@thunderid/javascript 1.0.7 → 1.2.0

package/dist/models/logout-token.d.ts

@@ -0,0 +1,58 @@
+/**
+ * The claims of a validated back-channel logout token.
+ */
+export interface LogoutTokenClaims {
+    /**
+     * Other claims the server included.
+     */
+    [claim: string]: unknown;
+    aud: string | string[];
+    events: Record<string, unknown>;
+    exp: number;
+    iat: number;
+    iss: string;
+    jti: string;
+    /**
+     * The server session that ended. Present on every ThunderID logout token.
+     */
+    sid?: string;
+    /**
+     * The subject whose session ended.
+     */
+    sub?: string;
+}
+/**
+ * What a logout token's claims are checked against.
+ */
+export interface LogoutTokenValidationOptions {
+    clientId: string;
+    /**
+     * Allowed clock difference in seconds.
+     */
+    clockTolerance?: number;
+    issuer: string;
+    /**
+     * The current time in seconds since the epoch. Defaults to the system clock.
+     */
+    now?: number;
+    /**
+     * The signature algorithms the SDK accepts.
+     */
+    supportedAlgorithms: readonly string[];
+}
+/**
+ * The outcome of handling a back-channel logout request.
+ */
+export interface BackchannelLogoutResult {
+    /**
+     * When the server issued the logout token, in seconds since the epoch.
+     */
+    issuedAt: number;
+    /**
+     * How many local sessions were ended. Zero when the token named no session held here.
+     */
+    sessionsEnded: number;
+    sid?: string;
+    sub?: string;
+}
+//# sourceMappingURL=logout-token.d.ts.map

package/dist/models/logout-token.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"logout-token.d.ts","sourceRoot":"","sources":["../../src/models/logout-token.ts"],"names":[],"mappings":"AAGA;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC;;OAEG;IACH,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;IACzB,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACvB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ;;OAEG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;OAEG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED;;GAEG;AACH,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,EAAE,MAAM,CAAC;IACjB;;OAEG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,MAAM,EAAE,MAAM,CAAC;IACf;;OAEG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;OAEG;IACH,mBAAmB,EAAE,SAAS,MAAM,EAAE,CAAC;CACxC;AAED;;GAEG;AACH,MAAM,WAAW,uBAAuB;IACtC;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAC;IACjB;;OAEG;IACH,aAAa,EAAE,MAAM,CAAC;IACtB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;CACd"}

package/dist/models/managed-user.d.ts

@@ -0,0 +1,44 @@
+import { ApiPaginationLink } from './api';
+/**
+ * A user record managed through the ThunderID management API.
+ *
+ * This is a server record, distinct from {@link User}, which describes the signed-in user.
+ */
+export interface ManagedUser {
+    attributes?: Record<string, unknown>;
+    display?: string;
+    id: string;
+    isReadOnly?: boolean;
+    ouHandle?: string;
+    ouId: string;
+    type: string;
+}
+/**
+ * A page of users.
+ */
+export interface ManagedUserListResponse {
+    count: number;
+    links?: ApiPaginationLink[];
+    startIndex: number;
+    totalResults: number;
+    users: ManagedUser[];
+}
+/**
+ * The payload used to create a user.
+ */
+export interface CreateManagedUserRequest {
+    attributes?: Record<string, unknown>;
+    groups?: string[];
+    ouId: string;
+    type: string;
+}
+/**
+ * The payload used to update a user.
+ */
+export interface UpdateManagedUserRequest {
+    attributes?: Record<string, unknown>;
+    groups?: string[];
+    ouId?: string;
+    type?: string;
+}
+//# sourceMappingURL=managed-user.d.ts.map

package/dist/models/managed-user.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"managed-user.d.ts","sourceRoot":"","sources":["../../src/models/managed-user.ts"],"names":[],"mappings":"AAGA,OAAO,EAAC,iBAAiB,EAAC,MAAM,OAAO,CAAC;AAExC;;;;GAIG;AACH,MAAM,WAAW,WAAW;IAC1B,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACrC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,EAAE,EAAE,MAAM,CAAC;IACX,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;GAEG;AACH,MAAM,WAAW,uBAAuB;IACtC,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,iBAAiB,EAAE,CAAC;IAC5B,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,WAAW,EAAE,CAAC;CACtB;AAED;;GAEG;AACH,MAAM,WAAW,wBAAwB;IACvC,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACrC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;GAEG;AACH,MAAM,WAAW,wBAAwB;IACvC,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACrC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;CACf"}

