@thunderid/javascript 1.4.0 → 1.5.0

package/dist/DefaultCrypto.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"DefaultCrypto.d.ts","sourceRoot":"","sources":["../src/DefaultCrypto.ts"],"names":[],"mappings":"AAIA,OAAO,EAAC,MAAM,EAAE,YAAY,EAAC,MAAM,iBAAiB,CAAC;AAErD;;;GAGG;AACH,qBAAa,aAAc,YAAW,MAAM,CAAC,UAAU,CAAC;IAC/C,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM;IAKtC,eAAe,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM;IAI1C,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,UAAU;IAIzC,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IAQ7C,SAAS,CACpB,OAAO,EAAE,MAAM,EACf,GAAG,EAAE,YAAY,EACjB,UAAU,EAAE,MAAM,EAAE,EACpB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,MAAM,EACf,cAAc,CAAC,EAAE,MAAM,EACvB,iBAAiB,UAAO,GACvB,OAAO,CAAC,OAAO,CAAC;CAapB"}
+{"version":3,"file":"DefaultCrypto.d.ts","sourceRoot":"","sources":["../src/DefaultCrypto.ts"],"names":[],"mappings":"AAQA,OAAO,EAAC,MAAM,EAAE,YAAY,EAAC,MAAM,iBAAiB,CAAC;AAErD;;;GAGG;AACH,qBAAa,aAAc,YAAW,MAAM,CAAC,UAAU,CAAC;IAC/C,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM;IAKtC,eAAe,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM;IAI1C,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,UAAU;IAIzC,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IAQ7C,SAAS,CACpB,OAAO,EAAE,MAAM,EACf,GAAG,EAAE,YAAY,EACjB,UAAU,EAAE,MAAM,EAAE,EACpB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,MAAM,EACf,cAAc,CAAC,EAAE,MAAM,EACvB,iBAAiB,UAAO,GACvB,OAAO,CAAC,OAAO,CAAC;CAapB"}

package/dist/IsomorphicCrypto.d.ts

@@ -8,6 +8,14 @@ export declare class IsomorphicCrypto<T = any> {
      * @returns code verifier.
      */
     getCodeVerifier(): string;
+    /**
+     * Generates the random part of an authorization request `state` from 32 random bytes. Only
+     * letters and digits are kept, so the value never contains the `_` that separates the parts of
+     * the state.
+     *
+     * @returns A random string of about 42 characters.
+     */
+    generateState(): string;
     /**
      * Derive code challenge from the code verifier.
      *

package/dist/IsomorphicCrypto.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"IsomorphicCrypto.d.ts","sourceRoot":"","sources":["../src/IsomorphicCrypto.ts"],"names":[],"mappings":"AAKA,OAAO,EAAC,MAAM,EAAE,YAAY,EAAC,MAAM,iBAAiB,CAAC;AAErD,qBAAa,gBAAgB,CAAC,CAAC,GAAG,GAAG;IACnC,OAAO,CAAC,WAAW,CAAY;gBAEZ,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC;IAIzC;;;;OAIG;IACI,eAAe,IAAI,MAAM;IAIhC;;;;;;OAMG;IACU,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAKhE;;;;;;;;;OASG;IAEI,mBAAmB,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,YAAY;IAoBjF;;;;;;;;;;;;;OAaG;IACI,cAAc,CACnB,OAAO,EAAE,MAAM,EACf,GAAG,EAAE,YAAY,EACjB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,cAAc,EAAE,MAAM,GAAG,SAAS,EAClC,iBAAiB,EAAE,OAAO,GAAG,SAAS,GACrC,OAAO,CAAC,OAAO,CAAC;IA4BnB;;;;;;;;;;;;OAYG;IACU,0BAA0B,CACrC,WAAW,EAAE,MAAM,EACnB,GAAG,EAAE,YAAY,EACjB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,MAAM,GAAG,SAAS,EAC3B,cAAc,EAAE,MAAM,GACrB,OAAO,CAAC,IAAI,CAAC;IA2BhB;;OAEG;IACI,eAAe,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,KAAK,EAAE,MAAM,GAAG,CAAC;IAY9D,cAAc,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,KAAK,EAAE,MAAM,GAAG,CAAC;CAUrE"}
+{"version":3,"file":"IsomorphicCrypto.d.ts","sourceRoot":"","sources":["../src/IsomorphicCrypto.ts"],"names":[],"mappings":"AAKA,OAAO,EAAC,MAAM,EAAE,YAAY,EAAC,MAAM,iBAAiB,CAAC;AAErD,qBAAa,gBAAgB,CAAC,CAAC,GAAG,GAAG;IACnC,OAAO,CAAC,WAAW,CAAY;gBAEZ,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC;IAIzC;;;;OAIG;IACI,eAAe,IAAI,MAAM;IAIhC;;;;;;OAMG;IACI,aAAa,IAAI,MAAM;IAI9B;;;;;;OAMG;IACU,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAKhE;;;;;;;;;OASG;IAEI,mBAAmB,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,YAAY;IAoBjF;;;;;;;;;;;;;OAaG;IACI,cAAc,CACnB,OAAO,EAAE,MAAM,EACf,GAAG,EAAE,YAAY,EACjB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,cAAc,EAAE,MAAM,GAAG,SAAS,EAClC,iBAAiB,EAAE,OAAO,GAAG,SAAS,GACrC,OAAO,CAAC,OAAO,CAAC;IA4BnB;;;;;;;;;;;;OAYG;IACU,0BAA0B,CACrC,WAAW,EAAE,MAAM,EACnB,GAAG,EAAE,YAAY,EACjB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,MAAM,GAAG,SAAS,EAC3B,cAAc,EAAE,MAAM,GACrB,OAAO,CAAC,IAAI,CAAC;IA2BhB;;OAEG;IACI,eAAe,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,KAAK,EAAE,MAAM,GAAG,CAAC;IAY9D,cAAc,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,KAAK,EAAE,MAAM,GAAG,CAAC;CAUrE"}

package/dist/StorageManager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"StorageManager.d.ts","sourceRoot":"","sources":["../src/StorageManager.ts"],"names":[],"mappings":"AAGA,OAAO,EAAC,gBAAgB,EAAC,MAAM,iBAAiB,CAAC;AACjD,OAAO,EAAC,wBAAwB,EAAC,MAAM,yBAAyB,CAAC;AACjE,OAAO,EAAC,WAAW,EAAC,MAAM,kBAAkB,CAAC;AAC7C,OAAO,EAAC,MAAM,EAAE,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,mBAAmB,EAAC,MAAM,gBAAgB,CAAC;AAIjG,KAAK,WAAW,CAAC,CAAC,IAAI,OAAO,CAC3B,gBAAgB,CAAC,CAAC,CAAC,GAAG,wBAAwB,GAAG,WAAW,GAAG,cAAc,GAAG,WAAW,CAC5F,CAAC;AAEF,cAAM,cAAc,CAAC,CAAC;IACpB,SAAS,CAAC,EAAE,EAAE,MAAM,CAAC;IAErB,SAAS,CAAC,KAAK,EAAE,OAAO,CAAC;IAEzB,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC;gBAEN,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,GAAE,MAAsC;cAMrF,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;cAU/D,QAAQ,CACtB,GAAG,EAAE,MAAM,EACX,SAAS,EAAE,MAAM,gBAAgB,CAAC,CAAC,CAAC,GAAG,MAAM,wBAAwB,GAAG,MAAM,WAAW,GAAG,MAAM,cAAc,EAChH,KAAK,EAAE,mBAAmB,GACzB,OAAO,CAAC,IAAI,CAAC;cAUA,WAAW,CACzB,GAAG,EAAE,MAAM,EACX,SAAS,EAAE,MAAM,gBAAgB,CAAC,CAAC,CAAC,GAAG,MAAM,wBAAwB,GAAG,MAAM,WAAW,GAAG,MAAM,cAAc,GAC/G,OAAO,CAAC,IAAI,CAAC;IAahB,SAAS,CAAC,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,MAAM;IAa1F,SAAS,CAAC,MAAM,CAAC,uBAAuB,IAAI,OAAO;IAatC,aAAa,CAAC,MAAM,EAAE,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IAIlE,uBAAuB,CAAC,oBAAoB,EAAE,OAAO,CAAC,wBAAwB,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IAI/F,gBAAgB,CAAC,aAAa,EAAE,OAAO,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIxF,aAAa,CAAC,UAAU,EAAE,OAAO,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAa/E,cAAc,CAAC,WAAW,EAAE,OAAO,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIjF,aAAa,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIrF,aAAa,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC;IAI5D,+BAA+B,IAAI,OAAO,CAAC,wBAAwB,CAAC;IAIpE,gBAAgB,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC;IAgB1D,aAAa,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC;IA4BpD,gBAAgB,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC;IAI1D,gBAAgB,CAAC,aAAa,EAAE,OAAO,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIxF,cAAc,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC;IAI1E,aAAa,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC;IAI1D,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAInE,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI;IAOtC,gBAAgB,IAAI,MAAM;IAM1B,mBAAmB,IAAI,IAAI;IAMrB,gBAAgB,IAAI,OAAO,CAAC,IAAI,CAAC;IAIjC,0BAA0B,IAAI,OAAO,CAAC,IAAI,CAAC;IAI3C,mBAAmB,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAInD,gBAAgB,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAUhD,iBAAiB,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIjD,sBAAsB,CAAC,GAAG,EAAE,MAAM,gBAAgB,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,mBAAmB,CAAC;IAMpF,gCAAgC,CAAC,GAAG,EAAE,MAAM,wBAAwB,GAAG,OAAO,CAAC,mBAAmB,CAAC;IAMnG,yBAAyB,CAAC,GAAG,EAAE,MAAM,cAAc,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC;IAKnG,sBAAsB,CAAC,GAAG,EAAE,MAAM,WAAW,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC;IAa7F,uBAAuB,CAAC,GAAG,EAAE,MAAM,WAAW,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC;IAM9F,sBAAsB,CAAC,GAAG,EAAE,MAAM,gBAAgB,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC;IAIjG,gCAAgC,CAC3C,GAAG,EAAE,MAAM,wBAAwB,EACnC,KAAK,EAAE,mBAAmB,GACzB,OAAO,CAAC,IAAI,CAAC;IAIH,yBAAyB,CACpC,GAAG,EAAE,MAAM,cAAc,EACzB,KAAK,EAAE,mBAAmB,EAC1B,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,IAAI,CAAC;IAIH,sBAAsB,CACjC,GAAG,EAAE,MAAM,WAAW,EACtB,KAAK,EAAE,mBAAmB,EAC1B,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,IAAI,CAAC;IAaH,uBAAuB,CAClC,GAAG,EAAE,MAAM,WAAW,EACtB,KAAK,EAAE,mBAAmB,EAC1B,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,IAAI,CAAC;IAIH,yBAAyB,CAAC,GAAG,EAAE,MAAM,gBAAgB,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IAIxE,mCAAmC,CAAC,GAAG,EAAE,MAAM,wBAAwB,GAAG,OAAO,CAAC,IAAI,CAAC;IAIvF,4BAA4B,CAAC,GAAG,EAAE,MAAM,cAAc,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIvF,yBAAyB,CAAC,GAAG,EAAE,MAAM,WAAW,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAajF,0BAA0B,CAAC,GAAG,EAAE,MAAM,WAAW,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAGhG;AAED,eAAe,cAAc,CAAC"}
+{"version":3,"file":"StorageManager.d.ts","sourceRoot":"","sources":["../src/StorageManager.ts"],"names":[],"mappings":"AAGA,OAAO,EAAC,gBAAgB,EAAC,MAAM,iBAAiB,CAAC;AACjD,OAAO,EAAC,wBAAwB,EAAC,MAAM,yBAAyB,CAAC;AACjE,OAAO,EAAC,WAAW,EAAC,MAAM,kBAAkB,CAAC;AAC7C,OAAO,EAAC,MAAM,EAAE,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,mBAAmB,EAAC,MAAM,gBAAgB,CAAC;AAIjG,KAAK,WAAW,CAAC,CAAC,IAAI,OAAO,CAC3B,gBAAgB,CAAC,CAAC,CAAC,GAAG,wBAAwB,GAAG,WAAW,GAAG,cAAc,GAAG,WAAW,CAC5F,CAAC;AAEF,cAAM,cAAc,CAAC,CAAC;IACpB,SAAS,CAAC,EAAE,EAAE,MAAM,CAAC;IAErB,SAAS,CAAC,KAAK,EAAE,OAAO,CAAC;IAEzB,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC;gBAEN,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,GAAE,MAAsC;cAMrF,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;cAU/D,QAAQ,CACtB,GAAG,EAAE,MAAM,EACX,SAAS,EAAE,MAAM,gBAAgB,CAAC,CAAC,CAAC,GAAG,MAAM,wBAAwB,GAAG,MAAM,WAAW,GAAG,MAAM,cAAc,EAChH,KAAK,EAAE,mBAAmB,GACzB,OAAO,CAAC,IAAI,CAAC;cAUA,WAAW,CACzB,GAAG,EAAE,MAAM,EACX,SAAS,EAAE,MAAM,gBAAgB,CAAC,CAAC,CAAC,GAAG,MAAM,wBAAwB,GAAG,MAAM,WAAW,GAAG,MAAM,cAAc,GAC/G,OAAO,CAAC,IAAI,CAAC;IAahB,SAAS,CAAC,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,MAAM;IAa1F,SAAS,CAAC,MAAM,CAAC,uBAAuB,IAAI,OAAO;IAmBtC,aAAa,CAAC,MAAM,EAAE,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IAIlE,uBAAuB,CAAC,oBAAoB,EAAE,OAAO,CAAC,wBAAwB,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IAI/F,gBAAgB,CAAC,aAAa,EAAE,OAAO,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIxF,aAAa,CAAC,UAAU,EAAE,OAAO,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAa/E,cAAc,CAAC,WAAW,EAAE,OAAO,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIjF,aAAa,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIrF,aAAa,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC;IAI5D,+BAA+B,IAAI,OAAO,CAAC,wBAAwB,CAAC;IAIpE,gBAAgB,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC;IAgB1D,aAAa,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC;IA4BpD,gBAAgB,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC;IAI1D,gBAAgB,CAAC,aAAa,EAAE,OAAO,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIxF,cAAc,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC;IAI1E,aAAa,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC;IAI1D,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAInE,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI;IAOtC,gBAAgB,IAAI,MAAM;IAM1B,mBAAmB,IAAI,IAAI;IAMrB,gBAAgB,IAAI,OAAO,CAAC,IAAI,CAAC;IAIjC,0BAA0B,IAAI,OAAO,CAAC,IAAI,CAAC;IAI3C,mBAAmB,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAInD,gBAAgB,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAUhD,iBAAiB,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIjD,sBAAsB,CAAC,GAAG,EAAE,MAAM,gBAAgB,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,mBAAmB,CAAC;IAMpF,gCAAgC,CAAC,GAAG,EAAE,MAAM,wBAAwB,GAAG,OAAO,CAAC,mBAAmB,CAAC;IAMnG,yBAAyB,CAAC,GAAG,EAAE,MAAM,cAAc,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC;IAKnG,sBAAsB,CAAC,GAAG,EAAE,MAAM,WAAW,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC;IAa7F,uBAAuB,CAAC,GAAG,EAAE,MAAM,WAAW,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC;IAM9F,sBAAsB,CAAC,GAAG,EAAE,MAAM,gBAAgB,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC;IAIjG,gCAAgC,CAC3C,GAAG,EAAE,MAAM,wBAAwB,EACnC,KAAK,EAAE,mBAAmB,GACzB,OAAO,CAAC,IAAI,CAAC;IAIH,yBAAyB,CACpC,GAAG,EAAE,MAAM,cAAc,EACzB,KAAK,EAAE,mBAAmB,EAC1B,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,IAAI,CAAC;IAIH,sBAAsB,CACjC,GAAG,EAAE,MAAM,WAAW,EACtB,KAAK,EAAE,mBAAmB,EAC1B,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,IAAI,CAAC;IAaH,uBAAuB,CAClC,GAAG,EAAE,MAAM,WAAW,EACtB,KAAK,EAAE,mBAAmB,EAC1B,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,IAAI,CAAC;IAIH,yBAAyB,CAAC,GAAG,EAAE,MAAM,gBAAgB,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IAIxE,mCAAmC,CAAC,GAAG,EAAE,MAAM,wBAAwB,GAAG,OAAO,CAAC,IAAI,CAAC;IAIvF,4BAA4B,CAAC,GAAG,EAAE,MAAM,cAAc,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIvF,yBAAyB,CAAC,GAAG,EAAE,MAAM,WAAW,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAajF,0BAA0B,CAAC,GAAG,EAAE,MAAM,WAAW,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAGhG;AAED,eAAe,cAAc,CAAC"}

package/dist/ThunderIDJavaScriptClient.d.ts

@@ -26,7 +26,13 @@ declare class ThunderIDJavaScriptClient<T = Config> implements ThunderIDClient<T
     constructor(storage?: Storage, cryptoUtils?: Crypto);
     initialize(config: T, storage?: Storage): Promise<boolean>;
     reInitialize(config: Partial<T>): Promise<boolean>;
-    getConfiguration(): T;
+    getConfiguration(): Promise<T>;
+    /**
+     * Returns the signed-in user, read from the claims of the session's ID token.
