@thunderid/javascript 1.1.0 → 1.3.0

package/dist/IsomorphicCrypto.d.ts

@@ -42,6 +42,24 @@ export declare class IsomorphicCrypto<T = any> {
      * @throws
      */
     isValidIdToken(idToken: string, jwk: JWKInterface, clientId: string, issuer: string, username: string, clockTolerance: number | undefined, validateJwtIssuer: boolean | undefined): Promise<boolean>;
+    /**
+     * Verifies the signature of a back-channel logout token, along with its audience, issuer,
+     * lifetime and, when the token has one, subject.
+     *
+     * @param logoutToken - The logout token received from the server.
+     * @param jwk - The server key the token names.
+     * @param clientId - The client the token must be addressed to.
+     * @param issuer - The expected issuer.
+     * @param subject - The token's subject, when it has one.
+     * @param clockTolerance - Allowed clock difference in seconds.
+     *
+     * @throws {InvalidLogoutTokenError} When verification fails. The message never includes the token.
+     */
+    verifyLogoutTokenSignature(logoutToken: string, jwk: JWKInterface, clientId: string, issuer: string, subject: string | undefined, clockTolerance: number): Promise<void>;
+    /**
+     * Decodes the JOSE header of a JWT without verifying its signature.
+     */
+    decodeJwtHeader<R = Record<string, unknown>>(token: string): R;
     decodeJwtToken<R = Record<string, unknown>>(token: string): R;
 }
 //# sourceMappingURL=IsomorphicCrypto.d.ts.map

package/dist/IsomorphicCrypto.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"IsomorphicCrypto.d.ts","sourceRoot":"","sources":["../src/IsomorphicCrypto.ts"],"names":[],"mappings":"AAKA,OAAO,EAAC,MAAM,EAAE,YAAY,EAAC,MAAM,iBAAiB,CAAC;AAErD,qBAAa,gBAAgB,CAAC,CAAC,GAAG,GAAG;IACnC,OAAO,CAAC,WAAW,CAAY;gBAEZ,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC;IAIzC;;;;OAIG;IACI,eAAe,IAAI,MAAM;IAIhC;;;;;;OAMG;IACU,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAKhE;;;;;;;;;OASG;IAEI,mBAAmB,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,YAAY;IAoBjF;;;;;;;;;;;;;OAaG;IACI,cAAc,CACnB,OAAO,EAAE,MAAM,EACf,GAAG,EAAE,YAAY,EACjB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,cAAc,EAAE,MAAM,GAAG,SAAS,EAClC,iBAAiB,EAAE,OAAO,GAAG,SAAS,GACrC,OAAO,CAAC,OAAO,CAAC;IA4BZ,cAAc,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,KAAK,EAAE,MAAM,GAAG,CAAC;CAUrE"}
+{"version":3,"file":"IsomorphicCrypto.d.ts","sourceRoot":"","sources":["../src/IsomorphicCrypto.ts"],"names":[],"mappings":"AAKA,OAAO,EAAC,MAAM,EAAE,YAAY,EAAC,MAAM,iBAAiB,CAAC;AAErD,qBAAa,gBAAgB,CAAC,CAAC,GAAG,GAAG;IACnC,OAAO,CAAC,WAAW,CAAY;gBAEZ,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC;IAIzC;;;;OAIG;IACI,eAAe,IAAI,MAAM;IAIhC;;;;;;OAMG;IACU,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAKhE;;;;;;;;;OASG;IAEI,mBAAmB,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,YAAY;IAoBjF;;;;;;;;;;;;;OAaG;IACI,cAAc,CACnB,OAAO,EAAE,MAAM,EACf,GAAG,EAAE,YAAY,EACjB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,cAAc,EAAE,MAAM,GAAG,SAAS,EAClC,iBAAiB,EAAE,OAAO,GAAG,SAAS,GACrC,OAAO,CAAC,OAAO,CAAC;IA4BnB;;;;;;;;;;;;OAYG;IACU,0BAA0B,CACrC,WAAW,EAAE,MAAM,EACnB,GAAG,EAAE,YAAY,EACjB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,MAAM,GAAG,SAAS,EAC3B,cAAc,EAAE,MAAM,GACrB,OAAO,CAAC,IAAI,CAAC;IA2BhB;;OAEG;IACI,eAAe,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,KAAK,EAAE,MAAM,GAAG,CAAC;IAY9D,cAAc,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,KAAK,EAAE,MAAM,GAAG,CAAC;CAUrE"}

package/dist/StorageManager.d.ts

@@ -27,6 +27,7 @@ declare class StorageManager<T> {
     setPersistedData(persistedData: Partial<TemporaryStore>, userId?: string): Promise<void>;
     getSessionData(userId?: string, instanceId?: string): Promise<SessionData>;
     getCustomData<K>(key: string, userId?: string): Promise<K>;
+    removeCustomData(key: string, userId?: string): Promise<void>;
     setSessionStatus(status: string): void;
     getSessionStatus(): string;
     removeSessionStatus(): void;

