@thunderid/javascript 1.11.0 → 1.13.0

package/dist/models/sharing-policy.d.ts

@@ -5,6 +5,11 @@ import { ApiPaginationLink } from './api';
  */
 export interface SharingPolicyAllUnits {
     excludedOuIds?: string[];
+    /**
+     * The terms the organization units reached hold the resource on, keyed by field: `roles` for a user,
+     * `assignments` for a role, `variables.<identifier>` for a flow.
+     */
+    overlayRules?: Record<string, OverlayRule>;
 }
 /**
  * Everything beneath the issuing organization unit, including units created later.
@@ -15,12 +20,22 @@ export interface SharingPolicyChildUnitsAll {
      */
     excludedOuIds?: string[];
     mode: 'all';
+    /**
+     * The terms the organization units reached hold the resource on, keyed by field: `roles` for a user,
+     * `assignments` for a role, `variables.<identifier>` for a flow.
+     */
+    overlayRules?: Record<string, OverlayRule>;
 }
 /**
  * A named organization unit directly beneath the issuer.
  */
 export interface SharingPolicyChildUnit {
     ouId: string;
+    /**
+     * The terms the organization units reached hold the resource on, keyed by field: `roles` for a user,
+     * `assignments` for a role, `variables.<identifier>` for a flow.
+     */
+    overlayRules?: Record<string, OverlayRule>;
     /**
      * `unit` reaches the named organization unit only; `subtree` reaches it and everything below it.
      */
@@ -44,6 +59,7 @@ export interface SharingPolicyOtherTreeRootsSelected {
     mode: 'selected';
     units: {
         ouId: string;
+        overlayRules?: Record<string, OverlayRule>;
     }[];
 }
 /**
@@ -53,14 +69,19 @@ export interface SharingPolicyOtherTreeRootsSelected {
 export interface SharingPolicyOtherTreeRootsAll {
     excludedOuIds?: string[];
     mode: 'all';
+    /**
+     * The terms the organization units reached hold the resource on, keyed by field: `roles` for a user,
+     * `assignments` for a role, `variables.<identifier>` for a flow.
+     */
+    overlayRules?: Record<string, OverlayRule>;
 }
 /**
  * The roots of other trees that a policy reaches.
  */
 export type SharingPolicyOtherTreeRoots = SharingPolicyOtherTreeRootsSelected | SharingPolicyOtherTreeRootsAll;
 /**
- * A sharing policy: one organization unit's decision about which other organization units a user or an
- * application reaches.
+ * A sharing policy: one organization unit's decision about which other organization units a user, an
+ * application, a role or a flow reaches.
  */
 export interface SharingPolicy {
     allUnits?: SharingPolicyAllUnits;
@@ -120,10 +141,26 @@ export interface OverlayRule {
  * The overlay rules that apply to a user or an application in one organization unit.
  */
 export interface ResolvedOverlay {
+    /**
+     * Whether the organization unit owns the resource. The server spells this flag `isOwned`,
+     * `isOwnedByOU` (roles, users) or `owned` (flows) depending on the resource; read whichever is set.
+     */
     isOwned?: boolean;
+    isOwnedByOU?: boolean;
+    owned?: boolean;
     ouId?: string;
     policyIds?: string[];
     rules?: Record<string, OverlayRule>;
     visible?: boolean;
 }
+/**
+ * What one organization unit may do with a role: whether it owns it, which policies reached it, and the
+ * effective rule for `assignments`, which says whether it may assign the role.
+ */
+export type RoleResolvedOverlay = ResolvedOverlay;
+/**
+ * What one organization unit may do with a flow: whether it owns or can see it, which policies reached it,
+ * and the effective rule for each variable a policy named, keyed `variables.<identifier>`.
+ */
+export type FlowResolvedOverlay = ResolvedOverlay;
 //# sourceMappingURL=sharing-policy.d.ts.map

package/dist/models/sharing-policy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sharing-policy.d.ts","sourceRoot":"","sources":["../../src/models/sharing-policy.ts"],"names":[],"mappings":"AAGA,OAAO,EAAC,iBAAiB,EAAC,MAAM,OAAO,CAAC;AAExC;;;GAGG;AACH,MAAM,WAAW,qBAAqB;IACpC,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;CAC1B;AAED;;GAEG;AACH,MAAM,WAAW,0BAA0B;IACzC;;OAEG;IACH,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,IAAI,EAAE,KAAK,CAAC;CACb;AAED;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,MAAM,CAAC;IACb;;OAEG;IACH,KAAK,EAAE,MAAM,GAAG,SAAS,CAAC;CAC3B;AAED;;GAEG;AACH,MAAM,WAAW,+BAA+B;IAC9C,IAAI,EAAE,UAAU,CAAC;IACjB,KAAK,EAAE,sBAAsB,EAAE,CAAC;CACjC;AAED;;GAEG;AACH,MAAM,MAAM,uBAAuB,GAAG,0BAA0B,GAAG,+BAA+B,CAAC;AAEnG;;GAEG;AACH,MAAM,WAAW,mCAAmC;IAClD,IAAI,EAAE,UAAU,CAAC;IACjB,KAAK,EAAE;QAAC,IAAI,EAAE,MAAM,CAAA;KAAC,EAAE,CAAC;CACzB;AAED;;;GAGG;AACH,MAAM,WAAW,8BAA8B;IAC7C,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,IAAI,EAAE,KAAK,CAAC;CACb;AAED;;GAEG;AACH,MAAM,MAAM,2BAA2B,GAAG,mCAAmC,GAAG,8BAA8B,CAAC;AAE/G;;;GAGG;AACH,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,EAAE,qBAAqB,CAAC;IACjC,UAAU,CAAC,EAAE,uBAAuB,CAAC;IACrC,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,cAAc,CAAC,EAAE,2BAA2B,CAAC;IAC7C,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,KAAK,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAC5B,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;GAEG;AACH,MAAM,WAAW,yBAAyB;IACxC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,iBAAiB,EAAE,CAAC;IAC5B,QAAQ,EAAE,aAAa,EAAE,CAAC;IAC1B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,UAAU,CAAC,EAAE,uBAAuB,CAAC;IACrC;;OAEG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,cAAc,CAAC,EAAE,mCAAmC,CAAC;IACrD,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;GAEG;AACH,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,EAAE,qBAAqB,CAAC;IACjC,UAAU,CAAC,EAAE,uBAAuB,CAAC;IACrC,cAAc,CAAC,EAAE,2BAA2B,CAAC;IAC7C;;OAEG;IACH,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;CAClB;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IACpC,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB"}
+{"version":3,"file":"sharing-policy.d.ts","sourceRoot":"","sources":["../../src/models/sharing-policy.ts"],"names":[],"mappings":"AAGA,OAAO,EAAC,iBAAiB,EAAC,MAAM,OAAO,CAAC;AAExC;;;GAGG;AACH,MAAM,WAAW,qBAAqB;IACpC,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;CAC5C;AAED;;GAEG;AACH,MAAM,WAAW,0BAA0B;IACzC;;OAEG;IACH,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,IAAI,EAAE,KAAK,CAAC;IACZ;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;CAC5C;AAED;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,MAAM,CAAC;IACb;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IAC3C;;OAEG;IACH,KAAK,EAAE,MAAM,GAAG,SAAS,CAAC;CAC3B;AAED;;GAEG;AACH,MAAM,WAAW,+BAA+B;IAC9C,IAAI,EAAE,UAAU,CAAC;IACjB,KAAK,EAAE,sBAAsB,EAAE,CAAC;CACjC;AAED;;GAEG;AACH,MAAM,MAAM,uBAAuB,GAAG,0BAA0B,GAAG,+BAA+B,CAAC;AAEnG;;GAEG;AACH,MAAM,WAAW,mCAAmC;IAClD,IAAI,EAAE,UAAU,CAAC;IACjB,KAAK,EAAE;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAA;KAAC,EAAE,CAAC;CACrE;AAED;;;GAGG;AACH,MAAM,WAAW,8BAA8B;IAC7C,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,IAAI,EAAE,KAAK,CAAC;IACZ;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;CAC5C;AAED;;GAEG;AACH,MAAM,MAAM,2BAA2B,GAAG,mCAAmC,GAAG,8BAA8B,CAAC;AAE/G;;;GAGG;AACH,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,EAAE,qBAAqB,CAAC;IACjC,UAAU,CAAC,EAAE,uBAAuB,CAAC;IACrC,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,cAAc,CAAC,EAAE,2BAA2B,CAAC;IAC7C,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,KAAK,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAC5B,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;GAEG;AACH,MAAM,WAAW,yBAAyB;IACxC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,iBAAiB,EAAE,CAAC;IAC5B,QAAQ,EAAE,aAAa,EAAE,CAAC;IAC1B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,UAAU,CAAC,EAAE,uBAAuB,CAAC;IACrC;;OAEG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,cAAc,CAAC,EAAE,mCAAmC,CAAC;IACrD,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;GAEG;AACH,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,EAAE,qBAAqB,CAAC;IACjC,UAAU,CAAC,EAAE,uBAAuB,CAAC;IACrC,cAAc,CAAC,EAAE,2BAA2B,CAAC;IAC7C;;OAEG;IACH,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;CAClB;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B;;;OAGG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IACpC,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED;;;GAGG;AACH,MAAM,MAAM,mBAAmB,GAAG,eAAe,CAAC;AAElD;;;GAGG;AACH,MAAM,MAAM,mBAAmB,GAAG,eAAe,CAAC"}