+     *
+     * @param userId - The session to read, on a server.
+     * @throws {ThunderIDRuntimeError} With code `JS-AUTH_CORE-GU-NF01` when the session holds no ID token.
+     */
     getUser(userId?: string): Promise<User>;
     isSignedIn(userId?: string): Promise<boolean>;
     getAccessToken(sessionId?: string): Promise<string>;
@@ -60,8 +66,20 @@ declare class ThunderIDJavaScriptClient<T = Config> implements ThunderIDClient<T
         params: Record<string, unknown>;
     }): Promise<TokenResponse>;
     protected getSignOutUrl(userId?: string): Promise<string>;
+    /**
+     * Returns the endpoints the SDK calls. Loads the discovery document first when no other call has.
+     */
     protected getOpenIDProviderEndpoints(): Promise<Partial<OIDCEndpoints>>;
+    /**
+     * Returns the discovery document. Loads it first when no other call has. Resolves to `null`
+     * before `initialize()`.
+     */
     getDiscoveryResponse(): Promise<OIDCDiscoveryApiResponse | null>;
+    /**
+     * Returns the claims of the session's ID token, or of `idToken` when the session holds none.
+     *
+     * @throws {ThunderIDRuntimeError} With code `JS-AUTH_CORE-GDIT-NF01` when there is no ID token to decode.
+     */
     protected getDecodedIdToken(userId?: string, idToken?: string): Promise<IdToken>;
     protected getIdToken(userId?: string): Promise<string>;
     protected getUserSession(userId?: string): Promise<UserSession>;

package/dist/ThunderIDJavaScriptClient.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ThunderIDJavaScriptClient.d.ts","sourceRoot":"","sources":["../src/ThunderIDJavaScriptClient.ts"],"names":[],"mappings":"AAYA,OAAO,EAAC,gBAAgB,EAAC,MAAM,oBAAoB,CAAC;AACpD,OAAO,EAAC,WAAW,EAAC,MAAM,gBAAgB,CAAC;AAE3C,OAAO,KAAK,EAAC,mBAAmB,EAAE,oBAAoB,EAAE,eAAe,EAAC,MAAM,eAAe,CAAC;AAC9F,OAAO,EAAC,eAAe,EAAC,MAAM,iBAAiB,CAAC;AAChD,OAAO,EAAmB,MAAM,EAAE,aAAa,EAAE,cAAc,EAAE,aAAa,EAAC,MAAM,iBAAiB,CAAC;AACvG,OAAO,EAAC,MAAM,EAAC,MAAM,iBAAiB,CAAC;AACvC,OAAO,EAAC,iCAAiC,EAAC,MAAM,wBAAwB,CAAC;AACzE,OAAO,EAAC,wBAAwB,EAAC,MAAM,yBAAyB,CAAC;AACjE,OAAO,EAAC,aAAa,EAAC,MAAM,yBAAyB,CAAC;AACtD,OAAO,EAAC,iBAAiB,EAAC,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAc,WAAW,EAAC,MAAM,kBAAkB,CAAC;AAC1D,OAAO,EAAC,OAAO,EAAiB,MAAM,gBAAgB,CAAC;AACvD,OAAO,EAAyB,OAAO,EAAE,0BAA0B,EAAE,aAAa,EAAC,MAAM,gBAAgB,CAAC;AAC1G,OAAO,EAAC,IAAI,EAAE,WAAW,EAAC,MAAM,eAAe,CAAC;AAChD,OAAO,cAAc,MAAM,kBAAkB,CAAC;AA2B9C,cAAM,yBAAyB,CAAC,CAAC,GAAG,MAAM,CAAE,YAAW,eAAe,CAAC,CAAC,CAAC;IACvE,SAAS,CAAC,cAAc,EAAG,cAAc,CAAC,CAAC,CAAC,CAAC;IAE7C,SAAS,CAAC,WAAW,EAAE,MAAM,CAAC;IAE9B,OAAO,CAAC,cAAc,CAAsC;IAE5D,OAAO,CAAC,4BAA4B,CAA2C;IAE/E,OAAO,CAAC,UAAU,CAA2B;IAE7C,OAAO,CAAC,YAAY,CAAoB;IAExC,OAAO,CAAC,eAAe,CAAK;IAE5B,OAAO,CAAC,UAAU,CAAU;IAE5B,OAAO,CAAC,OAAO,CAAM;gBAET,OAAO,CAAC,EAAE,OAAO,EAAE,WAAW,CAAC,EAAE,MAAM;IAOtC,UAAU,CAAC,MAAM,EAAE,CAAC,EAAE,OAAO,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IA8C1D,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC;IAUxD,gBAAgB,IAAI,CAAC;IAIf,OAAO,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAavC,UAAU,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAoB7C,cAAc,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAkBhE,OAAO,CAAC,uBAAuB;IAYxB,YAAY,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI;IAI7C;;;;OAIG;IACH,SAAS,CAAC,iBAAiB,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIjD,UAAU,CAAC,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAInF,cAAc,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC;IAInF;;;OAGG;cACa,mBAAmB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAOvE,aAAa,CACxB,MAAM,EAAE,0BAA0B,EAClC,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,aAAa,GAAG,QAAQ,GAAG,IAAI,CAAC;IAqFpC,SAAS,IAAI,OAAO;IAIpB,MAAM,CAAC,QAAQ,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,GAAG,aAAa,GAAG,SAAS,CAAC;IAI3E,OAAO,CACZ,QAAQ,CAAC,EAAE,cAAc,EACzB,wBAAwB,CAAC,EAAE,MAAM,GAAG,CAAC,CAAC,eAAe,EAAE,MAAM,KAAK,IAAI,CAAC,EACvE,aAAa,CAAC,EAAE,CAAC,eAAe,EAAE,MAAM,KAAK,IAAI,GAChD,OAAO,CAAC,MAAM,GAAG,OAAO,CAAC;IAIrB,cAAc,CAAC,QAAQ,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,GAAG,OAAO,GAAG,SAAS,CAAC;IAI7E,MAAM,CAAC,QAAQ,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC;IAI/C,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IAIxB,cAAc,CAAC,QAAQ,CAAC,EAAE,GAAG,GAAG,OAAO,CAAC,WAAW,CAAC;IAIpD,iBAAiB,CAAC,QAAQ,EAAE,GAAG,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;cAMxD,+BAA+B,CAAC,SAAS,UAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;cAiHjE,YAAY,CAAC,aAAa,CAAC,EAAE,iCAAiC,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;cAwEjG,kBAAkB,CAChC,iBAAiB,EAAE,MAAM,EACzB,KAAK,EAAE,MAAM,EACb,MAAM,CAAC,EAAE,MAAM,EACf,kBAAkB,CAAC,EAAE;QAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAC,GACrD,OAAO,CAAC,aAAa,CAAC;cAwFT,aAAa,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;cA4C/C,0BAA0B,IAAI,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IAgBhE,oBAAoB,IAAI,OAAO,CAAC,wBAAwB,GAAG,IAAI,CAAC;cAQ7D,iBAAiB,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;cAMtE,UAAU,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;cAI5C,cAAc,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC;cAQrD,kBAAkB,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC;IA2DlF;;;;OAIG;cACa,6BAA6B,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC;IAgGzF;;;;OAIG;cACa,4BAA4B,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC;cAmDhE,iBAAiB,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,OAAO,CAAC;IAQlE,YAAY,CAAC,OAAO,EAAE,mBAAmB,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAmIzE,QAAQ,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,eAAe,GAAG,OAAO,CAAC,aAAa,CAAC;cAkH7F,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;cAI5D,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIjF,aAAa,IAAI,MAAM;IAI9B,SAAS,CAAC,iBAAiB,IAAI,cAAc,CAAC,CAAC,CAAC;IAIhD,SAAS,CAAC,eAAe,IAAI,gBAAgB;WAM/B,mBAAmB,CAAC,eAAe,EAAE,MAAM,GAAG,OAAO;WAQrD,cAAc,CAAC,eAAe,EAAE,MAAM,GAAG,OAAO;IAUjD,eAAe,CAAC,WAAW,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC;CASxE;AAED,eAAe,yBAAyB,CAAC"}
