@thunderid/javascript 1.12.0 → 1.13.0

package/dist/utils/AuthenticationHelper.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"AuthenticationHelper.d.ts","sourceRoot":"","sources":["../../src/utils/AuthenticationHelper.ts"],"names":[],"mappings":"AAYA,OAAO,EAAC,gBAAgB,EAAC,MAAM,qBAAqB,CAAC;AAGrD,OAAO,EAAC,iBAAiB,EAAC,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAC,iCAAiC,EAAE,wBAAwB,EAAC,MAAM,0BAA0B,CAAC;AAErG,OAAO,EAAU,aAAa,EAAyB,MAAM,iBAAiB,CAAC;AAC/E,OAAO,EAAC,IAAI,EAAC,MAAM,gBAAgB,CAAC;AACpC,OAAO,cAAc,MAAM,mBAAmB,CAAC;AAE/C;;;;;GAKG;AACH,cAAM,oBAAoB,CAAC,CAAC;IAC1B,OAAO,CAAC,cAAc,CAAoB;IAE1C,OAAO,CAAC,MAAM,CAAqC;IAEnD,OAAO,CAAC,oBAAoB,CAA0C;IAEtE,OAAO,CAAC,YAAY,CAAmB;IAEvC,OAAO,CAAC,SAAS,CAAwD;IAIzE,OAAO,CAAC,SAAS,CAAsC;IAEvD,OAAO,CAAC,kBAAkB,CAAK;IAE/B;;;;;OAKG;gBACgB,sBAAsB,EAAE,cAAc,CAAC,CAAC,CAAC,EAAE,oBAAoB,EAAE,gBAAgB;IAQpG;;;;;;;;;OASG;IACH,OAAO,CAAC,0BAA0B;IAoBlC;;;;;;OAMG;IACU,gBAAgB,CAAC,QAAQ,EAAE,wBAAwB,GAAG,OAAO,CAAC,wBAAwB,CAAC;IAMpG;;;;;;OAMG;IACU,0BAA0B,IAAI,OAAO,CAAC,iCAAiC,CAAC;IAwCrF;;;;;;;OAOG;IACU,yBAAyB,IAAI,OAAO,CAAC,iCAAiC,CAAC;IAkCpF;;;;;;OAMG;IACU,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAiB/D;;;;;;;;OAQG;IACU,mBAAmB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC;IA2CjF;;;;;OAKG;YACW,YAAY;IAiC1B;;OAEG;IACH,OAAO,CAAC,aAAa;IAiBrB;;;;OAIG;YACW,SAAS;IA0CvB;;;;;OAKG;IACI,wBAAwB,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI;IAetD;;;;;;;OAOG;IACU,8BAA8B,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IA8C3F;;;;OAIG;IACU,YAAY,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAKzD;;;;;;;;OAQG;IACU,mBAAmB,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC;CA6C9F;AAED,eAAe,oBAAoB,CAAC"}
+{"version":3,"file":"AuthenticationHelper.d.ts","sourceRoot":"","sources":["../../src/utils/AuthenticationHelper.ts"],"names":[],"mappings":"AAYA,OAAO,EAAC,gBAAgB,EAAC,MAAM,qBAAqB,CAAC;AAGrD,OAAO,EAAC,iBAAiB,EAAC,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAC,iCAAiC,EAAE,wBAAwB,EAAC,MAAM,0BAA0B,CAAC;AAErG,OAAO,EAAU,aAAa,EAAyB,MAAM,iBAAiB,CAAC;AAC/E,OAAO,EAAC,IAAI,EAAC,MAAM,gBAAgB,CAAC;AACpC,OAAO,cAAc,MAAM,mBAAmB,CAAC;AAE/C;;;;;GAKG;AACH,cAAM,oBAAoB,CAAC,CAAC;IAC1B,OAAO,CAAC,cAAc,CAAoB;IAE1C,OAAO,CAAC,MAAM,CAAqC;IAEnD,OAAO,CAAC,oBAAoB,CAA0C;IAEtE,OAAO,CAAC,YAAY,CAAmB;IAEvC,OAAO,CAAC,SAAS,CAAwD;IAIzE,OAAO,CAAC,SAAS,CAAsC;IAEvD,OAAO,CAAC,kBAAkB,CAAK;IAE/B;;;;;OAKG;gBACgB,sBAAsB,EAAE,cAAc,CAAC,CAAC,CAAC,EAAE,oBAAoB,EAAE,gBAAgB;IAQpG;;;;;;;;;OASG;IACH,OAAO,CAAC,0BAA0B;IAoBlC;;;;;;OAMG;IACU,gBAAgB,CAAC,QAAQ,EAAE,wBAAwB,GAAG,OAAO,CAAC,wBAAwB,CAAC;IAMpG;;;;;;OAMG;IACU,0BAA0B,IAAI,OAAO,CAAC,iCAAiC,CAAC;IAwCrF;;;;;;;OAOG;IACU,yBAAyB,IAAI,OAAO,CAAC,iCAAiC,CAAC;IAkCpF;;;;;;OAMG;IACU,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAiB/D;;;;;;;;OAQG;IACU,mBAAmB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC;IA2CjF;;;;;OAKG;YACW,YAAY;IAiC1B;;OAEG;IACH,OAAO,CAAC,aAAa;IAiBrB;;;;OAIG;YACW,SAAS;IA0CvB;;;;;OAKG;IACI,wBAAwB,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI;IAetD;;;;;;;OAOG;IACU,8BAA8B,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IA8C3F;;;;OAIG;IACU,YAAY,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAKzD;;;;;;;;;;OAUG;IACU,mBAAmB,CAC9B,QAAQ,EAAE,QAAQ,EAClB,MAAM,CAAC,EAAE,MAAM,EACf,cAAc,UAAQ,GACrB,OAAO,CAAC,aAAa,CAAC;YA8CX,kBAAkB;CA4BjC;AAED,eAAe,oBAAoB,CAAC"}