package/dist/StorageManager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"StorageManager.d.ts","sourceRoot":"","sources":["../src/StorageManager.ts"],"names":[],"mappings":"AAGA,OAAO,EAAC,gBAAgB,EAAC,MAAM,iBAAiB,CAAC;AACjD,OAAO,EAAC,wBAAwB,EAAC,MAAM,yBAAyB,CAAC;AACjE,OAAO,EAAC,WAAW,EAAC,MAAM,kBAAkB,CAAC;AAC7C,OAAO,EAAC,MAAM,EAAE,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,mBAAmB,EAAC,MAAM,gBAAgB,CAAC;AAIjG,KAAK,WAAW,CAAC,CAAC,IAAI,OAAO,CAC3B,gBAAgB,CAAC,CAAC,CAAC,GAAG,wBAAwB,GAAG,WAAW,GAAG,cAAc,GAAG,WAAW,CAC5F,CAAC;AAEF,cAAM,cAAc,CAAC,CAAC;IACpB,SAAS,CAAC,EAAE,EAAE,MAAM,CAAC;IAErB,SAAS,CAAC,KAAK,EAAE,OAAO,CAAC;IAEzB,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC;gBAEN,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,GAAE,MAAsC;cAMrF,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;cAU/D,QAAQ,CACtB,GAAG,EAAE,MAAM,EACX,SAAS,EAAE,MAAM,gBAAgB,CAAC,CAAC,CAAC,GAAG,MAAM,wBAAwB,GAAG,MAAM,WAAW,GAAG,MAAM,cAAc,EAChH,KAAK,EAAE,mBAAmB,GACzB,OAAO,CAAC,IAAI,CAAC;cAUA,WAAW,CACzB,GAAG,EAAE,MAAM,EACX,SAAS,EAAE,MAAM,gBAAgB,CAAC,CAAC,CAAC,GAAG,MAAM,wBAAwB,GAAG,MAAM,WAAW,GAAG,MAAM,cAAc,GAC/G,OAAO,CAAC,IAAI,CAAC;IAahB,SAAS,CAAC,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,MAAM;IAa1F,SAAS,CAAC,MAAM,CAAC,uBAAuB,IAAI,OAAO;IAatC,aAAa,CAAC,MAAM,EAAE,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IAIlE,uBAAuB,CAAC,oBAAoB,EAAE,OAAO,CAAC,wBAAwB,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IAI/F,gBAAgB,CAAC,aAAa,EAAE,OAAO,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIxF,aAAa,CAAC,UAAU,EAAE,OAAO,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAa/E,cAAc,CAAC,WAAW,EAAE,OAAO,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIjF,aAAa,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIrF,aAAa,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC;IAI5D,+BAA+B,IAAI,OAAO,CAAC,wBAAwB,CAAC;IAIpE,gBAAgB,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC;IAgB1D,aAAa,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC;IA4BpD,gBAAgB,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC;IAI1D,gBAAgB,CAAC,aAAa,EAAE,OAAO,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIxF,cAAc,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC;IAI1E,aAAa,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC;IAIhE,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI;IAOtC,gBAAgB,IAAI,MAAM;IAM1B,mBAAmB,IAAI,IAAI;IAMrB,gBAAgB,IAAI,OAAO,CAAC,IAAI,CAAC;IAIjC,0BAA0B,IAAI,OAAO,CAAC,IAAI,CAAC;IAI3C,mBAAmB,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAInD,gBAAgB,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAUhD,iBAAiB,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIjD,sBAAsB,CAAC,GAAG,EAAE,MAAM,gBAAgB,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,mBAAmB,CAAC;IAMpF,gCAAgC,CAAC,GAAG,EAAE,MAAM,wBAAwB,GAAG,OAAO,CAAC,mBAAmB,CAAC;IAMnG,yBAAyB,CAAC,GAAG,EAAE,MAAM,cAAc,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC;IAKnG,sBAAsB,CAAC,GAAG,EAAE,MAAM,WAAW,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC;IAa7F,uBAAuB,CAAC,GAAG,EAAE,MAAM,WAAW,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC;IAM9F,sBAAsB,CAAC,GAAG,EAAE,MAAM,gBAAgB,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC;IAIjG,gCAAgC,CAC3C,GAAG,EAAE,MAAM,wBAAwB,EACnC,KAAK,EAAE,mBAAmB,GACzB,OAAO,CAAC,IAAI,CAAC;IAIH,yBAAyB,CACpC,GAAG,EAAE,MAAM,cAAc,EACzB,KAAK,EAAE,mBAAmB,EAC1B,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,IAAI,CAAC;IAIH,sBAAsB,CACjC,GAAG,EAAE,MAAM,WAAW,EACtB,KAAK,EAAE,mBAAmB,EAC1B,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,IAAI,CAAC;IAaH,uBAAuB,CAClC,GAAG,EAAE,MAAM,WAAW,EACtB,KAAK,EAAE,mBAAmB,EAC1B,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,IAAI,CAAC;IAIH,yBAAyB,CAAC,GAAG,EAAE,MAAM,gBAAgB,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IAIxE,mCAAmC,CAAC,GAAG,EAAE,MAAM,wBAAwB,GAAG,OAAO,CAAC,IAAI,CAAC;IAIvF,4BAA4B,CAAC,GAAG,EAAE,MAAM,cAAc,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIvF,yBAAyB,CAAC,GAAG,EAAE,MAAM,WAAW,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAajF,0BAA0B,CAAC,GAAG,EAAE,MAAM,WAAW,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAGhG;AAED,eAAe,cAAc,CAAC"}
+{"version":3,"file":"StorageManager.d.ts","sourceRoot":"","sources":["../src/StorageManager.ts"],"names":[],"mappings":"AAGA,OAAO,EAAC,gBAAgB,EAAC,MAAM,iBAAiB,CAAC;AACjD,OAAO,EAAC,wBAAwB,EAAC,MAAM,yBAAyB,CAAC;AACjE,OAAO,EAAC,WAAW,EAAC,MAAM,kBAAkB,CAAC;AAC7C,OAAO,EAAC,MAAM,EAAE,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,mBAAmB,EAAC,MAAM,gBAAgB,CAAC;AAIjG,KAAK,WAAW,CAAC,CAAC,IAAI,OAAO,CAC3B,gBAAgB,CAAC,CAAC,CAAC,GAAG,wBAAwB,GAAG,WAAW,GAAG,cAAc,GAAG,WAAW,CAC5F,CAAC;AAEF,cAAM,cAAc,CAAC,CAAC;IACpB,SAAS,CAAC,EAAE,EAAE,MAAM,CAAC;IAErB,SAAS,CAAC,KAAK,EAAE,OAAO,CAAC;IAEzB,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC;gBAEN,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,GAAE,MAAsC;cAMrF,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;cAU/D,QAAQ,CACtB,GAAG,EAAE,MAAM,EACX,SAAS,EAAE,MAAM,gBAAgB,CAAC,CAAC,CAAC,GAAG,MAAM,wBAAwB,GAAG,MAAM,WAAW,GAAG,MAAM,cAAc,EAChH,KAAK,EAAE,mBAAmB,GACzB,OAAO,CAAC,IAAI,CAAC;cAUA,WAAW,CACzB,GAAG,EAAE,MAAM,EACX,SAAS,EAAE,MAAM,gBAAgB,CAAC,CAAC,CAAC,GAAG,MAAM,wBAAwB,GAAG,MAAM,WAAW,GAAG,MAAM,cAAc,GAC/G,OAAO,CAAC,IAAI,CAAC;IAahB,SAAS,CAAC,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,MAAM;IAa1F,SAAS,CAAC,MAAM,CAAC,uBAAuB,IAAI,OAAO;IAatC,aAAa,CAAC,MAAM,EAAE,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IAIlE,uBAAuB,CAAC,oBAAoB,EAAE,OAAO,CAAC,wBAAwB,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IAI/F,gBAAgB,CAAC,aAAa,EAAE,OAAO,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIxF,aAAa,CAAC,UAAU,EAAE,OAAO,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAa/E,cAAc,CAAC,WAAW,EAAE,OAAO,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIjF,aAAa,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIrF,aAAa,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC;IAI5D,+BAA+B,IAAI,OAAO,CAAC,wBAAwB,CAAC;IAIpE,gBAAgB,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC;IAgB1D,aAAa,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC;IA4BpD,gBAAgB,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC;IAI1D,gBAAgB,CAAC,aAAa,EAAE,OAAO,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIxF,cAAc,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC;IAI1E,aAAa,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC;IAI1D,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAInE,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI;IAOtC,gBAAgB,IAAI,MAAM;IAM1B,mBAAmB,IAAI,IAAI;IAMrB,gBAAgB,IAAI,OAAO,CAAC,IAAI,CAAC;IAIjC,0BAA0B,IAAI,OAAO,CAAC,IAAI,CAAC;IAI3C,mBAAmB,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAInD,gBAAgB,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAUhD,iBAAiB,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIjD,sBAAsB,CAAC,GAAG,EAAE,MAAM,gBAAgB,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,mBAAmB,CAAC;IAMpF,gCAAgC,CAAC,GAAG,EAAE,MAAM,wBAAwB,GAAG,OAAO,CAAC,mBAAmB,CAAC;IAMnG,yBAAyB,CAAC,GAAG,EAAE,MAAM,cAAc,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC;IAKnG,sBAAsB,CAAC,GAAG,EAAE,MAAM,WAAW,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC;IAa7F,uBAAuB,CAAC,GAAG,EAAE,MAAM,WAAW,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC;IAM9F,sBAAsB,CAAC,GAAG,EAAE,MAAM,gBAAgB,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC;IAIjG,gCAAgC,CAC3C,GAAG,EAAE,MAAM,wBAAwB,EACnC,KAAK,EAAE,mBAAmB,GACzB,OAAO,CAAC,IAAI,CAAC;IAIH,yBAAyB,CACpC,GAAG,EAAE,MAAM,cAAc,EACzB,KAAK,EAAE,mBAAmB,EAC1B,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,IAAI,CAAC;IAIH,sBAAsB,CACjC,GAAG,EAAE,MAAM,WAAW,EACtB,KAAK,EAAE,mBAAmB,EAC1B,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,IAAI,CAAC;IAaH,uBAAuB,CAClC,GAAG,EAAE,MAAM,WAAW,EACtB,KAAK,EAAE,mBAAmB,EAC1B,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,IAAI,CAAC;IAIH,yBAAyB,CAAC,GAAG,EAAE,MAAM,gBAAgB,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IAIxE,mCAAmC,CAAC,GAAG,EAAE,MAAM,wBAAwB,GAAG,OAAO,CAAC,IAAI,CAAC;IAIvF,4BAA4B,CAAC,GAAG,EAAE,MAAM,cAAc,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIvF,yBAAyB,CAAC,GAAG,EAAE,MAAM,WAAW,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAajF,0BAA0B,CAAC,GAAG,EAAE,MAAM,WAAW,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAGhG;AAED,eAAe,cAAc,CAAC"}

package/dist/ThunderIDJavaScriptClient.d.ts

@@ -7,6 +7,7 @@ import { Crypto } from './models/crypto';
 import { ExtendedAuthorizeRequestUrlParams } from './models/oauth-request';
 import { OIDCDiscoveryApiResponse } from './models/oidc-discovery';
 import { OIDCEndpoints } from './models/oidc-endpoints';
+import { LogoutTokenClaims } from './models/logout-token';
 import { UserSession } from './models/session';
 import { Storage } from './models/store';
 import { IdToken, TokenExchangeRequestConfig, TokenResponse } from './models/token';
@@ -39,6 +40,11 @@ declare class ThunderIDJavaScriptClient<T = Config> implements ThunderIDClient<T
     protected clearSessionAsync(sessionId?: string): Promise<void>;
     setSession(sessionData: Record<string, unknown>, sessionId?: string): Promise<void>;
     decodeJwtToken<R = Record<string, unknown>>(token: string): Promise<R>;
+    /**
+     * Validates a back-channel logout token and returns its claims. Protected, because only an SDK
+     * that runs on a server can receive one; such an SDK builds its logout handler on this.
+     */
+    protected validateLogoutToken(logoutToken: string): Promise<LogoutTokenClaims>;
     exchangeToken(config: TokenExchangeRequestConfig, sessionId?: string): Promise<TokenResponse | Response | User>;
     isLoading(): boolean;
     signIn(_options?: SignInOptions): Promise<User | TokenResponse | undefined>;
@@ -50,7 +56,7 @@ declare class ThunderIDJavaScriptClient<T = Config> implements ThunderIDClient<T
     updateUserProfile(_payload: any, _userId?: string): Promise<User>;
     protected loadOpenIDProviderConfiguration(forceInit?: boolean): Promise<void>;
     protected getSignInUrl(requestConfig?: ExtendedAuthorizeRequestUrlParams, userId?: string): Promise<string>;
-    protected requestAccessToken(authorizationCode: string, sessionState: string, state: string, userId?: string, tokenRequestConfig?: {
+    protected requestAccessToken(authorizationCode: string, state: string, userId?: string, tokenRequestConfig?: {
         params: Record<string, unknown>;
     }): Promise<TokenResponse>;
     protected getSignOutUrl(userId?: string): Promise<string>;