package/dist/utils/AuthenticationHelper.d.ts

@@ -1,4 +1,5 @@
 import { IsomorphicCrypto } from '../IsomorphicCrypto';
+import { LogoutTokenClaims } from '../models/logout-token';
 import { OIDCDiscoveryEndpointsApiResponse, OIDCDiscoveryApiResponse } from '../models/oidc-discovery';
 import { TokenResponse } from '../models/token';
 import { User } from '../models/user';
@@ -14,6 +15,9 @@ declare class AuthenticationHelper<T> {
     private config;
     private oidcProviderMetaData;
     private cryptoHelper;
+    private jwksCache;
+    private jwksFetch;
+    private jwksFetchStartedAt;
     /**
      * Creates a new `AuthenticationHelper` instance.
      *
@@ -65,6 +69,33 @@ declare class AuthenticationHelper<T> {
      * @throws {ThunderIDAuthException} When the JWKS endpoint is missing or the request fails.
      */
     validateIdToken(idToken: string): Promise<boolean>;
+    /**
+     * Validates a back-channel logout token: its type, event, issuer, audience and lifetime, then its
+     * signature against the server's keys. The claims are checked first, so a malformed token costs
+     * neither a key fetch nor a signature check.
+     *
+     * @param logoutToken - The raw `logout_token` the server posted.
+     * @returns The token's claims.
+     * @throws {InvalidLogoutTokenError} When the token is not valid.
+     */
+    validateLogoutToken(logoutToken: string): Promise<LogoutTokenClaims>;
+    /**
+     * Returns the server key with the given identifier from a cached key set. An unknown identifier
+     * triggers one re-fetch, to follow key rotation, no more often than the minimum interval: the
+     * logout endpoint is unauthenticated, so an unbounded re-fetch would let anyone drive requests
+     * to the server. Requests that arrive while a fetch runs share it.
+     */
+    private getCachedJwk;
+    /**
+     * Fetches the key set unless a fetch is already running, in which case that one is shared.
+     */
+    private fetchJwksOnce;
+    /**
+     * Fetches the server's JSON Web Key Set.
+     *
+     * @throws {ThunderIDAuthException} When the JWKS endpoint is missing or the request fails.
+     */
+    private fetchJwks;
     /**
      * Extracts user information from a decoded ID token payload.
      *

