@thunderid/javascript 1.0.7 → 1.2.0

package/dist/cjs/index.cjs

@@ -81,6 +81,15 @@ var ThunderIDAuthException = class extends Error {
 		Object.setPrototypeOf(this, new.target.prototype);
 	}
 };
+/**
+* Raised when a back-channel logout token is not valid. A logout handler answers 400 for this and a
+* 5xx for any other failure, which tells the server whether a retry can help.
+*/
+var InvalidLogoutTokenError = class extends ThunderIDAuthException {
+	constructor(code, message) {
+		super(code, "Invalid logout token.", message);
+	}
+};
 
 //#endregion
 //#region src/IsomorphicCrypto.ts
@@ -144,6 +153,38 @@ var IsomorphicCrypto = class {
 			return Promise.reject(new ThunderIDAuthException("JS-CRYPTO_HELPER-IVIT-IV01", "Invalid ID token.", "ID token validation returned false"));
 		}).catch((error$1) => Promise.reject(error$1));
 	}
+	/**
+	* Verifies the signature of a back-channel logout token, along with its audience, issuer,
+	* lifetime and, when the token has one, subject.
+	*
+	* @param logoutToken - The logout token received from the server.
+	* @param jwk - The server key the token names.
+	* @param clientId - The client the token must be addressed to.
+	* @param issuer - The expected issuer.
+	* @param subject - The token's subject, when it has one.
+	* @param clockTolerance - Allowed clock difference in seconds.
+	*
+	* @throws {InvalidLogoutTokenError} When verification fails. The message never includes the token.
+	*/
+	async verifyLogoutTokenSignature(logoutToken, jwk, clientId, issuer, subject, clockTolerance) {
+		let verified = false;
+		try {
+			verified = await this.cryptoUtils.verifyJwt(logoutToken, jwk, TokenConstants_default.SignatureValidation.SUPPORTED_ALGORITHMS, clientId, issuer, subject, clockTolerance, true);
+		} catch {
+			verified = false;
+		}
+		if (!verified) throw new InvalidLogoutTokenError("JS-CRYPTO_HELPER-VLTS-IV01", "The logout token signature could not be verified.");
+	}
+	/**
+	* Decodes the JOSE header of a JWT without verifying its signature.
+	*/
+	decodeJwtHeader(token) {
+		try {
+			return JSON.parse(this.cryptoUtils.base64URLDecode(token?.split(".")[0]));
+		} catch {
+			throw new ThunderIDAuthException("JS-CRYPTO_UTIL-DJH-IV01", "Decoding token failed.", "The token header could not be decoded.");
+		}
+	}
 	decodeJwtToken(token) {
 		try {
 			const utf8String = this.cryptoUtils.base64URLDecode(token?.split(".")[1]);
@@ -1032,6 +1073,8 @@ let EmbeddedFlowComponentType = /* @__PURE__ */ function(EmbeddedFlowComponentTy
 	EmbeddedFlowComponentType$1["Icon"] = "ICON";
 	/** Image display component for logos and illustrations */
 	EmbeddedFlowComponentType$1["Image"] = "IMAGE";
+	/** Key-value list display component that shows label and value pairs published in additionalData */
+	EmbeddedFlowComponentType$1["KeyValueList"] = "KEY_VALUE_LIST";
 	/** One-time password input field for multi-factor authentication */
 	EmbeddedFlowComponentType$1["OtpInput"] = "OTP_INPUT";
 	/** Organization unit tree picker for selecting an OU */
@@ -1465,6 +1508,73 @@ const getUsersMeMeta = async ({ baseUrl, fetcher, url,...requestConfig }) => {
 };
 var getUsersMeMeta_default = getUsersMeMeta;
 
+//#endregion
+//#region src/api/updateMeCredentials.ts
+/**
+* Updates one or more of the signed-in user's credentials at the
+* /users/me/update-credentials endpoint.
+*
+* The endpoint responds with `204 No Content` on success, so this function resolves with
+* `void` rather than a parsed body.
+*
+* @param config - Configuration object with URL, payload and optional request config.
+* @returns A promise that resolves once the credentials have been updated.
+* @example
+* ```typescript
+* // Using default fetch
+* await updateMeCredentials({
+*   url: "https://localhost:8090/users/me/update-credentials",
+*   payload: {password: "n3wP@ssword!"}
+* });
+* ```
+*
+* @example
+* ```typescript
+* // Using custom fetcher (e.g. an httpClient that attaches the access token)
+* await updateMeCredentials({
+*   baseUrl: "https://localhost:8090",
+*   payload: {password: "n3wP@ssword!"},
+*   fetcher: async (url, config) => {
+*     const response = await httpClient({url, method: config.method, headers: config.headers, data: config.body});
+*     return {
+*       ok: response.status >= 200 && response.status < 300,
+*       status: response.status,
+*       statusText: response.statusText,
+*       json: () => Promise.resolve(response.data),
+*       text: () => Promise.resolve(typeof response.data === 'string' ? response.data : JSON.stringify(response.data))
+*     } as Response;
+*   }
+* });
+* ```
+*/
+const updateMeCredentials = async ({ url, baseUrl, payload, fetcher,...requestConfig }) => {
+	try {
+		new URL(url ?? baseUrl);
+	} catch (error$1) {
+		throw new ThunderIDAPIError(`Invalid URL provided. ${error$1 instanceof Error ? error$1.message : String(error$1)}`, "updateMeCredentials-ValidationError-001", "javascript", 400, "The provided `url` or `baseUrl` path does not adhere to the URL schema.");
+	}
+	const fetchFn = fetcher ?? fetch;
+	const resolvedUrl = url ?? `${baseUrl?.replace(/\/$/, "")}/users/me/update-credentials`;
+	const requestInit = {
+		...requestConfig,
+		method: "POST",
+		body: JSON.stringify({ attributes: payload }),
+		headers: {
+			...requestConfig.headers,
+			Accept: "application/json",
+			"Content-Type": "application/json"
+		}
+	};
+	try {
+		const response = await fetchFn(resolvedUrl, requestInit);
+		if (!response?.ok) throw new ThunderIDAPIError(await response.text(), "updateMeCredentials-ResponseError-001", "javascript", response.status, response.statusText, "Failed to update user credentials");
+	} catch (error$1) {
+		if (error$1 instanceof ThunderIDAPIError) throw error$1;
+		throw new ThunderIDAPIError(`Network or parsing error: ${error$1 instanceof Error ? error$1.message : "Unknown error"}`, "updateMeCredentials-NetworkError-001", "javascript", 0, "Network Error");
+	}
+};
+var updateMeCredentials_default = updateMeCredentials;
+
 //#endregion
 //#region src/api/updateMeProfile.ts
 /**
@@ -1542,6 +1652,456 @@ const updateMeProfile = async ({ url, baseUrl, payload, fetcher,...requestConfig
 };
 var updateMeProfile_default = updateMeProfile;
 
+//#endregion
+//#region src/utils/requestManagementResource.ts
+/**
+* Performs a request against a management API resource and maps failures onto
+* {@link ThunderIDAPIError}. HTTP 403 and 404 get their own codes so a caller can tell a missing
+* permission from a missing resource.
+*
+* @returns The parsed JSON body, or `undefined` when the server returns no content.
+*/
+const requestManagementResource = async ({ baseUrl, url, fetcher,...requestConfig }, { body, collection, failureMessage, id, method, operation, query }) => {
+	try {
+		new URL(url ?? baseUrl);
+	} catch (error$1) {
+		throw new ThunderIDAPIError(`Invalid URL provided. ${error$1 instanceof Error ? error$1.message : String(error$1)}`, `${operation}-ValidationError-001`, "javascript", 400, "The provided `url` or `baseUrl` path does not adhere to the URL schema.");
+	}
+	if (id?.trim() === "") throw new ThunderIDAPIError("A resource identifier is required.", `${operation}-ValidationError-002`, "javascript", 400, "The provided resource identifier is empty.");
+	const collectionUrl = (url ?? `${baseUrl}/${collection}`).replace(/\/+$/, "");
+	const resourceUrl = id === void 0 ? collectionUrl : `${collectionUrl}/${encodeURIComponent(id)}`;
+	const searchParams = new URLSearchParams();
+	Object.entries(query ?? {}).forEach(([key, value]) => {
+		if (value !== void 0) searchParams.set(key, String(value));
+	});
+	const queryString = searchParams.toString();
+	const resolvedUrl = queryString ? `${resourceUrl}?${queryString}` : resourceUrl;
+	const requestInit = {
+		...requestConfig,
+		headers: {
+			Accept: "application/json",
+			"Content-Type": "application/json",
+			...requestConfig.headers
+		},
+		method,
+		...body !== void 0 ? { body: JSON.stringify(body) } : {}
+	};
+	const fetchFn = fetcher ?? fetch;
+	try {
+		const response = await fetchFn(resolvedUrl, requestInit);
+		if (!response?.ok) {
+			const errorText = await response.text();
+			let reason = "ResponseError";
+			if (response.status === 403) reason = "ForbiddenError";
+			else if (response.status === 404) reason = "NotFoundError";
+			throw new ThunderIDAPIError(errorText, `${operation}-${reason}-001`, "javascript", response.status, response.statusText, failureMessage);
+		}
+		if (response.status === 204 || method === "DELETE") return;
+		return await response.json();
+	} catch (error$1) {
+		if (error$1 instanceof ThunderIDAPIError) throw error$1;
+		throw new ThunderIDAPIError(`Network or parsing error: ${error$1 instanceof Error ? error$1.message : "Unknown error"}`, `${operation}-NetworkError-001`, "javascript", 0, "Network Error");
+	}
+};
+var requestManagementResource_default = requestManagementResource;
+
+//#endregion
+//#region src/api/applications/getApplications.ts
+/**
+* Retrieves a page of applications.
+*
+* @param config - Request configuration object.
+* @returns A promise that resolves with the page of applications.
