@thunderid/javascript 1.19.0 → 1.20.0

package/dist/api/auth/getFlowMeta.d.ts

@@ -13,7 +13,9 @@ import { FlowMetadataResponse, GetFlowMetaRequestConfig } from '../../models/flo
  *                 and `id` are omitted the server returns i18n-only metadata.
  * @returns A promise that resolves to the {@link FlowMetadataResponse}.
  *
- * @throws {ThunderIDAPIError} When the server returns a non-OK response.
+ * @throws {ThunderIDAPIError} When the server returns a non-OK response, or an OK response whose body is not JSON.
+ * Use {@link isFlowMetaUnavailableError} to tell a server that has no flow metadata endpoint, such as an OpenID
+ * Connect provider other than ThunderID, from a real failure.
  *
  * @example
  * ```typescript

package/dist/api/auth/getFlowMeta.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"getFlowMeta.d.ts","sourceRoot":"","sources":["../../../src/api/auth/getFlowMeta.ts"],"names":[],"mappings":"AAIA,OAAO,EAAC,oBAAoB,EAAE,wBAAwB,EAAC,MAAM,wBAAwB,CAAC;AAEtF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,QAAA,MAAM,WAAW,GAAU,mEAQxB,wBAAwB,KAAG,OAAO,CAAC,oBAAoB,CAoCzD,CAAC;AAEF,eAAe,WAAW,CAAC"}
+{"version":3,"file":"getFlowMeta.d.ts","sourceRoot":"","sources":["../../../src/api/auth/getFlowMeta.ts"],"names":[],"mappings":"AAIA,OAAO,EAAC,oBAAoB,EAAE,wBAAwB,EAAC,MAAM,wBAAwB,CAAC;AAEtF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,QAAA,MAAM,WAAW,GAAU,mEAQxB,wBAAwB,KAAG,OAAO,CAAC,oBAAoB,CA8CzD,CAAC;AAEF,eAAe,WAAW,CAAC"}

package/dist/api/management/user-types/getUserType.d.ts

@@ -10,5 +10,13 @@ export interface GetUserTypeConfig extends ManagementRequestConfig {
  * Fetches a user type with its attribute schema.
  */
 declare const getUserType: ({ userTypeId, ...config }: GetUserTypeConfig) => Promise<ManagedUserTypeDetails>;
+/**
+ * Looks up the schema for the type handle reported by the users API.
+ *
+ * @internal Shared by the SDK packages. It is not part of the public API and can change in any release.
+ */
+export declare const getUserTypeByHandle: (config: ManagementRequestConfig & {
+    handle: string;
+}) => Promise<ManagedUserTypeDetails | undefined>;
 export default getUserType;
 //# sourceMappingURL=getUserType.d.ts.map

package/dist/api/management/user-types/getUserType.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"getUserType.d.ts","sourceRoot":"","sources":["../../../../src/api/management/user-types/getUserType.ts"],"names":[],"mappings":"AAGA,OAAO,EAAC,uBAAuB,EAAC,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAC,sBAAsB,EAAC,MAAM,6BAA6B,CAAC;AAGnE,MAAM,WAAW,iBAAkB,SAAQ,uBAAuB;IAChE;;OAEG;IACH,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;GAEG;AACH,QAAA,MAAM,WAAW,GAAU,2BAAyB,iBAAiB,KAAG,OAAO,CAAC,sBAAsB,CAQlG,CAAC;AAEL,eAAe,WAAW,CAAC"}
+{"version":3,"file":"getUserType.d.ts","sourceRoot":"","sources":["../../../../src/api/management/user-types/getUserType.ts"],"names":[],"mappings":"AAGA,OAAO,EAAC,uBAAuB,EAAC,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAC,sBAAsB,EAAC,MAAM,6BAA6B,CAAC;AAKnE,MAAM,WAAW,iBAAkB,SAAQ,uBAAuB;IAChE;;OAEG;IACH,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;GAEG;AACH,QAAA,MAAM,WAAW,GAAU,2BAAyB,iBAAiB,KAAG,OAAO,CAAC,sBAAsB,CAQlG,CAAC;AAEL;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,GAC9B,QAAQ,uBAAuB,GAAG;IAAC,MAAM,EAAE,MAAM,CAAA;CAAC,KACjD,OAAO,CAAC,sBAAsB,GAAG,SAAS,CAa5C,CAAC;AAEF,eAAe,WAAW,CAAC"}

package/dist/api/management/users/sendUserAttributeVerification.d.ts

@@ -0,0 +1,59 @@
+import { ManagementRequestConfig } from '../../../models/api';
+/**
+ * Configuration for the sendUserAttributeVerification request.
+ */
+export interface SendUserAttributeVerificationConfig extends ManagementRequestConfig {
+    /**
+     * The attribute to verify, such as `email`.
+     */
+    attribute: string;
+    /**
+     * Handle of the administrator-initiated verification flow to run. When omitted, the handle the server
+     * names under `adminAttributeVerificationFlow` in its `flow` configuration is used.
+     */
+    handle?: string;
+    /**
+     * Identifier of the user.
+     */
+    userId: string;
+}
+/**
+ * What the flow reports once it has sent the verification link. It never returns the link or the address.
+ */
+export interface SendUserAttributeVerificationResult {
+    /**
+     * The channel the link went out on, such as `email`.
+     */
+    channel: string;
+    /**
+     * Whether the flow's email step sent the link. `false` means the flow ran but no email went out, so check it
