@thunderid/browser 1.3.0 → 1.3.1

package/dist/ThunderIDBrowserClient.d.ts

@@ -1,4 +1,4 @@
-import { ThunderIDJavaScriptClient, User, IsomorphicCrypto, IdToken, OIDCEndpoints, Storage, TokenResponse, HttpRequestConfig, HttpResponse } from '@thunderid/javascript';
+import { ThunderIDJavaScriptClient, User, IsomorphicCrypto, IdToken, OIDCEndpoints, Storage, TokenResponse, HttpRequestConfig, HttpResponse, UserProfile } from '@thunderid/javascript';
 import FetchHttpClient from './FetchHttpClient';
 import { BrowserAuthConfig } from './models/BrowserConfig';
 import SignInConfig from './models/SignInConfig';
@@ -11,14 +11,7 @@ declare class ThunderIDBrowserClient<T = BrowserAuthConfig> extends ThunderIDJav
     private _storage;
     private _getSignOutURLFromSessionStorage;
     private _isHttpHandlerEnabled;
-    private _httpErrorCallback;
-    private _httpFinishCallback;
-    private _onSignInCallback;
-    private _onSignOutCallback;
-    private _onSignOutFailedCallback;
-    private _onEndUserSession;
-    private _onInitialize;
-    private _onCustomGrant;
+    private _hookCallbacks;
     private _initialized;
     private _startedInitialize;
     constructor(instanceId?: number);
@@ -39,6 +32,17 @@ declare class ThunderIDBrowserClient<T = BrowserAuthConfig> extends ThunderIDJav
     httpRequest(requestConfig: HttpRequestConfig): Promise<HttpResponse | undefined>;
     httpRequestAll(configs: HttpRequestConfig[]): Promise<HttpResponse[] | undefined>;
     getUser(userId?: string): Promise<User>;
+    /**
+     * Fetches the signed-in user's profile from the `/users/me` endpoint (or `endpoints.usersMe` when
+     * configured), sending the request through the client's HTTP client so the access token is attached.
+     *
+     * @param options - Optional `baseUrl` or full `url` overrides for the profile endpoint.
+     * @returns The user's profile.
+     */
+    getUserProfile(options?: {
+        baseUrl?: string;
+        url?: string;
+    }): Promise<UserProfile>;
     getAccessToken(sessionId?: string): Promise<string>;
     getDecodedIdToken(userId?: string, idToken?: string): Promise<IdToken>;
     getIdToken(userId?: string): Promise<string>;
@@ -56,7 +60,20 @@ declare class ThunderIDBrowserClient<T = BrowserAuthConfig> extends ThunderIDJav
     enableHttpHandler(): Promise<boolean | undefined>;
     disableHttpHandler(): Promise<boolean | undefined>;
     decodeJwtToken<R = Record<string, unknown>>(token: string): Promise<R>;
+    /**
+     * Subscribes a callback to a lifecycle hook. Every callback registered for a hook is called when it
+     * fires; registering the same callback again for the same hook has no further effect. Hooks can be
+     * registered before or after `initialize()`.
+     *
+     * @param hook - The hook to subscribe to (see `Hooks`).
+     * @param callback - Called when the hook fires.
+     * @param id - The custom grant id. Required for `custom-grant`.
+     */
     on(hook: string, callback: (response?: any) => void | Promise<void>, id?: string): Promise<void>;
+    private _addHookCallback;
+    private _emitHook;
+    private _emitHttpError;
+    private _emitHttpFinish;
     private _enableRetrievingSignOutURLFromSession;
     private _constructSilentSignInUrl;
     getInstanceId(): number;

