@thunderid/browser 1.3.0 → 1.3.1

package/dist/index.d.ts

@@ -40,7 +40,7 @@ export type { AnonymousEntityIcon } from './utils/anonymousEntityIcons.generated
 export { default as resolveLogoUri } from './utils/resolveLogoUri';
 export type { ResolvedLogo, ResolvedLogoKind } from './utils/resolveLogoUri';
 export { detectThemeMode, createClassObserver, createMediaQueryListener } from './theme/themeDetection';
-export type { BrowserThemeDetection } from './theme/themeDetection';
+export type { BrowserThemeDetection, MediaQueryListener } from './theme/themeDetection';
 export { default as getActiveTheme } from './theme/getActiveTheme';
 export { default as normalizeBorderRadius } from './theme/normalizeBorderRadius';
 export * from '@thunderid/javascript';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAGA;;GAEG;AAGH,OAAO,EAAC,OAAO,IAAI,sBAAsB,EAAC,MAAM,0BAA0B,CAAC;AAC3E,OAAO,EAAC,OAAO,IAAI,eAAe,EAAC,MAAM,mBAAmB,CAAC;AAG7D,OAAO,EAAC,OAAO,IAAI,KAAK,EAAE,KAAK,IAAI,YAAY,EAAC,MAAM,mBAAmB,CAAC;AAC1E,cAAc,0BAA0B,CAAC;AAGzC,OAAO,EAAC,OAAO,IAAI,cAAc,EAAC,MAAM,yBAAyB,CAAC;AAClE,YAAY,EAAC,mBAAmB,EAAE,iBAAiB,EAAC,MAAM,wBAAwB,CAAC;AACnF,YAAY,EAAC,OAAO,IAAI,YAAY,EAAC,MAAM,uBAAuB,CAAC;AACnE,YAAY,EAAC,OAAO,IAAI,YAAY,EAAC,MAAM,uBAAuB,CAAC;AACnE,YAAY,EAAC,sBAAsB,EAAC,MAAM,8BAA8B,CAAC;AACzE,YAAY,EAAC,sBAAsB,EAAC,MAAM,iBAAiB,CAAC;AAG5D,OAAO,EAAC,OAAO,IAAI,UAAU,EAAC,MAAM,qBAAqB,CAAC;AAC1D,OAAO,EAAC,OAAO,IAAI,YAAY,EAAC,MAAM,uBAAuB,CAAC;AAC9D,OAAO,EAAC,OAAO,IAAI,WAAW,EAAC,MAAM,sBAAsB,CAAC;AAG5D,OAAO,EAAC,OAAO,IAAI,cAAc,EAAC,MAAM,wBAAwB,CAAC;AACjE,OAAO,EAAC,OAAO,IAAI,QAAQ,EAAC,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAC,OAAO,IAAI,SAAS,EAAC,MAAM,mBAAmB,CAAC;AACvD,OAAO,EAAC,OAAO,IAAI,oBAAoB,EAAC,MAAM,8BAA8B,CAAC;AAC7E,OAAO,EAAC,OAAO,IAAI,kBAAkB,EAAC,MAAM,4BAA4B,CAAC;AACzE,OAAO,EAAC,OAAO,IAAI,6BAA6B,EAAC,MAAM,uCAAuC,CAAC;AAC/F,OAAO,EAAC,OAAO,IAAI,QAAQ,EAAC,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAC,OAAO,IAAI,IAAI,EAAC,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAC,OAAO,IAAI,uBAAuB,EAAC,MAAM,iCAAiC,CAAC;AACnF,OAAO,EAAC,OAAO,IAAI,mBAAmB,EAAC,MAAM,6BAA6B,CAAC;AAC3E,OAAO,EAAC,OAAO,IAAI,4BAA4B,EAAC,MAAM,sCAAsC,CAAC;AAC7F,OAAO,EAAC,OAAO,IAAI,sBAAsB,EAAC,MAAM,gCAAgC,CAAC;AACjF,OAAO,EAAC,OAAO,IAAI,WAAW,EAAE,iBAAiB,EAAC,MAAM,qBAAqB,CAAC;AAC9E,OAAO,EAAC