+     * before telling the administrator the link was sent. Absent when the flow does not report it.
+     */
+    emailSent?: boolean;
+    /**
+     * The masked address the link was sent to, such as `j***@example.com`.
+     */
+    maskedDestination?: string;
+}
+/**
+ * Sends a user a link to verify one of their attributes, through the server's administrator-initiated
+ * verification flow. The flow pauses once the link is sent; the user finishes it from the link, without
+ * the administrator. A refused step raises {@link AdministrationFlowError} with the step's code, such as
+ * `FET-1114` for a suspended user. Without a `handle`, the flow is the one the server's
+ * `adminAttributeVerificationFlow` setting names; when that is unset the call fails with
+ * `sendUserAttributeVerification-NotConfiguredError-001`. A flow whose email step sends nothing still
+ * resolves, with `emailSent: false`, as the account lifecycle actions do, so callers must check `emailSent`.
+ *
+ * @param config - Request configuration. Requires `baseUrl` and a token with the root `system` permission.
+ * @returns The channel, masked destination and delivery flag reported by the flow.
+ * @throws {ThunderIDAPIError} If required input is missing or the request fails.
+ * @throws {AdministrationFlowError} If no flow is configured, the flow refuses the start or it does not return the delivery step.
+ *
+ * @example
+ * ```typescript
+ * const {emailSent, maskedDestination} = await sendUserAttributeVerification({baseUrl, attribute: 'email', userId});
+ * ```
+ */
+declare const sendUserAttributeVerification: ({ attribute, handle, userId, ...config }: SendUserAttributeVerificationConfig) => Promise<SendUserAttributeVerificationResult>;
+export default sendUserAttributeVerification;
+//# sourceMappingURL=sendUserAttributeVerification.d.ts.map

package/dist/api/management/users/sendUserAttributeVerification.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sendUserAttributeVerification.d.ts","sourceRoot":"","sources":["../../../../src/api/management/users/sendUserAttributeVerification.ts"],"names":[],"mappings":"AAQA,OAAO,EAAC,uBAAuB,EAAC,MAAM,qBAAqB,CAAC;AAM5D;;GAEG;AACH,MAAM,WAAW,mCAAoC,SAAQ,uBAAuB;IAClF;;OAEG;IACH,SAAS,EAAE,MAAM,CAAC;IAClB;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;OAEG;IACH,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;GAEG;AACH,MAAM,WAAW,mCAAmC;IAClD;;OAEG;IACH,OAAO,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB;;OAEG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAID;;;;;;;;;;;;;;;;;;GAkBG;AACH,QAAA,MAAM,6BAA6B,GAAU,0CAK1C,mCAAmC,KAAG,OAAO,CAAC,mCAAmC,CAyEnF,CAAC;AAEF,eAAe,6BAA6B,CAAC"}

package/dist/cjs/index.cjs

@@ -886,6 +886,7 @@ var executeEmbeddedSignInFlow_default = executeEmbeddedSignInFlow;
 //#endregion
 //#region src/models/embedded-flow.ts
 let EmbeddedFlowType = /* @__PURE__ */ function(EmbeddedFlowType$1) {
+	EmbeddedFlowType$1["AdminInitiated"] = "ADMIN_INITIATED";
 	EmbeddedFlowType$1["Authentication"] = "AUTHENTICATION";
 	EmbeddedFlowType$1["DeviceGrant"] = "DEVICE_GRANT";
 	EmbeddedFlowType$1["Recovery"] = "RECOVERY";
@@ -1524,7 +1525,9 @@ var executeEmbeddedSelfFlow_default = executeEmbeddedSelfFlow;
 *                 and `id` are omitted the server returns i18n-only metadata.
 * @returns A promise that resolves to the {@link FlowMetadataResponse}.
 *
-* @throws {ThunderIDAPIError} When the server returns a non-OK response.
+* @throws {ThunderIDAPIError} When the server returns a non-OK response, or an OK response whose body is not JSON.
+* Use {@link isFlowMetaUnavailableError} to tell a server that has no flow metadata endpoint, such as an OpenID
+* Connect provider other than ThunderID, from a real failure.
 *
 * @example
 * ```typescript
@@ -1562,7 +1565,11 @@ const getFlowMeta = async ({ url, baseUrl, type, id, language, namespace,...requ
 		method: "GET"
 	});
 	if (!response.ok) throw new ThunderIDAPIError(await response.text(), "getFlowMeta-ResponseError-001", "javascript", response.status, response.statusText, "Flow metadata request failed");
-	return await response.json();
+	try {
+		return await response.json();
+	} catch {
+		throw new ThunderIDAPIError("The response body is not JSON.", "getFlowMeta-InvalidResponseError-001", "javascript", response.status, response.statusText, "Flow metadata request failed");
+	}
 };
 var getFlowMeta_default = getFlowMeta;
 