package/dist/utils/getCurrentOrganizationUnitFromClaims.d.ts

@@ -0,0 +1,14 @@
+import { CurrentOrganizationUnit } from '../models/accessible-organization-unit';
+/**
+ * Reads the organization unit a session was issued for from its token claims: `ouId`, `ouHandle` and
+ * `ouName`, which name the unit the sign-in decided.
+ *
+ * The claims are read without verifying the token, so the result is for display only and MUST NOT be
+ * used for an authorization decision.
+ *
+ * @param claims - The decoded ID token (or sign-in assertion) payload.
+ * @returns The current organization unit, or `null` when the claims carry no `ouId`.
+ */
+declare const getCurrentOrganizationUnitFromClaims: (claims: Record<string, unknown> | null | undefined) => CurrentOrganizationUnit | null;
+export default getCurrentOrganizationUnitFromClaims;
+//# sourceMappingURL=getCurrentOrganizationUnitFromClaims.d.ts.map

package/dist/utils/getCurrentOrganizationUnitFromClaims.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"getCurrentOrganizationUnitFromClaims.d.ts","sourceRoot":"","sources":["../../src/utils/getCurrentOrganizationUnitFromClaims.ts"],"names":[],"mappings":"AAGA,OAAO,EAAC,uBAAuB,EAAC,MAAM,wCAAwC,CAAC;AAQ/E;;;;;;;;;GASG;AACH,QAAA,MAAM,oCAAoC,GACxC,QAAQ,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,GAAG,SAAS,KACjD,uBAAuB,GAAG,IAe5B,CAAC;AAEF,eAAe,oCAAoC,CAAC"}

package/dist/utils/requestManagementResource.d.ts

@@ -37,7 +37,8 @@ export interface ManagementResourceRequest {
 /**
  * Performs a request against a management API resource and maps failures onto
  * {@link ThunderIDAPIError}. HTTP 403 and 404 get their own codes so a caller can tell a missing
- * permission from a missing resource.
+ * permission from a missing resource. An OAuth 2.0 error body is carried the same way as the server's
+ * error envelope.
  *
  * @returns The parsed JSON body, or `undefined` when the server returns no content.
  */