package/dist/utils/AuthenticationHelper.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"AuthenticationHelper.d.ts","sourceRoot":"","sources":["../../src/utils/AuthenticationHelper.ts"],"names":[],"mappings":"AASA,OAAO,EAAC,gBAAgB,EAAC,MAAM,qBAAqB,CAAC;AAGrD,OAAO,EAAC,iCAAiC,EAAE,wBAAwB,EAAC,MAAM,0BAA0B,CAAC;AAErG,OAAO,EAAU,aAAa,EAAyB,MAAM,iBAAiB,CAAC;AAC/E,OAAO,EAAC,IAAI,EAAC,MAAM,gBAAgB,CAAC;AACpC,OAAO,cAAc,MAAM,mBAAmB,CAAC;AAE/C;;;;;GAKG;AACH,cAAM,oBAAoB,CAAC,CAAC;IAC1B,OAAO,CAAC,cAAc,CAAoB;IAE1C,OAAO,CAAC,MAAM,CAAqC;IAEnD,OAAO,CAAC,oBAAoB,CAA0C;IAEtE,OAAO,CAAC,YAAY,CAAmB;IAEvC;;;;;OAKG;gBACgB,sBAAsB,EAAE,cAAc,CAAC,CAAC,CAAC,EAAE,oBAAoB,EAAE,gBAAgB;IAQpG;;;;;;;;;OASG;IACH,OAAO,CAAC,0BAA0B;IAkBlC;;;;;;OAMG;IACU,gBAAgB,CAAC,QAAQ,EAAE,wBAAwB,GAAG,OAAO,CAAC,wBAAwB,CAAC;IAMpG;;;;;;OAMG;IACU,0BAA0B,IAAI,OAAO,CAAC,iCAAiC,CAAC;IAyCrF;;;;;;;OAOG;IACU,yBAAyB,IAAI,OAAO,CAAC,iCAAiC,CAAC;IAmCpF;;;;;;OAMG;IACU,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAsD/D;;;;;OAKG;IACI,wBAAwB,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI;IAetD;;;;;;;OAOG;IACU,8BAA8B,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IA6C3F;;;;OAIG;IACU,YAAY,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAKzD;;;;;;;;OAQG;IACU,mBAAmB,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC;CA2C9F;AAED,eAAe,oBAAoB,CAAC"}
+{"version":3,"file":"AuthenticationHelper.d.ts","sourceRoot":"","sources":["../../src/utils/AuthenticationHelper.ts"],"names":[],"mappings":"AAYA,OAAO,EAAC,gBAAgB,EAAC,MAAM,qBAAqB,CAAC;AAGrD,OAAO,EAAC,iBAAiB,EAAC,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAC,iCAAiC,EAAE,wBAAwB,EAAC,MAAM,0BAA0B,CAAC;AAErG,OAAO,EAAU,aAAa,EAAyB,MAAM,iBAAiB,CAAC;AAC/E,OAAO,EAAC,IAAI,EAAC,MAAM,gBAAgB,CAAC;AACpC,OAAO,cAAc,MAAM,mBAAmB,CAAC;AAE/C;;;;;GAKG;AACH,cAAM,oBAAoB,CAAC,CAAC;IAC1B,OAAO,CAAC,cAAc,CAAoB;IAE1C,OAAO,CAAC,MAAM,CAAqC;IAEnD,OAAO,CAAC,oBAAoB,CAA0C;IAEtE,OAAO,CAAC,YAAY,CAAmB;IAEvC,OAAO,CAAC,SAAS,CAAwD;IAIzE,OAAO,CAAC,SAAS,CAAsC;IAEvD,OAAO,CAAC,kBAAkB,CAAK;IAE/B;;;;;OAKG;gBACgB,sBAAsB,EAAE,cAAc,CAAC,CAAC,CAAC,EAAE,oBAAoB,EAAE,gBAAgB;IAQpG;;;;;;;;;OASG;IACH,OAAO,CAAC,0BAA0B;IAkBlC;;;;;;OAMG;IACU,gBAAgB,CAAC,QAAQ,EAAE,wBAAwB,GAAG,OAAO,CAAC,wBAAwB,CAAC;IAMpG;;;;;;OAMG;IACU,0BAA0B,IAAI,OAAO,CAAC,iCAAiC,CAAC;IAyCrF;;;;;;;OAOG;IACU,yBAAyB,IAAI,OAAO,CAAC,iCAAiC,CAAC;IAmCpF;;;;;;OAMG;IACU,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAiB/D;;;;;;;;OAQG;IACU,mBAAmB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC;IA2CjF;;;;;OAKG;YACW,YAAY;IAiC1B;;OAEG;IACH,OAAO,CAAC,aAAa;IAiBrB;;;;OAIG;YACW,SAAS;IA0CvB;;;;;OAKG;IACI,wBAAwB,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI;IAetD;;;;;;;OAOG;IACU,8BAA8B,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IA6C3F;;;;OAIG;IACU,YAAY,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAKzD;;;;;;;;OAQG;IACU,mBAAmB,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC;CA2C9F;AAED,eAAe,oBAAoB,CAAC"}

package/dist/utils/evaluateChangePasswordForm.d.ts

@@ -0,0 +1,64 @@
+import { PasswordPolicy, PasswordRuleResult } from './evaluatePasswordPolicy';
+/**
+ * The two values a change-password form collects.
+ *
+ * There is deliberately no `currentPassword` here. The self-service credential write
+ * endpoint does not verify the account's existing value today, so a field the server
+ * ignores would only teach the user a false sense of security; once server-side
+ * current-value verification ships, this form gains that field back.
+ */
+export interface ChangePasswordFormValues {
+    /**
+     * The re-typed new password, used only to catch typos client-side.
+     */
+    confirmPassword: string;
+    /**
+     * The password to set.
+     */
+    newPassword: string;
+}
+/**
+ * The derived state a change-password form needs to render and to gate submission.
+ */
+export interface ChangePasswordFormEvaluation {
+    /**
+     * Whether the new password and its confirmation match.
+     */
+    confirmMatches: boolean;
+    /**
+     * Whether the values are complete and internally consistent. Callers combine this with
+     * their own in-flight flag, since whether a request is pending is UI state rather than
+     * validation.
+     */
+    isValid: boolean;
+    /**
+     * Whether the new password satisfies every configured rule.
+     */
+    meetsPolicy: boolean;
+    /**
+     * Per-rule results, for the live requirement checklist.
+     */
+    ruleResults: PasswordRuleResult[];
+}
+/**
+ * Evaluates a change-password form against a policy.
+ *
+ * Every predicate a change-password UI needs is derived here so the React and Vue
+ * components stay pure rendering concerns and cannot drift apart on what counts as a
+ * submittable form.
+ *
+ * @param values - The current field values.
+ * @param policy - The rules the new password must satisfy.
+ * @returns The derived flags plus the per-rule results.
+ * @example
+ * ```typescript
+ * const {isValid, ruleResults} = evaluateChangePasswordForm(
+ *   {confirmPassword, newPassword},
+ *   {regex: '^.{12,}$'},
+ * );
+ * const canSubmit = !loading && isValid;
+ * ```
+ */
+declare const evaluateChangePasswordForm: (values: ChangePasswordFormValues, policy: PasswordPolicy) => ChangePasswordFormEvaluation;
+export default evaluateChangePasswordForm;
+//# sourceMappingURL=evaluateChangePasswordForm.d.ts.map