@@ -2228,10 +2235,12 @@ const AdministrationModes = {
 };
 /**
 * Keys of the `flow` server-config section that name the administration flow for each operation. An
-* unset key is the opt-out: the operation calls the management API directly.
+* unset key is the opt-out: the operation calls the management API directly. `adminAttributeVerificationFlow`
+* names an administrator-initiated flow, started by its handle, and has no such fallback.
 */
 const AdministrationFlowConfigKey = {
 	ACTION_DELETION: "actionDeletionFlow",
+	ADMIN_ATTRIBUTE_VERIFICATION: "adminAttributeVerificationFlow",
 	AGENT_SUSPEND: "agentSuspendFlow",
 	AGENT_UNLOCK: "agentUnlockFlow",
 	AGENT_UNSUSPEND: "agentUnsuspendFlow",
@@ -3534,6 +3543,21 @@ const updateUserCredentials = async ({ payload, userId,...config }) => {
 };
 var updateUserCredentials_default = updateUserCredentials;
 
+//#endregion
+//#region src/utils/computeNextPageOffset.ts
+/**
+* Offset of the next page: the request offset plus the number of items the backend returned, or
+* `null` once the list is exhausted.
+*
+* @internal Shared by the SDK packages. It is not part of the public API and can change in any release.
+*/
+const computeNextPageOffset = (offset, count, totalResults) => {
+	if (!Number.isInteger(offset) || offset < 0 || !Number.isInteger(count) || count <= 0) return null;
+	const next = offset + count;
+	return totalResults !== void 0 && next >= totalResults ? null : next;
+};
+var computeNextPageOffset_default = computeNextPageOffset;
+
 //#endregion
 //#region src/api/management/user-types/getUserType.ts
 /**
@@ -3547,6 +3571,28 @@ const getUserType = async ({ userTypeId,...config }) => requestManagementResourc
 	operation: "getUserType",
 	query: { include: "display" }
 });
+/**
+* Looks up the schema for the type handle reported by the users API.
+*
+* @internal Shared by the SDK packages. It is not part of the public API and can change in any release.
+*/
+const getUserTypeByHandle = async (config) => {
+	const { handle,...endpoint } = config;
+	let offset = 0;
+	while (offset !== null) {
+		const page = await getUserTypes_default({
+			...endpoint,
+			limit: 100,
+			offset
+		});
+		const type = page.types.find((candidate) => candidate.handle === handle);
+		if (type) return getUserType({
+			...endpoint,
+			userTypeId: type.id
+		});
+		offset = computeNextPageOffset_default(offset, page.count, page.totalResults);
+	}
+};
 var getUserType_default = getUserType;
 
 //#endregion
@@ -8210,6 +8256,85 @@ const unlockUser = async ({ userId, operatorNote,...config }) => runAccountLifec
 });
 var unlockUser_default = unlockUser;
 
+//#endregion
+//#region src/constants/AttributeVerificationConstants.ts
+/**
+* Wire names and eligibility rules for user attribute verification, by the user or by an administrator.
+*/
+const AttributeVerificationConstants = {
+	ADMIN_VERIFIABLE_ATTRIBUTES: ["email"],
+	ATTRIBUTE_INPUT: "attribute",
+	CHANNEL_KEY: "channel",
+	DEFAULT_FLOW_HANDLE: "default-self-attribute-verification-flow",
+	EMAIL_SENT_KEY: "emailSent",
+	MASKED_DESTINATION_KEY: "maskedDestination",
+	SUBJECT_INPUT: "subject",
+	VERIFIABLE_ATTRIBUTE_TYPES: ["email", "mobile"],
+	VERIFIED_ATTRIBUTES_KEY: "verifiedAttributes"
+};
+var AttributeVerificationConstants_default = AttributeVerificationConstants;
+
+//#endregion
+//#region src/api/management/users/sendUserAttributeVerification.ts
+const OPERATION = "sendUserAttributeVerification";
+/**
+* Sends a user a link to verify one of their attributes, through the server's administrator-initiated
+* verification flow. The flow pauses once the link is sent; the user finishes it from the link, without
+* the administrator. A refused step raises {@link AdministrationFlowError} with the step's code, such as
+* `FET-1114` for a suspended user. Without a `handle`, the flow is the one the server's
+* `adminAttributeVerificationFlow` setting names; when that is unset the call fails with
+* `sendUserAttributeVerification-NotConfiguredError-001`. A flow whose email step sends nothing still
+* resolves, with `emailSent: false`, as the account lifecycle actions do, so callers must check `emailSent`.
+*
+* @param config - Request configuration. Requires `baseUrl` and a token with the root `system` permission.
+* @returns The channel, masked destination and delivery flag reported by the flow.
+* @throws {ThunderIDAPIError} If required input is missing or the request fails.
+* @throws {AdministrationFlowError} If no flow is configured, the flow refuses the start or it does not return the delivery step.
+*
+* @example
+* ```typescript
+* const {emailSent, maskedDestination} = await sendUserAttributeVerification({baseUrl, attribute: 'email', userId});
+* ```
+*/
+const sendUserAttributeVerification = async ({ attribute, handle, userId,...config }) => {
+	if (typeof userId !== "string" || userId.trim() === "" || typeof attribute !== "string" || !attribute.trim()) throw new ThunderIDAPIError("A user identifier and an attribute are required.", `${OPERATION}-ValidationError-002`, "javascript", 400, "The provided user identifier or attribute is empty.");
+	const flowHandle = handle ?? (await resolveAdministrationFlowHandles_default(config, [AdministrationFlowConfigKey.ADMIN_ATTRIBUTE_VERIFICATION]))[AdministrationFlowConfigKey.ADMIN_ATTRIBUTE_VERIFICATION];
+	if (!flowHandle) throw new AdministrationFlowError(`No administrator verification flow is configured, so no link was sent. Configure a flow for "${AdministrationFlowConfigKey.ADMIN_ATTRIBUTE_VERIFICATION}" in the server's flow configuration.`, `${OPERATION}-NotConfiguredError-001`);
+	const result = await requestManagementResource_default(toServerConfig_default(config, OPERATION), {
+		body: {
+			flowType: EmbeddedFlowType.AdminInitiated,
+			handle: flowHandle,
+			inputs: {
+				[AttributeVerificationConstants_default.ATTRIBUTE_INPUT]: attribute,
+				[AttributeVerificationConstants_default.SUBJECT_INPUT]: userId
+			},
+			verbose: true
+		},
+		collection: "flow",
+		failureMessage: "Failed to send the verification link",
+		id: "execute",
+		method: "POST",
+		operation: OPERATION
+	});
+	const data = result?.data?.additionalData ?? {};
+	const channel = data[AttributeVerificationConstants_default.CHANNEL_KEY];
+	if (result?.flowStatus === "INCOMPLETE" && channel) {
+		const emailSent = data[AttributeVerificationConstants_default.EMAIL_SENT_KEY];
+		const maskedDestination = data[AttributeVerificationConstants_default.MASKED_DESTINATION_KEY];
+		return {
+			channel,
+			...emailSent !== void 0 ? { emailSent: emailSent === "true" } : {},
+			...maskedDestination ? { maskedDestination } : {}
+		};
+	}
+	if (result?.flowStatus === "ERROR") {
+		const flowError = result.error ?? {};
+		throw new AdministrationFlowError(flowError.message?.defaultValue ?? flowError.description?.defaultValue ?? "The verification link was not sent.", flowError.code ?? `${OPERATION}-FlowError-001`, flowError);
+	}
+	throw new AdministrationFlowError("The verification flow did not report a sent link.", `${OPERATION}-UnexpectedStateError-001`);
+};
+var sendUserAttributeVerification_default = sendUserAttributeVerification;
+
 //#endregion
 //#region src/api/management/agents/suspendAgent.ts
 /**
@@ -8822,21 +8947,6 @@ const SelectConstants = {
 };
 var SelectConstants_default = SelectConstants;
 
