@thunderid/javascript 0.11.1 → 0.11.2

package/dist/ThunderIDJavaScriptClient.d.ts

@@ -46,6 +46,7 @@ declare class ThunderIDJavaScriptClient<T = Config> implements ThunderIDClient<T
     getUser(userId?: string): Promise<User>;
     isSignedIn(userId?: string): Promise<boolean>;
     getAccessToken(sessionId?: string): Promise<string>;
+    private isCachedTokenStillValid;
     clearSession(sessionId?: string): void;
     /**
      * Async variant of {@link clearSession} that resolves once the session data has been removed from
@@ -76,6 +77,12 @@ declare class ThunderIDJavaScriptClient<T = Config> implements ThunderIDClient<T
     protected getIdToken(userId?: string): Promise<string>;
     protected getUserSession(userId?: string): Promise<UserSession>;
     protected refreshAccessToken(userId?: string): Promise<TokenResponse | User>;
+    /**
+     * Requests a machine-to-machine access token via the `client_credentials` grant
+     * (RFC 6749 §4.4) and caches it under the given session key. Unlike the user-facing
+     * flows, there's no id_token or refresh_token: the service authenticates as itself.
+     */
+    protected requestClientCredentialsToken(sessionId?: string): Promise<TokenResponse>;
     protected revokeAccessToken(userId?: string): Promise<Response | boolean>;
     initiateCIBA(options: CIBAInitiateOptions): Promise<CIBAInitiateResponse>;
     pollCIBA(authReqId: string, interval: number, options?: CIBAPollOptions): Promise<TokenResponse>;

package/dist/ThunderIDJavaScriptClient.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ThunderIDJavaScriptClient.d.ts","sourceRoot":"","sources":["../src/ThunderIDJavaScriptClient.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAUH,OAAO,EAAC,gBAAgB,EAAC,MAAM,oBAAoB,CAAC;AACpD,OAAO,EAAC,WAAW,EAAC,MAAM,gBAAgB,CAAC;AAE3C,OAAO,KAAK,EAAC,mBAAmB,EAAE,oBAAoB,EAAE,eAAe,EAAC,MAAM,eAAe,CAAC;AAC9F,OAAO,EAAC,eAAe,EAAC,MAAM,iBAAiB,CAAC;AAChD,OAAO,EAAmB,MAAM,EAAE,aAAa,EAAE,cAAc,EAAE,aAAa,EAAC,MAAM,iBAAiB,CAAC;AACvG,OAAO,EAAC,MAAM,EAAC,MAAM,iBAAiB,CAAC;AACvC,OAAO,EAAC,iCAAiC,EAAC,MAAM,wBAAwB,CAAC;AACzE,OAAO,EAAC,wBAAwB,EAAC,MAAM,yBAAyB,CAAC;AACjE,OAAO,EAAC,aAAa,EAAC,MAAM,yBAAyB,CAAC;AACtD,OAAO,EAAc,WAAW,EAAC,MAAM,kBAAkB,CAAC;AAC1D,OAAO,EAAC,OAAO,EAAiB,MAAM,gBAAgB,CAAC;AACvD,OAAO,EAAC,OAAO,EAAE,0BAA0B,EAAE,aAAa,EAAC,MAAM,gBAAgB,CAAC;AAClF,OAAO,EAAC,IAAI,EAAE,WAAW,EAAC,MAAM,eAAe,CAAC;AAChD,OAAO,cAAc,MAAM,kBAAkB,CAAC;AAyB9C,cAAM,yBAAyB,CAAC,CAAC,GAAG,MAAM,CAAE,YAAW,eAAe,CAAC,CAAC,CAAC;IACvE,SAAS,CAAC,cAAc,EAAG,cAAc,CAAC,CAAC,CAAC,CAAC;IAE7C,SAAS,CAAC,WAAW,EAAE,MAAM,CAAC;IAE9B,OAAO,CAAC,cAAc,CAAsC;IAE5D,OAAO,CAAC,4BAA4B,CAA2C;IAE/E,OAAO,CAAC,UAAU,CAA2B;IAE7C,OAAO,CAAC,YAAY,CAAoB;IAExC,OAAO,CAAC,eAAe,CAAK;IAE5B,OAAO,CAAC,UAAU,CAAU;IAE5B,OAAO,CAAC,OAAO,CAAM;gBAET,OAAO,CAAC,EAAE,OAAO,EAAE,WAAW,CAAC,EAAE,MAAM;IAOtC,UAAU,CAAC,MAAM,EAAE,CAAC,EAAE,OAAO,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IA8C1D,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC;IAUxD,gBAAgB,IAAI,CAAC;IAIf,OAAO,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAavC,UAAU,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAoB7C,cAAc,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAIzD,YAAY,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI;IAI7C;;;;OAIG;IACH,SAAS,CAAC,iBAAiB,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIjD,UAAU,CAAC,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAInF,cAAc,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC;IAItE,aAAa,CACxB,MAAM,EAAE,0BAA0B,EAClC,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,aAAa,GAAG,QAAQ,GAAG,IAAI,CAAC;IAqFpC,SAAS,IAAI,OAAO;IAIpB,MAAM,CAAC,QAAQ,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,GAAG,aAAa,GAAG,SAAS,CAAC;IAI3E,OAAO,CACZ,QAAQ,CAAC,EAAE,cAAc,EACzB,wBAAwB,CAAC,EAAE,MAAM,GAAG,CAAC,CAAC,eAAe,EAAE,MAAM,KAAK,IAAI,CAAC,EACvE,aAAa,CAAC,EAAE,CAAC,eAAe,EAAE,MAAM,KAAK,IAAI,GAChD,OAAO,CAAC,MAAM,GAAG,OAAO,CAAC;IAIrB,cAAc,CAAC,QAAQ,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,GAAG,OAAO,GAAG,SAAS,CAAC;IAI7E,MAAM,CAAC,QAAQ,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC;IAI/C,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IAIxB,cAAc,CAAC,QAAQ,CAAC,EAAE,GAAG,GAAG,OAAO,CAAC,WAAW,CAAC;IAIpD,iBAAiB,CAAC,QAAQ,EAAE,GAAG,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;cAMxD,+BAA+B,CAAC,SAAS,UAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;cAiHjE,YAAY,CAAC,aAAa,CAAC,EAAE,iCAAiC,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;cAwEjG,kBAAkB,CAChC,iBAAiB,EAAE,MAAM,EACzB,YAAY,EAAE,MAAM,EACpB,KAAK,EAAE,MAAM,EACb,MAAM,CAAC,EAAE,MAAM,EACf,kBAAkB,CAAC,EAAE;QAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAC,GACrD,OAAO,CAAC,aAAa,CAAC;cAgGT,aAAa,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;cA4C/C,0BAA0B,IAAI,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IAiBhE,oBAAoB,IAAI,OAAO,CAAC,wBAAwB,GAAG,IAAI,CAAC;cAQ7D,iBAAiB,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;cAMtE,UAAU,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;cAI5C,cAAc,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC;cASrD,kBAAkB,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC;cA2DlE,iBAAiB,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,OAAO,CAAC;IAoDlE,YAAY,CAAC,OAAO,EAAE,mBAAmB,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAmIzE,QAAQ,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,eAAe,GAAG,OAAO,CAAC,aAAa,CAAC;cAkH7F,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;cAI5D,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIjF,aAAa,IAAI,MAAM;IAI9B,SAAS,CAAC,iBAAiB,IAAI,cAAc,CAAC,CAAC,CAAC;IAIhD,SAAS,CAAC,eAAe,IAAI,gBAAgB;WAM/B,mBAAmB,CAAC,eAAe,EAAE,MAAM,GAAG,OAAO;WAQrD,cAAc,CAAC,eAAe,EAAE,MAAM,GAAG,OAAO;IAUjD,eAAe,CAAC,WAAW,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC;CASxE;AAED,eAAe,yBAAyB,CAAC"}
+{"version":3,"file":"ThunderIDJavaScriptClient.d.ts","sourceRoot":"","sources":["../src/ThunderIDJavaScriptClient.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAWH,OAAO,EAAC,gBAAgB,EAAC,MAAM,oBAAoB,CAAC;AACpD,OAAO,EAAC,WAAW,EAAC,MAAM,gBAAgB,CAAC;AAE3C,OAAO,KAAK,EAAC,mBAAmB,EAAE,oBAAoB,EAAE,eAAe,EAAC,MAAM,eAAe,CAAC;AAC9F,OAAO,EAAC,eAAe,EAAC,MAAM,iBAAiB,CAAC;AAChD,OAAO,EAAmB,MAAM,EAAE,aAAa,EAAE,cAAc,EAAE,aAAa,EAAC,MAAM,iBAAiB,CAAC;AACvG,OAAO,EAAC,MAAM,EAAC,MAAM,iBAAiB,CAAC;AACvC,OAAO,EAAC,iCAAiC,EAAC,MAAM,wBAAwB,CAAC;AACzE,OAAO,EAAC,wBAAwB,EAAC,MAAM,yBAAyB,CAAC;AACjE,OAAO,EAAC,aAAa,EAAC,MAAM,yBAAyB,CAAC;AACtD,OAAO,EAAc,WAAW,EAAC,MAAM,kBAAkB,CAAC;AAC1D,OAAO,EAAC,OAAO,EAAiB,MAAM,gBAAgB,CAAC;AACvD,OAAO,EAAyB,OAAO,EAAE,0BAA0B,EAAE,aAAa,EAAC,MAAM,gBAAgB,CAAC;AAC1G,OAAO,EAAC,IAAI,EAAE,WAAW,EAAC,MAAM,eAAe,CAAC;AAChD,OAAO,cAAc,MAAM,kBAAkB,CAAC;AAyB9C,cAAM,yBAAyB,CAAC,CAAC,GAAG,MAAM,CAAE,YAAW,eAAe,CAAC,CAAC,CAAC;IACvE,SAAS,CAAC,cAAc,EAAG,cAAc,CAAC,CAAC,CAAC,CAAC;IAE7C,SAAS,CAAC,WAAW,EAAE,MAAM,CAAC;IAE9B,OAAO,CAAC,cAAc,CAAsC;IAE5D,OAAO,CAAC,4BAA4B,CAA2C;IAE/E,OAAO,CAAC,UAAU,CAA2B;IAE7C,OAAO,CAAC,YAAY,CAAoB;IAExC,OAAO,CAAC,eAAe,CAAK;IAE5B,OAAO,CAAC,UAAU,CAAU;IAE5B,OAAO,CAAC,OAAO,CAAM;gBAET,OAAO,CAAC,EAAE,OAAO,EAAE,WAAW,CAAC,EAAE,MAAM;IAOtC,UAAU,CAAC,MAAM,EAAE,CAAC,EAAE,OAAO,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IA8C1D,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC;IAUxD,gBAAgB,IAAI,CAAC;IAIf,OAAO,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAavC,UAAU,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAoB7C,cAAc,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAkBhE,OAAO,CAAC,uBAAuB;IAYxB,YAAY,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI;IAI7C;;;;OAIG;IACH,SAAS,CAAC,iBAAiB,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIjD,UAAU,CAAC,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAInF,cAAc,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC;IAItE,aAAa,CACxB,MAAM,EAAE,0BAA0B,EAClC,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,aAAa,GAAG,QAAQ,GAAG,IAAI,CAAC;IAqFpC,SAAS,IAAI,OAAO;IAIpB,MAAM,CAAC,QAAQ,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,GAAG,aAAa,GAAG,SAAS,CAAC;IAI3E,OAAO,CACZ,QAAQ,CAAC,EAAE,cAAc,EACzB,wBAAwB,CAAC,EAAE,MAAM,GAAG,CAAC,CAAC,eAAe,EAAE,MAAM,KAAK,IAAI,CAAC,EACvE,aAAa,CAAC,EAAE,CAAC,eAAe,EAAE,MAAM,KAAK,IAAI,GAChD,OAAO,CAAC,MAAM,GAAG,OAAO,CAAC;IAIrB,cAAc,CAAC,QAAQ,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,GAAG,OAAO,GAAG,SAAS,CAAC;IAI7E,MAAM,CAAC,QAAQ,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC;IAI/C,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IAIxB,cAAc,CAAC,QAAQ,CAAC,EAAE,GAAG,GAAG,OAAO,CAAC,WAAW,CAAC;IAIpD,iBAAiB,CAAC,QAAQ,EAAE,GAAG,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;cAMxD,+BAA+B,CAAC,SAAS,UAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;cAiHjE,YAAY,CAAC,aAAa,CAAC,EAAE,iCAAiC,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;cAwEjG,kBAAkB,CAChC,iBAAiB,EAAE,MAAM,EACzB,YAAY,EAAE,MAAM,EACpB,KAAK,EAAE,MAAM,EACb,MAAM,CAAC,EAAE,MAAM,EACf,kBAAkB,CAAC,EAAE;QAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAC,GACrD,OAAO,CAAC,aAAa,CAAC;cAgGT,aAAa,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;cA4C/C,0BAA0B,IAAI,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IAiBhE,oBAAoB,IAAI,OAAO,CAAC,wBAAwB,GAAG,IAAI,CAAC;cAQ7D,iBAAiB,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;cAMtE,UAAU,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;cAI5C,cAAc,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC;cASrD,kBAAkB,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC;IA2DlF;;;;OAIG;cACa,6BAA6B,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC;cAgGzE,iBAAiB,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,OAAO,CAAC;IAoDlE,YAAY,CAAC,OAAO,EAAE,mBAAmB,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAmIzE,QAAQ,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,eAAe,GAAG,OAAO,CAAC,aAAa,CAAC;cAkH7F,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;cAI5D,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIjF,aAAa,IAAI,MAAM;IAI9B,SAAS,CAAC,iBAAiB,IAAI,cAAc,CAAC,CAAC,CAAC;IAIhD,SAAS,CAAC,eAAe,IAAI,gBAAgB;WAM/B,mBAAmB,CAAC,eAAe,EAAE,MAAM,GAAG,OAAO;WAQrD,cAAc,CAAC,eAAe,EAAE,MAAM,GAAG,OAAO;IAUjD,eAAe,CAAC,WAAW,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC;CASxE;AAED,eAAe,yBAAyB,CAAC"}

package/dist/cjs/index.cjs

@@ -79,7 +79,8 @@ const TokenConstants = {
 		"ML-DSA-65",
 		"ML-DSA-87"
 	] },
-	Storage: { StorageKeys: { REFRESH_TOKEN_TIMER: "refresh_token_timer" } }
+	Storage: { StorageKeys: { REFRESH_TOKEN_TIMER: "refresh_token_timer" } },
+	Lifecycle: { CLIENT_CREDENTIALS_REFRESH_MARGIN_MS: 3e4 }
 };
 var TokenConstants_default = TokenConstants;
 
@@ -2545,6 +2546,42 @@ const processOpenIDScopes = (scopes) => {
 };
 var processOpenIDScopes_default = processOpenIDScopes;
 
