@thunderid/javascript 1.11.0 → 1.13.0

package/dist/ThunderIDJavaScriptClient.d.ts

@@ -4,13 +4,16 @@ import type { CIBAInitiateOptions, CIBAInitiateResponse, CIBAPollOptions } from
 import { ThunderIDClient } from './models/client';
 import { Config, SignInOptions, SignOutOptions, SignUpOptions } from './models/config';
 import { Crypto } from './models/crypto';
+import type { CurrentOrganizationUnit, SwitchOrganizationUnitOptions } from './models/accessible-organization-unit';
+import type { DeviceAuthorizationOptions, DeviceAuthorizationPollOptions, DeviceAuthorizationResponse } from './models/device-authorization';
+import type { EmbeddedFlowSessionData } from './models/embedded-flow';
 import { ExtendedAuthorizeRequestUrlParams } from './models/oauth-request';
 import { OIDCDiscoveryApiResponse } from './models/oidc-discovery';
 import { OIDCEndpoints } from './models/oidc-endpoints';
 import { LogoutTokenClaims } from './models/logout-token';
 import { UserSession } from './models/session';
 import { Storage } from './models/store';
-import { IdToken, TokenExchangeRequestConfig, TokenResponse } from './models/token';
+import { DeviceSecretSwitchResult, IdToken, TokenExchangeRequestConfig, TokenResponse } from './models/token';
 import { User, UserProfile } from './models/user';
 import StorageManager from './StorageManager';
 declare class ThunderIDJavaScriptClient<T = Config> implements ThunderIDClient<T> {
@@ -23,6 +26,11 @@ declare class ThunderIDJavaScriptClient<T = Config> implements ThunderIDClient<T
     private instanceIdValue;
     private cacheStore;
     private baseURL;
+    /**
+     * The `state` of the most recent authorization request this client built. A pushed request carries
+     * its parameters server-side, so the URL it returns has no `state` to read back.
+     */
+    protected lastAuthorizeRequestState: string | undefined;
     constructor(storage?: Storage, cryptoUtils?: Crypto);
     initialize(config: T, storage?: Storage): Promise<boolean>;
     reInitialize(config: Partial<T>): Promise<boolean>;
@@ -34,6 +42,43 @@ declare class ThunderIDJavaScriptClient<T = Config> implements ThunderIDClient<T
      * @throws {ThunderIDRuntimeError} With code `JS-AUTH_CORE-GU-NF01` when the session holds no ID token.
      */
     getUser(userId?: string): Promise<User>;
+    /**
+     * Returns the organization unit the signed-in session was issued for, read from the `ouId`,
+     * `ouHandle` and `ouName` claims of its ID token.
+     *
+     * The claims are not verified here, so the result is for display only and MUST NOT be used for an
+     * authorization decision.
+     *
+     * @param userId - The session to read, on a server.
+     * @returns The current organization unit, or `null` when signed out or when the claims are absent.
+     */
+    getCurrentOrganizationUnit(userId?: string): Promise<CurrentOrganizationUnit | null>;
+    /**
+     * Signs in again bounded to another organization unit. Each platform client implements it; the
+     * base client has no way to reach the user, so it refuses.
+     */
+    switchOrganizationUnit(_organizationUnitId: string, _options?: SwitchOrganizationUnitOptions): Promise<User | TokenResponse | undefined>;
+    /**
+     * Switches the session into the organization unit `organizationUnitId` by exchanging its device secret
+     * at the unit's token endpoint, with no redirect. On success the unit's tokens replace the session's.
+     * A device secret the server refuses as unusable is dropped from the session.
+     *
+     * @returns The new tokens or the server's OAuth error, or `undefined` when the session holds no device
+     *   secret.
+     */
+    protected switchOrganizationUnitWithDeviceSecret(organizationUnitId: string, sessionId?: string): Promise<DeviceSecretSwitchResult | undefined>;
+    /**
+     * Keeps the SSO session handles an embedded flow step returned and drops the ones it ended, so later
+     * flow requests can present them instead of relying on the session cookie.
+     */
+    protected storeFlowSessions(step: {
+        clearedSessions?: string[];
+        sessionData?: EmbeddedFlowSessionData[];
+    }, sessionId?: string): Promise<void>;
+    /**
+     * The SSO session handles kept from embedded flow steps that have not expired.
+     */
+    protected getFlowSessions(sessionId?: string): Promise<EmbeddedFlowSessionData[]>;
     isSignedIn(userId?: string): Promise<boolean>;
     getAccessToken(sessionId?: string): Promise<string>;
     private isCachedTokenStillValid;
@@ -62,6 +107,12 @@ declare class ThunderIDJavaScriptClient<T = Config> implements ThunderIDClient<T
     updateUserProfile(_payload: any, _userId?: string): Promise<User>;
     protected loadOpenIDProviderConfiguration(forceInit?: boolean): Promise<void>;
     protected getSignInUrl(requestConfig?: ExtendedAuthorizeRequestUrlParams, userId?: string): Promise<string>;
+    /**
+     * Pushes an authorization request to the server's pushed authorization request endpoint (RFC 9126),
+     * authenticating the client the way the token request does, and returns the `request_uri` to
+     * redirect with.
+     */
+    protected pushAuthorizationRequest(params: Map<string, string>, metadata?: OIDCDiscoveryApiResponse): Promise<string>;
     protected requestAccessToken(authorizationCode: string, state: string, userId?: string, tokenRequestConfig?: {
         params: Record<string, unknown>;
     }): Promise<TokenResponse>;
@@ -99,6 +150,40 @@ declare class ThunderIDJavaScriptClient<T = Config> implements ThunderIDClient<T
     protected revokeAccessToken(userId?: string): Promise<Response | boolean>;
     initiateCIBA(options: CIBAInitiateOptions): Promise<CIBAInitiateResponse>;
     pollCIBA(authReqId: string, interval: number, options?: CIBAPollOptions): Promise<TokenResponse>;
+    /**
+     * Builds the client authentication for a request to an OAuth endpoint, the way the token request
+     * authenticates: HTTP Basic or form parameters with a secret, `client_id` alone without one.
+     */
+    private clientAuthenticatedRequest;
+    /**
+     * Starts a device authorization request (RFC 8628 §3.1) at the server's device authorization
+     * endpoint (`device_authorization_endpoint` from discovery, else `{baseUrl}/oauth2/device-authorize`).
+     *
+     * Protected here: a server-side or device client exposes it. The returned `deviceCode` is a credential
+     * and is never logged.
+     */
+    protected startDeviceAuthorization(options?: DeviceAuthorizationOptions): Promise<DeviceAuthorizationResponse>;
+    /**
+     * Polls the token endpoint with the device code grant (RFC 8628 §3.4) until the user approves,
+     * denies, or the code expires, waiting at least `interval` seconds between polls and five more after
+     * each `slow_down`. On approval the tokens are stored as a sign-in stores them.
+     *
+     * Protected here: a server-side or device client exposes it.
+     */
+    protected pollDeviceAuthorization(deviceCode: string, interval: number, options?: DeviceAuthorizationPollOptions, userId?: string): Promise<TokenResponse>;
+    /**
+     * Introspects a token (RFC 7662) at the server's introspection endpoint with client authentication.
+     *
+     * Protected here: it needs the client's credentials, so only a server-side client exposes it.
+     */
+    protected introspectToken(token: string, tokenTypeHint?: string): Promise<Record<string, unknown> & {
+        active: boolean;
+    }>;
+    /**
+     * Whether the authorization request `state` belongs to was bounded to an organization unit, so its
+     * callback replaces a session that is still signed in.
+     */
+    protected isOrganizationUnitBoundRequest(state: string, userId?: string): Promise<boolean>;
     protected getPKCECode(state: string, userId?: string): Promise<string>;
     protected setPKCECode(pkce: string, state: string, userId?: string): Promise<void>;
     getInstanceId(): number;