package/dist/models/token.d.ts

@@ -82,6 +82,10 @@ export interface AccessTokenApiResponse {
      * and calculate absolute expiration time.
      */
     created_at: number;
+    /**
+     * The device secret, returned by a code exchange whose sign-in asked for the `device_sso` scope.
+     */
+    device_secret?: string;
     /**
      * Raw expiration time in seconds.
      * Indicates how long the access token will be valid
@@ -113,6 +117,14 @@ export interface AccessTokenApiResponse {
      */
     token_type: string;
 }
+/**
+ * The outcome of a device secret exchange: the new tokens, or the OAuth error the server answered with.
+ */
+export type DeviceSecretSwitchResult = {
+    error: string;
+} | {
+    tokenResponse: TokenResponse;
+};
 /**
  * Interface for the standard (required) claims of an ID Token payload.
  */

package/dist/models/token.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"token.d.ts","sourceRoot":"","sources":["../../src/models/token.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAC,mBAAmB,EAAC,MAAM,iBAAiB,CAAC;AAEzD;;;;;;;GAOG;AACH,MAAM,WAAW,aAAa;IAC5B;;;;OAIG;IACH,WAAW,EAAE,MAAM,CAAC;IAEpB;;;OAGG;IACH,oBAAoB,CAAC,EAAE,mBAAmB,EAAE,CAAC;IAE7C;;;;OAIG;IACH,SAAS,EAAE,MAAM,CAAC;IAElB;;;;OAIG;IACH,SAAS,EAAE,MAAM,CAAC;IAElB;;;;OAIG;IACH,OAAO,EAAE,MAAM,CAAC;IAEhB;;;;OAIG;IACH,YAAY,EAAE,MAAM,CAAC;IAErB;;;;OAIG;IACH,KAAK,EAAE,MAAM,CAAC;IAEd;;;;OAIG;IACH,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,sBAAsB;IACrC;;;;OAIG;IACH,YAAY,EAAE,MAAM,CAAC;IAErB;;;OAGG;IACH,qBAAqB,CAAC,EAAE,mBAAmB,EAAE,CAAC;IAE9C;;;;OAIG;IACH,UAAU,EAAE,MAAM,CAAC;IAEnB;;;;OAIG;IACH,UAAU,EAAE,MAAM,CAAC;IAEnB;;;;OAIG;IACH,QAAQ,EAAE,MAAM,CAAC;IAEjB;;;;OAIG;IACH,aAAa,EAAE,MAAM,CAAC;IAEtB;;;;OAIG;IACH,KAAK,EAAE,MAAM,CAAC;IAEd;;;;OAIG;IACH,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B;;OAEG;IACH,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAEvB;;OAEG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IAEf;;OAEG;IACH,GAAG,EAAE,MAAM,CAAC;IAEZ;;OAEG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAEhB;;OAEG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB;;OAEG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAE5B;;OAEG;IACH,GAAG,EAAE,MAAM,CAAC;IAEZ;;OAEG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;GAEG;AACH,MAAM,WAAW,OAAQ,SAAQ,YAAY;IAC3C;;OAEG;IACH,CAAC,KAAK,EAAE,MAAM,GAAG,GAAG,CAAC;CACtB;AAED,MAAM,WAAW,0BAA0B;IACzC,WAAW,EAAE,OAAO,CAAC;IACrB,IAAI,EAAE,GAAG,CAAC;IACV,EAAE,EAAE,MAAM,CAAC;IACX,cAAc,EAAE,OAAO,CAAC;IACxB,wBAAwB,CAAC,EAAE,OAAO,CAAC;IACnC,cAAc,EAAE,OAAO,CAAC;IACxB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB"}
+{"version":3,"file":"token.d.ts","sourceRoot":"","sources":["../../src/models/token.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAC,mBAAmB,EAAC,MAAM,iBAAiB,CAAC;AAEzD;;;;;;;GAOG;AACH,MAAM,WAAW,aAAa;IAC5B;;;;OAIG;IACH,WAAW,EAAE,MAAM,CAAC;IAEpB;;;OAGG;IACH,oBAAoB,CAAC,EAAE,mBAAmB,EAAE,CAAC;IAE7C;;;;OAIG;IACH,SAAS,EAAE,MAAM,CAAC;IAElB;;;;OAIG;IACH,SAAS,EAAE,MAAM,CAAC;IAElB;;;;OAIG;IACH,OAAO,EAAE,MAAM,CAAC;IAEhB;;;;OAIG;IACH,YAAY,EAAE,MAAM,CAAC;IAErB;;;;OAIG;IACH,KAAK,EAAE,MAAM,CAAC;IAEd;;;;OAIG;IACH,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,sBAAsB;IACrC;;;;OAIG;IACH,YAAY,EAAE,MAAM,CAAC;IAErB;;;OAGG;IACH,qBAAqB,CAAC,EAAE,mBAAmB,EAAE,CAAC;IAE9C;;;;OAIG;IACH,UAAU,EAAE,MAAM,CAAC;IAEnB;;OAEG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IAEvB;;;;OAIG;IACH,UAAU,EAAE,MAAM,CAAC;IAEnB;;;;OAIG;IACH,QAAQ,EAAE,MAAM,CAAC;IAEjB;;;;OAIG;IACH,aAAa,EAAE,MAAM,CAAC;IAEtB;;;;OAIG;IACH,KAAK,EAAE,MAAM,CAAC;IAEd;;;;OAIG;IACH,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;GAEG;AACH,MAAM,MAAM,wBAAwB,GAAG;IAAC,KAAK,EAAE,MAAM,CAAA;CAAC,GAAG;IAAC,aAAa,EAAE,aAAa,CAAA;CAAC,CAAC;AAExF;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B;;OAEG;IACH,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAEvB;;OAEG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IAEf;;OAEG;IACH,GAAG,EAAE,MAAM,CAAC;IAEZ;;OAEG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAEhB;;OAEG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB;;OAEG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAE5B;;OAEG;IACH,GAAG,EAAE,MAAM,CAAC;IAEZ;;OAEG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;GAEG;AACH,MAAM,WAAW,OAAQ,SAAQ,YAAY;IAC3C;;OAEG;IACH,CAAC,KAAK,EAAE,MAAM,GAAG,GAAG,CAAC;CACtB;AAED,MAAM,WAAW,0BAA0B;IACzC,WAAW,EAAE,OAAO,CAAC;IACrB,IAAI,EAAE,GAAG,CAAC;IACV,EAAE,EAAE,MAAM,CAAC;IACX,cAAc,EAAE,OAAO,CAAC;IACxB,wBAAwB,CAAC,EAAE,OAAO,CAAC;IACnC,cAAc,EAAE,OAAO,CAAC;IACxB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB"}