package/dist/utils/requestManagementResource.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"requestManagementResource.d.ts","sourceRoot":"","sources":["../../src/utils/requestManagementResource.ts"],"names":[],"mappings":"AAIA,OAAO,EAAC,uBAAuB,EAAC,MAAM,eAAe,CAAC;AAEtD;;GAEG;AACH,MAAM,WAAW,yBAAyB;IACxC;;OAEG;IACH,IAAI,CAAC,EAAE,OAAO,CAAC;IACf;;OAEG;IACH,UAAU,EAAE,MAAM,CAAC;IACnB;;OAEG;IACH,cAAc,EAAE,MAAM,CAAC;IACvB;;OAEG;IACH,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,KAAK,GAAG,MAAM,GAAG,KAAK,GAAG,QAAQ,CAAC;IAC1C;;OAEG;IACH,SAAS,EAAE,MAAM,CAAC;IAClB;;OAEG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC,CAAC;IACpD;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;;;;GAMG;AACH,QAAA,MAAM,yBAAyB,GAAU,CAAC,EACxC,6CAA2C,uBAAuB,EAClE,6EAA2E,yBAAyB,KACnG,OAAO,CAAC,CAAC,CA2FX,CAAC;AAEF,eAAe,yBAAyB,CAAC"}
+{"version":3,"file":"requestManagementResource.d.ts","sourceRoot":"","sources":["../../src/utils/requestManagementResource.ts"],"names":[],"mappings":"AAIA,OAAO,EAAC,uBAAuB,EAAC,MAAM,eAAe,CAAC;AAEtD;;GAEG;AACH,MAAM,WAAW,yBAAyB;IACxC;;OAEG;IACH,IAAI,CAAC,EAAE,OAAO,CAAC;IACf;;OAEG;IACH,UAAU,EAAE,MAAM,CAAC;IACnB;;OAEG;IACH,cAAc,EAAE,MAAM,CAAC;IACvB;;OAEG;IACH,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,KAAK,GAAG,MAAM,GAAG,KAAK,GAAG,QAAQ,CAAC;IAC1C;;OAEG;IACH,SAAS,EAAE,MAAM,CAAC;IAClB;;OAEG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC,CAAC;IACpD;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AA8BD;;;;;;;GAOG;AACH,QAAA,MAAM,yBAAyB,GAAU,CAAC,EACxC,6CAA2C,uBAAuB,EAClE,6EAA2E,yBAAyB,KACnG,OAAO,CAAC,CAAC,CA2FX,CAAC;AAEF,eAAe,yBAAyB,CAAC"}

package/dist/utils/resolveOrganizationUnitEndpoint.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Builds the organization-unit-qualified form of an OAuth 2.0 endpoint, such as
+ * `{baseUrl}/ou/{ouId}/oauth2/authorize` for `{baseUrl}/oauth2/authorize`. A sign-in started there is
+ * bounded to the unit, and an authorization code from it is redeemed at the unit's token endpoint.
+ *
+ * The unit identifier is one path segment, so it is percent-encoded. The `/ou/{ouId}` prefix goes in
+ * front of the endpoint's `/oauth2/` segment, so an endpoint discovered under a path prefix keeps it.
+ * When the endpoint has no `/oauth2/` segment, the path is built from `baseUrl` and the endpoint's
+ * last segment instead.
+ *
+ * @param endpoint - The unqualified endpoint, from discovery or derived from `baseUrl`.
+ * @param ouId - Identifier of the organization unit.
+ * @param baseUrl - The server's base URL, used when the endpoint cannot be qualified in place.
+ * @returns The qualified endpoint URL.
+ * @throws {ThunderIDRuntimeError} `JS-AUTH_CORE-OUEP-IV01` when `ouId` is empty, and
+ *   `JS-AUTH_CORE-OUEP-IV02` when the endpoint cannot be qualified.
+ */
+declare const resolveOrganizationUnitEndpoint: (endpoint: string, ouId: string, baseUrl?: string) => string;
+export default resolveOrganizationUnitEndpoint;
+//# sourceMappingURL=resolveOrganizationUnitEndpoint.d.ts.map

package/dist/utils/resolveOrganizationUnitEndpoint.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolveOrganizationUnitEndpoint.d.ts","sourceRoot":"","sources":["../../src/utils/resolveOrganizationUnitEndpoint.ts"],"names":[],"mappings":"AAOA;;;;;;;;;;;;;;;;GAgBG;AACH,QAAA,MAAM,+BAA+B,GAAI,UAAU,MAAM,EAAE,MAAM,MAAM,EAAE,UAAU,MAAM,KAAG,MA8B3F,CAAC;AAEF,eAAe,+BAA+B,CAAC"}