+{"version":3,"file":"ThunderIDJavaScriptClient.d.ts","sourceRoot":"","sources":["../src/ThunderIDJavaScriptClient.ts"],"names":[],"mappings":"AAaA,OAAO,EAAC,gBAAgB,EAAC,MAAM,oBAAoB,CAAC;AACpD,OAAO,EAAC,WAAW,EAAC,MAAM,gBAAgB,CAAC;AAE3C,OAAO,KAAK,EAAC,mBAAmB,EAAE,oBAAoB,EAAE,eAAe,EAAC,MAAM,eAAe,CAAC;AAC9F,OAAO,EAAC,eAAe,EAAC,MAAM,iBAAiB,CAAC;AAChD,OAAO,EAAmB,MAAM,EAAE,aAAa,EAAE,cAAc,EAAE,aAAa,EAAC,MAAM,iBAAiB,CAAC;AACvG,OAAO,EAAC,MAAM,EAAC,MAAM,iBAAiB,CAAC;AACvC,OAAO,EAAC,iCAAiC,EAAC,MAAM,wBAAwB,CAAC;AACzE,OAAO,EAAC,wBAAwB,EAAC,MAAM,yBAAyB,CAAC;AACjE,OAAO,EAAC,aAAa,EAAC,MAAM,yBAAyB,CAAC;AACtD,OAAO,EAAC,iBAAiB,EAAC,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAc,WAAW,EAAC,MAAM,kBAAkB,CAAC;AAC1D,OAAO,EAAC,OAAO,EAAiB,MAAM,gBAAgB,CAAC;AACvD,OAAO,EAAyB,OAAO,EAAE,0BAA0B,EAAE,aAAa,EAAC,MAAM,gBAAgB,CAAC;AAC1G,OAAO,EAAC,IAAI,EAAE,WAAW,EAAC,MAAM,eAAe,CAAC;AAChD,OAAO,cAAc,MAAM,kBAAkB,CAAC;AAwE9C,cAAM,yBAAyB,CAAC,CAAC,GAAG,MAAM,CAAE,YAAW,eAAe,CAAC,CAAC,CAAC;IACvE,SAAS,CAAC,cAAc,EAAG,cAAc,CAAC,CAAC,CAAC,CAAC;IAE7C,SAAS,CAAC,WAAW,EAAE,MAAM,CAAC;IAE9B,OAAO,CAAC,cAAc,CAAsC;IAE5D,OAAO,CAAC,4BAA4B,CAA2C;IAE/E,OAAO,CAAC,UAAU,CAA2B;IAE7C,OAAO,CAAC,YAAY,CAAoB;IAExC,OAAO,CAAC,eAAe,CAAK;IAE5B,OAAO,CAAC,UAAU,CAAU;IAE5B,OAAO,CAAC,OAAO,CAAM;gBAET,OAAO,CAAC,EAAE,OAAO,EAAE,WAAW,CAAC,EAAE,MAAM;IAOtC,UAAU,CAAC,MAAM,EAAE,CAAC,EAAE,OAAO,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IA8C1D,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC;IAUlD,gBAAgB,IAAI,OAAO,CAAC,CAAC,CAAC;IAI3C;;;;;OAKG;IACU,OAAO,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAkBvC,UAAU,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAoB7C,cAAc,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAkBhE,OAAO,CAAC,uBAAuB;IAYxB,YAAY,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI;IAI7C;;;;OAIG;IACH,SAAS,CAAC,iBAAiB,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIjD,UAAU,CAAC,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAInF,cAAc,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC;IAInF;;;OAGG;cACa,mBAAmB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAOvE,aAAa,CACxB,MAAM,EAAE,0BAA0B,EAClC,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,aAAa,GAAG,QAAQ,GAAG,IAAI,CAAC;IAqFpC,SAAS,IAAI,OAAO;IAIpB,MAAM,CAAC,QAAQ,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,GAAG,aAAa,GAAG,SAAS,CAAC;IAI3E,OAAO,CACZ,QAAQ,CAAC,EAAE,cAAc,EACzB,wBAAwB,CAAC,EAAE,MAAM,GAAG,CAAC,CAAC,eAAe,EAAE,MAAM,KAAK,IAAI,CAAC,EACvE,aAAa,CAAC,EAAE,CAAC,eAAe,EAAE,MAAM,KAAK,IAAI,GAChD,OAAO,CAAC,MAAM,GAAG,OAAO,CAAC;IAIrB,cAAc,CAAC,QAAQ,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,GAAG,OAAO,GAAG,SAAS,CAAC;IAI7E,MAAM,CAAC,QAAQ,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC;IAI/C,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IAIxB,cAAc,CAAC,QAAQ,CAAC,EAAE,GAAG,GAAG,OAAO,CAAC,WAAW,CAAC;IAIpD,iBAAiB,CAAC,QAAQ,EAAE,GAAG,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;cAMxD,+BAA+B,CAAC,SAAS,UAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;cAyIjE,YAAY,CAAC,aAAa,CAAC,EAAE,iCAAiC,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;cAgFjG,kBAAkB,CAChC,iBAAiB,EAAE,MAAM,EACzB,KAAK,EAAE,MAAM,EACb,MAAM,CAAC,EAAE,MAAM,EACf,kBAAkB,CAAC,EAAE;QAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAC,GACrD,OAAO,CAAC,aAAa,CAAC;cAuGT,aAAa,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IA4C/D;;OAEG;cACa,0BAA0B,IAAI,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IAkB7E;;;OAGG;IACU,oBAAoB,IAAI,OAAO,CAAC,wBAAwB,GAAG,IAAI,CAAC;IAU7E;;;;OAIG;cACa,iBAAiB,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;cAUtE,UAAU,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;cAI5C,cAAc,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC;cAQrD,kBAAkB,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC;IA2DlF;;;;OAIG;cACa,6BAA6B,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC;IAgGzF;;;;OAIG;cACa,4BAA4B,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC;cAmDhE,iBAAiB,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,OAAO,CAAC;IAQlE,YAAY,CAAC,OAAO,EAAE,mBAAmB,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAmIzE,QAAQ,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,eAAe,GAAG,OAAO,CAAC,aAAa,CAAC;cAkH7F,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;cAI5D,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIjF,aAAa,IAAI,MAAM;IAI9B,SAAS,CAAC,iBAAiB,IAAI,cAAc,CAAC,CAAC,CAAC;IAIhD,SAAS,CAAC,eAAe,IAAI,gBAAgB;WAM/B,mBAAmB,CAAC,eAAe,EAAE,MAAM,GAAG,OAAO;WAQrD,cAAc,CAAC,eAAe,EAAE,MAAM,GAAG,OAAO;IAUjD,eAAe,CAAC,WAAW,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC;CASxE;AAED,eAAe,yBAAyB,CAAC"}

package/dist/cjs/index.cjs

@@ -29,8 +29,12 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 }) : target, mod));
 
 //#endregion
