/C,EAAcoB,mBACd,CAAEuD,iBAAgBtC,WAClB,CAAExC,MAAOuC,KAEVpE,GAASA,IAcd4G,6BAA8B,CAC5BD,EACAtC,EACAwC,IAEAhC,EACEV,EAAIW,WAAWC,KACb/C,EAAcqB,yBACd,CAAEsD,iBAAgBtC,UAASyC,IAAKD,GAChC,CAAEhF,MAAOuC,KAEVpE,GAASA,IAad+G,iCAAkC,CAChC1C,EACAwC,IAEAhC,EACEV,EAAIW,WAAWC,KACb/C,EAAcsB,6BACd,CAAEe,UAASyC,IAAKD,GAChB,CAAEhF,MAAOuC,KAEVpE,GAASA,IAWdkD,YAAa,CAACmB,EAAiB2C,IAC7BnC,EACEV,EAAIW,WAAWC,KACb/C,EAAckB,YACd,CAAEmB,UAAS2C,YACX,CAAEnF,MAAOuC,KAEVpE,GAASA,IASdmD,eAAiBkB,GACfQ,EACEV,EAAIW,WAAWC,KAAK/C,EAAcmB,eAAgB,CAAEkB,WAAW,CAAExC,MAAOuC,KACvEpE,GAASA,MC5bViH,EAAa,CAAC9C,EAAcC,KAA4B,CAC5DnC,OAAQ,CACNjB,EACAkG,IAEArC,EACEV,EAAIW,WAAWC,KACb/C,EAAgBC,OAChB,CAAEjB,OAAMkG,2BACR,CAAErF,MAAOuC,KAGf+C,aAAc,CACZC,EACApG,EACAkG,IAEArC,EACEV,EAAIW,WAAWC,KACb/C,EAAgBC,OAChB,CAAEmF,KAAIpG,OAAMkG,2BACZ,CAAErF,MAAOuC,KAGflC,OAAQ,CACNkF,EACApG,EACAkG,IAEArC,EACEV,EAAIW,WAAWC,KACb/C,EAAgBE,OAChB,CAAEkF,KAAIpG,OAAMkG,2BACZ,CAAErF,MAAOuC,KAGfjC,OAASiF,GACPvC,EACEV,EAAIW,WAAWC,KAAK/C,EAAgBG,OAAQ,CAAEiF,MAAM,CAAEvF,MAAOuC,KAEjEX,QAAS,IACPoB,EACEV,EAAIW,WAAWhE,IAAIkB,EAAgByB,QAAS,CAC1C5B,MAAOuC,KAERpE,GAASA,EAAKqH,YCjDfC,EAAU,CAACnD,EAAcC,KAA4B,CACzDlC,OAAQ,CACNqF,EACAC,IAEA3C,EACEV,EAAIW,WAAWC,KAAK/C,EAAaE,OAAQ,CAAEqF,MAAKC,gBAAgB,CAAE3F,MAAOuC,OCFzEqD,EAAiB,CAACtD,EAAcC,KAA4B,CAChEnC,OAAQ,CAACjB,EAAc0G,IACrB7C,EACEV,EAAIW,WAAWC,KACb/C,EAAoBC,OACpB,CAAEjB,OAAM0G,eACR,CAAE7F,MAAOuC,KAGflC,OAAQ,CAAClB,EAAc2G,EAAiBD,IACtC7C,EACEV,EAAIW,WAAWC,KACb/C,EAAoBE,OACpB,CAAElB,OAAM2G,UAASD,eACjB,CAAE7F,MAAOuC,KAGfjC,OAASnB,GACP6D,EACEV,EAAIW,WAAWC,KAAK/C,EAAoBG,OAAQ,CAAEnB,QAAQ,CAAEa,MAAOuC,KAEvEX,QAAS,IACPoB,EACEV,EAAIW,WAAWhE,IAAIkB,EAAoByB,QAAS,CAC9C5B,MAAOuC,KAERpE,GAASA,EAAK4H,gBC1BfC,EAAW,CAAC1D,EAAcC,KAA4B,CAC1DnC,OAAQ,CACNjB,EACA0G,EACAI,IAEAjD,EACEV,EAAIW,WAAWC,KACb/C,EAAcC,OACd,CAAEjB,OAAM0G,cAAaI,mBACrB,CAAEjG,MAAOuC,KAGflC,OAAQ,CACNlB,EACA2G,EACAD,EACAI,IAEAjD,EACEV,EAAIW,WAAWC,KACb/C,EAAcE,OACd,CAAElB,OAAM2G,UAASD,cAAaI,mBAC9B,CAAEjG,MAAOuC,KAGfjC,OAASnB,GACP6D,EACEV,EAAIW,WAAWC,KAAK/C,EAAcG,OAAQ,CAAEnB,QAAQ,CAAEa,MAAOuC,KAEjEX,QAAS,IACPoB,EACEV,EAAIW,WAAWhE,IAAIkB,EAAcyB,QAAS,CACxC5B,MAAOuC,KAERpE,GAASA,EAAKyE,UCvCfsD,EAAY,CAAC5D,EAAcC,KAA4B,CAM3DL,cAAgBwC,GACd1B,EACEV,EAAIW,WAAWC,KAAK/C,EAAe+B,cAAe,CAAEwC,YAAY,CAAE1E,MAAOuC,KAU7EJ,uBAAwB,CACtBuC,EACAyB,EACAC,IAEApD,EACEV,EAAIW,WAAWC,KACb/C,EAAegC,uBACf,CAAEuC,WAAU0B,WAAUD,WACtB,CAAEnG,MAAOuC,KAUfH,oBAAqB,CAACsC,EAAkB2B,IACtCrD,EACEV,EAAIW,WAAWC,KACb/C,EAAeiC,oBACf,CAAEsC,WAAU2B,WACZ,CAAErG,MAAOuC,OC1CX+D,EAAkB,CAAChE,EAAcC,KAA4B,CACjEgE,YAAc7B,GACZ1B,EACEV,EAAIW,WAAWhE,IAAIkB,EAAa0B,SAAU,CACxC2B,YAAa,CAAEkB,YACf1E,MAAOuC,KAERpE,GAASA,IAEdqI,eAAiB9B,GACf1B,EACEV,EAAIW,WAAW3C,OAAOH,EAAa0B,SAAU,CAC3C2B,YAAa,CAAEkB,YACf1E,MAAOuC,KAGbkE,kBAAmB,CACjB/B,EACAgC,EACAC,EACAC,EACAC,EACAC,IAEA9D,EACEV,EAAIW,WAAWC,KACb/C,EAAa0B,SACb,CAAE6C,WAAUgC,SAAQE,WAAUD,UAASE,cAAaC,UACpD,CAAE9G,MAAOuC,KAGfwE,kBAAmB,CAACrC,EAAkBsC,IACpChE,EACEV,EAAIW,WAAWC,KACb/C,EAAa2B,SACb,CAAE4C,WAAUsC,kBACZ,CAAEhH,MAAOuC,KAGf0E,iBAAkB,CAChBvC,EACAwC,EACAC,IAEAnE,EACEV,EAAIW,WAAWC,KACb/C,EAAa4B,QACb,CAAE2C,WAAUwC,eAAcC,oBAC1B,CAAEnH,MAAOuC,OCxCX6E,EAAgB,CAAC9E,EAAcC,KAA4B,CAS/DnC,OAAQ,CACNjB,EACAkI,EACAzE,EACA0E,IAEAtE,EACEV,EAAIW,WAAWC,KACb/C,EAAmBC,OACnB,CAAEjB,OAAMkI,aAAYlE,UAAWP,EAAO0E,cACtC,CAAEtH,MAAOuC,KAQf/B,KAAO+E,GACLvC,EACEV,EAAIW,WAAWhE,IAAIkB,EAAmBK,KAAM,CAC1CgD,YAAa,CAAE+B,MACfvF,MAAOuC,KAERpE,GAASA,EAAKoJ,MAOnB5D,UAAYC,GACVZ,EACEV,EAAIW,WAAWC,KAAK/C,EAAmBM,OAAQ,CAAEmD,aAAa,CAAE5D,MAAOuC,KACtEpE,GAASA,EAAKqJ,OAQnBnH,OAAQ,CAACkF,EAAYpG,IACnB6D,EACEV,EAAIW,WAAWC,KAAK/C,EAAmBE,OAAQ,CAAEkF,KAAIpG,QAAQ,CAAEa,MAAOuC,KACrEpE,GAASA,EAAKoJ,MAOnB7F,WAAa6D,GACXvC,EACEV,EAAIW,WAAWC,KAAK/C,EAAmBuB,WAAY,CAAE6D,MAAM,CAAEvF,MAAOuC,KAMxEZ,SAAW4D,GACTvC,EACEV,EAAIW,WAAWC,KAAK/C,EAAmBwB,SAAU,CAAE4D,MAAM,CAAEvF,MAAOuC,KAMtEjC,OAASiF,GACPvC,EACEV,EAAIW,WAAWC,KAAK/C,EAAmBG,OAAQ,CAAEiF,MAAM,CAAEvF,MAAOuC,OCvFhEkF,EAAW,CAACnF,EAAcC,KAA4B,CAC1DP,OAAS0F,GACP1E,EACEV,EAAIW,WAAWC,KAAK/C,EAAc6B,OAAQ,CAAE0F,UAAU,CAAE1H,MAAOuC,KAEnEN,OAAQ,CAACyF,EAAgBC,EAAYC,IACnC5E,EACEV,EAAIW,WAAWC,KACb/C,EAAc8B,OACd,CAAEyF,SAAQC,OAAMC,WAChB,CAAE5H,MAAOuC,OCVXsF,EAAY,CAACvF,EAAcC,KAA4B,CAC3DP,OAAQ,IACNgB,EAAkBV,EAAIW,WAAWC,KAAK/C,EAAe6B,OAAQ,CAAE,EAAE,CAAEhC,MAAOuC,KAC5EN,OAAS6F,GACP9E,EACEV,EAAIW,WAAWC,KAAK/C,EAAe8B,OAAQ,CAAE6F,SAAS,CAAE9H,MAAOuC,aCRnD,QAAlBzD,EAAAiJ,WAAWC,eAAO,IAAAlJ,IAAlBiJ,WAAWC,QAAYA,GAEvB,MAGMC,EAAe,IAAIhK,KAGvBA,EAAKiK,SAASC,YAEZA,YAASrJ,GAAAS,EAAA4I,GAAYC,+BAAAA,cARD,UAQmC,IAGlDC,KAAapK,ICMhBqK,EAAWxJ,WAAAyD,cAAEA,EAAagG,UAAEA,GAASzJ,EAAK0J,EAAMjK,EAAAO,EAArC,+BACf,MAAM2J,EAAUC,EACXjJ,OAAAC,OAAAD,OAAAC,OAAA,CAAA,EAAA8I,UACHG,EACAC,YAAWnJ,OAAAC,OAAAD,OAAAC,OAAA,CAAA,EACN8I,EAAOI,cACV,qBAAsB,SACtB,8BAAiD,UAAZ,OAAPC,cAAO,IAAPA,aAAO,EAAPA,QAASC,gBAAU,IAAAvJ,OAAA,EAAAA,EAAAwJ,OAAQ,GACzD,wBAAyB,cAIvBC,UAAEA,EAASC,OAAEA,GAAWT,EAExBhB,EAA6C,CAAA,EAgC7C0B,ECtDe,EAAC5G,EAAcC,KAA4B,CAChEa,KAAMf,EAASC,EAAKC,GACpB4G,UAAW/B,EAAc9E,EAAKC,GAC9BzC,OAAQsF,EAAW9C,EAAKC,GACxB6G,IAAK9C,EAAgBhE,EAAKC,GAC1BmD,IAAKD,EAAQnD,EAAKC,GAClB8G,WAAYzD,EAAetD,EAAKC,GAChC+G,KAAMtD,EAAS1D,EAAKC,GACpBgH,MAAOrD,EAAU5D,EAAKC,GACtBoF,KAAMF,EAASnF,EAAKC,GACpBuF,MAAOD,EAAUvF,EAAKC,KD4CHiH,CAAef,EAASlG,GAErCD,iCACDmG,GAAO,CAOVS,aAGAlL,aAAayL,GACX,KAAKA,aAAA,EAAAA,EAAQC,KAAK,MAAMC,MAAM,gCAE9B,GAAInC,EAAKiC,EAAOC,KAAM,OAAOlC,EAAKiC,EAAOC,KAKzC,GAFAjK,OAAOC,OAAO8H,OAhDAxJ,WAChB,GAAIuK,EACF,IACE,MAAMqB,EAAYC,KAAKC,