@descope/node-sdk 1.6.11 → 1.6.13

package/dist/index.d.ts

@@ -341,6 +341,8 @@ declare type UserPasswordHashed = {
     pbkdf2?: UserPasswordPbkdf2;
     firebase?: UserPasswordFirebase;
     django?: UserPasswordDjango;
+    phpass?: UserPasswordPhpass;
+    md5?: UserPasswordMd5;
 };
 declare type UserPasswordBcrypt = {
     hash: string;
@@ -362,6 +364,15 @@ declare type UserPasswordFirebase = {
 declare type UserPasswordDjango = {
     hash: string;
 };
+declare type UserPasswordPhpass = {
+    hash: string;
+    salt: string;
+    iterations: number;
+    type: 'md5' | 'sha512';
+};
+declare type UserPasswordMd5 = {
+    hash: string;
+};
 declare type UserMapping = {
     name: string;
     email: string;
@@ -446,11 +457,15 @@ declare type SSOSAMLSettings = {
     entityId: string;
     roleMappings?: RoleMappings;
     attributeMapping?: AttributeMapping;
+    spACSUrl?: string;
+    spEntityId?: string;
 };
 declare type SSOSAMLByMetadataSettings = {
     idpMetadataUrl: string;
     roleMappings?: RoleMappings;
     attributeMapping?: AttributeMapping;
+    spACSUrl?: string;
+    spEntityId?: string;
 };
 declare type ProviderTokenOptions = {
     withRefreshToken?: boolean;
@@ -470,6 +485,7 @@ declare type UserFailedResponse = {
 declare type InviteBatchResponse = {
     createdUsers: UserResponse[];
     failedUsers: UserFailedResponse[];
+    additionalErrors: Record<string, string>;
 };
 /**
  * Search options to filter which audit records we should retrieve.
@@ -599,6 +615,60 @@ declare type AuthzModified = {
     targets: string[];
     schemaChanged: boolean;
 };
+declare type ExportSnapshotResponse = {
+    /** All project settings and configurations represented as JSON files */
+    files: Record<string, any>;
+};
+declare type ImportSnapshotRequest = {
+    /** All project settings and configurations represented as JSON files */
+    files: Record<string, any>;
+    /**
+     * An optional map of project entities and their secrets that will be
+     * injected into the snapshot before import (see below)
+     */
+    inputSecrets?: SnapshotSecrets;
+};
+declare type ValidateSnapshotRequest = {
+    /** All project settings and configurations represented as JSON files */
+    files: Record<string, any>;
+    /**
+     * An optional map of project entities and their secrets that will be
+     * injected into the snapshot before validation (see below)
+     */
+    inputSecrets?: SnapshotSecrets;
+};
+declare type ValidateSnapshotResponse = {
+    /** Whether the validation passed or not (true if and only if `failures` is empty) */
+    ok: boolean;
+    /** An array with `string` representations of any validation failures that were found */
+    failures?: string[];
+    /**
+     * An optional object that lists which if any secret values need to be provided in
+     * the request for an `importSnapshot` call so it doesn't fail (see below)
+     */
+    missingSecrets?: SnapshotSecrets;
+};
+declare type SnapshotSecrets = {
+    /** Any missing or input secrets for connectors in a snapshot */
+    connectors?: SnapshotSecret[];
+    /** Any missing or input secrets for OAuth providers in a snapshot */
+    oauthProviders?: SnapshotSecret[];
+};
+declare type SnapshotSecret = {
+    /** The id of the project entity that requires this secret */
+    id: string;
+    /** The name of the project entity that requires this secret */
+    name: string;
+    /** The type of secret, e.g., "bearertoken", "password" */
+    type: string;
+    /**
+     * The cleartext value of the secret. This value must not be empty when used in
+     * request objects when calling ValidateSnapshot and ImportSnapshot. Conversely,
+     * this value is an empty string when returned in ValidateSnapshotResponse to
+     * signify that this is a missing secret.
+     */
+    value: string;
+};
 declare type CloneProjectResponse = {
     projectId: string;
     projectName: string;
@@ -611,6 +681,20 @@ declare type Project = {
     environment?: string;
     tags?: string[];
 };
+declare type FGASchema = {
+    dsl: string;
+};
+declare type FGARelation = {
+    resource: string;
+    resourceType?: string;
+    relation: string;
+    target: string;
+    targetType?: string;
+};
+declare type CheckResponseRelation = {
+    allowed: boolean;
+    tuple: FGARelation;
+};
 
 interface UserOptions {
     email?: string;
@@ -689,10 +773,11 @@ declare const nodeSdk: {
                         sendMail?: boolean;
                         sendSMS?: boolean;
                         templateOptions?: TemplateOptions;
+                        templateId?: string;
                     }): Promise<SdkResponse<_descope_core_js_sdk.UserResponse>>;
-                    (loginId: string, email?: string, phone?: string, displayName?: string, roles?: string[], userTenants?: AssociatedTenant[], customAttributes?: Record<string, AttributesTypes>, picture?: string, verifiedEmail?: boolean, verifiedPhone?: boolean, inviteUrl?: string, sendMail?: boolean, sendSMS?: boolean, givenName?: string, middleName?: string, familyName?: string, additionalLoginIds?: string[]): Promise<SdkResponse<_descope_core_js_sdk.UserResponse>>;
+                    (loginId: string, email?: string, phone?: string, displayName?: string, roles?: string[], userTenants?: AssociatedTenant[], customAttributes?: Record<string, AttributesTypes>, picture?: string, verifiedEmail?: boolean, verifiedPhone?: boolean, inviteUrl?: string, sendMail?: boolean, sendSMS?: boolean, givenName?: string, middleName?: string, familyName?: string, additionalLoginIds?: string[], templateId?: string): Promise<SdkResponse<_descope_core_js_sdk.UserResponse>>;
                 };
-                inviteBatch: (users: User[], inviteUrl?: string, sendMail?: boolean, sendSMS?: boolean, templateOptions?: TemplateOptions) => Promise<SdkResponse<InviteBatchResponse>>;
+                inviteBatch: (users: User[], inviteUrl?: string, sendMail?: boolean, sendSMS?: boolean, templateOptions?: TemplateOptions, templateId?: string) => Promise<SdkResponse<InviteBatchResponse>>;
                 update: {
                     (loginId: string, options?: UserOptions): Promise<SdkResponse<_descope_core_js_sdk.UserResponse>>;
                     (loginId: string, email?: string, phone?: string, displayName?: string, roles?: string[], userTenants?: AssociatedTenant[], customAttributes?: Record<string, AttributesTypes>, picture?: string, verifiedEmail?: boolean, verifiedPhone?: boolean, givenName?: string, middleName?: string, familyName?: string, additionalLoginIds?: string[]): Promise<SdkResponse<_descope_core_js_sdk.UserResponse>>;
@@ -706,6 +791,25 @@ declare const nodeSdk: {
                 logoutUser: (loginId: string) => Promise<SdkResponse<never>>;
                 logoutUserByUserId: (userId: string) => Promise<SdkResponse<never>>;
                 searchAll: (tenantIds?: string[], roles?: string[], limit?: number, page?: number, testUsersOnly?: boolean, withTestUser?: boolean, customAttributes?: Record<string, AttributesTypes>, statuses?: UserStatus[], emails?: string[], phones?: string[]) => Promise<SdkResponse<_descope_core_js_sdk.UserResponse[]>>;
+                searchTestUsers: (searchReq: {
+                    page?: number;
+                    limit?: number;
+                    sort?: {
+                        field: string;
+                        desc?: boolean;
+                    }[];
+                    text?: string;
+                    emails?: string[];
+                    phones?: string[];
+                    statuses?: UserStatus[];
+                    roles?: string[];
+                    tenantIds?: string[];
+                    customAttributes?: Record<string, AttributesTypes>;
+                    withTestUser?: boolean;
+                    testUsersOnly?: boolean;
+                    ssoAppIds?: string[];
+                    loginIds?: string[];
+                }) => Promise<SdkResponse<_descope_core_js_sdk.UserResponse[]>>;
                 search: (searchReq: {
                     page?: number;
                     limit?: number;
@@ -761,6 +865,9 @@ declare const nodeSdk: {
                 updateTags: (tags: string[]) => Promise<SdkResponse<never>>;
                 clone: (name: string, environment?: "production", tags?: string[]) => Promise<SdkResponse<CloneProjectResponse>>;
                 listProjects: () => Promise<SdkResponse<Project[]>>;
+                exportSnapshot: () => Promise<SdkResponse<ExportSnapshotResponse>>;
+                importSnapshot: (request: ImportSnapshotRequest) => Promise<SdkResponse<never>>;
+                validateSnapshot: (request: ValidateSnapshotRequest) => Promise<SdkResponse<ValidateSnapshotResponse>>;
                 export: () => Promise<SdkResponse<Record<string, any>>>;
                 import: (files: Record<string, any>) => Promise<SdkResponse<never>>;
             };