package/dist/utils/evaluateChangePasswordForm.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"evaluateChangePasswordForm.d.ts","sourceRoot":"","sources":["../../src/utils/evaluateChangePasswordForm.ts"],"names":[],"mappings":"AAGA,OAA+B,EAAC,cAAc,EAAE,kBAAkB,EAAC,MAAM,0BAA0B,CAAC;AAEpG;;;;;;;GAOG;AACH,MAAM,WAAW,wBAAwB;IACvC;;OAEG;IACH,eAAe,EAAE,MAAM,CAAC;IACxB;;OAEG;IACH,WAAW,EAAE,MAAM,CAAC;CACrB;AAED;;GAEG;AACH,MAAM,WAAW,4BAA4B;IAC3C;;OAEG;IACH,cAAc,EAAE,OAAO,CAAC;IACxB;;;;OAIG;IACH,OAAO,EAAE,OAAO,CAAC;IACjB;;OAEG;IACH,WAAW,EAAE,OAAO,CAAC;IACrB;;OAEG;IACH,WAAW,EAAE,kBAAkB,EAAE,CAAC;CACnC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,QAAA,MAAM,0BAA0B,GAC9B,QAAQ,wBAAwB,EAChC,QAAQ,cAAc,KACrB,4BAUF,CAAC;AAEF,eAAe,0BAA0B,CAAC"}

package/dist/utils/evaluatePasswordPolicy.d.ts

@@ -0,0 +1,60 @@
+/**
+ * Client-side password rule used to drive both the requirement checklist and the
+ * submit gate of a change-password form.
+ *
+ * The server does not enforce the user type schema's `password` regex on the credential
+ * write path, and the default schema ships without a regex at all, so this rule is
+ * advisory: it exists to give the user actionable feedback before the request is sent.
+ * The schema's `regex` is the sole source of truth; the SDK does not layer its own
+ * character-class or length rules on top, since doing so could reject a password the
+ * organization's policy accepts.
+ */
+export interface PasswordPolicy {
+    /**
+     * A regular expression the whole value must match. Typically sourced from the
+     * `password` attribute's `regex` in `GET /users/me/meta`.
+     */
+    regex?: string;
+}
+/**
+ * The outcome of the password rule.
+ */
+export interface PasswordRuleResult {
+    /**
+     * Stable identifier for the rule, usable as a React key or test selector.
+     */
+    key: string;
+    /**
+     * i18n key describing the requirement. Resolved by the consuming component rather
+     * than here, so this module stays free of translation concerns.
+     */
+    messageKey: string;
+    /**
+     * Substitution params for `messageKey`, in the `{token}` form the i18n layer expects.
+     */
+    params?: Record<string, string | number>;
+    /**
+     * Whether the value satisfies this rule.
+     */
+    passed: boolean;
+}
+/**
+ * Evaluates a password against a policy, returning one result when the policy configures
+ * a `regex` and none otherwise.
+ *
+ * An uncompilable `regex` is treated as passing, matching `evaluateValidationRule`:
+ * the SDK stays lenient so a misconfigured schema cannot lock a user out of their own
+ * password change.
+ *
+ * @param value - The candidate password.
+ * @param policy - The rule to apply.
+ * @returns A single-item list when `policy.regex` is set, otherwise an empty list.
+ * @example
+ * ```typescript
+ * const results = evaluatePasswordPolicy('sh0rt', {regex: '^.{8,}$'});
+ * const isValid = results.every(result => result.passed);
+ * ```
+ */
+declare const evaluatePasswordPolicy: (value: string, policy: PasswordPolicy) => PasswordRuleResult[];
+export default evaluatePasswordPolicy;
+//# sourceMappingURL=evaluatePasswordPolicy.d.ts.map