package/dist/models/user.d.ts

@@ -12,4 +12,13 @@ export interface UserProfile {
     flattenedProfile: User;
     profile: User;
 }
+/**
+ * Verification record of one of the user's attributes, as returned in `/users/me`.
+ */
+export interface VerifiedAttribute {
+    /**
+     * When the attribute's current value was verified, as an RFC 3339 timestamp.
+     */
+    verifiedAt: string;
+}
 //# sourceMappingURL=user.d.ts.map

package/dist/models/user.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"user.d.ts","sourceRoot":"","sources":["../../src/models/user.ts"],"names":[],"mappings":"AAGA,MAAM,WAAW,SAAS;IACxB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,IAAK,SAAQ,SAAS;IACrC,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAC;CACpB;AAED,MAAM,WAAW,WAAW;IAC1B,gBAAgB,EAAE,IAAI,CAAC;IACvB,OAAO,EAAE,IAAI,CAAC;CACf"}
+{"version":3,"file":"user.d.ts","sourceRoot":"","sources":["../../src/models/user.ts"],"names":[],"mappings":"AAGA,MAAM,WAAW,SAAS;IACxB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,IAAK,SAAQ,SAAS;IACrC,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAC;CACpB;AAED,MAAM,WAAW,WAAW;IAC1B,gBAAgB,EAAE,IAAI,CAAC;IACvB,OAAO,EAAE,IAAI,CAAC;CACf;AAED;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC;;OAEG;IACH,UAAU,EAAE,MAAM,CAAC;CACpB"}

package/dist/utils/AuthenticationHelper.d.ts

@@ -124,10 +124,13 @@ declare class AuthenticationHelper<T> {
      *
      * @param response - The raw HTTP response from the token endpoint.
      * @param userId - Optional user ID scoping the session.
+     * @param replaceSession - Replace the whole session instead of merging into it, keeping only its device
+     *   secret and SSO session handles, so no token of the previous session survives.
      * @returns A normalized `TokenResponse` object.
      * @throws {ThunderIDAuthException} When the response status is not 200.
      */
-    handleTokenResponse(response: Response, userId?: string): Promise<TokenResponse>;
+    handleTokenResponse(response: Response, userId?: string, replaceSession?: boolean): Promise<TokenResponse>;
+    private storeTokenResponse;
 }
 export default AuthenticationHelper;
 //# sourceMappingURL=AuthenticationHelper.d.ts.map