-let jose = require("jose");
-jose = __toESM(jose);
+let jose_base64url = require("jose/base64url");
+jose_base64url = __toESM(jose_base64url);
+let jose_key_import = require("jose/key/import");
+jose_key_import = __toESM(jose_key_import);
+let jose_jwt_verify = require("jose/jwt/verify");
+jose_jwt_verify = __toESM(jose_jwt_verify);
 
 //#region src/constants/TokenConstants.ts
 /**
@@ -107,6 +111,16 @@ var IsomorphicCrypto = class {
 		return this.cryptoUtils.base64URLEncode(this.cryptoUtils.generateRandomBytes(32));
 	}
 	/**
+	* Generates the random part of an authorization request `state` from 32 random bytes. Only
+	* letters and digits are kept, so the value never contains the `_` that separates the parts of
+	* the state.
+	*
+	* @returns A random string of about 42 characters.
+	*/
+	generateState() {
+		return this.cryptoUtils.base64URLEncode(this.cryptoUtils.generateRandomBytes(32)).replace(/[^A-Za-z0-9]/g, "");
+	}
+	/**
 	* Derive code challenge from the code verifier.
 	*
 	* @param verifier - Code verifier.
@@ -2245,7 +2259,10 @@ const OIDCRequestConstants = {
 		SIGN_OUT_SUCCESS: "sign_out_success",
 		STATE: "state"
 	},
-	SignIn: { Payload: { DEFAULT_SCOPES: [ScopeConstants_default.OPENID, ScopeConstants_default.PROFILE] } },
+	SignIn: {
+		Payload: { DEFAULT_SCOPES: [ScopeConstants_default.OPENID, ScopeConstants_default.PROFILE] },
+		Storage: { StorageKeys: { STATE: "authorization_state" } }
+	},
 	SignOut: { Storage: { StorageKeys: { SIGN_OUT_URL: "sign_out_url" } } }
 };
 var OIDCRequestConstants_default = OIDCRequestConstants;
@@ -2702,11 +2719,11 @@ var DefaultCacheStore = class {
 */
 var DefaultCrypto = class {
 	base64URLDecode(value) {
-		const decodedArray = jose.base64url.decode(value);
+		const decodedArray = jose_base64url.decode(value);
 		return new TextDecoder().decode(decodedArray);
 	}
 	base64URLEncode(value) {
-		return jose.base64url.encode(value);
+		return jose_base64url.encode(value);
 	}
 	generateRandomBytes(length) {
 		return crypto.getRandomValues(new Uint8Array(length));
@@ -2717,8 +2734,7 @@ var DefaultCrypto = class {
 		return new Uint8Array(hashBuffer);
 	}
 	async verifyJwt(idToken, jwk, algorithms, clientId, issuer, subject, clockTolerance, validateJwtIssuer = true) {
-		const key = await jose.importJWK(jwk);
-		await jose.jwtVerify(idToken, key, {
+		await (0, jose_jwt_verify.jwtVerify)(idToken, await (0, jose_key_import.importJWK)(jwk), {
 			algorithms,
 			audience: [clientId],
 			clockTolerance,
@@ -2805,6 +2821,7 @@ var StorageManager = class StorageManager {
 		return `${store}-${this.id}`;
 	}
 	static isLocalStorageAvailable() {
+		if (typeof window === "undefined") return false;
 		try {
 			const testValue = "__AUTH_SDK_STORAGE_TEST__";
 			localStorage.setItem(testValue, testValue);
@@ -3228,7 +3245,7 @@ var AuthenticationHelper = class {
 	* Maps the config-defined OIDC endpoint overrides to their discovery-metadata form.
 	*
 	* Endpoint names are converted from camelCase to snake_case, and resource-server endpoints
-	* (`RESOURCE_ENDPOINT_KEYS`) are excluded — those are resolved separately via
+	* (`RESOURCE_ENDPOINT_KEYS`) and the backend overrides are excluded — those are resolved separately via
 	* `resolveResourceEndpoint` and must not leak into the OIDC provider metadata.
 	*
 	* @param configData - The resolved auth client config.
@@ -3237,7 +3254,7 @@ var AuthenticationHelper = class {
 	mapConfiguredOidcEndpoints(configData) {
 		const endpoints = {};
 		if (!configData.endpoints) return endpoints;
-		Object.keys(configData.endpoints).filter((endpointName) => !RESOURCE_ENDPOINT_KEYS.includes(endpointName)).forEach((endpointName) => {
+		Object.keys(configData.endpoints).filter((endpointName) => endpointName !== "backend" && !RESOURCE_ENDPOINT_KEYS.includes(endpointName)).forEach((endpointName) => {
 			const snakeCasedName = endpointName.replace(/[A-Z]/g, (letter) => `_${letter.toLowerCase()}`);
 			endpoints[snakeCasedName] = configData.endpoints ? configData.endpoints[endpointName] : "";
 		});
@@ -3444,7 +3461,7 @@ var AuthenticationHelper = class {
 		} else sessionData = await this.storageManager.getSessionData(userId);
 		const scope = processOpenIDScopes_default(configData.scopes);
 		if (typeof text !== "string") return text;
-		return text.replace(TokenExchangeConstants_default.Placeholders.ACCESS_TOKEN, sessionData.access_token).replace(TokenExchangeConstants_default.Placeholders.USERNAME, this.getAuthenticatedUserInfo(sessionData.id_token).username ?? "").replace(TokenExchangeConstants_default.Placeholders.SCOPES, scope).replace(TokenExchangeConstants_default.Placeholders.CLIENT_ID, configData.clientId ?? "").replace(TokenExchangeConstants_default.Placeholders.CLIENT_SECRET, configData.clientSecret ?? "");
+		return text.replace(TokenExchangeConstants_default.Placeholders.ACCESS_TOKEN, () => sessionData?.access_token ?? "").replace(TokenExchangeConstants_default.Placeholders.USERNAME, () => sessionData?.id_token ? this.getAuthenticatedUserInfo(sessionData.id_token).username ?? "" : "").replace(TokenExchangeConstants_default.Placeholders.SCOPES, scope).replace(TokenExchangeConstants_default.Placeholders.CLIENT_ID, configData.clientId ?? "").replace(TokenExchangeConstants_default.Placeholders.CLIENT_SECRET, configData.clientSecret ?? "");
 	}
 	/**
 	* Clears all temporary and session data for the given user.