package/dist/ThunderIDBrowserClient.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ThunderIDBrowserClient.d.ts","sourceRoot":"","sources":["../src/ThunderIDBrowserClient.ts"],"names":[],"mappings":"AAGA,OAAO,EACL,yBAAyB,EAEzB,IAAI,EACJ,gBAAgB,EAChB,OAAO,EACP,aAAa,EAGb,OAAO,EACP,aAAa,EAGb,iBAAiB,EACjB,YAAY,EAEb,MAAM,uBAAuB,CAAC;AAE/B,OAAO,eAAe,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAC,iBAAiB,EAAC,MAAM,wBAAwB,CAAC;AAEzD,OAAO,YAAY,MAAM,uBAAuB,CAAC;AAEjD,OAAO,EAAC,sBAAsB,EAAC,MAAM,8BAA8B,CAAC;AA8BpE,cAAM,sBAAsB,CAAC,CAAC,GAAG,iBAAiB,CAAE,SAAQ,yBAAyB,CAAC,CAAC,CAAC;IACtF,OAAO,CAAC,kBAAkB,CAAK;IAC/B,OAAO,CAAC,WAAW,CAA8B;IACjD,OAAO,CAAC,UAAU,CAA2B;IAC7C,OAAO,CAAC,WAAW,CAAsC;IACzD,OAAO,CAAC,QAAQ,CAA0D;IAC1E,OAAO,CAAC,gCAAgC,CAAS;IACjD,OAAO,CAAC,qBAAqB,CAAQ;IACrC,OAAO,CAAC,kBAAkB,CAA2D;IACrF,OAAO,CAAC,mBAAmB,CAA2B;IACtD,OAAO,CAAC,iBAAiB,CAAwC;IACjE,OAAO,CAAC,kBAAkB,CAA0B;IACpD,OAAO,CAAC,wBAAwB,CAA6C;IAC7E,OAAO,CAAC,iBAAiB,CAAuC;IAChE,OAAO,CAAC,aAAa,CAA2C;IAChE,OAAO,CAAC,cAAc,CAA8C;IACpE,OAAO,CAAC,YAAY,CAAS;IAC7B,OAAO,CAAC,kBAAkB,CAAS;gBAEhB,UAAU,SAAI;IAKX,UAAU,CAAC,MAAM,EAAE,CAAC,EAAE,OAAO,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IA4DnE,aAAa,IAAI,OAAO,CAAC,OAAO,CAAC;YAmBhC,eAAe;IAwBb,SAAS,IAAI,OAAO;IAId,MAAM,CAC1B,MAAM,CAAC,EAAE,YAAY,EACrB,iBAAiB,CAAC,EAAE,MAAM,EAC1B,KAAK,CAAC,EAAE,MAAM,EACd,kBAAkB,CAAC,EAAE;QAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAC,GACrD,OAAO,CAAC,IAAI,GAAG,SAAS,CAAC;YAkBd,eAAe;YAyEf,sBAAsB;IA6Bd,cAAc,CAClC,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,EACnD,kBAAkB,CAAC,EAAE;QAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAC,GACrD,OAAO,CAAC,IAAI,GAAG,OAAO,GAAG,SAAS,CAAC;YAgBxB,uBAAuB;IAef,OAAO,CAC3B,QAAQ,CAAC,EAAE,GAAG,EACd,uBAAuB,CAAC,EAAE,MAAM,GAAG,CAAC,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC,EAC1D,iBAAiB,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,GACxC,OAAO,CAAC,MAAM,CAAC;IA+EL,WAAW,CAAC,aAAa,EAAE,iBAAiB,GAAG,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC;IAYhF,cAAc,CAAC,OAAO,EAAE,iBAAiB,EAAE,GAAG,OAAO,CAAC,YAAY,EAAE,GAAG,SAAS,CAAC;IAYxE,OAAO,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAMvC,cAAc,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAInD,iBAAiB,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAMtE,UAAU,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAM5C,0BAA0B,IAAI,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IAMtE,SAAS,IAAI,OAAO,CAAC,gBAAgB,GAAG,SAAS,CAAC;IAMxD,aAAa,IAAI,eAAe;IAYjB,UAAU,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAMnE,SAAS,CAAC,YAAY,CAAC,IAAI,EAAE,IAAI,GAAG,IAAI;IAI3B,eAAe,IAAI,OAAO,CAAC,OAAO,GAAG,SAAS,CAAC;IAMtC,kBAAkB,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,aAAa,CAAC;IAUlE,iBAAiB,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,QAAQ,CAAC;IAa/D,aAAa,CAAC,MAAM,EAAE,sBAAsB,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;IAyBvE,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC;IAM3D,qBAAqB,IAAI,OAAO,CAAC,IAAI,CAAC;IAOtC,iBAAiB,IAAI,OAAO,CAAC,OAAO,GAAG,SAAS,CAAC;IASjD,kBAAkB,IAAI,OAAO,CAAC,OAAO,GAAG,SAAS,CAAC;IASzC,cAAc,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC;IAI/E,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,QAAQ,CAAC,EAAE,GAAG,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IA4D7G,OAAO,CAAC,sCAAsC;YAMhC,yBAAyB;IAqBvB,aAAa,IAAI,MAAM;WAInB,YAAY,IAAI,OAAO,CAAC,IAAI,CAAC;CAGlD;AAED,eAAe,sBAAsB,CAAC"}