+//#endregion
+//#region src/utils/resolveResourceEndpoint.ts
+/**
+* The `config.endpoints` keys that address resource-server endpoints rather than OIDC/OAuth
+* endpoints. Used to keep these overrides out of the resolved OIDC provider metadata.
+*/
+const RESOURCE_ENDPOINT_KEYS = [
+	"flowExecute",
+	"flowMeta",
+	"usersMe"
+];
+/**
+* Resolves the absolute `url` to use for a resource-server endpoint, honoring (in order of
+* precedence) an explicit per-call URL, then a `config.endpoints` override.
+*
+* Returns `undefined` when neither is set, so the calling API function falls back to deriving the
+* endpoint from `baseUrl` (i.e. `${baseUrl}/flow/execute`) exactly as before. Callers should keep
+* passing `baseUrl` alongside the resolved `url` to preserve that fallback.
+*
+* @param key - The resource endpoint to resolve.
+* @param config - The client config carrying optional `endpoints` overrides.
+* @param explicitUrl - An explicit URL provided by the immediate caller; takes highest precedence.
+* @returns The resolved override URL, or `undefined` to defer to `baseUrl`-based resolution.
+*
+* @example
+* ```typescript
+* const response = await executeEmbeddedUserOnboardingFlow({
+*   baseUrl: config.baseUrl,
+*   url: resolveResourceEndpoint('flowExecute', config),
+*   payload,
+* });
+* ```
+*/
+const resolveResourceEndpoint = (key, config, explicitUrl) => explicitUrl ?? config?.endpoints?.[key] ?? void 0;
+var resolveResourceEndpoint_default = resolveResourceEndpoint;
+
 //#endregion
 //#region src/constants/TokenExchangeConstants.ts
 /**
@@ -2615,6 +2652,25 @@ var AuthenticationHelper = class {
 		this.cryptoHelper = cryptoHelperInstance;
 	}
 	/**
+	* Maps the config-defined OIDC endpoint overrides to their discovery-metadata form.
+	*
+	* Endpoint names are converted from camelCase to snake_case, and resource-server endpoints
+	* (`RESOURCE_ENDPOINT_KEYS`) are excluded — those are resolved separately via
+	* `resolveResourceEndpoint` and must not leak into the OIDC provider metadata.
+	*
+	* @param configData - The resolved auth client config.
+	* @returns A snake_cased map of the OIDC endpoint overrides (empty when none are configured).
+	*/
+	mapConfiguredOidcEndpoints(configData) {
+		const endpoints = {};
+		if (!configData.endpoints) return endpoints;
+		Object.keys(configData.endpoints).filter((endpointName) => !RESOURCE_ENDPOINT_KEYS.includes(endpointName)).forEach((endpointName) => {
+			const snakeCasedName = endpointName.replace(/[A-Z]/g, (letter) => `_${letter.toLowerCase()}`);
+			endpoints[snakeCasedName] = configData.endpoints ? configData.endpoints[endpointName] : "";
+		});
+		return endpoints;
+	}
+	/**
 	* Merges explicit endpoint overrides from config into the discovery response.
 	* Config-defined endpoint names (camelCase) are converted to snake_case before merging.
 	*
@@ -2622,15 +2678,10 @@ var AuthenticationHelper = class {
 	* @returns The discovery response with any config-specified endpoint overrides applied.
 	*/
 	async resolveEndpoints(response) {
-		const oidcProviderMetaData = {};
 		const configData = await this.config();
-		if (configData.endpoints) Object.keys(configData.endpoints).forEach((endpointName) => {
-			const snakeCasedName = endpointName.replace(/[A-Z]/g, (letter) => `_${letter.toLowerCase()}`);
-			oidcProviderMetaData[snakeCasedName] = configData?.endpoints ? configData.endpoints[endpointName] : "";
-		});
 		return {
 			...response,
-			...oidcProviderMetaData
+			...this.mapConfiguredOidcEndpoints(configData)
 		};
 	}
 	/**
@@ -2641,7 +2692,6 @@ var AuthenticationHelper = class {
 	* @throws {ThunderIDAuthException} When required endpoints are absent from the config.
 	*/
 	async resolveEndpointsExplicitly() {
-		const oidcProviderMetaData = {};
 		const configData = await this.config();
 		const requiredEndpoints = [
 			OIDCDiscoveryConstants_default.Storage.StorageKeys.Endpoints.AUTHORIZATION,
@@ -2656,11 +2706,7 @@ var AuthenticationHelper = class {
 		if (!(configData.endpoints ? requiredEndpoints.every((reqEndpointName) => configData.endpoints ? Object.keys(configData.endpoints).some((endpointName) => {
 			return endpointName.replace(/[A-Z]/g, (letter) => `_${letter.toLowerCase()}`) === reqEndpointName;
 		}) : false) : false)) throw new ThunderIDAuthException("JS-AUTH_HELPER-REE-NF01", "Required endpoints missing", "Some or all of the required endpoints are missing in the object passed to the `endpoints` attribute of the`AuthConfig` object.");
-		if (configData.endpoints) Object.keys(configData.endpoints).forEach((endpointName) => {
-			const snakeCasedName = endpointName.replace(/[A-Z]/g, (letter) => `_${letter.toLowerCase()}`);
-			oidcProviderMetaData[snakeCasedName] = configData?.endpoints ? configData.endpoints[endpointName] : "";
-		});
-		return { ...oidcProviderMetaData };
+		return { ...this.mapConfiguredOidcEndpoints(configData) };
 	}
 	/**
 	* Derives OIDC endpoint URLs from the configured `baseUrl`.
@@ -2671,14 +2717,10 @@ var AuthenticationHelper = class {
 	* @throws {ThunderIDAuthException} When `baseUrl` is not defined in the config.
 	*/
 	async resolveEndpointsByBaseURL() {
-		const oidcProviderMetaData = {};
 		const configData = await this.config();
 		const { baseUrl } = configData;
 		if (!baseUrl) throw new ThunderIDAuthException("JS-AUTH_HELPER_REBO-NF01", "Base URL not defined.", "Base URL is not defined in AuthClient config.");
-		if (configData.endpoints) Object.keys(configData.endpoints).forEach((endpointName) => {
-			const snakeCasedName = endpointName.replace(/[A-Z]/g, (letter) => `_${letter.toLowerCase()}`);
-			oidcProviderMetaData[snakeCasedName] = configData?.endpoints ? configData.endpoints[endpointName] : "";
-		});
+		const oidcProviderMetaData = this.mapConfiguredOidcEndpoints(configData);
 		const endpointKeys = OIDCDiscoveryConstants_default.Storage.StorageKeys.Endpoints;
 		const endpointPaths = OIDCDiscoveryConstants_default.Endpoints;
 		return {
@@ -3106,8 +3148,18 @@ var ThunderIDJavaScriptClient = class {
 		return createdAt + parseInt(expiresInString, 10) * 1e3 > (/* @__PURE__ */ new Date()).getTime();
 	}
 	async getAccessToken(sessionId) {
+		if ((await this.configProvider()).grantType === "client_credentials") {
+			const sessionData = await this.storageManager.getSessionData(sessionId);
+			if (sessionData?.access_token && this.isCachedTokenStillValid(sessionData)) return sessionData.access_token;
+			return (await this.requestClientCredentialsToken(sessionId)).accessToken;
+		}
 		return (await this.storageManager.getSessionData(sessionId))?.access_token;
 	}
+	isCachedTokenStillValid(sessionData) {
+		if (!sessionData.created_at || !sessionData.expires_in) return false;
+		const expiresInMs = parseInt(sessionData.expires_in, 10) * 1e3;
+		return sessionData.created_at + expiresInMs - TokenConstants_default.Lifecycle.CLIENT_CREDENTIALS_REFRESH_MARGIN_MS > Date.now();
+	}
 	clearSession(sessionId) {
 		this.authHelper.clearSession(sessionId);
 	}
@@ -3380,6 +3432,56 @@ var ThunderIDJavaScriptClient = class {
 		if (!tokenResponse.ok) throw new ThunderIDAuthException("JS-AUTH_CORE-RAT2-HE04", `Refreshing access token failed with ${tokenResponse.statusText}`, await tokenResponse.json());
 		return this.authHelper.handleTokenResponse(tokenResponse, userId);
 	}
+	/**
+	* Requests a machine-to-machine access token via the `client_credentials` grant
+	* (RFC 6749 §4.4) and caches it under the given session key. Unlike the user-facing
+	* flows, there's no id_token or refresh_token: the service authenticates as itself.
+	*/
+	async requestClientCredentialsToken(sessionId) {
+		if (!await this.storageManager.getTemporaryDataParameter(OIDCDiscoveryConstants_default.Storage.StorageKeys.OPENID_PROVIDER_CONFIG_INITIATED)) await this.loadOpenIDProviderConfiguration(false);
+		const tokenEndpoint = (await this.oidcProviderMetaDataProvider()).token_endpoint;
+		const configData = await this.configProvider();
+		if (!tokenEndpoint || tokenEndpoint.trim().length === 0) throw new ThunderIDAuthException("JS-AUTH_CORE-RCCT-NF01", "Token endpoint not found.", "No token endpoint was found in the OIDC provider meta data returned by the well-known endpoint or the token endpoint passed to the SDK is empty.");
+		const body = new URLSearchParams();
+		body.set("grant_type", "client_credentials");
+		body.set("client_id", configData.clientId ?? "");
+		const hasSecret = Boolean(configData.clientSecret && configData.clientSecret.trim().length > 0);
+		const tokenEndpointAuthMethod = configData.tokenRequest?.authMethod ?? "client_secret_basic";
+		if (hasSecret && tokenEndpointAuthMethod === "client_secret_post") body.set("client_secret", configData.clientSecret);
+		const scope = Array.isArray(configData.scopes) ? configData.scopes.join(" ") : configData.scopes;
+		if (scope) body.set("scope", scope);
+		if (configData.tokenRequest?.params) Object.entries(configData.tokenRequest.params).forEach(([key, value]) => {
+			body.set(key, value);
+		});
+		const tokenRequestHeaders = {
+			Accept: "application/json",
+			"Content-Type": "application/x-www-form-urlencoded"
+		};
+		if (hasSecret && tokenEndpointAuthMethod === "client_secret_basic") tokenRequestHeaders["Authorization"] = `Basic ${base64Encode_default(`${encodeURIComponent(configData.clientId)}:${encodeURIComponent(configData.clientSecret)}`)}`;
+		let tokenResponse;
+		try {
+			tokenResponse = await fetch(tokenEndpoint, {
+				body,
+				headers: tokenRequestHeaders,
+				method: "POST"
+			});
+		} catch (error$1) {
+			throw new ThunderIDAuthException("JS-AUTH_CORE-RCCT-NE02", "Requesting client credentials token failed.", error$1 ?? "The request to get the client credentials access token failed.");
+		}
+		if (!tokenResponse.ok) throw new ThunderIDAuthException("JS-AUTH_CORE-RCCT-HE03", `Requesting client credentials token failed with ${tokenResponse.statusText}`, await tokenResponse.json());
+		const parsedResponse = await tokenResponse.json();
+		parsedResponse.created_at = (/* @__PURE__ */ new Date()).getTime();
+		await this.storageManager.setSessionData(parsedResponse, sessionId);
+		return {
+			accessToken: parsedResponse.access_token,
+			createdAt: parsedResponse.created_at,
+			expiresIn: parsedResponse.expires_in,
+			idToken: parsedResponse.id_token ?? "",
+			refreshToken: parsedResponse.refresh_token ?? "",
+			scope: parsedResponse.scope,
+			tokenType: parsedResponse.token_type
+		};
+	}
 	async revokeAccessToken(userId) {
 		const revokeTokenEndpoint = (await this.oidcProviderMetaDataProvider()).revocation_endpoint;
 		const configData = await this.configProvider();
@@ -6199,6 +6301,7 @@ exports.resolveFlowTemplateLiterals = resolveFlowTemplateLiterals;
 exports.resolveLocaleDisplayName = resolveLocaleDisplayName;
 exports.resolveLocaleEmoji = resolveLocaleEmoji_default;
 exports.resolveMeta = resolveMeta;
+exports.resolveResourceEndpoint = resolveResourceEndpoint_default;
 exports.set = set_default;
 exports.startCase = startCase_default;
 exports.updateMeProfile = updateMeProfile_default;

package/dist/constants/TokenConstants.d.ts

@@ -43,6 +43,9 @@ declare const TokenConstants: {
             readonly REFRESH_TOKEN_TIMER: string;
         };
     };
+    readonly Lifecycle: {
+        readonly CLIENT_CREDENTIALS_REFRESH_MARGIN_MS: number;
+    };
 };
 export default TokenConstants;
 //# sourceMappingURL=TokenConstants.d.ts.map

package/dist/constants/TokenConstants.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"TokenConstants.d.ts","sourceRoot":"","sources":["../../src/constants/TokenConstants.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH;;;;;;;;;;;;;;;;;;GAkBG;AACH,QAAA,MAAM,cAAc,EAAE;IACpB,QAAQ,CAAC,mBAAmB,EAAE;QAC5B,QAAQ,CAAC,oBAAoB,EAAE,SAAS,MAAM,EAAE,CAAC;KAClD,CAAC;IACF,QAAQ,CAAC,OAAO,EAAE;QAChB,QAAQ,CAAC,WAAW,EAAE;YACpB,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;SACtC,CAAC;KACH,CAAC;CAyCM,CAAC;AAEX,eAAe,cAAc,CAAC"}
+{"version":3,"file":"TokenConstants.d.ts","sourceRoot":"","sources":["../../src/constants/TokenConstants.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH;;;;;;;;;;;;;;;;;;GAkBG;AACH,QAAA,MAAM,cAAc,EAAE;IACpB,QAAQ,CAAC,mBAAmB,EAAE;QAC5B,QAAQ,CAAC,oBAAoB,EAAE,SAAS,MAAM,EAAE,CAAC;KAClD,CAAC;IACF,QAAQ,CAAC,OAAO,EAAE;QAChB,QAAQ,CAAC,WAAW,EAAE;YACpB,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;SACtC,CAAC;KACH,CAAC;IACF,QAAQ,CAAC,SAAS,EAAE;QAClB,QAAQ,CAAC,oCAAoC,EAAE,MAAM,CAAC;KACvD,CAAC;CAqDM,CAAC;AAEX,eAAe,cAAc,CAAC"}

package/dist/edge/index.js

@@ -59,7 +59,8 @@ const TokenConstants = {
 		"ML-DSA-65",
 		"ML-DSA-87"
 	] },
-	Storage: { StorageKeys: { REFRESH_TOKEN_TIMER: "refresh_token_timer" } }
+	Storage: { StorageKeys: { REFRESH_TOKEN_TIMER: "refresh_token_timer" } },
+	Lifecycle: { CLIENT_CREDENTIALS_REFRESH_MARGIN_MS: 3e4 }
 };
 var TokenConstants_default = TokenConstants;
 
@@ -2525,6 +2526,42 @@ const processOpenIDScopes = (scopes) => {
 };
 var processOpenIDScopes_default = processOpenIDScopes;
 