+*
+* @example
+* ```typescript
+* const {applications, totalResults} = await getApplications({
+*   baseUrl: 'https://localhost:8090',
+*   limit: 10,
+*   offset: 0,
+* });
+* ```
+*/
+const getApplications = async ({ limit, offset,...config }) => requestManagementResource_default(config, {
+	collection: "applications",
+	failureMessage: "Failed to fetch applications",
+	method: "GET",
+	operation: "getApplications",
+	query: {
+		limit,
+		offset
+	}
+});
+var getApplications_default = getApplications;
+
+//#endregion
+//#region src/api/applications/getApplication.ts
+/**
+* Retrieves a single application.
+*
+* @param config - Request configuration object.
+* @returns A promise that resolves with the application.
+*
+* @example
+* ```typescript
+* const application = await getApplication({
+*   baseUrl: 'https://localhost:8090',
+*   applicationId: '550e8400-e29b-41d4-a716-446655440000',
+* });
+* ```
+*/
+const getApplication = async ({ applicationId,...config }) => requestManagementResource_default(config, {
+	collection: "applications",
+	failureMessage: "Failed to fetch application",
+	id: applicationId,
+	method: "GET",
+	operation: "getApplication"
+});
+var getApplication_default = getApplication;
+
+//#endregion
+//#region src/api/applications/createApplication.ts
+/**
+* Creates an application.
+*
+* @param config - Request configuration object.
+* @returns A promise that resolves with the application as the server stored it.
+*
+* @example
+* ```typescript
+* const application = await createApplication({
+*   baseUrl: 'https://localhost:8090',
+*   payload: {name: 'My SPA', url: 'http://localhost:3000'},
+* });
+* ```
+*/
+const createApplication = async ({ payload,...config }) => requestManagementResource_default(config, {
+	body: payload,
+	collection: "applications",
+	failureMessage: "Failed to create application",
+	method: "POST",
+	operation: "createApplication"
+});
+var createApplication_default = createApplication;
+
+//#endregion
+//#region src/api/applications/updateApplication.ts
+/**
+* Updates an application.
+*
+* @param config - Request configuration object.
+* @returns A promise that resolves with the updated application.
+*
+* @example
+* ```typescript
+* const application = await updateApplication({
+*   baseUrl: 'https://localhost:8090',
+*   applicationId: '550e8400-e29b-41d4-a716-446655440000',
+*   payload: {...existing, name: 'Renamed'},
+* });
+* ```
+*/
+const updateApplication = async ({ applicationId, payload,...config }) => requestManagementResource_default(config, {
+	body: payload,
+	collection: "applications",
+	failureMessage: "Failed to update application",
+	id: applicationId,
+	method: "PUT",
+	operation: "updateApplication"
+});
+var updateApplication_default = updateApplication;
+
+//#endregion
+//#region src/api/applications/deleteApplication.ts
+/**
+* Deletes an application.
+*
+* @param config - Request configuration object.
+* @returns A promise that resolves once the application is deleted.
+*
+* @example
+* ```typescript
+* await deleteApplication({
+*   baseUrl: 'https://localhost:8090',
+*   applicationId: '550e8400-e29b-41d4-a716-446655440000',
+* });
+* ```
+*/
+const deleteApplication = async ({ applicationId,...config }) => requestManagementResource_default(config, {
+	collection: "applications",
+	failureMessage: "Failed to delete application",
+	id: applicationId,
+	method: "DELETE",
+	operation: "deleteApplication"
+});
+var deleteApplication_default = deleteApplication;
+
+//#endregion
+//#region src/api/users/getUsers.ts
+/**
+* Retrieves a page of users. Each user carries its resolved `display` value.
+*
+* @param config - Request configuration object.
+* @returns A promise that resolves with the page of users.
+*
+* @example
+* ```typescript
+* const {users, totalResults} = await getUsers({
+*   baseUrl: 'https://localhost:8090',
+*   limit: 10,
+*   filter: 'username eq "alice"',
+* });
+* ```
+*/
+const getUsers = async ({ filter, limit, offset,...config }) => requestManagementResource_default(config, {
+	collection: "users",
+	failureMessage: "Failed to fetch users",
+	method: "GET",
+	operation: "getUsers",
+	query: {
+		filter,
+		include: "display",
+		limit,
+		offset
+	}
+});
+var getUsers_default = getUsers;
+
+//#endregion
+//#region src/api/users/getUser.ts
+/**
+* Retrieves a single user, with its resolved `display` value.
+*
+* @param config - Request configuration object.
+* @returns A promise that resolves with the user.
+*
+* @example
+* ```typescript
+* const user = await getUser({
+*   baseUrl: 'https://localhost:8090',
+*   userId: '9a475e1e-b0cb-4b29-8df5-2e5b24fb0ed3',
+* });
+* ```
+*/
+const getUser = async ({ userId,...config }) => requestManagementResource_default(config, {
+	collection: "users",
+	failureMessage: "Failed to fetch user",
+	id: userId,
+	method: "GET",
+	operation: "getUser",
+	query: { include: "display" }
+});
+var getUser_default = getUser;
+
+//#endregion
+//#region src/api/users/createUser.ts
+/**
+* Creates a user.
+*
+* @param config - Request configuration object.
+* @returns A promise that resolves with the user as the server stored it.
+*
+* @example
+* ```typescript
+* const user = await createUser({
+*   baseUrl: 'https://localhost:8090',
+*   payload: {ouId, type: 'customer', attributes: {username: 'alice'}},
+* });
+* ```
+*/
+const createUser = async ({ payload,...config }) => requestManagementResource_default(config, {
+	body: payload,
+	collection: "users",
+	failureMessage: "Failed to create user",
+	method: "POST",
+	operation: "createUser"
+});
+var createUser_default = createUser;
+
+//#endregion
+//#region src/api/users/updateUser.ts
+/**
+* Updates a user.
+*
+* @param config - Request configuration object.
+* @returns A promise that resolves with the updated user.
+*
+* @example
+* ```typescript
+* const user = await updateUser({
+*   baseUrl: 'https://localhost:8090',
+*   userId: '9a475e1e-b0cb-4b29-8df5-2e5b24fb0ed3',
+*   payload: {attributes: {givenName: 'Alice'}},
+* });
+* ```
+*/
+const updateUser = async ({ userId, payload,...config }) => requestManagementResource_default(config, {
+	body: payload,
+	collection: "users",
+	failureMessage: "Failed to update user",
+	id: userId,
+	method: "PUT",
+	operation: "updateUser"
+});
+var updateUser_default = updateUser;
+
+//#endregion
+//#region src/api/users/deleteUser.ts
+/**
+* Deletes a user.
+*
+* @param config - Request configuration object.
+* @returns A promise that resolves once the user is deleted.
+*
+* @example
+* ```typescript
+* await deleteUser({
+*   baseUrl: 'https://localhost:8090',
+*   userId: '9a475e1e-b0cb-4b29-8df5-2e5b24fb0ed3',
+* });
+* ```
+*/
+const deleteUser = async ({ userId,...config }) => requestManagementResource_default(config, {
+	collection: "users",
+	failureMessage: "Failed to delete user",
+	id: userId,
+	method: "DELETE",
+	operation: "deleteUser"
+});
+var deleteUser_default = deleteUser;
+
+//#endregion
+//#region src/api/agents/getAgents.ts
+/**
+* Retrieves a page of agents.
+*
+* @param config - Request configuration object.
+* @returns A promise that resolves with the page of agents.
+*
+* @example
+* ```typescript
+* const {agents, totalResults} = await getAgents({
+*   baseUrl: 'https://localhost:8090',
+*   limit: 10,
+* });
+* ```
+*/
+const getAgents = async ({ limit, offset,...config }) => requestManagementResource_default(config, {
+	collection: "agents",
+	failureMessage: "Failed to fetch agents",
+	method: "GET",
+	operation: "getAgents",
+	query: {
+		include: "display",
+		limit,
+		offset
+	}
+});
+var getAgents_default = getAgents;
+
+//#endregion
+//#region src/api/agents/getAgent.ts
+/**
+* Retrieves a single agent.
+*
+* @param config - Request configuration object.
+* @returns A promise that resolves with the agent.
+*
+* @example
+* ```typescript
+* const agent = await getAgent({
+*   baseUrl: 'https://localhost:8090',
+*   agentId: '6f1e2d3c-4b5a-4978-8a6b-5c4d3e2f1a0b',
+* });
+* ```
+*/
+const getAgent = async ({ agentId,...config }) => requestManagementResource_default(config, {
+	collection: "agents",
+	failureMessage: "Failed to fetch agent",
+	id: agentId,
+	method: "GET",
+	operation: "getAgent",
+	query: { include: "display" }
+});
+var getAgent_default = getAgent;
+
+//#endregion
+//#region src/api/agents/createAgent.ts
+/**
+* Creates an agent.
+*
+* @param config - Request configuration object.
+* @returns A promise that resolves with the agent as the server stored it.
+*
+* @example
+* ```typescript
+* const agent = await createAgent({
+*   baseUrl: 'https://localhost:8090',
+*   payload: {ouId, type: 'default', name: 'Nightly Sync Worker'},
+* });
+* ```
+*/
+const createAgent = async ({ payload,...config }) => requestManagementResource_default(config, {
+	body: payload,
+	collection: "agents",
+	failureMessage: "Failed to create agent",
+	method: "POST",
+	operation: "createAgent"
+});
+var createAgent_default = createAgent;
+
+//#endregion
+//#region src/api/agents/updateAgent.ts
+/**
+* Updates an agent.
+*
+* @param config - Request configuration object.
+* @returns A promise that resolves with the updated agent.
+*
+* @example
+* ```typescript
+* const agent = await updateAgent({
+*   baseUrl: 'https://localhost:8090',
+*   agentId: '6f1e2d3c-4b5a-4978-8a6b-5c4d3e2f1a0b',
+*   payload: {name: 'Renamed Agent'},
+* });
+* ```
+*/
+const updateAgent = async ({ agentId, payload,...config }) => requestManagementResource_default(config, {
+	body: payload,
+	collection: "agents",
+	failureMessage: "Failed to update agent",
+	id: agentId,
+	method: "PUT",
+	operation: "updateAgent"
+});
+var updateAgent_default = updateAgent;
+
+//#endregion
+//#region src/api/agents/deleteAgent.ts
+/**
+* Deletes an agent.