package/dist/utils/AuthenticationHelper.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"AuthenticationHelper.d.ts","sourceRoot":"","sources":["../../src/utils/AuthenticationHelper.ts"],"names":[],"mappings":"AAYA,OAAO,EAAC,gBAAgB,EAAC,MAAM,qBAAqB,CAAC;AAGrD,OAAO,EAAC,iBAAiB,EAAC,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAC,iCAAiC,EAAE,wBAAwB,EAAC,MAAM,0BAA0B,CAAC;AAErG,OAAO,EAAU,aAAa,EAAyB,MAAM,iBAAiB,CAAC;AAC/E,OAAO,EAAC,IAAI,EAAC,MAAM,gBAAgB,CAAC;AACpC,OAAO,cAAc,MAAM,mBAAmB,CAAC;AAE/C;;;;;GAKG;AACH,cAAM,oBAAoB,CAAC,CAAC;IAC1B,OAAO,CAAC,cAAc,CAAoB;IAE1C,OAAO,CAAC,MAAM,CAAqC;IAEnD,OAAO,CAAC,oBAAoB,CAA0C;IAEtE,OAAO,CAAC,YAAY,CAAmB;IAEvC,OAAO,CAAC,SAAS,CAAwD;IAIzE,OAAO,CAAC,SAAS,CAAsC;IAEvD,OAAO,CAAC,kBAAkB,CAAK;IAE/B;;;;;OAKG;gBACgB,sBAAsB,EAAE,cAAc,CAAC,CAAC,CAAC,EAAE,oBAAoB,EAAE,gBAAgB;IAQpG;;;;;;;;;OASG;IACH,OAAO,CAAC,0BAA0B;IAoBlC;;;;;;OAMG;IACU,gBAAgB,CAAC,QAAQ,EAAE,wBAAwB,GAAG,OAAO,CAAC,wBAAwB,CAAC;IAMpG;;;;;;OAMG;IACU,0BAA0B,IAAI,OAAO,CAAC,iCAAiC,CAAC;IAwCrF;;;;;;;OAOG;IACU,yBAAyB,IAAI,OAAO,CAAC,iCAAiC,CAAC;IAkCpF;;;;;;OAMG;IACU,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAiB/D;;;;;;;;OAQG;IACU,mBAAmB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC;IA2CjF;;;;;OAKG;YACW,YAAY;IAiC1B;;OAEG;IACH,OAAO,CAAC,aAAa;IAiBrB;;;;OAIG;YACW,SAAS;IA0CvB;;;;;OAKG;IACI,wBAAwB,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI;IAetD;;;;;;;OAOG;IACU,8BAA8B,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IA8C3F;;;;OAIG;IACU,YAAY,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAKzD;;;;;;;;OAQG;IACU,mBAAmB,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC;CA6C9F;AAED,eAAe,oBAAoB,CAAC"}
+{"version":3,"file":"AuthenticationHelper.d.ts","sourceRoot":"","sources":["../../src/utils/AuthenticationHelper.ts"],"names":[],"mappings":"AAYA,OAAO,EAAC,gBAAgB,EAAC,MAAM,qBAAqB,CAAC;AAGrD,OAAO,EAAC,iBAAiB,EAAC,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAC,iCAAiC,EAAE,wBAAwB,EAAC,MAAM,0BAA0B,CAAC;AAErG,OAAO,EAAU,aAAa,EAAyB,MAAM,iBAAiB,CAAC;AAC/E,OAAO,EAAC,IAAI,EAAC,MAAM,gBAAgB,CAAC;AACpC,OAAO,cAAc,MAAM,mBAAmB,CAAC;AAE/C;;;;;GAKG;AACH,cAAM,oBAAoB,CAAC,CAAC;IAC1B,OAAO,CAAC,cAAc,CAAoB;IAE1C,OAAO,CAAC,MAAM,CAAqC;IAEnD,OAAO,CAAC,oBAAoB,CAA0C;IAEtE,OAAO,CAAC,YAAY,CAAmB;IAEvC,OAAO,CAAC,SAAS,CAAwD;IAIzE,OAAO,CAAC,SAAS,CAAsC;IAEvD,OAAO,CAAC,kBAAkB,CAAK;IAE/B;;;;;OAKG;gBACgB,sBAAsB,EAAE,cAAc,CAAC,CAAC,CAAC,EAAE,oBAAoB,EAAE,gBAAgB;IAQpG;;;;;;;;;OASG;IACH,OAAO,CAAC,0BAA0B;IAoBlC;;;;;;OAMG;IACU,gBAAgB,CAAC,QAAQ,EAAE,wBAAwB,GAAG,OAAO,CAAC,wBAAwB,CAAC;IAMpG;;;;;;OAMG;IACU,0BAA0B,IAAI,OAAO,CAAC,iCAAiC,CAAC;IAwCrF;;;;;;;OAOG;IACU,yBAAyB,IAAI,OAAO,CAAC,iCAAiC,CAAC;IAkCpF;;;;;;OAMG;IACU,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAiB/D;;;;;;;;OAQG;IACU,mBAAmB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC;IA2CjF;;;;;OAKG;YACW,YAAY;IAiC1B;;OAEG;IACH,OAAO,CAAC,aAAa;IAiBrB;;;;OAIG;YACW,SAAS;IA0CvB;;;;;OAKG;IACI,wBAAwB,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI;IAetD;;;;;;;OAOG;IACU,8BAA8B,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IA8C3F;;;;OAIG;IACU,YAAY,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAKzD;;;;;;;;;;OAUG;IACU,mBAAmB,CAC9B,QAAQ,EAAE,QAAQ,EAClB,MAAM,CAAC,EAAE,MAAM,EACf,cAAc,UAAQ,GACrB,OAAO,CAAC,aAAa,CAAC;YA8CX,kBAAkB;CA4BjC;AAED,eAAe,oBAAoB,CAAC"}

package/dist/utils/getCurrentOrganizationUnitFromClaims.d.ts

@@ -0,0 +1,14 @@
+import { CurrentOrganizationUnit } from '../models/accessible-organization-unit';
+/**
+ * Reads the organization unit a session was issued for from its token claims: `ouId`, `ouHandle` and
+ * `ouName`, which name the unit the sign-in decided.
+ *
+ * The claims are read without verifying the token, so the result is for display only and MUST NOT be
+ * used for an authorization decision.
+ *
+ * @param claims - The decoded ID token (or sign-in assertion) payload.
+ * @returns The current organization unit, or `null` when the claims carry no `ouId`.
+ */
+declare const getCurrentOrganizationUnitFromClaims: (claims: Record<string, unknown> | null | undefined) => CurrentOrganizationUnit | null;
+export default getCurrentOrganizationUnitFromClaims;
+//# sourceMappingURL=getCurrentOrganizationUnitFromClaims.d.ts.map

package/dist/utils/getCurrentOrganizationUnitFromClaims.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"getCurrentOrganizationUnitFromClaims.d.ts","sourceRoot":"","sources":["../../src/utils/getCurrentOrganizationUnitFromClaims.ts"],"names":[],"mappings":"AAGA,OAAO,EAAC,uBAAuB,EAAC,MAAM,wCAAwC,CAAC;AAQ/E;;;;;;;;;GASG;AACH,QAAA,MAAM,oCAAoC,GACxC,QAAQ,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,GAAG,SAAS,KACjD,uBAAuB,GAAG,IAe5B,CAAC;AAEF,eAAe,oCAAoC,CAAC"}

package/dist/utils/getFlowStepComponents.d.ts

@@ -0,0 +1,26 @@
+import { EmbeddedFlowComponent } from '../models/embedded-flow';
+/**
+ * The components of a flow step that collect a value or submit the step.
+ */
+export interface FlowStepComponents {
+    /** Components that submit the step, the resend action included. */
+    actions: EmbeddedFlowComponent[];
+    /** Components that collect a value. */
+    inputs: EmbeddedFlowComponent[];
+    /** The step's resend action, if it has one. */
+    resend?: EmbeddedFlowComponent;
+}
+/**
+ * Collects the inputs and actions of a flow step, nested components included, in document order.
+ *
+ * @param components - The step's components.
+ * @returns The step's inputs, actions and resend action.
+ * @example
+ * ```typescript
+ * const {actions, inputs} = getFlowStepComponents(response.data.components);
+ * const isAwaitingLink = inputs.length === 0 && actions.length === 0;
+ * ```
+ */
+declare const getFlowStepComponents: (components: EmbeddedFlowComponent[], step?: FlowStepComponents) => FlowStepComponents;
+export default getFlowStepComponents;
+//# sourceMappingURL=getFlowStepComponents.d.ts.map

package/dist/utils/getFlowStepComponents.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"getFlowStepComponents.d.ts","sourceRoot":"","sources":["../../src/utils/getFlowStepComponents.ts"],"names":[],"mappings":"AAGA,OAAO,EAAC,qBAAqB,EAA4B,MAAM,yBAAyB,CAAC;AAgBzF;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,mEAAmE;IACnE,OAAO,EAAE,qBAAqB,EAAE,CAAC;IACjC,uCAAuC;IACvC,MAAM,EAAE,qBAAqB,EAAE,CAAC;IAChC,+CAA+C;IAC/C,MAAM,CAAC,EAAE,qBAAqB,CAAC;CAChC;AAED;;;;;;;;;;GAUG;AACH,QAAA,MAAM,qBAAqB,GACzB,YAAY,qBAAqB,EAAE,EACnC,OAAM,kBAA8C,KACnD,kBAQF,CAAC;AAEF,eAAe,qBAAqB,CAAC"}