package/dist/ThunderIDJavaScriptClient.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ThunderIDJavaScriptClient.d.ts","sourceRoot":"","sources":["../src/ThunderIDJavaScriptClient.ts"],"names":[],"mappings":"AAYA,OAAO,EAAC,gBAAgB,EAAC,MAAM,oBAAoB,CAAC;AACpD,OAAO,EAAC,WAAW,EAAC,MAAM,gBAAgB,CAAC;AAE3C,OAAO,KAAK,EAAC,mBAAmB,EAAE,oBAAoB,EAAE,eAAe,EAAC,MAAM,eAAe,CAAC;AAC9F,OAAO,EAAC,eAAe,EAAC,MAAM,iBAAiB,CAAC;AAChD,OAAO,EAAmB,MAAM,EAAE,aAAa,EAAE,cAAc,EAAE,aAAa,EAAC,MAAM,iBAAiB,CAAC;AACvG,OAAO,EAAC,MAAM,EAAC,MAAM,iBAAiB,CAAC;AACvC,OAAO,EAAC,iCAAiC,EAAC,MAAM,wBAAwB,CAAC;AACzE,OAAO,EAAC,wBAAwB,EAAC,MAAM,yBAAyB,CAAC;AACjE,OAAO,EAAC,aAAa,EAAC,MAAM,yBAAyB,CAAC;AACtD,OAAO,EAAc,WAAW,EAAC,MAAM,kBAAkB,CAAC;AAC1D,OAAO,EAAC,OAAO,EAAiB,MAAM,gBAAgB,CAAC;AACvD,OAAO,EAAyB,OAAO,EAAE,0BAA0B,EAAE,aAAa,EAAC,MAAM,gBAAgB,CAAC;AAC1G,OAAO,EAAC,IAAI,EAAE,WAAW,EAAC,MAAM,eAAe,CAAC;AAChD,OAAO,cAAc,MAAM,kBAAkB,CAAC;AA2B9C,cAAM,yBAAyB,CAAC,CAAC,GAAG,MAAM,CAAE,YAAW,eAAe,CAAC,CAAC,CAAC;IACvE,SAAS,CAAC,cAAc,EAAG,cAAc,CAAC,CAAC,CAAC,CAAC;IAE7C,SAAS,CAAC,WAAW,EAAE,MAAM,CAAC;IAE9B,OAAO,CAAC,cAAc,CAAsC;IAE5D,OAAO,CAAC,4BAA4B,CAA2C;IAE/E,OAAO,CAAC,UAAU,CAA2B;IAE7C,OAAO,CAAC,YAAY,CAAoB;IAExC,OAAO,CAAC,eAAe,CAAK;IAE5B,OAAO,CAAC,UAAU,CAAU;IAE5B,OAAO,CAAC,OAAO,CAAM;gBAET,OAAO,CAAC,EAAE,OAAO,EAAE,WAAW,CAAC,EAAE,MAAM;IAOtC,UAAU,CAAC,MAAM,EAAE,CAAC,EAAE,OAAO,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IA8C1D,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC;IAUxD,gBAAgB,IAAI,CAAC;IAIf,OAAO,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAavC,UAAU,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAoB7C,cAAc,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAkBhE,OAAO,CAAC,uBAAuB;IAYxB,YAAY,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI;IAI7C;;;;OAIG;IACH,SAAS,CAAC,iBAAiB,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIjD,UAAU,CAAC,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAInF,cAAc,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC;IAItE,aAAa,CACxB,MAAM,EAAE,0BAA0B,EAClC,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,aAAa,GAAG,QAAQ,GAAG,IAAI,CAAC;IAqFpC,SAAS,IAAI,OAAO;IAIpB,MAAM,CAAC,QAAQ,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,GAAG,aAAa,GAAG,SAAS,CAAC;IAI3E,OAAO,CACZ,QAAQ,CAAC,EAAE,cAAc,EACzB,wBAAwB,CAAC,EAAE,MAAM,GAAG,CAAC,CAAC,eAAe,EAAE,MAAM,KAAK,IAAI,CAAC,EACvE,aAAa,CAAC,EAAE,CAAC,eAAe,EAAE,MAAM,KAAK,IAAI,GAChD,OAAO,CAAC,MAAM,GAAG,OAAO,CAAC;IAIrB,cAAc,CAAC,QAAQ,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,GAAG,OAAO,GAAG,SAAS,CAAC;IAI7E,MAAM,CAAC,QAAQ,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC;IAI/C,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IAIxB,cAAc,CAAC,QAAQ,CAAC,EAAE,GAAG,GAAG,OAAO,CAAC,WAAW,CAAC;IAIpD,iBAAiB,CAAC,QAAQ,EAAE,GAAG,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;cAMxD,+BAA+B,CAAC,SAAS,UAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;cAiHjE,YAAY,CAAC,aAAa,CAAC,EAAE,iCAAiC,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;cAwEjG,kBAAkB,CAChC,iBAAiB,EAAE,MAAM,EACzB,YAAY,EAAE,MAAM,EACpB,KAAK,EAAE,MAAM,EACb,MAAM,CAAC,EAAE,MAAM,EACf,kBAAkB,CAAC,EAAE;QAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAC,GACrD,OAAO,CAAC,aAAa,CAAC;cAgGT,aAAa,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;cA4C/C,0BAA0B,IAAI,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IAiBhE,oBAAoB,IAAI,OAAO,CAAC,wBAAwB,GAAG,IAAI,CAAC;cAQ7D,iBAAiB,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;cAMtE,UAAU,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;cAI5C,cAAc,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC;cASrD,kBAAkB,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC;IA2DlF;;;;OAIG;cACa,6BAA6B,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC;IAgGzF;;;;OAIG;cACa,4BAA4B,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC;cAmDhE,iBAAiB,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,OAAO,CAAC;IAQlE,YAAY,CAAC,OAAO,EAAE,mBAAmB,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAmIzE,QAAQ,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,eAAe,GAAG,OAAO,CAAC,aAAa,CAAC;cAkH7F,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;cAI5D,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIjF,aAAa,IAAI,MAAM;IAI9B,SAAS,CAAC,iBAAiB,IAAI,cAAc,CAAC,CAAC,CAAC;IAIhD,SAAS,CAAC,eAAe,IAAI,gBAAgB;WAM/B,mBAAmB,CAAC,eAAe,EAAE,MAAM,GAAG,OAAO;WAQrD,cAAc,CAAC,eAAe,EAAE,MAAM,GAAG,OAAO;IAUjD,eAAe,CAAC,WAAW,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC;CASxE;AAED,eAAe,yBAAyB,CAAC"}
+{"version":3,"file":"ThunderIDJavaScriptClient.d.ts","sourceRoot":"","sources":["../src/ThunderIDJavaScriptClient.ts"],"names":[],"mappings":"AAYA,OAAO,EAAC,gBAAgB,EAAC,MAAM,oBAAoB,CAAC;AACpD,OAAO,EAAC,WAAW,EAAC,MAAM,gBAAgB,CAAC;AAE3C,OAAO,KAAK,EAAC,mBAAmB,EAAE,oBAAoB,EAAE,eAAe,EAAC,MAAM,eAAe,CAAC;AAC9F,OAAO,EAAC,eAAe,EAAC,MAAM,iBAAiB,CAAC;AAChD,OAAO,EAAmB,MAAM,EAAE,aAAa,EAAE,cAAc,EAAE,aAAa,EAAC,MAAM,iBAAiB,CAAC;AACvG,OAAO,EAAC,MAAM,EAAC,MAAM,iBAAiB,CAAC;AACvC,OAAO,EAAC,iCAAiC,EAAC,MAAM,wBAAwB,CAAC;AACzE,OAAO,EAAC,wBAAwB,EAAC,MAAM,yBAAyB,CAAC;AACjE,OAAO,EAAC,aAAa,EAAC,MAAM,yBAAyB,CAAC;AACtD,OAAO,EAAC,iBAAiB,EAAC,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAc,WAAW,EAAC,MAAM,kBAAkB,CAAC;AAC1D,OAAO,EAAC,OAAO,EAAiB,MAAM,gBAAgB,CAAC;AACvD,OAAO,EAAyB,OAAO,EAAE,0BAA0B,EAAE,aAAa,EAAC,MAAM,gBAAgB,CAAC;AAC1G,OAAO,EAAC,IAAI,EAAE,WAAW,EAAC,MAAM,eAAe,CAAC;AAChD,OAAO,cAAc,MAAM,kBAAkB,CAAC;AA2B9C,cAAM,yBAAyB,CAAC,CAAC,GAAG,MAAM,CAAE,YAAW,eAAe,CAAC,CAAC,CAAC;IACvE,SAAS,CAAC,cAAc,EAAG,cAAc,CAAC,CAAC,CAAC,CAAC;IAE7C,SAAS,CAAC,WAAW,EAAE,MAAM,CAAC;IAE9B,OAAO,CAAC,cAAc,CAAsC;IAE5D,OAAO,CAAC,4BAA4B,CAA2C;IAE/E,OAAO,CAAC,UAAU,CAA2B;IAE7C,OAAO,CAAC,YAAY,CAAoB;IAExC,OAAO,CAAC,eAAe,CAAK;IAE5B,OAAO,CAAC,UAAU,CAAU;IAE5B,OAAO,CAAC,OAAO,CAAM;gBAET,OAAO,CAAC,EAAE,OAAO,EAAE,WAAW,CAAC,EAAE,MAAM;IAOtC,UAAU,CAAC,MAAM,EAAE,CAAC,EAAE,OAAO,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IA8C1D,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC;IAUxD,gBAAgB,IAAI,CAAC;IAIf,OAAO,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAavC,UAAU,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAoB7C,cAAc,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAkBhE,OAAO,CAAC,uBAAuB;IAYxB,YAAY,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI;IAI7C;;;;OAIG;IACH,SAAS,CAAC,iBAAiB,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIjD,UAAU,CAAC,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAInF,cAAc,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC;IAInF;;;OAGG;cACa,mBAAmB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAOvE,aAAa,CACxB,MAAM,EAAE,0BAA0B,EAClC,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,aAAa,GAAG,QAAQ,GAAG,IAAI,CAAC;IAqFpC,SAAS,IAAI,OAAO;IAIpB,MAAM,CAAC,QAAQ,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,GAAG,aAAa,GAAG,SAAS,CAAC;IAI3E,OAAO,CACZ,QAAQ,CAAC,EAAE,cAAc,EACzB,wBAAwB,CAAC,EAAE,MAAM,GAAG,CAAC,CAAC,eAAe,EAAE,MAAM,KAAK,IAAI,CAAC,EACvE,aAAa,CAAC,EAAE,CAAC,eAAe,EAAE,MAAM,KAAK,IAAI,GAChD,OAAO,CAAC,MAAM,GAAG,OAAO,CAAC;IAIrB,cAAc,CAAC,QAAQ,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,GAAG,OAAO,GAAG,SAAS,CAAC;IAI7E,MAAM,CAAC,QAAQ,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC;IAI/C,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IAIxB,cAAc,CAAC,QAAQ,CAAC,EAAE,GAAG,GAAG,OAAO,CAAC,WAAW,CAAC;IAIpD,iBAAiB,CAAC,QAAQ,EAAE,GAAG,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;cAMxD,+BAA+B,CAAC,SAAS,UAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;cAiHjE,YAAY,CAAC,aAAa,CAAC,EAAE,iCAAiC,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;cAwEjG,kBAAkB,CAChC,iBAAiB,EAAE,MAAM,EACzB,KAAK,EAAE,MAAM,EACb,MAAM,CAAC,EAAE,MAAM,EACf,kBAAkB,CAAC,EAAE;QAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAC,GACrD,OAAO,CAAC,aAAa,CAAC;cAwFT,aAAa,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;cA4C/C,0BAA0B,IAAI,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IAgBhE,oBAAoB,IAAI,OAAO,CAAC,wBAAwB,GAAG,IAAI,CAAC;cAQ7D,iBAAiB,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;cAMtE,UAAU,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;cAI5C,cAAc,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC;cAQrD,kBAAkB,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC;IA2DlF;;;;OAIG;cACa,6BAA6B,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC;IAgGzF;;;;OAIG;cACa,4BAA4B,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC;cAmDhE,iBAAiB,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,OAAO,CAAC;IAQlE,YAAY,CAAC,OAAO,EAAE,mBAAmB,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAmIzE,QAAQ,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,eAAe,GAAG,OAAO,CAAC,aAAa,CAAC;cAkH7F,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;cAI5D,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIjF,aAAa,IAAI,MAAM;IAI9B,SAAS,CAAC,iBAAiB,IAAI,cAAc,CAAC,CAAC,CAAC;IAIhD,SAAS,CAAC,eAAe,IAAI,gBAAgB;WAM/B,mBAAmB,CAAC,eAAe,EAAE,MAAM,GAAG,OAAO;WAQrD,cAAc,CAAC,eAAe,EAAE,MAAM,GAAG,OAAO;IAUjD,eAAe,CAAC,WAAW,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC;CASxE;AAED,eAAe,yBAAyB,CAAC"}