,OAAO,IAAI,0BAA0B,EAAC,MAAM,oCAAoC,CAAC;AACzF,YAAY,EAAC,YAAY,EAAE,WAAW,EAAE,aAAa,EAAC,MAAM,oCAAoC,CAAC;AACjG,OAAO,EAAC,OAAO,IAAI,eAAe,EAAC,MAAM,yBAAyB,CAAC;AACnE,OAAO,EACL,OAAO,IAAI,qBAAqB,EAChC,mBAAmB,EACnB,qBAAqB,GACtB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAC,OAAO,IAAI,uBAAuB,EAAC,MAAM,iCAAiC,CAAC;AACnF,OAAO,EAAC,OAAO,IAAI,uBAAuB,EAAC,MAAM,iCAAiC,CAAC;AACnF,OAAO,EAAC,sBAAsB,EAAC,MAAM,wCAAwC,CAAC;AAC9E,YAAY,EAAC,mBAAmB,EAAC,MAAM,wCAAwC,CAAC;AAChF,OAAO,EAAC,sBAAsB,EAAC,MAAM,wCAAwC,CAAC;AAC9E,YAAY,EAAC,mBAAmB,EAAC,MAAM,wCAAwC,CAAC;AAChF,OAAO,EAAC,OAAO,IAAI,cAAc,EAAC,MAAM,wBAAwB,CAAC;AACjE,YAAY,EAAC,YAAY,EAAE,gBAAgB,EAAC,MAAM,wBAAwB,CAAC;AAG3E,OAAO,EAAC,eAAe,EAAE,mBAAmB,EAAE,wBAAwB,EAAC,MAAM,wBAAwB,CAAC;AACtG,YAAY,EAAC,qBAAqB,EAAC,MAAM,wBAAwB,CAAC;AAClE,OAAO,EAAC,OAAO,IAAI,cAAc,EAAC,MAAM,wBAAwB,CAAC;AACjE,OAAO,EAAC,OAAO,IAAI,qBAAqB,EAAC,MAAM,+BAA+B,CAAC;AAG/E,cAAc,uBAAuB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAGA;;GAEG;AAGH,OAAO,EAAC,OAAO,IAAI,sBAAsB,EAAC,MAAM,0BAA0B,CAAC;AAC3E,OAAO,EAAC,OAAO,IAAI,eAAe,EAAC,MAAM,mBAAmB,CAAC;AAG7D,OAAO,EAAC,OAAO,IAAI,KAAK,EAAE,KAAK,IAAI,YAAY,EAAC,MAAM,mBAAmB,CAAC;AAC1E,cAAc,0BAA0B,CAAC;AAGzC,OAAO,EAAC,OAAO,IAAI,cAAc,EAAC,MAAM,yBAAyB,CAAC;AAClE,YAAY,EAAC,mBAAmB,EAAE,iBAAiB,EAAC,MAAM,wBAAwB,CAAC;AACnF,YAAY,EAAC,OAAO,IAAI,YAAY,EAAC,MAAM,uBAAuB,CAAC;AACnE,YAAY,EAAC,OAAO,IAAI,YAAY,EAAC,MAAM,uBAAuB,CAAC;AACnE,YAAY,EAAC,sBAAsB,EAAC,MAAM,8BAA8B,CAAC;AACzE,YAAY,EAAC,sBAAsB,EAAC,MAAM,iBAAiB,CAAC;AAG5D,OAAO,EAAC,OAAO,IAAI,UAAU,EAAC,MAAM,qBAAqB,CAAC;AAC1D,OAAO,EAAC,OAAO,IAAI,YAAY,EAAC,MAAM,uBAAuB,CAAC;AAC9D,OAAO,EAAC,OAAO,IAAI,WAAW,EAAC,MAAM,sBAAsB,CAAC;AAG5D,OAAO,EAAC,OAAO,IAAI,cAAc,EAAC,MAAM,wBAAwB,CAAC;AACjE,OAAO,EAAC,OAAO,IAAI,QAAQ,EAAC,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAC,OAAO,IAAI,SAAS,EAAC,MAAM,mBAAmB,CAAC;AACvD,OAAO,EAAC,OAAO,IAAI,oBAAoB,EAAC,MAAM,8BAA8B,CAAC;AAC7E,OAAO,EAAC,OAAO,IAAI,kBAAkB,EAAC,MAAM,4BAA4B,CAAC;AACzE,OAAO,EAAC,OAAO,IAAI,6BAA6B,EAAC,MAAM,uCAAuC,CAAC;AAC/F,OAAO,EAAC,OAAO,IAAI,QAAQ,EAAC,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAC,OAAO,IAAI,IAAI,EAAC,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAC,OAAO,IAAI,uBAAuB,EAAC,MAAM,iCAAiC,CAAC;AACnF,OAAO,EAAC,OAAO,IAAI,mBAAmB,EAAC,MAAM,6BAA6B,CAAC;AAC3E,OAAO,EAAC,OAAO,IAAI,4BAA4B,EAAC,MAAM,sCAAsC,CAAC;AAC