+//#endregion
+//#region src/utils/resolveResourceEndpoint.ts
+/**
+* The `config.endpoints` keys that address resource-server endpoints rather than OIDC/OAuth
+* endpoints. Used to keep these overrides out of the resolved OIDC provider metadata.
+*/
+const RESOURCE_ENDPOINT_KEYS = [
+	"flowExecute",
+	"flowMeta",
+	"usersMe"
+];
+/**
+* Resolves the absolute `url` to use for a resource-server endpoint, honoring (in order of
+* precedence) an explicit per-call URL, then a `config.endpoints` override.
+*
+* Returns `undefined` when neither is set, so the calling API function falls back to deriving the
+* endpoint from `baseUrl` (i.e. `${baseUrl}/flow/execute`) exactly as before. Callers should keep
+* passing `baseUrl` alongside the resolved `url` to preserve that fallback.
+*
+* @param key - The resource endpoint to resolve.
+* @param config - The client config carrying optional `endpoints` overrides.
+* @param explicitUrl - An explicit URL provided by the immediate caller; takes highest precedence.
+* @returns The resolved override URL, or `undefined` to defer to `baseUrl`-based resolution.
+*
+* @example
+* ```typescript
+* const response = await executeEmbeddedUserOnboardingFlow({
+*   baseUrl: config.baseUrl,
+*   url: resolveResourceEndpoint('flowExecute', config),
+*   payload,
+* });
+* ```
+*/
+const resolveResourceEndpoint = (key, config, explicitUrl) => explicitUrl ?? config?.endpoints?.[key] ?? void 0;
+var resolveResourceEndpoint_default = resolveResourceEndpoint;
+
 //#endregion
 //#region src/constants/TokenExchangeConstants.ts
 /**
@@ -2595,6 +2632,25 @@ var AuthenticationHelper = class {
 		this.cryptoHelper = cryptoHelperInstance;
 	}
 	/**
+	* Maps the config-defined OIDC endpoint overrides to their discovery-metadata form.
+	*
+	* Endpoint names are converted from camelCase to snake_case, and resource-server endpoints
+	* (`RESOURCE_ENDPOINT_KEYS`) are excluded — those are resolved separately via
+	* `resolveResourceEndpoint` and must not leak into the OIDC provider metadata.
+	*
+	* @param configData - The resolved auth client config.
+	* @returns A snake_cased map of the OIDC endpoint overrides (empty when none are configured).
+	*/
+	mapConfiguredOidcEndpoints(configData) {
+		const endpoints = {};
+		if (!configData.endpoints) return endpoints;
+		Object.keys(configData.endpoints).filter((endpointName) => !RESOURCE_ENDPOINT_KEYS.includes(endpointName)).forEach((endpointName) => {
+			const snakeCasedName = endpointName.replace(/[A-Z]/g, (letter) => `_${letter.toLowerCase()}`);
+			endpoints[snakeCasedName] = configData.endpoints ? configData.endpoints[endpointName] : "";
+		});
+		return endpoints;
+	}
+	/**
 	* Merges explicit endpoint overrides from config into the discovery response.
 	* Config-defined endpoint names (camelCase) are converted to snake_case before merging.
 	*
@@ -2602,15 +2658,10 @@ var AuthenticationHelper = class {
 	* @returns The discovery response with any config-specified endpoint overrides applied.
 	*/
 	async resolveEndpoints(response) {
-		const oidcProviderMetaData = {};
 		const configData = await this.config();
-		if (configData.endpoints) Object.keys(configData.endpoints).forEach((endpointName) => {
-			const snakeCasedName = endpointName.replace(/[A-Z]/g, (letter) => `_${letter.toLowerCase()}`);
-			oidcProviderMetaData[snakeCasedName] = configData?.endpoints ? configData.endpoints[endpointName] : "";
-		});
 		return {
 			...response,
-			...oidcProviderMetaData
+			...this.mapConfiguredOidcEndpoints(configData)
 		};
 	}
 	/**
@@ -2621,7 +2672,6 @@ var AuthenticationHelper = class {
 	* @throws {ThunderIDAuthException} When required endpoints are absent from the config.
 	*/
 	async resolveEndpointsExplicitly() {
-		const oidcProviderMetaData = {};
 		const configData = await this.config();
 		const requiredEndpoints = [
 			OIDCDiscoveryConstants_default.Storage.StorageKeys.Endpoints.AUTHORIZATION,
@@ -2636,11 +2686,7 @@ var AuthenticationHelper = class {
 		if (!(configData.endpoints ? requiredEndpoints.every((reqEndpointName) => configData.endpoints ? Object.keys(configData.endpoints).some((endpointName) => {
 			return endpointName.replace(/[A-Z]/g, (letter) => `_${letter.toLowerCase()}`) === reqEndpointName;
 		}) : false) : false)) throw new ThunderIDAuthException("JS-AUTH_HELPER-REE-NF01", "Required endpoints missing", "Some or all of the required endpoints are missing in the object passed to the `endpoints` attribute of the`AuthConfig` object.");
-		if (configData.endpoints) Object.keys(configData.endpoints).forEach((endpointName) => {
-			const snakeCasedName = endpointName.replace(/[A-Z]/g, (letter) => `_${letter.toLowerCase()}`);
-			oidcProviderMetaData[snakeCasedName] = configData?.endpoints ? configData.endpoints[endpointName] : "";
-		});
-		return { ...oidcProviderMetaData };
+		return { ...this.mapConfiguredOidcEndpoints(configData) };
 	}
 	/**
 	* Derives OIDC endpoint URLs from the configured `baseUrl`.
@@ -2651,14 +2697,10 @@ var AuthenticationHelper = class {
 	* @throws {ThunderIDAuthException} When `baseUrl` is not defined in the config.
 	*/
 	async resolveEndpointsByBaseURL() {
-		const oidcProviderMetaData = {};
 		const configData = await this.config();
 		const { baseUrl } = configData;
 		if (!baseUrl) throw new ThunderIDAuthException("JS-AUTH_HELPER_REBO-NF01", "Base URL not defined.", "Base URL is not defined in AuthClient config.");
-		if (configData.endpoints) Object.keys(configData.endpoints).forEach((endpointName) => {
-			const snakeCasedName = endpointName.replace(/[A-Z]/g, (letter) => `_${letter.toLowerCase()}`);
-			oidcProviderMetaData[snakeCasedName] = configData?.endpoints ? configData.endpoints[endpointName] : "";
-		});
+		const oidcProviderMetaData = this.mapConfiguredOidcEndpoints(configData);
 		const endpointKeys = OIDCDiscoveryConstants_default.Storage.StorageKeys.Endpoints;
 		const endpointPaths = OIDCDiscoveryConstants_default.Endpoints;
 		return {
@@ -3086,8 +3128,18 @@ var ThunderIDJavaScriptClient = class {
 		return createdAt + parseInt(expiresInString, 10) * 1e3 > (/* @__PURE__ */ new Date()).getTime();
 	}
 	async getAccessToken(sessionId) {
+		if ((await this.configProvider()).grantType === "client_credentials") {
+			const sessionData = await this.storageManager.getSessionData(sessionId);
+			if (sessionData?.access_token && this.isCachedTokenStillValid(sessionData)) return sessionData.access_token;
+			return (await this.requestClientCredentialsToken(sessionId)).accessToken;
+		}
 		return (await this.storageManager.getSessionData(sessionId))?.access_token;
 	}
+	isCachedTokenStillValid(sessionData) {
+		if (!sessionData.created_at || !sessionData.expires_in) return false;
+		const expiresInMs = parseInt(sessionData.expires_in, 10) * 1e3;
+		return sessionData.created_at + expiresInMs - TokenConstants_default.Lifecycle.CLIENT_CREDENTIALS_REFRESH_MARGIN_MS > Date.now();
+	}
 	clearSession(sessionId) {
 		this.authHelper.clearSession(sessionId);
 	}
@@ -3360,6 +3412,56 @@ var ThunderIDJavaScriptClient = class {
 		if (!tokenResponse.ok) throw new ThunderIDAuthException("JS-AUTH_CORE-RAT2-HE04", `Refreshing access token failed with ${tokenResponse.statusText}`, await tokenResponse.json());
 		return this.authHelper.handleTokenResponse(tokenResponse, userId);
 	}
+	/**
+	* Requests a machine-to-machine access token via the `client_credentials` grant
+	* (RFC 6749 §4.4) and caches it under the given session key. Unlike the user-facing
+	* flows, there's no id_token or refresh_token: the service authenticates as itself.
+	*/
+	async requestClientCredentialsToken(sessionId) {
+		if (!await this.storageManager.getTemporaryDataParameter(OIDCDiscoveryConstants_default.Storage.StorageKeys.OPENID_PROVIDER_CONFIG_INITIATED)) await this.loadOpenIDProviderConfiguration(false);
+		const tokenEndpoint = (await this.oidcProviderMetaDataProvider()).token_endpoint;
+		const configData = await this.configProvider();
+		if (!tokenEndpoint || tokenEndpoint.trim().length === 0) throw new ThunderIDAuthException("JS-AUTH_CORE-RCCT-NF01", "Token endpoint not found.", "No token endpoint was found in the OIDC provider meta data returned by the well-known endpoint or the token endpoint passed to the SDK is empty.");
+		const body = new URLSearchParams();
+		body.set("grant_type", "client_credentials");
+		body.set("client_id", configData.clientId ?? "");
+		const hasSecret = Boolean(configData.clientSecret && configData.clientSecret.trim().length > 0);
+		const tokenEndpointAuthMethod = configData.tokenRequest?.authMethod ?? "client_secret_basic";
+		if (hasSecret && tokenEndpointAuthMethod === "client_secret_post") body.set("client_secret", configData.clientSecret);
+		const scope = Array.isArray(configData.scopes) ? configData.scopes.join(" ") : configData.scopes;
+		if (scope) body.set("scope", scope);
+		if (configData.tokenRequest?.params) Object.entries(configData.tokenRequest.params).forEach(([key, value]) => {
+			body.set(key, value);
+		});
+		const tokenRequestHeaders = {
+			Accept: "application/json",
+			"Content-Type": "application/x-www-form-urlencoded"
+		};
+		if (hasSecret && tokenEndpointAuthMethod === "client_secret_basic") tokenRequestHeaders["Authorization"] = `Basic ${base64Encode_default(`${encodeURIComponent(configData.clientId)}:${encodeURIComponent(configData.clientSecret)}`)}`;
+		let tokenResponse;
+		try {
+			tokenResponse = await fetch(tokenEndpoint, {
+				body,
+				headers: tokenRequestHeaders,
+				method: "POST"
+			});
+		} catch (error$1) {
+			throw new ThunderIDAuthException("JS-AUTH_CORE-RCCT-NE02", "Requesting client credentials token failed.", error$1 ?? "The request to get the client credentials access token failed.");
+		}
+		if (!tokenResponse.ok) throw new ThunderIDAuthException("JS-AUTH_CORE-RCCT-HE03", `Requesting client credentials token failed with ${tokenResponse.statusText}`, await tokenResponse.json());
+		const parsedResponse = await tokenResponse.json();
+		parsedResponse.created_at = (/* @__PURE__ */ new Date()).getTime();
+		await this.storageManager.setSessionData(parsedResponse, sessionId);
+		return {
+			accessToken: parsedResponse.access_token,
+			createdAt: parsedResponse.created_at,
+			expiresIn: parsedResponse.expires_in,
+			idToken: parsedResponse.id_token ?? "",
+			refreshToken: parsedResponse.refresh_token ?? "",
+			scope: parsedResponse.scope,
+			tokenType: parsedResponse.token_type
+		};
+	}
 	async revokeAccessToken(userId) {
 		const revokeTokenEndpoint = (await this.oidcProviderMetaDataProvider()).revocation_endpoint;
 		const configData = await this.configProvider();
@@ -6100,4 +6202,4 @@ const normalizeTranslations = (translations) => {
 var normalizeTranslations_default = normalizeTranslations;
 
 //#endregion
-export { ApplicationNativeAuthenticationConstants_default as ApplicationNativeAuthenticationConstants, AuthenticationHelper_default as AuthenticationHelper, DEFAULT_THEME, DEFAULT_VALIDATION_MESSAGE_KEYS, EMOJI_URI_SCHEME, EmbeddedFlowActionVariant, EmbeddedFlowComponentType, EmbeddedFlowEventType, EmbeddedFlowResponseType, EmbeddedFlowTextVariant, EmbeddedFlowType, EmbeddedRecoveryFlowStatus, EmbeddedRecoveryFlowType, EmbeddedSignInFlowStatus, EmbeddedSignInFlowType, EmbeddedSignUpFlowStatus, EmbeddedSignUpFlowType, FieldType, FlowMetaType, FlowMode, HttpClient, IsomorphicCrypto, OIDCRequestConstants_default as OIDCRequestConstants, StorageManager_default as StorageManager, ThunderIDAPIError, ThunderIDAuthException, ThunderIDError, ThunderIDJavaScriptClient_default as ThunderIDJavaScriptClient, ThunderIDRuntimeError, TokenConstants_default as TokenConstants, TranslationBundleConstants_default as TranslationBundleConstants, VendorConstants_default as VendorConstants, arrayBufferToBase64url_default as arrayBufferToBase64url, base64urlToArrayBuffer_default as base64urlToArrayBuffer, bem_default as bem, buildValidatorFromRules_default as buildValidatorFromRules, configure as configureLogger, countryCodeToFlagEmoji, createComponentLogger, createLogger, createPackageComponentLogger, createPackageLogger, createTheme_default as createTheme, debug, deepMerge_default as deepMerge, error, evaluateValidationRule_default as evaluateValidationRule, executeEmbeddedRecoveryFlow_default as executeEmbeddedRecoveryFlow, executeEmbeddedSignInFlow_default as executeEmbeddedSignInFlow, executeEmbeddedSignUpFlow_default as executeEmbeddedSignUpFlow, executeEmbeddedUserOnboardingFlow_default as executeEmbeddedUserOnboardingFlow, extractEmojiFromUri_default as extractEmojiFromUri, extractPkceStorageKeyFromState_default as extractPkceStorageKeyFromState, extractUserClaimsFromIdToken_default as extractUserClaimsFromIdToken, formatDate_default as formatDate, generateFlattenedUserProfile_default as generateFlattenedUserProfile, get_default as get, getDefaultI18nBundles_default as getDefaultI18nBundles, getFlowMeta_default as getFlowMeta, getLatestStateParam_default as getLatestStateParam, getOrganizationUnitChildren_default as getOrganizationUnitChildren, getRedirectBasedSignUpUrl_default as getRedirectBasedSignUpUrl, getUserInfo_default as getUserInfo, getUsersMe_default as getUsersMe, getVendorPrefix_default as getVendorPrefix, info, isEmojiUri_default as isEmojiUri, isEmpty_default as isEmpty, isRecognizedBaseUrlPattern_default as isRecognizedBaseUrlPattern, logger_default as logger, normalizeTranslations_default as normalizeTranslations, processOpenIDScopes_default as processOpenIDScopes, processUsername_default as processUsername, removeTrailingSlash_default as removeTrailingSlash, resolveFieldName_default as resolveFieldName, resolveFlowTemplateLiterals, resolveLocaleDisplayName, resolveLocaleEmoji_default as resolveLocaleEmoji, resolveMeta, set_default as set, startCase_default as startCase, updateMeProfile_default as updateMeProfile, warn, withVendorCSSClassPrefix_default as withVendorCSSClassPrefix };
+export { ApplicationNativeAuthenticationConstants_default as ApplicationNativeAuthenticationConstants, AuthenticationHelper_default as AuthenticationHelper, DEFAULT_THEME, DEFAULT_VALIDATION_MESSAGE_KEYS, EMOJI_URI_SCHEME, EmbeddedFlowActionVariant, EmbeddedFlowComponentType, EmbeddedFlowEventType, EmbeddedFlowResponseType, EmbeddedFlowTextVariant, EmbeddedFlowType, EmbeddedRecoveryFlowStatus, EmbeddedRecoveryFlowType, EmbeddedSignInFlowStatus, EmbeddedSignInFlowType, EmbeddedSignUpFlowStatus, EmbeddedSignUpFlowType, FieldType, FlowMetaType, FlowMode, HttpClient, IsomorphicCrypto, OIDCRequestConstants_default as OIDCRequestConstants, StorageManager_default as StorageManager, ThunderIDAPIError, ThunderIDAuthException, ThunderIDError, ThunderIDJavaScriptClient_default as ThunderIDJavaScriptClient, ThunderIDRuntimeError, TokenConstants_default as TokenConstants, TranslationBundleConstants_default as TranslationBundleConstants, VendorConstants_default as VendorConstants, arrayBufferToBase64url_default as arrayBufferToBase64url, base64urlToArrayBuffer_default as base64urlToArrayBuffer, bem_default as bem, buildValidatorFromRules_default as buildValidatorFromRules, configure as configureLogger, countryCodeToFlagEmoji, createComponentLogger, createLogger, createPackageComponentLogger, createPackageLogger, createTheme_default as createTheme, debug, deepMerge_default as deepMerge, error, evaluateValidationRule_default as evaluateValidationRule, executeEmbeddedRecoveryFlow_default as executeEmbeddedRecoveryFlow, executeEmbeddedSignInFlow_default as executeEmbeddedSignInFlow, executeEmbeddedSignUpFlow_default as executeEmbeddedSignUpFlow, executeEmbeddedUserOnboardingFlow_default as executeEmbeddedUserOnboardingFlow, extractEmojiFromUri_default as extractEmojiFromUri, extractPkceStorageKeyFromState_default as extractPkceStorageKeyFromState, extractUserClaimsFromIdToken_default as extractUserClaimsFromIdToken, formatDate_default as formatDate, generateFlattenedUserProfile_default as generateFlattenedUserProfile, get_default as get, getDefaultI18nBundles_default as getDefaultI18nBundles, getFlowMeta_default as getFlowMeta, getLatestStateParam_default as getLatestStateParam, getOrganizationUnitChildren_default as getOrganizationUnitChildren, getRedirectBasedSignUpUrl_default as getRedirectBasedSignUpUrl, getUserInfo_default as getUserInfo, getUsersMe_default as getUsersMe, getVendorPrefix_default as getVendorPrefix, info, isEmojiUri_default as isEmojiUri, isEmpty_default as isEmpty, isRecognizedBaseUrlPattern_default as isRecognizedBaseUrlPattern, logger_default as logger, normalizeTranslations_default as normalizeTranslations, processOpenIDScopes_default as processOpenIDScopes, processUsername_default as processUsername, removeTrailingSlash_default as removeTrailingSlash, resolveFieldName_default as resolveFieldName, resolveFlowTemplateLiterals, resolveLocaleDisplayName, resolveLocaleEmoji_default as resolveLocaleEmoji, resolveMeta, resolveResourceEndpoint_default as resolveResourceEndpoint, set_default as set, startCase_default as startCase, updateMeProfile_default as updateMeProfile, warn, withVendorCSSClassPrefix_default as withVendorCSSClassPrefix };