-//#endregion
-//#region src/constants/AttributeVerificationConstants.ts
-/**
-* Wire names and eligibility rules for self user attribute verification.
-*/
-const AttributeVerificationConstants = {
-	ATTRIBUTE_INPUT: "attribute",
-	DEFAULT_FLOW_HANDLE: "default-self-attribute-verification-flow",
-	MASKED_DESTINATION_KEY: "maskedDestination",
-	VERIFIABLE_ATTRIBUTE_TYPES: ["email", "mobile"],
-	VERIFIED_ATTRIBUTES_KEY: "verifiedAttributes",
-	VERIFY_AFTER_SAVE_ATTRIBUTE_TYPES: ["email"]
-};
-var AttributeVerificationConstants_default = AttributeVerificationConstants;
-
 //#endregion
 //#region src/errors/ThunderIDRuntimeError.ts
 /**
@@ -12707,6 +12817,38 @@ const getVerifiedAttributes = (user) => {
 };
 var getVerifiedAttributes_default = getVerifiedAttributes;
 
+//#endregion
+//#region src/utils/isAdminVerifiableAttribute.ts
+const hasReportedStatus = (user, attribute) => {
+	const value = user?.attributes?.[attribute];
+	const verified = user?.verifiedAttributes;
+	return typeof value === "string" && value.trim() !== "" && !!verified && typeof verified === "object" && !Array.isArray(verified);
+};
+const getContactType = (schema, attribute) => {
+	if (!Object.prototype.hasOwnProperty.call(schema, attribute)) return;
+	const field = schema[attribute];
+	return (field?.type === "email" || field?.type === "mobile") && !field.credential ? field.type : void 0;
+};
+/**
+* Whether the administrator view knows the verification status of a stored contact.
+* A recorded verification remains visible when the schema cannot be read.
+*
+* @internal Shared by the SDK packages. It is not part of the public API and can change in any release.
+*/
+const hasAdminVerificationStatus = (user, attribute, schema) => hasReportedStatus(user, attribute) && (Object.prototype.hasOwnProperty.call(user?.verifiedAttributes, attribute) || (schema ? getContactType(schema, attribute) !== void 0 : AttributeVerificationConstants_default.ADMIN_VERIFIABLE_ATTRIBUTES.includes(attribute)));
+/**
+* Whether the stored attribute can be verified through the shipped administrator email flow.
+* With a schema, the property must be a top-level email. Without one, the base view recognizes
+* the default email field for applications that supply their own send callback.
+*
+* @param user - The user, as read from `GET /users/{id}`.
+* @param attribute - The concrete attribute name, such as `workEmail`.
+* @param schema - The user's type schema.
+* @returns Whether the administrator email flow supports the attribute.
+*/
+const isAdminVerifiableAttribute = (user, attribute, schema) => hasReportedStatus(user, attribute) && (schema ? getContactType(schema, attribute) === "email" : AttributeVerificationConstants_default.ADMIN_VERIFIABLE_ATTRIBUTES.includes(attribute));
+var isAdminVerifiableAttribute_default = isAdminVerifiableAttribute;
+
 //#endregion
 //#region src/utils/isVerifiableAttribute.ts
 /**
@@ -13201,21 +13343,6 @@ const resolveRequestBaseUrl = (config) => {
 };
 var resolveRequestBaseUrl_default = resolveRequestBaseUrl;
 
-//#endregion
-//#region src/utils/computeNextPageOffset.ts
-/**
-* Offset of the next page: the request offset plus the number of items the backend returned, or
-* `null` once the list is exhausted.
-*
-* @internal Shared by the SDK packages. It is not part of the public API and can change in any release.
-*/
-const computeNextPageOffset = (offset, count, totalResults) => {
-	if (!Number.isInteger(offset) || offset < 0 || !Number.isInteger(count) || count <= 0) return null;
-	const next = offset + count;
-	return totalResults !== void 0 && next >= totalResults ? null : next;
-};
-var computeNextPageOffset_default = computeNextPageOffset;
-
 //#endregion
 //#region src/utils/isAdvancingPageOffset.ts
 /**
@@ -13369,6 +13496,45 @@ var isRetryableError_default = isRetryableError;
 const isFlowExpiredError = (error$1) => error$1 instanceof ThunderIDAPIError && error$1.serverError?.code === "FES-1004";
 var isFlowExpiredError_default = isFlowExpiredError;
 