7F,OAAO,EAAC,OAAO,IAAI,sBAAsB,EAAC,MAAM,gCAAgC,CAAC;AACjF,OAAO,EAAC,OAAO,IAAI,WAAW,EAAE,iBAAiB,EAAC,MAAM,qBAAqB,CAAC;AAC9E,OAAO,EAAC,OAAO,IAAI,0BAA0B,EAAC,MAAM,oCAAoC,CAAC;AACzF,YAAY,EAAC,YAAY,EAAE,WAAW,EAAE,aAAa,EAAC,MAAM,oCAAoC,CAAC;AACjG,OAAO,EAAC,OAAO,IAAI,eAAe,EAAC,MAAM,yBAAyB,CAAC;AACnE,OAAO,EACL,OAAO,IAAI,qBAAqB,EAChC,mBAAmB,EACnB,qBAAqB,GACtB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAC,OAAO,IAAI,uBAAuB,EAAC,MAAM,iCAAiC,CAAC;AACnF,OAAO,EAAC,OAAO,IAAI,uBAAuB,EAAC,MAAM,iCAAiC,CAAC;AACnF,OAAO,EAAC,sBAAsB,EAAC,MAAM,wCAAwC,CAAC;AAC9E,YAAY,EAAC,mBAAmB,EAAC,MAAM,wCAAwC,CAAC;AAChF,OAAO,EAAC,sBAAsB,EAAC,MAAM,wCAAwC,CAAC;AAC9E,YAAY,EAAC,mBAAmB,EAAC,MAAM,wCAAwC,CAAC;AAChF,OAAO,EAAC,OAAO,IAAI,cAAc,EAAC,MAAM,wBAAwB,CAAC;AACjE,YAAY,EAAC,YAAY,EAAE,gBAAgB,EAAC,MAAM,wBAAwB,CAAC;AAG3E,OAAO,EAAC,eAAe,EAAE,mBAAmB,EAAE,wBAAwB,EAAC,MAAM,wBAAwB,CAAC;AACtG,YAAY,EAAC,qBAAqB,EAAE,kBAAkB,EAAC,MAAM,wBAAwB,CAAC;AACtF,OAAO,EAAC,OAAO,IAAI,cAAc,EAAC,MAAM,wBAAwB,CAAC;AACjE,OAAO,EAAC,OAAO,IAAI,qBAAqB,EAAC,MAAM,+BAA+B,CAAC;AAG/E,cAAc,uBAAuB,CAAC"}

package/dist/index.js

@@ -1,6 +1,6 @@
 import { Buffer } from 'buffer/index.js';
 if (typeof window !== 'undefined' && !window.Buffer) { window.Buffer = Buffer; }
-import { DEFAULT_THEME, HttpClient, OIDCRequestConstants, ThunderIDAuthException, ThunderIDJavaScriptClient, ThunderIDRuntimeError, TokenConstants, arrayBufferToBase64url, base64urlToArrayBuffer, createPackageComponentLogger, extractEmojiFromUri, extractPkceStorageKeyFromState, isEmojiUri } from "@thunderid/javascript";
+import { DEFAULT_THEME, HttpClient, OIDCRequestConstants, ThunderIDAuthException, ThunderIDJavaScriptClient, ThunderIDRuntimeError, TokenConstants, arrayBufferToBase64url, base64urlToArrayBuffer, createPackageComponentLogger, extractEmojiFromUri, extractPkceStorageKeyFromState, generateFlattenedUserProfile, getUsersMe, isEmojiUri, resolveResourceEndpoint } from "@thunderid/javascript";
 import base64url from "base64url";
 import sha256 from "fast-sha256";
 import { createLocalJWKSet, jwtVerify } from "jose";
@@ -32,6 +32,26 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 	enumerable: true
 }) : target, mod));
 
+//#endregion
+//#region src/constants/Hooks.ts
+/**
+* Event hook names for attaching callbacks via `ThunderIDBrowserClient.on()`.