package/dist/utils/getVerifiedAttributes.d.ts

@@ -0,0 +1,14 @@
+import { User, VerifiedAttribute } from '../models/user';
+/**
+ * Returns the verified attributes of a `/users/me` profile, keyed by attribute name.
+ *
+ * A profile without the field, from a server that does not report verification, leaves every status
+ * unknown, so the result is `undefined` rather than an empty record that would read as unverified.
+ *
+ * @param user - The profile to read.
+ * @returns The verified attributes, an empty object when none is verified, or `undefined` when the
+ * profile does not report them.
+ */
+declare const getVerifiedAttributes: (user?: User | null) => Record<string, VerifiedAttribute> | undefined;
+export default getVerifiedAttributes;
+//# sourceMappingURL=getVerifiedAttributes.d.ts.map

package/dist/utils/getVerifiedAttributes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"getVerifiedAttributes.d.ts","sourceRoot":"","sources":["../../src/utils/getVerifiedAttributes.ts"],"names":[],"mappings":"AAIA,OAAO,EAAC,IAAI,EAAE,iBAAiB,EAAC,MAAM,gBAAgB,CAAC;AAEvD;;;;;;;;;GASG;AACH,QAAA,MAAM,qBAAqB,GAAI,OAAO,IAAI,GAAG,IAAI,KAAG,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC,GAAG,SAMvF,CAAC;AAEF,eAAe,qBAAqB,CAAC"}

package/dist/utils/isVerifiableAttribute.d.ts

@@ -0,0 +1,22 @@
+import { AttributeSchema } from '../api/account/getUsersMeMeta';
+/**
+ * Whether the signed-in user can verify the given attribute: a top-level, single-valued property of
+ * type `email` or `mobile` in the user type schema from `GET /users/me/meta`.
+ *
+ * Schema keys are top-level properties, and a multi-valued property has type `array`, so both are
+ * settled by the property's own type. An absent schema, or one without the attribute, leaves the
+ * type unknown and resolves to `false`, so no verification is started on missing information.
+ *
+ * @param userSchema - The user type schema resolved by the provider, keyed by attribute.
+ * @param attribute - The attribute to check (e.g. `email`).
+ * @returns `true` only when the schema declares `attribute` with a verifiable type.
+ * @example
+ * ```typescript
+ * if (!isVerifiableAttribute(userSchema, 'given_name')) {
+ *   return null;
+ * }
+ * ```
+ */
+declare const isVerifiableAttribute: (userSchema: Record<string, AttributeSchema> | null | undefined, attribute: string) => boolean;
+export default isVerifiableAttribute;
+//# sourceMappingURL=isVerifiableAttribute.d.ts.map

package/dist/utils/isVerifiableAttribute.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"isVerifiableAttribute.d.ts","sourceRoot":"","sources":["../../src/utils/isVerifiableAttribute.ts"],"names":[],"mappings":"AAGA,OAAO,EAAC,eAAe,EAAC,MAAM,+BAA+B,CAAC;AAG9D;;;;;;;;;;;;;;;;;GAiBG;AACH,QAAA,MAAM,qBAAqB,GACzB,YAAY,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,GAAG,IAAI,GAAG,SAAS,EAC9D,WAAW,MAAM,KAChB,OAUF,CAAC;AAEF,eAAe,qBAAqB,CAAC"}

package/dist/utils/parseSelfFlowRequest.d.ts

@@ -0,0 +1,24 @@
+import { EmbeddedSelfFlowRequest } from '../models/embedded-self-flow';
+/**
+ * Result of {@link parseSelfFlowRequest}: the request to send, or the field that made it invalid.
+ */
+export type SelfFlowRequestParseResult = {
+    invalid: string;
+} | {
+    request: EmbeddedSelfFlowRequest;
+};
+/**
+ * Checks a `SELF` flow step that a browser sent to a server-side SDK, which attaches the
+ * session's access token before forwarding it. Such an endpoint is public, so its types protect
+ * nothing.
+ *
+ * Only the fields of a step are kept, so a caller cannot add a user or application identifier. A
+ * request without an `executionId` starts a flow, and must name a `SELF` flow by its handle,
+ * so the endpoint cannot start a flow of another type with the user's token.
+ *
+ * @param raw - The request body as received.
+ * @returns The request to send, or the name of the first invalid field.
+ */
+declare const parseSelfFlowRequest: (raw: unknown) => SelfFlowRequestParseResult;
+export default parseSelfFlowRequest;
+//# sourceMappingURL=parseSelfFlowRequest.d.ts.map

package/dist/utils/parseSelfFlowRequest.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"parseSelfFlowRequest.d.ts","sourceRoot":"","sources":["../../src/utils/parseSelfFlowRequest.ts"],"names":[],"mappings":"AAIA,OAAO,EAAC,uBAAuB,EAAC,MAAM,8BAA8B,CAAC;AAErE;;GAEG;AACH,MAAM,MAAM,0BAA0B,GAAG;IAAC,OAAO,EAAE,MAAM,CAAA;CAAC,GAAG;IAAC,OAAO,EAAE,uBAAuB,CAAA;CAAC,CAAC;AAUhG;;;;;;;;;;;GAWG;AACH,QAAA,MAAM,oBAAoB,GAAI,KAAK,OAAO,KAAG,0BA8B5C,CAAC;AAEF,eAAe,oBAAoB,CAAC"}

package/dist/utils/requestManagementResource.d.ts

@@ -37,7 +37,8 @@ export interface ManagementResourceRequest {
 /**
  * Performs a request against a management API resource and maps failures onto
  * {@link ThunderIDAPIError}. HTTP 403 and 404 get their own codes so a caller can tell a missing
- * permission from a missing resource.
+ * permission from a missing resource. An OAuth 2.0 error body is carried the same way as the server's
+ * error envelope.
  *
  * @returns The parsed JSON body, or `undefined` when the server returns no content.
  */