+{"version":3,"file":"ThunderIDBrowserClient.d.ts","sourceRoot":"","sources":["../src/ThunderIDBrowserClient.ts"],"names":[],"mappings":"AAGA,OAAO,EACL,yBAAyB,EAEzB,IAAI,EACJ,gBAAgB,EAChB,OAAO,EACP,aAAa,EAGb,OAAO,EACP,aAAa,EAGb,iBAAiB,EACjB,YAAY,EACZ,WAAW,EAKZ,MAAM,uBAAuB,CAAC;AAG/B,OAAO,eAAe,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAC,iBAAiB,EAAC,MAAM,wBAAwB,CAAC;AAEzD,OAAO,YAAY,MAAM,uBAAuB,CAAC;AAEjD,OAAO,EAAC,sBAAsB,EAAC,MAAM,8BAA8B,CAAC;AAiCpE,cAAM,sBAAsB,CAAC,CAAC,GAAG,iBAAiB,CAAE,SAAQ,yBAAyB,CAAC,CAAC,CAAC;IACtF,OAAO,CAAC,kBAAkB,CAAK;IAC/B,OAAO,CAAC,WAAW,CAA8B;IACjD,OAAO,CAAC,UAAU,CAA2B;IAC7C,OAAO,CAAC,WAAW,CAAsC;IACzD,OAAO,CAAC,QAAQ,CAA0D;IAC1E,OAAO,CAAC,gCAAgC,CAAS;IACjD,OAAO,CAAC,qBAAqB,CAAQ;IACrC,OAAO,CAAC,cAAc,CAAwC;IAC9D,OAAO,CAAC,YAAY,CAAS;IAC7B,OAAO,CAAC,kBAAkB,CAAS;gBAEhB,UAAU,SAAI;IAKX,UAAU,CAAC,MAAM,EAAE,CAAC,EAAE,OAAO,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IAgEnE,aAAa,IAAI,OAAO,CAAC,OAAO,CAAC;YAmBhC,eAAe;IAwBb,SAAS,IAAI,OAAO;IAId,MAAM,CAC1B,MAAM,CAAC,EAAE,YAAY,EACrB,iBAAiB,CAAC,EAAE,MAAM,EAC1B,KAAK,CAAC,EAAE,MAAM,EACd,kBAAkB,CAAC,EAAE;QAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAC,GACrD,OAAO,CAAC,IAAI,GAAG,SAAS,CAAC;YAkBd,eAAe;YAyEf,sBAAsB;IA6Bd,cAAc,CAClC,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,EACnD,kBAAkB,CAAC,EAAE;QAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAC,GACrD,OAAO,CAAC,IAAI,GAAG,OAAO,GAAG,SAAS,CAAC;YAgBxB,uBAAuB;IAef,OAAO,CAC3B,QAAQ,CAAC,EAAE,GAAG,EACd,uBAAuB,CAAC,EAAE,MAAM,GAAG,CAAC,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC,EAC1D,iBAAiB,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,GACxC,OAAO,CAAC,MAAM,CAAC;IA+EL,WAAW,CAAC,aAAa,EAAE,iBAAiB,GAAG,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC;IAkBhF,cAAc,CAAC,OAAO,EAAE,iBAAiB,EAAE,GAAG,OAAO,CAAC,YAAY,EAAE,GAAG,SAAS,CAAC;IAkBxE,OAAO,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAM7D;;;;;;OAMG;IACmB,cAAc,CAAC,OAAO,CAAC,EAAE;QAAC,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAA;KAAC,GAAG,OAAO,CAAC,WAAW,CAAC;IAgBhF,cAAc,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAInD,iBAAiB,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAMtE,UAAU,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAM5C,0BAA0B,IAAI,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IAMtE,SAAS,IAAI,OAAO,CAAC,gBAAgB,GAAG,SAAS,CAAC;IAMxD,aAAa,IAAI,eAAe;IAYjB,UAAU,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAMnE,SAAS,CAAC,YAAY,CAAC,IAAI,EAAE,IAAI,GAAG,IAAI;IAI3B,eAAe,IAAI,OAAO,CAAC,OAAO,GAAG,SAAS,CAAC;IAMtC,kBAAkB,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,aAAa,CAAC;IAUlE,iBAAiB,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,QAAQ,CAAC;IAa/D,aAAa,CAAC,MAAM,EAAE,sBAAsB,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;IAwBvE,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC;IAM3D,qBAAqB,IAAI,OAAO,CAAC,IAAI,CAAC;IAOtC,iBAAiB,IAAI,OAAO,CAAC,OAAO,GAAG,SAAS,CAAC;IASjD,kBAAkB,IAAI,OAAO,CAAC,OAAO,GAAG,SAAS,CAAC;IASzC,cAAc,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC;IAI5F;;;;;;;;OAQG;IACU,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,QAAQ,CAAC,EAAE,GAAG,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IA8C7G,OAAO,CAAC,gBAAgB;IAOxB,OAAO,CAAC,SAAS;IAMjB,OAAO,CAAC,cAAc,CAEpB;IAEF,OAAO,CAAC,eAAe,CAErB;IAEF,OAAO,CAAC,sCAAsC;YAMhC,yBAAyB;IAqBvB,aAAa,IAAI,MAAM;WAInB,YAAY,IAAI,OAAO,CAAC,IAAI,CAAC;CAGlD;AAED,eAAe,sBAAsB,CAAC"}

package/dist/cjs/index.cjs

@@ -35,6 +35,26 @@ fast_sha256 = __toESM(fast_sha256);
 let jose = require("jose");
 jose = __toESM(jose);
 
+//#region src/constants/Hooks.ts
+/**
+* Event hook names for attaching callbacks via `ThunderIDBrowserClient.on()`.