+*/
+let Hooks = /* @__PURE__ */ function(Hooks$1) {
+	Hooks$1["SignIn"] = "sign-in";
+	Hooks$1["SignOut"] = "sign-out";
+	Hooks$1["Initialize"] = "initialize";
+	Hooks$1["HttpRequestStart"] = "http-request-start";
+	Hooks$1["HttpRequestFinish"] = "http-request-finish";
+	Hooks$1["HttpRequestError"] = "http-request-error";
+	Hooks$1["HttpRequestSuccess"] = "http-request-success";
+	Hooks$1["RevokeAccessToken"] = "revoke-access-token";
+	Hooks$1["CustomGrant"] = "custom-grant";
+	Hooks$1["SignOutFailed"] = "sign-out-failed";
+	return Hooks$1;
+}({});
+var Hooks_default = Hooks;
+
 //#endregion
 //#region src/constants/SPAConstants.ts
 const ERROR = "error";
@@ -780,6 +800,57 @@ var AuthenticationHelper = class {
 };
 var AuthenticationHelper_default = AuthenticationHelper;
 
+//#endregion
+//#region src/utils/createHttpClientFetcher.ts
+/**
+* Builds a `fetch`-shaped function backed by the shared `FetchHttpClient` singleton, for
+* framework wrappers (`@thunderid/react`, `@thunderid/vue`) that need to hand a core
+* `@thunderid/javascript` API function a `fetcher` carrying the access token automatically.
+*
+* Unlike a plain `fetch` call, `FetchHttpClient.request` throws on a non-2xx response instead
+* of resolving it. This adapter catches that and reconstructs a `Response`-shaped object from
+* the thrown error's `response`, so the core API function sees the real status and body instead
+* of treating every non-2xx result as a network failure. A genuine network error (no response
+* attached) still propagates.
+*
+* @param instanceId - Which `FetchHttpClient` instance to use, for multi-instance apps. Defaults to `0`.
+* @returns A function matching the `(url, config) => Promise<Response>` shape core API functions expect.
+* @example
+* ```typescript
+* await updateMeCredentials({
+*   ...config,
+*   fetcher: fetcher ?? createHttpClientFetcher(instanceId),
+* });
+* ```
+*/
+const createHttpClientFetcher = (instanceId = 0) => {
+	return async (url, config) => {
+		const httpClient = FetchHttpClient_default.getInstance(instanceId);
+		const toResponse = (data, status, statusText) => ({
+			json: () => Promise.resolve(data),
+			ok: status >= 200 && status < 300,
+			status,
+			statusText,
+			text: () => Promise.resolve(typeof data === "string" ? data : JSON.stringify(data))
+		});
+		try {
+			const response = await httpClient.request({
+				data: config.body ? JSON.parse(config.body) : void 0,
+				headers: config.headers,
+				method: config.method || "POST",
+				signal: config.signal,
+				url
+			});
+			return toResponse(response.data, response.status, response.statusText || "");
+		} catch (error) {
+			const httpError = error;
+			if (httpError?.response) return toResponse(httpError.response.data, httpError.response.status, httpError.response.statusText ?? "");
+			throw error;
+		}
+	};
+};
+var createHttpClientFetcher_default = createHttpClientFetcher;
+
 //#endregion
 //#region src/utils/navigate.ts
 /**
@@ -2439,14 +2510,7 @@ var ThunderIDBrowserClient = class ThunderIDBrowserClient extends ThunderIDJavaS
 	_storage = BrowserStorage_default.SessionStorage;
 	_getSignOutURLFromSessionStorage = false;
 	_isHttpHandlerEnabled = true;
-	_httpErrorCallback;
-	_httpFinishCallback;
-	_onSignInCallback = () => null;
-	_onSignOutCallback = () => null;
-	_onSignOutFailedCallback = () => null;
-	_onEndUserSession = () => null;
-	_onInitialize = () => null;
-	_onCustomGrant = /* @__PURE__ */ new Map();
+	_hookCallbacks = /* @__PURE__ */ new Map();
 	_initialized = false;
 	_startedInitialize = false;
 	constructor(instanceId = 0) {
@@ -2473,6 +2537,12 @@ var ThunderIDBrowserClient = class ThunderIDBrowserClient extends ThunderIDJavaS
 			await this._authHelper?.attachTokenToRequestConfig(request);
 		};
 		this._httpClient = FetchHttpClient_default.getInstance(this._browserInstanceId, true, attachToken);
+		this._httpClient.setHttpRequestStartCallback((request) => {
+			this._emitHook(Hooks_default.HttpRequestStart, request);
+		});
+		this._httpClient.setHttpRequestSuccessCallback((response) => {
+			this._emitHook(Hooks_default.HttpRequestSuccess, response);
+		});
 		this._authHelper = new AuthenticationHelper_default(sm, this._spaHelper, this._browserInstanceId, {
 			exchangeToken: (cfg) => super.exchangeToken(cfg),
 			getAccessToken: (sessionId) => this.getAccessToken(sessionId),
@@ -2487,7 +2557,7 @@ var ThunderIDBrowserClient = class ThunderIDBrowserClient extends ThunderIDJavaS
 			setPKCECode: (pkceKey, state) => this.setPKCECode(pkceKey, state)
 		});
 		this._initialized = true;
-		if (this._onInitialize) this._onInitialize(true);
+		this._emitHook(Hooks_default.Initialize, true);
 		if (!merged.autoLogoutOnTokenRefreshError) return true;
 		window.addEventListener("message", (event) => {
 			if (event?.data?.type === REFRESH_ACCESS_TOKEN_ERR0R) this.signOut();