package/dist/cjs/index.cjs

@@ -81,6 +81,15 @@ var ThunderIDAuthException = class extends Error {
 		Object.setPrototypeOf(this, new.target.prototype);
 	}
 };
+/**
+* Raised when a back-channel logout token is not valid. A logout handler answers 400 for this and a
+* 5xx for any other failure, which tells the server whether a retry can help.
+*/
+var InvalidLogoutTokenError = class extends ThunderIDAuthException {
+	constructor(code, message) {
+		super(code, "Invalid logout token.", message);
+	}
+};
 
 //#endregion
 //#region src/IsomorphicCrypto.ts
@@ -144,6 +153,38 @@ var IsomorphicCrypto = class {
 			return Promise.reject(new ThunderIDAuthException("JS-CRYPTO_HELPER-IVIT-IV01", "Invalid ID token.", "ID token validation returned false"));
 		}).catch((error$1) => Promise.reject(error$1));
 	}
+	/**
+	* Verifies the signature of a back-channel logout token, along with its audience, issuer,
+	* lifetime and, when the token has one, subject.
+	*
+	* @param logoutToken - The logout token received from the server.
+	* @param jwk - The server key the token names.
+	* @param clientId - The client the token must be addressed to.
+	* @param issuer - The expected issuer.
+	* @param subject - The token's subject, when it has one.
+	* @param clockTolerance - Allowed clock difference in seconds.
+	*
+	* @throws {InvalidLogoutTokenError} When verification fails. The message never includes the token.
+	*/
+	async verifyLogoutTokenSignature(logoutToken, jwk, clientId, issuer, subject, clockTolerance) {
+		let verified = false;
+		try {
+			verified = await this.cryptoUtils.verifyJwt(logoutToken, jwk, TokenConstants_default.SignatureValidation.SUPPORTED_ALGORITHMS, clientId, issuer, subject, clockTolerance, true);
+		} catch {
+			verified = false;
+		}
+		if (!verified) throw new InvalidLogoutTokenError("JS-CRYPTO_HELPER-VLTS-IV01", "The logout token signature could not be verified.");
+	}
+	/**
+	* Decodes the JOSE header of a JWT without verifying its signature.
+	*/
+	decodeJwtHeader(token) {
+		try {
+			return JSON.parse(this.cryptoUtils.base64URLDecode(token?.split(".")[0]));
+		} catch {
+			throw new ThunderIDAuthException("JS-CRYPTO_UTIL-DJH-IV01", "Decoding token failed.", "The token header could not be decoded.");
+		}
+	}
 	decodeJwtToken(token) {
 		try {
 			const utf8String = this.cryptoUtils.base64URLDecode(token?.split(".")[1]);
@@ -1032,6 +1073,8 @@ let EmbeddedFlowComponentType = /* @__PURE__ */ function(EmbeddedFlowComponentTy
 	EmbeddedFlowComponentType$1["Icon"] = "ICON";
 	/** Image display component for logos and illustrations */
 	EmbeddedFlowComponentType$1["Image"] = "IMAGE";
+	/** Key-value list display component that shows label and value pairs published in additionalData */
+	EmbeddedFlowComponentType$1["KeyValueList"] = "KEY_VALUE_LIST";
 	/** One-time password input field for multi-factor authentication */
 	EmbeddedFlowComponentType$1["OtpInput"] = "OTP_INPUT";
 	/** Organization unit tree picker for selecting an OU */
@@ -2082,6 +2125,21 @@ const ApplicationNativeAuthenticationConstants = { SupportedAuthenticators: {
 } };
 var ApplicationNativeAuthenticationConstants_default = ApplicationNativeAuthenticationConstants;
 