+*/
+let Hooks = /* @__PURE__ */ function(Hooks$1) {
+	Hooks$1["SignIn"] = "sign-in";
+	Hooks$1["SignOut"] = "sign-out";
+	Hooks$1["Initialize"] = "initialize";
+	Hooks$1["HttpRequestStart"] = "http-request-start";
+	Hooks$1["HttpRequestFinish"] = "http-request-finish";
+	Hooks$1["HttpRequestError"] = "http-request-error";
+	Hooks$1["HttpRequestSuccess"] = "http-request-success";
+	Hooks$1["RevokeAccessToken"] = "revoke-access-token";
+	Hooks$1["CustomGrant"] = "custom-grant";
+	Hooks$1["SignOutFailed"] = "sign-out-failed";
+	return Hooks$1;
+}({});
+var Hooks_default = Hooks;
+
+//#endregion
 //#region src/constants/SPAConstants.ts
 const ERROR = "error";
 const ERROR_DESCRIPTION = "error_description";
@@ -782,6 +802,57 @@ var AuthenticationHelper = class {
 };
 var AuthenticationHelper_default = AuthenticationHelper;
 
+//#endregion
+//#region src/utils/createHttpClientFetcher.ts
+/**
+* Builds a `fetch`-shaped function backed by the shared `FetchHttpClient` singleton, for
+* framework wrappers (`@thunderid/react`, `@thunderid/vue`) that need to hand a core
+* `@thunderid/javascript` API function a `fetcher` carrying the access token automatically.
+*
+* Unlike a plain `fetch` call, `FetchHttpClient.request` throws on a non-2xx response instead
+* of resolving it. This adapter catches that and reconstructs a `Response`-shaped object from
+* the thrown error's `response`, so the core API function sees the real status and body instead
+* of treating every non-2xx result as a network failure. A genuine network error (no response
+* attached) still propagates.
+*
+* @param instanceId - Which `FetchHttpClient` instance to use, for multi-instance apps. Defaults to `0`.
+* @returns A function matching the `(url, config) => Promise<Response>` shape core API functions expect.
+* @example
+* ```typescript
+* await updateMeCredentials({
+*   ...config,
+*   fetcher: fetcher ?? createHttpClientFetcher(instanceId),
+* });
+* ```
+*/
+const createHttpClientFetcher = (instanceId = 0) => {
+	return async (url, config) => {
+		const httpClient = FetchHttpClient_default.getInstance(instanceId);
+		const toResponse = (data, status, statusText) => ({
+			json: () => Promise.resolve(data),
+			ok: status >= 200 && status < 300,
+			status,
+			statusText,
+			text: () => Promise.resolve(typeof data === "string" ? data : JSON.stringify(data))
+		});
+		try {
+			const response = await httpClient.request({
+				data: config.body ? JSON.parse(config.body) : void 0,
+				headers: config.headers,
+				method: config.method || "POST",
+				signal: config.signal,
+				url
+			});
+			return toResponse(response.data, response.status, response.statusText || "");
+		} catch (error) {
+			const httpError = error;
+			if (httpError?.response) return toResponse(httpError.response.data, httpError.response.status, httpError.response.statusText ?? "");
+			throw error;
+		}
+	};
+};
+var createHttpClientFetcher_default = createHttpClientFetcher;
+
 //#endregion
 //#region src/utils/navigate.ts
 /**
@@ -2441,14 +2512,7 @@ var ThunderIDBrowserClient = class ThunderIDBrowserClient extends __thunderid_ja
 	_storage = BrowserStorage_default.SessionStorage;
 	_getSignOutURLFromSessionStorage = false;
 	_isHttpHandlerEnabled = true;
-	_httpErrorCallback;
-	_httpFinishCallback;
-	_onSignInCallback = () => null;
-	_onSignOutCallback = () => null;
-	_onSignOutFailedCallback = () => null;
-	_onEndUserSession = () => null;
-	_onInitialize = () => null;
-	_onCustomGrant = /* @__PURE__ */ new Map();
+	_hookCallbacks = /* @__PURE__ */ new Map();
 	_initialized = false;
 	_startedInitialize = false;
 	constructor(instanceId = 0) {
@@ -2475,6 +2539,12 @@ var ThunderIDBrowserClient = class ThunderIDBrowserClient extends __thunderid_ja