package/dist/ThunderIDJavaScriptClient.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ThunderIDJavaScriptClient.d.ts","sourceRoot":"","sources":["../src/ThunderIDJavaScriptClient.ts"],"names":[],"mappings":"AAaA,OAAO,EAAC,gBAAgB,EAAC,MAAM,oBAAoB,CAAC;AACpD,OAAO,EAAC,WAAW,EAAC,MAAM,gBAAgB,CAAC;AAE3C,OAAO,KAAK,EAAC,mBAAmB,EAAE,oBAAoB,EAAE,eAAe,EAAC,MAAM,eAAe,CAAC;AAC9F,OAAO,EAAC,eAAe,EAAC,MAAM,iBAAiB,CAAC;AAChD,OAAO,EAAmB,MAAM,EAAE,aAAa,EAAE,cAAc,EAAE,aAAa,EAAC,MAAM,iBAAiB,CAAC;AACvG,OAAO,EAAC,MAAM,EAAC,MAAM,iBAAiB,CAAC;AACvC,OAAO,EAAC,iCAAiC,EAAC,MAAM,wBAAwB,CAAC;AACzE,OAAO,EAAC,wBAAwB,EAAC,MAAM,yBAAyB,CAAC;AACjE,OAAO,EAAC,aAAa,EAAC,MAAM,yBAAyB,CAAC;AACtD,OAAO,EAAC,iBAAiB,EAAC,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAc,WAAW,EAAC,MAAM,kBAAkB,CAAC;AAC1D,OAAO,EAAC,OAAO,EAAiB,MAAM,gBAAgB,CAAC;AACvD,OAAO,EAAyB,OAAO,EAAE,0BAA0B,EAAE,aAAa,EAAC,MAAM,gBAAgB,CAAC;AAC1G,OAAO,EAAC,IAAI,EAAE,WAAW,EAAC,MAAM,eAAe,CAAC;AAChD,OAAO,cAAc,MAAM,kBAAkB,CAAC;AAwE9C,cAAM,yBAAyB,CAAC,CAAC,GAAG,MAAM,CAAE,YAAW,eAAe,CAAC,CAAC,CAAC;IACvE,SAAS,CAAC,cAAc,EAAG,cAAc,CAAC,CAAC,CAAC,CAAC;IAE7C,SAAS,CAAC,WAAW,EAAE,MAAM,CAAC;IAE9B,OAAO,CAAC,cAAc,CAAsC;IAE5D,OAAO,CAAC,4BAA4B,CAA2C;IAE/E,OAAO,CAAC,UAAU,CAA2B;IAE7C,OAAO,CAAC,YAAY,CAAoB;IAExC,OAAO,CAAC,eAAe,CAAK;IAE5B,OAAO,CAAC,UAAU,CAAU;IAE5B,OAAO,CAAC,OAAO,CAAM;gBAET,OAAO,CAAC,EAAE,OAAO,EAAE,WAAW,CAAC,EAAE,MAAM;IAOtC,UAAU,CAAC,MAAM,EAAE,CAAC,EAAE,OAAO,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IA8C1D,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC;IAUlD,gBAAgB,IAAI,OAAO,CAAC,CAAC,CAAC;IAI3C;;;;;OAKG;IACU,OAAO,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAkBvC,UAAU,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAoB7C,cAAc,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAkBhE,OAAO,CAAC,uBAAuB;IAYxB,YAAY,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI;IAI7C;;;;OAIG;IACH,SAAS,CAAC,iBAAiB,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIjD,UAAU,CAAC,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAInF,cAAc,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC;IAInF;;;OAGG;cACa,mBAAmB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAOvE,aAAa,CACxB,MAAM,EAAE,0BAA0B,EAClC,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,aAAa,GAAG,QAAQ,GAAG,IAAI,CAAC;IAqFpC,SAAS,IAAI,OAAO;IAIpB,MAAM,CAAC,QAAQ,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,GAAG,aAAa,GAAG,SAAS,CAAC;IAI3E,OAAO,CACZ,QAAQ,CAAC,EAAE,cAAc,EACzB,wBAAwB,CAAC,EAAE,MAAM,GAAG,CAAC,CAAC,eAAe,EAAE,MAAM,KAAK,IAAI,CAAC,EACvE,aAAa,CAAC,EAAE,CAAC,eAAe,EAAE,MAAM,KAAK,IAAI,GAChD,OAAO,CAAC,MAAM,GAAG,OAAO,CAAC;IAIrB,cAAc,CAAC,QAAQ,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,GAAG,OAAO,GAAG,SAAS,CAAC;IAI7E,MAAM,CAAC,QAAQ,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC;IAI/C,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IAIxB,cAAc,CAAC,QAAQ,CAAC,EAAE,GAAG,GAAG,OAAO,CAAC,WAAW,CAAC;IAIpD,iBAAiB,CAAC,QAAQ,EAAE,GAAG,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;cAMxD,+BAA+B,CAAC,SAAS,UAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;cA6IjE,YAAY,CAAC,aAAa,CAAC,EAAE,iCAAiC,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;cAkFjG,kBAAkB,CAChC,iBAAiB,EAAE,MAAM,EACzB,KAAK,EAAE,MAAM,EACb,MAAM,CAAC,EAAE,MAAM,EACf,kBAAkB,CAAC,EAAE;QAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAC,GACrD,OAAO,CAAC,aAAa,CAAC;cAuGT,aAAa,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IA4C/D;;OAEG;cACa,0BAA0B,IAAI,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IAkB7E;;;OAGG;IACU,oBAAoB,IAAI,OAAO,CAAC,wBAAwB,GAAG,IAAI,CAAC;IAU7E;;;;OAIG;cACa,iBAAiB,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;cAUtE,UAAU,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;cAI5C,cAAc,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC;cASrD,kBAAkB,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC;IA2DlF;;;;OAIG;cACa,6BAA6B,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC;IAqGzF;;;;OAIG;cACa,4BAA4B,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC;cAmDhE,iBAAiB,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,OAAO,CAAC;IAQlE,YAAY,CAAC,OAAO,EAAE,mBAAmB,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAqIzE,QAAQ,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,eAAe,GAAG,OAAO,CAAC,aAAa,CAAC;cAkH7F,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;cAI5D,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIjF,aAAa,IAAI,MAAM;IAI9B,SAAS,CAAC,iBAAiB,IAAI,cAAc,CAAC,CAAC,CAAC;IAIhD,SAAS,CAAC,eAAe,IAAI,gBAAgB;WAM/B,mBAAmB,CAAC,eAAe,EAAE,MAAM,GAAG,OAAO;WAQrD,cAAc,CAAC,eAAe,EAAE,MAAM,GAAG,OAAO;IAUjD,eAAe,CAAC,WAAW,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC;CASxE;AAED,eAAe,yBAAyB,CAAC"}