package/dist/index.d.ts

@@ -93,6 +93,8 @@ export { default as get } from './utils/get';
 export { default as startCase } from './utils/startCase';
 export { default as removeTrailingSlash } from './utils/removeTrailingSlash';
 export { default as resolveFieldName } from './utils/resolveFieldName';
+export { default as resolveResourceEndpoint } from './utils/resolveResourceEndpoint';
+export type { ResourceEndpointKey, ResourceEndpointConfig } from './utils/resolveResourceEndpoint';
 export { default as resolveMeta } from './utils/resolveMeta';
 export { default as resolveFlowTemplateLiterals } from './utils/resolveFlowTemplateLiterals';
 export { default as countryCodeToFlagEmoji } from './utils/countryCodeToFlagEmoji';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAC,gBAAgB,EAAC,MAAM,oBAAoB,CAAC;AAEpD,OAAO,EAAC,OAAO,IAAI,yBAAyB,EAAC,MAAM,iCAAiC,CAAC;AACrF,OAAO,EAAC,OAAO,IAAI,yBAAyB,EAAC,MAAM,iCAAiC,CAAC;AACrF,OAAO,EAAC,OAAO,IAAI,2BAA2B,EAAC,MAAM,mCAAmC,CAAC;AACzF,OAAO,EAAC,OAAO,IAAI,iCAAiC,EAAC,MAAM,yCAAyC,CAAC;AACrG,YAAY,EAAC,kCAAkC,EAAC,MAAM,yCAAyC,CAAC;AAChG,OAAO,EAAC,OAAO,IAAI,WAAW,EAAC,MAAM,mBAAmB,CAAC;AACzD,OAAO,EAAC,OAAO,IAAI,2BAA2B,EAAC,MAAM,mCAAmC,CAAC;AACzF,YAAY,EACV,iCAAiC,EACjC,gBAAgB,EAChB,4BAA4B,GAC7B,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAC,OAAO,IAAI,WAAW,EAAC,MAAM,mBAAmB,CAAC;AACzD,OAAO,EAAC,OAAO,IAAI,UAAU,EAAC,MAAM,kBAAkB,CAAC;AACvD,YAAY,EAAC,gBAAgB,EAAC,MAAM,kBAAkB,CAAC;AACvD,OAAO,EAAC,OAAO,IAAI,eAAe,EAAC,MAAM,uBAAuB,CAAC;AACjE,YAAY,EAAC,qBAAqB,EAAC,MAAM,uBAAuB,CAAC;AAEjE,OAAO,EAAC,OAAO,IAAI,wCAAwC,EAAC,MAAM,sDAAsD,CAAC;AACzH,OAAO,EAAC,OAAO,IAAI,cAAc,EAAC,MAAM,4BAA4B,CAAC;AACrE,OAAO,EAAC,OAAO,IAAI,oBAAoB,EAAC,MAAM,kCAAkC,CAAC;AACjF,OAAO,EAAC,OAAO,IAAI,eAAe,EAAC,MAAM,6BAA6B,CAAC;AAEvE,OAAO,EAAC,OAAO,IAAI,cAAc,EAAC,MAAM,yBAAyB,CAAC;AAClE,OAAO,EAAC,OAAO,IAAI,iBAAiB,EAAC,MAAM,4BAA4B,CAAC;AACxE,OAAO,EAAC,OAAO,IAAI,qBAAqB,EAAC,MAAM,gCAAgC,CAAC;AAChF,OAAO,EAAC,sBAAsB,EAAC,MAAM,oBAAoB,CAAC;AAE1D,YAAY,EAAC,mBAAmB,EAAE,oBAAoB,EAAE,aAAa,EAAE,eAAe,EAAC,MAAM,eAAe,CAAC;AAE7G,OAAO,EACL,yBAAyB,EACzB,yBAAyB,EACzB,uBAAuB,EACvB,qBAAqB,GACtB,MAAM,wBAAwB,CAAC;AAChC,YAAY,EACV,qBAAqB,EACrB,2BAA2B,EAC3B,wBAAwB,EACxB,gCAAgC,EAChC,kBAAkB,EAClB,uBAAuB,EACvB,aAAa,EACb,sBAAsB,EACtB,gBAAgB,EAChB,kBAAkB,EAClB,iBAAiB,EACjB,WAAW,EACX,cAAc,EACd,kBAAkB,EAClB,UAAU,EACV,YAAY,GACb,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAC,wBAAwB,EAAE,sBAAsB,EAAC,MAAM,+BAA+B,CAAC;AAC/F,YAAY,EACV,kCAAkC,EAClC,0BAA0B,EAC1B,kCAAkC,EAClC,iCAAiC,EACjC,yBAAyB,GAC1B,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAC,wBAAwB,EAAE,sBAAsB,EAAC,MAAM,+BAA+B,CAAC;AAC/F,YAAY,EACV,kCAAkC,EAClC,0BAA0B,EAC1B,kCAAkC,EAClC,iCAAiC,EACjC,yBAAyB,EACzB,+BAA+B,GAChC,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAC,0BAA0B,EAAE,wBAAwB,EAAC,MAAM,iCAAiC,CAAC;AACrG,YAAY,EACV,4BAA4B,EAC5B,mCAAmC,EACnC,2BAA2B,EAC3B,iCAAiC,GAClC,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAC,YAAY,EAAC,MAAM,oBAAoB,CAAC;AAChD,YAAY,EACV,mBAAmB,EACnB,UAAU,EACV,cAAc,EACd,YAAY,EACZ,oBAAoB,EACpB,wBAAwB,EACxB,aAAa,EACb,qBAAqB,EACrB,uBAAuB,EACvB,uBAAuB,EACvB,mBAAmB,EACnB,wBAAwB,EACxB,kBAAkB,EAClB,uBAAuB,GACxB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAC,gBAAgB,EAAE,wBAAwB,EAAC,MAAM,wBAAwB,CAAC;AAClF,OAAO,EAAC,QAAQ,EAAC,MAAM,eAAe,CAAC;AACvC,YAAY,EAAC,eAAe,EAAC,MAAM,iBAAiB,CAAC;AACrD,YAAY,EACV,gBAAgB,EAChB,sBAAsB,EACtB,uBAAuB,EACvB,yBAAyB,EACzB,uBAAuB,EACvB,wBAAwB,EACxB,UAAU,EACV,MAAM,EACN,WAAW,EACX,gBAAgB,EAChB,eAAe,EACf,mBAAmB,EACnB,eAAe,EACf,UAAU,EACV,cAAc,EACd,aAAa,EACb,cAAc,EACd,aAAa,GACd,MAAM,iBAAiB,CAAC;AACzB,YAAY,EAAC,uBAAuB,EAAC,MAAM,8BAA8B,CAAC;AAC1E,YAAY,EAAC,sBAAsB,EAAE,iBAAiB,EAAE,oBAAoB,EAAC,MAAM,gCAAgC,CAAC;AACpH,YAAY,EAAC,aAAa,EAAE,OAAO,EAAE,0BAA0B,EAAC,MAAM,gBAAgB,CAAC;AACvF,YAAY,EAAC,WAAW,EAAC,MAAM,gBAAgB,CAAC;AAChD,YAAY,EAAC,gBAAgB,EAAC,MAAM,6BAA6B,CAAC;AAClE,YAAY,EAAC,MAAM,EAAE,YAAY,EAAC,MAAM,iBAAiB,CAAC;AAC1D,YAAY,EAAC,iBAAiB,EAAC,MAAM,yBAAyB,CAAC;AAC/D,YAAY,EACV,yBAAyB,EACzB,sCAAsC,EACtC,iCAAiC,GAClC,MAAM,wBAAwB,CAAC;AAChC,YAAY,EAAC,aAAa,EAAC,MAAM,yBAAyB,CAAC;AAC3D,YAAY,EAAC,wBAAwB,EAAC,MAAM,yBAAyB,CAAC;AACtE,YAAY,EAAC,OAAO,EAAE,cAAc,EAAC,MAAM,gBAAgB,CAAC;AAC5D,YAAY,EAAC,IAAI,EAAE,WAAW,EAAC,MAAM,eAAe,CAAC;AACrD,YAAY,EAAC,WAAW,EAAC,MAAM,kBAAkB,CAAC;AAClD,YAAY,EAAC,aAAa,EAAC,MAAM,sBAAsB,CAAC;AACxD,YAAY,EAAC,kCAAkC,EAAC,MAAM,eAAe,CAAC;AACtE,YAAY,EAAC,gBAAgB,EAAC,MAAM,wBAAwB,CAAC;AAC7D,OAAO,EAAC,SAAS,EAAC,MAAM,gBAAgB,CAAC;AAEzC,OAAO,EAAC,OAAO,IAAI,yBAAyB,EAAC,MAAM,6BAA6B,CAAC;AAEjF,OAAO,EAAC,OAAO,IAAI,WAAW,EAAE,aAAa,EAAC,MAAM,qBAAqB,CAAC;AAC1E,YAAY,EAAC,WAAW,EAAE,WAAW,EAAE,KAAK,EAAE,SAAS,EAAE,cAAc,EAAC,MAAM,eAAe,CAAC;AAE9F,OAAO,EAAC,OAAO,IAAI,oBAAoB,EAAC,MAAM,8BAA8B,CAAC;AAC7E,OAAO,EAAC,OAAO,IAAI,sBAAsB,EAAC,MAAM,gCAAgC,CAAC;AACjF,OAAO,EAAC,OAAO,IAAI,sBAAsB,EAAC,MAAM,gCAAgC,CAAC;AACjF,OAAO,EAAC,OAAO,IAAI,GAAG,EAAC,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAC,OAAO,IAAI,UAAU,EAAC,MAAM,oBAAoB,CAAC;AACzD,OAAO,EAAC,OAAO,IAAI,eAAe,EAAC,MAAM,yBAAyB,CAAC;AACnE,OAAO,EAAC,OAAO,IAAI,SAAS,EAAC,MAAM,mBAAmB,CAAC;AACvD,OAAO,EAAC,OAAO,IAAI,4BAA4B,EAAC,MAAM,sCAAsC,CAAC;AAC7F,OAAO,EAAC,OAAO,IAAI,0BAA0B,EAAC,MAAM,oCAAoC,CAAC;AACzF,OAAO,EAAC,OAAO,IAAI,8BAA8B,EAAC,MAAM,wCAAwC,CAAC;AACjG,OAAO,EAAC,OAAO,IAAI,mBAAmB,EAAC,MAAM,6BAA6B,CAAC;AAC3E,OAAO,EAAC,OAAO,IAAI,4BAA4B,EAAC,MAAM,sCAAsC,CAAC;AAC7F,OAAO,EAAC,OAAO,IAAI,yBAAyB,EAAC,MAAM,mCAAmC,CAAC;AACvF,OAAO,EAAC,OAAO,IAAI,OAAO,EAAC,MAAM,iBAAiB,CAAC;AACnD,OAAO,EAAC,OAAO,IAAI,UAAU,EAAE,gBAAgB,EAAC,MAAM,oBAAoB,CAAC;AAC3E,OAAO,EAAC,OAAO,IAAI,mBAAmB,EAAC,MAAM,6BAA6B,CAAC;AAC3E,OAAO,EAAC,OAAO,IAAI,GAAG,EAAC,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAC,OAAO,IAAI,GAAG,EAAC,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAC,OAAO,IAAI,SAAS,EAAC,MAAM,mBAAmB,CAAC;AACvD,OAAO,EAAC,OAAO,IAAI,mBAAmB,EAAC,MAAM,6BAA6B,CAAC;AAC3E,OAAO,EAAC,OAAO,IAAI,gBAAgB,EAAC,MAAM,0BAA0B,CAAC;AACrE,OAAO,EAAC,OAAO,IAAI,WAAW,EAAC,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAC,OAAO,IAAI,2BAA2B,EAAC,MAAM,qCAAqC,CAAC;AAC3F,OAAO,EAAC,OAAO,IAAI,sBAAsB,EAAC,MAAM,gCAAgC,CAAC;AACjF,OAAO,EAAC,OAAO,IAAI,wBAAwB,EAAC,MAAM,kCAAkC,CAAC;AACrF,OAAO,EAAC,OAAO,IAAI,kBAAkB,EAAC,MAAM,4BAA4B,CAAC;AACzE,OAAO,EAAC,OAAO,IAAI,uBAAuB,EAAC,MAAM,iCAAiC,CAAC;AACnF,OAAO,EAAC,OAAO,IAAI,sBAAsB,EAAE,+BAA+B,EAAC,MAAM,gCAAgC,CAAC;AAClH,OAAO,EAAC,OAAO,IAAI,mBAAmB,EAAC,MAAM,6BAA6B,CAAC;AAC3E,OAAO,EAAC,OAAO,IAAI,wBAAwB,EAAC,MAAM,kCAAkC,CAAC;AACrF,OAAO,EAAC,OAAO,IAAI,eAAe,EAAC,MAAM,yBAAyB,CAAC;AAEnE,OAAO,EACL,OAAO,IAAI,MAAM,EACjB,YAAY,EACZ,qBAAqB,EACrB,mBAAmB,EACnB,4BAA4B,EAC5B,SAAS,IAAI,eAAe,EAC5B,KAAK,EACL,IAAI,EACJ,IAAI,EACJ,KAAK,GACN,MAAM,gBAAgB,CAAC;AACxB,YAAY,EAAC,QAAQ,EAAE,YAAY,EAAC,MAAM,gBAAgB,CAAC;AAE3D,OAAO,EAAC,OAAO,IAAI,cAAc,EAAC,MAAM,kBAAkB,CAAC;AAE3D,OAAO,EAAC,UAAU,EAAC,MAAM,cAAc,CAAC;AACxC,YAAY,EAAC,SAAS,EAAE,iBAAiB,EAAE,YAAY,EAAC,MAAM,eAAe,CAAC;AAE9E,YAAY,EAAC,UAAU,EAAE,gBAAgB,EAAC,MAAM,oBAAoB,CAAC;AACrE,OAAO,EAAC,OAAO,IAAI,0BAA0B,EAAC,MAAM,6CAA6C,CAAC;AAClG,OAAO,EAAC,OAAO,IAAI,qBAAqB,EAAC,MAAM,oCAAoC,CAAC;AACpF,OAAO,EAAC,OAAO,IAAI,qBAAqB,EAAC,MAAM,oCAAoC,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAC,gBAAgB,EAAC,MAAM,oBAAoB,CAAC;AAEpD,OAAO,EAAC,OAAO,IAAI,yBAAyB,EAAC,MAAM,iCAAiC,CAAC;AACrF,OAAO,EAAC,OAAO,IAAI,yBAAyB,EAAC,MAAM,iCAAiC,CAAC;AACrF,OAAO,EAAC,OAAO,IAAI,2BAA2B,EAAC,MAAM,mCAAmC,CAAC;AACzF,OAAO,EAAC,OAAO,IAAI,iCAAiC,EAAC,MAAM,yCAAyC,CAAC;AACrG,YAAY,EAAC,kCAAkC,EAAC,MAAM,yCAAyC,CAAC;AAChG,OAAO,EAAC,OAAO,IAAI,WAAW,EAAC,MAAM,mBAAmB,CAAC;AACzD,OAAO,EAAC,OAAO,IAAI,2BAA2B,EAAC,MAAM,mCAAmC,CAAC;AACzF,YAAY,EACV,iCAAiC,EACjC,gBAAgB,EAChB,4BAA4B,GAC7B,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAC,OAAO,IAAI,WAAW,EAAC,MAAM,mBAAmB,CAAC;AACzD,OAAO,EAAC,OAAO,IAAI,UAAU,EAAC,MAAM,kBAAkB,CAAC;AACvD,YAAY,EAAC,gBAAgB,EAAC,MAAM,kBAAkB,CAAC;AACvD,OAAO,EAAC,OAAO,IAAI,eAAe,EAAC,MAAM,uBAAuB,CAAC;AACjE,YAAY,EAAC,qBAAqB,EAAC,MAAM,uBAAuB,CAAC;AAEjE,OAAO,EAAC,OAAO,IAAI,wCAAwC,EAAC,MAAM,sDAAsD,CAAC;AACzH,OAAO,EAAC,OAAO,IAAI,cAAc,EAAC,MAAM,4BAA4B,CAAC;AACrE,OAAO,EAAC,OAAO,IAAI,oBAAoB,EAAC,MAAM,kCAAkC,CAAC;AACjF,OAAO,EAAC,OAAO,IAAI,eAAe,EAAC,MAAM,6BAA6B,CAAC;AAEvE,OAAO,EAAC,OAAO,IAAI,cAAc,EAAC,MAAM,yBAAyB,CAAC;AAClE,OAAO,EAAC,OAAO,IAAI,iBAAiB,EAAC,MAAM,4BAA4B,CAAC;AACxE,OAAO,EAAC,OAAO,IAAI,qBAAqB,EAAC,MAAM,gCAAgC,CAAC;AAChF,OAAO,EAAC,sBAAsB,EAAC,MAAM,oBAAoB,CAAC;AAE1D,YAAY,EAAC,mBAAmB,EAAE,oBAAoB,EAAE,aAAa,EAAE,eAAe,EAAC,MAAM,eAAe,CAAC;AAE7G,OAAO,EACL,yBAAyB,EACzB,yBAAyB,EACzB,uBAAuB,EACvB,qBAAqB,GACtB,MAAM,wBAAwB,CAAC;AAChC,YAAY,EACV,qBAAqB,EACrB,2BAA2B,EAC3B,wBAAwB,EACxB,gCAAgC,EAChC,kBAAkB,EAClB,uBAAuB,EACvB,aAAa,EACb,sBAAsB,EACtB,gBAAgB,EAChB,kBAAkB,EAClB,iBAAiB,EACjB,WAAW,EACX,cAAc,EACd,kBAAkB,EAClB,UAAU,EACV,YAAY,GACb,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAC,wBAAwB,EAAE,sBAAsB,EAAC,MAAM,+BAA+B,CAAC;AAC/F,YAAY,EACV,kCAAkC,EAClC,0BAA0B,EAC1B,kCAAkC,EAClC,iCAAiC,EACjC,yBAAyB,GAC1B,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAC,wBAAwB,EAAE,sBAAsB,EAAC,MAAM,+BAA+B,CAAC;AAC/F,YAAY,EACV,kCAAkC,EAClC,0BAA0B,EAC1B,kCAAkC,EAClC,iCAAiC,EACjC,yBAAyB,EACzB,+BAA+B,GAChC,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAC,0BAA0B,EAAE,wBAAwB,EAAC,MAAM,iCAAiC,CAAC;AACrG,YAAY,EACV,4BAA4B,EAC5B,mCAAmC,EACnC,2BAA2B,EAC3B,iCAAiC,GAClC,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAC,YAAY,EAAC,MAAM,oBAAoB,CAAC;AAChD,YAAY,EACV,mBAAmB,EACnB,UAAU,EACV,cAAc,EACd,YAAY,EACZ,oBAAoB,EACpB,wBAAwB,EACxB,aAAa,EACb,qBAAqB,EACrB,uBAAuB,EACvB,uBAAuB,EACvB,mBAAmB,EACnB,wBAAwB,EACxB,kBAAkB,EAClB,uBAAuB,GACxB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAC,gBAAgB,EAAE,wBAAwB,EAAC,MAAM,wBAAwB,CAAC;AAClF,OAAO,EAAC,QAAQ,EAAC,MAAM,eAAe,CAAC;AACvC,YAAY,EAAC,eAAe,EAAC,MAAM,iBAAiB,CAAC;AACrD,YAAY,EACV,gBAAgB,EAChB,sBAAsB,EACtB,uBAAuB,EACvB,yBAAyB,EACzB,uBAAuB,EACvB,wBAAwB,EACxB,UAAU,EACV,MAAM,EACN,WAAW,EACX,gBAAgB,EAChB,eAAe,EACf,mBAAmB,EACnB,eAAe,EACf,UAAU,EACV,cAAc,EACd,aAAa,EACb,cAAc,EACd,aAAa,GACd,MAAM,iBAAiB,CAAC;AACzB,YAAY,EAAC,uBAAuB,EAAC,MAAM,8BAA8B,CAAC;AAC1E,YAAY,EAAC,sBAAsB,EAAE,iBAAiB,EAAE,oBAAoB,EAAC,MAAM,gCAAgC,CAAC;AACpH,YAAY,EAAC,aAAa,EAAE,OAAO,EAAE,0BAA0B,EAAC,MAAM,gBAAgB,CAAC;AACvF,YAAY,EAAC,WAAW,EAAC,MAAM,gBAAgB,CAAC;AAChD,YAAY,EAAC,gBAAgB,EAAC,MAAM,6BAA6B,CAAC;AAClE,YAAY,EAAC,MAAM,EAAE,YAAY,EAAC,MAAM,iBAAiB,CAAC;AAC1D,YAAY,EAAC,iBAAiB,EAAC,MAAM,yBAAyB,CAAC;AAC/D,YAAY,EACV,yBAAyB,EACzB,sCAAsC,EACtC,iCAAiC,GAClC,MAAM,wBAAwB,CAAC;AAChC,YAAY,EAAC,aAAa,EAAC,MAAM,yBAAyB,CAAC;AAC3D,YAAY,EAAC,wBAAwB,EAAC,MAAM,yBAAyB,CAAC;AACtE,YAAY,EAAC,OAAO,EAAE,cAAc,EAAC,MAAM,gBAAgB,CAAC;AAC5D,YAAY,EAAC,IAAI,EAAE,WAAW,EAAC,MAAM,eAAe,CAAC;AACrD,YAAY,EAAC,WAAW,EAAC,MAAM,kBAAkB,CAAC;AAClD,YAAY,EAAC,aAAa,EAAC,MAAM,sBAAsB,CAAC;AACxD,YAAY,EAAC,kCAAkC,EAAC,MAAM,eAAe,CAAC;AACtE,YAAY,EAAC,gBAAgB,EAAC,MAAM,wBAAwB,CAAC;AAC7D,OAAO,EAAC,SAAS,EAAC,MAAM,gBAAgB,CAAC;AAEzC,OAAO,EAAC,OAAO,IAAI,yBAAyB,EAAC,MAAM,6BAA6B,CAAC;AAEjF,OAAO,EAAC,OAAO,IAAI,WAAW,EAAE,aAAa,EAAC,MAAM,qBAAqB,CAAC;AAC1E,YAAY,EAAC,WAAW,EAAE,WAAW,EAAE,KAAK,EAAE,SAAS,EAAE,cAAc,EAAC,MAAM,eAAe,CAAC;AAE9F,OAAO,EAAC,OAAO,IAAI,oBAAoB,EAAC,MAAM,8BAA8B,CAAC;AAC7E,OAAO,EAAC,OAAO,IAAI,sBAAsB,EAAC,MAAM,gCAAgC,CAAC;AACjF,OAAO,EAAC,OAAO,IAAI,sBAAsB,EAAC,MAAM,gCAAgC,CAAC;AACjF,OAAO,EAAC,OAAO,IAAI,GAAG,EAAC,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAC,OAAO,IAAI,UAAU,EAAC,MAAM,oBAAoB,CAAC;AACzD,OAAO,EAAC,OAAO,IAAI,eAAe,EAAC,MAAM,yBAAyB,CAAC;AACnE,OAAO,EAAC,OAAO,IAAI,SAAS,EAAC,MAAM,mBAAmB,CAAC;AACvD,OAAO,EAAC,OAAO,IAAI,4BAA4B,EAAC,MAAM,sCAAsC,CAAC;AAC7F,OAAO,EAAC,OAAO,IAAI,0BAA0B,EAAC,MAAM,oCAAoC,CAAC;AACzF,OAAO,EAAC,OAAO,IAAI,8BAA8B,EAAC,MAAM,wCAAwC,CAAC;AACjG,OAAO,EAAC,OAAO,IAAI,mBAAmB,EAAC,MAAM,6BAA6B,CAAC;AAC3E,OAAO,EAAC,OAAO,IAAI,4BAA4B,EAAC,MAAM,sCAAsC,CAAC;AAC7F,OAAO,EAAC,OAAO,IAAI,yBAAyB,EAAC,MAAM,mCAAmC,CAAC;AACvF,OAAO,EAAC,OAAO,IAAI,OAAO,EAAC,MAAM,iBAAiB,CAAC;AACnD,OAAO,EAAC,OAAO,IAAI,UAAU,EAAE,gBAAgB,EAAC,MAAM,oBAAoB,CAAC;AAC3E,OAAO,EAAC,OAAO,IAAI,mBAAmB,EAAC,MAAM,6BAA6B,CAAC;AAC3E,OAAO,EAAC,OAAO,IAAI,GAAG,EAAC,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAC,OAAO,IAAI,GAAG,EAAC,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAC,OAAO,IAAI,SAAS,EAAC,MAAM,mBAAmB,CAAC;AACvD,OAAO,EAAC,OAAO,IAAI,mBAAmB,EAAC,MAAM,6BAA6B,CAAC;AAC3E,OAAO,EAAC,OAAO,IAAI,gBAAgB,EAAC,MAAM,0BAA0B,CAAC;AACrE,OAAO,EAAC,OAAO,IAAI,uBAAuB,EAAC,MAAM,iCAAiC,CAAC;AACnF,YAAY,EAAC,mBAAmB,EAAE,sBAAsB,EAAC,MAAM,iCAAiC,CAAC;AACjG,OAAO,EAAC,OAAO,IAAI,WAAW,EAAC,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAC,OAAO,IAAI,2BAA2B,EAAC,MAAM,qCAAqC,CAAC;AAC3F,OAAO,EAAC,OAAO,IAAI,sBAAsB,EAAC,MAAM,gCAAgC,CAAC;AACjF,OAAO,EAAC,OAAO,IAAI,wBAAwB,EAAC,MAAM,kCAAkC,CAAC;AACrF,OAAO,EAAC,OAAO,IAAI,kBAAkB,EAAC,MAAM,4BAA4B,CAAC;AACzE,OAAO,EAAC,OAAO,IAAI,uBAAuB,EAAC,MAAM,iCAAiC,CAAC;AACnF,OAAO,EAAC,OAAO,IAAI,sBAAsB,EAAE,+BAA+B,EAAC,MAAM,gCAAgC,CAAC;AAClH,OAAO,EAAC,OAAO,IAAI,mBAAmB,EAAC,MAAM,6BAA6B,CAAC;AAC3E,OAAO,EAAC,OAAO,IAAI,wBAAwB,EAAC,MAAM,kCAAkC,CAAC;AACrF,OAAO,EAAC,OAAO,IAAI,eAAe,EAAC,MAAM,yBAAyB,CAAC;AAEnE,OAAO,EACL,OAAO,IAAI,MAAM,EACjB,YAAY,EACZ,qBAAqB,EACrB,mBAAmB,EACnB,4BAA4B,EAC5B,SAAS,IAAI,eAAe,EAC5B,KAAK,EACL,IAAI,EACJ,IAAI,EACJ,KAAK,GACN,MAAM,gBAAgB,CAAC;AACxB,YAAY,EAAC,QAAQ,EAAE,YAAY,EAAC,MAAM,gBAAgB,CAAC;AAE3D,OAAO,EAAC,OAAO,IAAI,cAAc,EAAC,MAAM,kBAAkB,CAAC;AAE3D,OAAO,EAAC,UAAU,EAAC,MAAM,cAAc,CAAC;AACxC,YAAY,EAAC,SAAS,EAAE,iBAAiB,EAAE,YAAY,EAAC,MAAM,eAAe,CAAC;AAE9E,YAAY,EAAC,UAAU,EAAE,gBAAgB,EAAC,MAAM,oBAAoB,CAAC;AACrE,OAAO,EAAC,OAAO,IAAI,0BAA0B,EAAC,MAAM,6CAA6C,CAAC;AAClG,OAAO,EAAC,OAAO,IAAI,qBAAqB,EAAC,MAAM,oCAAoC,CAAC;AACpF,OAAO,EAAC,OAAO,IAAI,qBAAqB,EAAC,MAAM,oCAAoC,CAAC"}