 			await this._authHelper?.attachTokenToRequestConfig(request);
 		};
 		this._httpClient = FetchHttpClient_default.getInstance(this._browserInstanceId, true, attachToken);
+		this._httpClient.setHttpRequestStartCallback((request) => {
+			this._emitHook(Hooks_default.HttpRequestStart, request);
+		});
+		this._httpClient.setHttpRequestSuccessCallback((response) => {
+			this._emitHook(Hooks_default.HttpRequestSuccess, response);
+		});
 		this._authHelper = new AuthenticationHelper_default(sm, this._spaHelper, this._browserInstanceId, {
 			exchangeToken: (cfg) => super.exchangeToken(cfg),
 			getAccessToken: (sessionId) => this.getAccessToken(sessionId),
@@ -2489,7 +2559,7 @@ var ThunderIDBrowserClient = class ThunderIDBrowserClient extends __thunderid_ja
 			setPKCECode: (pkceKey, state) => this.setPKCECode(pkceKey, state)
 		});
 		this._initialized = true;
-		if (this._onInitialize) this._onInitialize(true);
+		this._emitHook(Hooks_default.Initialize, true);
 		if (!merged.autoLogoutOnTokenRefreshError) return true;
 		window.addEventListener("message", (event) => {
 			if (event?.data?.type === REFRESH_ACCESS_TOKEN_ERR0R) this.signOut();
@@ -2520,7 +2590,7 @@ var ThunderIDBrowserClient = class ThunderIDBrowserClient extends __thunderid_ja
 		if (!SPAUtils_default.canContinueSignIn(Boolean(config?.callOnlyOnRedirect), authorizationCode)) return;
 		delete config?.callOnlyOnRedirect;
 		const user = await this._signInInternal(config, authorizationCode, state, tokenRequestConfig);
-		if (user && this._onSignInCallback) this._onSignInCallback(user);
+		if (user) this._emitHook(Hooks_default.SignIn, user);
 		return user;
 	}
 	async _signInInternal(signInConfig, authorizationCode, state, tokenRequestConfig) {
@@ -2589,7 +2659,7 @@ var ThunderIDBrowserClient = class ThunderIDBrowserClient extends __thunderid_ja
 		await this.isInitialized();
 		if (SPAUtils_default.wasSignInCalled()) return;
 		const response = await this._signInSilentlyInternal(additionalParams, tokenRequestConfig);
-		if (this._onSignInCallback && response) this._onSignInCallback(response);
+		if (response) this._emitHook(Hooks_default.SignIn, response);
 		return response;
 	}
 	async _signInSilentlyInternal(additionalParams, tokenRequestConfig) {
@@ -2635,16 +2705,40 @@ var ThunderIDBrowserClient = class ThunderIDBrowserClient extends __thunderid_ja
 	}
 	async httpRequest(requestConfig) {
 		await this._validateMethod(false);
-		return this._authHelper.httpRequest(this._httpClient, requestConfig, this._isHttpHandlerEnabled, this._httpErrorCallback, this._httpFinishCallback);
+		const response = await this._authHelper.httpRequest(this._httpClient, requestConfig, this._isHttpHandlerEnabled, this._emitHttpError, this._emitHttpFinish);
+		if (this._isHttpHandlerEnabled) this._emitHttpFinish();
+		return response;
 	}
 	async httpRequestAll(configs) {
 		await this._validateMethod(false);
-		return this._authHelper.httpRequestAll(configs, this._httpClient, this._isHttpHandlerEnabled, this._httpErrorCallback, this._httpFinishCallback);
+		const responses = await this._authHelper.httpRequestAll(configs, this._httpClient, this._isHttpHandlerEnabled, this._emitHttpError, this._emitHttpFinish);
+		if (this._isHttpHandlerEnabled) this._emitHttpFinish();
+		return responses;
 	}
 	async getUser(userId) {
 		await this._validateMethod();
 		return super.getUser(userId);
 	}
+	/**
+	* Fetches the signed-in user's profile from the `/users/me` endpoint (or `endpoints.usersMe` when
+	* configured), sending the request through the client's HTTP client so the access token is attached.
+	*
+	* @param options - Optional `baseUrl` or full `url` overrides for the profile endpoint.
+	* @returns The user's profile.