@@ -811,7 +918,7 @@ declare const nodeSdk: {
             };
             jwt: {
                 update: (jwt: string, customClaims?: Record<string, any>) => Promise<SdkResponse<UpdateJWTResponse>>;
-                impersonate: (impersonatorId: string, loginId: string, validateConsent: boolean) => Promise<SdkResponse<UpdateJWTResponse>>;
+                impersonate: (impersonatorId: string, loginId: string, validateConsent: boolean, customClaims?: Record<string, any>, selectedTenant?: string) => Promise<SdkResponse<UpdateJWTResponse>>;
             };
             permission: {
                 create: (name: string, description?: string) => Promise<SdkResponse<never>>;
@@ -867,6 +974,13 @@ declare const nodeSdk: {
                 whatCanTargetAccess: (target: string) => Promise<SdkResponse<AuthzRelation[]>>;
                 getModified: (since: Date) => Promise<SdkResponse<AuthzModified>>;
             };
+            fga: {
+                saveSchema: (schema: FGASchema) => Promise<SdkResponse<never>>;
+                deleteSchema: () => Promise<SdkResponse<never>>;
+                createRelations: (relations: FGARelation[]) => Promise<SdkResponse<never>>;
+                deleteRelations: (relations: FGARelation[]) => Promise<SdkResponse<never>>;
+                check: (relations: FGARelation[]) => Promise<SdkResponse<CheckResponseRelation[]>>;
+            };
         };
         getKey: (header: JWTHeaderParameters) => Promise<KeyLike | Uint8Array>;
         validateJwt: (jwt: string) => Promise<AuthenticationInfo>;
@@ -928,6 +1042,7 @@ declare const nodeSdk: {
                     phone?: string;
                 }, signUpOptions?: {
                     customClaims?: Record<string, any>;
+                    templateId?: string;
                     templateOptions?: {
                         [x: string]: string;
                     };
@@ -943,6 +1058,7 @@ declare const nodeSdk: {
                     phone?: string;
                 }, signUpOptions?: {
                     customClaims?: Record<string, any>;
+                    templateId?: string;
                     templateOptions?: {
                         [x: string]: string;
                     };
@@ -958,6 +1074,7 @@ declare const nodeSdk: {
                     phone?: string;
                 }, signUpOptions?: {
                     customClaims?: Record<string, any>;
+                    templateId?: string;
                     templateOptions?: {
                         [x: string]: string;
                     };
@@ -973,6 +1090,7 @@ declare const nodeSdk: {
                     phone?: string;
                 }, signUpOptions?: {
                     customClaims?: Record<string, any>;
+                    templateId?: string;
                     templateOptions?: {
                         [x: string]: string;
                     };
@@ -1064,6 +1182,7 @@ declare const nodeSdk: {
                     phone?: string;
                 }, signUpOptions?: {
                     customClaims?: Record<string, any>;
+                    templateId?: string;
                     templateOptions?: {
                         [x: string]: string;
                     };
@@ -1079,6 +1198,7 @@ declare const nodeSdk: {
                     phone?: string;
                 }, signUpOptions?: {
                     customClaims?: Record<string, any>;
+                    templateId?: string;
                     templateOptions?: {
                         [x: string]: string;
                     };
@@ -1094,6 +1214,7 @@ declare const nodeSdk: {
                     phone?: string;
                 }, signUpOptions?: {
                     customClaims?: Record<string, any>;
+                    templateId?: string;
                     templateOptions?: {
                         [x: string]: string;
                     };
@@ -1109,6 +1230,7 @@ declare const nodeSdk: {
                     phone?: string;
                 }, signUpOptions?: {
                     customClaims?: Record<string, any>;
+                    templateId?: string;
                     templateOptions?: {
                         [x: string]: string;
                     };
@@ -1119,6 +1241,7 @@ declare const nodeSdk: {
             signUpOrIn: {
                 sms: (loginId: string, URI?: string, signUpOptions?: {
                     customClaims?: Record<string, any>;
+                    templateId?: string;
                     templateOptions?: {
                         [x: string]: string;
                     };
@@ -1127,6 +1250,7 @@ declare const nodeSdk: {
                 }>>;
                 voice: (loginId: string, URI?: string, signUpOptions?: {
                     customClaims?: Record<string, any>;
+                    templateId?: string;
                     templateOptions?: {
                         [x: string]: string;
                     };
@@ -1135,6 +1259,7 @@ declare const nodeSdk: {
                 }>>;
                 whatsapp: (loginId: string, URI?: string, signUpOptions?: {
                     customClaims?: Record<string, any>;
+                    templateId?: string;
                     templateOptions?: {
                         [x: string]: string;
                     };
@@ -1143,6 +1268,7 @@ declare const nodeSdk: {
                 }>>;
                 email: (loginId: string, URI?: string, signUpOptions?: {
                     customClaims?: Record<string, any>;
+                    templateId?: string;
                     templateOptions?: {
                         [x: string]: string;
                     };
@@ -1199,6 +1325,7 @@ declare const nodeSdk: {
             }>>;
             signUpOrIn: (loginId: string, URI?: string, signUpOptions?: {
                 customClaims?: Record<string, any>;
+                templateId?: string;
                 templateOptions?: {
                     [x: string]: string;
                 };
@@ -1212,6 +1339,7 @@ declare const nodeSdk: {
                 phone?: string;
             }, signUpOptions?: {
                 customClaims?: Record<string, any>;
+                templateId?: string;
                 templateOptions?: {
                     [x: string]: string;
                 };
@@ -1277,6 +1405,7 @@ declare const nodeSdk: {
         notp: {
             signUpOrIn: (loginId?: string, signUpOptions?: {
                 customClaims?: Record<string, any>;
+                templateId?: string;
                 templateOptions?: {
                     [x: string]: string;
                 };
@@ -1294,6 +1423,7 @@ declare const nodeSdk: {
                 phone?: string;
             }, signUpOptions?: {
                 customClaims?: Record<string, any>;
+                templateId?: string;
                 templateOptions?: {
                     [x: string]: string;
                 };
@@ -1314,7 +1444,7 @@ declare const nodeSdk: {
         };
         webauthn: {
             signUp: {
-                start: (loginId: string, origin: string, name: string) => Promise<SdkResponse<{
+                start: (loginId: string, origin: string, name: string, passkeyOptions?: _descope_core_js_sdk.PasskeyOptions) => Promise<SdkResponse<{
                     transactionId: string;
                     options: string;
                     create: boolean;
@@ -1325,7 +1455,7 @@ declare const nodeSdk: {
                 }>>;
             };
             signIn: {
-                start: (loginId: string, origin: string, loginOptions?: _descope_core_js_sdk.LoginOptions, token?: string) => Promise<SdkResponse<{
+                start: (loginId: string, origin: string, loginOptions?: _descope_core_js_sdk.LoginOptions, token?: string, passkeyOptions?: _descope_core_js_sdk.PasskeyOptions) => Promise<SdkResponse<{
                     transactionId: string;
                     options: string;
                     create: boolean;
@@ -1336,14 +1466,14 @@ declare const nodeSdk: {
                 }>>;
             };
             signUpOrIn: {
-                start: (loginId: string, origin: string) => Promise<SdkResponse<{
+                start: (loginId: string, origin: string, passkeyOptions?: _descope_core_js_sdk.PasskeyOptions) => Promise<SdkResponse<{
                     transactionId: string;
                     options: string;
                     create: boolean;
                 }>>;
             };
             update: {
-                start: (loginId: string, origin: string, token: string) => Promise<SdkResponse<{
+                start: (loginId: string, origin: string, token: string, passkeyOptions?: _descope_core_js_sdk.PasskeyOptions) => Promise<SdkResponse<{
                     transactionId: string;
                     options: string;
                     create: boolean;
@@ -1361,6 +1491,7 @@ declare const nodeSdk: {
                 phone?: string;
             }, signUpOptions?: {
                 customClaims?: Record<string, any>;