+*
+* @param config - Request configuration object.
+* @returns A promise that resolves once the agent is deleted.
+*
+* @example
+* ```typescript
+* await deleteAgent({
+*   baseUrl: 'https://localhost:8090',
+*   agentId: '6f1e2d3c-4b5a-4978-8a6b-5c4d3e2f1a0b',
+* });
+* ```
+*/
+const deleteAgent = async ({ agentId,...config }) => requestManagementResource_default(config, {
+	collection: "agents",
+	failureMessage: "Failed to delete agent",
+	id: agentId,
+	method: "DELETE",
+	operation: "deleteAgent"
+});
+var deleteAgent_default = deleteAgent;
+
 //#endregion
 //#region src/constants/ApplicationNativeAuthenticationConstants.ts
 /**
@@ -1565,6 +2125,21 @@ const ApplicationNativeAuthenticationConstants = { SupportedAuthenticators: {
 } };
 var ApplicationNativeAuthenticationConstants_default = ApplicationNativeAuthenticationConstants;
 
+//#endregion
+//#region src/constants/BackchannelLogoutConstants.ts
+/**
+* Constants for OpenID Connect Back-Channel Logout 1.0, for an SDK that receives logout tokens.
+*/
+const BackchannelLogoutConstants = {
+	DEFAULT_CLOCK_TOLERANCE_SECONDS: 60,
+	EVENT: "http://schemas.openid.net/event/backchannel-logout",
+	JWKS_CACHE_TTL_MS: 6e5,
+	JWKS_MIN_REFETCH_INTERVAL_MS: 3e4,
+	TOKEN_PARAM: "logout_token",
+	TOKEN_TYPE: "logout+jwt"
+};
+var BackchannelLogoutConstants_default = BackchannelLogoutConstants;
+
 //#endregion
 //#region src/constants/ScopeConstants.ts
 /**
@@ -1625,6 +2200,28 @@ var OIDCRequestConstants_default = OIDCRequestConstants;
 const VendorConstants = { VENDOR_PREFIX: "thunderid" };
 var VendorConstants_default = VendorConstants;
 
+//#endregion
+//#region src/constants/CredentialConstants.ts
+/**
+* Constants for the credential types the server accepts on the self-service
+* credential write path.
+*
+* The server keys credentials by type. `password` is the one every user type schema
+* declares by default, hence a named constant for it; any other schema-declared
+* `credential: true` attribute (for example `pin`) can be self-managed too, just by its
+* own attribute name rather than a constant here.
+*
+* @example
+* ```typescript
+* await updateMeCredentials({
+*   payload: {[CredentialConstants.PASSWORD]: newPassword},
+*   url,
+* });
+* ```
+*/
+const CredentialConstants = { PASSWORD: "password" };
+var CredentialConstants_default = CredentialConstants;
+
 //#endregion
 //#region src/constants/ConsentConstants.ts
 /**
@@ -1649,6 +2246,42 @@ const ConsentConstants = {
 };
 var ConsentConstants_default = ConsentConstants;
 
+//#endregion
+//#region src/constants/ApplicationQueryKeys.ts
+/**
+* Cache keys for application resources. The SDK's reactive wrappers use them to refetch after a
+* mutation, and an application can reuse them as keys in its own data fetching cache.
+*/
+const ApplicationQueryKeys = {
+	APPLICATION: "application",
+	APPLICATIONS: "applications"
+};
+var ApplicationQueryKeys_default = ApplicationQueryKeys;
+
+//#endregion
+//#region src/constants/UserQueryKeys.ts
+/**
+* Cache keys for user resources. The SDK's reactive wrappers use them to refetch after a mutation,
+* and an application can reuse them as keys in its own data fetching cache.
+*/
+const UserQueryKeys = {
+	USER: "user",
+	USERS: "users"
+};
+var UserQueryKeys_default = UserQueryKeys;
+
+//#endregion
+//#region src/constants/AgentQueryKeys.ts
+/**
+* Cache keys for agent resources. The SDK's reactive wrappers use them to refetch after a mutation,
+* and an application can reuse them as keys in its own data fetching cache.
+*/
+const AgentQueryKeys = {
+	AGENT: "agent",
+	AGENTS: "agents"
+};
+var AgentQueryKeys_default = AgentQueryKeys;
+
 //#endregion
 //#region src/errors/ThunderIDRuntimeError.ts
 /**
@@ -1775,6 +2408,51 @@ let FlowMode = /* @__PURE__ */ function(FlowMode$1) {
 	return FlowMode$1;
 }({});
 
+//#endregion
+//#region src/models/application.ts
+/**
+* OAuth 2.0 grant type values.
+*/
+const OAuth2GrantTypes = {
+	AUTHORIZATION_CODE: "authorization_code",
+	CIBA: "urn:openid:params:grant-type:ciba",
+	CLIENT_CREDENTIALS: "client_credentials",
+	IMPLICIT: "implicit",
+	JWT_BEARER: "urn:ietf:params:oauth:grant-type:jwt-bearer",
+	PASSWORD: "password",
+	REFRESH_TOKEN: "refresh_token",
+	TOKEN_EXCHANGE: "urn:ietf:params:oauth:grant-type:token-exchange"
+};
+/**
+* Grant types that can issue a refresh token.
+*/
+const REFRESH_TOKEN_ISSUING_GRANTS = [OAuth2GrantTypes.AUTHORIZATION_CODE, OAuth2GrantTypes.CIBA];
+/**
+* OAuth 2.0 response type values.
+*/
+const OAuth2ResponseTypes = {
+	CODE: "code",
+	CODE_ID_TOKEN: "code id_token",
+	CODE_TOKEN: "code token",
+	ID_TOKEN: "id_token",
+	TOKEN: "token",
+	TOKEN_ID_TOKEN: "token id_token"
+};
+/**
+* Token endpoint authentication methods an application can be configured with.
+*/
+const TokenEndpointAuthMethods = {
+	CLIENT_SECRET_BASIC: "client_secret_basic",
+	CLIENT_SECRET_JWT: "client_secret_jwt",
+	CLIENT_SECRET_POST: "client_secret_post",
+	NONE: "none",
+	PRIVATE_KEY_JWT: "private_key_jwt"
+};
+/**
+* Inbound authentication protocol values.
+*/
+const InboundAuthTypes = { OAUTH2: "oauth2" };
+
 //#endregion
 //#region src/models/field.ts
 let FieldType = /* @__PURE__ */ function(FieldType$1) {
@@ -2100,6 +2778,9 @@ var StorageManager = class StorageManager {
 	async getCustomData(key, userId) {
 		return JSON.parse(await this.store.getData(this.resolveKey(key, userId)) ?? null);
 	}
+	async removeCustomData(key, userId) {
+		await this.store.removeData(this.resolveKey(key, userId));
+	}
 	setSessionStatus(status) {
 		if (StorageManager.isLocalStorageAvailable()) localStorage.setItem(`${this.vendor}-session-active`, status);
 	}
@@ -2300,9 +2981,13 @@ var processOpenIDScopes_default = processOpenIDScopes;
 * endpoints. Used to keep these overrides out of the resolved OIDC provider metadata.
 */
 const RESOURCE_ENDPOINT_KEYS = [
+	"agents",
+	"applications",
 	"flowExecute",
 	"flowMeta",
+	"users",
 	"usersMe",
+	"usersMeCredentials",
 	"usersMeMeta"
 ];
 /**
@@ -2330,6 +3015,47 @@ const RESOURCE_ENDPOINT_KEYS = [
 const resolveResourceEndpoint = (key, config, explicitUrl) => explicitUrl ?? config?.endpoints?.[key] ?? void 0;
 var resolveResourceEndpoint_default = resolveResourceEndpoint;
 
+//#endregion
+//#region src/utils/validateLogoutTokenClaims.ts
+const fail = (code, message) => {
+	throw new InvalidLogoutTokenError(code, message);
+};
+const isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+const isNonEmptyString = (value) => typeof value === "string" && value.length > 0;
+/**
+* Checks the header and claims of a back-channel logout token, per OpenID Connect Back-Channel
+* Logout 1.0 section 2.6. It does not verify the signature: the caller does that with the server's
+* keys. Messages never include the token or its claim values.
+*
+* @param header - The decoded JOSE header.
+* @param payload - The decoded claims.
+* @param options - The issuer, client and clock the claims are checked against.
+* @returns The claims, typed.
+* @throws {InvalidLogoutTokenError} When any check fails.