+//#endregion
+//#region src/constants/BackchannelLogoutConstants.ts
+/**
+* Constants for OpenID Connect Back-Channel Logout 1.0, for an SDK that receives logout tokens.
+*/
+const BackchannelLogoutConstants = {
+	DEFAULT_CLOCK_TOLERANCE_SECONDS: 60,
+	EVENT: "http://schemas.openid.net/event/backchannel-logout",
+	JWKS_CACHE_TTL_MS: 6e5,
+	JWKS_MIN_REFETCH_INTERVAL_MS: 3e4,
+	TOKEN_PARAM: "logout_token",
+	TOKEN_TYPE: "logout+jwt"
+};
+var BackchannelLogoutConstants_default = BackchannelLogoutConstants;
+
 //#endregion
 //#region src/constants/ScopeConstants.ts
 /**
@@ -2118,7 +2176,6 @@ var ScopeConstants_default = ScopeConstants;
 const OIDCRequestConstants = {
 	Params: {
 		AUTHORIZATION_CODE: "code",
-		SESSION_STATE: "session_state",
 		SIGN_OUT_SUCCESS: "sign_out_success",
 		STATE: "state"
 	},
@@ -2441,7 +2498,6 @@ const OIDCDiscoveryConstants = {
 		ISSUER: "/oauth2/token",
 		JWKS: "/oauth2/jwks",
 		REVOCATION: "/oauth2/revoke",
-		SESSION_IFRAME: "/oidc/checksession",
 		TOKEN: "/oauth2/token",
 		USERINFO: "/oauth2/userinfo"
 	},
@@ -2452,7 +2508,6 @@ const OIDCDiscoveryConstants = {
 			ISSUER: "issuer",
 			JWKS: "jwks_uri",
 			REVOCATION: "revocation_endpoint",
-			SESSION_IFRAME: "check_session_iframe",
 			TOKEN: "token_endpoint",
 			USERINFO: "userinfo_endpoint"
 		},
@@ -2720,6 +2775,9 @@ var StorageManager = class StorageManager {
 	async getCustomData(key, userId) {
 		return JSON.parse(await this.store.getData(this.resolveKey(key, userId)) ?? null);
 	}
+	async removeCustomData(key, userId) {
+		await this.store.removeData(this.resolveKey(key, userId));
+	}
 	setSessionStatus(status) {
 		if (StorageManager.isLocalStorageAvailable()) localStorage.setItem(`${this.vendor}-session-active`, status);
 	}
@@ -2954,6 +3012,47 @@ const RESOURCE_ENDPOINT_KEYS = [
 const resolveResourceEndpoint = (key, config, explicitUrl) => explicitUrl ?? config?.endpoints?.[key] ?? void 0;
 var resolveResourceEndpoint_default = resolveResourceEndpoint;
 