@@ -3499,7 +3516,7 @@ var AuthenticationHelper_default = AuthenticationHelper;
 /**
 * Encodes a string to standard base64 using `jose` (already a package dependency).
 *
-* `jose.base64url.encode` is environment-agnostic (browser, Node.js, Deno, Bun,
+* jose's `base64url.encode` is environment-agnostic (browser, Node.js, Deno, Bun,
 * edge/service-worker runtimes). It produces base64url output, which is then
 * converted to standard base64 by restoring the `+`/`/` characters and adding
 * `=` padding.
@@ -3513,7 +3530,7 @@ var AuthenticationHelper_default = AuthenticationHelper;
 * ```
 */
 const base64Encode = (value) => {
-	const b64url = jose.base64url.encode(new TextEncoder().encode(value));
+	const b64url = jose_base64url.encode(new TextEncoder().encode(value));
 	const rem = b64url.length % 4;
 	return (rem === 0 ? b64url : b64url + "=".repeat(4 - rem)).replace(/-/g, "+").replace(/_/g, "/");
 };
@@ -3648,7 +3665,7 @@ var generateStateParamForRequestCorrelation_default = generateStateParamForReque
 * This utility ensures the `openid` scope is always included, handles both string and array forms of the `scope` parameter,
 * and supports PKCE and custom parameters. Throws if a code challenge is provided without a code challenge method.
 *
-* @param options - The main options for the authorization request, including redirectUri, clientId, scope, responseMode, codeChallenge, codeChallengeMethod, and prompt.
+* @param options - The main options for the authorization request, including redirectUri, clientId, scope, responseMode, codeChallenge, codeChallengeMethod, prompt, and randomState (a value generated from random bytes that makes the `state` unique to this request).
 * @param pkceOptions - PKCE options, including the PKCE key for state correlation.
 * @param customParams - Optional custom parameters to include in the request (excluding the `state` param, which is handled separately).
 * @returns A Map of key-value pairs representing the authorization request URL parameters.
@@ -3693,14 +3710,67 @@ const getAuthorizeRequestUrlParams = (options, pkceOptions, customParams) => {
 	const customState = customParams?.[OIDCRequestConstants_default.Params.STATE]?.toString() ?? "";
 	let customStateValue = customState;
 	if (options.instanceId) customStateValue = AUTH_INSTANCE_PREFIX + options.instanceId + (customState ? `_${customState}` : "");
+	if (options.randomState) customStateValue = customStateValue ? `${customStateValue}_${options.randomState}` : options.randomState;
 	authorizeRequestParams.set(OIDCRequestConstants_default.Params.STATE, generateStateParamForRequestCorrelation_default(pkceKey, customStateValue));
 	return authorizeRequestParams;
 };
 var getAuthorizeRequestUrlParams_default = getAuthorizeRequestUrlParams;
 
+//#endregion
+//#region src/utils/getOAuthErrorMessage.ts
+/**
+* Builds a readable message from the body of an OAuth 2.0 error response (RFC 6749 section 5.2).
+*
+* Only the `error` and `error_description` members are read, so nothing else in the body, such as
+* a token, can end up in the message.
+*
+* @param body - The parsed response body, or its raw text.
+* @param fallback - The message to use when the body carries neither member.
+* @returns `"<error>: <error_description>"`, whichever of the two is present, or `fallback`.
+*
+* @example
+* getOAuthErrorMessage({error: 'invalid_grant', error_description: 'The code has expired.'}, 'Failed');
+* // Returns: "invalid_grant: The code has expired."
+*/
+const getOAuthErrorMessage = (body, fallback) => {
+	let parsed = body;
+	if (typeof body === "string") try {
+		parsed = JSON.parse(body);
+	} catch {
+		return fallback;
+	}
+	if (!parsed || typeof parsed !== "object") return fallback;
+	const { error: error$1, error_description: description } = parsed;
+	const parts = [error$1, description].filter((part) => typeof part === "string" && part.trim().length > 0);
+	return parts.length > 0 ? parts.join(": ") : fallback;
+};
+var getOAuthErrorMessage_default = getOAuthErrorMessage;
+
 //#endregion
 //#region src/ThunderIDJavaScriptClient.ts
 const WELL_KNOWN_PATH = "/.well-known/openid-configuration";
+/**
+* The issuer a discovery document must name: the configured `endpoints.issuer`, else the URL the
+* well-known path was appended to (OpenID Connect Discovery 1.0, section 4.3).
+*/
+const getExpectedIssuer = (configuredIssuer, wellKnownOverride, baseUrl) => {
+	if (configuredIssuer) return configuredIssuer;
+	if (wellKnownOverride) return wellKnownOverride.endsWith(WELL_KNOWN_PATH) ? wellKnownOverride.slice(0, -33) : void 0;
+	return baseUrl || void 0;
+};
+/**
+* Compares two issuers exactly, apart from a trailing slash on either side.
+*/
+const issuersMatch = (discovered, expected) => typeof discovered === "string" && discovered.replace(/\/+$/, "") === expected.replace(/\/+$/, "");
+/**
+* Reads a readable message from the body of a failed token, revocation, or custom grant response.
+*/
+const readErrorMessage = async (response, fallback) => getOAuthErrorMessage_default(await response.json().catch(() => void 0), fallback);
+/**
+* The storage key of the `state` sent with the authorization request whose PKCE key is given. Both
+* share the request index, so the callback finds the state from the index at the end of `state`.
+*/
+const getStateStorageKey = (pkceKey) => pkceKey.replace(PKCEConstants_default.Storage.StorageKeys.CODE_VERIFIER, OIDCRequestConstants_default.SignIn.Storage.StorageKeys.STATE);
 const REVOKE_ACCESS_TOKEN_REQUEST_TIMEOUT_MS = 1e4;
 const DEFAULT_CONFIG = {
 	enablePKCE: true,
@@ -3758,12 +3828,19 @@ var ThunderIDJavaScriptClient = class {
 		await this.loadOpenIDProviderConfiguration(true);
 		return true;
 	}
-	getConfiguration() {
-		return this.storageManager.getConfigData();
+	async getConfiguration() {
+		return await this.storageManager.getConfigData();
 	}
+	/**
+	* Returns the signed-in user, read from the claims of the session's ID token.
+	*
+	* @param userId - The session to read, on a server.
+	* @throws {ThunderIDRuntimeError} With code `JS-AUTH_CORE-GU-NF01` when the session holds no ID token.