+*/
+const validateLogoutTokenClaims = (header, payload, options) => {
+	if (!isRecord(header) || !isRecord(payload)) return fail("JS-LOGOUT_TOKEN-VLTC-IV01", "The logout token is not a well-formed JWT.");
+	const type = typeof header["typ"] === "string" ? header["typ"].toLowerCase() : "";
+	if (type !== BackchannelLogoutConstants_default.TOKEN_TYPE && type !== `application/${BackchannelLogoutConstants_default.TOKEN_TYPE}`) return fail("JS-LOGOUT_TOKEN-VLTC-IV02", "The token type is not logout+jwt.");
+	if (typeof header["alg"] !== "string" || !options.supportedAlgorithms.includes(header["alg"])) return fail("JS-LOGOUT_TOKEN-VLTC-IV03", "The signature algorithm is not supported.");
+	if ("nonce" in payload) return fail("JS-LOGOUT_TOKEN-VLTC-IV04", "A logout token must not carry a nonce.");
+	const { events } = payload;
+	if (!isRecord(events) || !isRecord(events[BackchannelLogoutConstants_default.EVENT])) return fail("JS-LOGOUT_TOKEN-VLTC-IV05", "The back-channel logout event is missing.");
+	if (payload["iss"] !== options.issuer) return fail("JS-LOGOUT_TOKEN-VLTC-IV06", "The issuer does not match.");
+	const audiences = Array.isArray(payload["aud"]) ? payload["aud"] : [payload["aud"]];
+	if (!isNonEmptyString(options.clientId) || !audiences.includes(options.clientId)) return fail("JS-LOGOUT_TOKEN-VLTC-IV07", "The audience does not include this client.");
+	const now = options.now ?? Math.floor(Date.now() / 1e3);
+	const tolerance = options.clockTolerance ?? BackchannelLogoutConstants_default.DEFAULT_CLOCK_TOLERANCE_SECONDS;
+	if (typeof payload["iat"] !== "number" || payload["iat"] > now + tolerance) return fail("JS-LOGOUT_TOKEN-VLTC-IV08", "The issued-at time is missing or in the future.");
+	if (typeof payload["exp"] !== "number" || payload["exp"] <= now - tolerance) return fail("JS-LOGOUT_TOKEN-VLTC-IV09", "The token has expired.");
+	if ("sid" in payload && !isNonEmptyString(payload["sid"])) return fail("JS-LOGOUT_TOKEN-VLTC-IV10", "The session identifier is not valid.");
+	if ("sub" in payload && !isNonEmptyString(payload["sub"])) return fail("JS-LOGOUT_TOKEN-VLTC-IV10", "The subject is not valid.");
+	if (!("sid" in payload) && !("sub" in payload)) return fail("JS-LOGOUT_TOKEN-VLTC-IV11", "The token names neither a session nor a subject.");
+	if (!isNonEmptyString(payload["jti"])) return fail("JS-LOGOUT_TOKEN-VLTC-IV12", "The token identifier is missing.");
+	return payload;
+};
+var validateLogoutTokenClaims_default = validateLogoutTokenClaims;
+
 //#endregion
 //#region src/constants/TokenExchangeConstants.ts
 /**
@@ -2370,6 +3096,9 @@ var AuthenticationHelper = class {
 	config;
 	oidcProviderMetaData;
 	cryptoHelper;
+	jwksCache;
+	jwksFetch;
+	jwksFetchStartedAt = 0;
 	/**
 	* Creates a new `AuthenticationHelper` instance.
 	*
@@ -2474,6 +3203,83 @@ var AuthenticationHelper = class {
 	* @throws {ThunderIDAuthException} When the JWKS endpoint is missing or the request fails.
 	*/
 	async validateIdToken(idToken) {
+		const keys = await this.fetchJwks();
+		const { issuer } = await this.oidcProviderMetaData();
+		const jwk = await this.cryptoHelper.getJWKForTheIdToken(idToken.split(".")[0], keys);
+		return this.cryptoHelper.isValidIdToken(idToken, jwk, (await this.config()).clientId ?? "", issuer ?? "", this.cryptoHelper.decodeJwtToken(idToken).sub, (await this.config()).tokenValidation?.idToken?.clockTolerance, (await this.config()).tokenValidation?.idToken?.validateIssuer ?? true);
+	}
+	/**
+	* Validates a back-channel logout token: its type, event, issuer, audience and lifetime, then its
+	* signature against the server's keys. The claims are checked first, so a malformed token costs
+	* neither a key fetch nor a signature check.
+	*
+	* @param logoutToken - The raw `logout_token` the server posted.
+	* @returns The token's claims.
+	* @throws {InvalidLogoutTokenError} When the token is not valid.
+	*/
+	async validateLogoutToken(logoutToken) {
+		const malformed = new InvalidLogoutTokenError("JS-AUTH_HELPER-VLT-IV01", "The logout token is not a signed JWT.");
+		if (typeof logoutToken !== "string" || logoutToken.split(".").length !== 3) throw malformed;
+		const configData = await this.config();
+		const { issuer } = await this.oidcProviderMetaData();
+		const clockTolerance = configData.tokenValidation?.idToken?.clockTolerance ?? BackchannelLogoutConstants_default.DEFAULT_CLOCK_TOLERANCE_SECONDS;
+		let header;
+		let payload;
+		try {
+			header = this.cryptoHelper.decodeJwtHeader(logoutToken);
+			payload = this.cryptoHelper.decodeJwtToken(logoutToken);
+		} catch {
+			throw malformed;
+		}
+		const claims = validateLogoutTokenClaims_default(header, payload, {
+			clientId: configData.clientId ?? "",
+			clockTolerance,
+			issuer: issuer ?? "",
+			supportedAlgorithms: TokenConstants_default.SignatureValidation.SUPPORTED_ALGORITHMS
+		});
+		await this.cryptoHelper.verifyLogoutTokenSignature(logoutToken, await this.getCachedJwk(header["kid"]), configData.clientId ?? "", issuer ?? "", claims.sub, clockTolerance);
+		return claims;
+	}
+	/**
+	* Returns the server key with the given identifier from a cached key set. An unknown identifier
+	* triggers one re-fetch, to follow key rotation, no more often than the minimum interval: the
+	* logout endpoint is unauthenticated, so an unbounded re-fetch would let anyone drive requests
+	* to the server. Requests that arrive while a fetch runs share it.
+	*/
+	async getCachedJwk(kid) {
+		const now = Date.now();
+		const find = (keys) => keys.find((key) => key.kid === kid);
+		const fresh = this.jwksCache !== void 0 && now - this.jwksCache.fetchedAt < BackchannelLogoutConstants_default.JWKS_CACHE_TTL_MS;
+		let jwk = fresh ? find(this.jwksCache.keys) : void 0;
+		if (!jwk && (this.jwksFetch || now - this.jwksFetchStartedAt >= BackchannelLogoutConstants_default.JWKS_MIN_REFETCH_INTERVAL_MS)) jwk = find(await this.fetchJwksOnce());
+		else if (!jwk && !fresh) throw new ThunderIDAuthException("JS-AUTH_HELPER-GCJ-NA02", "The server keys are not available.", "The server key set could not be fetched recently, and the cached one has expired.");
+		if (!jwk) throw new InvalidLogoutTokenError("JS-AUTH_HELPER-GCJ-NF01", "The logout token names a key the server does not publish.");
+		return jwk;
+	}
+	/**
+	* Fetches the key set unless a fetch is already running, in which case that one is shared.
+	*/
+	fetchJwksOnce() {
+		if (!this.jwksFetch) {
+			this.jwksFetchStartedAt = Date.now();
+			this.jwksFetch = this.fetchJwks().then((keys) => {
+				this.jwksCache = {
+					fetchedAt: Date.now(),
+					keys
+				};
+				return keys;
+			}).finally(() => {
+				this.jwksFetch = void 0;
+			});
+		}
+		return this.jwksFetch;
+	}
+	/**
+	* Fetches the server's JSON Web Key Set.
+	*
+	* @throws {ThunderIDAuthException} When the JWKS endpoint is missing or the request fails.
+	*/
+	async fetchJwks() {
 		const jwksEndpoint = (await this.storageManager.loadOpenIDProviderConfiguration()).jwks_uri;
 		const configData = await this.config();
 		if (!jwksEndpoint || jwksEndpoint.trim().length === 0) throw new ThunderIDAuthException("JS_AUTH_HELPER-VIT-NF01", "JWKS endpoint not found.", "No JWKS endpoint was found in the OIDC provider meta data returned by the well-known endpoint or the JWKS endpoint passed to the SDK is empty.");
@@ -2484,10 +3290,8 @@ var AuthenticationHelper = class {
 			throw new ThunderIDAuthException("JS-AUTH_HELPER-VIT-NE02", "Request to jwks endpoint failed.", error$1 ?? "The request sent to get the jwks from the server failed.");
 		}
 		if (response.status !== 200 || !response.ok) throw new ThunderIDAuthException("JS-AUTH_HELPER-VIT-HE03", `Invalid response status received for jwks request (${response.statusText}).`, await response.json());
-		const { issuer } = await this.oidcProviderMetaData();
 		const { keys } = await response.json();
-		const jwk = await this.cryptoHelper.getJWKForTheIdToken(idToken.split(".")[0], keys);
-		return this.cryptoHelper.isValidIdToken(idToken, jwk, (await this.config()).clientId ?? "", issuer ?? "", this.cryptoHelper.decodeJwtToken(idToken).sub, (await this.config()).tokenValidation?.idToken?.clockTolerance, (await this.config()).tokenValidation?.idToken?.validateIssuer ?? true);
+		return keys;
 	}
 	/**
 	* Extracts user information from a decoded ID token payload.
@@ -2892,6 +3696,14 @@ var ThunderIDJavaScriptClient = class {
 	async decodeJwtToken(token) {
 		return this.cryptoHelper.decodeJwtToken(token);
 	}
+	/**
+	* Validates a back-channel logout token and returns its claims. Protected, because only an SDK
+	* that runs on a server can receive one; such an SDK builds its logout handler on this.
+	*/
+	async validateLogoutToken(logoutToken) {
+		await this.loadOpenIDProviderConfiguration(false);
+		return this.authHelper.validateLogoutToken(logoutToken);
+	}
 	async exchangeToken(config, sessionId) {
 		if (!await this.storageManager.getTemporaryDataParameter(OIDCDiscoveryConstants_default.Storage.StorageKeys.OPENID_PROVIDER_CONFIG_INITIATED)) await this.loadOpenIDProviderConfiguration(false);
 		const oidcProviderMetadata = await this.oidcProviderMetaDataProvider();
@@ -4332,6 +5144,182 @@ const resolveFieldName = (field) => {
 };
 var resolveFieldName_default = resolveFieldName;
 
+//#endregion
+//#region src/utils/evaluatePasswordPolicy.ts
+/**
+* Evaluates a password against a policy, returning one result when the policy configures
+* a `regex` and none otherwise.
+*
+* An uncompilable `regex` is treated as passing, matching `evaluateValidationRule`:
+* the SDK stays lenient so a misconfigured schema cannot lock a user out of their own
+* password change.
+*
+* @param value - The candidate password.