@@ -2518,7 +2588,7 @@ var ThunderIDBrowserClient = class ThunderIDBrowserClient extends ThunderIDJavaS
 		if (!SPAUtils_default.canContinueSignIn(Boolean(config?.callOnlyOnRedirect), authorizationCode)) return;
 		delete config?.callOnlyOnRedirect;
 		const user = await this._signInInternal(config, authorizationCode, state, tokenRequestConfig);
-		if (user && this._onSignInCallback) this._onSignInCallback(user);
+		if (user) this._emitHook(Hooks_default.SignIn, user);
 		return user;
 	}
 	async _signInInternal(signInConfig, authorizationCode, state, tokenRequestConfig) {
@@ -2587,7 +2657,7 @@ var ThunderIDBrowserClient = class ThunderIDBrowserClient extends ThunderIDJavaS
 		await this.isInitialized();
 		if (SPAUtils_default.wasSignInCalled()) return;
 		const response = await this._signInSilentlyInternal(additionalParams, tokenRequestConfig);
-		if (this._onSignInCallback && response) this._onSignInCallback(response);
+		if (response) this._emitHook(Hooks_default.SignIn, response);
 		return response;
 	}
 	async _signInSilentlyInternal(additionalParams, tokenRequestConfig) {
@@ -2633,16 +2703,40 @@ var ThunderIDBrowserClient = class ThunderIDBrowserClient extends ThunderIDJavaS
 	}
 	async httpRequest(requestConfig) {
 		await this._validateMethod(false);
-		return this._authHelper.httpRequest(this._httpClient, requestConfig, this._isHttpHandlerEnabled, this._httpErrorCallback, this._httpFinishCallback);
+		const response = await this._authHelper.httpRequest(this._httpClient, requestConfig, this._isHttpHandlerEnabled, this._emitHttpError, this._emitHttpFinish);
+		if (this._isHttpHandlerEnabled) this._emitHttpFinish();
+		return response;
 	}
 	async httpRequestAll(configs) {
 		await this._validateMethod(false);
-		return this._authHelper.httpRequestAll(configs, this._httpClient, this._isHttpHandlerEnabled, this._httpErrorCallback, this._httpFinishCallback);
+		const responses = await this._authHelper.httpRequestAll(configs, this._httpClient, this._isHttpHandlerEnabled, this._emitHttpError, this._emitHttpFinish);
+		if (this._isHttpHandlerEnabled) this._emitHttpFinish();
+		return responses;
 	}
 	async getUser(userId) {
 		await this._validateMethod();
 		return super.getUser(userId);
 	}
+	/**
+	* Fetches the signed-in user's profile from the `/users/me` endpoint (or `endpoints.usersMe` when
+	* configured), sending the request through the client's HTTP client so the access token is attached.
+	*
+	* @param options - Optional `baseUrl` or full `url` overrides for the profile endpoint.
+	* @returns The user's profile.
+	*/
+	async getUserProfile(options) {
+		await this._validateMethod();
+		const configData = await this.getStorageManager().getConfigData();
+		const profile = await getUsersMe({
+			baseUrl: options?.baseUrl ?? configData?.baseUrl,
+			fetcher: createHttpClientFetcher_default(this._browserInstanceId),
+			url: resolveResourceEndpoint("usersMe", configData, options?.url)
+		});
+		return {
+			flattenedProfile: generateFlattenedUserProfile(profile),
+			profile
+		};
+	}
 	async getAccessToken(sessionId) {
 		return super.getAccessToken(sessionId);
 	}
@@ -2671,7 +2765,7 @@ var ThunderIDBrowserClient = class ThunderIDBrowserClient extends ThunderIDJavaS
 		return super.isSignedIn(userId);
 	}
 	notifySignIn(user) {
-		this._onSignInCallback(user);
+		this._emitHook(Hooks_default.SignIn, user);
 	}
 	async isSessionActive() {
 		await this.isInitialized();
@@ -2690,14 +2784,14 @@ var ThunderIDBrowserClient = class ThunderIDBrowserClient extends ThunderIDJavaS
 		const timer = await this._spaHelper.getRefreshTimeoutTimer();
 		await super.revokeAccessToken(userId);
 		await this._spaHelper.clearRefreshTokenTimeout(timer);
-		this._onEndUserSession && await this._onEndUserSession(true);
+		await this._emitHook(Hooks_default.RevokeAccessToken, true);
 		return true;
 	}
 	async exchangeToken(config) {
 		if (config.signInRequired) await this._validateMethod();
 		if (!config.id) return Promise.reject(new ThunderIDAuthException("SPA-AUTH_CLIENT-RCG-NF01", "The custom grant request id not found.", "Set the `id` attribute on the token exchange config."));
 		const response = await this._authHelper.exchangeToken(config, (cfg) => this._enableRetrievingSignOutURLFromSession(cfg));
-		this._onCustomGrant.get(config.id)?.(response);
+		this._emitHook(`${Hooks_default.CustomGrant}:${config.id}`, response);
 		return response;
 	}
 	async reInitialize(config) {
@@ -2724,47 +2818,56 @@ var ThunderIDBrowserClient = class ThunderIDBrowserClient extends ThunderIDJavaS
 	async decodeJwtToken(token) {
 		return this.getCryptoHelper().decodeJwtToken(token);
 	}
+	/**
+	* Subscribes a callback to a lifecycle hook. Every callback registered for a hook is called when it
+	* fires; registering the same callback again for the same hook has no further effect. Hooks can be
+	* registered before or after `initialize()`.