+	*/
 	async getUser(userId) {
 		const sessionData = await this.storageManager.getSessionData(userId);
-		const authenticatedUser = this.authHelper.getAuthenticatedUserInfo(sessionData?.id_token);
+		if (!sessionData?.id_token) throw new ThunderIDRuntimeError("No signed-in session was found.", "JS-AUTH_CORE-GU-NF01", "javascript");
+		const authenticatedUser = this.authHelper.getAuthenticatedUserInfo(sessionData.id_token);
 		Object.keys(authenticatedUser).forEach((key) => {
 			if (authenticatedUser[key] === void 0 || authenticatedUser[key] === "" || authenticatedUser[key] === null) delete authenticatedUser[key];
 		});
@@ -3832,7 +3909,7 @@ var ThunderIDJavaScriptClient = class {
 		};
 		if (config.attachToken) requestHeaders = {
 			...requestHeaders,
-			Authorization: `Bearer ${(await this.storageManager.getSessionData(sessionId)).access_token}`
+			Authorization: `Bearer ${(await this.storageManager.getSessionData(sessionId))?.access_token}`
 		};
 		const requestConfig = {
 			body: data.join("&"),
@@ -3846,7 +3923,7 @@ var ThunderIDJavaScriptClient = class {
 		} catch (error$1) {
 			throw new ThunderIDAuthException("JS-AUTH_CORE-RCG-NE02", "The custom grant request failed.", error$1 ?? "The request sent to get the custom grant failed.");
 		}
-		if (response.status !== 200 || !response.ok) throw new ThunderIDAuthException("JS-AUTH_CORE-RCG-HE03", `Invalid response status received for the custom grant request. (${response.statusText})`, await response.json());
+		if (response.status !== 200 || !response.ok) throw new ThunderIDAuthException("JS-AUTH_CORE-RCG-HE03", `Invalid response status received for the custom grant request. (${response.statusText})`, await readErrorMessage(response, "The custom grant request was rejected."));
 		if (config.returnsSession) return this.authHelper.handleTokenResponse(response, sessionId);
 		return await response.json();
 	}
@@ -3878,7 +3955,8 @@ var ThunderIDJavaScriptClient = class {
 		const configData = await this.configProvider();
 		if (!forceInit && await this.storageManager.getTemporaryDataParameter(OIDCDiscoveryConstants_default.Storage.StorageKeys.OPENID_PROVIDER_CONFIG_INITIATED)) return;
 		const { discovery, baseUrl, endpoints } = configData;
-		const resolvedWellKnownEndpoint = endpoints?.wellKnown || (discovery?.wellKnown?.enabled !== false && baseUrl ? `${baseUrl}${WELL_KNOWN_PATH}` : void 0);
+		const wellKnownOverride = endpoints?.wellKnown;
+		const resolvedWellKnownEndpoint = wellKnownOverride || (discovery?.wellKnown?.enabled !== false && baseUrl ? `${baseUrl}${WELL_KNOWN_PATH}` : void 0);
 		if (resolvedWellKnownEndpoint) {
 			let response;
 			try {
@@ -3893,8 +3971,19 @@ var ThunderIDJavaScriptClient = class {
 			}
 			if (response) {
 				let discoveryResolved = false;
+				let discovered;
+				try {
+					discovered = await response.json();
+				} catch {
+					discovered = void 0;
+				}
+				if (discovered && typeof discovered === "object") {
+					const expectedIssuer = getExpectedIssuer(endpoints?.issuer, wellKnownOverride, baseUrl);
+					if (expectedIssuer !== void 0 && !issuersMatch(discovered.issuer, expectedIssuer)) throw new ThunderIDRuntimeError("The discovered issuer does not match the expected issuer. Set endpoints.issuer if your server uses a custom issuer.", "JS-AUTH_CORE-GOPMD-IV03", "javascript");
+				}
 				try {
-					await this.storageManager.setOIDCProviderMetaData(await this.authHelper.resolveEndpoints(await response.json()));
+					if (!discovered || typeof discovered !== "object") throw new Error("The discovery response is not a JSON object.");
+					await this.storageManager.setOIDCProviderMetaData(await this.authHelper.resolveEndpoints(discovered));
 					discoveryResolved = true;
 				} catch (error$1) {
 					logger_default.warn(`ThunderIDJavaScriptClient: Could not resolve endpoints from the discovery response of ${resolvedWellKnownEndpoint}; falling back to endpoints derived from the base URL.`, error$1);
@@ -3942,10 +4031,12 @@ var ThunderIDJavaScriptClient = class {
 				codeChallengeMethod: PKCEConstants_default.DEFAULT_CODE_CHALLENGE_METHOD,
 				instanceId: this.getInstanceId().toString(),
 				prompt: configData.prompt,
+				randomState: this.cryptoHelper.generateState(),
 				redirectUri: configData.afterSignInUrl ?? "",
 				responseMode: configData.responseMode,
 				scopes: processOpenIDScopes_default(configData.scopes)
 			}).filter(([, v]) => v !== void 0)), { key: pkceKey }, authRequestConfig);
+			await this.storageManager.setHybridDataParameter(getStateStorageKey(pkceKey), authorizeRequestParams.get(OIDCRequestConstants_default.Params.STATE) ?? "", userId);
 			Array.from(authorizeRequestParams.entries()).forEach(([paramKey, paramValue]) => {
 				authorizeRequest.searchParams.append(paramKey, paramValue);
 			});
@@ -3956,6 +4047,10 @@ var ThunderIDJavaScriptClient = class {
 	}
 	async requestAccessToken(authorizationCode, state, userId, tokenRequestConfig) {
 		if (!await this.storageManager.getTemporaryDataParameter(OIDCDiscoveryConstants_default.Storage.StorageKeys.OPENID_PROVIDER_CONFIG_INITIATED)) await this.loadOpenIDProviderConfiguration(false);
+		const stateStorageKey = getStateStorageKey(extractPkceStorageKeyFromState_default(state ?? ""));
+		const expectedState = await this.storageManager.getHybridDataParameter(stateStorageKey, userId);
+		if (!state || typeof expectedState !== "string" || !expectedState || state !== expectedState) throw new ThunderIDRuntimeError("The state returned to the callback does not match the state of the authorization request.", "JS-AUTH_CORE-RAT1-IV04", "javascript");
+		await this.storageManager.removeHybridDataParameter(stateStorageKey, userId);
 		const tokenEndpoint = (await this.oidcProviderMetaDataProvider()).token_endpoint;
 		const configData = await this.configProvider();
 		if (!tokenEndpoint || tokenEndpoint.trim().length === 0) throw new ThunderIDAuthException("JS-AUTH_CORE-RAT1-NF01", "Token endpoint not found.", "No token endpoint was found in the OIDC provider meta data returned by the well-known endpoint or the token endpoint passed to the SDK is empty.");
@@ -3990,7 +4085,7 @@ var ThunderIDJavaScriptClient = class {
 		} catch (error$1) {
 			throw new ThunderIDAuthException("JS-AUTH_CORE-RAT1-NE02", "Requesting access token failed", error$1 ?? "The request to get the access token from the server failed.");
 		}
-		if (!tokenResponse.ok) throw new ThunderIDAuthException("JS-AUTH_CORE-RAT1-HE03", `Requesting access token failed with ${tokenResponse.statusText}`, await tokenResponse.json());
+		if (!tokenResponse.ok) throw new ThunderIDAuthException("JS-AUTH_CORE-RAT1-HE03", `Requesting access token failed with ${tokenResponse.statusText}`, await readErrorMessage(tokenResponse, "The token request was rejected."));
 		return this.authHelper.handleTokenResponse(tokenResponse, userId);
 	}
 	async getSignOutUrl(userId) {
@@ -4007,7 +4102,11 @@ var ThunderIDJavaScriptClient = class {
 		queryParams.set("state", OIDCRequestConstants_default.Params.SIGN_OUT_SUCCESS);
 		return `${logoutEndpoint}?${queryParams.toString()}`;
 	}
+	/**
+	* Returns the endpoints the SDK calls. Loads the discovery document first when no other call has.
+	*/
 	async getOpenIDProviderEndpoints() {
+		await this.loadOpenIDProviderConfiguration(false);
 		const meta = await this.oidcProviderMetaDataProvider();
 		return {
 			authorizationEndpoint: meta.authorization_endpoint ?? "",
@@ -4021,16 +4120,27 @@ var ThunderIDJavaScriptClient = class {
 			userinfoEndpoint: meta.userinfo_endpoint ?? ""
 		};
 	}
+	/**
+	* Returns the discovery document. Loads it first when no other call has. Resolves to `null`
+	* before `initialize()`.
+	*/
 	async getDiscoveryResponse() {
 		if (!this.storageManager) return null;
+		await this.loadOpenIDProviderConfiguration(false);
 		return this.storageManager.loadOpenIDProviderConfiguration();
 	}
+	/**
+	* Returns the claims of the session's ID token, or of `idToken` when the session holds none.