+{"version":3,"file":"ThunderIDJavaScriptClient.d.ts","sourceRoot":"","sources":["../src/ThunderIDJavaScriptClient.ts"],"names":[],"mappings":"AAaA,OAAO,EAAC,gBAAgB,EAAC,MAAM,oBAAoB,CAAC;AACpD,OAAO,EAAC,WAAW,EAAC,MAAM,gBAAgB,CAAC;AAG3C,OAAO,KAAK,EAAC,mBAAmB,EAAE,oBAAoB,EAAE,eAAe,EAAC,MAAM,eAAe,CAAC;AAC9F,OAAO,EAAC,eAAe,EAAC,MAAM,iBAAiB,CAAC;AAChD,OAAO,EAAmB,MAAM,EAAE,aAAa,EAAE,cAAc,EAAE,aAAa,EAAC,MAAM,iBAAiB,CAAC;AACvG,OAAO,EAAC,MAAM,EAAC,MAAM,iBAAiB,CAAC;AACvC,OAAO,KAAK,EAAC,uBAAuB,EAAE,6BAA6B,EAAC,MAAM,uCAAuC,CAAC;AAClH,OAAO,KAAK,EACV,0BAA0B,EAC1B,8BAA8B,EAC9B,2BAA2B,EAC5B,MAAM,+BAA+B,CAAC;AACvC,OAAO,KAAK,EAAC,uBAAuB,EAAC,MAAM,wBAAwB,CAAC;AACpE,OAAO,EAAC,iCAAiC,EAAC,MAAM,wBAAwB,CAAC;AACzE,OAAO,EAAC,wBAAwB,EAAC,MAAM,yBAAyB,CAAC;AACjE,OAAO,EAAC,aAAa,EAAC,MAAM,yBAAyB,CAAC;AACtD,OAAO,EAAC,iBAAiB,EAAC,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAiC,WAAW,EAAC,MAAM,kBAAkB,CAAC;AAC7E,OAAO,EAAC,OAAO,EAAiB,MAAM,gBAAgB,CAAC;AACvD,OAAO,EAEL,wBAAwB,EACxB,OAAO,EACP,0BAA0B,EAC1B,aAAa,EACd,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAC,IAAI,EAAE,WAAW,EAAC,MAAM,eAAe,CAAC;AAChD,OAAO,cAAc,MAAM,kBAAkB,CAAC;AAqF9C,cAAM,yBAAyB,CAAC,CAAC,GAAG,MAAM,CAAE,YAAW,eAAe,CAAC,CAAC,CAAC;IACvE,SAAS,CAAC,cAAc,EAAG,cAAc,CAAC,CAAC,CAAC,CAAC;IAE7C,SAAS,CAAC,WAAW,EAAE,MAAM,CAAC;IAE9B,OAAO,CAAC,cAAc,CAAsC;IAE5D,OAAO,CAAC,4BAA4B,CAA2C;IAE/E,OAAO,CAAC,UAAU,CAA2B;IAE7C,OAAO,CAAC,YAAY,CAAoB;IAExC,OAAO,CAAC,eAAe,CAAK;IAE5B,OAAO,CAAC,UAAU,CAAU;IAE5B,OAAO,CAAC,OAAO,CAAM;IAErB;;;OAGG;IACH,SAAS,CAAC,yBAAyB,EAAE,MAAM,GAAG,SAAS,CAAC;gBAE5C,OAAO,CAAC,EAAE,OAAO,EAAE,WAAW,CAAC,EAAE,MAAM;IAOtC,UAAU,CAAC,MAAM,EAAE,CAAC,EAAE,OAAO,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IA8C1D,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC;IAUlD,gBAAgB,IAAI,OAAO,CAAC,CAAC,CAAC;IAI3C;;;;;OAKG;IACU,OAAO,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAkBpD;;;;;;;;;OASG;IACU,0BAA0B,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,GAAG,IAAI,CAAC;IAcjG;;;OAGG;IACI,sBAAsB,CAE3B,mBAAmB,EAAE,MAAM,EAE3B,QAAQ,CAAC,EAAE,6BAA6B,GACvC,OAAO,CAAC,IAAI,GAAG,aAAa,GAAG,SAAS,CAAC;IAU5C;;;;;;;OAOG;cACa,sCAAsC,CACpD,kBAAkB,EAAE,MAAM,EAC1B,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,wBAAwB,GAAG,SAAS,CAAC;IAwFhD;;;OAGG;cACa,iBAAiB,CAC/B,IAAI,EAAE;QAAC,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,WAAW,CAAC,EAAE,uBAAuB,EAAE,CAAA;KAAC,EAC3E,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,IAAI,CAAC;IAwBhB;;OAEG;cACa,eAAe,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,EAAE,CAAC;IAQ1E,UAAU,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAoB7C,cAAc,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAkBhE,OAAO,CAAC,uBAAuB;IAYxB,YAAY,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI;IAI7C;;;;OAIG;IACH,SAAS,CAAC,iBAAiB,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIjD,UAAU,CAAC,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAInF,cAAc,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC;IAInF;;;OAGG;cACa,mBAAmB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAOvE,aAAa,CACxB,MAAM,EAAE,0BAA0B,EAClC,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,aAAa,GAAG,QAAQ,GAAG,IAAI,CAAC;IAqFpC,SAAS,IAAI,OAAO;IAIpB,MAAM,CAAC,QAAQ,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,GAAG,aAAa,GAAG,SAAS,CAAC;IAI3E,OAAO,CACZ,QAAQ,CAAC,EAAE,cAAc,EACzB,wBAAwB,CAAC,EAAE,MAAM,GAAG,CAAC,CAAC,eAAe,EAAE,MAAM,KAAK,IAAI,CAAC,EACvE,aAAa,CAAC,EAAE,CAAC,eAAe,EAAE,MAAM,KAAK,IAAI,GAChD,OAAO,CAAC,MAAM,GAAG,OAAO,CAAC;IAIrB,cAAc,CAAC,QAAQ,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,GAAG,OAAO,GAAG,SAAS,CAAC;IAI7E,MAAM,CAAC,QAAQ,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC;IAI/C,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IAIxB,cAAc,CAAC,QAAQ,CAAC,EAAE,GAAG,GAAG,OAAO,CAAC,WAAW,CAAC;IAIpD,iBAAiB,CAAC,QAAQ,EAAE,GAAG,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;cAMxD,+BAA+B,CAAC,SAAS,UAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;cA6IjE,YAAY,CAAC,aAAa,CAAC,EAAE,iCAAiC,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAgHjH;;;;OAIG;cACa,wBAAwB,CACtC,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,EAC3B,QAAQ,CAAC,EAAE,wBAAwB,GAClC,OAAO,CAAC,MAAM,CAAC;cA2DF,kBAAkB,CAChC,iBAAiB,EAAE,MAAM,EACzB,KAAK,EAAE,MAAM,EACb,MAAM,CAAC,EAAE,MAAM,EACf,kBAAkB,CAAC,EAAE;QAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAC,GACrD,OAAO,CAAC,aAAa,CAAC;cAsHT,aAAa,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IA4C/D;;OAEG;cACa,0BAA0B,IAAI,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IAkB7E;;;OAGG;IACU,oBAAoB,IAAI,OAAO,CAAC,wBAAwB,GAAG,IAAI,CAAC;IAU7E;;;;OAIG;cACa,iBAAiB,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;cAUtE,UAAU,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;cAI5C,cAAc,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC;cASrD,kBAAkB,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC;IA2DlF;;;;OAIG;cACa,6BAA6B,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC;IAqGzF;;;;OAIG;cACa,4BAA4B,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC;cAmDhE,iBAAiB,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,OAAO,CAAC;IAQlE,YAAY,CAAC,OAAO,EAAE,mBAAmB,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAqIzE,QAAQ,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,eAAe,GAAG,OAAO,CAAC,aAAa,CAAC;IAkH7G;;;OAGG;YACW,0BAA0B;IAyBxC;;;;;;OAMG;cACa,wBAAwB,CACtC,OAAO,GAAE,0BAA+B,GACvC,OAAO,CAAC,2BAA2B,CAAC;IA2FvC;;;;;;OAMG;cACa,uBAAuB,CACrC,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE,8BAA8B,EACxC,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,aAAa,CAAC;IA8FzB;;;;OAIG;cACa,eAAe,CAC7B,KAAK,EAAE,MAAM,EACb,aAAa,CAAC,EAAE,MAAM,GACrB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG;QAAC,MAAM,EAAE,OAAO,CAAA;KAAC,CAAC;IAsGvD;;;OAGG;cACa,8BAA8B,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;cAShF,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;cAI5D,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIjF,aAAa,IAAI,MAAM;IAI9B,SAAS,CAAC,iBAAiB,IAAI,cAAc,CAAC,CAAC,CAAC;IAIhD,SAAS,CAAC,eAAe,IAAI,gBAAgB;WAM/B,mBAAmB,CAAC,eAAe,EAAE,MAAM,GAAG,OAAO;WAQrD,cAAc,CAAC,eAAe,EAAE,MAAM,GAAG,OAAO;IAUjD,eAAe,CAAC,WAAW,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC;CASxE;AAED,eAAe,yBAAyB,CAAC"}