+                templateId?: string;
                 templateOptions?: {
                     [x: string]: string;
                 };
@@ -1414,7 +1545,12 @@ declare const nodeSdk: {
                 locale?: string;
                 oidcPrompt?: string;
                 oidcErrorRedirectUri?: string;
-            }, conditionInteractionId?: string, interactionId?: string, version?: number, componentsVersion?: string, input?: {
+                nativeOptions?: {
+                    platform: "ios" | "android";
+                    oauthProvider?: string;
+                    oauthRedirect?: string;
+                };
+            }, conditionInteractionId?: string, interactionId?: string, componentsVersion?: string, flowVersions?: Record<string, number>, input?: {
                 [x: string]: string | number | boolean | (string | number | boolean | (string | number | boolean | (string | number | boolean | (string | number | boolean | (string | number | boolean | (string | number | boolean | (string | number | boolean | (string | number | boolean | (string | number | boolean | (string | number | boolean | (string | number | boolean | any)[])[])[])[])[])[])[])[])[])[])[];
             }) => Promise<SdkResponse<_descope_core_js_sdk.FlowResponse>>;
             next: (executionId: string, stepId: string, interactionId: string, version?: number, componentsVersion?: string, input?: {

package/dist/index.esm.js

@@ -1,2 +1,2 @@
-import{__rest as e}from"tslib";import t,{transformResponse as s,wrapWith as a}from"@descope/core-js-sdk";import{jwtVerify as n,errors as o,importJWK as i}from"jose";import{Headers as r,fetch as l}from"cross-fetch";var d;null!==(d=globalThis.Headers)&&void 0!==d||(globalThis.Headers=r);const p=(...e)=>(e.forEach((e=>{var t,s;e&&"object"==typeof e&&(null!==(t=(s=e).highWaterMark)&&void 0!==t||(s.highWaterMark=31457280))})),l(...e)),m=t=>async(...s)=>{var a,n,o;const i=await t(...s);if(!i.data)return i;let r=i.data,{refreshJwt:l}=r,d=e(r,["refreshJwt"]);const p=[];var m;return l?p.push(`${"DSR"}=${l}; Domain=${(null==(m=d)?void 0:m.cookieDomain)||""}; Max-Age=${(null==m?void 0:m.cookieMaxAge)||""}; Path=${(null==m?void 0:m.cookiePath)||"/"}; HttpOnly; SameSite=Strict`):(null===(a=i.response)||void 0===a?void 0:a.headers.get("set-cookie"))&&(l=((e,t)=>{const s=null==e?void 0:e.match(RegExp(`(?:^|;\\s*)${t}=([^;]*)`));return s?s[1]:null})(null===(n=i.response)||void 0===n?void 0:n.headers.get("set-cookie"),"DSR"),p.push(null===(o=i.response)||void 0===o?void 0:o.headers.get("set-cookie"))),Object.assign(Object.assign({},i),{data:Object.assign(Object.assign({},i.data),{refreshJwt:l,cookies:p})})};function c(e,t,s){var a,n;const o=s?null===(n=null===(a=e.token.tenants)||void 0===a?void 0:a[s])||void 0===n?void 0:n[t]:e.token[t];return Array.isArray(o)?o:[]}function g(e,t){var s;return!!(null===(s=e.token.tenants)||void 0===s?void 0:s[t])}var u={create:"/v1/mgmt/user/create",createBatch:"/v1/mgmt/user/create/batch",update:"/v1/mgmt/user/update",patch:"/v1/mgmt/user/patch",delete:"/v1/mgmt/user/delete",deleteAllTestUsers:"/v1/mgmt/user/test/delete/all",load:"/v1/mgmt/user",logout:"/v1/mgmt/user/logout",search:"/v2/mgmt/user/search",getProviderToken:"/v1/mgmt/user/provider/token",updateStatus:"/v1/mgmt/user/update/status",updateLoginId:"/v1/mgmt/user/update/loginid",updateEmail:"/v1/mgmt/user/update/email",updatePhone:"/v1/mgmt/user/update/phone",updateDisplayName:"/v1/mgmt/user/update/name",updatePicture:"/v1/mgmt/user/update/picture",updateCustomAttribute:"/v1/mgmt/user/update/customAttribute",setRole:"/v1/mgmt/user/update/role/set",addRole:"/v1/mgmt/user/update/role/add",removeRole:"/v1/mgmt/user/update/role/remove",setSSOApps:"/v1/mgmt/user/update/ssoapp/set",addSSOApps:"/v1/mgmt/user/update/ssoapp/add",removeSSOApps:"/v1/mgmt/user/update/ssoapp/remove",addTenant:"/v1/mgmt/user/update/tenant/add",removeTenant:"/v1/mgmt/user/update/tenant/remove",setPassword:"/v1/mgmt/user/password/set",setTemporaryPassword:"/v1/mgmt/user/password/set/temporary",setActivePassword:"/v1/mgmt/user/password/set/active",expirePassword:"/v1/mgmt/user/password/expire",removeAllPasskeys:"/v1/mgmt/user/passkeys/delete",generateOTPForTest:"/v1/mgmt/tests/generate/otp",generateMagicLinkForTest:"/v1/mgmt/tests/generate/magiclink",generateEnchantedLinkForTest:"/v1/mgmt/tests/generate/enchantedlink",generateEmbeddedLink:"/v1/mgmt/user/signin/embeddedlink",history:"/v1/mgmt/user/history"},h={updateName:"/v1/mgmt/project/update/name",updateTags:"/v1/mgmt/project/update/tags",clone:"/v1/mgmt/project/clone",export:"/v1/mgmt/project/export",import:"/v1/mgmt/project/import",projectsList:"/v1/mgmt/projects/list"},v={create:"/v1/mgmt/accesskey/create",load:"/v1/mgmt/accesskey",search:"/v1/mgmt/accesskey/search",update:"/v1/mgmt/accesskey/update",deactivate:"/v1/mgmt/accesskey/deactivate",activate:"/v1/mgmt/accesskey/activate",delete:"/v1/mgmt/accesskey/delete"},k={create:"/v1/mgmt/tenant/create",update:"/v1/mgmt/tenant/update",delete:"/v1/mgmt/tenant/delete",load:"/v1/mgmt/tenant",settings:"/v1/mgmt/tenant/settings",loadAll:"/v1/mgmt/tenant/all",searchAll:"/v1/mgmt/tenant/search",generateSSOConfigurationLink:"/v1/mgmt/tenant/adminlinks/sso/generate"},C={oidcCreate:"/v1/mgmt/sso/idp/app/oidc/create",samlCreate:"/v1/mgmt/sso/idp/app/saml/create",oidcUpdate:"/v1/mgmt/sso/idp/app/oidc/update",samlUpdate:"/v1/mgmt/sso/idp/app/saml/update",delete:"/v1/mgmt/sso/idp/app/delete",load:"/v1/mgmt/sso/idp/app/load",loadAll:"/v1/mgmt/sso/idp/apps/load"},f={settings:"/v1/mgmt/sso/settings",metadata:"/v1/mgmt/sso/metadata",mapping:"/v1/mgmt/sso/mapping",settingsv2:"/v2/mgmt/sso/settings",oidc:{configure:"/v1/mgmt/sso/oidc"},saml:{configure:"/v1/mgmt/sso/saml",metadata:"/v1/mgmt/sso/saml/metadata"}},y={update:"/v1/mgmt/jwt/update",impersonate:"/v1/mgmt/impersonate"},I={settings:"/v1/mgmt/password/settings"},b={create:"/v1/mgmt/permission/create",update:"/v1/mgmt/permission/update",delete:"/v1/mgmt/permission/delete",loadAll:"/v1/mgmt/permission/all"},w={create:"/v1/mgmt/role/create",update:"/v1/mgmt/role/update",delete:"/v1/mgmt/role/delete",loadAll:"/v1/mgmt/role/all",search:"/v1/mgmt/role/search"},A={list:"/v1/mgmt/flow/list",delete:"/v1/mgmt/flow/delete",export:"/v1/mgmt/flow/export",import:"/v1/mgmt/flow/import"},N={export:"/v1/mgmt/theme/export",import:"/v1/mgmt/theme/import"},O={loadAllGroups:"/v1/mgmt/group/all",loadAllGroupsForMember:"/v1/mgmt/group/member/all",loadAllGroupMembers:"/v1/mgmt/group/members"},S={search:"/v1/mgmt/audit/search",createEvent:"/v1/mgmt/audit/event"},j={schemaSave:"/v1/mgmt/authz/schema/save",schemaDelete:"/v1/mgmt/authz/schema/delete",schemaLoad:"/v1/mgmt/authz/schema/load",nsSave:"/v1/mgmt/authz/ns/save",nsDelete:"/v1/mgmt/authz/ns/delete",rdSave:"/v1/mgmt/authz/rd/save",rdDelete:"/v1/mgmt/authz/rd/delete",reCreate:"/v1/mgmt/authz/re/create",reDelete:"/v1/mgmt/authz/re/delete",reDeleteResources:"/v1/mgmt/authz/re/deleteresources",hasRelations:"/v1/mgmt/authz/re/has",who:"/v1/mgmt/authz/re/who",resource:"/v1/mgmt/authz/re/resource",targets:"/v1/mgmt/authz/re/targets",targetAll:"/v1/mgmt/authz/re/targetall",getModified:"/v1/mgmt/authz/getmodified"};const T=(e,t)=>({create:function(a,n,o,i,r,l,d,p,m,c,g,h,v,k){const C="string"==typeof n?{loginId:a,email:n,phone:o,displayName:i,givenName:g,middleName:h,familyName:v,roleNames:r,userTenants:l,customAttributes:d,picture:p,verifiedEmail:m,verifiedPhone:c,additionalLoginIds:k}:Object.assign(Object.assign({loginId:a},n),{roleNames:null==n?void 0:n.roles,roles:void 0});return s(e.httpClient.post(u.create,C,{token:t}),(e=>e.user))},createTestUser:function(a,n,o,i,r,l,d,p,m,c,g,h,v,k){const C="string"==typeof n?{loginId:a,email:n,phone:o,displayName:i,givenName:g,middleName:h,familyName:v,roleNames:r,userTenants:l,customAttributes:d,picture:p,verifiedEmail:m,verifiedPhone:c,additionalLoginIds:k,test:!0}:Object.assign(Object.assign({loginId:a},n),{roleNames:null==n?void 0:n.roles,roles:void 0,test:!0});return s(e.httpClient.post(u.create,C,{token:t}),(e=>e.user))},invite:function(a,n,o,i,r,l,d,p,m,c,g,h,v,k,C,f,y){const I="string"==typeof n?{loginId:a,email:n,phone:o,displayName:i,givenName:k,middleName:C,familyName:f,roleNames:r,userTenants:l,invite:!0,customAttributes:d,picture:p,verifiedEmail:m,verifiedPhone:c,inviteUrl:g,sendMail:h,sendSMS:v,additionalLoginIds:y}:Object.assign(Object.assign({loginId:a},n),{roleNames:null==n?void 0:n.roles,roles:void 0,invite:!0});return s(e.httpClient.post(u.create,I,{token:t}),(e=>e.user))},inviteBatch:(a,n,o,i,r)=>s(e.httpClient.post(u.createBatch,{users:a,invite:!0,inviteUrl:n,sendMail:o,sendSMS:i,templateOptions:r},{token:t}),(e=>e)),update:function(a,n,o,i,r,l,d,p,m,c,g,h,v,k){const C="string"==typeof n?{loginId:a,email:n,phone:o,displayName:i,givenName:g,middleName:h,familyName:v,roleNames:r,userTenants:l,customAttributes:d,picture:p,verifiedEmail:m,verifiedPhone:c,additionalLoginIds:k}:Object.assign(Object.assign({loginId:a},n),{roleNames:null==n?void 0:n.roles,roles:void 0});return s(e.httpClient.post(u.update,C,{token:t}),(e=>e.user))},patch:function(a,n){const o={loginId:a};return void 0!