package/dist/utils/requestManagementResource.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"requestManagementResource.d.ts","sourceRoot":"","sources":["../../src/utils/requestManagementResource.ts"],"names":[],"mappings":"AAIA,OAAO,EAAC,uBAAuB,EAAC,MAAM,eAAe,CAAC;AAEtD;;GAEG;AACH,MAAM,WAAW,yBAAyB;IACxC;;OAEG;IACH,IAAI,CAAC,EAAE,OAAO,CAAC;IACf;;OAEG;IACH,UAAU,EAAE,MAAM,CAAC;IACnB;;OAEG;IACH,cAAc,EAAE,MAAM,CAAC;IACvB;;OAEG;IACH,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,KAAK,GAAG,MAAM,GAAG,KAAK,GAAG,QAAQ,CAAC;IAC1C;;OAEG;IACH,SAAS,EAAE,MAAM,CAAC;IAClB;;OAEG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC,CAAC;IACpD;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;;;;GAMG;AACH,QAAA,MAAM,yBAAyB,GAAU,CAAC,EACxC,6CAA2C,uBAAuB,EAClE,6EAA2E,yBAAyB,KACnG,OAAO,CAAC,CAAC,CA2FX,CAAC;AAEF,eAAe,yBAAyB,CAAC"}
+{"version":3,"file":"requestManagementResource.d.ts","sourceRoot":"","sources":["../../src/utils/requestManagementResource.ts"],"names":[],"mappings":"AAIA,OAAO,EAAC,uBAAuB,EAAC,MAAM,eAAe,CAAC;AAEtD;;GAEG;AACH,MAAM,WAAW,yBAAyB;IACxC;;OAEG;IACH,IAAI,CAAC,EAAE,OAAO,CAAC;IACf;;OAEG;IACH,UAAU,EAAE,MAAM,CAAC;IACnB;;OAEG;IACH,cAAc,EAAE,MAAM,CAAC;IACvB;;OAEG;IACH,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,KAAK,GAAG,MAAM,GAAG,KAAK,GAAG,QAAQ,CAAC;IAC1C;;OAEG;IACH,SAAS,EAAE,MAAM,CAAC;IAClB;;OAEG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC,CAAC;IACpD;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AA8BD;;;;;;;GAOG;AACH,QAAA,MAAM,yBAAyB,GAAU,CAAC,EACxC,6CAA2C,uBAAuB,EAClE,6EAA2E,yBAAyB,KACnG,OAAO,CAAC,CAAC,CA2FX,CAAC;AAEF,eAAe,yBAAyB,CAAC"}

package/dist/utils/resolveOrganizationUnitEndpoint.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Builds the organization-unit-qualified form of an OAuth 2.0 endpoint, such as
+ * `{baseUrl}/ou/{ouId}/oauth2/authorize` for `{baseUrl}/oauth2/authorize`. A sign-in started there is
+ * bounded to the unit, and an authorization code from it is redeemed at the unit's token endpoint.
+ *
+ * The unit identifier is one path segment, so it is percent-encoded. The `/ou/{ouId}` prefix goes in
+ * front of the endpoint's `/oauth2/` segment, so an endpoint discovered under a path prefix keeps it.
+ * When the endpoint has no `/oauth2/` segment, the path is built from `baseUrl` and the endpoint's
+ * last segment instead.
+ *
+ * @param endpoint - The unqualified endpoint, from discovery or derived from `baseUrl`.
+ * @param ouId - Identifier of the organization unit.
+ * @param baseUrl - The server's base URL, used when the endpoint cannot be qualified in place.
+ * @returns The qualified endpoint URL.
+ * @throws {ThunderIDRuntimeError} `JS-AUTH_CORE-OUEP-IV01` when `ouId` is empty, and
+ *   `JS-AUTH_CORE-OUEP-IV02` when the endpoint cannot be qualified.
+ */
+declare const resolveOrganizationUnitEndpoint: (endpoint: string, ouId: string, baseUrl?: string) => string;
+export default resolveOrganizationUnitEndpoint;
+//# sourceMappingURL=resolveOrganizationUnitEndpoint.d.ts.map

package/dist/utils/resolveOrganizationUnitEndpoint.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolveOrganizationUnitEndpoint.d.ts","sourceRoot":"","sources":["../../src/utils/resolveOrganizationUnitEndpoint.ts"],"names":[],"mappings":"AAOA;;;;;;;;;;;;;;;;GAgBG;AACH,QAAA,MAAM,+BAA+B,GAAI,UAAU,MAAM,EAAE,MAAM,MAAM,EAAE,UAAU,MAAM,KAAG,MA8B3F,CAAC;AAEF,eAAe,+BAA+B,CAAC"}

package/dist/utils/resolveResourceEndpoint.d.ts

@@ -8,7 +8,7 @@ import { BaseConfig } from '../models/config';
  * issuers), these overrides let the SDK send flow and user-management requests to the resource
  * server while OAuth requests continue to target the authorization server.
  */
-export type ResourceEndpointKey = 'agents' | 'agentTypes' | 'applications' | 'configurationVersions' | 'connections' | 'design' | 'export' | 'flowExecute' | 'flowMeta' | 'flows' | 'gateways' | 'groups' | 'i18n' | 'import' | 'notificationTemplates' | 'organizationUnits' | 'resourceServers' | 'roles' | 'secrets' | 'serverConfig' | 'users' | 'usersMe' | 'usersMeCredentials' | 'usersMeMeta' | 'userTypes' | 'variables';
+export type ResourceEndpointKey = 'agents' | 'agentTypes' | 'applications' | 'authorizationDetailTypes' | 'clientRegistrations' | 'configurationVersions' | 'connections' | 'credentialConfigurations' | 'design' | 'export' | 'flowExecute' | 'flowMeta' | 'flows' | 'gateways' | 'groups' | 'i18n' | 'import' | 'notificationTemplates' | 'organizationUnits' | 'presentationDefinitions' | 'projects' | 'resourceServers' | 'roles' | 'secrets' | 'serverConfig' | 'users' | 'usersMe' | 'usersMeCredentials' | 'usersMeMeta' | 'usersMeOrganizationUnits' | 'userTypes' | 'variables';
 /**
  * The `config.endpoints` keys that address resource-server endpoints rather than OIDC/OAuth
  * endpoints. Used to keep these overrides out of the resolved OIDC provider metadata.