package/dist/api/account/getAccessibleOrganizationUnits.d.ts

@@ -0,0 +1,38 @@
+import { AccessibleOrganizationUnitList, AccessibleOrganizationUnitsOptions } from '../../models/accessible-organization-unit';
+import { ManagementRequestConfig } from '../../models/api';
+/**
+ * Configuration for the getAccessibleOrganizationUnits request.
+ */
+export interface GetAccessibleOrganizationUnitsConfig extends ManagementRequestConfig, AccessibleOrganizationUnitsOptions {
+    /**
+     * The absolute endpoint URL. Defaults to `{baseUrl}/users/me/ous`.
+     */
+    url?: string;
+}
+/**
+ * Lists the organization units the signed-in user can access, from `/users/me/ous`: the one the user
+ * lives in and every one the user is shared into. The request must carry the signed-in user's access
+ * token (pass it in `headers`, or a `fetcher` that attaches it).
+ *
+ * `current` is the unit the list is relative to: the one the token was issued for, or the user's own
+ * when the token names none. It is returned whatever the scope or page.
+ *
+ * @param config - Request configuration: `baseUrl` or `url`, and optional `scope`, `limit` and `offset`.
+ * @returns One page of the accessible organization units.
+ * @throws {ThunderIDAPIError} `getAccessibleOrganizationUnits-ForbiddenError-001` and
+ *   `getAccessibleOrganizationUnits-NotFoundError-001` for 403 and 404, and
+ *   `getAccessibleOrganizationUnits-ResponseError-001` for any other rejection, with the server's error
+ *   in `serverError`.
+ *
+ * @example
+ * ```typescript
+ * const {current, organizationUnits} = await getAccessibleOrganizationUnits({
+ *   baseUrl: 'https://localhost:8090',
+ *   headers: {Authorization: `Bearer ${accessToken}`},
+ *   scope: 'siblings',
+ * });
+ * ```
+ */
+declare const getAccessibleOrganizationUnits: ({ limit, offset, scope, baseUrl, ...requestConfig }: GetAccessibleOrganizationUnitsConfig) => Promise<AccessibleOrganizationUnitList>;
+export default getAccessibleOrganizationUnits;
+//# sourceMappingURL=getAccessibleOrganizationUnits.d.ts.map

package/dist/api/account/getAccessibleOrganizationUnits.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"getAccessibleOrganizationUnits.d.ts","sourceRoot":"","sources":["../../../src/api/account/getAccessibleOrganizationUnits.ts"],"names":[],"mappings":"AAGA,OAAO,EAEL,8BAA8B,EAC9B,kCAAkC,EACnC,MAAM,2CAA2C,CAAC;AACnD,OAAO,EAAC,uBAAuB,EAAC,MAAM,kBAAkB,CAAC;AAGzD;;GAEG;AACH,MAAM,WAAW,oCACf,SAAQ,uBAAuB,EAC7B,kCAAkC;IACpC;;OAEG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAUD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,QAAA,MAAM,8BAA8B,GAAU,qDAM3C,oCAAoC,KAAG,OAAO,CAAC,8BAA8B,CAsB/E,CAAC;AAEF,eAAe,8BAA8B,CAAC"}

package/dist/api/auth/executeEmbeddedDeviceGrantFlow.d.ts

@@ -20,13 +20,22 @@ export interface EmbeddedDeviceGrantFlowRequestConfig extends Omit<EmbeddedFlowE
     payload?: EmbeddedDeviceGrantFlowPayload;
 }
 /**
- * Executes or continues the application's configured Device Grant flow.
+ * Verifies a device's user code: runs, or continues, the application's `DEVICE_GRANT` flow in embedded
+ * mode (the user side of RFC 8628 device authorization), so a signed-in user approves a device from the
+ * application. Start it with `{applicationId, flowType: 'DEVICE_GRANT', inputs: {user_code}}` and drive
+ * it like any embedded flow.
  *
  * The request starts at the existing flow execution endpoint. When the terminal flow response
  * carries the server-issued authorization request ID and assertion, this function relays them
  * to the existing OAuth callback endpoint. A start request requires its application ID; an optional
  * user code is submitted as flow input.
  */
-declare const executeEmbeddedDeviceGrantFlow: ({ baseUrl, payload, url, ...requestConfig }: EmbeddedDeviceGrantFlowRequestConfig) => Promise<EmbeddedDeviceGrantFlowResponse>;
+export declare const verifyDeviceCode: ({ baseUrl, payload, url, ...requestConfig }: EmbeddedDeviceGrantFlowRequestConfig) => Promise<EmbeddedDeviceGrantFlowResponse>;
+/**
+ * Executes or continues the application's configured Device Grant flow.
+ *
+ * @deprecated Use {@link verifyDeviceCode}, the canonical name. This alias is the same function.
+ */
+declare const executeEmbeddedDeviceGrantFlow: typeof verifyDeviceCode;
 export default executeEmbeddedDeviceGrantFlow;
 //# sourceMappingURL=executeEmbeddedDeviceGrantFlow.d.ts.map

package/dist/api/auth/executeEmbeddedDeviceGrantFlow.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"executeEmbeddedDeviceGrantFlow.d.ts","sourceRoot":"","sources":["../../../src/api/auth/executeEmbeddedDeviceGrantFlow.ts"],"names":[],"mappings":"AAIA,OAAO,EAAC,gCAAgC,EAAE,gBAAgB,EAAC,MAAM,4BAA4B,CAAC;AAC9F,OAAO,EAAC,0BAA0B,EAA2B,MAAM,mCAAmC,CAAC;AAEvG,MAAM,WAAW,mCAAmC;IAClD,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,gBAAgB,CAAC,WAAW,CAAC;IACvC,MAAM,EAAE;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAC,CAAC;CAC9B;AAED,MAAM,WAAW,0CAA0C;IACzD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AAED,MAAM,MAAM,8BAA8B,GACtC,mCAAmC,GACnC,0CAA0C,CAAC;AAE/C,qEAAqE;AACrE,MAAM,MAAM,+BAA+B,GAAG,0BAA0B,CAAC;AAEzE,MAAM,WAAW,oCACf,SAAQ,IAAI,CAAC,gCAAgC,CAAC,8BAA8B,CAAC,EAAE,QAAQ,GAAG,YAAY,CAAC;IACvG,OAAO,CAAC,EAAE,8BAA8B,CAAC;CAC1C;AAiED;;;;;;;GAOG;AACH,QAAA,MAAM,8BAA8B,GAAU,6CAK3C,oCAAoC,KAAG,OAAO,CAAC,+BAA+B,CA6KhF,CAAC;AAEF,eAAe,8BAA8B,CAAC"}
+{"version":3,"file":"executeEmbeddedDeviceGrantFlow.d.ts","sourceRoot":"","sources":["../../../src/api/auth/executeEmbeddedDeviceGrantFlow.ts"],"names":[],"mappings":"AAIA,OAAO,EAAC,gCAAgC,EAAE,gBAAgB,EAAC,MAAM,4BAA4B,CAAC;AAC9F,OAAO,EAAC,0BAA0B,EAA2B,MAAM,mCAAmC,CAAC;AAEvG,MAAM,WAAW,mCAAmC;IAClD,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,gBAAgB,CAAC,WAAW,CAAC;IACvC,MAAM,EAAE;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAC,CAAC;CAC9B;AAED,MAAM,WAAW,0CAA0C;IACzD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AAED,MAAM,MAAM,8BAA8B,GACtC,mCAAmC,GACnC,0CAA0C,CAAC;AAE/C,qEAAqE;AACrE,MAAM,MAAM,+BAA+B,GAAG,0BAA0B,CAAC;AAEzE,MAAM,WAAW,oCACf,SAAQ,IAAI,CAAC,gCAAgC,CAAC,8BAA8B,CAAC,EAAE,QAAQ,GAAG,YAAY,CAAC;IACvG,OAAO,CAAC,EAAE,8BAA8B,CAAC;CAC1C;AAiED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,gBAAgB,GAAU,6CAKpC,oCAAoC,KAAG,OAAO,CAAC,+BAA+B,CA6KhF,CAAC;AAEF;;;;GAIG;AACH,QAAA,MAAM,8BAA8B,EAAE,OAAO,gBAAmC,CAAC;AAEjF,eAAe,8BAA8B,CAAC"}