package/dist/utils/resolveResourceEndpoint.d.ts

@@ -8,7 +8,7 @@ import { BaseConfig } from '../models/config';
  * issuers), these overrides let the SDK send flow and user-management requests to the resource
  * server while OAuth requests continue to target the authorization server.
  */
-export type ResourceEndpointKey = 'agents' | 'agentTypes' | 'applications' | 'configurationVersions' | 'connections' | 'design' | 'export' | 'flowExecute' | 'flowMeta' | 'flows' | 'gateways' | 'groups' | 'i18n' | 'import' | 'notificationTemplates' | 'organizationUnits' | 'resourceServers' | 'roles' | 'secrets' | 'serverConfig' | 'users' | 'usersMe' | 'usersMeCredentials' | 'usersMeMeta' | 'userTypes' | 'variables';
+export type ResourceEndpointKey = 'agents' | 'agentTypes' | 'applications' | 'authorizationDetailTypes' | 'clientRegistrations' | 'configurationVersions' | 'connections' | 'credentialConfigurations' | 'design' | 'export' | 'flowExecute' | 'flowMeta' | 'flows' | 'gateways' | 'groups' | 'i18n' | 'import' | 'notificationTemplates' | 'organizationUnits' | 'presentationDefinitions' | 'projects' | 'resourceServers' | 'roles' | 'secrets' | 'serverConfig' | 'users' | 'usersMe' | 'usersMeCredentials' | 'usersMeMeta' | 'usersMeOrganizationUnits' | 'userTypes' | 'variables';
 /**
  * The `config.endpoints` keys that address resource-server endpoints rather than OIDC/OAuth
  * endpoints. Used to keep these overrides out of the resolved OIDC provider metadata.

package/dist/utils/resolveResourceEndpoint.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resolveResourceEndpoint.d.ts","sourceRoot":"","sources":["../../src/utils/resolveResourceEndpoint.ts"],"names":[],"mappings":"AAGA,OAAO,EAAC,UAAU,EAAC,MAAM,kBAAkB,CAAC;AAE5C;;;;;;;;GAQG;AACH,MAAM,MAAM,mBAAmB,GAC3B,QAAQ,GACR,YAAY,GACZ,cAAc,GACd,uBAAuB,GACvB,aAAa,GACb,QAAQ,GACR,QAAQ,GACR,aAAa,GACb,UAAU,GACV,OAAO,GACP,UAAU,GACV,QAAQ,GACR,MAAM,GACN,QAAQ,GACR,uBAAuB,GACvB,mBAAmB,GACnB,iBAAiB,GACjB,OAAO,GACP,SAAS,GACT,cAAc,GACd,OAAO,GACP,SAAS,GACT,oBAAoB,GACpB,aAAa,GACb,WAAW,GACX,WAAW,CAAC;AAEhB;;;GAGG;AACH,eAAO,MAAM,sBAAsB,EAAE,SAAS,mBAAmB,EA2BhE,CAAC;AAEF;;;GAGG;AACH,MAAM,WAAW,sBAAsB;IACrC,SAAS,CAAC,EAAE,UAAU,CAAC,WAAW,CAAC,CAAC;CACrC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,QAAA,MAAM,uBAAuB,GAC3B,KAAK,mBAAmB,EACxB,QAAQ,sBAAsB,GAAG,SAAS,EAC1C,cAAc,MAAM,KACnB,MAAM,GAAG,SAAiE,CAAC;AAE9E,eAAe,uBAAuB,CAAC"}
+{"version":3,"file":"resolveResourceEndpoint.d.ts","sourceRoot":"","sources":["../../src/utils/resolveResourceEndpoint.ts"],"names":[],"mappings":"AAGA,OAAO,EAAC,UAAU,EAAC,MAAM,kBAAkB,CAAC;AAE5C;;;;;;;;GAQG;AACH,MAAM,MAAM,mBAAmB,GAC3B,QAAQ,GACR,YAAY,GACZ,cAAc,GACd,0BAA0B,GAC1B,qBAAqB,GACrB,uBAAuB,GACvB,aAAa,GACb,0BAA0B,GAC1B,QAAQ,GACR,QAAQ,GACR,aAAa,GACb,UAAU,GACV,OAAO,GACP,UAAU,GACV,QAAQ,GACR,MAAM,GACN,QAAQ,GACR,uBAAuB,GACvB,mBAAmB,GACnB,yBAAyB,GACzB,UAAU,GACV,iBAAiB,GACjB,OAAO,GACP,SAAS,GACT,cAAc,GACd,OAAO,GACP,SAAS,GACT,oBAAoB,GACpB,aAAa,GACb,0BAA0B,GAC1B,WAAW,GACX,WAAW,CAAC;AAEhB;;;GAGG;AACH,eAAO,MAAM,sBAAsB,EAAE,SAAS,mBAAmB,EAiChE,CAAC;AAEF;;;GAGG;AACH,MAAM,WAAW,sBAAsB;IACrC,SAAS,CAAC,EAAE,UAAU,CAAC,WAAW,CAAC,CAAC;CACrC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,QAAA,MAAM,uBAAuB,GAC3B,KAAK,mBAAmB,EACxB,QAAQ,sBAAsB,GAAG,SAAS,EAC1C,cAAc,MAAM,KACnB,MAAM,GAAG,SAAiE,CAAC;AAE9E,eAAe,uBAAuB,CAAC"}