package/dist/utils/resolveResourceEndpoint.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resolveResourceEndpoint.d.ts","sourceRoot":"","sources":["../../src/utils/resolveResourceEndpoint.ts"],"names":[],"mappings":"AAGA,OAAO,EAAC,UAAU,EAAC,MAAM,kBAAkB,CAAC;AAE5C;;;;;;;;GAQG;AACH,MAAM,MAAM,mBAAmB,GAC3B,QAAQ,GACR,YAAY,GACZ,cAAc,GACd,uBAAuB,GACvB,aAAa,GACb,QAAQ,GACR,QAAQ,GACR,aAAa,GACb,UAAU,GACV,OAAO,GACP,UAAU,GACV,QAAQ,GACR,MAAM,GACN,QAAQ,GACR,uBAAuB,GACvB,mBAAmB,GACnB,iBAAiB,GACjB,OAAO,GACP,SAAS,GACT,cAAc,GACd,OAAO,GACP,SAAS,GACT,oBAAoB,GACpB,aAAa,GACb,WAAW,GACX,WAAW,CAAC;AAEhB;;;GAGG;AACH,eAAO,MAAM,sBAAsB,EAAE,SAAS,mBAAmB,EA2BhE,CAAC;AAEF;;;GAGG;AACH,MAAM,WAAW,sBAAsB;IACrC,SAAS,CAAC,EAAE,UAAU,CAAC,WAAW,CAAC,CAAC;CACrC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,QAAA,MAAM,uBAAuB,GAC3B,KAAK,mBAAmB,EACxB,QAAQ,sBAAsB,GAAG,SAAS,EAC1C,cAAc,MAAM,KACnB,MAAM,GAAG,SAAiE,CAAC;AAE9E,eAAe,uBAAuB,CAAC"}
+{"version":3,"file":"resolveResourceEndpoint.d.ts","sourceRoot":"","sources":["../../src/utils/resolveResourceEndpoint.ts"],"names":[],"mappings":"AAGA,OAAO,EAAC,UAAU,EAAC,MAAM,kBAAkB,CAAC;AAE5C;;;;;;;;GAQG;AACH,MAAM,MAAM,mBAAmB,GAC3B,QAAQ,GACR,YAAY,GACZ,cAAc,GACd,0BAA0B,GAC1B,qBAAqB,GACrB,uBAAuB,GACvB,aAAa,GACb,0BAA0B,GAC1B,QAAQ,GACR,QAAQ,GACR,aAAa,GACb,UAAU,GACV,OAAO,GACP,UAAU,GACV,QAAQ,GACR,MAAM,GACN,QAAQ,GACR,uBAAuB,GACvB,mBAAmB,GACnB,yBAAyB,GACzB,UAAU,GACV,iBAAiB,GACjB,OAAO,GACP,SAAS,GACT,cAAc,GACd,OAAO,GACP,SAAS,GACT,oBAAoB,GACpB,aAAa,GACb,0BAA0B,GAC1B,WAAW,GACX,WAAW,CAAC;AAEhB;;;GAGG;AACH,eAAO,MAAM,sBAAsB,EAAE,SAAS,mBAAmB,EAiChE,CAAC;AAEF;;;GAGG;AACH,MAAM,WAAW,sBAAsB;IACrC,SAAS,CAAC,EAAE,UAAU,CAAC,WAAW,CAAC,CAAC;CACrC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,QAAA,MAAM,uBAAuB,GAC3B,KAAK,mBAAmB,EACxB,QAAQ,sBAAsB,GAAG,SAAS,EAC1C,cAAc,MAAM,KACnB,MAAM,GAAG,SAAiE,CAAC;AAE9E,eAAe,uBAAuB,CAAC"}

package/dist/utils/sharingPolicies.d.ts

@@ -0,0 +1,126 @@
+import { ManagementRequestConfig } from '../models/api';
+import { ResolvedOverlay, SharingPolicy, SharingPolicyListResponse, SharingPolicyRequest, SharingPolicyUpdateRequest } from '../models/sharing-policy';
+/**
+ * The kinds of resource that carry sharing policies.
+ */
+export type SharingResourceType = 'user' | 'application' | 'role' | 'flow';
+/**
+ * The management collection that holds each kind of shared resource.
+ */
+export declare const SHARING_RESOURCE_COLLECTIONS: Record<SharingResourceType, 'users' | 'applications' | 'roles' | 'flows'>;
+/**
+ * The sharing operations of one kind of resource, addressed by the resource's identifier.
+ */
+export interface SharingPolicyOperations {
+    create: (config: ManagementRequestConfig & {
+        payload: SharingPolicyRequest;
+        resourceId: string;
+    }) => Promise<SharingPolicy>;
+    delete: (config: ManagementRequestConfig & {
+        policyId: string;
+        resourceId: string;
+    }) => Promise<void>;
+    getOverlayRules: (config: ManagementRequestConfig & {
+        ouId: string;
+        resourceId: string;
+    }) => Promise<ResolvedOverlay>;
+    list: (config: ManagementRequestConfig & {
+        limit?: number;
+        offset?: number;
+        resourceId: string;
+    }) => Promise<SharingPolicyListResponse>;
+    update: (config: ManagementRequestConfig & {
+        payload: SharingPolicyUpdateRequest;
+        policyId: string;
+        resourceId: string;
+    }) => Promise<SharingPolicy>;
+}
+/**
+ * Returns the existing sharing operations for a kind of resource, so a component can manage the
+ * policies of a user, an application, a role or a flow the same way.
+ *
+ * @param resourceType - The kind of resource.
+ * @returns The operations, each taking the resource's identifier as `resourceId`.
+ */
+export declare const getSharingPolicyOperations: (resourceType: SharingResourceType) => SharingPolicyOperations;
+/**
+ * The translation function the helpers below take.
+ */
+type Translate = (key: string, params?: Record<string, string | number>) => string;
+/**
+ * Describes, in translated words, which organization units a sharing policy reaches: one line per
+ * section the server returned (every unit, the units beneath the owner, the roots of other trees).
+ *
+ * @param t - The translation function.
+ * @param policy - The policy.
+ * @returns The lines, never empty.
+ */
+export declare const describeSharingPolicyScope: (t: Translate, policy: SharingPolicy) => string[];
+/**
+ * The values of the sharing policy form. Lists of organization unit identifiers are kept as the text
+ * the user types, separated by commas.
+ */
+export interface SharingPolicyFormValues {
+    /**
+     * Which units beneath the owner the policy reaches: none, all of them, or the ones listed.
+     */
+    childUnitsMode: 'none' | 'all' | 'selected';
+    /**
+     * With `all`, the units beneath the owner to withhold.
+     */
+    excludedOuIds: string;
+    /**
+     * The root units of other trees the policy reaches.
+     */
+    otherTreeRootOuIds: string;
+    /**
+     * With `selected`, whether each listed unit is reached alone or with everything below it.
+     */
+    reach: 'unit' | 'subtree';
+    /**
+     * With `selected`, the units beneath the owner the policy reaches.
+     */
+    selectedOuIds: string;
+}
+/**
+ * Splits text of comma or whitespace separated identifiers, dropping empty and repeated entries.
+ *
+ * @param value - The text.
+ * @returns The identifiers.
+ */
+export declare const parseOrganizationUnitIds: (value: string) => string[];
+/**
+ * The form values for a new policy, or for editing an existing one.
+ *
+ * @param policy - The policy being edited, if any.
+ * @returns The values.
+ */
+export declare const toSharingPolicyFormValues: (policy?: SharingPolicy) => SharingPolicyFormValues;
+/**
+ * Whether the form describes a policy the server can accept: it must reach some unit, and a policy of
+ * selected units must name at least one. A policy that already reaches every unit or every other tree
+ * keeps that section, so it is valid without either.
+ *
+ * @param values - The form values.
+ * @param policy - The policy being edited, if any.
+ * @returns Whether the values can be submitted.
+ */
+export declare const isSharingPolicyFormValid: (values: SharingPolicyFormValues, policy?: SharingPolicy) => boolean;
+/**
+ * Builds the payload that creates a policy from the form.
+ *
+ * @param values - The form values.
+ * @returns The payload.
+ */
+export declare const toSharingPolicyRequest: (values: SharingPolicyFormValues) => SharingPolicyRequest;
+/**
+ * Builds the payload that replaces a policy's sections from the form. Sections the form cannot edit
+ * (every unit, every other tree) and the overlay rules of units that stay are kept as they were.
+ *
+ * @param values - The form values.
+ * @param policy - The policy being edited.
+ * @returns The payload, carrying the version being edited.
+ */
+export declare const toSharingPolicyUpdateRequest: (values: SharingPolicyFormValues, policy: SharingPolicy) => SharingPolicyUpdateRequest;
+export {};
+//# sourceMappingURL=sharingPolicies.d.ts.map