package/dist/api/auth/executeEmbeddedSelfFlow.d.ts

@@ -0,0 +1,57 @@
+import { EmbeddedSelfFlowRequest, EmbeddedSelfFlowResponse } from '../../models/embedded-self-flow';
+/**
+ * Configuration for the executeEmbeddedSelfFlow request.
+ */
+export interface ExecuteEmbeddedSelfFlowConfig extends Omit<RequestInit, 'method' | 'body'> {
+    /**
+     * The base path of the API endpoint.
+     */
+    baseUrl?: string;
+    /**
+     * Optional custom fetcher function. If not provided, native fetch is used, which sends no
+     * access token; framework SDKs pass a fetcher that attaches the signed-in user's token.
+     */
+    fetcher?: (url: string, config: RequestInit) => Promise<Response>;
+    /**
+     * The step to execute: an initiating request or a continuation.
+     */
+    payload: EmbeddedSelfFlowRequest;
+    /**
+     * The absolute flow execution endpoint.
+     */
+    url?: string;
+}
+/**
+ * Executes one step of a `SELF` flow, an operation the signed-in user performs on their own
+ * account, such as verifying their email address. A new execution names the flow by its handle; the
+ * server takes the user from the access token on that first request and keeps it for the execution.
+ *
+ * @param config - Configuration object with URL, payload, fetcher and optional request config.
+ * @returns A promise that resolves with the flow step.
+ * @throws ThunderIDAPIError when the input is invalid or the request fails, coded
+ * `executeEmbeddedSelfFlow-` plus `ValidationError-001` (invalid `url` or `baseUrl`), `ValidationError-002`
+ * (no payload), `ValidationError-003` (a new flow without a handle), `ResponseError-001` (the server refused, with
+ * its status) or `NetworkError-001` (no response, or an unreadable one).
+ *
+ * @example
+ * ```typescript
+ * const step = await executeEmbeddedSelfFlow({
+ *   baseUrl: 'https://localhost:8090',
+ *   payload: {
+ *     flowType: 'SELF',
+ *     handle: 'default-self-attribute-verification-flow',
+ *     inputs: {attribute: 'email'},
+ *   },
+ *   fetcher: authenticatedFetcher,
+ * });
+ *
+ * await executeEmbeddedSelfFlow({
+ *   baseUrl: 'https://localhost:8090',
+ *   payload: {executionId: step.executionId, action: 'verify', inputs: {otp: '123456'}},
+ *   fetcher: authenticatedFetcher,
+ * });
+ * ```
+ */
+declare const executeEmbeddedSelfFlow: ({ url, baseUrl, payload, fetcher, ...requestConfig }: ExecuteEmbeddedSelfFlowConfig) => Promise<EmbeddedSelfFlowResponse>;
+export default executeEmbeddedSelfFlow;
+//# sourceMappingURL=executeEmbeddedSelfFlow.d.ts.map

package/dist/api/auth/executeEmbeddedSelfFlow.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"executeEmbeddedSelfFlow.d.ts","sourceRoot":"","sources":["../../../src/api/auth/executeEmbeddedSelfFlow.ts"],"names":[],"mappings":"AAIA,OAAO,EAAC,uBAAuB,EAAE,wBAAwB,EAAC,MAAM,iCAAiC,CAAC;AAElG;;GAEG;AACH,MAAM,WAAW,6BAA8B,SAAQ,IAAI,CAAC,WAAW,EAAE,QAAQ,GAAG,MAAM,CAAC;IACzF;;OAEG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;OAGG;IACH,OAAO,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;IAClE;;OAEG;IACH,OAAO,EAAE,uBAAuB,CAAC;IACjC;;OAEG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,QAAA,MAAM,uBAAuB,GAAU,sDAMpC,6BAA6B,KAAG,OAAO,CAAC,wBAAwB,CA+ElE,CAAC;AAEF,eAAe,uBAAuB,CAAC"}

package/dist/api/auth/executeEmbeddedSignInFlow.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"executeEmbeddedSignInFlow.d.ts","sourceRoot":"","sources":["../../../src/api/auth/executeEmbeddedSignInFlow.ts"],"names":[],"mappings":"AAKA,OAAO,EAAC,gCAAgC,EAA0B,MAAM,4BAA4B,CAAC;AACrG,OAAO,EAAC,0BAA0B,EAA2B,MAAM,mCAAmC,CAAC;AAuEvG,QAAA,MAAM,yBAAyB,GAAU,iEAOtC,gCAAgC,KAAG,OAAO,CAAC,0BAA0B,CA0HvE,CAAC;AAEF,eAAe,yBAAyB,CAAC"}
+{"version":3,"file":"executeEmbeddedSignInFlow.d.ts","sourceRoot":"","sources":["../../../src/api/auth/executeEmbeddedSignInFlow.ts"],"names":[],"mappings":"AAKA,OAAO,EAAC,gCAAgC,EAA0B,MAAM,4BAA4B,CAAC;AACrG,OAAO,EAAC,0BAA0B,EAA2B,MAAM,mCAAmC,CAAC;AAuEvG,QAAA,MAAM,yBAAyB,GAAU,iEAOtC,gCAAgC,KAAG,OAAO,CAAC,0BAA0B,CAkIvE,CAAC;AAEF,eAAe,yBAAyB,CAAC"}

package/dist/api/auth/getSupportedAuthorizationDetailsType.d.ts

@@ -0,0 +1,29 @@
+import { ManagementRequestConfig } from '../../models/api';
+import { SupportedAuthorizationDetailsType } from '../../models/authorization-detail-type';
+/**
+ * Configuration for the getSupportedAuthorizationDetailsType request. `url`, when given, is the absolute
+ * URL of the types endpoint; otherwise it is `{baseUrl}/oauth2/authorization-details-types`.
+ */
+export interface GetSupportedAuthorizationDetailsTypeConfig extends ManagementRequestConfig {
+    /**
+     * The type value, such as `payment_initiation` or a URI. It is percent-encoded as one path segment.
+     */
+    type: string;
+}
+/**
+ * Retrieves the request view of one authorization details type a client may request.
+ *
+ * @param config - Request configuration object.
+ * @returns A promise that resolves with the type's request view.
+ *
+ * @example
+ * ```typescript
+ * const paymentType = await getSupportedAuthorizationDetailsType({
+ *   baseUrl: 'https://localhost:8090',
+ *   type: 'payment_initiation',
+ * });
+ * ```
+ */
+declare const getSupportedAuthorizationDetailsType: ({ type, ...config }: GetSupportedAuthorizationDetailsTypeConfig) => Promise<SupportedAuthorizationDetailsType>;
+export default getSupportedAuthorizationDetailsType;
+//# sourceMappingURL=getSupportedAuthorizationDetailsType.d.ts.map