+	*/
+	async getUserProfile(options) {
+		await this._validateMethod();
+		const configData = await this.getStorageManager().getConfigData();
+		const profile = await (0, __thunderid_javascript.getUsersMe)({
+			baseUrl: options?.baseUrl ?? configData?.baseUrl,
+			fetcher: createHttpClientFetcher_default(this._browserInstanceId),
+			url: (0, __thunderid_javascript.resolveResourceEndpoint)("usersMe", configData, options?.url)
+		});
+		return {
+			flattenedProfile: (0, __thunderid_javascript.generateFlattenedUserProfile)(profile),
+			profile
+		};
+	}
 	async getAccessToken(sessionId) {
 		return super.getAccessToken(sessionId);
 	}
@@ -2673,7 +2767,7 @@ var ThunderIDBrowserClient = class ThunderIDBrowserClient extends __thunderid_ja
 		return super.isSignedIn(userId);
 	}
 	notifySignIn(user) {
-		this._onSignInCallback(user);
+		this._emitHook(Hooks_default.SignIn, user);
 	}
 	async isSessionActive() {
 		await this.isInitialized();
@@ -2692,14 +2786,14 @@ var ThunderIDBrowserClient = class ThunderIDBrowserClient extends __thunderid_ja
 		const timer = await this._spaHelper.getRefreshTimeoutTimer();
 		await super.revokeAccessToken(userId);
 		await this._spaHelper.clearRefreshTokenTimeout(timer);
-		this._onEndUserSession && await this._onEndUserSession(true);
+		await this._emitHook(Hooks_default.RevokeAccessToken, true);
 		return true;
 	}
 	async exchangeToken(config) {
 		if (config.signInRequired) await this._validateMethod();
 		if (!config.id) return Promise.reject(new __thunderid_javascript.ThunderIDAuthException("SPA-AUTH_CLIENT-RCG-NF01", "The custom grant request id not found.", "Set the `id` attribute on the token exchange config."));
 		const response = await this._authHelper.exchangeToken(config, (cfg) => this._enableRetrievingSignOutURLFromSession(cfg));
-		this._onCustomGrant.get(config.id)?.(response);
+		this._emitHook(`${Hooks_default.CustomGrant}:${config.id}`, response);
 		return response;
 	}
 	async reInitialize(config) {
@@ -2726,47 +2820,56 @@ var ThunderIDBrowserClient = class ThunderIDBrowserClient extends __thunderid_ja
 	async decodeJwtToken(token) {
 		return this.getCryptoHelper().decodeJwtToken(token);
 	}
+	/**
+	* Subscribes a callback to a lifecycle hook. Every callback registered for a hook is called when it
+	* fires; registering the same callback again for the same hook has no further effect. Hooks can be
+	* registered before or after `initialize()`.
+	*
+	* @param hook - The hook to subscribe to (see `Hooks`).
+	* @param callback - Called when the hook fires.
+	* @param id - The custom grant id. Required for `custom-grant`.
+	*/
 	async on(hook, callback, id) {
 		await this.isInitialized();
 		if (!callback || typeof callback !== "function") throw new __thunderid_javascript.ThunderIDAuthException("SPA-AUTH_CLIENT-ON-IV02", "Invalid callback function.", "The provided callback must be a function.");
 		switch (hook) {
-			case "sign-in":
-				this._onSignInCallback = callback;
-				break;
-			case "sign-out":
-				this._onSignOutCallback = callback;
-				if (await SPAUtils_default.isSignOutSuccessful(ThunderIDBrowserClient.isSignOutSuccessful.bind(ThunderIDBrowserClient), () => ThunderIDBrowserClient.clearSession())) this._onSignOutCallback();
+			case Hooks_default.SignIn:
+			case Hooks_default.RevokeAccessToken:
+			case Hooks_default.Initialize:
+			case Hooks_default.HttpRequestError:
+			case Hooks_default.HttpRequestFinish:
+			case Hooks_default.HttpRequestStart:
+			case Hooks_default.HttpRequestSuccess:
+				this._addHookCallback(hook, callback);
 				break;
-			case "revoke-access-token":
-				this._onEndUserSession = callback;
+			case Hooks_default.SignOut:
+				if (await SPAUtils_default.isSignOutSuccessful(ThunderIDBrowserClient.isSignOutSuccessful.bind(ThunderIDBrowserClient), () => ThunderIDBrowserClient.clearSession())) callback();
 				break;
-			case "initialize":
-				this._onInitialize = callback;
+			case Hooks_default.CustomGrant:
+				id && this._addHookCallback(`${Hooks_default.CustomGrant}:${id}`, callback);
 				break;
-			case "http-request-error":
-				this._httpErrorCallback = callback;
-				break;
-			case "http-request-finish":
-				this._httpFinishCallback = callback;
-				break;
-			case "http-request-start":
-				this._httpClient?.setHttpRequestStartCallback?.(callback);
-				break;
-			case "http-request-success":
-				this._httpClient?.setHttpRequestSuccessCallback?.(callback);
-				break;
-			case "custom-grant":
-				id && this._onCustomGrant.set(id, callback);
-				break;
-			case "sign-out-failed": {
-				this._onSignOutFailedCallback = callback;
+			case Hooks_default.SignOutFailed: {
 				const signOutFail = SPAUtils_default.didSignOutFail(ThunderIDBrowserClient.didSignOutFail.bind(ThunderIDBrowserClient));
-				if (signOutFail) this._onSignOutFailedCallback(signOutFail);
+				if (signOutFail) callback(signOutFail);
 				break;
 			}
 			default: throw new __thunderid_javascript.ThunderIDAuthException("SPA-AUTH_CLIENT-ON-IV01", "Invalid hook.", `Unknown hook: "${hook}"`);
 		}
 	}
+	_addHookCallback(hook, callback) {
+		const callbacks = this._hookCallbacks.get(hook) ?? /* @__PURE__ */ new Set();
+		callbacks.add(callback);
+		this._hookCallbacks.set(hook, callbacks);
+	}
+	_emitHook(hook, response) {
+		return Promise.all([...this._hookCallbacks.get(hook) ?? []].map((callback) => Promise.resolve(callback(response))));
+	}
+	_emitHttpError = async (error) => {
+		await this._emitHook(Hooks_default.HttpRequestError, error);
+	};
+	_emitHttpFinish = () => {
+		this._emitHook(Hooks_default.HttpRequestFinish);
+	};
 	_enableRetrievingSignOutURLFromSession(config) {
 		if (config.preventSignOutURLUpdate) this._getSignOutURLFromSessionStorage = true;
 	}
@@ -2792,26 +2895,6 @@ var ThunderIDBrowserClient = class ThunderIDBrowserClient extends __thunderid_ja
 };
 var ThunderIDBrowserClient_default = ThunderIDBrowserClient;
 
-//#endregion
-//#region src/constants/Hooks.ts
-/**
-* Event hook names for attaching callbacks via `ThunderIDBrowserClient.on()`.