+//#endregion
+//#region src/utils/isFlowMetaUnavailableError.ts
+/**
+* Statuses a server answers with when it has no `GET /flow/meta` endpoint, or does not open it to this client.
+*/
+const UNAVAILABLE_STATUSES = new Set([
+	401,
+	403,
+	404,
+	405,
+	501
+]);
+/**
+* Prefix of the error codes ThunderID's flow metadata endpoint answers with, such as `FM-1004` for an unknown
+* application.
+*/
+const FLOW_META_SERVER_ERROR_PREFIX = "FM-";
+/**
+* Tells whether a {@link getFlowMeta} failure means the server has no flow metadata to give, rather than that the
+* request failed. This is what happens when `baseUrl` points at an OpenID Connect provider other than ThunderID:
+* the provider answers `/flow/meta` with 401, 403, 404, 405 or 501, or with a body that is not JSON. Callers treat
+* such a failure as "no flow metadata" and carry on with the SDK's defaults.
+*
+* Everything else stays a real failure: a network error, a server error (5xx other than 501), and any reply that
+* carries ThunderID's own flow metadata error code (`FM-…`), such as the 404 ThunderID answers for an unknown
+* application.
+*
+* @param error - The value `getFlowMeta` rejected with.
+* @returns `true` when the server has no flow metadata endpoint.
+*/
+const isFlowMetaUnavailableError = (error$1) => {
+	if (!(error$1 instanceof ThunderIDAPIError)) return false;
+	if (error$1.code === "getFlowMeta-InvalidResponseError-001") return true;
+	if (error$1.code !== "getFlowMeta-ResponseError-001" || error$1.statusCode === void 0) return false;
+	if (error$1.serverError?.code?.startsWith(FLOW_META_SERVER_ERROR_PREFIX)) return false;
+	return UNAVAILABLE_STATUSES.has(error$1.statusCode);
+};
+var isFlowMetaUnavailableError_default = isFlowMetaUnavailableError;
+
 //#endregion
 //#region src/utils/withRetry.ts
 const DEFAULT_RETRY_DELAY_MS = 500;
@@ -13818,6 +13984,13 @@ const en_US = {
 		"admin.users.details.edit.action": "Edit",
 		"admin.users.details.edit.save": "Save changes",
 		"admin.users.details.edit.error": "Could not save the user. Please try again.",
+		"admin.users.details.verification.status.verified": "Verified",
+		"admin.users.details.verification.status.unverified": "Unverified",
+		"admin.users.details.verification.verify": "Verify",
+		"admin.users.details.verification.sent": "Verification link sent to {destination}.",
+		"admin.users.details.verification.sent_generic": "Verification link sent.",
+		"admin.users.details.verification.error": "Could not send the verification link. Please try again.",
+		"admin.users.details.verification.load_error": "The verification settings could not be loaded.",
 		"admin.groups.list.title": "Groups",
 		"admin.groups.list.columns.name": "Name",
 		"admin.groups.list.columns.description": "Description",
@@ -14370,6 +14543,13 @@ const fr_FR = {
 		"admin.users.details.edit.action": "Modifier",
 		"admin.users.details.edit.save": "Enregistrer les modifications",
 		"admin.users.details.edit.error": "Impossible d'enregistrer l'utilisateur. Veuillez réessayer.",
+		"admin.users.details.verification.status.verified": "Vérifié",
+		"admin.users.details.verification.status.unverified": "Non vérifié",
+		"admin.users.details.verification.verify": "Vérifier",
+		"admin.users.details.verification.sent": "Lien de vérification envoyé à {destination}.",
+		"admin.users.details.verification.sent_generic": "Lien de vérification envoyé.",
+		"admin.users.details.verification.error": "Impossible d'envoyer le lien de vérification. Veuillez réessayer.",
+		"admin.users.details.verification.load_error": "Les paramètres de vérification n'ont pas pu être chargés.",
 		"admin.groups.list.title": "Groupes",
 		"admin.groups.list.columns.name": "Nom",
 		"admin.groups.list.columns.description": "Description",
@@ -14922,6 +15102,13 @@ const te_IN = {
 		"admin.users.details.edit.action": "సవరించు",
 		"admin.users.details.edit.save": "మార్పులను సేవ్ చేయి",
 		"admin.users.details.edit.error": "వినియోగదారుని సేవ్ చేయలేకపోయాము. దయచేసి మళ్లీ ప్రయత్నించండి.",
+		"admin.users.details.verification.status.verified": "ధృవీకరించబడింది",
+		"admin.users.details.verification.status.unverified": "ధృవీకరించబడలేదు",
+		"admin.users.details.verification.verify": "ధృవీకరించండి",
+		"admin.users.details.verification.sent": "ధృవీకరణ లింక్ {destination}కి పంపబడింది.",
+		"admin.users.details.verification.sent_generic": "ధృవీకరణ లింక్ పంపబడింది.",
+		"admin.users.details.verification.error": "ధృవీకరణ లింక్‌ను పంపలేకపోయాము. దయచేసి మళ్లీ ప్రయత్నించండి.",
+		"admin.users.details.verification.load_error": "ధృవీకరణ సెట్టింగ్‌లను లోడ్ చేయలేకపోయాము.",
 		"admin.groups.list.title": "సమూహాలు",
 		"admin.groups.list.columns.name": "పేరు",
 		"admin.groups.list.columns.description": "వివరణ",
@@ -15474,6 +15661,13 @@ const hi_IN = {
 		"admin.users.details.edit.action": "संपादित करें",
 		"admin.users.details.edit.save": "परिवर्तन सहेजें",
 		"admin.users.details.edit.error": "उपयोगकर्ता को सहेजा नहीं जा सका। कृपया फिर से प्रयास करें।",
+		"admin.users.details.verification.status.verified": "सत्यापित",
+		"admin.users.details.verification.status.unverified": "सत्यापित नहीं",
+		"admin.users.details.verification.verify": "सत्यापित करें",
+		"admin.users.details.verification.sent": "सत्यापन लिंक {destination} पर भेजा गया।",
+		"admin.users.details.verification.sent_generic": "सत्यापन लिंक भेजा गया।",
+		"admin.users.details.verification.error": "सत्यापन लिंक नहीं भेजा जा सका। कृपया फिर से प्रयास करें।",
+		"admin.users.details.verification.load_error": "सत्यापन सेटिंग्स लोड नहीं हो सकीं।",
 		"admin.groups.list.title": "समूह",
 		"admin.groups.list.columns.name": "नाम",
 		"admin.groups.list.columns.description": "विवरण",
@@ -16026,6 +16220,13 @@ const pt_BR = {
 		"admin.users.details.edit.action": "Editar",
 		"admin.users.details.edit.save": "Salvar alterações",