package/dist/utils/evaluatePasswordPolicy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"evaluatePasswordPolicy.d.ts","sourceRoot":"","sources":["../../src/utils/evaluatePasswordPolicy.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;GAUG;AACH,MAAM,WAAW,cAAc;IAC7B;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC;;OAEG;IACH,GAAG,EAAE,MAAM,CAAC;IACZ;;;OAGG;IACH,UAAU,EAAE,MAAM,CAAC;IACnB;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC,CAAC;IACzC;;OAEG;IACH,MAAM,EAAE,OAAO,CAAC;CACjB;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,QAAA,MAAM,sBAAsB,GAAI,OAAO,MAAM,EAAE,QAAQ,cAAc,KAAG,kBAAkB,EAqBzF,CAAC;AAEF,eAAe,sBAAsB,CAAC"}

package/dist/utils/mapCredentialUpdateError.d.ts

@@ -0,0 +1,31 @@
+/**
+ * The form field a credential-update failure belongs to, or `null` when the failure has
+ * no single field to blame and belongs at form level.
+ */
+export type CredentialUpdateErrorField = 'newPassword' | null;
+/**
+ * Where a credential-update failure should be shown, and what it should say.
+ *
+ * `messageKey` is always set, so the caller can resolve text with a plain
+ * `message ?? t(messageKey)` and never needs a non-null assertion. `message` is present
+ * only when the server supplied something human-readable, and takes precedence when it
+ * is. Translation is left to the caller, which keeps this module free of i18n concerns
+ * in the same way {@link evaluatePasswordPolicy} is.
+ */
+export interface CredentialUpdateErrorResult {
+    /**
+     * The field to attach the error to, or `null` for a form-level error.
+     */
+    field: CredentialUpdateErrorField;
+    /**
+     * A server-supplied message, already human-readable. Shown as-is when present.
+     */
+    message?: string;
+    /**
+     * The i18n key to fall back to when `message` is absent. Always set.
+     */
+    messageKey: string;
+}
+declare const mapCredentialUpdateError: (error: unknown) => CredentialUpdateErrorResult;
+export default mapCredentialUpdateError;
+//# sourceMappingURL=mapCredentialUpdateError.d.ts.map

package/dist/utils/mapCredentialUpdateError.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mapCredentialUpdateError.d.ts","sourceRoot":"","sources":["../../src/utils/mapCredentialUpdateError.ts"],"names":[],"mappings":"AAMA;;;GAGG;AACH,MAAM,MAAM,0BAA0B,GAAG,aAAa,GAAG,IAAI,CAAC;AAE9D;;;;;;;;GAQG;AACH,MAAM,WAAW,2BAA2B;IAC1C;;OAEG;IACH,KAAK,EAAE,0BAA0B,CAAC;IAClC;;OAEG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;OAEG;IACH,UAAU,EAAE,MAAM,CAAC;CACpB;AAyBD,QAAA,MAAM,wBAAwB,GAAI,OAAO,OAAO,KAAG,2BAYlD,CAAC;AAEF,eAAe,wBAAwB,CAAC"}

package/dist/utils/parseKeyValuePairs.d.ts

@@ -0,0 +1,21 @@
+import { KeyValuePair } from '../models/embedded-flow';
+/**
+ * Reads the label and value pairs a KEY_VALUE_LIST renders from the raw value found under its
+ * `source` key in `additionalData`. The server publishes them as a JSON-encoded array, since
+ * additional data carries strings, so both an array and its encoding are accepted.
+ *
+ * Entries that are not objects, or that carry no value, are dropped, since an empty row tells the
+ * user nothing. Anything that is not a list of pairs yields none.
+ *
+ * @param raw - The raw value found under the source key.
+ * @returns The pairs to render, empty when the value holds none.
+ *
+ * @example
+ * ```typescript
+ * parseKeyValuePairs('[{"label":"Email","value":"a@b.com"}]'); // [{label: 'Email', value: 'a@b.com'}]
+ * parseKeyValuePairs('not json');                              // []
+ * ```
+ */
+declare const parseKeyValuePairs: (raw: unknown) => KeyValuePair[];
+export default parseKeyValuePairs;
+//# sourceMappingURL=parseKeyValuePairs.d.ts.map