package/dist/index.js

@@ -59,7 +59,8 @@ const TokenConstants = {
 		"ML-DSA-65",
 		"ML-DSA-87"
 	] },
-	Storage: { StorageKeys: { REFRESH_TOKEN_TIMER: "refresh_token_timer" } }
+	Storage: { StorageKeys: { REFRESH_TOKEN_TIMER: "refresh_token_timer" } },
+	Lifecycle: { CLIENT_CREDENTIALS_REFRESH_MARGIN_MS: 3e4 }
 };
 var TokenConstants_default = TokenConstants;
 
@@ -2525,6 +2526,42 @@ const processOpenIDScopes = (scopes) => {
 };
 var processOpenIDScopes_default = processOpenIDScopes;
 
+//#endregion
+//#region src/utils/resolveResourceEndpoint.ts
+/**
+* The `config.endpoints` keys that address resource-server endpoints rather than OIDC/OAuth
+* endpoints. Used to keep these overrides out of the resolved OIDC provider metadata.
+*/
+const RESOURCE_ENDPOINT_KEYS = [
+	"flowExecute",
+	"flowMeta",
+	"usersMe"
+];
+/**
+* Resolves the absolute `url` to use for a resource-server endpoint, honoring (in order of
+* precedence) an explicit per-call URL, then a `config.endpoints` override.
+*
+* Returns `undefined` when neither is set, so the calling API function falls back to deriving the
+* endpoint from `baseUrl` (i.e. `${baseUrl}/flow/execute`) exactly as before. Callers should keep
+* passing `baseUrl` alongside the resolved `url` to preserve that fallback.
+*
+* @param key - The resource endpoint to resolve.
+* @param config - The client config carrying optional `endpoints` overrides.
+* @param explicitUrl - An explicit URL provided by the immediate caller; takes highest precedence.
+* @returns The resolved override URL, or `undefined` to defer to `baseUrl`-based resolution.
+*
+* @example
+* ```typescript
+* const response = await executeEmbeddedUserOnboardingFlow({
+*   baseUrl: config.baseUrl,
+*   url: resolveResourceEndpoint('flowExecute', config),
+*   payload,
+* });
+* ```
+*/
+const resolveResourceEndpoint = (key, config, explicitUrl) => explicitUrl ?? config?.endpoints?.[key] ?? void 0;
+var resolveResourceEndpoint_default = resolveResourceEndpoint;
+
 //#endregion
 //#region src/constants/TokenExchangeConstants.ts
 /**
@@ -2595,6 +2632,25 @@ var AuthenticationHelper = class {
 		this.cryptoHelper = cryptoHelperInstance;
 	}
 	/**
+	* Maps the config-defined OIDC endpoint overrides to their discovery-metadata form.
+	*
+	* Endpoint names are converted from camelCase to snake_case, and resource-server endpoints
+	* (`RESOURCE_ENDPOINT_KEYS`) are excluded — those are resolved separately via
+	* `resolveResourceEndpoint` and must not leak into the OIDC provider metadata.
+	*
+	* @param configData - The resolved auth client config.
+	* @returns A snake_cased map of the OIDC endpoint overrides (empty when none are configured).
+	*/
+	mapConfiguredOidcEndpoints(configData) {
+		const endpoints = {};
+		if (!configData.endpoints) return endpoints;
+		Object.keys(configData.endpoints).filter((endpointName) => !RESOURCE_ENDPOINT_KEYS.includes(endpointName)).forEach((endpointName) => {
+			const snakeCasedName = endpointName.replace(/[A-Z]/g, (letter) => `_${letter.toLowerCase()}`);
+			endpoints[snakeCasedName] = configData.endpoints ? configData.endpoints[endpointName] : "";
+		});
+		return endpoints;
+	}
+	/**
 	* Merges explicit endpoint overrides from config into the discovery response.
 	* Config-defined endpoint names (camelCase) are converted to snake_case before merging.
 	*
@@ -2602,15 +2658,10 @@ var AuthenticationHelper = class {
 	* @returns The discovery response with any config-specified endpoint overrides applied.
 	*/
 	async resolveEndpoints(response) {
-		const oidcProviderMetaData = {};
 		const configData = await this.config();
-		if (configData.endpoints) Object.keys(configData.endpoints).forEach((endpointName) => {
-			const snakeCasedName = endpointName.replace(/[A-Z]/g, (letter) => `_${letter.toLowerCase()}`);
-			oidcProviderMetaData[snakeCasedName] = configData?.endpoints ? configData.endpoints[endpointName] : "";
-		});
 		return {
 			...response,
-			...oidcProviderMetaData
+			...this.mapConfiguredOidcEndpoints(configData)
 		};
 	}
 	/**
@@ -2621,7 +2672,6 @@ var AuthenticationHelper = class {
 	* @throws {ThunderIDAuthException} When required endpoints are absent from the config.
 	*/
 	async resolveEndpointsExplicitly() {
-		const oidcProviderMetaData = {};
 		const configData = await this.config();
 		const requiredEndpoints = [
 			OIDCDiscoveryConstants_default.Storage.StorageKeys.Endpoints.AUTHORIZATION,
@@ -2636,11 +2686,7 @@ var AuthenticationHelper = class {
 		if (!(configData.endpoints ? requiredEndpoints.every((reqEndpointName) => configData.endpoints ? Object.keys(configData.endpoints).some((endpointName) => {
 			return endpointName.replace(/[A-Z]/g, (letter) => `_${letter.toLowerCase()}`) === reqEndpointName;
 		}) : false) : false)) throw new ThunderIDAuthException("JS-AUTH_HELPER-REE-NF01", "Required endpoints missing", "Some or all of the required endpoints are missing in the object passed to the `endpoints` attribute of the`AuthConfig` object.");
-		if (configData.endpoints) Object.keys(configData.endpoints).forEach((endpointName) => {
-			const snakeCasedName = endpointName.replace(/[A-Z]/g, (letter) => `_${letter.toLowerCase()}`);
-			oidcProviderMetaData[snakeCasedName] = configData?.endpoints ? configData.endpoints[endpointName] : "";
-		});
-		return { ...oidcProviderMetaData };
+		return { ...this.mapConfiguredOidcEndpoints(configData) };
 	}
 	/**
 	* Derives OIDC endpoint URLs from the configured `baseUrl`.
@@ -2651,14 +2697,10 @@ var AuthenticationHelper = class {
 	* @throws {ThunderIDAuthException} When `baseUrl` is not defined in the config.
 	*/
 	async resolveEndpointsByBaseURL() {
-		const oidcProviderMetaData = {};
 		const configData = await this.config();
 		const { baseUrl } = configData;
 		if (!baseUrl) throw new ThunderIDAuthException("JS-AUTH_HELPER_REBO-NF01", "Base URL not defined.", "Base URL is not defined in AuthClient config.");
-		if (configData.endpoints) Object.keys(configData.endpoints).forEach((endpointName) => {
-			const snakeCasedName = endpointName.replace(/[A-Z]/g, (letter) => `_${letter.toLowerCase()}`);
-			oidcProviderMetaData[snakeCasedName] = configData?.endpoints ? configData.endpoints[endpointName] : "";
-		});
+		const oidcProviderMetaData = this.mapConfiguredOidcEndpoints(configData);
 		const endpointKeys = OIDCDiscoveryConstants_default.Storage.StorageKeys.Endpoints;
 		const endpointPaths = OIDCDiscoveryConstants_default.Endpoints;
 		return {
@@ -3086,8 +3128,18 @@ var ThunderIDJavaScriptClient = class {
 		return createdAt + parseInt(expiresInString, 10) * 1e3 > (/* @__PURE__ */ new Date()).getTime();
 	}
 	async getAccessToken(sessionId) {
+		if ((await this.configProvider()).grantType === "client_credentials") {
+			const sessionData = await this.storageManager.getSessionData(sessionId);
+			if (sessionData?.access_token && this.isCachedTokenStillValid(sessionData)) return sessionData.access_token;
+			return (await this.requestClientCredentialsToken(sessionId)).accessToken;
+		}
 		return (await this.storageManager.getSessionData(sessionId))?.access_token;
 	}
+	isCachedTokenStillValid(sessionData) {
+		if (!sessionData.created_at || !sessionData.expires_in) return false;
+		const expiresInMs = parseInt(sessionData.expires_in, 10) * 1e3;
+		return sessionData.created_at + expiresInMs - TokenConstants_default.Lifecycle.CLIENT_CREDENTIALS_REFRESH_MARGIN_MS > Date.now();
+	}
 	clearSession(sessionId) {
 		this.authHelper.clearSession(sessionId);
 	}
@@ -3360,6 +3412,56 @@ var ThunderIDJavaScriptClient = class {
 		if (!tokenResponse.ok) throw new ThunderIDAuthException("JS-AUTH_CORE-RAT2-HE04", `Refreshing access token failed with ${tokenResponse.statusText}`, await tokenResponse.json());
 		return this.authHelper.handleTokenResponse(tokenResponse, userId);
 	}
+	/**
+	* Requests a machine-to-machine access token via the `client_credentials` grant
+	* (RFC 6749 §4.4) and caches it under the given session key. Unlike the user-facing
+	* flows, there's no id_token or refresh_token: the service authenticates as itself.
+	*/
+	async requestClientCredentialsToken(sessionId) {
+		if (!await this.storageManager.getTemporaryDataParameter(OIDCDiscoveryConstants_default.Storage.StorageKeys.OPENID_PROVIDER_CONFIG_INITIATED)) await this.loadOpenIDProviderConfiguration(false);
+		const tokenEndpoint = (await this.oidcProviderMetaDataProvider()).token_endpoint;
+		const configData = await this.configProvider();
+		if (!tokenEndpoint || tokenEndpoint.trim().length === 0) throw new ThunderIDAuthException("JS-AUTH_CORE-RCCT-NF01", "Token endpoint not found.", "No token endpoint was found in the OIDC provider meta data returned by the well-known endpoint or the token endpoint passed to the SDK is empty.");
+		const body = new URLSearchParams();
+		body.set("grant_type", "client_credentials");
+		body.set("client_id", configData.clientId ?? "");
+		const hasSecret = Boolean(configData.clientSecret && configData.clientSecret.trim().length > 0);
+		const tokenEndpointAuthMethod = configData.tokenRequest?.authMethod ?? "client_secret_basic";
+		if (hasSecret && tokenEndpointAuthMethod === "client_secret_post") body.set("client_secret", configData.clientSecret);
+		const scope = Array.isArray(configData.scopes) ? configData.scopes.join(" ") : configData.scopes;
+		if (scope) body.set("scope", scope);
+		if (configData.tokenRequest?.params) Object.entries(configData.tokenRequest.params).forEach(([key, value]) => {
+			body.set(key, value);
+		});
+		const tokenRequestHeaders = {
+			Accept: "application/json",
+			"Content-Type": "application/x-www-form-urlencoded"
+		};
+		if (hasSecret && tokenEndpointAuthMethod === "client_secret_basic") tokenRequestHeaders["Authorization"] = `Basic ${base64Encode_default(`${encodeURIComponent(configData.clientId)}:${encodeURIComponent(configData.clientSecret)}`)}`;
+		let tokenResponse;
+		try {
+			tokenResponse = await fetch(tokenEndpoint, {
+				body,
+				headers: tokenRequestHeaders,
+				method: "POST"
+			});
+		} catch (error$1) {
+			throw new ThunderIDAuthException("JS-AUTH_CORE-RCCT-NE02", "Requesting client credentials token failed.", error$1 ?? "The request to get the client credentials access token failed.");
+		}
+		if (!tokenResponse.ok) throw new ThunderIDAuthException("JS-AUTH_CORE-RCCT-HE03", `Requesting client credentials token failed with ${tokenResponse.statusText}`, await tokenResponse.json());
+		const parsedResponse = await tokenResponse.json();
+		parsedResponse.created_at = (/* @__PURE__ */ new Date()).getTime();
+		await this.storageManager.setSessionData(parsedResponse, sessionId);
+		return {
+			accessToken: parsedResponse.access_token,
+			createdAt: parsedResponse.created_at,
+			expiresIn: parsedResponse.expires_in,
+			idToken: parsedResponse.id_token ?? "",
+			refreshToken: parsedResponse.refresh_token ?? "",
+			scope: parsedResponse.scope,
+			tokenType: parsedResponse.token_type
+		};
+	}
 	async revokeAccessToken(userId) {
 		const revokeTokenEndpoint = (await this.oidcProviderMetaDataProvider()).revocation_endpoint;
 		const configData = await this.configProvider();
@@ -6100,4 +6202,4 @@ const normalizeTranslations = (translations) => {
 var normalizeTranslations_default = normalizeTranslations;
 
 //#endregion
-export { ApplicationNativeAuthenticationConstants_default as ApplicationNativeAuthenticationConstants, AuthenticationHelper_default as AuthenticationHelper, DEFAULT_THEME, DEFAULT_VALIDATION_MESSAGE_KEYS, EMOJI_URI_SCHEME, EmbeddedFlowActionVariant, EmbeddedFlowComponentType, EmbeddedFlowEventType, EmbeddedFlowResponseType, EmbeddedFlowTextVariant, EmbeddedFlowType, EmbeddedRecoveryFlowStatus, EmbeddedRecoveryFlowType, EmbeddedSignInFlowStatus, EmbeddedSignInFlowType, EmbeddedSignUpFlowStatus, EmbeddedSignUpFlowType, FieldType, FlowMetaType, FlowMode, HttpClient, IsomorphicCrypto, OIDCRequestConstants_default as OIDCRequestConstants, StorageManager_default as StorageManager, ThunderIDAPIError, ThunderIDAuthException, ThunderIDError, ThunderIDJavaScriptClient_default as ThunderIDJavaScriptClient, ThunderIDRuntimeError, TokenConstants_default as TokenConstants, TranslationBundleConstants_default as TranslationBundleConstants, VendorConstants_default as VendorConstants, arrayBufferToBase64url_default as arrayBufferToBase64url, base64urlToArrayBuffer_default as base64urlToArrayBuffer, bem_default as bem, buildValidatorFromRules_default as buildValidatorFromRules, configure as configureLogger, countryCodeToFlagEmoji, createComponentLogger, createLogger, createPackageComponentLogger, createPackageLogger, createTheme_default as createTheme, debug, deepMerge_default as deepMerge, error, evaluateValidationRule_default as evaluateValidationRule, executeEmbeddedRecoveryFlow_default as executeEmbeddedRecoveryFlow, executeEmbeddedSignInFlow_default as executeEmbeddedSignInFlow, executeEmbeddedSignUpFlow_default as executeEmbeddedSignUpFlow, executeEmbeddedUserOnboardingFlow_default as executeEmbeddedUserOnboardingFlow, extractEmojiFromUri_default as extractEmojiFromUri, extractPkceStorageKeyFromState_default as extractPkceStorageKeyFromState, extractUserClaimsFromIdToken_default as extractUserClaimsFromIdToken, formatDate_default as formatDate, generateFlattenedUserProfile_default as generateFlattenedUserProfile, get_default as get, getDefaultI18nBundles_default as getDefaultI18nBundles, getFlowMeta_default as getFlowMeta, getLatestStateParam_default as getLatestStateParam, getOrganizationUnitChildren_default as getOrganizationUnitChildren, getRedirectBasedSignUpUrl_default as getRedirectBasedSignUpUrl, getUserInfo_default as getUserInfo, getUsersMe_default as getUsersMe, getVendorPrefix_default as getVendorPrefix, info, isEmojiUri_default as isEmojiUri, isEmpty_default as isEmpty, isRecognizedBaseUrlPattern_default as isRecognizedBaseUrlPattern, logger_default as logger, normalizeTranslations_default as normalizeTranslations, processOpenIDScopes_default as processOpenIDScopes, processUsername_default as processUsername, removeTrailingSlash_default as removeTrailingSlash, resolveFieldName_default as resolveFieldName, resolveFlowTemplateLiterals, resolveLocaleDisplayName, resolveLocaleEmoji_default as resolveLocaleEmoji, resolveMeta, set_default as set, startCase_default as startCase, updateMeProfile_default as updateMeProfile, warn, withVendorCSSClassPrefix_default as withVendorCSSClassPrefix };
+export { ApplicationNativeAuthenticationConstants_default as ApplicationNativeAuthenticationConstants, AuthenticationHelper_default as AuthenticationHelper, DEFAULT_THEME, DEFAULT_VALIDATION_MESSAGE_KEYS, EMOJI_URI_SCHEME, EmbeddedFlowActionVariant, EmbeddedFlowComponentType, EmbeddedFlowEventType, EmbeddedFlowResponseType, EmbeddedFlowTextVariant, EmbeddedFlowType, EmbeddedRecoveryFlowStatus, EmbeddedRecoveryFlowType, EmbeddedSignInFlowStatus, EmbeddedSignInFlowType, EmbeddedSignUpFlowStatus, EmbeddedSignUpFlowType, FieldType, FlowMetaType, FlowMode, HttpClient, IsomorphicCrypto, OIDCRequestConstants_default as OIDCRequestConstants, StorageManager_default as StorageManager, ThunderIDAPIError, ThunderIDAuthException, ThunderIDError, ThunderIDJavaScriptClient_default as ThunderIDJavaScriptClient, ThunderIDRuntimeError, TokenConstants_default as TokenConstants, TranslationBundleConstants_default as TranslationBundleConstants, VendorConstants_default as VendorConstants, arrayBufferToBase64url_default as arrayBufferToBase64url, base64urlToArrayBuffer_default as base64urlToArrayBuffer, bem_default as bem, buildValidatorFromRules_default as buildValidatorFromRules, configure as configureLogger, countryCodeToFlagEmoji, createComponentLogger, createLogger, createPackageComponentLogger, createPackageLogger, createTheme_default as createTheme, debug, deepMerge_default as deepMerge, error, evaluateValidationRule_default as evaluateValidationRule, executeEmbeddedRecoveryFlow_default as executeEmbeddedRecoveryFlow, executeEmbeddedSignInFlow_default as executeEmbeddedSignInFlow, executeEmbeddedSignUpFlow_default as executeEmbeddedSignUpFlow, executeEmbeddedUserOnboardingFlow_default as executeEmbeddedUserOnboardingFlow, extractEmojiFromUri_default as extractEmojiFromUri, extractPkceStorageKeyFromState_default as extractPkceStorageKeyFromState, extractUserClaimsFromIdToken_default as extractUserClaimsFromIdToken, formatDate_default as formatDate, generateFlattenedUserProfile_default as generateFlattenedUserProfile, get_default as get, getDefaultI18nBundles_default as getDefaultI18nBundles, getFlowMeta_default as getFlowMeta, getLatestStateParam_default as getLatestStateParam, getOrganizationUnitChildren_default as getOrganizationUnitChildren, getRedirectBasedSignUpUrl_default as getRedirectBasedSignUpUrl, getUserInfo_default as getUserInfo, getUsersMe_default as getUsersMe, getVendorPrefix_default as getVendorPrefix, info, isEmojiUri_default as isEmojiUri, isEmpty_default as isEmpty, isRecognizedBaseUrlPattern_default as isRecognizedBaseUrlPattern, logger_default as logger, normalizeTranslations_default as normalizeTranslations, processOpenIDScopes_default as processOpenIDScopes, processUsername_default as processUsername, removeTrailingSlash_default as removeTrailingSlash, resolveFieldName_default as resolveFieldName, resolveFlowTemplateLiterals, resolveLocaleDisplayName, resolveLocaleEmoji_default as resolveLocaleEmoji, resolveMeta, resolveResourceEndpoint_default as resolveResourceEndpoint, set_default as set, startCase_default as startCase, updateMeProfile_default as updateMeProfile, warn, withVendorCSSClassPrefix_default as withVendorCSSClassPrefix };