MAAMvB,GACvBhB,QAAYwC,EAAUH,GAC5B,MAAO,CACL,CAACA,EAAUF,KAAMnC,EAKpB,CAHC,MAAOyC,GAEP,MADAf,SAAAA,EAAQgB,MAAM,0CAA2CD,GACnD,IAAIL,MAAM,6BACjB,CAGH,MAGMO,SAHoBzB,EAAQxF,WAC/BhE,IAAI,WAAW+J,KACfmB,MAAMjM,GAASA,EAAKkM,UACe5C,KACtC,OAAKvH,MAAMC,QAAQgK,UACQG,QAAQC,IACjCJ,EAAWK,KAAIvM,MAAOuJ,GAAQ,CAACA,EAAImC,UAAWK,EAAUxC,QAGtCiD,QAClB,CAACC,GAAMf,EAAKgB,KAAUhB,EAAWjK,OAAAC,OAAAD,OAAAC,OAAA,CAAA,EAAA+K,IAAK,CAACf,EAAIiB,YAAaD,IAAQD,GAChE,CAAE,GAPmC,EAQtC,EAsB2BG,KAErBpD,EAAKiC,EAAOC,KAAM,MAAMC,MAAM,gCAEnC,OAAOnC,EAAKiC,EAAOC,IACpB,EAOD1L,kBAAkB0H,SAEhB,MACM1F,SADY6K,EAAUnF,EAAKpD,EAAIwI,OAAQ,CAAEC,eAAgB,KAC7CC,QAElB,GAAIhL,IACFA,EAAMiL,IAAe,QAATnM,EAAAkB,EAAMiL,WAAG,IAAAnM,OAAA,EAAAA,EAAEoM,MAAM,KAAKC,MAC9BnL,EAAMiL,MAAQjC,GAEhB,MAAM,IAAIoC,EAAOC,yBACf,+BACA,MACA,gBAKN,MAAO,CAAE3F,MAAK1F,QACf,EAODhC,sBAAsBsN,GACpB,IAAKA,EAAc,MAAM3B,MAAM,4CAE/B,IAEE,aADoBrH,EAAIiJ,YAAYD,EAMrC,CAJC,MAAOrB,GAGP,MADAhB,SAAAA,EAAQgB,MAAM,4BAA6BA,GACrCN,MAAM,4BACb,CACF,EAOD3L,qBAAqBwN,WACnB,IAAKA,EAAc,MAAM7B,MAAM,kDAE/B,UACQrH,EAAIiJ,YAAYC,GACtB,MAAMC,QAAgBnJ,EAAIoJ,QAAQF,GAClC,GAAIC,EAAQE,GAAI,CAEd,aADoBrJ,EAAIiJ,YAA0B,QAAdzM,EAAA2M,EAAQtN,YAAM,IAAAW,OAAA,EAAAA,EAAA8M,WAEnD,CAED,MAAMjC,MAAmB,QAAbpK,EAAAkM,EAAQxB,aAAK,IAAA1K,OAAA,EAAAA,EAAEsM,aAK5B,CAJC,MAAOC,GAGP,MADA7C,SAAAA,EAAQgB,MAAM,kCAAmC6B,GAC3CnC,MAAM,kCACb,CACF,EAQD3L,gCACEsN,EACAE,GAEA,IAAKF,IAAiBE,EAAc,MAAM7B,MAAM,6CAEhD,IAEE,aADoBrH,EAAIyJ,gBAAgBT,EAKzC,CAHC,MAAOrB,GAEPhB,SAAAA,EAAQ+C,IAAI,mDACb,CAED,OAAO1J,EAAI2J,eAAeT,EAC3B,EAODxN,wBAAwBmL,GACtB,IAAKA,EAAW,MAAMQ,MAAM,gCAE5B,IAAIzL,EACJ,IACEA,QAAaoE,EAAI6G,UAAU+C,SAAS/C,EAIrC,CAHC,MAAOc,GAEP,MADAhB,SAAAA,EAAQgB,MAAM,gCAAiCA,GACzCN,MAAM,gCACb,CAED,MAAMiC,WAAEA,GAAe1N,EAAKC,KAC5B,IAAKyN,EAEH,MADA3C,SAAAA,EAAQgB,MAAM,gDACRN,MAAM,iCAGd,IAEE,aADoBrH,EAAIiJ,YAAYK,EAKrC,CAHC