+	*
+	* @param hook - The hook to subscribe to (see `Hooks`).
+	* @param callback - Called when the hook fires.
+	* @param id - The custom grant id. Required for `custom-grant`.
+	*/
 	async on(hook, callback, id) {
 		await this.isInitialized();
 		if (!callback || typeof callback !== "function") throw new ThunderIDAuthException("SPA-AUTH_CLIENT-ON-IV02", "Invalid callback function.", "The provided callback must be a function.");
 		switch (hook) {
-			case "sign-in":
-				this._onSignInCallback = callback;
-				break;
-			case "sign-out":
-				this._onSignOutCallback = callback;
-				if (await SPAUtils_default.isSignOutSuccessful(ThunderIDBrowserClient.isSignOutSuccessful.bind(ThunderIDBrowserClient), () => ThunderIDBrowserClient.clearSession())) this._onSignOutCallback();
+			case Hooks_default.SignIn:
+			case Hooks_default.RevokeAccessToken:
+			case Hooks_default.Initialize:
+			case Hooks_default.HttpRequestError:
+			case Hooks_default.HttpRequestFinish:
+			case Hooks_default.HttpRequestStart:
+			case Hooks_default.HttpRequestSuccess:
+				this._addHookCallback(hook, callback);
 				break;
-			case "revoke-access-token":
-				this._onEndUserSession = callback;
+			case Hooks_default.SignOut:
+				if (await SPAUtils_default.isSignOutSuccessful(ThunderIDBrowserClient.isSignOutSuccessful.bind(ThunderIDBrowserClient), () => ThunderIDBrowserClient.clearSession())) callback();
 				break;
-			case "initialize":
-				this._onInitialize = callback;
+			case Hooks_default.CustomGrant:
+				id && this._addHookCallback(`${Hooks_default.CustomGrant}:${id}`, callback);
 				break;
-			case "http-request-error":
-				this._httpErrorCallback = callback;
-				break;
-			case "http-request-finish":
-				this._httpFinishCallback = callback;
-				break;
-			case "http-request-start":
-				this._httpClient?.setHttpRequestStartCallback?.(callback);
-				break;
-			case "http-request-success":
-				this._httpClient?.setHttpRequestSuccessCallback?.(callback);
-				break;
-			case "custom-grant":
-				id && this._onCustomGrant.set(id, callback);
-				break;
-			case "sign-out-failed": {
-				this._onSignOutFailedCallback = callback;
+			case Hooks_default.SignOutFailed: {
 				const signOutFail = SPAUtils_default.didSignOutFail(ThunderIDBrowserClient.didSignOutFail.bind(ThunderIDBrowserClient));
-				if (signOutFail) this._onSignOutFailedCallback(signOutFail);
+				if (signOutFail) callback(signOutFail);
 				break;
 			}
 			default: throw new ThunderIDAuthException("SPA-AUTH_CLIENT-ON-IV01", "Invalid hook.", `Unknown hook: "${hook}"`);
 		}
 	}
+	_addHookCallback(hook, callback) {
+		const callbacks = this._hookCallbacks.get(hook) ?? /* @__PURE__ */ new Set();
+		callbacks.add(callback);
+		this._hookCallbacks.set(hook, callbacks);
+	}
+	_emitHook(hook, response) {
+		return Promise.all([...this._hookCallbacks.get(hook) ?? []].map((callback) => Promise.resolve(callback(response))));
+	}
+	_emitHttpError = async (error) => {
+		await this._emitHook(Hooks_default.HttpRequestError, error);
+	};
+	_emitHttpFinish = () => {
+		this._emitHook(Hooks_default.HttpRequestFinish);
+	};
 	_enableRetrievingSignOutURLFromSession(config) {
 		if (config.preventSignOutURLUpdate) this._getSignOutURLFromSessionStorage = true;
 	}
@@ -2790,26 +2893,6 @@ var ThunderIDBrowserClient = class ThunderIDBrowserClient extends ThunderIDJavaS
 };
 var ThunderIDBrowserClient_default = ThunderIDBrowserClient;
 
-//#endregion
-//#region src/constants/Hooks.ts
-/**
-* Event hook names for attaching callbacks via `ThunderIDBrowserClient.on()`.