package/dist/utils/sharingPolicies.d.ts

@@ -0,0 +1,126 @@
+import { ManagementRequestConfig } from '../models/api';
+import { ResolvedOverlay, SharingPolicy, SharingPolicyListResponse, SharingPolicyRequest, SharingPolicyUpdateRequest } from '../models/sharing-policy';
+/**
+ * The kinds of resource that carry sharing policies.
+ */
+export type SharingResourceType = 'user' | 'application' | 'role' | 'flow';
+/**
+ * The management collection that holds each kind of shared resource.
+ */
+export declare const SHARING_RESOURCE_COLLECTIONS: Record<SharingResourceType, 'users' | 'applications' | 'roles' | 'flows'>;
+/**
+ * The sharing operations of one kind of resource, addressed by the resource's identifier.
+ */
+export interface SharingPolicyOperations {
+    create: (config: ManagementRequestConfig & {
+        payload: SharingPolicyRequest;
+        resourceId: string;
+    }) => Promise<SharingPolicy>;
+    delete: (config: ManagementRequestConfig & {
+        policyId: string;
+        resourceId: string;
+    }) => Promise<void>;
+    getOverlayRules: (config: ManagementRequestConfig & {
+        ouId: string;
+        resourceId: string;
+    }) => Promise<ResolvedOverlay>;
+    list: (config: ManagementRequestConfig & {
+        limit?: number;
+        offset?: number;
+        resourceId: string;
+    }) => Promise<SharingPolicyListResponse>;
+    update: (config: ManagementRequestConfig & {
+        payload: SharingPolicyUpdateRequest;
+        policyId: string;
+        resourceId: string;
+    }) => Promise<SharingPolicy>;
+}
+/**
+ * Returns the existing sharing operations for a kind of resource, so a component can manage the
+ * policies of a user, an application, a role or a flow the same way.
+ *
+ * @param resourceType - The kind of resource.
+ * @returns The operations, each taking the resource's identifier as `resourceId`.
+ */
+export declare const getSharingPolicyOperations: (resourceType: SharingResourceType) => SharingPolicyOperations;
+/**
+ * The translation function the helpers below take.
+ */
+type Translate = (key: string, params?: Record<string, string | number>) => string;
+/**
+ * Describes, in translated words, which organization units a sharing policy reaches: one line per
+ * section the server returned (every unit, the units beneath the owner, the roots of other trees).
+ *
+ * @param t - The translation function.
+ * @param policy - The policy.
+ * @returns The lines, never empty.
+ */
+export declare const describeSharingPolicyScope: (t: Translate, policy: SharingPolicy) => string[];
+/**
+ * The values of the sharing policy form. Lists of organization unit identifiers are kept as the text
+ * the user types, separated by commas.
+ */
+export interface SharingPolicyFormValues {
+    /**
+     * Which units beneath the owner the policy reaches: none, all of them, or the ones listed.
+     */
+    childUnitsMode: 'none' | 'all' | 'selected';
+    /**
+     * With `all`, the units beneath the owner to withhold.
+     */
+    excludedOuIds: string;
+    /**
+     * The root units of other trees the policy reaches.
+     */
+    otherTreeRootOuIds: string;
+    /**
+     * With `selected`, whether each listed unit is reached alone or with everything below it.
+     */
+    reach: 'unit' | 'subtree';
+    /**
+     * With `selected`, the units beneath the owner the policy reaches.
+     */
+    selectedOuIds: string;
+}
+/**
+ * Splits text of comma or whitespace separated identifiers, dropping empty and repeated entries.
+ *
+ * @param value - The text.
+ * @returns The identifiers.
+ */
+export declare const parseOrganizationUnitIds: (value: string) => string[];
+/**
+ * The form values for a new policy, or for editing an existing one.
+ *
+ * @param policy - The policy being edited, if any.
+ * @returns The values.
+ */
+export declare const toSharingPolicyFormValues: (policy?: SharingPolicy) => SharingPolicyFormValues;
+/**
+ * Whether the form describes a policy the server can accept: it must reach some unit, and a policy of
+ * selected units must name at least one. A policy that already reaches every unit or every other tree
+ * keeps that section, so it is valid without either.
+ *
+ * @param values - The form values.
+ * @param policy - The policy being edited, if any.
+ * @returns Whether the values can be submitted.
+ */
+export declare const isSharingPolicyFormValid: (values: SharingPolicyFormValues, policy?: SharingPolicy) => boolean;
+/**
+ * Builds the payload that creates a policy from the form.
+ *
+ * @param values - The form values.
+ * @returns The payload.
+ */
+export declare const toSharingPolicyRequest: (values: SharingPolicyFormValues) => SharingPolicyRequest;
+/**
+ * Builds the payload that replaces a policy's sections from the form. Sections the form cannot edit
+ * (every unit, every other tree) and the overlay rules of units that stay are kept as they were.
+ *
+ * @param values - The form values.
+ * @param policy - The policy being edited.
+ * @returns The payload, carrying the version being edited.
+ */
+export declare const toSharingPolicyUpdateRequest: (values: SharingPolicyFormValues, policy: SharingPolicy) => SharingPolicyUpdateRequest;
+export {};
+//# sourceMappingURL=sharingPolicies.d.ts.map