 		"admin.users.details.edit.error": "Não foi possível salvar o usuário. Tente novamente.",
+		"admin.users.details.verification.status.verified": "Verificado",
+		"admin.users.details.verification.status.unverified": "Não verificado",
+		"admin.users.details.verification.verify": "Verificar",
+		"admin.users.details.verification.sent": "Link de verificação enviado para {destination}.",
+		"admin.users.details.verification.sent_generic": "Link de verificação enviado.",
+		"admin.users.details.verification.error": "Não foi possível enviar o link de verificação. Tente novamente.",
+		"admin.users.details.verification.load_error": "Não foi possível carregar as configurações de verificação.",
 		"admin.groups.list.title": "Grupos",
 		"admin.groups.list.columns.name": "Nome",
 		"admin.groups.list.columns.description": "Descrição",
@@ -16578,6 +16779,13 @@ const pt_PT = {
 		"admin.users.details.edit.action": "Editar",
 		"admin.users.details.edit.save": "Guardar alterações",
 		"admin.users.details.edit.error": "Não foi possível guardar o utilizador. Tente novamente.",
+		"admin.users.details.verification.status.verified": "Verificado",
+		"admin.users.details.verification.status.unverified": "Não verificado",
+		"admin.users.details.verification.verify": "Verificar",
+		"admin.users.details.verification.sent": "Ligação de verificação enviada para {destination}.",
+		"admin.users.details.verification.sent_generic": "Ligação de verificação enviada.",
+		"admin.users.details.verification.error": "Não foi possível enviar a ligação de verificação. Tente novamente.",
+		"admin.users.details.verification.load_error": "Não foi possível carregar as definições de verificação.",
 		"admin.groups.list.title": "Grupos",
 		"admin.groups.list.columns.name": "Nome",
 		"admin.groups.list.columns.description": "Descrição",
@@ -17130,6 +17338,13 @@ const ta_IN = {
 		"admin.users.details.edit.action": "திருத்து",
 		"admin.users.details.edit.save": "மாற்றங்களைச் சேமி",
 		"admin.users.details.edit.error": "பயனரைச் சேமிக்க முடியவில்லை. மீண்டும் முயற்சிக்கவும்.",
+		"admin.users.details.verification.status.verified": "சரிபார்க்கப்பட்டது",
+		"admin.users.details.verification.status.unverified": "சரிபார்க்கப்படவில்லை",
+		"admin.users.details.verification.verify": "சரிபார்",
+		"admin.users.details.verification.sent": "சரிபார்ப்பு இணைப்பு {destination} க்கு அனுப்பப்பட்டது.",
+		"admin.users.details.verification.sent_generic": "சரிபார்ப்பு இணைப்பு அனுப்பப்பட்டது.",
+		"admin.users.details.verification.error": "சரிபார்ப்பு இணைப்பை அனுப்ப முடியவில்லை. மீண்டும் முயற்சிக்கவும்.",
+		"admin.users.details.verification.load_error": "சரிபார்ப்பு அமைப்புகளை ஏற்ற முடியவில்லை.",
 		"admin.groups.list.title": "குழுக்கள்",
 		"admin.groups.list.columns.name": "பெயர்",
 		"admin.groups.list.columns.description": "விளக்கம்",
@@ -17682,6 +17897,13 @@ const si_LK = {
 		"admin.users.details.edit.action": "සංස්කරණය",
 		"admin.users.details.edit.save": "වෙනස්කම් සුරකින්න",
 		"admin.users.details.edit.error": "පරිශීලකයා සුරැකිය නොහැකි විය. නැවත උත්සාහ කරන්න.",
+		"admin.users.details.verification.status.verified": "සත්‍යාපනය කර ඇත",
+		"admin.users.details.verification.status.unverified": "සත්‍යාපනය කර නැත",
+		"admin.users.details.verification.verify": "සත්‍යාපනය කරන්න",
+		"admin.users.details.verification.sent": "සත්‍යාපන සබැඳිය {destination} වෙත යවන ලදී.",
+		"admin.users.details.verification.sent_generic": "සත්‍යාපන සබැඳිය යවන ලදී.",
+		"admin.users.details.verification.error": "සත්‍යාපන සබැඳිය යැවිය නොහැකි විය. නැවත උත්සාහ කරන්න.",
+		"admin.users.details.verification.load_error": "සත්‍යාපන සැකසුම් පූරණය කළ නොහැකි විය.",
 		"admin.groups.list.title": "කණ්ඩායම්",
 		"admin.groups.list.columns.name": "නම",
 		"admin.groups.list.columns.description": "විස්තරය",
@@ -19338,6 +19560,7 @@ exports.getUserOverlayRules = getUserOverlayRules_default;
 exports.getUserSharingPolicies = getUserSharingPolicies_default;
 exports.getUserSharingPolicy = getUserSharingPolicy_default;
 exports.getUserType = getUserType_default;
+exports.getUserTypeByHandle = getUserTypeByHandle;
 exports.getUserTypes = getUserTypes_default;
 exports.getUserUsages = getUserUsages_default;
 exports.getUsers = getUsers_default;
@@ -19348,15 +19571,18 @@ exports.getVariable = getVariable_default;
 exports.getVariables = getVariables_default;
 exports.getVendorPrefix = getVendorPrefix_default;
 exports.getVerifiedAttributes = getVerifiedAttributes_default;
+exports.hasAdminVerificationStatus = hasAdminVerificationStatus;
 exports.hasPermission = hasPermission_default;
 exports.hasUnresolvedTranslationParams = hasUnresolvedTranslationParams;
 exports.importConfiguration = importConfiguration_default;
 exports.info = info;
+exports.isAdminVerifiableAttribute = isAdminVerifiableAttribute_default;
 exports.isAdvancingPageOffset = isAdvancingPageOffset_default;
 exports.isApplicationSubmissionValid = isApplicationSubmissionValid_default;
 exports.isEmojiUri = isEmojiUri_default;
 exports.isEmpty = isEmpty_default;
 exports.isFlowExpiredError = isFlowExpiredError_default;
+exports.isFlowMetaUnavailableError = isFlowMetaUnavailableError_default;
 exports.isRecognizedBaseUrlPattern = isRecognizedBaseUrlPattern_default;
 exports.isRetryableError = isRetryableError_default;
 exports.isSharingPolicyFormValid = isSharingPolicyFormValid;
@@ -19408,6 +19634,7 @@ exports.restoreFlowVersion = restoreFlowVersion_default;
 exports.revertGatewayConfiguration = revertGatewayConfiguration_default;
 exports.runAccountLifecycleAction = runAccountLifecycleAction_default;
 exports.runAdministrationFlow = runAdministrationFlow_default;
+exports.sendUserAttributeVerification = sendUserAttributeVerification_default;
 exports.set = set_default;
 exports.setTranslation = setTranslation_default;
 exports.setTranslations = setTranslations_default;