-*/
-let Hooks = /* @__PURE__ */ function(Hooks$1) {
-	Hooks$1["SignIn"] = "sign-in";
-	Hooks$1["SignOut"] = "sign-out";
-	Hooks$1["Initialize"] = "initialize";
-	Hooks$1["HttpRequestStart"] = "http-request-start";
-	Hooks$1["HttpRequestFinish"] = "http-request-finish";
-	Hooks$1["HttpRequestError"] = "http-request-error";
-	Hooks$1["HttpRequestSuccess"] = "http-request-success";
-	Hooks$1["RevokeAccessToken"] = "revoke-access-token";
-	Hooks$1["CustomGrant"] = "custom-grant";
-	Hooks$1["SignOutFailed"] = "sign-out-failed";
-	return Hooks$1;
-}({});
-var Hooks_default = Hooks;
-
 //#endregion
 //#region src/utils/hasAuthParamsInUrl.ts
 /**
@@ -2861,57 +2944,6 @@ const http = (client) => {
 };
 var http_default = http;
 
-//#endregion
-//#region src/utils/createHttpClientFetcher.ts
-/**
-* Builds a `fetch`-shaped function backed by the shared `FetchHttpClient` singleton, for
-* framework wrappers (`@thunderid/react`, `@thunderid/vue`) that need to hand a core
-* `@thunderid/javascript` API function a `fetcher` carrying the access token automatically.
-*
-* Unlike a plain `fetch` call, `FetchHttpClient.request` throws on a non-2xx response instead
-* of resolving it. This adapter catches that and reconstructs a `Response`-shaped object from
-* the thrown error's `response`, so the core API function sees the real status and body instead
-* of treating every non-2xx result as a network failure. A genuine network error (no response
-* attached) still propagates.
-*
-* @param instanceId - Which `FetchHttpClient` instance to use, for multi-instance apps. Defaults to `0`.
-* @returns A function matching the `(url, config) => Promise<Response>` shape core API functions expect.
-* @example
-* ```typescript
-* await updateMeCredentials({
-*   ...config,
-*   fetcher: fetcher ?? createHttpClientFetcher(instanceId),
-* });
-* ```
-*/
-const createHttpClientFetcher = (instanceId = 0) => {
-	return async (url, config) => {
-		const httpClient = FetchHttpClient_default.getInstance(instanceId);
-		const toResponse = (data, status, statusText) => ({
-			json: () => Promise.resolve(data),
-			ok: status >= 200 && status < 300,
-			status,
-			statusText,
-			text: () => Promise.resolve(typeof data === "string" ? data : JSON.stringify(data))
-		});
-		try {
-			const response = await httpClient.request({
-				data: config.body ? JSON.parse(config.body) : void 0,
-				headers: config.headers,
-				method: config.method || "POST",
-				signal: config.signal,
-				url
-			});
-			return toResponse(response.data, response.status, response.statusText || "");
-		} catch (error) {
-			const httpError = error;
-			if (httpError?.response) return toResponse(httpError.response.data, httpError.response.status, httpError.response.statusText ?? "");
-			throw error;
-		}
-	};
-};
-var createHttpClientFetcher_default = createHttpClientFetcher;
-
 //#endregion
 //#region src/utils/copyTextToClipboard.ts
 /**
@@ -3505,6 +3537,23 @@ const AVATAR_PALETTES = [
 * without needing the actual palette values.
 */
 const AVATAR_GRADIENT_COUNT = AVATAR_PALETTES.length;
+const XML_ESCAPES = {
+	"\"": "&quot;",
+	"&": "&amp;",
+	"'": "&apos;",
+	"<": "&lt;",
+	">": "&gt;"
+};
+/**
+* Escapes a caller-supplied value for interpolation into SVG text.