==n.email&&(o.email=n.email),void 0!==n.phone&&(o.phone=n.phone),void 0!==n.displayName&&(o.displayName=n.displayName),void 0!==n.givenName&&(o.givenName=n.givenName),void 0!==n.middleName&&(o.middleName=n.middleName),void 0!==n.familyName&&(o.familyName=n.familyName),void 0!==n.roles&&(o.roleNames=n.roles),void 0!==n.userTenants&&(o.userTenants=n.userTenants),void 0!==n.customAttributes&&(o.customAttributes=n.customAttributes),void 0!==n.picture&&(o.picture=n.picture),void 0!==n.verifiedEmail&&(o.verifiedEmail=n.verifiedEmail),void 0!==n.verifiedPhone&&(o.verifiedPhone=n.verifiedPhone),void 0!==n.ssoAppIds&&(o.ssoAppIds=n.ssoAppIds),s(e.httpClient.patch(u.patch,o,{token:t}),(e=>e.user))},delete:a=>s(e.httpClient.post(u.delete,{loginId:a},{token:t})),deleteByUserId:a=>s(e.httpClient.post(u.delete,{userId:a},{token:t})),deleteAllTestUsers:()=>s(e.httpClient.delete(u.deleteAllTestUsers,{token:t})),load:a=>s(e.httpClient.get(u.load,{queryParams:{loginId:a},token:t}),(e=>e.user)),loadByUserId:a=>s(e.httpClient.get(u.load,{queryParams:{userId:a},token:t}),(e=>e.user)),logoutUser:a=>s(e.httpClient.post(u.logout,{loginId:a},{token:t})),logoutUserByUserId:a=>s(e.httpClient.post(u.logout,{userId:a},{token:t})),searchAll:(a,n,o,i,r,l,d,p,m,c)=>s(e.httpClient.post(u.search,{tenantIds:a,roleNames:n,limit:o,page:i,testUsersOnly:r,withTestUser:l,customAttributes:d,statuses:p,emails:m,phones:c},{token:t}),(e=>e.users)),search:a=>s(e.httpClient.post(u.search,Object.assign(Object.assign({},a),{roleNames:a.roles,roles:void 0}),{token:t}),(e=>e.users)),getProviderToken:(a,n,o)=>s(e.httpClient.get(u.getProviderToken,{queryParams:{loginId:a,provider:n,withRefreshToken:(null==o?void 0:o.withRefreshToken)?"true":"false",forceRefresh:(null==o?void 0:o.forceRefresh)?"true":"false"},token:t}),(e=>e)),activate:a=>s(e.httpClient.post(u.updateStatus,{loginId:a,status:"enabled"},{token:t}),(e=>e.user)),deactivate:a=>s(e.httpClient.post(u.updateStatus,{loginId:a,status:"disabled"},{token:t}),(e=>e.user)),updateLoginId:(a,n)=>s(e.httpClient.post(u.updateLoginId,{loginId:a,newLoginId:n},{token:t}),(e=>e.user)),updateEmail:(a,n,o)=>s(e.httpClient.post(u.updateEmail,{loginId:a,email:n,verified:o},{token:t}),(e=>e.user)),updatePhone:(a,n,o)=>s(e.httpClient.post(u.updatePhone,{loginId:a,phone:n,verified:o},{token:t}),(e=>e.user)),updateDisplayName:(a,n,o,i,r)=>s(e.httpClient.post(u.updateDisplayName,{loginId:a,displayName:n,givenName:o,middleName:i,familyName:r},{token:t}),(e=>e.user)),updatePicture:(a,n)=>s(e.httpClient.post(u.updatePicture,{loginId:a,picture:n},{token:t}),(e=>e.user)),updateCustomAttribute:(a,n,o)=>s(e.httpClient.post(u.updateCustomAttribute,{loginId:a,attributeKey:n,attributeValue:o},{token:t}),(e=>e.user)),setRoles:(a,n)=>s(e.httpClient.post(u.setRole,{loginId:a,roleNames:n},{token:t}),(e=>e.user)),addRoles:(a,n)=>s(e.httpClient.post(u.addRole,{loginId:a,roleNames:n},{token:t}),(e=>e.user)),removeRoles:(a,n)=>s(e.httpClient.post(u.removeRole,{loginId:a,roleNames:n},{token:t}),(e=>e.user)),addTenant:(a,n)=>s(e.httpClient.post(u.addTenant,{loginId:a,tenantId:n},{token:t}),(e=>e.user)),removeTenant:(a,n)=>s(e.httpClient.post(u.removeTenant,{loginId:a,tenantId:n},{token:t}),(e=>e.user)),setTenantRoles:(a,n,o)=>s(e.httpClient.post(u.setRole,{loginId:a,tenantId:n,roleNames:o},{token:t}),(e=>e.user)),addTenantRoles:(a,n,o)=>s(e.httpClient.post(u.addRole,{loginId:a,tenantId:n,roleNames:o},{token:t}),(e=>e.user)),removeTenantRoles:(a,n,o)=>s(e.httpClient.post(u.removeRole,{loginId:a,tenantId:n,roleNames:o},{token:t}),(e=>e.user)),addSSOapps:(a,n)=>s(e.httpClient.post(u.addSSOApps,{loginId:a,ssoAppIds:n},{token:t}),(e=>e.user)),setSSOapps:(a,n)=>s(e.httpClient.post(u.setSSOApps,{loginId:a,ssoAppIds:n},{token:t}),(e=>e.user)),removeSSOapps:(a,n)=>s(e.httpClient.post(u.removeSSOApps,{loginId:a,ssoAppIds:n},{token:t}),(e=>e.user)),generateOTPForTestUser:(a,n,o)=>s(e.httpClient.post(u.generateOTPForTest,{deliveryMethod:a,loginId:n,loginOptions:o},{token:t}),(e=>e)),generateMagicLinkForTestUser:(a,n,o,i)=>s(e.httpClient.post(u.generateMagicLinkForTest,{deliveryMethod:a,loginId:n,URI:o,loginOptions:i},{token:t}),(e=>e)),generateEnchantedLinkForTestUser:(a,n,o)=>s(e.httpClient.post(u.generateEnchantedLinkForTest,{loginId:a,URI:n,loginOptions:o},{token:t}),(e=>e)),generateEmbeddedLink:(a,n)=>s(e.httpClient.post(u.generateEmbeddedLink,{loginId:a,customClaims:n},{token:t}),(e=>e)),setTemporaryPassword:(a,n)=>s(e.httpClient.post(u.setTemporaryPassword,{loginId:a,password:n},{token:t}),(e=>e)),setActivePassword:(a,n)=>s(e.httpClient.post(u.setActivePassword,{loginId:a,password:n},{token:t}),(e=>e)),setPassword:(a,n)=>s(e.httpClient.post(u.setPassword,{loginId:a,password:n},{token:t}),(e=>e)),expirePassword:a=>s(e.httpClient.post(u.expirePassword,{loginId:a},{token:t}),(e=>e)),removeAllPasskeys:a=>s(e.httpClient.post(u.removeAllPasskeys,{loginId:a},{token:t}),(e=>e)),history:a=>s(e.httpClient.post(u.history,a,{token:t}),(e=>e))}),P=(e,t)=>({updateName:a=>s(e.httpClient.post(h.updateName,{name:a},{token:t})),updateTags:a=>s(e.httpClient.post(h.updateTags,{tags:a},{token:t})),clone:(a,n,o)=>s(e.httpClient.post(h.clone,{name:a,environment:n,tags:o},{token:t})),listProjects:async()=>s(e.httpClient.post(h.projectsList,{},{token:t}),(e=>e.projects.map((({id:e,name:t,environment:s,tags:a})=>({id:e,name:t,environment:s,tags:a}))))),export:()=>s(e.httpClient.post(h.export,{},{token:t}),(e=>e.files)),import:a=>s(e.httpClient.post(h.import,{files:a},{token:t}))}),R=(e,t)=>({create:(a,n,o)=>s(e.httpClient.post(k.create,{name:a,selfProvisioningDomains:n,customAttributes:o},{token:t})),createWithId:(a,n,o,i)=>s(e.httpClient.post(k.create,{id:a,name:n,selfProvisioningDomains:o,customAttributes:i},{token:t})),update:(a,n,o,i)=>s(e.httpClient.post(k.update,{id:a,name:n,selfProvisioningDomains:o,customAttributes:i},{token:t})),delete:(a,n)=>s(e.httpClient.post(k.delete,{id:a,cascade:n},{token:t})),load:a=>s(e.httpClient.get(k.load,{queryParams:{id:a},token:t}),(e=>e)),loadAll:()=>s(e.httpClient.get(k.loadAll,{token:t}),(e=>e.tenants)),searchAll:(a,n,o,i)=>s(e.httpClient.post(k.searchAll,{tenantIds:a,tenantNames:n,tenantSelfProvisioningDomains:o,customAttributes:i},{token:t}),(e=>e.tenants)),getSettings:a=>s(e.httpClient.get(k.settings,{queryParams:{id:a},token:t}),(e=>e)),configureSettings:(a,n)=>s(e.httpClient.post(k.settings,Object.assign(Object.assign({},n),{tenantId:a}),{token:t})),generateSSOConfigurationLink:(a,n)=>s(e.httpClient.post(k.generateSSOConfigurationLink,{tenantId:a,expireTime:n},{token:t}),(e=>e))}),E=(e,t)=>({update:(a,n)=>s(e.httpClient.post(y.update,{jwt:a,customClaims:n},{token:t})),impersonate:(a,n,o)=>s(e.httpClient.post(y.impersonate,{impersonatorId:a,loginId:n,validateConsent:o},{token:t}))}),M=(e,t)=>({create:(a,n)=>s(e.httpClient.post(b.create,{name:a,description:n},{token:t})),update:(a,n,o)=>s(e.httpClient.post(b.update,{name:a,newName:n,description:o},{token:t})),delete:a=>s(e.httpClient.post(b.delete,{name:a},{token:t})),loadAll:()=>s(e.httpClient.get(b.loadAll,{token:t}),(e=>e.permissions))}),x=(e,t)=>({create:(a,n,o,i)=>s(e.httpClient.post(w.create,{name:a,description:n,permissionNames:o,tenantId:i},{token:t})),update:(a,n,o,i,r)=>s(e.httpClient.post(w.update,{name:a,newName:n,description:o,permissionNames:i,tenantId:r},{token:t})),delete:(a,n)=>s(e.httpClient.post(w.delete,{name:a,tenantId:n},{token:t})),loadAll:()=>s(e.httpClient.get(w.loadAll,{token:t}),(e=>e.roles)),search:a=>s(e.httpClient.post(w.search,a,{token:t}),(e=>e.roles))}),L=(e,t)=>({loadAllGroups:a=>s(e.httpClient.post(O.loadAllGroups,{tenantId:a},{token:t})),loadAllGroupsForMember:(a,n,o)=>s(e.httpClient.post(O.loadAllGroupsForMember,{tenantId:a,loginIds:o,userIds:n},{token:t})),loadAllGroupMembers:(a,n)=>s(e.httpClient.post(O.loadAllGroupMembers,{tenantId:a,groupId:n},{token:t}))}),U=(e,t)=>({getSettings:a=>s(e.httpClient.get(f.settings,{queryParams:{tenantId:a},token:t}),(e=>e)),deleteSettings:a=>s(e.httpClient.delete(f.settings,{queryParams:{tenantId:a},token:t})),configureSettings:(a,n,o,i,r,l)=>s(e.httpClient.post(f.settings,{tenantId:a,idpURL:n,entityId:i,idpCert:o,redirectURL:r,domains:l},{token:t})),configureMetadata:(a,n,o,i)=>s(e.httpClient.post(f.metadata,{tenantId:a,idpMetadataURL:n,redirectURL:o,domains:i},{token:t})),configureMapping:(a,n,o)=>s(e.httpClient.post(f.mapping,{tenantId:a,roleMappings:n,attributeMapping:o},{token:t})),configureOIDCSettings:(a,n,o)=>{const i=Object.assign(Object.assign({},n),{userAttrMapping:n.attributeMapping});return delete