+* @param policy - The rule to apply.
+* @returns A single-item list when `policy.regex` is set, otherwise an empty list.
+* @example
+* ```typescript
+* const results = evaluatePasswordPolicy('sh0rt', {regex: '^.{8,}$'});
+* const isValid = results.every(result => result.passed);
+* ```
+*/
+const evaluatePasswordPolicy = (value, policy) => {
+	if (!policy.regex) return [];
+	let matches = true;
+	try {
+		matches = new RegExp(policy.regex).test(value);
+	} catch {
+		matches = true;
+	}
+	return [{
+		key: "regex",
+		messageKey: "validation.password.pattern",
+		passed: matches
+	}];
+};
+var evaluatePasswordPolicy_default = evaluatePasswordPolicy;
+
+//#endregion
+//#region src/utils/evaluateChangePasswordForm.ts
+/**
+* Evaluates a change-password form against a policy.
+*
+* Every predicate a change-password UI needs is derived here so the React and Vue
+* components stay pure rendering concerns and cannot drift apart on what counts as a
+* submittable form.
+*
+* @param values - The current field values.
+* @param policy - The rules the new password must satisfy.
+* @returns The derived flags plus the per-rule results.
+* @example
+* ```typescript
+* const {isValid, ruleResults} = evaluateChangePasswordForm(
+*   {confirmPassword, newPassword},
+*   {regex: '^.{12,}$'},
+* );
+* const canSubmit = !loading && isValid;
+* ```
+*/
+const evaluateChangePasswordForm = (values, policy) => {
+	const { confirmPassword, newPassword } = values;
+	const ruleResults = evaluatePasswordPolicy_default(newPassword, policy);
+	const meetsPolicy = ruleResults.every((rule) => rule.passed);
+	const confirmMatches = newPassword === confirmPassword;
+	return {
+		confirmMatches,
+		isValid: newPassword !== "" && confirmPassword !== "" && meetsPolicy && confirmMatches,
+		meetsPolicy,
+		ruleResults
+	};
+};
+var evaluateChangePasswordForm_default = evaluateChangePasswordForm;
+
+//#endregion
+//#region src/utils/resolveChangeCredentialPolicy.ts
+/**
+* Resolves the rules a change-credential form should enforce for the given credential.
+*
+* The organization's own policy, expressed as the credential attribute's `regex` in
+* `GET /users/me/meta`, is the sole source of truth: the SDK does not layer its own
+* character-class or length rules on top, since doing so could reject a value the
+* organization's policy accepts. When the schema carries no regex for this credential,
+* there is no policy to check client-side and the requirement checklist is simply empty.
+*
+* @param userSchema - The user type schema resolved by the provider, keyed by attribute.
+* @param attribute - The credential attribute this form manages (e.g. `password`, `pin`).
+* @param override - An explicit policy supplied by the caller, which wins outright.
+* @returns The policy to hand to {@link evaluatePasswordPolicy}.
+* @example
+* ```typescript
+* const policy = resolveChangeCredentialPolicy(userSchema, 'pin', undefined);
+* const results = evaluatePasswordPolicy(candidate, policy);
+* ```
+*/
+const resolveChangeCredentialPolicy = (userSchema, attribute, override) => {
+	if (override) return override;
+	const schemaRegex = userSchema?.[attribute]?.regex;
+	return schemaRegex ? { regex: schemaRegex } : {};
+};
+var resolveChangeCredentialPolicy_default = resolveChangeCredentialPolicy;
+
+//#endregion
+//#region src/utils/supportsCredential.ts
+/**
+* Whether the signed-in user's type allows them to set the given credential for themselves.
+*
+* The user type schema from `GET /users/me/meta` is the only thing a client can check before
+* rendering. It says whether the credential is declared on this type at all, which is a property
+* of the type rather than of the account, so it cannot say whether this particular user has one
+* stored today. That second question is the server's to answer.
+*
+* Without this check the form would submit into a guaranteed failure. `POST
+* /users/me/update-credentials` rejects a write for a name not declared on the type, since the
+* entity layer only accepts schema-declared credential keys.
+*
+* An absent schema means the answer is not known yet, either because the profile is still loading
+* or because the consuming app never supplied one. Both resolve to `true` so a change-credential
+* affordance is never hidden on missing information alone, and so apps that do not wire up
+* `userSchema` keep the behaviour they had before this check existed.
+*
+* @param userSchema - The user type schema resolved by the provider, keyed by attribute.
+* @param attribute - The credential attribute to check (e.g. `password`, `pin`).
+* @returns `false` only when the schema is known and either defines no attribute named
+* `attribute` or defines one that isn't marked `credential: true`.
+* @example
+* ```typescript
+* if (!supportsCredential(userSchema, 'pin')) {
+*   return null;
+* }
+* ```
+*/
+const supportsCredential = (userSchema, attribute) => {
+	if (!userSchema) return true;
+	return userSchema[attribute]?.credential === true;
+};
+var supportsCredential_default = supportsCredential;
+
+//#endregion
+//#region src/utils/mapCredentialUpdateError.ts
+/**
+* Maps a failure from the credential write path onto the field that caused it.
+*
+* `400` is the new password failing a server-side check. Everything else, including a
+* `403`, has no single field to blame here: this form collects no current-value field for
+* a `403` to attach to, since the server does not verify one on this path today.
+*
+* @param error - The value thrown by the credential update call.
+* @returns Where to show the failure and what to show.
+* @example
+* ```typescript
+* const {field, message, messageKey} = mapCredentialUpdateError(caughtError);
+* const text = message ?? t(messageKey);
+*
+* if (field) {
+*   setFieldErrors({[field]: text});
+* } else {
+*   setError(text);
+* }
+* ```
+*/
+const GENERIC_MESSAGE_KEY = "user.change_password.generic.error";
+const mapCredentialUpdateError = (error$1) => {
+	if ((error$1 instanceof ThunderIDAPIError ? error$1.statusCode : void 0) === 400 && error$1 instanceof ThunderIDError) return {
+		field: "newPassword",
+		message: error$1.message,
+		messageKey: GENERIC_MESSAGE_KEY
+	};
+	if (error$1 instanceof ThunderIDError) return {
+		field: null,
+		message: error$1.message,
+		messageKey: GENERIC_MESSAGE_KEY
+	};
+	return {
+		field: null,
+		messageKey: GENERIC_MESSAGE_KEY
+	};
+};
+var mapCredentialUpdateError_default = mapCredentialUpdateError;
+
 //#endregion
 //#region src/utils/resolveMeta.ts
 /**
@@ -4524,6 +5512,40 @@ function resolveFlowTemplateLiterals(text, { t, meta }) {
 	});
 }
 
+//#endregion
+//#region src/utils/parseKeyValuePairs.ts
+/**
+* Reads the label and value pairs a KEY_VALUE_LIST renders from the raw value found under its
+* `source` key in `additionalData`. The server publishes them as a JSON-encoded array, since
+* additional data carries strings, so both an array and its encoding are accepted.
+*
+* Entries that are not objects, or that carry no value, are dropped, since an empty row tells the
+* user nothing. Anything that is not a list of pairs yields none.
+*
+* @param raw - The raw value found under the source key.
+* @returns The pairs to render, empty when the value holds none.
+*
+* @example
+* ```typescript
+* parseKeyValuePairs('[{"label":"Email","value":"a@b.com"}]'); // [{label: 'Email', value: 'a@b.com'}]
+* parseKeyValuePairs('not json');                              // []
+* ```
+*/
+const parseKeyValuePairs = (raw) => {
+	let parsed = raw;
+	if (typeof raw === "string") try {
+		parsed = JSON.parse(raw);
+	} catch {
+		return [];
+	}
+	if (!Array.isArray(parsed)) return [];
+	return parsed.filter((entry) => typeof entry === "object" && entry !== null && !Array.isArray(entry)).map((entry) => ({
+		label: typeof entry["label"] === "string" ? entry["label"] : "",
+		value: typeof entry["value"] === "string" ? entry["value"] : ""
+	})).filter((pair) => pair.value !== "");
+};
+var parseKeyValuePairs_default = parseKeyValuePairs;
+
 //#endregion
 //#region src/utils/countryCodeToFlagEmoji.ts
 /**
@@ -4718,7 +5740,7 @@ const DEFAULT_VALIDATION_MESSAGE_KEYS = {
 * - Unknown rule types are treated as passing (forward compatibility with future types).
 */
 const evaluateValidationRule = (rule, value) => {
-	const fail = () => rule.message ?? DEFAULT_VALIDATION_MESSAGE_KEYS[rule.type];
+	const fail$1 = () => rule.message ?? DEFAULT_VALIDATION_MESSAGE_KEYS[rule.type];
 	switch (rule.type) {
 		case "regex": {
 			if (typeof rule.value !== "string" || rule.value === "") return null;
@@ -4728,14 +5750,14 @@ const evaluateValidationRule = (rule, value) => {
 			} catch {
 				return null;
 			}
-			return re.test(value) ? null : fail();
+			return re.test(value) ? null : fail$1();
 		}
 		case "minLength":
 			if (typeof rule.value !== "number" || Number.isNaN(rule.value)) return null;
-			return value.length >= rule.value ? null : fail();
+			return value.length >= rule.value ? null : fail$1();
 		case "maxLength":
 			if (typeof rule.value !== "number" || Number.isNaN(rule.value)) return null;
-			return value.length <= rule.value ? null : fail();
+			return value.length <= rule.value ? null : fail$1();
 		default: return null;
 	}
 };
@@ -4965,6 +5987,19 @@ const en_US = {
 		"passkey.register.description": "Create a passkey to securely sign in to your account without a password.",
 		"user.profile.heading": "Profile",
 		"user.profile.update.generic.error": "An error occurred while updating your profile. Please try again.",
+		"user.change_password.heading": "Change {credential}",
+		"user.change_password.new.label": "New {credential}",
+		"user.change_password.new.placeholder": "Enter your new {credentialLower}",
+		"user.change_password.confirm.label": "Confirm New {credential}",
+		"user.change_password.confirm.placeholder": "Re-enter your new {credentialLower}",
+		"user.change_password.requirements.heading": "Your {credentialLower} must have:",
+		"user.change_password.submit": "Update {credential}",
+		"user.change_password.success": "Your {credentialLower} has been updated.",
+		"user.change_password.mismatch.error": "{credential}s do not match.",
+		"user.change_password.generic.error": "An error occurred while updating your {credentialLower}. Please try again.",
+		"user.change_password.unavailable.heading": "{credential} changes unavailable",
+		"user.change_password.unavailable.description": "Please contact your administrator.",
+		"validation.password.pattern": "Matches the required format",
 		"organization.switcher.switch.organization": "Switch Organization",
 		"organization.switcher.loading.placeholder.organizations": "Loading organizations...",
 		"organization.switcher.members": "members",
@@ -5008,6 +6043,7 @@ const en_US = {
 		"errors.signup.initialization": "An error occurred while initializing. Please try again later.",
 		"errors.signup.flow.failure": "An error occurred during the sign-up flow. Please try again later.",
 		"errors.signup.flow.initialization.failure": "An error occurred while initializing the sign-up flow. Please try again later.",
+		"errors.signup.popup.failure": "Could not continue the sign-up in the pop-up window. Please try again.",
 		"errors.signup.components.not.available": "Sign-up form is not available at the moment. Please try again later."