-*/
-let Hooks = /* @__PURE__ */ function(Hooks$1) {
-	Hooks$1["SignIn"] = "sign-in";
-	Hooks$1["SignOut"] = "sign-out";
-	Hooks$1["Initialize"] = "initialize";
-	Hooks$1["HttpRequestStart"] = "http-request-start";
-	Hooks$1["HttpRequestFinish"] = "http-request-finish";
-	Hooks$1["HttpRequestError"] = "http-request-error";
-	Hooks$1["HttpRequestSuccess"] = "http-request-success";
-	Hooks$1["RevokeAccessToken"] = "revoke-access-token";
-	Hooks$1["CustomGrant"] = "custom-grant";
-	Hooks$1["SignOutFailed"] = "sign-out-failed";
-	return Hooks$1;
-}({});
-var Hooks_default = Hooks;
-
 //#endregion
 //#region src/utils/hasAuthParamsInUrl.ts
 /**
@@ -2863,57 +2946,6 @@ const http = (client) => {
 };
 var http_default = http;
 
-//#endregion
-//#region src/utils/createHttpClientFetcher.ts
-/**
-* Builds a `fetch`-shaped function backed by the shared `FetchHttpClient` singleton, for
-* framework wrappers (`@thunderid/react`, `@thunderid/vue`) that need to hand a core
-* `@thunderid/javascript` API function a `fetcher` carrying the access token automatically.
-*
-* Unlike a plain `fetch` call, `FetchHttpClient.request` throws on a non-2xx response instead
-* of resolving it. This adapter catches that and reconstructs a `Response`-shaped object from
-* the thrown error's `response`, so the core API function sees the real status and body instead
-* of treating every non-2xx result as a network failure. A genuine network error (no response
-* attached) still propagates.
-*
-* @param instanceId - Which `FetchHttpClient` instance to use, for multi-instance apps. Defaults to `0`.
-* @returns A function matching the `(url, config) => Promise<Response>` shape core API functions expect.
-* @example
-* ```typescript
-* await updateMeCredentials({
-*   ...config,
-*   fetcher: fetcher ?? createHttpClientFetcher(instanceId),
-* });
-* ```
-*/
-const createHttpClientFetcher = (instanceId = 0) => {
-	return async (url, config) => {
-		const httpClient = FetchHttpClient_default.getInstance(instanceId);
-		const toResponse = (data, status, statusText) => ({
-			json: () => Promise.resolve(data),
-			ok: status >= 200 && status < 300,
-			status,
-			statusText,
-			text: () => Promise.resolve(typeof data === "string" ? data : JSON.stringify(data))
-		});
-		try {
-			const response = await httpClient.request({
-				data: config.body ? JSON.parse(config.body) : void 0,
-				headers: config.headers,
-				method: config.method || "POST",
-				signal: config.signal,
-				url
-			});
-			return toResponse(response.data, response.status, response.statusText || "");
-		} catch (error) {
-			const httpError = error;
-			if (httpError?.response) return toResponse(httpError.response.data, httpError.response.status, httpError.response.statusText ?? "");
-			throw error;
-		}
-	};
-};
-var createHttpClientFetcher_default = createHttpClientFetcher;
-
 //#endregion
 //#region src/utils/copyTextToClipboard.ts
 /**
@@ -3507,6 +3539,23 @@ const AVATAR_PALETTES = [
 * without needing the actual palette values.