+//#endregion
+//#region src/utils/validateLogoutTokenClaims.ts
+const fail = (code, message) => {
+	throw new InvalidLogoutTokenError(code, message);
+};
+const isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+const isNonEmptyString = (value) => typeof value === "string" && value.length > 0;
+/**
+* Checks the header and claims of a back-channel logout token, per OpenID Connect Back-Channel
+* Logout 1.0 section 2.6. It does not verify the signature: the caller does that with the server's
+* keys. Messages never include the token or its claim values.
+*
+* @param header - The decoded JOSE header.
+* @param payload - The decoded claims.
+* @param options - The issuer, client and clock the claims are checked against.
+* @returns The claims, typed.
+* @throws {InvalidLogoutTokenError} When any check fails.
+*/
+const validateLogoutTokenClaims = (header, payload, options) => {
+	if (!isRecord(header) || !isRecord(payload)) return fail("JS-LOGOUT_TOKEN-VLTC-IV01", "The logout token is not a well-formed JWT.");
+	const type = typeof header["typ"] === "string" ? header["typ"].toLowerCase() : "";
+	if (type !== BackchannelLogoutConstants_default.TOKEN_TYPE && type !== `application/${BackchannelLogoutConstants_default.TOKEN_TYPE}`) return fail("JS-LOGOUT_TOKEN-VLTC-IV02", "The token type is not logout+jwt.");
+	if (typeof header["alg"] !== "string" || !options.supportedAlgorithms.includes(header["alg"])) return fail("JS-LOGOUT_TOKEN-VLTC-IV03", "The signature algorithm is not supported.");
+	if ("nonce" in payload) return fail("JS-LOGOUT_TOKEN-VLTC-IV04", "A logout token must not carry a nonce.");
+	const { events } = payload;
+	if (!isRecord(events) || !isRecord(events[BackchannelLogoutConstants_default.EVENT])) return fail("JS-LOGOUT_TOKEN-VLTC-IV05", "The back-channel logout event is missing.");
+	if (payload["iss"] !== options.issuer) return fail("JS-LOGOUT_TOKEN-VLTC-IV06", "The issuer does not match.");
+	const audiences = Array.isArray(payload["aud"]) ? payload["aud"] : [payload["aud"]];
+	if (!isNonEmptyString(options.clientId) || !audiences.includes(options.clientId)) return fail("JS-LOGOUT_TOKEN-VLTC-IV07", "The audience does not include this client.");
+	const now = options.now ?? Math.floor(Date.now() / 1e3);
+	const tolerance = options.clockTolerance ?? BackchannelLogoutConstants_default.DEFAULT_CLOCK_TOLERANCE_SECONDS;
+	if (typeof payload["iat"] !== "number" || payload["iat"] > now + tolerance) return fail("JS-LOGOUT_TOKEN-VLTC-IV08", "The issued-at time is missing or in the future.");
+	if (typeof payload["exp"] !== "number" || payload["exp"] <= now - tolerance) return fail("JS-LOGOUT_TOKEN-VLTC-IV09", "The token has expired.");
+	if ("sid" in payload && !isNonEmptyString(payload["sid"])) return fail("JS-LOGOUT_TOKEN-VLTC-IV10", "The session identifier is not valid.");
+	if ("sub" in payload && !isNonEmptyString(payload["sub"])) return fail("JS-LOGOUT_TOKEN-VLTC-IV10", "The subject is not valid.");
+	if (!("sid" in payload) && !("sub" in payload)) return fail("JS-LOGOUT_TOKEN-VLTC-IV11", "The token names neither a session nor a subject.");
+	if (!isNonEmptyString(payload["jti"])) return fail("JS-LOGOUT_TOKEN-VLTC-IV12", "The token identifier is missing.");
+	return payload;
+};
+var validateLogoutTokenClaims_default = validateLogoutTokenClaims;
+
 //#endregion
 //#region src/constants/TokenExchangeConstants.ts
 /**
@@ -2994,6 +3093,9 @@ var AuthenticationHelper = class {
 	config;
 	oidcProviderMetaData;
 	cryptoHelper;
+	jwksCache;
+	jwksFetch;
+	jwksFetchStartedAt = 0;
 	/**
 	* Creates a new `AuthenticationHelper` instance.
 	*
@@ -3052,7 +3154,6 @@ var AuthenticationHelper = class {
 			OIDCDiscoveryConstants_default.Storage.StorageKeys.Endpoints.AUTHORIZATION,
 			OIDCDiscoveryConstants_default.Storage.StorageKeys.Endpoints.END_SESSION,
 			OIDCDiscoveryConstants_default.Storage.StorageKeys.Endpoints.JWKS,
-			OIDCDiscoveryConstants_default.Storage.StorageKeys.Endpoints.SESSION_IFRAME,
 			OIDCDiscoveryConstants_default.Storage.StorageKeys.Endpoints.REVOCATION,
 			OIDCDiscoveryConstants_default.Storage.StorageKeys.Endpoints.TOKEN,
 			OIDCDiscoveryConstants_default.Storage.StorageKeys.Endpoints.ISSUER,
@@ -3083,7 +3184,6 @@ var AuthenticationHelper = class {
 			[endpointKeys.END_SESSION]: `${baseUrl}${endpointPaths.END_SESSION}`,
 			[endpointKeys.ISSUER]: `${baseUrl}`,
 			[endpointKeys.JWKS]: `${baseUrl}${endpointPaths.JWKS}`,
-			[endpointKeys.SESSION_IFRAME]: `${baseUrl}${endpointPaths.SESSION_IFRAME}`,
 			[endpointKeys.REVOCATION]: `${baseUrl}${endpointPaths.REVOCATION}`,
 			[endpointKeys.TOKEN]: `${baseUrl}${endpointPaths.TOKEN}`,
 			[endpointKeys.USERINFO]: `${baseUrl}${endpointPaths.USERINFO}`,
@@ -3098,6 +3198,83 @@ var AuthenticationHelper = class {
 	* @throws {ThunderIDAuthException} When the JWKS endpoint is missing or the request fails.
 	*/
 	async validateIdToken(idToken) {
+		const keys = await this.fetchJwks();
+		const { issuer } = await this.oidcProviderMetaData();
+		const jwk = await this.cryptoHelper.getJWKForTheIdToken(idToken.split(".")[0], keys);
+		return this.cryptoHelper.isValidIdToken(idToken, jwk, (await this.config()).clientId ?? "", issuer ?? "", this.cryptoHelper.decodeJwtToken(idToken).sub, (await this.config()).tokenValidation?.idToken?.clockTolerance, (await this.config()).tokenValidation?.idToken?.validateIssuer ?? true);
+	}
+	/**
+	* Validates a back-channel logout token: its type, event, issuer, audience and lifetime, then its
+	* signature against the server's keys. The claims are checked first, so a malformed token costs
+	* neither a key fetch nor a signature check.
+	*
+	* @param logoutToken - The raw `logout_token` the server posted.
+	* @returns The token's claims.
+	* @throws {InvalidLogoutTokenError} When the token is not valid.
+	*/
+	async validateLogoutToken(logoutToken) {
+		const malformed = new InvalidLogoutTokenError("JS-AUTH_HELPER-VLT-IV01", "The logout token is not a signed JWT.");
+		if (typeof logoutToken !== "string" || logoutToken.split(".").length !== 3) throw malformed;
+		const configData = await this.config();
+		const { issuer } = await this.oidcProviderMetaData();
+		const clockTolerance = configData.tokenValidation?.idToken?.clockTolerance ?? BackchannelLogoutConstants_default.DEFAULT_CLOCK_TOLERANCE_SECONDS;
+		let header;
+		let payload;
+		try {
+			header = this.cryptoHelper.decodeJwtHeader(logoutToken);
+			payload = this.cryptoHelper.decodeJwtToken(logoutToken);
+		} catch {
+			throw malformed;
+		}
+		const claims = validateLogoutTokenClaims_default(header, payload, {
+			clientId: configData.clientId ?? "",
+			clockTolerance,
+			issuer: issuer ?? "",
+			supportedAlgorithms: TokenConstants_default.SignatureValidation.SUPPORTED_ALGORITHMS
+		});
+		await this.cryptoHelper.verifyLogoutTokenSignature(logoutToken, await this.getCachedJwk(header["kid"]), configData.clientId ?? "", issuer ?? "", claims.sub, clockTolerance);
+		return claims;
+	}
+	/**
+	* Returns the server key with the given identifier from a cached key set. An unknown identifier
+	* triggers one re-fetch, to follow key rotation, no more often than the minimum interval: the
+	* logout endpoint is unauthenticated, so an unbounded re-fetch would let anyone drive requests
+	* to the server. Requests that arrive while a fetch runs share it.
+	*/
+	async getCachedJwk(kid) {
+		const now = Date.now();
+		const find = (keys) => keys.find((key) => key.kid === kid);
+		const fresh = this.jwksCache !== void 0 && now - this.jwksCache.fetchedAt < BackchannelLogoutConstants_default.JWKS_CACHE_TTL_MS;
+		let jwk = fresh ? find(this.jwksCache.keys) : void 0;
+		if (!jwk && (this.jwksFetch || now - this.jwksFetchStartedAt >= BackchannelLogoutConstants_default.JWKS_MIN_REFETCH_INTERVAL_MS)) jwk = find(await this.fetchJwksOnce());
+		else if (!jwk && !fresh) throw new ThunderIDAuthException("JS-AUTH_HELPER-GCJ-NA02", "The server keys are not available.", "The server key set could not be fetched recently, and the cached one has expired.");
+		if (!jwk) throw new InvalidLogoutTokenError("JS-AUTH_HELPER-GCJ-NF01", "The logout token names a key the server does not publish.");
+		return jwk;
+	}
+	/**
+	* Fetches the key set unless a fetch is already running, in which case that one is shared.
+	*/
+	fetchJwksOnce() {
+		if (!this.jwksFetch) {
+			this.jwksFetchStartedAt = Date.now();
+			this.jwksFetch = this.fetchJwks().then((keys) => {
+				this.jwksCache = {
+					fetchedAt: Date.now(),
+					keys
+				};
+				return keys;
+			}).finally(() => {
+				this.jwksFetch = void 0;
+			});
+		}
+		return this.jwksFetch;
+	}
+	/**
+	* Fetches the server's JSON Web Key Set.
+	*
+	* @throws {ThunderIDAuthException} When the JWKS endpoint is missing or the request fails.
+	*/
+	async fetchJwks() {
 		const jwksEndpoint = (await this.storageManager.loadOpenIDProviderConfiguration()).jwks_uri;
 		const configData = await this.config();
 		if (!jwksEndpoint || jwksEndpoint.trim().length === 0) throw new ThunderIDAuthException("JS_AUTH_HELPER-VIT-NF01", "JWKS endpoint not found.", "No JWKS endpoint was found in the OIDC provider meta data returned by the well-known endpoint or the JWKS endpoint passed to the SDK is empty.");
@@ -3108,10 +3285,8 @@ var AuthenticationHelper = class {
 			throw new ThunderIDAuthException("JS-AUTH_HELPER-VIT-NE02", "Request to jwks endpoint failed.", error$1 ?? "The request sent to get the jwks from the server failed.");
 		}
 		if (response.status !== 200 || !response.ok) throw new ThunderIDAuthException("JS-AUTH_HELPER-VIT-HE03", `Invalid response status received for jwks request (${response.statusText}).`, await response.json());
-		const { issuer } = await this.oidcProviderMetaData();
 		const { keys } = await response.json();
-		const jwk = await this.cryptoHelper.getJWKForTheIdToken(idToken.split(".")[0], keys);
-		return this.cryptoHelper.isValidIdToken(idToken, jwk, (await this.config()).clientId ?? "", issuer ?? "", this.cryptoHelper.decodeJwtToken(idToken).sub, (await this.config()).tokenValidation?.idToken?.clockTolerance, (await this.config()).tokenValidation?.idToken?.validateIssuer ?? true);
+		return keys;
 	}
 	/**
 	* Extracts user information from a decoded ID token payload.
@@ -3516,6 +3691,14 @@ var ThunderIDJavaScriptClient = class {
 	async decodeJwtToken(token) {
 		return this.cryptoHelper.decodeJwtToken(token);
 	}
+	/**
+	* Validates a back-channel logout token and returns its claims. Protected, because only an SDK
+	* that runs on a server can receive one; such an SDK builds its logout handler on this.
+	*/
+	async validateLogoutToken(logoutToken) {
+		await this.loadOpenIDProviderConfiguration(false);
+		return this.authHelper.validateLogoutToken(logoutToken);
+	}
 	async exchangeToken(config, sessionId) {
 		if (!await this.storageManager.getTemporaryDataParameter(OIDCDiscoveryConstants_default.Storage.StorageKeys.OPENID_PROVIDER_CONFIG_INITIATED)) await this.loadOpenIDProviderConfiguration(false);
 		const oidcProviderMetadata = await this.oidcProviderMetaDataProvider();
@@ -3655,12 +3838,11 @@ var ThunderIDJavaScriptClient = class {
 		if (await this.storageManager.getTemporaryDataParameter(OIDCDiscoveryConstants_default.Storage.StorageKeys.OPENID_PROVIDER_CONFIG_INITIATED)) return buildSignInUrl();
 		return this.loadOpenIDProviderConfiguration(requestConfig?.forceInit).then(() => buildSignInUrl());
 	}
-	async requestAccessToken(authorizationCode, sessionState, state, userId, tokenRequestConfig) {
+	async requestAccessToken(authorizationCode, state, userId, tokenRequestConfig) {
 		if (!await this.storageManager.getTemporaryDataParameter(OIDCDiscoveryConstants_default.Storage.StorageKeys.OPENID_PROVIDER_CONFIG_INITIATED)) await this.loadOpenIDProviderConfiguration(false);
 		const tokenEndpoint = (await this.oidcProviderMetaDataProvider()).token_endpoint;
 		const configData = await this.configProvider();
 		if (!tokenEndpoint || tokenEndpoint.trim().length === 0) throw new ThunderIDAuthException("JS-AUTH_CORE-RAT1-NF01", "Token endpoint not found.", "No token endpoint was found in the OIDC provider meta data returned by the well-known endpoint or the token endpoint passed to the SDK is empty.");
-		if (sessionState) await this.storageManager.setSessionDataParameter(OIDCRequestConstants_default.Params.SESSION_STATE, sessionState, userId);
 		const body = new URLSearchParams();
 		body.set("client_id", configData.clientId ?? "");
 		const hasSecret = Boolean(configData.clientSecret && configData.clientSecret.trim().length > 0);
@@ -3713,7 +3895,6 @@ var ThunderIDJavaScriptClient = class {
 		const meta = await this.oidcProviderMetaDataProvider();
 		return {
 			authorizationEndpoint: meta.authorization_endpoint ?? "",
-			checkSessionIframe: meta.check_session_iframe ?? "",
 			endSessionEndpoint: meta.end_session_endpoint ?? "",
 			introspectionEndpoint: meta.introspection_endpoint ?? "",
 			issuer: meta.issuer ?? "",
@@ -3736,11 +3917,7 @@ var ThunderIDJavaScriptClient = class {
 		return (await this.storageManager.getSessionData(userId)).id_token;
 	}
 	async getUserSession(userId) {
-		const sessionData = await this.storageManager.getSessionData(userId);
-		return {
-			scopes: sessionData?.scope?.split(" "),
-			sessionState: sessionData?.session_state ?? ""
-		};
+		return { scopes: (await this.storageManager.getSessionData(userId))?.scope?.split(" ") };
 	}
 	async refreshAccessToken(userId) {
 		const tokenEndpoint = (await this.oidcProviderMetaDataProvider()).token_endpoint;
@@ -5324,6 +5501,40 @@ function resolveFlowTemplateLiterals(text, { t, meta }) {
 	});
 }
 