i.attributeMapping,s(e.httpClient.post(f.oidc.configure,{tenantId:a,settings:i,domains:o},{token:t}))},configureSAMLSettings:(a,n,o,i)=>s(e.httpClient.post(f.saml.configure,{tenantId:a,settings:n,redirectUrl:o,domains:i},{token:t})),configureSAMLByMetadata:(a,n,o,i)=>s(e.httpClient.post(f.saml.metadata,{tenantId:a,settings:n,redirectUrl:o,domains:i},{token:t})),loadSettings:a=>s(e.httpClient.get(f.settingsv2,{queryParams:{tenantId:a},token:t}),(e=>{var t,s;const a=e;return a.oidc&&(a.oidc=Object.assign(Object.assign({},a.oidc),{attributeMapping:a.oidc.userAttrMapping}),delete a.oidc.userAttrMapping),(null===(t=a.saml)||void 0===t?void 0:t.groupsMapping)&&(a.saml.groupsMapping=null===(s=a.saml)||void 0===s?void 0:s.groupsMapping.map((e=>{const t=e;return t.roleName=t.role.name,delete t.role,t}))),a}))}),D=(e,t)=>({create:(a,n,o,i,r,l,d,p)=>s(e.httpClient.post(v.create,{name:a,expireTime:n,roleNames:o,keyTenants:i,userId:r,customClaims:l,description:d,permittedIps:p},{token:t})),load:a=>s(e.httpClient.get(v.load,{queryParams:{id:a},token:t}),(e=>e.key)),searchAll:a=>s(e.httpClient.post(v.search,{tenantIds:a},{token:t}),(e=>e.keys)),update:(a,n,o)=>s(e.httpClient.post(v.update,{id:a,name:n,description:o},{token:t}),(e=>e.key)),deactivate:a=>s(e.httpClient.post(v.deactivate,{id:a},{token:t})),activate:a=>s(e.httpClient.post(v.activate,{id:a},{token:t})),delete:a=>s(e.httpClient.post(v.delete,{id:a},{token:t}))}),F=(e,t)=>({list:()=>s(e.httpClient.post(A.list,{},{token:t})),delete:a=>s(e.httpClient.post(A.delete,{ids:a},{token:t})),export:a=>s(e.httpClient.post(A.export,{flowId:a},{token:t})),import:(a,n,o)=>s(e.httpClient.post(A.import,{flowId:a,flow:n,screens:o},{token:t}))}),z=(e,t)=>({export:()=>s(e.httpClient.post(N.export,{},{token:t})),import:a=>s(e.httpClient.post(N.import,{theme:a},{token:t}))}),q=(e,t)=>({search:a=>{const n=Object.assign(Object.assign({},a),{externalIds:a.loginIds});return delete n.loginIds,s(e.httpClient.post(S.search,n,{token:t}),(e=>null==e?void 0:e.audits.map((e=>{const t=Object.assign(Object.assign({},e),{occurred:parseFloat(e.occurred),loginIds:e.externalIds});return delete t.externalIds,t}))))},createEvent:a=>{const n=Object.assign({},a);return s(e.httpClient.post(S.createEvent,n,{token:t}))}}),$=(e,t)=>({saveSchema:(a,n)=>s(e.httpClient.post(j.schemaSave,{schema:a,upgrade:n},{token:t})),deleteSchema:()=>s(e.httpClient.post(j.schemaDelete,{},{token:t})),loadSchema:()=>s(e.httpClient.post(j.schemaLoad,{},{token:t}),(e=>e.schema)),saveNamespace:(a,n,o)=>s(e.httpClient.post(j.nsSave,{namespace:a,oldName:n,schemaName:o},{token:t})),deleteNamespace:(a,n)=>s(e.httpClient.post(j.nsDelete,{name:a,schemaName:n},{token:t})),saveRelationDefinition:(a,n,o,i)=>s(e.httpClient.post(j.rdSave,{relationDefinition:a,namespace:n,oldName:o,schemaName:i},{token:t})),deleteRelationDefinition:(a,n,o)=>s(e.httpClient.post(j.rdDelete,{name:a,namespace:n,schemaName:o},{token:t})),createRelations:a=>s(e.httpClient.post(j.reCreate,{relations:a},{token:t})),deleteRelations:a=>s(e.httpClient.post(j.reDelete,{relations:a},{token:t})),deleteRelationsForResources:a=>s(e.httpClient.post(j.reDeleteResources,{resources:a},{token:t})),hasRelations:a=>s(e.httpClient.post(j.hasRelations,{relationQueries:a},{token:t}),(e=>e.relationQueries)),whoCanAccess:(a,n,o)=>s(e.httpClient.post(j.who,{resource:a,relationDefinition:n,namespace:o},{token:t}),(e=>e.targets)),resourceRelations:a=>s(e.httpClient.post(j.resource,{resource:a},{token:t}),(e=>e.relations)),targetsRelations:a=>s(e.httpClient.post(j.targets,{targets:a},{token:t}),(e=>e.relations)),whatCanTargetAccess:a=>s(e.httpClient.post(j.targetAll,{target:a},{token:t}),(e=>e.relations)),getModified:a=>s(e.httpClient.post(j.getModified,{since:a?a.getTime():0},{token:t}),(e=>e))}),J=(e,t)=>({createOidcApplication:a=>{var n;return s(e.httpClient.post(C.oidcCreate,Object.assign(Object.assign({},a),{enabled:null===(n=a.enabled)||void 0===n||n}),{token:t}))},createSamlApplication:a=>{var n;return s(e.httpClient.post(C.samlCreate,Object.assign(Object.assign({},a),{enabled:null===(n=a.enabled)||void 0===n||n}),{token:t}))},updateOidcApplication:a=>s(e.httpClient.post(C.oidcUpdate,Object.assign({},a),{token:t})),updateSamlApplication:a=>s(e.httpClient.post(C.samlUpdate,Object.assign({},a),{token:t})),delete:a=>s(e.httpClient.post(C.delete,{id:a},{token:t})),load:a=>s(e.httpClient.get(C.load,{queryParams:{id:a},token:t}),(e=>e)),loadAll:()=>s(e.httpClient.get(C.loadAll,{token:t}),(e=>e.apps))}),K=(e,t)=>({getSettings:a=>s(e.httpClient.get(I.settings,{queryParams:{tenantId:a},token:t}),(e=>e)),configureSettings:(a,n)=>s(e.httpClient.post(I.settings,Object.assign(Object.assign({},n),{tenantId:a}),{token:t}))});var G=Object.freeze({__proto__:null,default:{badRequest:"E011001",missingArguments:"E011002",invalidRequest:"E011003",invalidArguments:"E011004",wrongOTPCode:"E061102",tooManyOTPAttempts:"E061103",enchantedLinkPending:"E062503",userNotFound:"E062108"}});const B=s=>{var r,{managementKey:l,publicKey:d}=s,u=e(s,["managementKey","publicKey"]);const h=t(Object.assign(Object.assign({fetch:p},u),{baseHeaders:Object.assign(Object.assign({},u.baseHeaders),{"x-descope-sdk-name":"nodejs","x-descope-sdk-node-version":(null===(r=null===process||void 0===process?void 0:process.versions)||void 0===r?void 0:r.node)||"","x-descope-sdk-version":"1.6.11"})})),{projectId:v,logger:k}=u,C={},f=((e,t)=>({user:T(e,t),project:P(e,t),accessKey:D(e,t),tenant:R(e,t),ssoApplication:J(e,t),sso:U(e,t),jwt:E(e,t),permission:M(e,t),password:K(e,t),role:x(e,t),group:L(e,t),flow:F(e,t),theme:z(e,t),audit:q(e,t),authz:$(e,t)}))(h,l),y=Object.assign(Object.assign({},h),{refresh:async e=>h.refresh(e),management:f,async getKey(e){if(!(null==e?void 0:e.kid))throw Error("header.kid must not be empty");if(C[e.kid])return C[e.kid];if(Object.assign(C,await(async()=>{if(d)try{const e=JSON.parse(d),t=await i(e);return{[e.kid]:t}}catch(e){throw null==k||k.error("Failed to parse the provided public key",e),new Error(`Failed to parse public key. Error: ${e}`)}const e=(await h.httpClient.get(`v2/keys/${v}`).then((e=>e.json()))).keys;return Array.isArray(e)?(await Promise.all(e.map((async e=>[e.kid,await i(e)])))).reduce(((e,[t,s])=>t?Object.assign(Object.assign({},e),{[t.toString()]:s}):e),{}):{}})()),!C[e.kid])throw Error("failed to fetch matching key");return C[e.kid]},async validateJwt(e){var t;const s=(await n(e,y.getKey,{clockTolerance:5})).payload;if(s&&(s.iss=null===(t=s.iss)||void 0===t?void 0:t.split("/").pop(),s.iss!==v))throw new o.JWTClaimValidationFailed('unexpected "iss" claim value',"iss","check_failed");return{jwt:e,token:s}},async validateSession(e){if(!e)throw Error("session token is required for validation");try{return await y.validateJwt(e)}catch(e){throw null==k||k.error("session validation failed",e),Error(`session validation failed. Error: ${e}`)}},async refreshSession(e){var t,s;if(!e)throw Error("refresh token is required to refresh a session");try{await y.validateJwt(e);const a=await y.refresh(e);if(a.ok){return await y.validateJwt(null===(t=a.data)||void 0===t?void 0:t.sessionJwt)}throw Error(null===(s=a.error)||void 0===s?void 0:s.errorMessage)}catch(e){throw null==k||k.error("refresh token validation failed",e),Error(`refresh token validation failed, Error: ${e}`)}},async validateAndRefreshSession(e,t){if(!e&&!t)throw Error("both session and refresh tokens are empty");try{return await y.validateSession(e)}catch(e){null==k||k.log(`session validation failed with error ${e} - trying to refresh it`)}return y.refreshSession(t)},async exchangeAccessKey(e,t){if(!e)throw Error("access key must not be empty");let s;try{s=await y.accessKey.exchange(e,t)}catch(e){throw null==k||k.error("failed to exchange access key",e),Error(`could not exchange access key - Failed to exchange. Error: ${e}`)}const{sessionJwt:a}=s.data;if(!a)throw null==k||k.error("failed to parse exchange access key response"),Error("could not exchange access key");try{return await y.validateJwt(a)}catch(e){throw null==k||k.error("failed to parse jwt from access key",e),Error(`could not exchange access key - failed to validate jwt. Error: ${e}`)}},validatePermissions:(e,t)=>y.validateTenantPermissions(e,"",t),getMatchedPermissions:(e,t)=>y.getMatchedTenantPermissions(e,"",t),validateTenantPermissions(e,t,s){if(t&&!g(e,t))return!1;const a=c(e,"permissions",t);return s.every((e=>a.includes(e)))},getMatchedTenantPermissions(e,t,s){if(t&&!g(e,t))return[];const a=c(e,"permissions",t);return s.filter((e=>a.includes(e)))},validateRoles:(e,t)=>y.validateTenantRoles(e,"",t),getMatchedRoles:(e,t)=>y.getMatchedTenantRoles(e,"",t),validateTenantRoles(e,t,s){if(t&&!g(e,t))return!1;const a=c(e,"roles",t);return s.every((e=>a.includes(e)))},getMatchedTenantRoles(e,t,s){if(t&&!g(e,t))return[];const a=c(e,"roles",t);return s.filter((e=>a.includes(e)))}});return a(y,["otp.verify.email","otp.verify.sms","otp.verify.voice","otp.verify.whatsapp","magicLink.verify","enchantedLink.signUp","enchantedLink.signIn","oauth.exchange","saml.exchange","totp.verify","webauthn.signIn.finish","webauthn.signUp.finish","refresh"],m)};B.RefreshTokenCookieName="DSR",B.SessionTokenCookieName="DS";export{B as default,G as descopeErrors};