package/dist/utils/sharingPolicies.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sharingPolicies.d.ts","sourceRoot":"","sources":["../../src/utils/sharingPolicies.ts"],"names":[],"mappings":"AAuBA,OAAO,EAAC,uBAAuB,EAAC,MAAM,eAAe,CAAC;AACtD,OAAO,EACL,eAAe,EACf,aAAa,EAGb,yBAAyB,EAEzB,oBAAoB,EACpB,0BAA0B,EAC3B,MAAM,0BAA0B,CAAC;AAElC;;GAEG;AACH,MAAM,MAAM,mBAAmB,GAAG,MAAM,GAAG,aAAa,GAAG,MAAM,GAAG,MAAM,CAAC;AAE3E;;GAEG;AACH,eAAO,MAAM,4BAA4B,EAAE,MAAM,CAAC,mBAAmB,EAAE,OAAO,GAAG,cAAc,GAAG,OAAO,GAAG,OAAO,CAKlH,CAAC;AAEF;;GAEG;AACH,MAAM,WAAW,uBAAuB;IACtC,MAAM,EAAE,CACN,MAAM,EAAE,uBAAuB,GAAG;QAAC,OAAO,EAAE,oBAAoB,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAC,KAClF,OAAO,CAAC,aAAa,CAAC,CAAC;IAC5B,MAAM,EAAE,CAAC,MAAM,EAAE,uBAAuB,GAAG;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAC,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACpG,eAAe,EAAE,CAAC,MAAM,EAAE,uBAAuB,GAAG;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAC,KAAK,OAAO,CAAC,eAAe,CAAC,CAAC;IACpH,IAAI,EAAE,CACJ,MAAM,EAAE,uBAAuB,GAAG;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAC,KACpF,OAAO,CAAC,yBAAyB,CAAC,CAAC;IACxC,MAAM,EAAE,CACN,MAAM,EAAE,uBAAuB,GAAG;QAAC,OAAO,EAAE,0BAA0B,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAC,KAC1G,OAAO,CAAC,aAAa,CAAC,CAAC;CAC7B;AAED;;;;;;GAMG;AACH,eAAO,MAAM,0BAA0B,GAAI,cAAc,mBAAmB,KAAG,uBAqC9E,CAAC;AAEF;;GAEG;AACH,KAAK,SAAS,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC,KAAK,MAAM,CAAC;AAKnF;;;;;;;GAOG;AACH,eAAO,MAAM,0BAA0B,GAAI,GAAG,SAAS,EAAE,QAAQ,aAAa,KAAG,MAAM,EAwCtF,CAAC;AAEF;;;GAGG;AACH,MAAM,WAAW,uBAAuB;IACtC;;OAEG;IACH,cAAc,EAAE,MAAM,GAAG,KAAK,GAAG,UAAU,CAAC;IAC5C;;OAEG;IACH,aAAa,EAAE,MAAM,CAAC;IACtB;;OAEG;IACH,kBAAkB,EAAE,MAAM,CAAC;IAC3B;;OAEG;IACH,KAAK,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B;;OAEG;IACH,aAAa,EAAE,MAAM,CAAC;CACvB;AAED;;;;;GAKG;AACH,eAAO,MAAM,wBAAwB,GAAI,OAAO,MAAM,KAAG,MAAM,EAQ5D,CAAC;AAEJ;;;;;GAKG;AACH,eAAO,MAAM,yBAAyB,GAAI,SAAS,aAAa,KAAG,uBAoBlE,CAAC;AAwDF;;;;;;;;GAQG;AACH,eAAO,MAAM,wBAAwB,GAAI,QAAQ,uBAAuB,EAAE,SAAS,aAAa,KAAG,OAWlG,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,sBAAsB,GAAI,QAAQ,uBAAuB,KAAG,oBAKxE,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,4BAA4B,GACvC,QAAQ,uBAAuB,EAC/B,QAAQ,aAAa,KACpB,0BAWF,CAAC"}

package/dist/utils/toManagementErrorMessage.d.ts

@@ -1,13 +1,15 @@
 /**
  * Turns a failed management request into a message for admin UI. A missing permission and a
- * missing resource get their own messages; anything else gets the operation's fallback. The
- * server's own error text is never shown.
+ * missing resource get their own messages; a refusal the caller names in `specificKeys` gets that
+ * message; anything else gets the operation's fallback. The server's own error text is never shown.
  *
  * @param t - The translation function.
  * @param error - The error a management operation reported, if any.
  * @param fallbackKey - Translation key of the message for any other failure.
+ * @param specificKeys - Translation keys for specific refusals, keyed by the server's error code
+ * (such as `OU-1006`) or by HTTP status (such as `409`). A code wins over a status.
  * @returns The translated message, or `null` when there is no error.
  */
-declare const toManagementErrorMessage: (t: (key: string) => string, error: Error | null | undefined, fallbackKey: string) => string | null;
+declare const toManagementErrorMessage: (t: (key: string) => string, error: Error | null | undefined, fallbackKey: string, specificKeys?: Readonly<Record<string, string>>) => string | null;
 export default toManagementErrorMessage;
 //# sourceMappingURL=toManagementErrorMessage.d.ts.map

package/dist/utils/toManagementErrorMessage.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"toManagementErrorMessage.d.ts","sourceRoot":"","sources":["../../src/utils/toManagementErrorMessage.ts"],"names":[],"mappings":"AAKA;;;;;;;;;GASG;AACH,QAAA,MAAM,wBAAwB,GAC5B,GAAG,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,EAC1B,OAAO,KAAK,GAAG,IAAI,GAAG,SAAS,EAC/B,aAAa,MAAM,KAClB,MAAM,GAAG,IAgBX,CAAC;AAEF,eAAe,wBAAwB,CAAC"}
+{"version":3,"file":"toManagementErrorMessage.d.ts","sourceRoot":"","sources":["../../src/utils/toManagementErrorMessage.ts"],"names":[],"mappings":"AAKA;;;;;;;;;;;GAWG;AACH,QAAA,MAAM,wBAAwB,GAC5B,GAAG,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,EAC1B,OAAO,KAAK,GAAG,IAAI,GAAG,SAAS,EAC/B,aAAa,MAAM,EACnB,eAAe,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,KAC9C,MAAM,GAAG,IA6BX,CAAC;AAEF,eAAe,wBAAwB,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@thunderid/javascript",
-  "version": "1.11.0",
+  "version": "1.13.0",
   "description": "JavaScript Ecosystem SDK for ThunderID",
   "keywords": [
     "thunderid",