+//#endregion
+//#region src/utils/parseKeyValuePairs.ts
+/**
+* Reads the label and value pairs a KEY_VALUE_LIST renders from the raw value found under its
+* `source` key in `additionalData`. The server publishes them as a JSON-encoded array, since
+* additional data carries strings, so both an array and its encoding are accepted.
+*
+* Entries that are not objects, or that carry no value, are dropped, since an empty row tells the
+* user nothing. Anything that is not a list of pairs yields none.
+*
+* @param raw - The raw value found under the source key.
+* @returns The pairs to render, empty when the value holds none.
+*
+* @example
+* ```typescript
+* parseKeyValuePairs('[{"label":"Email","value":"a@b.com"}]'); // [{label: 'Email', value: 'a@b.com'}]
+* parseKeyValuePairs('not json');                              // []
+* ```
+*/
+const parseKeyValuePairs = (raw) => {
+	let parsed = raw;
+	if (typeof raw === "string") try {
+		parsed = JSON.parse(raw);
+	} catch {
+		return [];
+	}
+	if (!Array.isArray(parsed)) return [];
+	return parsed.filter((entry) => typeof entry === "object" && entry !== null && !Array.isArray(entry)).map((entry) => ({
+		label: typeof entry["label"] === "string" ? entry["label"] : "",
+		value: typeof entry["value"] === "string" ? entry["value"] : ""
+	})).filter((pair) => pair.value !== "");
+};
+var parseKeyValuePairs_default = parseKeyValuePairs;
+
 //#endregion
 //#region src/utils/countryCodeToFlagEmoji.ts
 /**
@@ -5518,7 +5729,7 @@ const DEFAULT_VALIDATION_MESSAGE_KEYS = {
 * - Unknown rule types are treated as passing (forward compatibility with future types).
 */
 const evaluateValidationRule = (rule, value) => {
-	const fail = () => rule.message ?? DEFAULT_VALIDATION_MESSAGE_KEYS[rule.type];
+	const fail$1 = () => rule.message ?? DEFAULT_VALIDATION_MESSAGE_KEYS[rule.type];
 	switch (rule.type) {
 		case "regex": {
 			if (typeof rule.value !== "string" || rule.value === "") return null;
@@ -5528,14 +5739,14 @@ const evaluateValidationRule = (rule, value) => {
 			} catch {
 				return null;
 			}
-			return re.test(value) ? null : fail();
+			return re.test(value) ? null : fail$1();
 		}
 		case "minLength":
 			if (typeof rule.value !== "number" || Number.isNaN(rule.value)) return null;
-			return value.length >= rule.value ? null : fail();
+			return value.length >= rule.value ? null : fail$1();
 		case "maxLength":
 			if (typeof rule.value !== "number" || Number.isNaN(rule.value)) return null;
-			return value.length <= rule.value ? null : fail();
+			return value.length <= rule.value ? null : fail$1();
 		default: return null;
 	}
 };
@@ -5821,6 +6032,7 @@ const en_US = {
 		"errors.signup.initialization": "An error occurred while initializing. Please try again later.",
 		"errors.signup.flow.failure": "An error occurred during the sign-up flow. Please try again later.",
 		"errors.signup.flow.initialization.failure": "An error occurred while initializing the sign-up flow. Please try again later.",
+		"errors.signup.popup.failure": "Could not continue the sign-up in the pop-up window. Please try again.",
 		"errors.signup.components.not.available": "Sign-up form is not available at the moment. Please try again later."
 	}
 };
@@ -5953,6 +6165,7 @@ const fr_FR = {
 		"errors.signup.initialization": "Une erreur est survenue lors de l'initialisation. Veuillez réessayer plus tard.",
 		"errors.signup.flow.failure": "Une erreur est survenue lors du flux d'inscription. Veuillez réessayer plus tard.",
 		"errors.signup.flow.initialization.failure": "Une erreur est survenue lors de l'initialisation du flux d'inscription. Veuillez réessayer plus tard.",
+		"errors.signup.popup.failure": "Impossible de poursuivre l'inscription dans la fenêtre contextuelle. Veuillez réessayer.",
 		"errors.signup.components.not.available": "Le formulaire d'inscription n'est pas disponible pour le moment. Veuillez réessayer plus tard.",
 		"errors.signin.components.not.available": "Le formulaire de connexion n'est pas disponible pour le moment. Veuillez réessayer plus tard.",
 		"errors.signin.timeout": "Le temps imparti pour effectuer cette e'tape est expire'."
@@ -6087,6 +6300,7 @@ const te_IN = {
 		"errors.signup.initialization": "ప్రారంభించేటప్పుడు లోపం వచ్చింది. దయచేసి తరువాత మళ్లీ ప్రయత్నించండి.",
 		"errors.signup.flow.failure": "సైన్ అప్ ప్రక్రియలో లోపం వచ్చింది. దయచేసి తరువాత మళ్లీ ప్రయత్నించండి.",
 		"errors.signup.flow.initialization.failure": "సైన్ అప్ ప్రక్రియను ప్రారంభించేటప్పుడు లోపం వచ్చింది. దయచేసి తరువాత మళ్లీ ప్రయత్నించండి.",
+		"errors.signup.popup.failure": "పాప్-అప్ విండోలో సైన్ అప్ కొనసాగించడం సాధ్యం కాలేదు. దయచేసి మళ్లీ ప్రయత్నించండి.",
 		"errors.signup.components.not.available": "సైన్ అప్ ఫారం ప్రస్తుతం అందుబాటులో లేదు. దయచేసి తరువాత మళ్లీ ప్రయత్నించండి.",
 		"errors.signin.components.not.available": "సైన్ ఇన్ ఫారం ప్రస్తుతం అందుబాటులో లేదు. దయచేసి తరువాత మళ్లీ ప్రయత్నించండి.",
 		"errors.signin.timeout": "దశను పూర్తి చేయడానికి అనుమతించబడిన సమయం ముగిసింది."
@@ -6221,6 +6435,7 @@ const hi_IN = {
 		"errors.signup.initialization": "प्रारंभीकरण के दौरान एक त्रुटि हुई। कृपया बाद में पुनः प्रयास करें।",
 		"errors.signup.flow.failure": "साइन-अप प्रक्रिया में त्रुटि। कृपया बाद में पुनः प्रयास करें।",
 		"errors.signup.flow.initialization.failure": "साइन-अप प्रक्रिया प्रारंभ करते समय त्रुटि। कृपया बाद में पुनः प्रयास करें।",
+		"errors.signup.popup.failure": "पॉप-अप विंडो में साइन-अप जारी नहीं रखा जा सका। कृपया पुनः प्रयास करें।",
 		"errors.signup.components.not.available": "साइन-अप फॉर्म फिलहाल उपलब्ध नहीं है। कृपया बाद में पुनः प्रयास करें।",
 		"errors.signin.components.not.available": "साइन-इन फॉर्म फिलहाल उपलब्ध नहीं है। कृपया बाद में पुनः प्रयास करें।",
 		"errors.signin.timeout": "स्टेप पूरा करने के लिए दिया गया समय खत्म हो गया है।"
@@ -6355,6 +6570,7 @@ const pt_BR = {
 		"errors.signup.initialization": "Ocorreu um erro durante a inicialização. Tente novamente mais tarde.",
 		"errors.signup.flow.failure": "Ocorreu um erro durante o fluxo de cadastro. Tente novamente mais tarde.",
 		"errors.signup.flow.initialization.failure": "Ocorreu um erro ao inicializar o fluxo de cadastro. Tente novamente mais tarde.",
+		"errors.signup.popup.failure": "Não foi possível continuar o cadastro na janela pop-up. Tente novamente.",
 		"errors.signup.components.not.available": "O formulário de cadastro não está disponível no momento. Tente novamente mais tarde.",
 		"errors.signin.components.not.available": "O formulário de login não está disponível no momento. Tente novamente mais tarde.",
 		"errors.signin.timeout": "O tempo permitido para concluir a etapa expirou."
@@ -6489,6 +6705,7 @@ const pt_PT = {
 		"errors.signup.initialization": "Ocorreu um erro durante a inicialização. Tente novamente mais tarde.",
 		"errors.signup.flow.failure": "Ocorreu um erro durante o fluxo de registo. Tente novamente mais tarde.",
 		"errors.signup.flow.initialization.failure": "Ocorreu um erro ao inicializar o fluxo de registo. Tente novamente mais tarde.",
+		"errors.signup.popup.failure": "Não foi possível continuar o registo na janela pop-up. Tente novamente.",
 		"errors.signup.components.not.available": "O formulário de registo não está disponível de momento. Tente novamente mais tarde.",
 		"errors.signin.components.not.available": "O formulário de início de sessão não está disponível de momento. Tente novamente mais tarde.",
 		"errors.signin.timeout": "O tempo permitido para completar a etapa expirou."
@@ -6623,6 +6840,7 @@ const ta_IN = {
 		"errors.signup.initialization": "தொடங்கும்போது பிழை ஏற்பட்டது. பின்னர் மீண்டும் முயற்சிக்கவும்.",
 		"errors.signup.flow.failure": "பதிவு செய்யும் செயல்பாட்டில் பிழை ஏற்பட்டது. பின்னர் மீண்டும் முயற்சிக்கவும்.",
 		"errors.signup.flow.initialization.failure": "பதிவு செய்யும் செயல்பாட்டை தொடங்கும்போது பிழை ஏற்பட்டது. பின்னர் மீண்டும் முயற்சிக்கவும்.",
+		"errors.signup.popup.failure": "பாப்-அப் சாளரத்தில் பதிவைத் தொடர முடியவில்லை. மீண்டும் முயற்சிக்கவும்.",
 		"errors.signup.components.not.available": "பதிவு படிவம் இப்போது கிடைக்கவில்லை. பின்னர் மீண்டும் முயற்சிக்கவும்.",
 		"errors.signin.components.not.available": "உள்நுழைவு படிவம் இப்போது கிடைக்கவில்லை. பின்னர் மீண்டும் முயற்சிக்கவும்.",
 		"errors.signin.timeout": "படிநிலையை முடிக்க அனுமதிக்கப்பட்ட நேரம் காலாவதியானது."
@@ -6757,6 +6975,7 @@ const si_LK = {
 		"errors.signup.initialization": "ආරම්භ කිරීමේදී දෝෂයක් සිදු විය. කරුණාකර පසුව නැවත උත්සාහ කරන්න.",
 		"errors.signup.flow.failure": "ගිණුම් තැනීමේ ක්‍රියාවලියේදී දෝෂයක් සිදු විය. කරුණාකර පසුව නැවත උත්සාහ කරන්න.",
 		"errors.signup.flow.initialization.failure": "ගිණුම් තැනීමේ ක්‍රියාවලිය ආරම්භ කිරීමේදී දෝෂයක් සිදු විය. කරුණාකර පසුව නැවත උත්සාහ කරන්න.",
+		"errors.signup.popup.failure": "උත්පතන කවුළුවේ ගිණුම් තැනීම දිගටම කරගෙන යා නොහැකි විය. කරුණාකර නැවත උත්සාහ කරන්න.",
 		"errors.signup.components.not.available": "ගිණුම් තැනීමේ පිටුව දැන් ලබා ගත නොහැකිය. කරුණාකර පසුව නැවත උත්සාහ කරන්න.",
 		"errors.signin.components.not.available": "ප්‍රවේශ වීමේ පිටුව දැන් ලබා ගත නොහැකිය. කරුණාකර පසුව නැවත උත්සාහ කරන්න.",
 		"errors.signin.timeout": "පියවර සම්පූර්ණ කිරීමට ලබා දී තිබූ කාලය ඉකුත් වී ඇත."
@@ -6857,6 +7076,7 @@ exports.AgentQueryKeys = AgentQueryKeys_default;
 exports.ApplicationNativeAuthenticationConstants = ApplicationNativeAuthenticationConstants_default;
 exports.ApplicationQueryKeys = ApplicationQueryKeys_default;
 exports.AuthenticationHelper = AuthenticationHelper_default;
+exports.BackchannelLogoutConstants = BackchannelLogoutConstants_default;
 exports.ConsentConstants = ConsentConstants_default;
 exports.CredentialConstants = CredentialConstants_default;
 exports.DEFAULT_THEME = DEFAULT_THEME;
@@ -6879,6 +7099,7 @@ exports.FlowMetaType = FlowMetaType;
 exports.FlowMode = FlowMode;
 exports.HttpClient = HttpClient;
 exports.InboundAuthTypes = InboundAuthTypes;
+exports.InvalidLogoutTokenError = InvalidLogoutTokenError;
 exports.IsomorphicCrypto = IsomorphicCrypto;
 exports.OAuth2GrantTypes = OAuth2GrantTypes;
 exports.OAuth2ResponseTypes = OAuth2ResponseTypes;
@@ -6953,6 +7174,7 @@ exports.logger = logger_default;
 exports.mapCredentialUpdateError = mapCredentialUpdateError_default;
 exports.normalizeLocaleTag = normalizeLocaleTag;
 exports.normalizeTranslations = normalizeTranslations_default;
+exports.parseKeyValuePairs = parseKeyValuePairs_default;
 exports.processOpenIDScopes = processOpenIDScopes_default;
 exports.removeTrailingSlash = removeTrailingSlash_default;
 exports.resolveChangeCredentialPolicy = resolveChangeCredentialPolicy_default;
@@ -6971,5 +7193,6 @@ exports.updateApplication = updateApplication_default;
 exports.updateMeCredentials = updateMeCredentials_default;
 exports.updateMeProfile = updateMeProfile_default;
 exports.updateUser = updateUser_default;
+exports.validateLogoutTokenClaims = validateLogoutTokenClaims_default;
 exports.warn = warn;
 exports.withVendorCSSClassPrefix = withVendorCSSClassPrefix_default;