,MAAO3B,GAEP,MADAhB,SAAAA,EAAQgB,MAAM,sCAAuCA,GAC/CN,MAAM,gCACb,CACF,EAQDwC,oBAAmB,CAACvM,EAA8BmG,IACzCzD,EAAI8J,0BAA0BxM,EAAU,KAAMmG,GASvDqG,0BACExM,EACAE,EACAiG,GAEA,MAAMsG,EAAU1M,EAA2BC,EdnOb,ccmO6CE,GAC3E,OAAOiG,EAAYuG,OAAOC,GAASF,EAAQG,SAASD,IACrD,EAQDE,cAAa,CAAC7M,EAA8BgD,IACnCN,EAAIoK,oBAAoB9M,EAAU,KAAMgD,GASjD8J,oBAAoB9M,EAA8BE,EAAgB8C,GAChE,MAAM+J,EAAahN,EAA2BC,EdtPtB,QcsPgDE,GACxE,OAAO8C,EAAM0J,OAAOhD,GAASqD,EAAWH,SAASlD,IAClD,IAGH,OAAOsD,EACLtK,EACA,CACE,mBACA,iBACA,sBACA,mBACA,uBACA,uBACA,iBACA,gBACA,cACA,yBACA,yBACA,WAEFxE,EACD,EAoBHwK,EAAQuE,uBdxS8B,McyStCvE,EAAQwE,uBdvS8B"}

package/package.json

@@ -1,14 +1,20 @@
 {
   "name": "@descope/node-sdk",
-  "version": "1.5.0",
+  "version": "1.5.2",
   "description": "Node.js library used to integrate with Descope",
   "typings": "./dist/index.d.ts",
   "main": "dist/cjs/index.cjs.js",
   "module": "./dist/index.esm.js",
   "types": "dist/index.d.ts",
   "exports": {
-    "require": "./dist/cjs/index.cjs.js",
-    "import": "./dist/index.esm.js"
+    "require": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/cjs/index.cjs.js"
+    },
+    "import": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.esm.js"
+    }
   },
   "type": "module",
   "files": [
@@ -49,7 +55,7 @@
     "authentication"
   ],
   "devDependencies": {
-    "@rollup/plugin-commonjs": "^24.0.0",
+    "@rollup/plugin-commonjs": "^25.0.0",
     "@rollup/plugin-json": "^4.1.0",
     "@rollup/plugin-node-resolve": "^13.3.0",
     "@rollup/plugin-replace": "^5.0.0",
@@ -95,8 +101,8 @@
     "typescript": "^4.6.4"
   },
   "dependencies": {
-    "@descope/core-js-sdk": "1.2.1",
-    "jose": "4.14.1",
+    "@descope/core-js-sdk": "1.3.4",
+    "jose": "4.14.4",
     "node-fetch-commonjs": "3.2.4"
   },
   "peerDependencies": {