package/dist/utils/parseKeyValuePairs.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"parseKeyValuePairs.d.ts","sourceRoot":"","sources":["../../src/utils/parseKeyValuePairs.ts"],"names":[],"mappings":"AAGA,OAAO,EAAC,YAAY,EAAC,MAAM,yBAAyB,CAAC;AAErD;;;;;;;;;;;;;;;;GAgBG;AACH,QAAA,MAAM,kBAAkB,GAAI,KAAK,OAAO,KAAG,YAAY,EA2BtD,CAAC;AAEF,eAAe,kBAAkB,CAAC"}

package/dist/utils/requestManagementResource.d.ts

@@ -0,0 +1,41 @@
+import { ManagementRequestConfig } from '../models/api';
+/**
+ * Describes a single request against a management API resource collection.
+ */
+export interface ManagementResourceRequest {
+    /**
+     * Request payload, serialized as JSON.
+     */
+    body?: unknown;
+    /**
+     * Collection path segment appended to `baseUrl` when no `url` is given (e.g. `applications`).
+     */
+    collection: string;
+    /**
+     * Message prefix used when the server rejects the request.
+     */
+    failureMessage: string;
+    /**
+     * Identifier of a single resource. When set, the request targets `{collectionUrl}/{id}`.
+     */
+    id?: string;
+    method: 'GET' | 'POST' | 'PUT' | 'DELETE';
+    /**
+     * Name of the calling operation, used as the prefix of every error code it raises.
+     */
+    operation: string;
+    /**
+     * Query parameters. `undefined` values are omitted.
+     */
+    query?: Record<string, string | number | undefined>;
+}
+/**
+ * Performs a request against a management API resource and maps failures onto
+ * {@link ThunderIDAPIError}. HTTP 403 and 404 get their own codes so a caller can tell a missing
+ * permission from a missing resource.
+ *
+ * @returns The parsed JSON body, or `undefined` when the server returns no content.
+ */
+declare const requestManagementResource: <T>({ baseUrl, url, fetcher, ...requestConfig }: ManagementRequestConfig, { body, collection, failureMessage, id, method, operation, query }: ManagementResourceRequest) => Promise<T>;
+export default requestManagementResource;
+//# sourceMappingURL=requestManagementResource.d.ts.map

package/dist/utils/requestManagementResource.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"requestManagementResource.d.ts","sourceRoot":"","sources":["../../src/utils/requestManagementResource.ts"],"names":[],"mappings":"AAIA,OAAO,EAAC,uBAAuB,EAAC,MAAM,eAAe,CAAC;AAEtD;;GAEG;AACH,MAAM,WAAW,yBAAyB;IACxC;;OAEG;IACH,IAAI,CAAC,EAAE,OAAO,CAAC;IACf;;OAEG;IACH,UAAU,EAAE,MAAM,CAAC;IACnB;;OAEG;IACH,cAAc,EAAE,MAAM,CAAC;IACvB;;OAEG;IACH,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,KAAK,GAAG,MAAM,GAAG,KAAK,GAAG,QAAQ,CAAC;IAC1C;;OAEG;IACH,SAAS,EAAE,MAAM,CAAC;IAClB;;OAEG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC,CAAC;CACrD;AAED;;;;;;GAMG;AACH,QAAA,MAAM,yBAAyB,GAAU,CAAC,EACxC,6CAA2C,uBAAuB,EAClE,oEAAkE,yBAAyB,KAC1F,OAAO,CAAC,CAAC,CA0FX,CAAC;AAEF,eAAe,yBAAyB,CAAC"}

package/dist/utils/resolveChangeCredentialPolicy.d.ts

@@ -0,0 +1,24 @@
+import { PasswordPolicy } from './evaluatePasswordPolicy';
+import { AttributeSchema } from '../api/getUsersMeMeta';
+/**
+ * Resolves the rules a change-credential form should enforce for the given credential.
+ *
+ * The organization's own policy, expressed as the credential attribute's `regex` in
+ * `GET /users/me/meta`, is the sole source of truth: the SDK does not layer its own
+ * character-class or length rules on top, since doing so could reject a value the
+ * organization's policy accepts. When the schema carries no regex for this credential,
+ * there is no policy to check client-side and the requirement checklist is simply empty.
+ *
+ * @param userSchema - The user type schema resolved by the provider, keyed by attribute.
+ * @param attribute - The credential attribute this form manages (e.g. `password`, `pin`).
+ * @param override - An explicit policy supplied by the caller, which wins outright.
+ * @returns The policy to hand to {@link evaluatePasswordPolicy}.
+ * @example
+ * ```typescript
+ * const policy = resolveChangeCredentialPolicy(userSchema, 'pin', undefined);
+ * const results = evaluatePasswordPolicy(candidate, policy);
+ * ```
+ */
+declare const resolveChangeCredentialPolicy: (userSchema: Record<string, AttributeSchema> | null | undefined, attribute: string, override?: PasswordPolicy) => PasswordPolicy;
+export default resolveChangeCredentialPolicy;
+//# sourceMappingURL=resolveChangeCredentialPolicy.d.ts.map