package/dist/constants/BackchannelLogoutConstants.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Constants for OpenID Connect Back-Channel Logout 1.0, for an SDK that receives logout tokens.
+ */
+declare const BackchannelLogoutConstants: {
+    readonly DEFAULT_CLOCK_TOLERANCE_SECONDS: number;
+    readonly EVENT: string;
+    readonly JWKS_CACHE_TTL_MS: number;
+    readonly JWKS_MIN_REFETCH_INTERVAL_MS: number;
+    readonly TOKEN_PARAM: string;
+    readonly TOKEN_TYPE: string;
+};
+export default BackchannelLogoutConstants;
+//# sourceMappingURL=BackchannelLogoutConstants.d.ts.map

package/dist/constants/BackchannelLogoutConstants.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"BackchannelLogoutConstants.d.ts","sourceRoot":"","sources":["../../src/constants/BackchannelLogoutConstants.ts"],"names":[],"mappings":"AAGA;;GAEG;AACH,QAAA,MAAM,0BAA0B,EAAE;IAChC,QAAQ,CAAC,+BAA+B,EAAE,MAAM,CAAC;IACjD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,4BAA4B,EAAE,MAAM,CAAC;IAC9C,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAU7B,CAAC;AAEF,eAAe,0BAA0B,CAAC"}