 	}
 };
@@ -5086,6 +6122,19 @@ const fr_FR = {
 		"passkey.register.description": "Créez une clé d'accès pour vous connecter en toute sécurité à votre compte sans mot de passe.",
 		"user.profile.heading": "Profil",
 		"user.profile.update.generic.error": "Une erreur est survenue lors de la mise à jour de votre profil. Veuillez réessayer.",
+		"user.change_password.heading": "Modifier {credential}",
+		"user.change_password.new.label": "Nouveau {credential}",
+		"user.change_password.new.placeholder": "Entrez votre nouveau {credentialLower}",
+		"user.change_password.confirm.label": "Confirmer le nouveau {credential}",
+		"user.change_password.confirm.placeholder": "Saisissez à nouveau votre nouveau {credentialLower}",
+		"user.change_password.requirements.heading": "Votre {credentialLower} doit contenir :",
+		"user.change_password.submit": "Mettre à jour {credential}",
+		"user.change_password.success": "Votre {credentialLower} a été mis à jour.",
+		"user.change_password.mismatch.error": "Les {credentialLower}s ne correspondent pas.",
+		"user.change_password.generic.error": "Une erreur est survenue lors de la mise à jour de votre {credentialLower}. Veuillez réessayer.",
+		"user.change_password.unavailable.heading": "Modification du {credentialLower} indisponible",
+		"user.change_password.unavailable.description": "Veuillez contacter votre administrateur.",
+		"validation.password.pattern": "Correspond au format requis",
 		"organization.switcher.switch.organization": "Changer d'organisation",
 		"organization.switcher.loading.placeholder.organizations": "Chargement des organisations...",
 		"organization.switcher.members": "membres",
@@ -5127,6 +6176,7 @@ const fr_FR = {
 		"errors.signup.initialization": "Une erreur est survenue lors de l'initialisation. Veuillez réessayer plus tard.",
 		"errors.signup.flow.failure": "Une erreur est survenue lors du flux d'inscription. Veuillez réessayer plus tard.",
 		"errors.signup.flow.initialization.failure": "Une erreur est survenue lors de l'initialisation du flux d'inscription. Veuillez réessayer plus tard.",
+		"errors.signup.popup.failure": "Impossible de poursuivre l'inscription dans la fenêtre contextuelle. Veuillez réessayer.",
 		"errors.signup.components.not.available": "Le formulaire d'inscription n'est pas disponible pour le moment. Veuillez réessayer plus tard.",
 		"errors.signin.components.not.available": "Le formulaire de connexion n'est pas disponible pour le moment. Veuillez réessayer plus tard.",
 		"errors.signin.timeout": "Le temps imparti pour effectuer cette e'tape est expire'."
@@ -5207,6 +6257,19 @@ const te_IN = {
 		"passkey.register.description": "పాస్‌వర్డ్ లేకుండా మీ ఖాతాలోకి సురక్షితంగా సైన్ ఇన్ చేయడానికి Passkey ని సృష్టించండి.",
 		"user.profile.heading": "ప్రొఫైల్",
 		"user.profile.update.generic.error": "ప్రొఫైల్ అప్‌డేట్ చేస్తూ లోపం వచ్చింది. దయచేసి మళ్లీ ప్రయత్నించండి.",
+		"user.change_password.heading": "{credential} మార్చండి",
+		"user.change_password.new.label": "కొత్త {credential}",
+		"user.change_password.new.placeholder": "మీ కొత్త {credentialLower} నమోదు చేయండి",
+		"user.change_password.confirm.label": "కొత్త {credential} నిర్ధారించండి",
+		"user.change_password.confirm.placeholder": "మీ కొత్త {credentialLower}ని మళ్లీ నమోదు చేయండి",
+		"user.change_password.requirements.heading": "మీ {credentialLower} కింది వాటిని కలిగి ఉండాలి:",
+		"user.change_password.submit": "{credential} నవీకరించండి",
+		"user.change_password.success": "మీ {credentialLower} నవీకరించబడింది.",
+		"user.change_password.mismatch.error": "{credentialLower} సరిపోలలేదు.",
+		"user.change_password.generic.error": "మీ {credentialLower} నవీకరించేటప్పుడు లోపం వచ్చింది. దయచేసి మళ్లీ ప్రయత్నించండి.",
+		"user.change_password.unavailable.heading": "{credential} మార్పులు అందుబాటులో లేవు",
+		"user.change_password.unavailable.description": "దయచేసి మీ నిర్వాహకుడిని సంప్రదించండి.",
+		"validation.password.pattern": "అవసరమైన ఫార్మాట్‌కు సరిపోతుంది",
 		"organization.switcher.switch.organization": "ఆర్గనైజేషన్ మార్చండి",
 		"organization.switcher.loading.placeholder.organizations": "ఆర్గనైజేషన్‌లు లోడ్ అవుతున్నాయి...",
 		"organization.switcher.members": "సభ్యులు",
@@ -5248,6 +6311,7 @@ const te_IN = {
 		"errors.signup.initialization": "ప్రారంభించేటప్పుడు లోపం వచ్చింది. దయచేసి తరువాత మళ్లీ ప్రయత్నించండి.",
 		"errors.signup.flow.failure": "సైన్ అప్ ప్రక్రియలో లోపం వచ్చింది. దయచేసి తరువాత మళ్లీ ప్రయత్నించండి.",
 		"errors.signup.flow.initialization.failure": "సైన్ అప్ ప్రక్రియను ప్రారంభించేటప్పుడు లోపం వచ్చింది. దయచేసి తరువాత మళ్లీ ప్రయత్నించండి.",
+		"errors.signup.popup.failure": "పాప్-అప్ విండోలో సైన్ అప్ కొనసాగించడం సాధ్యం కాలేదు. దయచేసి మళ్లీ ప్రయత్నించండి.",
 		"errors.signup.components.not.available": "సైన్ అప్ ఫారం ప్రస్తుతం అందుబాటులో లేదు. దయచేసి తరువాత మళ్లీ ప్రయత్నించండి.",
 		"errors.signin.components.not.available": "సైన్ ఇన్ ఫారం ప్రస్తుతం అందుబాటులో లేదు. దయచేసి తరువాత మళ్లీ ప్రయత్నించండి.",
 		"errors.signin.timeout": "దశను పూర్తి చేయడానికి అనుమతించబడిన సమయం ముగిసింది."