package/dist/utils/sharingPolicies.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sharingPolicies.d.ts","sourceRoot":"","sources":["../../src/utils/sharingPolicies.ts"],"names":[],"mappings":"AAuBA,OAAO,EAAC,uBAAuB,EAAC,MAAM,eAAe,CAAC;AACtD,OAAO,EACL,eAAe,EACf,aAAa,EAGb,yBAAyB,EAEzB,oBAAoB,EACpB,0BAA0B,EAC3B,MAAM,0BAA0B,CAAC;AAElC;;GAEG;AACH,MAAM,MAAM,mBAAmB,GAAG,MAAM,GAAG,aAAa,GAAG,MAAM,GAAG,MAAM,CAAC;AAE3E;;GAEG;AACH,eAAO,MAAM,4BAA4B,EAAE,MAAM,CAAC,mBAAmB,EAAE,OAAO,GAAG,cAAc,GAAG,OAAO,GAAG,OAAO,CAKlH,CAAC;AAEF;;GAEG;AACH,MAAM,WAAW,uBAAuB;IACtC,MAAM,EAAE,CACN,MAAM,EAAE,uBAAuB,GAAG;QAAC,OAAO,EAAE,oBAAoB,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAC,KAClF,OAAO,CAAC,aAAa,CAAC,CAAC;IAC5B,MAAM,EAAE,CAAC,MAAM,EAAE,uBAAuB,GAAG;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAC,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACpG,eAAe,EAAE,CAAC,MAAM,EAAE,uBAAuB,GAAG;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAC,KAAK,OAAO,CAAC,eAAe,CAAC,CAAC;IACpH,IAAI,EAAE,CACJ,MAAM,EAAE,uBAAuB,GAAG;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAC,KACpF,OAAO,CAAC,yBAAyB,CAAC,CAAC;IACxC,MAAM,EAAE,CACN,MAAM,EAAE,uBAAuB,GAAG;QAAC,OAAO,EAAE,0BAA0B,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAC,KAC1G,OAAO,CAAC,aAAa,CAAC,CAAC;CAC7B;AAED;;;;;;GAMG;AACH,eAAO,MAAM,0BAA0B,GAAI,cAAc,mBAAmB,KAAG,uBAqC9E,CAAC;AAEF;;GAEG;AACH,KAAK,SAAS,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC,KAAK,MAAM,CAAC;AAKnF;;;;;;;GAOG;AACH,eAAO,MAAM,0BAA0B,GAAI,GAAG,SAAS,EAAE,QAAQ,aAAa,KAAG,MAAM,EAwCtF,CAAC;AAEF;;;GAGG;AACH,MAAM,WAAW,uBAAuB;IACtC;;OAEG;IACH,cAAc,EAAE,MAAM,GAAG,KAAK,GAAG,UAAU,CAAC;IAC5C;;OAEG;IACH,aAAa,EAAE,MAAM,CAAC;IACtB;;OAEG;IACH,kBAAkB,EAAE,MAAM,CAAC;IAC3B;;OAEG;IACH,KAAK,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B;;OAEG;IACH,aAAa,EAAE,MAAM,CAAC;CACvB;AAED;;;;;GAKG;AACH,eAAO,MAAM,wBAAwB,GAAI,OAAO,MAAM,KAAG,MAAM,EAQ5D,CAAC;AAEJ;;;;;GAKG;AACH,eAAO,MAAM,yBAAyB,GAAI,SAAS,aAAa,KAAG,uBAoBlE,CAAC;AAwDF;;;;;;;;GAQG;AACH,eAAO,MAAM,wBAAwB,GAAI,QAAQ,uBAAuB,EAAE,SAAS,aAAa,KAAG,OAWlG,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,sBAAsB,GAAI,QAAQ,uBAAuB,KAAG,oBAKxE,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,4BAA4B,GACvC,QAAQ,uBAAuB,EAC/B,QAAQ,aAAa,KACpB,0BAWF,CAAC"}