+import{__rest as e}from"tslib";import t,{transformResponse as s,wrapWith as a}from"@descope/core-js-sdk";import{jwtVerify as o,errors as n,importJWK as i}from"jose";import{Headers as r,fetch as l}from"cross-fetch";var d;null!==(d=globalThis.Headers)&&void 0!==d||(globalThis.Headers=r);const p=(...e)=>(e.forEach((e=>{var t,s;e&&"object"==typeof e&&(null!==(t=(s=e).highWaterMark)&&void 0!==t||(s.highWaterMark=31457280))})),l(...e)),m=t=>async(...s)=>{var a,o,n;const i=await t(...s);if(!i.data)return i;let r=i.data,{refreshJwt:l}=r,d=e(r,["refreshJwt"]);const p=[];var m;return l?p.push(`${"DSR"}=${l}; Domain=${(null==(m=d)?void 0:m.cookieDomain)||""}; Max-Age=${(null==m?void 0:m.cookieMaxAge)||""}; Path=${(null==m?void 0:m.cookiePath)||"/"}; HttpOnly; SameSite=Strict`):(null===(a=i.response)||void 0===a?void 0:a.headers.get("set-cookie"))&&(l=((e,t)=>{const s=null==e?void 0:e.match(RegExp(`(?:^|;\\s*)${t}=([^;]*)`));return s?s[1]:null})(null===(o=i.response)||void 0===o?void 0:o.headers.get("set-cookie"),"DSR"),p.push(null===(n=i.response)||void 0===n?void 0:n.headers.get("set-cookie"))),Object.assign(Object.assign({},i),{data:Object.assign(Object.assign({},i.data),{refreshJwt:l,cookies:p})})};function c(e,t,s){var a,o;const n=s?null===(o=null===(a=e.token.tenants)||void 0===a?void 0:a[s])||void 0===o?void 0:o[t]:e.token[t];return Array.isArray(n)?n:[]}function g(e,t){var s;return!!(null===(s=e.token.tenants)||void 0===s?void 0:s[t])}var u={create:"/v1/mgmt/user/create",createTestUser:"/v1/mgmt/user/create/test",createBatch:"/v1/mgmt/user/create/batch",update:"/v1/mgmt/user/update",patch:"/v1/mgmt/user/patch",delete:"/v1/mgmt/user/delete",deleteAllTestUsers:"/v1/mgmt/user/test/delete/all",load:"/v1/mgmt/user",logout:"/v1/mgmt/user/logout",search:"/v2/mgmt/user/search",searchTestUsers:"/v2/mgmt/user/search/test",getProviderToken:"/v1/mgmt/user/provider/token",updateStatus:"/v1/mgmt/user/update/status",updateLoginId:"/v1/mgmt/user/update/loginid",updateEmail:"/v1/mgmt/user/update/email",updatePhone:"/v1/mgmt/user/update/phone",updateDisplayName:"/v1/mgmt/user/update/name",updatePicture:"/v1/mgmt/user/update/picture",updateCustomAttribute:"/v1/mgmt/user/update/customAttribute",setRole:"/v1/mgmt/user/update/role/set",addRole:"/v2/mgmt/user/update/role/add",removeRole:"/v1/mgmt/user/update/role/remove",setSSOApps:"/v1/mgmt/user/update/ssoapp/set",addSSOApps:"/v1/mgmt/user/update/ssoapp/add",removeSSOApps:"/v1/mgmt/user/update/ssoapp/remove",addTenant:"/v1/mgmt/user/update/tenant/add",removeTenant:"/v1/mgmt/user/update/tenant/remove",setPassword:"/v1/mgmt/user/password/set",setTemporaryPassword:"/v1/mgmt/user/password/set/temporary",setActivePassword:"/v1/mgmt/user/password/set/active",expirePassword:"/v1/mgmt/user/password/expire",removeAllPasskeys:"/v1/mgmt/user/passkeys/delete",generateOTPForTest:"/v1/mgmt/tests/generate/otp",generateMagicLinkForTest:"/v1/mgmt/tests/generate/magiclink",generateEnchantedLinkForTest:"/v1/mgmt/tests/generate/enchantedlink",generateEmbeddedLink:"/v1/mgmt/user/signin/embeddedlink",history:"/v1/mgmt/user/history"},h={updateName:"/v1/mgmt/project/update/name",updateTags:"/v1/mgmt/project/update/tags",clone:"/v1/mgmt/project/clone",projectsList:"/v1/mgmt/projects/list",exportSnapshot:"/v1/mgmt/project/snapshot/export",importSnapshot:"/v1/mgmt/project/snapshot/import",validateSnapshot:"/v1/mgmt/project/snapshot/validate"},v={create:"/v1/mgmt/accesskey/create",load:"/v1/mgmt/accesskey",search:"/v1/mgmt/accesskey/search",update:"/v1/mgmt/accesskey/update",deactivate:"/v1/mgmt/accesskey/deactivate",activate:"/v1/mgmt/accesskey/activate",delete:"/v1/mgmt/accesskey/delete"},k={create:"/v1/mgmt/tenant/create",update:"/v1/mgmt/tenant/update",delete:"/v1/mgmt/tenant/delete",load:"/v1/mgmt/tenant",settings:"/v1/mgmt/tenant/settings",loadAll:"/v1/mgmt/tenant/all",searchAll:"/v1/mgmt/tenant/search",generateSSOConfigurationLink:"/v1/mgmt/tenant/adminlinks/sso/generate"},C={oidcCreate:"/v1/mgmt/sso/idp/app/oidc/create",samlCreate:"/v1/mgmt/sso/idp/app/saml/create",oidcUpdate:"/v1/mgmt/sso/idp/app/oidc/update",samlUpdate:"/v1/mgmt/sso/idp/app/saml/update",delete:"/v1/mgmt/sso/idp/app/delete",load:"/v1/mgmt/sso/idp/app/load",loadAll:"/v1/mgmt/sso/idp/apps/load"},f={settings:"/v1/mgmt/sso/settings",metadata:"/v1/mgmt/sso/metadata",mapping:"/v1/mgmt/sso/mapping",settingsv2:"/v2/mgmt/sso/settings",oidc:{configure:"/v1/mgmt/sso/oidc"},saml:{configure:"/v1/mgmt/sso/saml",metadata:"/v1/mgmt/sso/saml/metadata"}},y={update:"/v1/mgmt/jwt/update",impersonate:"/v1/mgmt/impersonate"},I={settings:"/v1/mgmt/password/settings"},b={create:"/v1/mgmt/permission/create",update:"/v1/mgmt/permission/update",delete:"/v1/mgmt/permission/delete",loadAll:"/v1/mgmt/permission/all"},w={create:"/v1/mgmt/role/create",update:"/v1/mgmt/role/update",delete:"/v1/mgmt/role/delete",loadAll:"/v1/mgmt/role/all",search:"/v1/mgmt/role/search"},A={list:"/v1/mgmt/flow/list",delete:"/v1/mgmt/flow/delete",export:"/v1/mgmt/flow/export",import:"/v1/mgmt/flow/import"},S={export:"/v1/mgmt/theme/export",import:"/v1/mgmt/theme/import"},N={loadAllGroups:"/v1/mgmt/group/all",loadAllGroupsForMember:"/v1/mgmt/group/member/all",loadAllGroupMembers:"/v1/mgmt/group/members"},O={search:"/v1/mgmt/audit/search",createEvent:"/v1/mgmt/audit/event"},T={schemaSave:"/v1/mgmt/authz/schema/save",schemaDelete:"/v1/mgmt/authz/schema/delete",schemaLoad:"/v1/mgmt/authz/schema/load",nsSave:"/v1/mgmt/authz/ns/save",nsDelete:"/v1/mgmt/authz/ns/delete",rdSave:"/v1/mgmt/authz/rd/save",rdDelete:"/v1/mgmt/authz/rd/delete",reCreate:"/v1/mgmt/authz/re/create",reDelete:"/v1/mgmt/authz/re/delete",reDeleteResources:"/v1/mgmt/authz/re/deleteresources",hasRelations:"/v1/mgmt/authz/re/has",who:"/v1/mgmt/authz/re/who",resource:"/v1/mgmt/authz/re/resource",targets:"/v1/mgmt/authz/re/targets",targetAll:"/v1/mgmt/authz/re/targetall",getModified:"/v1/mgmt/authz/getmodified"},j={schema:"/v1/mgmt/fga/schema",relations:"/v1/mgmt/fga/relations",deleteRelations:"/v1/mgmt/fga/relations/delete",check:"/v1/mgmt/fga/check"};const P=(e,t)=>({create:function(a,o,n,i,r,l,d,p,m,c,g,h,v,k){const C="string"==typeof o?{loginId:a,email:o,phone:n,displayName:i,givenName:g,middleName:h,familyName:v,roleNames:r,userTenants:l,customAttributes:d,picture:p,verifiedEmail:m,verifiedPhone:c,additionalLoginIds:k}:Object.assign(Object.assign({loginId:a},o),{roleNames:null==o?void 0:o.roles,roles:void 0});return s(e.httpClient.post(u.create,C,{token:t}),(e=>e.user))},createTestUser:function(a,o,n,i,r,l,d,p,m,c,g,h,v,k){const C="string"==typeof o?{loginId:a,email:o,phone:n,displayName:i,givenName:g,middleName:h,familyName:v,roleNames:r,userTenants:l,customAttributes:d,picture:p,verifiedEmail:m,verifiedPhone:c,additionalLoginIds:k,test:!0}:Object.assign(Object.assign({loginId:a},o),{roleNames:null==o?void 0:o.roles,roles:void 0,test:!0});return s(e.httpClient.post(u.createTestUser,C,{token:t}),(e=>e.user))},invite:function(a,o,n,i,r,l,d,p,m,c,g,h,v,k,C,f,y,I){const b="string"==typeof o?{loginId:a,email:o,phone:n,displayName:i,givenName:k,middleName:C,familyName:f,roleNames:r,userTenants:l,invite:!0,customAttributes:d,picture:p,verifiedEmail:m,verifiedPhone:c,inviteUrl:g,sendMail:h,sendSMS:v,additionalLoginIds:y,templateId:I}:Object.assign(Object.assign({loginId:a},o),{roleNames:null==o?void 0:o.roles,roles:void 0,invite:!0});return s(e.httpClient.post(u.create,b,{token:t}),(e=>e.user))},inviteBatch:(a,o,n,i,r,l)=>s(e.httpClient.post(u.createBatch,{users:a.map((e=>{const t=Object.assign(Object.assign({},e),{roleNames:e.roles});return delete t.roles,t})),invite:!0,inviteUrl:o,sendMail:n,sendSMS:i,templateOptions:r,templateId:l},{token:t}),(e=>e)),update:function(a,o,n,i,r,l,d,p,m,c,g,h,v,k){const C="string"==typeof o?{loginId:a,email:o,phone:n,displayName:i,givenName:g,middleName:h,familyName:v,roleNames:r,userTenants:l,customAttributes:d,picture:p,verifiedEmail:m,verifiedPhone:c,additionalLoginIds:k}:Object.assign(Object.assign({loginId:a},o),{roleNames:null==o?void 0:o.roles,roles:void 0});return s(e.httpClient.post(u.update,C,{token:t}),(e=>e.user))},patch:function(a,o){const n={loginId:a};return void 0!==o.email&&(n.email=o.email),void 0!==o.phone&&(n.phone=o.phone),void 0!==o.displayName&&(n.displayName=o.displayName),void 0!==o.givenName&&(n.givenName=o.givenName),void 0!==o.middleName&&(n.middleName=o.middleName),void 0!==o.familyName&&(n.familyName=o.familyName),void 0!==o.roles&&(n.roleNames=o.roles),void 0!==o.userTenants&&(n.userTenants=o.userTenants),void 0!==o.customAttributes&&(n.customAttributes=o.customAttributes),void 0!==o.picture&&(n.picture=o.picture),void 0!==o.verifiedEmail&&(n.verifiedEmail=o.verifiedEmail),void 0!==o.verifiedPhone&&(n.verifiedPhone=o.verifiedPhone),void 0!