package/dist/constants/AdministrationConstants.d.ts

@@ -12,10 +12,12 @@ declare const AdministrationModes: {
 };
 /**
  * Keys of the `flow` server-config section that name the administration flow for each operation. An
- * unset key is the opt-out: the operation calls the management API directly.
+ * unset key is the opt-out: the operation calls the management API directly. `adminAttributeVerificationFlow`
+ * names an administrator-initiated flow, started by its handle, and has no such fallback.
  */
 export declare const AdministrationFlowConfigKey: {
     ACTION_DELETION: 'actionDeletionFlow';
+    ADMIN_ATTRIBUTE_VERIFICATION: 'adminAttributeVerificationFlow';
     AGENT_SUSPEND: 'agentSuspendFlow';
     AGENT_UNLOCK: 'agentUnlockFlow';
     AGENT_UNSUSPEND: 'agentUnsuspendFlow';

package/dist/constants/AdministrationConstants.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"AdministrationConstants.d.ts","sourceRoot":"","sources":["../../src/constants/AdministrationConstants.ts"],"names":[],"mappings":"AAGA;;;;;;;GAOG;AACH,QAAA,MAAM,mBAAmB,EAAE;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,QAAQ,CAAC;CAIlB,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,2BAA2B,EAAE;IACxC,eAAe,EAAE,oBAAoB,CAAC;IACtC,aAAa,EAAE,kBAAkB,CAAC;IAClC,YAAY,EAAE,iBAAiB,CAAC;IAChC,eAAe,EAAE,oBAAoB,CAAC;IACtC,oBAAoB,EAAE,yBAAyB,CAAC;IAChD,mBAAmB,EAAE,wBAAwB,CAAC;IAC9C,qBAAqB,EAAE,0BAA0B,CAAC;IAClD,cAAc,EAAE,mBAAmB,CAAC;IACpC,wBAAwB,EAAE,4BAA4B,CAAC;IACvD,uBAAuB,EAAE,2BAA2B,CAAC;IACrD,aAAa,EAAE,kBAAkB,CAAC;IAClC,uBAAuB,EAAE,2BAA2B,CAAC;IACrD,mBAAmB,EAAE,wBAAwB,CAAC;IAC9C,aAAa,EAAE,kBAAkB,CAAC;IAClC,YAAY,EAAE,iBAAiB,CAAC;IAChC,WAAW,EAAE,gBAAgB,CAAC;IAC9B,cAAc,EAAE,mBAAmB,CAAC;CAmBrC,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,6BAA6B,EAAE;IAC1C,KAAK,EAAE;QAAC,OAAO,EAAE,kBAAkB,CAAC;QAAC,MAAM,EAAE,iBAAiB,CAAC;QAAC,SAAS,EAAE,oBAAoB,CAAA;KAAC,CAAC;IACjG,WAAW,EAAE;QAAC,OAAO,EAAE,wBAAwB,CAAC;QAAC,SAAS,EAAE,0BAA0B,CAAA;KAAC,CAAC;IACxF,IAAI,EAAE;QAAC,OAAO,EAAE,iBAAiB,CAAC;QAAC,MAAM,EAAE,gBAAgB,CAAC;QAAC,SAAS,EAAE,mBAAmB,CAAA;KAAC,CAAC;CAgB9F,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,uBAAuB,EAAE;IACpC,MAAM,EAAE,gBAAgB,CAAC;IACzB,WAAW,EAAE,qBAAqB,CAAC;IACnC,QAAQ,EAAE,kBAAkB,CAAC;IAC7B,KAAK,EAAE,eAAe,CAAC;IACvB,MAAM,EAAE,gBAAgB,CAAC;IACzB,aAAa,EAAE,cAAc,CAAC;IAC9B,WAAW,EAAE,mBAAmB,CAAC;IACjC,QAAQ,EAAE,kBAAkB,CAAC;IAC7B,eAAe,EAAE,wBAAwB,CAAC;IAC1C,IAAI,EAAE,cAAc,CAAC;IACrB,OAAO,EAAE,SAAS,CAAC;CAapB,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,sBAAsB,EAAE;IACnC,aAAa,EAAE,cAAc,CAAC;IAC9B,UAAU,EAAE,WAAW,CAAC;CAIzB,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,wBAAwB,mBAAmB,CAAC;AAEzD,eAAe,mBAAmB,CAAC"}
+{"version":3,"file":"AdministrationConstants.d.ts","sourceRoot":"","sources":["../../src/constants/AdministrationConstants.ts"],"names":[],"mappings":"AAGA;;;;;;;GAOG;AACH,QAAA,MAAM,mBAAmB,EAAE;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,QAAQ,CAAC;CAIlB,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,2BAA2B,EAAE;IACxC,eAAe,EAAE,oBAAoB,CAAC;IACtC,4BAA4B,EAAE,gCAAgC,CAAC;IAC/D,aAAa,EAAE,kBAAkB,CAAC;IAClC,YAAY,EAAE,iBAAiB,CAAC;IAChC,eAAe,EAAE,oBAAoB,CAAC;IACtC,oBAAoB,EAAE,yBAAyB,CAAC;IAChD,mBAAmB,EAAE,wBAAwB,CAAC;IAC9C,qBAAqB,EAAE,0BAA0B,CAAC;IAClD,cAAc,EAAE,mBAAmB,CAAC;IACpC,wBAAwB,EAAE,4BAA4B,CAAC;IACvD,uBAAuB,EAAE,2BAA2B,CAAC;IACrD,aAAa,EAAE,kBAAkB,CAAC;IAClC,uBAAuB,EAAE,2BAA2B,CAAC;IACrD,mBAAmB,EAAE,wBAAwB,CAAC;IAC9C,aAAa,EAAE,kBAAkB,CAAC;IAClC,YAAY,EAAE,iBAAiB,CAAC;IAChC,WAAW,EAAE,gBAAgB,CAAC;IAC9B,cAAc,EAAE,mBAAmB,CAAC;CAoBrC,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,6BAA6B,EAAE;IAC1C,KAAK,EAAE;QAAC,OAAO,EAAE,kBAAkB,CAAC;QAAC,MAAM,EAAE,iBAAiB,CAAC;QAAC,SAAS,EAAE,oBAAoB,CAAA;KAAC,CAAC;IACjG,WAAW,EAAE;QAAC,OAAO,EAAE,wBAAwB,CAAC;QAAC,SAAS,EAAE,0BAA0B,CAAA;KAAC,CAAC;IACxF,IAAI,EAAE;QAAC,OAAO,EAAE,iBAAiB,CAAC;QAAC,MAAM,EAAE,gBAAgB,CAAC;QAAC,SAAS,EAAE,mBAAmB,CAAA;KAAC,CAAC;CAgB9F,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,uBAAuB,EAAE;IACpC,MAAM,EAAE,gBAAgB,CAAC;IACzB,WAAW,EAAE,qBAAqB,CAAC;IACnC,QAAQ,EAAE,kBAAkB,CAAC;IAC7B,KAAK,EAAE,eAAe,CAAC;IACvB,MAAM,EAAE,gBAAgB,CAAC;IACzB,aAAa,EAAE,cAAc,CAAC;IAC9B,WAAW,EAAE,mBAAmB,CAAC;IACjC,QAAQ,EAAE,kBAAkB,CAAC;IAC7B,eAAe,EAAE,wBAAwB,CAAC;IAC1C,IAAI,EAAE,cAAc,CAAC;IACrB,OAAO,EAAE,SAAS,CAAC;CAapB,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,sBAAsB,EAAE;IACnC,aAAa,EAAE,cAAc,CAAC;IAC9B,UAAU,EAAE,WAAW,CAAC;CAIzB,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,wBAAwB,mBAAmB,CAAC;AAEzD,eAAe,mBAAmB,CAAC"}