package/dist/api/auth/getSupportedAuthorizationDetailsType.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"getSupportedAuthorizationDetailsType.d.ts","sourceRoot":"","sources":["../../../src/api/auth/getSupportedAuthorizationDetailsType.ts"],"names":[],"mappings":"AAGA,OAAO,EAAC,uBAAuB,EAAC,MAAM,kBAAkB,CAAC;AACzD,OAAO,EAAC,iCAAiC,EAAC,MAAM,wCAAwC,CAAC;AAGzF;;;GAGG;AACH,MAAM,WAAW,0CAA2C,SAAQ,uBAAuB;IACzF;;OAEG;IACH,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;;;;;;;;;;;;GAaG;AACH,QAAA,MAAM,oCAAoC,GAAU,qBAGjD,0CAA0C,KAAG,OAAO,CAAC,iCAAiC,CAOrF,CAAC;AAEL,eAAe,oCAAoC,CAAC"}

package/dist/api/auth/getSupportedAuthorizationDetailsTypes.d.ts

@@ -0,0 +1,24 @@
+import { ManagementRequestConfig } from '../../models/api';
+import { SupportedAuthorizationDetailsTypesResponse } from '../../models/authorization-detail-type';
+/**
+ * Configuration for the getSupportedAuthorizationDetailsTypes request. `url`, when given, is the absolute
+ * URL of the types endpoint, such as the `authorization_details_types_endpoint` the server's discovery
+ * document advertises; otherwise it is `{baseUrl}/oauth2/authorization-details-types`. The endpoint is
+ * public, so no access token is needed.
+ */
+export type GetSupportedAuthorizationDetailsTypesConfig = ManagementRequestConfig;
+/**
+ * Retrieves the RFC 9396 authorization details types a client may request, each with the fields a client
+ * may send and the changes it may make to a granted detail at the token endpoint.
+ *
+ * @param config - Request configuration object.
+ * @returns A promise that resolves with every registered type's request view.
+ *
+ * @example
+ * ```typescript
+ * const {types} = await getSupportedAuthorizationDetailsTypes({baseUrl: 'https://localhost:8090'});
+ * ```
+ */
+declare const getSupportedAuthorizationDetailsTypes: (config: GetSupportedAuthorizationDetailsTypesConfig) => Promise<SupportedAuthorizationDetailsTypesResponse>;
+export default getSupportedAuthorizationDetailsTypes;
+//# sourceMappingURL=getSupportedAuthorizationDetailsTypes.d.ts.map

package/dist/api/auth/getSupportedAuthorizationDetailsTypes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"getSupportedAuthorizationDetailsTypes.d.ts","sourceRoot":"","sources":["../../../src/api/auth/getSupportedAuthorizationDetailsTypes.ts"],"names":[],"mappings":"AAGA,OAAO,EAAC,uBAAuB,EAAC,MAAM,kBAAkB,CAAC;AACzD,OAAO,EAAC,0CAA0C,EAAC,MAAM,wCAAwC,CAAC;AAGlG;;;;;GAKG;AACH,MAAM,MAAM,2CAA2C,GAAG,uBAAuB,CAAC;AAElF;;;;;;;;;;;GAWG;AACH,QAAA,MAAM,qCAAqC,GACzC,QAAQ,2CAA2C,KAClD,OAAO,CAAC,0CAA0C,CAMjD,CAAC;AAEL,eAAe,qCAAqC,CAAC"}

package/dist/api/management/agents/getAgents.d.ts

@@ -3,7 +3,13 @@ import { ApiFilteringParams, ManagementRequestConfig } from '../../../models/api
 /**
  * Configuration for the getAgents request.
  */
-export type GetAgentsConfig = ManagementRequestConfig & Pick<ApiFilteringParams, 'filter' | 'limit' | 'offset'>;
+export type GetAgentsConfig = ManagementRequestConfig & Pick<ApiFilteringParams, 'filter' | 'limit' | 'offset'> & {
+    /**
+     * Lists the agents the project's root organization unit owns, followed by the ones shared into
+     * it. Served by the control plane.
+     */
+    projectId?: string;
+};
 /**
  * Retrieves a page of agents.
  *
@@ -19,6 +25,6 @@ export type GetAgentsConfig = ManagementRequestConfig & Pick<ApiFilteringParams,
  * });
  * ```
  */
-declare const getAgents: ({ filter, limit, offset, ...config }: GetAgentsConfig) => Promise<AgentListResponse>;
+declare const getAgents: ({ filter, limit, offset, projectId, ...config }: GetAgentsConfig) => Promise<AgentListResponse>;
 export default getAgents;
 //# sourceMappingURL=getAgents.d.ts.map

package/dist/api/management/agents/getAgents.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"getAgents.d.ts","sourceRoot":"","sources":["../../../../src/api/management/agents/getAgents.ts"],"names":[],"mappings":"AAGA,OAAO,EAAC,iBAAiB,EAAC,MAAM,gCAAgC,CAAC;AACjE,OAAO,EAAC,kBAAkB,EAAE,uBAAuB,EAAC,MAAM,qBAAqB,CAAC;AAGhF;;GAEG;AACH,MAAM,MAAM,eAAe,GAAG,uBAAuB,GAAG,IAAI,CAAC,kBAAkB,EAAE,QAAQ,GAAG,OAAO,GAAG,QAAQ,CAAC,CAAC;AAEhH;;;;;;;;;;;;;;GAcG;AACH,QAAA,MAAM,SAAS,GAAU,sCAAoC,eAAe,KAAG,OAAO,CAAC,iBAAiB,CAOpG,CAAC;AAEL,eAAe,SAAS,CAAC"}
+{"version":3,"file":"getAgents.d.ts","sourceRoot":"","sources":["../../../../src/api/management/agents/getAgents.ts"],"names":[],"mappings":"AAGA,OAAO,EAAC,iBAAiB,EAAC,MAAM,gCAAgC,CAAC;AACjE,OAAO,EAAC,kBAAkB,EAAE,uBAAuB,EAAC,MAAM,qBAAqB,CAAC;AAGhF;;GAEG;AACH,MAAM,MAAM,eAAe,GAAG,uBAAuB,GACnD,IAAI,CAAC,kBAAkB,EAAE,QAAQ,GAAG,OAAO,GAAG,QAAQ,CAAC,GAAG;IACxD;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAEJ;;;;;;;;;;;;;;GAcG;AACH,QAAA,MAAM,SAAS,GAAU,iDAA+C,eAAe,KAAG,OAAO,CAAC,iBAAiB,CAO/G,CAAC;AAEL,eAAe,SAAS,CAAC"}

package/dist/api/management/applications/getApplications.d.ts

@@ -3,7 +3,13 @@ import { ApplicationListResponse } from '../../../models/application';
 /**
  * Configuration for the getApplications request.
  */
-export type GetApplicationsConfig = ManagementRequestConfig & Pick<ApiFilteringParams, 'limit' | 'offset'>;
+export type GetApplicationsConfig = ManagementRequestConfig & Pick<ApiFilteringParams, 'limit' | 'offset'> & {
+    /**
+     * Lists the applications the project's root organization unit owns, followed by the ones shared
+     * into it. Served by the control plane.
+     */
+    projectId?: string;
+};
 /**
  * Retrieves a page of applications.
  *
@@ -19,6 +25,6 @@ export type GetApplicationsConfig = ManagementRequestConfig & Pick<ApiFilteringP
  * });
  * ```
  */
-declare const getApplications: ({ limit, offset, ...config }: GetApplicationsConfig) => Promise<ApplicationListResponse>;
+declare const getApplications: ({ limit, offset, projectId, ...config }: GetApplicationsConfig) => Promise<ApplicationListResponse>;
 export default getApplications;
 //# sourceMappingURL=getApplications.d.ts.map