package/dist/utils/toManagementErrorMessage.d.ts

@@ -1,13 +1,15 @@
 /**
  * Turns a failed management request into a message for admin UI. A missing permission and a
- * missing resource get their own messages; anything else gets the operation's fallback. The
- * server's own error text is never shown.
+ * missing resource get their own messages; a refusal the caller names in `specificKeys` gets that
+ * message; anything else gets the operation's fallback. The server's own error text is never shown.
  *
  * @param t - The translation function.
  * @param error - The error a management operation reported, if any.
  * @param fallbackKey - Translation key of the message for any other failure.
+ * @param specificKeys - Translation keys for specific refusals, keyed by the server's error code
+ * (such as `OU-1006`) or by HTTP status (such as `409`). A code wins over a status.
  * @returns The translated message, or `null` when there is no error.
  */
-declare const toManagementErrorMessage: (t: (key: string) => string, error: Error | null | undefined, fallbackKey: string) => string | null;
+declare const toManagementErrorMessage: (t: (key: string) => string, error: Error | null | undefined, fallbackKey: string, specificKeys?: Readonly<Record<string, string>>) => string | null;
 export default toManagementErrorMessage;
 //# sourceMappingURL=toManagementErrorMessage.d.ts.map

package/dist/utils/toManagementErrorMessage.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"toManagementErrorMessage.d.ts","sourceRoot":"","sources":["../../src/utils/toManagementErrorMessage.ts"],"names":[],"mappings":"AAKA;;;;;;;;;GASG;AACH,QAAA,MAAM,wBAAwB,GAC5B,GAAG,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,EAC1B,OAAO,KAAK,GAAG,IAAI,GAAG,SAAS,EAC/B,aAAa,MAAM,KAClB,MAAM,GAAG,IAgBX,CAAC;AAEF,eAAe,wBAAwB,CAAC"}
+{"version":3,"file":"toManagementErrorMessage.d.ts","sourceRoot":"","sources":["../../src/utils/toManagementErrorMessage.ts"],"names":[],"mappings":"AAKA;;;;;;;;;;;GAWG;AACH,QAAA,MAAM,wBAAwB,GAC5B,GAAG,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,EAC1B,OAAO,KAAK,GAAG,IAAI,GAAG,SAAS,EAC/B,aAAa,MAAM,EACnB,eAAe,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,KAC9C,MAAM,GAAG,IA6BX,CAAC;AAEF,eAAe,wBAAwB,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@thunderid/javascript",
-  "version": "1.12.0",
+  "version": "1.13.0",
   "description": "JavaScript Ecosystem SDK for ThunderID",
   "keywords": [
     "thunderid",