@@ -5328,6 +6392,19 @@ const hi_IN = {
 		"passkey.register.description": "बिना पासवर्ड के अपने खाते में सुरक्षित रूप से साइन इन करने के लिए एक Passkey बनाएं।",
 		"user.profile.heading": "प्रोफ़ाइल",
 		"user.profile.update.generic.error": "प्रोफ़ाइल अपडेट करते समय त्रुटि हुई। कृपया पुनः प्रयास करें।",
+		"user.change_password.heading": "{credential} बदलें",
+		"user.change_password.new.label": "नया {credential}",
+		"user.change_password.new.placeholder": "अपना नया {credentialLower} दर्ज करें",
+		"user.change_password.confirm.label": "नए {credential} की पुष्टि करें",
+		"user.change_password.confirm.placeholder": "अपना नया {credentialLower} फिर से दर्ज करें",
+		"user.change_password.requirements.heading": "आपके {credentialLower} में यह होना चाहिए:",
+		"user.change_password.submit": "{credential} अपडेट करें",
+		"user.change_password.success": "आपका {credentialLower} अपडेट कर दिया गया है।",
+		"user.change_password.mismatch.error": "{credential} मेल नहीं खाते।",
+		"user.change_password.generic.error": "आपका {credentialLower} अपडेट करते समय त्रुटि हुई। कृपया पुनः प्रयास करें।",
+		"user.change_password.unavailable.heading": "{credential} परिवर्तन उपलब्ध नहीं है",
+		"user.change_password.unavailable.description": "कृपया अपने व्यवस्थापक से संपर्क करें।",
+		"validation.password.pattern": "आवश्यक प्रारूप से मेल खाता है",
 		"organization.switcher.switch.organization": "संगठन बदलें",
 		"organization.switcher.loading.placeholder.organizations": "संगठन लोड हो रहे हैं...",
 		"organization.switcher.members": "सदस्य",
@@ -5369,6 +6446,7 @@ const hi_IN = {
 		"errors.signup.initialization": "प्रारंभीकरण के दौरान एक त्रुटि हुई। कृपया बाद में पुनः प्रयास करें।",
 		"errors.signup.flow.failure": "साइन-अप प्रक्रिया में त्रुटि। कृपया बाद में पुनः प्रयास करें।",
 		"errors.signup.flow.initialization.failure": "साइन-अप प्रक्रिया प्रारंभ करते समय त्रुटि। कृपया बाद में पुनः प्रयास करें।",
+		"errors.signup.popup.failure": "पॉप-अप विंडो में साइन-अप जारी नहीं रखा जा सका। कृपया पुनः प्रयास करें।",
 		"errors.signup.components.not.available": "साइन-अप फॉर्म फिलहाल उपलब्ध नहीं है। कृपया बाद में पुनः प्रयास करें।",
 		"errors.signin.components.not.available": "साइन-इन फॉर्म फिलहाल उपलब्ध नहीं है। कृपया बाद में पुनः प्रयास करें।",
 		"errors.signin.timeout": "स्टेप पूरा करने के लिए दिया गया समय खत्म हो गया है।"
@@ -5449,6 +6527,19 @@ const pt_BR = {
 		"passkey.register.description": "Crie uma passkey para entrar em sua conta com segurança sem uma senha.",
 		"user.profile.heading": "Perfil",
 		"user.profile.update.generic.error": "Ocorreu um erro ao atualizar seu perfil. Tente novamente.",
+		"user.change_password.heading": "Alterar {credential}",
+		"user.change_password.new.label": "Novo {credential}",
+		"user.change_password.new.placeholder": "Digite seu novo {credentialLower}",
+		"user.change_password.confirm.label": "Confirmar novo {credential}",
+		"user.change_password.confirm.placeholder": "Digite novamente seu novo {credentialLower}",
+		"user.change_password.requirements.heading": "Seu {credentialLower} deve conter:",
+		"user.change_password.submit": "Atualizar {credential}",
+		"user.change_password.success": "Seu {credentialLower} foi atualizado.",
+		"user.change_password.mismatch.error": "Os {credentialLower}s não coincidem.",
+		"user.change_password.generic.error": "Ocorreu um erro ao atualizar seu {credentialLower}. Tente novamente.",
+		"user.change_password.unavailable.heading": "Alteração de {credentialLower} indisponível",
+		"user.change_password.unavailable.description": "Entre em contato com o administrador.",
+		"validation.password.pattern": "Corresponde ao formato exigido",
 		"organization.switcher.switch.organization": "Trocar Organização",
 		"organization.switcher.loading.placeholder.organizations": "Carregando organizações...",
 		"organization.switcher.members": "membros",
@@ -5490,6 +6581,7 @@ const pt_BR = {
 		"errors.signup.initialization": "Ocorreu um erro durante a inicialização. Tente novamente mais tarde.",
 		"errors.signup.flow.failure": "Ocorreu um erro durante o fluxo de cadastro. Tente novamente mais tarde.",
 		"errors.signup.flow.initialization.failure": "Ocorreu um erro ao inicializar o fluxo de cadastro. Tente novamente mais tarde.",
+		"errors.signup.popup.failure": "Não foi possível continuar o cadastro na janela pop-up. Tente novamente.",
 		"errors.signup.components.not.available": "O formulário de cadastro não está disponível no momento. Tente novamente mais tarde.",
 		"errors.signin.components.not.available": "O formulário de login não está disponível no momento. Tente novamente mais tarde.",
 		"errors.signin.timeout": "O tempo permitido para concluir a etapa expirou."
@@ -5570,6 +6662,19 @@ const pt_PT = {
 		"passkey.register.description": "Crie uma passkey para iniciar sessão na sua conta com segurança sem palavra-passe.",
 		"user.profile.heading": "Perfil",
 		"user.profile.update.generic.error": "Ocorreu um erro ao actualizar o seu perfil. Tente novamente.",
+		"user.change_password.heading": "Alterar {credential}",
+		"user.change_password.new.label": "Novo {credential}",
+		"user.change_password.new.placeholder": "Introduza o seu novo {credentialLower}",
+		"user.change_password.confirm.label": "Confirmar novo {credential}",
+		"user.change_password.confirm.placeholder": "Introduza novamente o seu novo {credentialLower}",
+		"user.change_password.requirements.heading": "O seu {credentialLower} deve conter:",
+		"user.change_password.submit": "Atualizar {credential}",
+		"user.change_password.success": "O seu {credentialLower} foi atualizado.",
+		"user.change_password.mismatch.error": "Os {credentialLower}s não coincidem.",
+		"user.change_password.generic.error": "Ocorreu um erro ao actualizar o seu {credentialLower}. Tente novamente.",
+		"user.change_password.unavailable.heading": "Alteração de {credentialLower} indisponível",
+		"user.change_password.unavailable.description": "Contacte o seu administrador.",
+		"validation.password.pattern": "Corresponde ao formato exigido",
 		"organization.switcher.switch.organization": "Trocar Organização",
 		"organization.switcher.loading.placeholder.organizations": "A carregar organizações...",
 		"organization.switcher.members": "membros",
@@ -5611,6 +6716,7 @@ const pt_PT = {
 		"errors.signup.initialization": "Ocorreu um erro durante a inicialização. Tente novamente mais tarde.",
 		"errors.signup.flow.failure": "Ocorreu um erro durante o fluxo de registo. Tente novamente mais tarde.",
 		"errors.signup.flow.initialization.failure": "Ocorreu um erro ao inicializar o fluxo de registo. Tente novamente mais tarde.",
+		"errors.signup.popup.failure": "Não foi possível continuar o registo na janela pop-up. Tente novamente.",
 		"errors.signup.components.not.available": "O formulário de registo não está disponível de momento. Tente novamente mais tarde.",
 		"errors.signin.components.not.available": "O formulário de início de sessão não está disponível de momento. Tente novamente mais tarde.",
 		"errors.signin.timeout": "O tempo permitido para completar a etapa expirou."
@@ -5691,6 +6797,19 @@ const ta_IN = {
 		"passkey.register.description": "கடவுச்சொல் இல்லாமல் பாதுகாப்பாக உள்நுழைய ஒரு passkey-ஐ உருவாக்கவும்.",
 		"user.profile.heading": "சுயவிவரம்",
 		"user.profile.update.generic.error": "உங்கள் சுயவிவரத்தை புதுப்பிக்கும் போது பிழை ஏற்பட்டது. மீண்டும் முயற்சிக்கவும்.",
+		"user.change_password.heading": "{credential} மாற்றவும்",
+		"user.change_password.new.label": "புதிய {credential}",
+		"user.change_password.new.placeholder": "உங்கள் புதிய {credentialLower}-ஐ உள்ளிடவும்",
+		"user.change_password.confirm.label": "புதிய {credential}-ஐ உறுதிப்படுத்தவும்",
+		"user.change_password.confirm.placeholder": "உங்கள் புதிய {credentialLower}-ஐ மீண்டும் உள்ளிடவும்",
+		"user.change_password.requirements.heading": "உங்கள் {credentialLower} பின்வருவனவற்றைக் கொண்டிருக்க வேண்டும்:",
+		"user.change_password.submit": "{credential}-ஐ புதுப்பிக்கவும்",
+		"user.change_password.success": "உங்கள் {credentialLower} புதுப்பிக்கப்பட்டது.",
+		"user.change_password.mismatch.error": "{credentialLower} பொருந்தவில்லை.",
+		"user.change_password.generic.error": "உங்கள் {credentialLower}-ஐ புதுப்பிக்கும் போது பிழை ஏற்பட்டது. மீண்டும் முயற்சிக்கவும்.",
+		"user.change_password.unavailable.heading": "{credential} மாற்றங்கள் கிடைக்கவில்லை",
+		"user.change_password.unavailable.description": "உங்கள் நிர்வாகியை தொடர்பு கொள்ளவும்.",
+		"validation.password.pattern": "தேவையான வடிவமைப்பிற்கு பொருந்துகிறது",
 		"organization.switcher.switch.organization": "அமைப்பை மாற்று",
 		"organization.switcher.loading.placeholder.organizations": "அமைப்புகள் ஏற்றப்படுகின்றன...",
 		"organization.switcher.members": "உறுப்பினர்கள்",
@@ -5732,6 +6851,7 @@ const ta_IN = {
 		"errors.signup.initialization": "தொடங்கும்போது பிழை ஏற்பட்டது. பின்னர் மீண்டும் முயற்சிக்கவும்.",
 		"errors.signup.flow.failure": "பதிவு செய்யும் செயல்பாட்டில் பிழை ஏற்பட்டது. பின்னர் மீண்டும் முயற்சிக்கவும்.",
 		"errors.signup.flow.initialization.failure": "பதிவு செய்யும் செயல்பாட்டை தொடங்கும்போது பிழை ஏற்பட்டது. பின்னர் மீண்டும் முயற்சிக்கவும்.",
+		"errors.signup.popup.failure": "பாப்-அப் சாளரத்தில் பதிவைத் தொடர முடியவில்லை. மீண்டும் முயற்சிக்கவும்.",
 		"errors.signup.components.not.available": "பதிவு படிவம் இப்போது கிடைக்கவில்லை. பின்னர் மீண்டும் முயற்சிக்கவும்.",
 		"errors.signin.components.not.available": "உள்நுழைவு படிவம் இப்போது கிடைக்கவில்லை. பின்னர் மீண்டும் முயற்சிக்கவும்.",
 		"errors.signin.timeout": "படிநிலையை முடிக்க அனுமதிக்கப்பட்ட நேரம் காலாவதியானது."