package/dist/api/management/applications/getApplications.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"getApplications.d.ts","sourceRoot":"","sources":["../../../../src/api/management/applications/getApplications.ts"],"names":[],"mappings":"AAGA,OAAO,EAAC,kBAAkB,EAAE,uBAAuB,EAAC,MAAM,qBAAqB,CAAC;AAChF,OAAO,EAAC,uBAAuB,EAAC,MAAM,6BAA6B,CAAC;AAGpE;;GAEG;AACH,MAAM,MAAM,qBAAqB,GAAG,uBAAuB,GAAG,IAAI,CAAC,kBAAkB,EAAE,OAAO,GAAG,QAAQ,CAAC,CAAC;AAE3G;;;;;;;;;;;;;;GAcG;AACH,QAAA,MAAM,eAAe,GAAU,8BAA4B,qBAAqB,KAAG,OAAO,CAAC,uBAAuB,CAO9G,CAAC;AAEL,eAAe,eAAe,CAAC"}
+{"version":3,"file":"getApplications.d.ts","sourceRoot":"","sources":["../../../../src/api/management/applications/getApplications.ts"],"names":[],"mappings":"AAGA,OAAO,EAAC,kBAAkB,EAAE,uBAAuB,EAAC,MAAM,qBAAqB,CAAC;AAChF,OAAO,EAAC,uBAAuB,EAAC,MAAM,6BAA6B,CAAC;AAGpE;;GAEG;AACH,MAAM,MAAM,qBAAqB,GAAG,uBAAuB,GACzD,IAAI,CAAC,kBAAkB,EAAE,OAAO,GAAG,QAAQ,CAAC,GAAG;IAC7C;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAEJ;;;;;;;;;;;;;;GAcG;AACH,QAAA,MAAM,eAAe,GAAU,yCAK5B,qBAAqB,KAAG,OAAO,CAAC,uBAAuB,CAOtD,CAAC;AAEL,eAAe,eAAe,CAAC"}

package/dist/api/management/authorization-detail-types/createAuthorizationDetailType.d.ts

@@ -0,0 +1,28 @@
+import { ManagementRequestConfig } from '../../../models/api';
+import { AuthorizationDetailTypeRequest, AuthorizationDetailType } from '../../../models/authorization-detail-type';
+/**
+ * Configuration for the createAuthorizationDetailType request.
+ */
+export interface CreateAuthorizationDetailTypeConfig extends ManagementRequestConfig {
+    /**
+     * The authorization details type to create.
+     */
+    payload: AuthorizationDetailTypeRequest;
+}
+/**
+ * Creates an authorization details type.
+ *
+ * @param config - Request configuration object.
+ * @returns A promise that resolves with the authorization details type as the server stored it.
+ *
+ * @example
+ * ```typescript
+ * const item = await createAuthorizationDetailType({
+ *   baseUrl: 'https://localhost:8090',
+ *   payload: {type: 'payment_initiation', name: 'Payment initiation', schema: {type: 'object'}},
+ * });
+ * ```
+ */
+declare const createAuthorizationDetailType: ({ payload, ...config }: CreateAuthorizationDetailTypeConfig) => Promise<AuthorizationDetailType>;
+export default createAuthorizationDetailType;
+//# sourceMappingURL=createAuthorizationDetailType.d.ts.map

package/dist/api/management/authorization-detail-types/createAuthorizationDetailType.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"createAuthorizationDetailType.d.ts","sourceRoot":"","sources":["../../../../src/api/management/authorization-detail-types/createAuthorizationDetailType.ts"],"names":[],"mappings":"AAGA,OAAO,EAAC,uBAAuB,EAAC,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAC,8BAA8B,EAAE,uBAAuB,EAAC,MAAM,2CAA2C,CAAC;AAGlH;;GAEG;AACH,MAAM,WAAW,mCAAoC,SAAQ,uBAAuB;IAClF;;OAEG;IACH,OAAO,EAAE,8BAA8B,CAAC;CACzC;AAED;;;;;;;;;;;;;GAaG;AACH,QAAA,MAAM,6BAA6B,GAAU,wBAG1C,mCAAmC,KAAG,OAAO,CAAC,uBAAuB,CAOpE,CAAC;AAEL,eAAe,6BAA6B,CAAC"}

package/dist/api/management/authorization-detail-types/deleteAuthorizationDetailType.d.ts

@@ -0,0 +1,24 @@
+import { ManagementRequestConfig } from '../../../models/api';
+/**
+ * Configuration for the deleteAuthorizationDetailType request.
+ */
+export interface DeleteAuthorizationDetailTypeConfig extends ManagementRequestConfig {
+    /**
+     * Identifier of the authorization details type.
+     */
+    authorizationDetailTypeId: string;
+}
+/**
+ * Deletes an authorization details type.
+ *
+ * @param config - Request configuration object.
+ * @returns A promise that resolves once the server has made the change.
+ *
+ * @example
+ * ```typescript
+ * await deleteAuthorizationDetailType({baseUrl: 'https://localhost:8090', authorizationDetailTypeId});
+ * ```
+ */
+declare const deleteAuthorizationDetailType: ({ authorizationDetailTypeId, ...config }: DeleteAuthorizationDetailTypeConfig) => Promise<void>;
+export default deleteAuthorizationDetailType;
+//# sourceMappingURL=deleteAuthorizationDetailType.d.ts.map

package/dist/api/management/authorization-detail-types/deleteAuthorizationDetailType.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"deleteAuthorizationDetailType.d.ts","sourceRoot":"","sources":["../../../../src/api/management/authorization-detail-types/deleteAuthorizationDetailType.ts"],"names":[],"mappings":"AAGA,OAAO,EAAC,uBAAuB,EAAC,MAAM,qBAAqB,CAAC;AAG5D;;GAEG;AACH,MAAM,WAAW,mCAAoC,SAAQ,uBAAuB;IAClF;;OAEG;IACH,yBAAyB,EAAE,MAAM,CAAC;CACnC;AAED;;;;;;;;;;GAUG;AACH,QAAA,MAAM,6BAA6B,GAAU,0CAG1C,mCAAmC,KAAG,OAAO,CAAC,IAAI,CAQpD,CAAC;AAEF,eAAe,6BAA6B,CAAC"}

package/dist/api/management/authorization-detail-types/getAuthorizationDetailType.d.ts