package/dist/constants/AttributeVerificationConstants.d.ts

@@ -1,13 +1,16 @@
 /**
- * Wire names and eligibility rules for self user attribute verification.
+ * Wire names and eligibility rules for user attribute verification, by the user or by an administrator.
  */
 declare const AttributeVerificationConstants: {
+    ADMIN_VERIFIABLE_ATTRIBUTES: readonly string[];
     ATTRIBUTE_INPUT: string;
+    CHANNEL_KEY: string;
     DEFAULT_FLOW_HANDLE: string;
+    EMAIL_SENT_KEY: string;
     MASKED_DESTINATION_KEY: string;
+    SUBJECT_INPUT: string;
     VERIFIABLE_ATTRIBUTE_TYPES: readonly string[];
     VERIFIED_ATTRIBUTES_KEY: string;
-    VERIFY_AFTER_SAVE_ATTRIBUTE_TYPES: readonly string[];
 };
 export default AttributeVerificationConstants;
 //# sourceMappingURL=AttributeVerificationConstants.d.ts.map

package/dist/constants/AttributeVerificationConstants.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"AttributeVerificationConstants.d.ts","sourceRoot":"","sources":["../../src/constants/AttributeVerificationConstants.ts"],"names":[],"mappings":"AAGA;;GAEG;AACH,QAAA,MAAM,8BAA8B,EAAE;IACpC,eAAe,EAAE,MAAM,CAAC;IACxB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,sBAAsB,EAAE,MAAM,CAAC;IAC/B,0BAA0B,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9C,uBAAuB,EAAE,MAAM,CAAC;IAChC,iCAAiC,EAAE,SAAS,MAAM,EAAE,CAAC;CA2BtD,CAAC;AAEF,eAAe,8BAA8B,CAAC"}
+{"version":3,"file":"AttributeVerificationConstants.d.ts","sourceRoot":"","sources":["../../src/constants/AttributeVerificationConstants.ts"],"names":[],"mappings":"AAGA;;GAEG;AACH,QAAA,MAAM,8BAA8B,EAAE;IACpC,2BAA2B,EAAE,SAAS,MAAM,EAAE,CAAC;IAC/C,eAAe,EAAE,MAAM,CAAC;IACxB,WAAW,EAAE,MAAM,CAAC;IACpB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,cAAc,EAAE,MAAM,CAAC;IACvB,sBAAsB,EAAE,MAAM,CAAC;IAC/B,aAAa,EAAE,MAAM,CAAC;IACtB,0BAA0B,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9C,uBAAuB,EAAE,MAAM,CAAC;CAsCjC,CAAC;AAEF,eAAe,8BAA8B,CAAC"}