==o.ssoAppIds&&(n.ssoAppIds=o.ssoAppIds),s(e.httpClient.patch(u.patch,n,{token:t}),(e=>e.user))},delete:a=>s(e.httpClient.post(u.delete,{loginId:a},{token:t})),deleteByUserId:a=>s(e.httpClient.post(u.delete,{userId:a},{token:t})),deleteAllTestUsers:()=>s(e.httpClient.delete(u.deleteAllTestUsers,{token:t})),load:a=>s(e.httpClient.get(u.load,{queryParams:{loginId:a},token:t}),(e=>e.user)),loadByUserId:a=>s(e.httpClient.get(u.load,{queryParams:{userId:a},token:t}),(e=>e.user)),logoutUser:a=>s(e.httpClient.post(u.logout,{loginId:a},{token:t})),logoutUserByUserId:a=>s(e.httpClient.post(u.logout,{userId:a},{token:t})),searchAll:(a,o,n,i,r,l,d,p,m,c)=>s(e.httpClient.post(u.search,{tenantIds:a,roleNames:o,limit:n,page:i,testUsersOnly:r,withTestUser:l,customAttributes:d,statuses:p,emails:m,phones:c},{token:t}),(e=>e.users)),searchTestUsers:a=>s(e.httpClient.post(u.searchTestUsers,Object.assign(Object.assign({},a),{withTestUser:!0,testUsersOnly:!0,roleNames:a.roles,roles:void 0}),{token:t}),(e=>e.users)),search:a=>s(e.httpClient.post(u.search,Object.assign(Object.assign({},a),{roleNames:a.roles,roles:void 0}),{token:t}),(e=>e.users)),getProviderToken:(a,o,n)=>s(e.httpClient.get(u.getProviderToken,{queryParams:{loginId:a,provider:o,withRefreshToken:(null==n?void 0:n.withRefreshToken)?"true":"false",forceRefresh:(null==n?void 0:n.forceRefresh)?"true":"false"},token:t}),(e=>e)),activate:a=>s(e.httpClient.post(u.updateStatus,{loginId:a,status:"enabled"},{token:t}),(e=>e.user)),deactivate:a=>s(e.httpClient.post(u.updateStatus,{loginId:a,status:"disabled"},{token:t}),(e=>e.user)),updateLoginId:(a,o)=>s(e.httpClient.post(u.updateLoginId,{loginId:a,newLoginId:o},{token:t}),(e=>e.user)),updateEmail:(a,o,n)=>s(e.httpClient.post(u.updateEmail,{loginId:a,email:o,verified:n},{token:t}),(e=>e.user)),updatePhone:(a,o,n)=>s(e.httpClient.post(u.updatePhone,{loginId:a,phone:o,verified:n},{token:t}),(e=>e.user)),updateDisplayName:(a,o,n,i,r)=>s(e.httpClient.post(u.updateDisplayName,{loginId:a,displayName:o,givenName:n,middleName:i,familyName:r},{token:t}),(e=>e.user)),updatePicture:(a,o)=>s(e.httpClient.post(u.updatePicture,{loginId:a,picture:o},{token:t}),(e=>e.user)),updateCustomAttribute:(a,o,n)=>s(e.httpClient.post(u.updateCustomAttribute,{loginId:a,attributeKey:o,attributeValue:n},{token:t}),(e=>e.user)),setRoles:(a,o)=>s(e.httpClient.post(u.setRole,{loginId:a,roleNames:o},{token:t}),(e=>e.user)),addRoles:(a,o)=>s(e.httpClient.post(u.addRole,{loginId:a,roleNames:o},{token:t}),(e=>e.user)),removeRoles:(a,o)=>s(e.httpClient.post(u.removeRole,{loginId:a,roleNames:o},{token:t}),(e=>e.user)),addTenant:(a,o)=>s(e.httpClient.post(u.addTenant,{loginId:a,tenantId:o},{token:t}),(e=>e.user)),removeTenant:(a,o)=>s(e.httpClient.post(u.removeTenant,{loginId:a,tenantId:o},{token:t}),(e=>e.user)),setTenantRoles:(a,o,n)=>s(e.httpClient.post(u.setRole,{loginId:a,tenantId:o,roleNames:n},{token:t}),(e=>e.user)),addTenantRoles:(a,o,n)=>s(e.httpClient.post(u.addRole,{loginId:a,tenantId:o,roleNames:n},{token:t}),(e=>e.user)),removeTenantRoles:(a,o,n)=>s(e.httpClient.post(u.removeRole,{loginId:a,tenantId:o,roleNames:n},{token:t}),(e=>e.user)),addSSOapps:(a,o)=>s(e.httpClient.post(u.addSSOApps,{loginId:a,ssoAppIds:o},{token:t}),(e=>e.user)),setSSOapps:(a,o)=>s(e.httpClient.post(u.setSSOApps,{loginId:a,ssoAppIds:o},{token:t}),(e=>e.user)),removeSSOapps:(a,o)=>s(e.httpClient.post(u.removeSSOApps,{loginId:a,ssoAppIds:o},{token:t}),(e=>e.user)),generateOTPForTestUser:(a,o,n)=>s(e.httpClient.post(u.generateOTPForTest,{deliveryMethod:a,loginId:o,loginOptions:n},{token:t}),(e=>e)),generateMagicLinkForTestUser:(a,o,n,i)=>s(e.httpClient.post(u.generateMagicLinkForTest,{deliveryMethod:a,loginId:o,URI:n,loginOptions:i},{token:t}),(e=>e)),generateEnchantedLinkForTestUser:(a,o,n)=>s(e.httpClient.post(u.generateEnchantedLinkForTest,{loginId:a,URI:o,loginOptions:n},{token:t}),(e=>e)),generateEmbeddedLink:(a,o)=>s(e.httpClient.post(u.generateEmbeddedLink,{loginId:a,customClaims:o},{token:t}),(e=>e)),setTemporaryPassword:(a,o)=>s(e.httpClient.post(u.setTemporaryPassword,{loginId:a,password:o},{token:t}),(e=>e)),setActivePassword:(a,o)=>s(e.httpClient.post(u.setActivePassword,{loginId:a,password:o},{token:t}),(e=>e)),setPassword:(a,o)=>s(e.httpClient.post(u.setPassword,{loginId:a,password:o},{token:t}),(e=>e)),expirePassword:a=>s(e.httpClient.post(u.expirePassword,{loginId:a},{token:t}),(e=>e)),removeAllPasskeys:a=>s(e.httpClient.post(u.removeAllPasskeys,{loginId:a},{token:t}),(e=>e)),history:a=>s(e.httpClient.post(u.history,a,{token:t}),(e=>e))}),R=(e,t)=>({updateName:a=>s(e.httpClient.post(h.updateName,{name:a},{token:t})),updateTags:a=>s(e.httpClient.post(h.updateTags,{tags:a},{token:t})),clone:(a,o,n)=>s(e.httpClient.post(h.clone,{name:a,environment:o,tags:n},{token:t})),listProjects:async()=>s(e.httpClient.post(h.projectsList,{},{token:t}),(e=>e.projects.map((({id:e,name:t,environment:s,tags:a})=>({id:e,name:t,environment:s,tags:a}))))),exportSnapshot:()=>s(e.httpClient.post(h.exportSnapshot,{},{token:t})),importSnapshot:a=>s(e.httpClient.post(h.importSnapshot,a,{token:t})),validateSnapshot:a=>s(e.httpClient.post(h.validateSnapshot,a,{token:t})),export:()=>s(e.httpClient.post(h.exportSnapshot,{},{token:t}),(e=>e.files)),import:a=>s(e.httpClient.post(h.importSnapshot,{files:a},{token:t}))}),E=(e,t)=>({create:(a,o,n)=>s(e.httpClient.post(k.create,{name:a,selfProvisioningDomains:o,customAttributes:n},{token:t})),createWithId:(a,o,n,i)=>s(e.httpClient.post(k.create,{id:a,name:o,selfProvisioningDomains:n,customAttributes:i},{token:t})),update:(a,o,n,i)=>s(e.httpClient.post(k.update,{id:a,name:o,selfProvisioningDomains:n,customAttributes:i},{token:t})),delete:(a,o)=>s(e.httpClient.post(k.delete,{id:a,cascade:o},{token:t})),load:a=>s(e.httpClient.get(k.load,{queryParams:{id:a},token:t}),(e=>e)),loadAll:()=>s(e.httpClient.get(k.loadAll,{token:t}),(e=>e.tenants)),searchAll:(a,o,n,i)=>s(e.httpClient.post(k.searchAll,{tenantIds:a,tenantNames:o,tenantSelfProvisioningDomains:n,customAttributes:i},{token:t}),(e=>e.tenants)),getSettings:a=>s(e.httpClient.get(k.settings,{queryParams:{id:a},token:t}),(e=>e)),configureSettings:(a,o)=>s(e.httpClient.post(k.settings,Object.assign(Object.assign({},o),{tenantId:a}),{token:t})),generateSSOConfigurationLink:(a,o)=>s(e.httpClient.post(k.generateSSOConfigurationLink,{tenantId:a,expireTime:o},{token:t}),(e=>e))}),M=(e,t)=>({update:(a,o)=>s(e.httpClient.post(y.update,{jwt:a,customClaims:o},{token:t})),impersonate:(a,o,n,i,r)=>s(e.httpClient.post(y.impersonate,{impersonatorId:a,loginId:o,validateConsent:n,customClaims:i,selectedTenant:r},{token:t}))}),x=(e,t)=>({create:(a,o)=>s(e.httpClient.post(b.create,{name:a,description:o},{token:t})),update:(a,o,n)=>s(e.httpClient.post(b.update,{name:a,newName:o,description:n},{token:t})),delete:a=>s(e.httpClient.post(b.delete,{name:a},{token:t})),loadAll:()=>s(e.httpClient.get(b.loadAll,{token:t}),(e=>e.permissions))}),U=(e,t)=>({create:(a,o,n,i)=>s(e.httpClient.post(w.create,{name:a,description:o,permissionNames:n,tenantId:i},{token:t})),update:(a,o,n,i,r)=>s(e.httpClient.post(w.update,{name:a,newName:o,description:n,permissionNames:i,tenantId:r},{token:t})),delete:(a,o)=>s(e.httpClient.post(w.delete,{name:a,tenantId:o},{token:t})),loadAll:()=>s(e.httpClient.get(w.loadAll,{token:t}),(e=>e.roles)),search:a=>s(e.httpClient.post(w.search,a,{token:t}),(e=>e.roles))}),L=(e,t)=>({loadAllGroups:a=>s(e.httpClient.post(N.loadAllGroups,{tenantId:a},{token:t})),loadAllGroupsForMember:(a,o,n)=>s(e.httpClient.post(N.loadAllGroupsForMember,{tenantId:a,loginIds:n,userIds:o},{token:t})),loadAllGroupMembers:(a,o)=>s(e.httpClient.post(N.loadAllGroupMembers,{tenantId:a,groupId:o},{token:t}))}),D=(e,t)=>({getSettings:a=>s(e.httpClient.get(f.settings,{queryParams:{tenantId:a},token:t}),(e=>e)),deleteSettings:a=>s(e.httpClient.delete(f.settings,{queryParams:{tenantId:a},token:t})),configureSettings:(a,o,n,i,r,l)=>s(e.httpClient.post(f.settings,{tenantId:a,idpURL:o,entityId:i,idpCert:n,redirectURL:r,domains:l},{token:t})),configureMetadata:(a,o,n,i)=>s(e.httpClient.post(f.metadata,{tenantId:a,idpMetadataURL:o,redirectURL:n,domains:i},{token:t})),configureMapping:(a,o,n)=>s(e.httpClient.post(f.mapping,{tenantId:a,roleMappings:o,attributeMapping:n},{token:t})),configureOIDCSettings:(a,o,n)=>{const i=Object.assign(Object.assign({},o),{userAttrMapping:o.attributeMapping});return delete i.attributeMapping,s(e.httpClient.post(f.oidc.configure,{tenantId:a,settings:i,domains:n},{token:t}))},configureSAMLSettings:(a,o,n,i)=>s(e.httpClient.post(f.saml.configure,{tenantId:a,settings:o,redirectUrl:n,domains:i},{token:t})),configureSAMLByMetadata:(a,o,n,i)=>s(e.httpClient.post(f.saml.metadata,{tenantId:a,settings:o,redirectUrl:n,domains:i},{token:t})),loadSettings:a=>s(e.httpClient.get(f.settingsv2,{queryParams:{tenantId:a},token:t}),(e=>{var t,s;const a=e;return a.oidc&&(a.oidc=Object.assign(Object.assign({},a.oidc),{attributeMapping:a.oidc.userAttrMapping}),delete a.oidc.userAttrMapping),(null===(t=a.saml)||void 0===t?void 0:t.groupsMapping)&&(a.saml.groupsMapping=null===(s=a.saml)||void 