@@ -0,0 +1,25 @@
+import { ManagementRequestConfig } from '../../../models/api';
+import { AuthorizationDetailType } from '../../../models/authorization-detail-type';
+/**
+ * Configuration for the getAuthorizationDetailType request.
+ */
+export interface GetAuthorizationDetailTypeConfig extends ManagementRequestConfig {
+    /**
+     * Identifier of the authorization details type.
+     */
+    authorizationDetailTypeId: string;
+}
+/**
+ * Retrieves an authorization details type.
+ *
+ * @param config - Request configuration object.
+ * @returns A promise that resolves with the authorization details type.
+ *
+ * @example
+ * ```typescript
+ * const item = await getAuthorizationDetailType({baseUrl: 'https://localhost:8090', authorizationDetailTypeId});
+ * ```
+ */
+declare const getAuthorizationDetailType: ({ authorizationDetailTypeId, ...config }: GetAuthorizationDetailTypeConfig) => Promise<AuthorizationDetailType>;
+export default getAuthorizationDetailType;
+//# sourceMappingURL=getAuthorizationDetailType.d.ts.map

package/dist/api/management/authorization-detail-types/getAuthorizationDetailType.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"getAuthorizationDetailType.d.ts","sourceRoot":"","sources":["../../../../src/api/management/authorization-detail-types/getAuthorizationDetailType.ts"],"names":[],"mappings":"AAGA,OAAO,EAAC,uBAAuB,EAAC,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAC,uBAAuB,EAAC,MAAM,2CAA2C,CAAC;AAGlF;;GAEG;AACH,MAAM,WAAW,gCAAiC,SAAQ,uBAAuB;IAC/E;;OAEG;IACH,yBAAyB,EAAE,MAAM,CAAC;CACnC;AAED;;;;;;;;;;GAUG;AACH,QAAA,MAAM,0BAA0B,GAAU,0CAGvC,gCAAgC,KAAG,OAAO,CAAC,uBAAuB,CAOjE,CAAC;AAEL,eAAe,0BAA0B,CAAC"}

package/dist/api/management/authorization-detail-types/getAuthorizationDetailTypes.d.ts

@@ -0,0 +1,20 @@
+import { ApiFilteringParams, ManagementRequestConfig } from '../../../models/api';
+import { AuthorizationDetailTypeListResponse } from '../../../models/authorization-detail-type';
+/**
+ * Configuration for the getAuthorizationDetailTypes request.
+ */
+export type GetAuthorizationDetailTypesConfig = ManagementRequestConfig & Pick<ApiFilteringParams, 'limit' | 'offset'>;
+/**
+ * Retrieves a page of authorization details types.
+ *
+ * @param config - Request configuration object.
+ * @returns A promise that resolves with the page the server returned.
+ *
+ * @example
+ * ```typescript
+ * const {types} = await getAuthorizationDetailTypes({baseUrl: 'https://localhost:8090', limit: 20});
+ * ```
+ */
+declare const getAuthorizationDetailTypes: ({ limit, offset, ...config }: GetAuthorizationDetailTypesConfig) => Promise<AuthorizationDetailTypeListResponse>;
+export default getAuthorizationDetailTypes;
+//# sourceMappingURL=getAuthorizationDetailTypes.d.ts.map

package/dist/api/management/authorization-detail-types/getAuthorizationDetailTypes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"getAuthorizationDetailTypes.d.ts","sourceRoot":"","sources":["../../../../src/api/management/authorization-detail-types/getAuthorizationDetailTypes.ts"],"names":[],"mappings":"AAGA,OAAO,EAAC,kBAAkB,EAAE,uBAAuB,EAAC,MAAM,qBAAqB,CAAC;AAChF,OAAO,EAAC,mCAAmC,EAAC,MAAM,2CAA2C,CAAC;AAG9F;;GAEG;AACH,MAAM,MAAM,iCAAiC,GAAG,uBAAuB,GAAG,IAAI,CAAC,kBAAkB,EAAE,OAAO,GAAG,QAAQ,CAAC,CAAC;AAEvH;;;;;;;;;;GAUG;AACH,QAAA,MAAM,2BAA2B,GAAU,8BAIxC,iCAAiC,KAAG,OAAO,CAAC,mCAAmC,CAO9E,CAAC;AAEL,eAAe,2BAA2B,CAAC"}

package/dist/api/management/authorization-detail-types/updateAuthorizationDetailType.d.ts

@@ -0,0 +1,33 @@
+import { ManagementRequestConfig } from '../../../models/api';
+import { AuthorizationDetailType, AuthorizationDetailTypeRequest } from '../../../models/authorization-detail-type';
+/**
+ * Configuration for the updateAuthorizationDetailType request.
+ */
+export interface UpdateAuthorizationDetailTypeConfig extends ManagementRequestConfig {
+    /**
+     * Identifier of the authorization details type.
+     */
+    authorizationDetailTypeId: string;
+    /**
+     * The authorization details type's new state.
+     */
+    payload: AuthorizationDetailTypeRequest;
+}
+/**
+ * Updates an authorization details type.
+ *
+ * @param config - Request configuration object.
+ * @returns A promise that resolves with the authorization details type as the server stored it.
+ *
+ * @example
+ * ```typescript
+ * const item = await updateAuthorizationDetailType({
+ *   baseUrl: 'https://localhost:8090',
+ *   authorizationDetailTypeId,
+ *   payload: {type: 'payment_initiation', name: 'Payment', schema: {type: 'object'}},
+ * });
+ * ```
+ */
+declare const updateAuthorizationDetailType: ({ authorizationDetailTypeId, payload, ...config }: UpdateAuthorizationDetailTypeConfig) => Promise<AuthorizationDetailType>;
+export default updateAuthorizationDetailType;
+//# sourceMappingURL=updateAuthorizationDetailType.d.ts.map

package/dist/api/management/authorization-detail-types/updateAuthorizationDetailType.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"updateAuthorizationDetailType.d.ts","sourceRoot":"","sources":["../../../../src/api/management/authorization-detail-types/updateAuthorizationDetailType.ts"],"names":[],"mappings":"AAGA,OAAO,EAAC,uBAAuB,EAAC,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAC,uBAAuB,EAAE,8BAA8B,EAAC,MAAM,2CAA2C,CAAC;AAGlH;;GAEG;AACH,MAAM,WAAW,mCAAoC,SAAQ,uBAAuB;IAClF;;OAEG;IACH,yBAAyB,EAAE,MAAM,CAAC;IAClC;;OAEG;IACH,OAAO,EAAE,8BAA8B,CAAC;CACzC;AAED;;;;;;;;;;;;;;GAcG;AACH,QAAA,MAAM,6BAA6B,GAAU,mDAI1C,mCAAmC,KAAG,OAAO,CAAC,uBAAuB,CAQpE,CAAC;AAEL,eAAe,6BAA6B,CAAC"}

package/dist/api/management/client-registrations/deleteClientRegistration.d.ts

@@ -0,0 +1,24 @@
+import { ManagementRequestConfig } from '../../../models/api';
+/**
+ * Configuration for the deleteClientRegistration request.
+ */
+export interface DeleteClientRegistrationConfig extends ManagementRequestConfig {
+    /**
+     * Identifier of the registered client.
+     */
+    clientId: string;
+}
+/**
+ * Deletes a dynamically registered client (RFC 7592).
+ *
+ * @param config - Request configuration object.
+ * @returns A promise that resolves once the server has made the change.
+ *
+ * @example
+ * ```typescript
+ * await deleteClientRegistration({baseUrl: 'https://localhost:8090', clientId});
+ * ```
+ */
+declare const deleteClientRegistration: ({ clientId, ...config }: DeleteClientRegistrationConfig) => Promise<void>;
+export default deleteClientRegistration;
+//# sourceMappingURL=deleteClientRegistration.d.ts.map

package/dist/api/management/client-registrations/deleteClientRegistration.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"deleteClientRegistration.d.ts","sourceRoot":"","sources":["../../../../src/api/management/client-registrations/deleteClientRegistration.ts"],"names":[],"mappings":"AAGA,OAAO,EAAC,uBAAuB,EAAC,MAAM,qBAAqB,CAAC;AAG5D;;GAEG;AACH,MAAM,WAAW,8BAA+B,SAAQ,uBAAuB;IAC7E;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;;;;;;;;;GAUG;AACH,QAAA,MAAM,wBAAwB,GAAU,yBAAuB,8BAA8B,KAAG,OAAO,CAAC,IAAI,CAQ3G,CAAC;AAEF,eAAe,wBAAwB,CAAC"}