package/dist/models/config.d.ts

@@ -197,19 +197,38 @@ export interface BaseConfig<T = unknown> extends WithPreferences, WithExtensions
         };
     };
     /**
-     * Optional overrides for the OIDC protocol endpoints.
-     * By default, the SDK derives all endpoint URLs from the well-known discovery document
-     * located at `{baseUrl}/oauth2/token/.well-known/openid-configuration`.
-     * Use this when your authorization server exposes endpoints at non-standard paths,
-     * or when a custom domain differs from `baseUrl`.
+     * Optional overrides for the endpoint URLs the SDK talks to.
      *
-     * Individual overrides take precedence over values resolved from the discovery document.
+     * Two independent groups live here:
+     *
+     * - **OIDC/OAuth endpoints** (`authorization`, `token`, `userInfo`, `jwks`, `introspection`,
+     *   `endSession`, `wellKnown`) — by default derived from the well-known discovery document at
+     *   `{baseUrl}/oauth2/token/.well-known/openid-configuration`. Individual overrides take
+     *   precedence over values resolved from the discovery document.
+     * - **Resource-server endpoints** (`flowExecute`, `flowMeta`, `usersMe`) —
+     *   by default derived by concatenating `baseUrl` with a fixed path (e.g. `{baseUrl}/flow/execute`).
+     *   These do not participate in OIDC discovery.
+     *
+     * Split these two groups when the OAuth authorization server (IdP) and the Thunder resource
+     * server are different hosts — for example, when two Thunder instances are connected as trusted
+     * issuers. Point `baseUrl` (and hence the OAuth/discovery endpoints) at the authorization server,
+     * and override the resource-server endpoints to target the resource server that actually owns the
+     * users and flows.
      *
      * @example
      * endpoints: {
      *   wellKnown: "https://custom-domain.example.com/.well-known/openid-configuration",
      *   authorization: "https://custom-domain.example.com/oauth2/authorize",
      * }
+     *
+     * @example
+     * // Trusted-issuer setup: OAuth on the authorization server, resource APIs on the resource server.
+     * baseUrl: "https://idp.example.com",
+     * endpoints: {
+     *   flowExecute: "https://rs.example.com/flow/execute",
+     *   flowMeta: "https://rs.example.com/flow/meta",
+     *   usersMe: "https://rs.example.com/users/me",
+     * }
      */
     endpoints?: {
         /**
@@ -222,6 +241,17 @@ export interface BaseConfig<T = unknown> extends WithPreferences, WithExtensions
          * If not provided, resolved from the well-known discovery document.
          */
         endSession?: string;
+        /**
+         * The flow execution endpoint URL used by the embedded sign-in, sign-up, recovery, and user
+         * onboarding flows.
+         * If not provided, defaults to `{baseUrl}/flow/execute`.
+         */
+        flowExecute?: string;
+        /**
+         * The flow metadata endpoint URL used to resolve flow/branding metadata.
+         * If not provided, defaults to `{baseUrl}/flow/meta`.
+         */
+        flowMeta?: string;
         /**
          * The introspection endpoint URL.
          * If not provided, resolved from the well-known discovery document.
@@ -242,6 +272,11 @@ export interface BaseConfig<T = unknown> extends WithPreferences, WithExtensions
          * If not provided, resolved from the well-known discovery document.
          */
         userInfo?: string;
+        /**
+         * The current-user profile endpoint URL used to fetch and update the signed-in user's profile.
+         * If not provided, defaults to `{baseUrl}/users/me`.
+         */
+        usersMe?: string;
         /**
          * The OpenID Connect discovery document URL.
          * Defaults to `{baseUrl}/oauth2/token/.well-known/openid-configuration`.
@@ -263,6 +298,18 @@ export interface BaseConfig<T = unknown> extends WithPreferences, WithExtensions
      * @default 'redirect'
      */
     mode?: 'redirect' | 'embedded';
+    /**
+     * The OAuth 2.0 grant type this client uses to obtain access tokens.
+     *
+     * - `'authorization_code'` (default) — standard user sign-in flow. `getAccessToken()`
+     *   only ever reads from the stored session; it never fetches a token on its own.
+     * - `'client_credentials'` — machine-to-machine flow (RFC 6749 §4.4). There's no user
+     *   and no sign-in step: `getAccessToken()` fetches (and transparently caches/refreshes)
+     *   a token for the service itself, using `clientId`/`clientSecret`.
+     *
+     * @default 'authorization_code'
+     */
+    grantType?: 'authorization_code' | 'client_credentials';
     /**
      * Configuration for chaining authentication across multiple organization contexts.
      * Used when you need to authenticate a user in one organization using credentials

package/dist/models/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/models/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAC,oBAAoB,EAAC,MAAM,yBAAyB,CAAC;AAC7D,OAAO,KAAK,EAAC,iBAAiB,EAAC,MAAM,kBAAkB,CAAC;AACxD,OAAO,KAAK,EAAC,aAAa,EAAC,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAC,uBAAuB,EAAC,MAAM,uBAAuB,CAAC;AAC9D,OAAO,EAAC,gBAAgB,EAAC,MAAM,iBAAiB,CAAC;AACjD,OAAO,EAAC,UAAU,EAAC,MAAM,qBAAqB,CAAC;AAC/C,OAAO,EAAC,WAAW,EAAE,SAAS,EAAC,MAAM,gBAAgB,CAAC;AAEtD;;;;;;;;GAQG;AACH,MAAM,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;AAEhD;;;;;;;;GAQG;AACH,MAAM,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAErD;;;;;;;;GAQG;AACH,MAAM,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAEpD,MAAM,WAAW,UAAU,CAAC,CAAC,GAAG,OAAO,CAAE,SAAQ,eAAe,EAAE,cAAc;IAC9E;;;;;;OAMG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;IAErB;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAEhB;;;;;OAKG;IACH,YAAY,CAAC,EAAE,iBAAiB,CAAC;IAEjC;;;;;OAKG;IACH,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAEhC;;;;;;;;;OASG;IACH,0BAA0B,CAAC,EAAE,OAAO,CAAC;IAErC;;;;;;;;;;OAUG;IACH,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAE5B;;;;;;;;OAQG;IACH,cAAc,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAEpC;;;;;;;;;OASG;IACH,eAAe,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAErC;;;;;;;;;;;;;;;OAeG;IACH,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC;IAE/B;;;;;OAKG;IACH,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAEnC;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAEhB;;;OAGG;IACH,OAAO,EAAE,MAAM,GAAG,SAAS,CAAC;IAE5B;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAE9B;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAElC;;;;;;;;;;;;OAYG;IACH,SAAS,CAAC,EAAE;QACV;;;WAGG;QACH,SAAS,CAAC,EAAE;YACV;;;eAGG;YACH,OAAO,CAAC,EAAE,OAAO,CAAC;SACnB,CAAC;KACH,CAAC;IAEF;;;;;;;;;;;;;;OAcG;IACH,SAAS,CAAC,EAAE;QACV;;;WAGG;QACH,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB;;;WAGG;QACH,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB;;;WAGG;QACH,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB;;;WAGG;QACH,IAAI,CAAC,EAAE,MAAM,CAAC;QACd;;;WAGG;QACH,KAAK,CAAC,EAAE,MAAM,CAAC;QACf;;;WAGG;QACH,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB;;;WAGG;QACH,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,CAAC;IAEF;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB;;;;;;;;OAQG;IACH,IAAI,CAAC,EAAE,UAAU,GAAG,UAAU,CAAC;IAE/B;;;;OAIG;IACH,iBAAiB,CAAC,EAAE;QAClB;;;WAGG;QACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;QAC1B;;;WAGG;QACH,oBAAoB,CAAC,EAAE,MAAM,CAAC;KAC/B,CAAC;IAEF;;;;;OAKG;IACH,kBAAkB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAExC;;;;;;;;;;;OAWG;IACH,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC;IAEvC;;;OAGG;IACH,aAAa,CAAC,EAAE,aAAa,CAAC;IAE9B;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAE/B;;;OAGG;IACH,cAAc,CAAC,EAAE,cAAc,CAAC;IAEhC;;;OAGG;IACH,aAAa,CAAC,EAAE,aAAa,CAAC;IAE9B;;;;;OAKG;IACH,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAE/B;;;OAGG;IACH,OAAO,CAAC,EAAE,CAAC,CAAC;IAEZ;;;;;;;;;OASG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;IAEtB;;OAEG;IACH,cAAc,CAAC,EAAE;QACf;;WAEG;QACH,YAAY,CAAC,EAAE;YACb;;eAEG;YACH,WAAW,CAAC,EAAE,OAAO,CAAC;SACvB,CAAC;KACH,CAAC;IAEF;;OAEG;IACH,YAAY,CAAC,EAAE;QACb;;;;;;;;;;WAUG;QACH,UAAU,CAAC,EAAE,uBAAuB,CAAC;QACrC;;;;;;WAMG;QACH,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KAClC,CAAC;IAEF;;;;;;OAMG;IACH,eAAe,CAAC,EAAE;QAChB;;WAEG;QACH,OAAO,CAAC,EAAE;YACR;;eAEG;YACH,cAAc,CAAC,EAAE,MAAM,CAAC;YACxB;;eAEG;YACH,QAAQ,CAAC,EAAE,OAAO,CAAC;YACnB;;eAEG;YACH,cAAc,CAAC,EAAE,OAAO,CAAC;SAC1B,CAAC;KACH,CAAC;CACH;AAED,MAAM,WAAW,eAAe;IAC9B;;OAEG;IACH,WAAW,CAAC,EAAE,WAAW,CAAC;CAC3B;AAED,MAAM,WAAW,UAAU;IACzB;;OAEG;IACH,UAAU,CAAC,EAAE,oBAAoB,CAAC;CACnC;AAED,MAAM,WAAW,cAAc;IAC7B;;OAEG;IACH,UAAU,CAAC,EAAE,UAAU,CAAC;CACzB;AAED,MAAM,MAAM,MAAM,CAAC,CAAC,GAAG,OAAO,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC;AAEhD,MAAM,WAAW,gBAAgB;IAC/B;;;OAGG;IACH,SAAS,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC;IAC1B;;OAEG;IACH,IAAI,CAAC,EAAE,SAAS,CAAC;IACjB;;OAEG;IACH,SAAS,CAAC,EAAE,gBAAgB,CAAC,WAAW,CAAC,CAAC;CAC3C;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,mBAAmB,GAAG,QAAQ,GAAG,cAAc,GAAG,MAAM,CAAC;AAErE,MAAM,WAAW,eAAe;IAC9B;;OAEG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IACrC;;;;;;OAMG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;OAGG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;OAGG;IACH,eAAe,CAAC,EAAE,mBAAmB,CAAC;IACtC;;;;;;;;OAQG;IACH,QAAQ,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC;CAC3B;AAED,MAAM,WAAW,eAAe;IAC9B;;;;;;;;OAQG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC5B;AAED,MAAM,WAAW,WAAW;IAC1B;;OAEG;IACH,IAAI,CAAC,EAAE,eAAe,CAAC;IACvB;;;OAGG;IACH,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B;;OAEG;IACH,KAAK,CAAC,EAAE,gBAAgB,CAAC;IACzB;;;OAGG;IACH,IAAI,CAAC,EAAE,eAAe,CAAC;CACxB;AAED;;;;;GAKG;AACH,MAAM,MAAM,gBAAgB,CAAC,CAAC,GAAG,OAAO,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC;AAEtD;;;GAGG;AACH,MAAM,MAAM,sBAAsB,GAAG,MAAM,CAAC;AAE5C;;;GAGG;AACH,MAAM,MAAM,uBAAuB,GAAG,MAAM,CAAC;AAE7C;;;GAGG;AACH,MAAM,MAAM,yBAAyB,GAAG,MAAM,GAAG;IAAC,SAAS,CAAC,EAAE;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAC,CAAA;CAAC,CAAC;AAEpF;;GAEG;AACH,MAAM,MAAM,uBAAuB,GAAG,MAAM,GAAG;IAAC,OAAO,EAAE,MAAM,CAAA;CAAC,CAAC;AAEjE;;GAEG;AACH,MAAM,MAAM,wBAAwB,GAAG,MAAM,GAAG;IAAC,SAAS,EAAE,OAAO,CAAC,aAAa,CAAC,CAAA;CAAC,CAAC"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/models/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAC,oBAAoB,EAAC,MAAM,yBAAyB,CAAC;AAC7D,OAAO,KAAK,EAAC,iBAAiB,EAAC,MAAM,kBAAkB,CAAC;AACxD,OAAO,KAAK,EAAC,aAAa,EAAC,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAC,uBAAuB,EAAC,MAAM,uBAAuB,CAAC;AAC9D,OAAO,EAAC,gBAAgB,EAAC,MAAM,iBAAiB,CAAC;AACjD,OAAO,EAAC,UAAU,EAAC,MAAM,qBAAqB,CAAC;AAC/C,OAAO,EAAC,WAAW,EAAE,SAAS,EAAC,MAAM,gBAAgB,CAAC;AAEtD;;;;;;;;GAQG;AACH,MAAM,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;AAEhD;;;;;;;;GAQG;AACH,MAAM,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAErD;;;;;;;;GAQG;AACH,MAAM,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAEpD,MAAM,WAAW,UAAU,CAAC,CAAC,GAAG,OAAO,CAAE,SAAQ,eAAe,EAAE,cAAc;IAC9E;;;;;;OAMG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;IAErB;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAEhB;;;;;OAKG;IACH,YAAY,CAAC,EAAE,iBAAiB,CAAC;IAEjC;;;;;OAKG;IACH,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAEhC;;;;;;;;;OASG;IACH,0BAA0B,CAAC,EAAE,OAAO,CAAC;IAErC;;;;;;;;;;OAUG;IACH,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAE5B;;;;;;;;OAQG;IACH,cAAc,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAEpC;;;;;;;;;OASG;IACH,eAAe,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAErC;;;;;;;;;;;;;;;OAeG;IACH,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC;IAE/B;;;;;OAKG;IACH,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAEnC;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAEhB;;;OAGG;IACH,OAAO,EAAE,MAAM,GAAG,SAAS,CAAC;IAE5B;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAE9B;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAElC;;;;;;;;;;;;OAYG;IACH,SAAS,CAAC,EAAE;QACV;;;WAGG;QACH,SAAS,CAAC,EAAE;YACV;;;eAGG;YACH,OAAO,CAAC,EAAE,OAAO,CAAC;SACnB,CAAC;KACH,CAAC;IAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAiCG;IACH,SAAS,CAAC,EAAE;QACV;;;WAGG;QACH,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB;;;WAGG;QACH,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB;;;;WAIG;QACH,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB;;;WAGG;QACH,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB;;;WAGG;QACH,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB;;;WAGG;QACH,IAAI,CAAC,EAAE,MAAM,CAAC;QACd;;;WAGG;QACH,KAAK,CAAC,EAAE,MAAM,CAAC;QACf;;;WAGG;QACH,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB;;;WAGG;QACH,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB;;;WAGG;QACH,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,CAAC;IAEF;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB;;;;;;;;OAQG;IACH,IAAI,CAAC,EAAE,UAAU,GAAG,UAAU,CAAC;IAE/B;;;;;;;;;;OAUG;IACH,SAAS,CAAC,EAAE,oBAAoB,GAAG,oBAAoB,CAAC;IAExD;;;;OAIG;IACH,iBAAiB,CAAC,EAAE;QAClB;;;WAGG;QACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;QAC1B;;;WAGG;QACH,oBAAoB,CAAC,EAAE,MAAM,CAAC;KAC/B,CAAC;IAEF;;;;;OAKG;IACH,kBAAkB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAExC;;;;;;;;;;;OAWG;IACH,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC;IAEvC;;;OAGG;IACH,aAAa,CAAC,EAAE,aAAa,CAAC;IAE9B;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAE/B;;;OAGG;IACH,cAAc,CAAC,EAAE,cAAc,CAAC;IAEhC;;;OAGG;IACH,aAAa,CAAC,EAAE,aAAa,CAAC;IAE9B;;;;;OAKG;IACH,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAE/B;;;OAGG;IACH,OAAO,CAAC,EAAE,CAAC,CAAC;IAEZ;;;;;;;;;OASG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;IAEtB;;OAEG;IACH,cAAc,CAAC,EAAE;QACf;;WAEG;QACH,YAAY,CAAC,EAAE;YACb;;eAEG;YACH,WAAW,CAAC,EAAE,OAAO,CAAC;SACvB,CAAC;KACH,CAAC;IAEF;;OAEG;IACH,YAAY,CAAC,EAAE;QACb;;;;;;;;;;WAUG;QACH,UAAU,CAAC,EAAE,uBAAuB,CAAC;QACrC;;;;;;WAMG;QACH,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KAClC,CAAC;IAEF;;;;;;OAMG;IACH,eAAe,CAAC,EAAE;QAChB;;WAEG;QACH,OAAO,CAAC,EAAE;YACR;;eAEG;YACH,cAAc,CAAC,EAAE,MAAM,CAAC;YACxB;;eAEG;YACH,QAAQ,CAAC,EAAE,OAAO,CAAC;YACnB;;eAEG;YACH,cAAc,CAAC,EAAE,OAAO,CAAC;SAC1B,CAAC;KACH,CAAC;CACH;AAED,MAAM,WAAW,eAAe;IAC9B;;OAEG;IACH,WAAW,CAAC,EAAE,WAAW,CAAC;CAC3B;AAED,MAAM,WAAW,UAAU;IACzB;;OAEG;IACH,UAAU,CAAC,EAAE,oBAAoB,CAAC;CACnC;AAED,MAAM,WAAW,cAAc;IAC7B;;OAEG;IACH,UAAU,CAAC,EAAE,UAAU,CAAC;CACzB;AAED,MAAM,MAAM,MAAM,CAAC,CAAC,GAAG,OAAO,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC;AAEhD,MAAM,WAAW,gBAAgB;IAC/B;;;OAGG;IACH,SAAS,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC;IAC1B;;OAEG;IACH,IAAI,CAAC,EAAE,SAAS,CAAC;IACjB;;OAEG;IACH,SAAS,CAAC,EAAE,gBAAgB,CAAC,WAAW,CAAC,CAAC;CAC3C;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,mBAAmB,GAAG,QAAQ,GAAG,cAAc,GAAG,MAAM,CAAC;AAErE,MAAM,WAAW,eAAe;IAC9B;;OAEG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IACrC;;;;;;OAMG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;OAGG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;OAGG;IACH,eAAe,CAAC,EAAE,mBAAmB,CAAC;IACtC;;;;;;;;OAQG;IACH,QAAQ,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC;CAC3B;AAED,MAAM,WAAW,eAAe;IAC9B;;;;;;;;OAQG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC5B;AAED,MAAM,WAAW,WAAW;IAC1B;;OAEG;IACH,IAAI,CAAC,EAAE,eAAe,CAAC;IACvB;;;OAGG;IACH,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B;;OAEG;IACH,KAAK,CAAC,EAAE,gBAAgB,CAAC;IACzB;;;OAGG;IACH,IAAI,CAAC,EAAE,eAAe,CAAC;CACxB;AAED;;;;;GAKG;AACH,MAAM,MAAM,gBAAgB,CAAC,CAAC,GAAG,OAAO,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC;AAEtD;;;GAGG;AACH,MAAM,MAAM,sBAAsB,GAAG,MAAM,CAAC;AAE5C;;;GAGG;AACH,MAAM,MAAM,uBAAuB,GAAG,MAAM,CAAC;AAE7C;;;GAGG;AACH,MAAM,MAAM,yBAAyB,GAAG,MAAM,GAAG;IAAC,SAAS,CAAC,EAAE;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAC,CAAA;CAAC,CAAC;AAEpF;;GAEG;AACH,MAAM,MAAM,uBAAuB,GAAG,MAAM,GAAG;IAAC,OAAO,EAAE,MAAM,CAAA;CAAC,CAAC;AAEjE;;GAEG;AACH,MAAM,MAAM,wBAAwB,GAAG,MAAM,GAAG;IAAC,SAAS,EAAE,OAAO,CAAC,aAAa,CAAC,CAAA;CAAC,CAAC"}