package/dist/utils/resolveChangeCredentialPolicy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolveChangeCredentialPolicy.d.ts","sourceRoot":"","sources":["../../src/utils/resolveChangeCredentialPolicy.ts"],"names":[],"mappings":"AAGA,OAAO,EAAC,cAAc,EAAC,MAAM,0BAA0B,CAAC;AACxD,OAAO,EAAC,eAAe,EAAC,MAAM,uBAAuB,CAAC;AAEtD;;;;;;;;;;;;;;;;;;GAkBG;AACH,QAAA,MAAM,6BAA6B,GACjC,YAAY,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,GAAG,IAAI,GAAG,SAAS,EAC9D,WAAW,MAAM,EACjB,WAAW,cAAc,KACxB,cAQF,CAAC;AAEF,eAAe,6BAA6B,CAAC"}

package/dist/utils/resolveResourceEndpoint.d.ts

@@ -8,7 +8,7 @@ import { BaseConfig } from '../models/config';
  * issuers), these overrides let the SDK send flow and user-management requests to the resource
  * server while OAuth requests continue to target the authorization server.
  */
-export type ResourceEndpointKey = 'flowExecute' | 'flowMeta' | 'usersMe' | 'usersMeMeta';
+export type ResourceEndpointKey = 'agents' | 'applications' | 'flowExecute' | 'flowMeta' | 'users' | 'usersMe' | 'usersMeCredentials' | 'usersMeMeta';
 /**
  * The `config.endpoints` keys that address resource-server endpoints rather than OIDC/OAuth
  * endpoints. Used to keep these overrides out of the resolved OIDC provider metadata.

package/dist/utils/resolveResourceEndpoint.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resolveResourceEndpoint.d.ts","sourceRoot":"","sources":["../../src/utils/resolveResourceEndpoint.ts"],"names":[],"mappings":"AAGA,OAAO,EAAC,UAAU,EAAC,MAAM,kBAAkB,CAAC;AAE5C;;;;;;;;GAQG;AACH,MAAM,MAAM,mBAAmB,GAAG,aAAa,GAAG,UAAU,GAAG,SAAS,GAAG,aAAa,CAAC;AAEzF;;;GAGG;AACH,eAAO,MAAM,sBAAsB,EAAE,SAAS,mBAAmB,EAKhE,CAAC;AAEF;;;GAGG;AACH,MAAM,WAAW,sBAAsB;IACrC,SAAS,CAAC,EAAE,UAAU,CAAC,WAAW,CAAC,CAAC;CACrC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,QAAA,MAAM,uBAAuB,GAC3B,KAAK,mBAAmB,EACxB,QAAQ,sBAAsB,GAAG,SAAS,EAC1C,cAAc,MAAM,KACnB,MAAM,GAAG,SAAiE,CAAC;AAE9E,eAAe,uBAAuB,CAAC"}
+{"version":3,"file":"resolveResourceEndpoint.d.ts","sourceRoot":"","sources":["../../src/utils/resolveResourceEndpoint.ts"],"names":[],"mappings":"AAGA,OAAO,EAAC,UAAU,EAAC,MAAM,kBAAkB,CAAC;AAE5C;;;;;;;;GAQG;AACH,MAAM,MAAM,mBAAmB,GAC3B,QAAQ,GACR,cAAc,GACd,aAAa,GACb,UAAU,GACV,OAAO,GACP,SAAS,GACT,oBAAoB,GACpB,aAAa,CAAC;AAElB;;;GAGG;AACH,eAAO,MAAM,sBAAsB,EAAE,SAAS,mBAAmB,EAShE,CAAC;AAEF;;;GAGG;AACH,MAAM,WAAW,sBAAsB;IACrC,SAAS,CAAC,EAAE,UAAU,CAAC,WAAW,CAAC,CAAC;CACrC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,QAAA,MAAM,uBAAuB,GAC3B,KAAK,mBAAmB,EACxB,QAAQ,sBAAsB,GAAG,SAAS,EAC1C,cAAc,MAAM,KACnB,MAAM,GAAG,SAAiE,CAAC;AAE9E,eAAe,uBAAuB,CAAC"}