+*/
+const escapeXml = (value) => value.replace(/["&'<>]/g, (ch) => XML_ESCAPES[ch]);
+/**
+* Encodes an SVG document as a data URI. Lone UTF-16 surrogates are replaced with U+FFFD
+* first, since `encodeURIComponent` throws a `URIError` on them. `Array.from` iterates by
+* code point, so a surrogate it yields on its own is unpaired.
+*/
+const toSvgDataUri = (svg) => `data:image/svg+xml,${encodeURIComponent(Array.from(svg, (ch) => ch.length === 1 && ch >= "\ud800" && ch <= "\udfff" ? "�" : ch).join(""))}`;
 /**
 * Fills in `params.content` when the spec itself didn't carry one, deriving it from a raw
 * seed name (e.g. an app or user display name) — extracting initials for letter variants,
@@ -3555,11 +3604,10 @@ const generateGradientAvatar = ({ shape, variant, content, colors, bg }) => {
 	let text = "";
 	if (variant !== "blank") {
 		const letterCount = variant === "one_letter" ? 1 : 2;
-		const initials = (content || "A").toUpperCase().slice(0, letterCount);
+		const initials = escapeXml(Array.from((content || "A").toUpperCase()).slice(0, letterCount).join(""));
 		text = `<text x="50" y="64" font-family="Helvetica,Arial,sans-serif" font-weight="700" font-size="${letterCount === 1 ? 46 : 34}" text-anchor="middle" fill="#fff">${initials}</text>`;
 	}
-	const svg = `<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 100 100">${defs}${shapeMarkup(shape, background)}${text}</svg>`;
-	return `data:image/svg+xml,${encodeURIComponent(svg)}`;
+	return toSvgDataUri(`<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 100 100">${defs}${shapeMarkup(shape, background)}${text}</svg>`);
 };
 /**
 * Renders one of the curated anonymous-animal icons, applying the requested background
@@ -3571,8 +3619,7 @@ const generateAnonymousAnimalAvatar = ({ shape, content, bg }) => {
 	const icon = ANONYMOUS_ANIMAL_ICONS[Object.prototype.hasOwnProperty.call(ANONYMOUS_ANIMAL_ICONS, content) ? content : pickAnonymousAvatarName_default()];
 	const color = bg ?? icon.color;
 	const markup = icon.markup.replaceAll("%COLOR%", color);
-	const svg = `<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 100 100">${shapeMarkup(shape, color)}${markup}</svg>`;
-	return `data:image/svg+xml,${encodeURIComponent(svg)}`;
+	return toSvgDataUri(`<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 100 100">${shapeMarkup(shape, color)}${markup}</svg>`);
 };
 /**
 * Renders one of the curated anonymous-entity icons (application/organization/resource-server
@@ -3584,8 +3631,7 @@ const generateAnonymousEntityAvatar = ({ shape, content, bg }) => {
 	const icon = ANONYMOUS_ENTITY_ICONS[Object.prototype.hasOwnProperty.call(ANONYMOUS_ENTITY_ICONS, content) ? content : pickAnonymousEntityName_default()];
 	const color = bg ?? icon.color;
 	const markup = icon.markup.replaceAll("%COLOR%", color);
-	const svg = `<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 100 100">${shapeMarkup(shape, color)}${markup}</svg>`;
-	return `data:image/svg+xml,${encodeURIComponent(svg)}`;
+	return toSvgDataUri(`<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 100 100">${shapeMarkup(shape, color)}${markup}</svg>`);
 };
 /**
 * Generates an avatar image as an `svg+xml` data URI from a fully-resolved {@link AvatarParams}.
@@ -3702,7 +3748,8 @@ const createClassObserver = (targetElement, callback, config = {}) => {
 	return observer;
 };
 /**
-* Creates a media query listener for system theme changes
+* Creates a media query listener for system theme changes. Call `disconnect()` on the returned
+* object to remove the listener.
 */
 const createMediaQueryListener = (callback) => {
 	if (typeof window === "undefined" || !window.matchMedia) return null;
@@ -3712,7 +3759,10 @@ const createMediaQueryListener = (callback) => {
 	};
 	if (mediaQuery.addEventListener) mediaQuery.addEventListener("change", handleChange);
 	else mediaQuery.addListener(handleChange);
-	return mediaQuery;
+	return Object.assign(mediaQuery, { disconnect: () => {
+		if (mediaQuery.removeEventListener) mediaQuery.removeEventListener("change", handleChange);
+		else mediaQuery.removeListener(handleChange);
+	} });
 };
 
 //#endregion