0===s?void 0:s.groupsMapping.map((e=>{const t=e;return t.roleName=t.role.name,delete t.role,t}))),a}))}),F=(e,t)=>({create:(a,o,n,i,r,l,d,p)=>s(e.httpClient.post(v.create,{name:a,expireTime:o,roleNames:n,keyTenants:i,userId:r,customClaims:l,description:d,permittedIps:p},{token:t})),load:a=>s(e.httpClient.get(v.load,{queryParams:{id:a},token:t}),(e=>e.key)),searchAll:a=>s(e.httpClient.post(v.search,{tenantIds:a},{token:t}),(e=>e.keys)),update:(a,o,n)=>s(e.httpClient.post(v.update,{id:a,name:o,description:n},{token:t}),(e=>e.key)),deactivate:a=>s(e.httpClient.post(v.deactivate,{id:a},{token:t})),activate:a=>s(e.httpClient.post(v.activate,{id:a},{token:t})),delete:a=>s(e.httpClient.post(v.delete,{id:a},{token:t}))}),z=(e,t)=>({list:()=>s(e.httpClient.post(A.list,{},{token:t})),delete:a=>s(e.httpClient.post(A.delete,{ids:a},{token:t})),export:a=>s(e.httpClient.post(A.export,{flowId:a},{token:t})),import:(a,o,n)=>s(e.httpClient.post(A.import,{flowId:a,flow:o,screens:n},{token:t}))}),q=(e,t)=>({export:()=>s(e.httpClient.post(S.export,{},{token:t})),import:a=>s(e.httpClient.post(S.import,{theme:a},{token:t}))}),$=(e,t)=>({search:a=>{const o=Object.assign(Object.assign({},a),{externalIds:a.loginIds});return delete o.loginIds,s(e.httpClient.post(O.search,o,{token:t}),(e=>null==e?void 0:e.audits.map((e=>{const t=Object.assign(Object.assign({},e),{occurred:parseFloat(e.occurred),loginIds:e.externalIds});return delete t.externalIds,t}))))},createEvent:a=>{const o=Object.assign({},a);return s(e.httpClient.post(O.createEvent,o,{token:t}))}}),J=(e,t)=>({saveSchema:(a,o)=>s(e.httpClient.post(T.schemaSave,{schema:a,upgrade:o},{token:t})),deleteSchema:()=>s(e.httpClient.post(T.schemaDelete,{},{token:t})),loadSchema:()=>s(e.httpClient.post(T.schemaLoad,{},{token:t}),(e=>e.schema)),saveNamespace:(a,o,n)=>s(e.httpClient.post(T.nsSave,{namespace:a,oldName:o,schemaName:n},{token:t})),deleteNamespace:(a,o)=>s(e.httpClient.post(T.nsDelete,{name:a,schemaName:o},{token:t})),saveRelationDefinition:(a,o,n,i)=>s(e.httpClient.post(T.rdSave,{relationDefinition:a,namespace:o,oldName:n,schemaName:i},{token:t})),deleteRelationDefinition:(a,o,n)=>s(e.httpClient.post(T.rdDelete,{name:a,namespace:o,schemaName:n},{token:t})),createRelations:a=>s(e.httpClient.post(T.reCreate,{relations:a},{token:t})),deleteRelations:a=>s(e.httpClient.post(T.reDelete,{relations:a},{token:t})),deleteRelationsForResources:a=>s(e.httpClient.post(T.reDeleteResources,{resources:a},{token:t})),hasRelations:a=>s(e.httpClient.post(T.hasRelations,{relationQueries:a},{token:t}),(e=>e.relationQueries)),whoCanAccess:(a,o,n)=>s(e.httpClient.post(T.who,{resource:a,relationDefinition:o,namespace:n},{token:t}),(e=>e.targets)),resourceRelations:a=>s(e.httpClient.post(T.resource,{resource:a},{token:t}),(e=>e.relations)),targetsRelations:a=>s(e.httpClient.post(T.targets,{targets:a},{token:t}),(e=>e.relations)),whatCanTargetAccess:a=>s(e.httpClient.post(T.targetAll,{target:a},{token:t}),(e=>e.relations)),getModified:a=>s(e.httpClient.post(T.getModified,{since:a?a.getTime():0},{token:t}),(e=>e))}),K=(e,t)=>({createOidcApplication:a=>{var o;return s(e.httpClient.post(C.oidcCreate,Object.assign(Object.assign({},a),{enabled:null===(o=a.enabled)||void 0===o||o}),{token:t}))},createSamlApplication:a=>{var o;return s(e.httpClient.post(C.samlCreate,Object.assign(Object.assign({},a),{enabled:null===(o=a.enabled)||void 0===o||o}),{token:t}))},updateOidcApplication:a=>s(e.httpClient.post(C.oidcUpdate,Object.assign({},a),{token:t})),updateSamlApplication:a=>s(e.httpClient.post(C.samlUpdate,Object.assign({},a),{token:t})),delete:a=>s(e.httpClient.post(C.delete,{id:a},{token:t})),load:a=>s(e.httpClient.get(C.load,{queryParams:{id:a},token:t}),(e=>e)),loadAll:()=>s(e.httpClient.get(C.loadAll,{token:t}),(e=>e.apps))}),G=(e,t)=>({getSettings:a=>s(e.httpClient.get(I.settings,{queryParams:{tenantId:a},token:t}),(e=>e)),configureSettings:(a,o)=>s(e.httpClient.post(I.settings,Object.assign(Object.assign({},o),{tenantId:a}),{token:t}))}),B=(e,t)=>({saveSchema:a=>s(e.httpClient.post(j.schema,a,{token:t})),deleteSchema:()=>s(e.httpClient.post(T.schemaDelete,{},{token:t})),createRelations:a=>s(e.httpClient.post(j.relations,{tuples:a},{token:t})),deleteRelations:a=>s(e.httpClient.post(j.deleteRelations,{tuples:a},{token:t})),check:a=>s(e.httpClient.post(j.check,{tuples:a},{token:t}),(e=>e.tuples))});var H=Object.freeze({__proto__:null,default:{badRequest:"E011001",missingArguments:"E011002",invalidRequest:"E011003",invalidArguments:"E011004",wrongOTPCode:"E061102",tooManyOTPAttempts:"E061103",enchantedLinkPending:"E062503",userNotFound:"E062108"}});const _=s=>{var r,{managementKey:l,publicKey:d}=s,u=e(s,["managementKey","publicKey"]);const h=t(Object.assign(Object.assign({fetch:p},u),{baseHeaders:Object.assign(Object.assign({},u.baseHeaders),{"x-descope-sdk-name":"nodejs","x-descope-sdk-node-version":(null===(r=null===process||void 0===process?void 0:process.versions)||void 0===r?void 0:r.node)||"","x-descope-sdk-version":"1.6.13"})})),{projectId:v,logger:k}=u,C={},f=((e,t)=>({user:P(e,t),project:R(e,t),accessKey:F(e,t),tenant:E(e,t),ssoApplication:K(e,t),sso:D(e,t),jwt:M(e,t),permission:x(e,t),password:G(e,t),role:U(e,t),group:L(e,t),flow:z(e,t),theme:q(e,t),audit:$(e,t),authz:J(e,t),fga:B(e,t)}))(h,l),y=Object.assign(Object.assign({},h),{refresh:async e=>h.refresh(e),management:f,async getKey(e){if(!(null==e?void 0:e.kid))throw Error("header.kid must not be empty");if(C[e.kid])return C[e.kid];if(Object.assign(C,await(async()=>{if(d)try{const e=JSON.parse(d),t=await i(e);return{[e.kid]:t}}catch(e){throw null==k||k.error("Failed to parse the provided public key",e),new Error(`Failed to parse public key. Error: ${e}`)}const e=(await h.httpClient.get(`v2/keys/${v}`).then((e=>e.json()))).keys;return Array.isArray(e)?(await Promise.all(e.map((async e=>[e.kid,await i(e)])))).reduce(((e,[t,s])=>t?Object.assign(Object.assign({},e),{[t.toString()]:s}):e),{}):{}})()),!C[e.kid])throw Error("failed to fetch matching key");return C[e.kid]},async validateJwt(e){var t;const s=(await o(e,y.getKey,{clockTolerance:5})).payload;if(s&&(s.iss=null===(t=s.iss)||void 0===t?void 0:t.split("/").pop(),s.iss!==v))throw new n.JWTClaimValidationFailed('unexpected "iss" claim value',"iss","check_failed");return{jwt:e,token:s}},async validateSession(e){if(!e)throw Error("session token is required for validation");try{return await y.validateJwt(e)}catch(e){throw null==k||k.error("session validation failed",e),Error(`session validation failed. Error: ${e}`)}},async refreshSession(e){var t,s;if(!e)throw Error("refresh token is required to refresh a session");try{await y.validateJwt(e);const a=await y.refresh(e);if(a.ok){return await y.validateJwt(null===(t=a.data)||void 0===t?void 0:t.sessionJwt)}throw Error(null===(s=a.error)||void 0===s?void 0:s.errorMessage)}catch(e){throw null==k||k.error("refresh token validation failed",e),Error(`refresh token validation failed, Error: ${e}`)}},async validateAndRefreshSession(e,t){if(!e&&!t)throw Error("both session and refresh tokens are empty");try{return await y.validateSession(e)}catch(e){null==k||k.log(`session validation failed with error ${e} - trying to refresh it`)}return y.refreshSession(t)},async exchangeAccessKey(e,t){if(!e)throw Error("access key must not be empty");let s;try{s=await y.accessKey.exchange(e,t)}catch(e){throw null==k||k.error("failed to exchange access key",e),Error(`could not exchange access key - Failed to exchange. Error: ${e}`)}const{sessionJwt:a}=s.data;if(!a)throw null==k||k.error("failed to parse exchange access key response"),Error("could not exchange access key");try{return await y.validateJwt(a)}catch(e){throw null==k||k.error("failed to parse jwt from access key",e),Error(`could not exchange access key - failed to validate jwt. Error: ${e}`)}},validatePermissions:(e,t)=>y.validateTenantPermissions(e,"",t),getMatchedPermissions:(e,t)=>y.getMatchedTenantPermissions(e,"",t),validateTenantPermissions(e,t,s){if(t&&!g(e,t))return!1;const a=c(e,"permissions",t);return s.every((e=>a.includes(e)))},getMatchedTenantPermissions(e,t,s){if(t&&!g(e,t))return[];const a=c(e,"permissions",t);return s.filter((e=>a.includes(e)))},validateRoles:(e,t)=>y.validateTenantRoles(e,"",t),getMatchedRoles:(e,t)=>y.getMatchedTenantRoles(e,"",t),validateTenantRoles(e,t,s){if(t&&!g(e,t))return!1;const a=c(e,"roles",t);return s.every((e=>a.includes(e)))},getMatchedTenantRoles(e,t,s){if(t&&!g(e,t))return[];const a=c(e,"roles",t);return s.filter((e=>a.includes(e)))}});return a(y,["otp.verify.email","otp.verify.sms","otp.verify.voice","otp.verify.whatsapp","magicLink.verify","enchantedLink.signUp","enchantedLink.signIn","oauth.exchange","saml.exchange","totp.verify","webauthn.signIn.finish","webauthn.signUp.finish","refresh"],m)};_.RefreshTokenCookieName="DSR",_.SessionTokenCookieName="DS";export{_ as default,H as descopeErrors};
 //# sourceMappingURL=index.esm.js.map