package/dist/utils/AuthenticationHelper.d.ts

@@ -38,6 +38,17 @@ declare class AuthenticationHelper<T> {
      * @param cryptoHelperInstance - The isomorphic crypto helper for JWT operations.
      */
     constructor(storageManagerInstance: StorageManager<T>, cryptoHelperInstance: IsomorphicCrypto);
+    /**
+     * Maps the config-defined OIDC endpoint overrides to their discovery-metadata form.
+     *
+     * Endpoint names are converted from camelCase to snake_case, and resource-server endpoints
+     * (`RESOURCE_ENDPOINT_KEYS`) are excluded — those are resolved separately via
+     * `resolveResourceEndpoint` and must not leak into the OIDC provider metadata.
+     *
+     * @param configData - The resolved auth client config.
+     * @returns A snake_cased map of the OIDC endpoint overrides (empty when none are configured).
+     */
+    private mapConfiguredOidcEndpoints;
     /**
      * Merges explicit endpoint overrides from config into the discovery response.
      * Config-defined endpoint names (camelCase) are converted to snake_case before merging.

package/dist/utils/AuthenticationHelper.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"AuthenticationHelper.d.ts","sourceRoot":"","sources":["../../src/utils/AuthenticationHelper.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAOH,OAAO,EAAC,gBAAgB,EAAC,MAAM,qBAAqB,CAAC;AAGrD,OAAO,EAAC,iCAAiC,EAAE,wBAAwB,EAAC,MAAM,0BAA0B,CAAC;AAErG,OAAO,EAAU,aAAa,EAAyB,MAAM,iBAAiB,CAAC;AAC/E,OAAO,EAAC,IAAI,EAAC,MAAM,gBAAgB,CAAC;AACpC,OAAO,cAAc,MAAM,mBAAmB,CAAC;AAE/C;;;;;GAKG;AACH,cAAM,oBAAoB,CAAC,CAAC;IAC1B,OAAO,CAAC,cAAc,CAAoB;IAE1C,OAAO,CAAC,MAAM,CAAqC;IAEnD,OAAO,CAAC,oBAAoB,CAA0C;IAEtE,OAAO,CAAC,YAAY,CAAmB;IAEvC;;;;;OAKG;gBACgB,sBAAsB,EAAE,cAAc,CAAC,CAAC,CAAC,EAAE,oBAAoB,EAAE,gBAAgB;IAQpG;;;;;;OAMG;IACU,gBAAgB,CAAC,QAAQ,EAAE,wBAAwB,GAAG,OAAO,CAAC,wBAAwB,CAAC;IAepG;;;;;;OAMG;IACU,0BAA0B,IAAI,OAAO,CAAC,iCAAiC,CAAC;IAkDrF;;;;;;;OAOG;IACU,yBAAyB,IAAI,OAAO,CAAC,iCAAiC,CAAC;IA0CpF;;;;;;OAMG;IACU,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAsD/D;;;;;OAKG;IACI,wBAAwB,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI;IAetD;;;;;;;OAOG;IACU,8BAA8B,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IA6C3F;;;;OAIG;IACU,YAAY,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAKzD;;;;;;;;OAQG;IACU,mBAAmB,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC;CA2C9F;AAED,eAAe,oBAAoB,CAAC"}
+{"version":3,"file":"AuthenticationHelper.d.ts","sourceRoot":"","sources":["../../src/utils/AuthenticationHelper.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAQH,OAAO,EAAC,gBAAgB,EAAC,MAAM,qBAAqB,CAAC;AAGrD,OAAO,EAAC,iCAAiC,EAAE,wBAAwB,EAAC,MAAM,0BAA0B,CAAC;AAErG,OAAO,EAAU,aAAa,EAAyB,MAAM,iBAAiB,CAAC;AAC/E,OAAO,EAAC,IAAI,EAAC,MAAM,gBAAgB,CAAC;AACpC,OAAO,cAAc,MAAM,mBAAmB,CAAC;AAE/C;;;;;GAKG;AACH,cAAM,oBAAoB,CAAC,CAAC;IAC1B,OAAO,CAAC,cAAc,CAAoB;IAE1C,OAAO,CAAC,MAAM,CAAqC;IAEnD,OAAO,CAAC,oBAAoB,CAA0C;IAEtE,OAAO,CAAC,YAAY,CAAmB;IAEvC;;;;;OAKG;gBACgB,sBAAsB,EAAE,cAAc,CAAC,CAAC,CAAC,EAAE,oBAAoB,EAAE,gBAAgB;IAQpG;;;;;;;;;OASG;IACH,OAAO,CAAC,0BAA0B;IAkBlC;;;;;;OAMG;IACU,gBAAgB,CAAC,QAAQ,EAAE,wBAAwB,GAAG,OAAO,CAAC,wBAAwB,CAAC;IAMpG;;;;;;OAMG;IACU,0BAA0B,IAAI,OAAO,CAAC,iCAAiC,CAAC;IAyCrF;;;;;;;OAOG;IACU,yBAAyB,IAAI,OAAO,CAAC,iCAAiC,CAAC;IAmCpF;;;;;;OAMG;IACU,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAsD/D;;;;;OAKG;IACI,wBAAwB,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI;IAetD;;;;;;;OAOG;IACU,8BAA8B,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IA6C3F;;;;OAIG;IACU,YAAY,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAKzD;;;;;;;;OAQG;IACU,mBAAmB,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC;CA2C9F;AAED,eAAe,oBAAoB,CAAC"}

package/dist/utils/resolveResourceEndpoint.d.ts

@@ -0,0 +1,65 @@
+/**
+ * Copyright (c) 2025-2026, WSO2 LLC. (https://www.wso2.com).
+ *
+ * WSO2 LLC. licenses this file to you under the Apache License,
+ * Version 2.0 (the "License"); you may not use this file except
+ * in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+import { BaseConfig } from '../models/config';
+/**
+ * Resource-server endpoints whose URLs can be overridden via `config.endpoints`.
+ *
+ * Unlike the OIDC/OAuth endpoints, these are not resolved from the well-known discovery document;
+ * they are derived by concatenating `baseUrl` with a fixed path. When the authorization server and
+ * the Thunder resource server are different hosts (e.g. two Thunder instances connected as trusted
+ * issuers), these overrides let the SDK send flow and user-management requests to the resource
+ * server while OAuth requests continue to target the authorization server.
+ */
+export type ResourceEndpointKey = 'flowExecute' | 'flowMeta' | 'usersMe';
+/**
+ * The `config.endpoints` keys that address resource-server endpoints rather than OIDC/OAuth
+ * endpoints. Used to keep these overrides out of the resolved OIDC provider metadata.
+ */
+export declare const RESOURCE_ENDPOINT_KEYS: readonly ResourceEndpointKey[];
+/**
+ * Minimal shape of the config needed to resolve a resource-server endpoint override.
+ * Reuses the `endpoints` type from {@link BaseConfig} so the override shape stays in sync.
+ */
+export interface ResourceEndpointConfig {
+    endpoints?: BaseConfig['endpoints'];
+}
+/**
+ * Resolves the absolute `url` to use for a resource-server endpoint, honoring (in order of
+ * precedence) an explicit per-call URL, then a `config.endpoints` override.
+ *
+ * Returns `undefined` when neither is set, so the calling API function falls back to deriving the
+ * endpoint from `baseUrl` (i.e. `${baseUrl}/flow/execute`) exactly as before. Callers should keep
+ * passing `baseUrl` alongside the resolved `url` to preserve that fallback.
+ *
+ * @param key - The resource endpoint to resolve.
+ * @param config - The client config carrying optional `endpoints` overrides.
+ * @param explicitUrl - An explicit URL provided by the immediate caller; takes highest precedence.
+ * @returns The resolved override URL, or `undefined` to defer to `baseUrl`-based resolution.
+ *
+ * @example
+ * ```typescript
+ * const response = await executeEmbeddedUserOnboardingFlow({
+ *   baseUrl: config.baseUrl,
+ *   url: resolveResourceEndpoint('flowExecute', config),
+ *   payload,
+ * });
+ * ```
+ */
+declare const resolveResourceEndpoint: (key: ResourceEndpointKey, config: ResourceEndpointConfig | undefined, explicitUrl?: string) => string | undefined;
+export default resolveResourceEndpoint;
+//# sourceMappingURL=resolveResourceEndpoint.d.ts.map

package/dist/utils/resolveResourceEndpoint.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolveResourceEndpoint.d.ts","sourceRoot":"","sources":["../../src/utils/resolveResourceEndpoint.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAC,UAAU,EAAC,MAAM,kBAAkB,CAAC;AAE5C;;;;;;;;GAQG;AACH,MAAM,MAAM,mBAAmB,GAAG,aAAa,GAAG,UAAU,GAAG,SAAS,CAAC;AAEzE;;;GAGG;AACH,eAAO,MAAM,sBAAsB,EAAE,SAAS,mBAAmB,EAA2C,CAAC;AAE7G;;;GAGG;AACH,MAAM,WAAW,sBAAsB;IACrC,SAAS,CAAC,EAAE,UAAU,CAAC,WAAW,CAAC,CAAC;CACrC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,QAAA,MAAM,uBAAuB,GAC3B,KAAK,mBAAmB,EACxB,QAAQ,sBAAsB,GAAG,SAAS,EAC1C,cAAc,MAAM,KACnB,MAAM,GAAG,SAAiE,CAAC;AAE9E,eAAe,uBAAuB,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@thunderid/javascript",
-  "version": "0.11.1",
+  "version": "0.11.2",
   "description": "JavaScript Ecosystem SDK for ThunderID",
   "keywords": [
     "thunderid",