@@ -5812,6 +6932,19 @@ const si_LK = {
 		"passkey.register.description": "මුරපදයක් නොමැතිව ඔබේ ගිණුමට ආරක්ෂිතව ඇතුල් වීමට passkey එකක් සාදන්න.",
 		"user.profile.heading": "පැතිකඩ",
 		"user.profile.update.generic.error": "ඔබේ පැතිකඩ යාවත්කාලීන කිරීමේදී දෝෂයක් ඇතිවිය.කරුණාකර නැවත උත්සාහ කරන්න",
+		"user.change_password.heading": "{credential} වෙනස් කරන්න",
+		"user.change_password.new.label": "නව {credential}",
+		"user.change_password.new.placeholder": "ඔබේ නව {credentialLower} ඇතුළත් කරන්න",
+		"user.change_password.confirm.label": "නව {credential} තහවුරු කරන්න",
+		"user.change_password.confirm.placeholder": "ඔබේ නව {credentialLower} නැවත ඇතුළත් කරන්න",
+		"user.change_password.requirements.heading": "ඔබේ {credentialLower} තුළ තිබිය යුතුය:",
+		"user.change_password.submit": "{credential} යාවත්කාලීන කරන්න",
+		"user.change_password.success": "ඔබේ {credentialLower} යාවත්කාලීන කර ඇත.",
+		"user.change_password.mismatch.error": "{credentialLower} නොගැලපේ.",
+		"user.change_password.generic.error": "ඔබේ {credentialLower} යාවත්කාලීන කිරීමේදී දෝෂයක් ඇතිවිය. කරුණාකර නැවත උත්සාහ කරන්න.",
+		"user.change_password.unavailable.heading": "{credential} වෙනස් කිරීම් ලබා ගත නොහැක",
+		"user.change_password.unavailable.description": "කරුණාකර ඔබේ පරිපාලක සම්බන්ධ කර ගන්න.",
+		"validation.password.pattern": "අවශ්‍ය ආකෘතියට ගැලපේ",
 		"organization.switcher.switch.organization": "සංවිධානය මාරු කරන්න",
 		"organization.switcher.loading.placeholder.organizations": "සංවිධාන ලෝඩ් වෙමින්...",
 		"organization.switcher.members": "සාමාජිකයන්",
@@ -5853,6 +6986,7 @@ const si_LK = {
 		"errors.signup.initialization": "ආරම්භ කිරීමේදී දෝෂයක් සිදු විය. කරුණාකර පසුව නැවත උත්සාහ කරන්න.",
 		"errors.signup.flow.failure": "ගිණුම් තැනීමේ ක්‍රියාවලියේදී දෝෂයක් සිදු විය. කරුණාකර පසුව නැවත උත්සාහ කරන්න.",
 		"errors.signup.flow.initialization.failure": "ගිණුම් තැනීමේ ක්‍රියාවලිය ආරම්භ කිරීමේදී දෝෂයක් සිදු විය. කරුණාකර පසුව නැවත උත්සාහ කරන්න.",
+		"errors.signup.popup.failure": "උත්පතන කවුළුවේ ගිණුම් තැනීම දිගටම කරගෙන යා නොහැකි විය. කරුණාකර නැවත උත්සාහ කරන්න.",
 		"errors.signup.components.not.available": "ගිණුම් තැනීමේ පිටුව දැන් ලබා ගත නොහැකිය. කරුණාකර පසුව නැවත උත්සාහ කරන්න.",
 		"errors.signin.components.not.available": "ප්‍රවේශ වීමේ පිටුව දැන් ලබා ගත නොහැකිය. කරුණාකර පසුව නැවත උත්සාහ කරන්න.",
 		"errors.signin.timeout": "පියවර සම්පූර්ණ කිරීමට ලබා දී තිබූ කාලය ඉකුත් වී ඇත."
@@ -5949,9 +7083,13 @@ const normalizeTranslations = (translations) => {
 var normalizeTranslations_default = normalizeTranslations;
 
 //#endregion
+exports.AgentQueryKeys = AgentQueryKeys_default;
 exports.ApplicationNativeAuthenticationConstants = ApplicationNativeAuthenticationConstants_default;
+exports.ApplicationQueryKeys = ApplicationQueryKeys_default;
 exports.AuthenticationHelper = AuthenticationHelper_default;
+exports.BackchannelLogoutConstants = BackchannelLogoutConstants_default;
 exports.ConsentConstants = ConsentConstants_default;
+exports.CredentialConstants = CredentialConstants_default;
 exports.DEFAULT_THEME = DEFAULT_THEME;
 exports.DEFAULT_VALIDATION_MESSAGE_KEYS = DEFAULT_VALIDATION_MESSAGE_KEYS;
 exports.EMOJI_URI_SCHEME = EMOJI_URI_SCHEME;
@@ -5971,8 +7109,13 @@ exports.FieldType = FieldType;
 exports.FlowMetaType = FlowMetaType;
 exports.FlowMode = FlowMode;
 exports.HttpClient = HttpClient;
+exports.InboundAuthTypes = InboundAuthTypes;
+exports.InvalidLogoutTokenError = InvalidLogoutTokenError;
 exports.IsomorphicCrypto = IsomorphicCrypto;
+exports.OAuth2GrantTypes = OAuth2GrantTypes;
+exports.OAuth2ResponseTypes = OAuth2ResponseTypes;
 exports.OIDCRequestConstants = OIDCRequestConstants_default;
+exports.REFRESH_TOKEN_ISSUING_GRANTS = REFRESH_TOKEN_ISSUING_GRANTS;
 exports.StorageManager = StorageManager_default;
 exports.ThunderIDAPIError = ThunderIDAPIError;
 exports.ThunderIDAuthException = ThunderIDAuthException;
@@ -5980,7 +7123,9 @@ exports.ThunderIDError = ThunderIDError;
 exports.ThunderIDJavaScriptClient = ThunderIDJavaScriptClient_default;
 exports.ThunderIDRuntimeError = ThunderIDRuntimeError;
 exports.TokenConstants = TokenConstants_default;
+exports.TokenEndpointAuthMethods = TokenEndpointAuthMethods;
 exports.TranslationBundleConstants = TranslationBundleConstants_default;
+exports.UserQueryKeys = UserQueryKeys_default;
 exports.VendorConstants = VendorConstants_default;
 exports.arrayBufferToBase64url = arrayBufferToBase64url_default;
 exports.base64urlToArrayBuffer = base64urlToArrayBuffer_default;
@@ -5988,14 +7133,22 @@ exports.bem = bem_default;
 exports.buildValidatorFromRules = buildValidatorFromRules_default;
 exports.configureLogger = configure;
 exports.countryCodeToFlagEmoji = countryCodeToFlagEmoji;
+exports.createAgent = createAgent_default;
+exports.createApplication = createApplication_default;
 exports.createComponentLogger = createComponentLogger;
 exports.createLogger = createLogger;
 exports.createPackageComponentLogger = createPackageComponentLogger;
 exports.createPackageLogger = createPackageLogger;
 exports.createTheme = createTheme_default;
+exports.createUser = createUser_default;
 exports.debug = debug;
 exports.deepMerge = deepMerge_default;
+exports.deleteAgent = deleteAgent_default;
+exports.deleteApplication = deleteApplication_default;
+exports.deleteUser = deleteUser_default;
 exports.error = error;
+exports.evaluateChangePasswordForm = evaluateChangePasswordForm_default;
+exports.evaluatePasswordPolicy = evaluatePasswordPolicy_default;
 exports.evaluateValidationRule = evaluateValidationRule_default;
 exports.executeEmbeddedRecoveryFlow = executeEmbeddedRecoveryFlow_default;
 exports.executeEmbeddedSignInFlow = executeEmbeddedSignInFlow_default;
@@ -6007,13 +7160,19 @@ exports.extractUserClaimsFromIdToken = extractUserClaimsFromIdToken_default;
 exports.formatDate = formatDate_default;
 exports.generateFlattenedUserProfile = generateFlattenedUserProfile_default;
 exports.get = get_default;
+exports.getAgent = getAgent_default;
+exports.getAgents = getAgents_default;
+exports.getApplication = getApplication_default;
+exports.getApplications = getApplications_default;
 exports.getBaseLanguage = getBaseLanguage;
 exports.getDefaultI18nBundles = getDefaultI18nBundles_default;
 exports.getFlowMeta = getFlowMeta_default;
 exports.getLatestStateParam = getLatestStateParam_default;
 exports.getOrganizationUnitChildren = getOrganizationUnitChildren_default;
 exports.getRedirectBasedSignUpUrl = getRedirectBasedSignUpUrl_default;
+exports.getUser = getUser_default;
 exports.getUserInfo = getUserInfo_default;
+exports.getUsers = getUsers_default;
 exports.getUsersMe = getUsersMe_default;
 exports.getUsersMeMeta = getUsersMeMeta_default;
 exports.getVendorPrefix = getVendorPrefix_default;
@@ -6023,10 +7182,13 @@ exports.isEmojiUri = isEmojiUri_default;
 exports.isEmpty = isEmpty_default;
 exports.isRecognizedBaseUrlPattern = isRecognizedBaseUrlPattern_default;
 exports.logger = logger_default;
+exports.mapCredentialUpdateError = mapCredentialUpdateError_default;
 exports.normalizeLocaleTag = normalizeLocaleTag;
 exports.normalizeTranslations = normalizeTranslations_default;
+exports.parseKeyValuePairs = parseKeyValuePairs_default;
 exports.processOpenIDScopes = processOpenIDScopes_default;
 exports.removeTrailingSlash = removeTrailingSlash_default;
+exports.resolveChangeCredentialPolicy = resolveChangeCredentialPolicy_default;
 exports.resolveFieldName = resolveFieldName_default;
 exports.resolveFlowTemplateLiterals = resolveFlowTemplateLiterals;
 exports.resolveLocaleDisplayName = resolveLocaleDisplayName;
@@ -6036,6 +7198,12 @@ exports.resolveResourceEndpoint = resolveResourceEndpoint_default;
 exports.set = set_default;
 exports.startCase = startCase_default;
 exports.substituteTranslationParams = substituteTranslationParams_default;
+exports.supportsCredential = supportsCredential_default;
+exports.updateAgent = updateAgent_default;
+exports.updateApplication = updateApplication_default;
+exports.updateMeCredentials = updateMeCredentials_default;
 exports.updateMeProfile = updateMeProfile_default;
+exports.updateUser = updateUser_default;
+exports.validateLogoutTokenClaims = validateLogoutTokenClaims_default;
 exports.warn = warn;
 exports.withVendorCSSClassPrefix = withVendorCSSClassPrefix_default;