 */
 const AVATAR_GRADIENT_COUNT = AVATAR_PALETTES.length;
+const XML_ESCAPES = {
+	"\"": "&quot;",
+	"&": "&amp;",
+	"'": "&apos;",
+	"<": "&lt;",
+	">": "&gt;"
+};
+/**
+* Escapes a caller-supplied value for interpolation into SVG text.
+*/
+const escapeXml = (value) => value.replace(/["&'<>]/g, (ch) => XML_ESCAPES[ch]);
+/**
+* Encodes an SVG document as a data URI. Lone UTF-16 surrogates are replaced with U+FFFD
+* first, since `encodeURIComponent` throws a `URIError` on them. `Array.from` iterates by
+* code point, so a surrogate it yields on its own is unpaired.
+*/
+const toSvgDataUri = (svg) => `data:image/svg+xml,${encodeURIComponent(Array.from(svg, (ch) => ch.length === 1 && ch >= "\ud800" && ch <= "\udfff" ? "�" : ch).join(""))}`;
 /**
 * Fills in `params.content` when the spec itself didn't carry one, deriving it from a raw
 * seed name (e.g. an app or user display name) — extracting initials for letter variants,
@@ -3557,11 +3606,10 @@ const generateGradientAvatar = ({ shape, variant, content, colors, bg }) => {
 	let text = "";
 	if (variant !== "blank") {
 		const letterCount = variant === "one_letter" ? 1 : 2;
-		const initials = (content || "A").toUpperCase().slice(0, letterCount);
+		const initials = escapeXml(Array.from((content || "A").toUpperCase()).slice(0, letterCount).join(""));
 		text = `<text x="50" y="64" font-family="Helvetica,Arial,sans-serif" font-weight="700" font-size="${letterCount === 1 ? 46 : 34}" text-anchor="middle" fill="#fff">${initials}</text>`;
 	}
-	const svg = `<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 100 100">${defs}${shapeMarkup(shape, background)}${text}</svg>`;
-	return `data:image/svg+xml,${encodeURIComponent(svg)}`;
+	return toSvgDataUri(`<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 100 100">${defs}${shapeMarkup(shape, background)}${text}</svg>`);
 };
 /**
 * Renders one of the curated anonymous-animal icons, applying the requested background
@@ -3573,8 +3621,7 @@ const generateAnonymousAnimalAvatar = ({ shape, content, bg }) => {
 	const icon = ANONYMOUS_ANIMAL_ICONS[Object.prototype.hasOwnProperty.call(ANONYMOUS_ANIMAL_ICONS, content) ? content : pickAnonymousAvatarName_default()];
 	const color = bg ?? icon.color;
 	const markup = icon.markup.replaceAll("%COLOR%", color);
-	const svg = `<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 100 100">${shapeMarkup(shape, color)}${markup}</svg>`;
-	return `data:image/svg+xml,${encodeURIComponent(svg)}`;
+	return toSvgDataUri(`<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 100 100">${shapeMarkup(shape, color)}${markup}</svg>`);
 };
 /**
 * Renders one of the curated anonymous-entity icons (application/organization/resource-server
@@ -3586,8 +3633,7 @@ const generateAnonymousEntityAvatar = ({ shape, content, bg }) => {
 	const icon = ANONYMOUS_ENTITY_ICONS[Object.prototype.hasOwnProperty.call(ANONYMOUS_ENTITY_ICONS, content) ? content : pickAnonymousEntityName_default()];
 	const color = bg ?? icon.color;
 	const markup = icon.markup.replaceAll("%COLOR%", color);
-	const svg = `<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 100 100">${shapeMarkup(shape, color)}${markup}</svg>`;
-	return `data:image/svg+xml,${encodeURIComponent(svg)}`;
+	return toSvgDataUri(`<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 100 100">${shapeMarkup(shape, color)}${markup}</svg>`);
 };
 /**
 * Generates an avatar image as an `svg+xml` data URI from a fully-resolved {@link AvatarParams}.
@@ -3704,7 +3750,8 @@ const createClassObserver = (targetElement, callback, config = {}) => {
 	return observer;
 };
 /**
-* Creates a media query listener for system theme changes
+* Creates a media query listener for system theme changes. Call `disconnect()` on the returned
+* object to remove the listener.
 */
 const createMediaQueryListener = (callback) => {
 	if (typeof window === "undefined" || !window.matchMedia) return null;
@@ -3714,7 +3761,10 @@ const createMediaQueryListener = (callback) => {
 	};
 	if (mediaQuery.addEventListener) mediaQuery.addEventListener("change", handleChange);
 	else mediaQuery.addListener(handleChange);
-	return mediaQuery;
+	return Object.assign(mediaQuery, { disconnect: () => {
+		if (mediaQuery.removeEventListener) mediaQuery.removeEventListener("change", handleChange);
+		else mediaQuery.removeListener(handleChange);
+	} });
 };
 
 //#endregion