package/dist/utils/supportsCredential.d.ts

@@ -0,0 +1,32 @@
+import { AttributeSchema } from '../api/getUsersMeMeta';
+/**
+ * Whether the signed-in user's type allows them to set the given credential for themselves.
+ *
+ * The user type schema from `GET /users/me/meta` is the only thing a client can check before
+ * rendering. It says whether the credential is declared on this type at all, which is a property
+ * of the type rather than of the account, so it cannot say whether this particular user has one
+ * stored today. That second question is the server's to answer.
+ *
+ * Without this check the form would submit into a guaranteed failure. `POST
+ * /users/me/update-credentials` rejects a write for a name not declared on the type, since the
+ * entity layer only accepts schema-declared credential keys.
+ *
+ * An absent schema means the answer is not known yet, either because the profile is still loading
+ * or because the consuming app never supplied one. Both resolve to `true` so a change-credential
+ * affordance is never hidden on missing information alone, and so apps that do not wire up
+ * `userSchema` keep the behaviour they had before this check existed.
+ *
+ * @param userSchema - The user type schema resolved by the provider, keyed by attribute.
+ * @param attribute - The credential attribute to check (e.g. `password`, `pin`).
+ * @returns `false` only when the schema is known and either defines no attribute named
+ * `attribute` or defines one that isn't marked `credential: true`.
+ * @example
+ * ```typescript
+ * if (!supportsCredential(userSchema, 'pin')) {
+ *   return null;
+ * }
+ * ```
+ */
+declare const supportsCredential: (userSchema: Record<string, AttributeSchema> | null | undefined, attribute: string) => boolean;
+export default supportsCredential;
+//# sourceMappingURL=supportsCredential.d.ts.map

package/dist/utils/supportsCredential.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"supportsCredential.d.ts","sourceRoot":"","sources":["../../src/utils/supportsCredential.ts"],"names":[],"mappings":"AAGA,OAAO,EAAC,eAAe,EAAC,MAAM,uBAAuB,CAAC;AAEtD;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,QAAA,MAAM,kBAAkB,GACtB,YAAY,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,GAAG,IAAI,GAAG,SAAS,EAC9D,WAAW,MAAM,KAChB,OAMF,CAAC;AAEF,eAAe,kBAAkB,CAAC"}

package/dist/utils/validateLogoutTokenClaims.d.ts

@@ -0,0 +1,15 @@
+import { LogoutTokenClaims, LogoutTokenValidationOptions } from '../models/logout-token';
+/**
+ * Checks the header and claims of a back-channel logout token, per OpenID Connect Back-Channel
+ * Logout 1.0 section 2.6. It does not verify the signature: the caller does that with the server's
+ * keys. Messages never include the token or its claim values.
+ *
+ * @param header - The decoded JOSE header.
+ * @param payload - The decoded claims.
+ * @param options - The issuer, client and clock the claims are checked against.
+ * @returns The claims, typed.
+ * @throws {InvalidLogoutTokenError} When any check fails.
+ */
+declare const validateLogoutTokenClaims: (header: unknown, payload: unknown, options: LogoutTokenValidationOptions) => LogoutTokenClaims;
+export default validateLogoutTokenClaims;
+//# sourceMappingURL=validateLogoutTokenClaims.d.ts.map

package/dist/utils/validateLogoutTokenClaims.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validateLogoutTokenClaims.d.ts","sourceRoot":"","sources":["../../src/utils/validateLogoutTokenClaims.ts"],"names":[],"mappings":"AAKA,OAAO,EAAC,iBAAiB,EAAE,4BAA4B,EAAC,MAAM,wBAAwB,CAAC;AAWvF;;;;;;;;;;GAUG;AACH,QAAA,MAAM,yBAAyB,GAC7B,QAAQ,OAAO,EACf,SAAS,OAAO,EAChB,SAAS,4BAA4B,KACpC,iBA4DF,CAAC;AAEF,eAAe,yBAAyB,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@thunderid/javascript",
-  "version": "1.0.7",
+  "version": "1.2.0",
   "description": "JavaScript Ecosystem SDK for ThunderID",
   "keywords": [
     "thunderid",
@@ -44,7 +44,7 @@
     "rimraf": "6.1.3",
     "rolldown": "1.0.0-beta.45",
     "typescript": "5.9.3",
-    "vitest": "4.1.10"
+    "vitest": "4.1.11"
   },
   "dependencies": {
     "jose": "6.2.3",