+	*
+	* @throws {ThunderIDRuntimeError} With code `JS-AUTH_CORE-GDIT-NF01` when there is no ID token to decode.
+	*/
 	async getDecodedIdToken(userId, idToken) {
-		const storedIdToken = (await this.storageManager.getSessionData(userId)).id_token;
-		return this.cryptoHelper.decodeJwtToken(storedIdToken ?? idToken);
+		const token = (await this.storageManager.getSessionData(userId))?.id_token ?? idToken;
+		if (!token) throw new ThunderIDRuntimeError("No signed-in session was found.", "JS-AUTH_CORE-GDIT-NF01", "javascript");
+		return this.cryptoHelper.decodeJwtToken(token);
 	}
 	async getIdToken(userId) {
-		return (await this.storageManager.getSessionData(userId)).id_token;
+		return (await this.storageManager.getSessionData(userId))?.id_token;
 	}
 	async getUserSession(userId) {
 		return { scopes: (await this.storageManager.getSessionData(userId))?.scope?.split(" ") };
@@ -4061,7 +4171,7 @@ var ThunderIDJavaScriptClient = class {
 		} catch (error$1) {
 			throw new ThunderIDAuthException("JS-AUTH_CORE-RAT2-NR03", "Refresh access token request failed.", error$1 ?? "The request to refresh the access token failed.");
 		}
-		if (!tokenResponse.ok) throw new ThunderIDAuthException("JS-AUTH_CORE-RAT2-HE04", `Refreshing access token failed with ${tokenResponse.statusText}`, await tokenResponse.json());
+		if (!tokenResponse.ok) throw new ThunderIDAuthException("JS-AUTH_CORE-RAT2-HE04", `Refreshing access token failed with ${tokenResponse.statusText}`, await readErrorMessage(tokenResponse, "The refresh token request was rejected."));
 		return this.authHelper.handleTokenResponse(tokenResponse, userId);
 	}
 	/**
@@ -4100,7 +4210,7 @@ var ThunderIDJavaScriptClient = class {
 		} catch (error$1) {
 			throw new ThunderIDAuthException("JS-AUTH_CORE-RCCT-NE02", "Requesting client credentials token failed.", error$1 ?? "The request to get the client credentials access token failed.");
 		}
-		if (!tokenResponse.ok) throw new ThunderIDAuthException("JS-AUTH_CORE-RCCT-HE03", `Requesting client credentials token failed with ${tokenResponse.statusText}`, await tokenResponse.json());
+		if (!tokenResponse.ok) throw new ThunderIDAuthException("JS-AUTH_CORE-RCCT-HE03", `Requesting client credentials token failed with ${tokenResponse.statusText}`, await readErrorMessage(tokenResponse, "The client credentials token request was rejected."));
 		const parsedResponse = await tokenResponse.json();
 		parsedResponse.created_at = (/* @__PURE__ */ new Date()).getTime();
 		await this.storageManager.setSessionData(parsedResponse, sessionId);
@@ -4144,7 +4254,7 @@ var ThunderIDJavaScriptClient = class {
 		} catch (error$1) {
 			throw new ThunderIDAuthException("JS-AUTH_CORE-RAT3-NE02", "The request to revoke access token failed.", error$1 ?? "The request sent to revoke the access token failed.");
 		}
-		if (response.status !== 200 || !response.ok) throw new ThunderIDAuthException("JS-AUTH_CORE-RAT3-HE03", `Invalid response status received for revoke access token request (${response.statusText}).`, await response.json());
+		if (response.status !== 200 || !response.ok) throw new ThunderIDAuthException("JS-AUTH_CORE-RAT3-HE03", `Invalid response status received for revoke access token request (${response.statusText}).`, await readErrorMessage(response, "The revocation request was rejected."));
 		return response;
 	}
 	async revokeAccessToken(userId) {
@@ -4200,7 +4310,7 @@ var ThunderIDJavaScriptClient = class {
 		} catch {
 			parsedBody = rawBody;
 		}
-		if (!response.ok) throw new ThunderIDAPIError(parsedBody, "JS-AUTH_CORE-CIBA1-HE03", "javascript", response.status, response.statusText, "CIBA backchannel authentication request failed");
+		if (!response.ok) throw new ThunderIDAPIError(getOAuthErrorMessage_default(parsedBody, "The backchannel authentication request was rejected."), "JS-AUTH_CORE-CIBA1-HE03", "javascript", response.status, response.statusText, "CIBA backchannel authentication request failed");
 		const payload = parsedBody;
 		if (!payload.auth_req_id) throw new ThunderIDAPIError("The server response did not include an auth_req_id.", "JS-AUTH_CORE-CIBA1-PR04", "javascript");
 		return {
@@ -5249,6 +5359,43 @@ const resolveFieldName = (field) => {
 };
 var resolveFieldName_default = resolveFieldName;
 
+//#endregion
+//#region src/utils/resolveBackendEndpoints.ts
+const DEFAULT_BACKEND_BASE_PATH = "/api/auth";
+/**
+* Resolves the backend endpoints from `endpoints.backend`, or returns `undefined` when it is not set
+* and sign-in does not run on a backend.
+*
+* @param config - The client config.
+* @param origin - The app's origin, used as the API base when `baseUrl` is not set.
+* @returns The resolved endpoints, or `undefined` when `endpoints.backend` is not set.
+*
+* @example
+* ```typescript
+* resolveBackendEndpoints({endpoints: {backend: {signIn: '/auth/signin'}}}, window.location.origin);
+* // {signIn: '/auth/signin', session: '/api/auth/session', ..., apiBaseUrl: 'https://...'}
+* ```
+*/
+const resolveBackendEndpoints = (config, origin) => {
+	const endpoints = config?.endpoints?.backend;
+	if (!endpoints) return;
+	return {
+		apiBaseUrl: (config?.baseUrl || origin).replace(/\/+$/, ""),
+		bypass: {
+			attachToken: endpoints.bypass?.attachToken ?? true,
+			urls: (endpoints.bypass?.urls ?? []).map((url) => url.replace(/\/+$/, ""))
+		},
+		checkSession: endpoints.checkSession ?? `${DEFAULT_BACKEND_BASE_PATH}/checksession`,
+		proxy: (endpoints.proxy ?? `${DEFAULT_BACKEND_BASE_PATH}/proxy`).replace(/\/+$/, ""),
+		refresh: endpoints.refresh ?? `${DEFAULT_BACKEND_BASE_PATH}/refresh`,
+		session: endpoints.session ?? `${DEFAULT_BACKEND_BASE_PATH}/session`,
+		signIn: endpoints.signIn ?? `${DEFAULT_BACKEND_BASE_PATH}/signin`,
+		signOut: endpoints.signOut ?? `${DEFAULT_BACKEND_BASE_PATH}/signout`,
+		token: endpoints.token ?? `${DEFAULT_BACKEND_BASE_PATH}/token`
+	};
+};
+var resolveBackendEndpoints_default = resolveBackendEndpoints;
+
 //#endregion
 //#region src/utils/computeNextPageOffset.ts
 /**
@@ -7915,6 +8062,7 @@ exports.parseKeyValuePairs = parseKeyValuePairs_default;
 exports.parseSelectPageQuery = parseSelectPageQuery_default;
 exports.processOpenIDScopes = processOpenIDScopes_default;
 exports.removeTrailingSlash = removeTrailingSlash_default;
+exports.resolveBackendEndpoints = resolveBackendEndpoints_default;
 exports.resolveChangeCredentialPolicy = resolveChangeCredentialPolicy_default;
 exports.resolveFieldName = resolveFieldName_default;
 exports.resolveFlowTemplateLiterals = resolveFlowTemplateLiterals;

package/dist/constants/OIDCRequestConstants.d.ts

@@ -12,6 +12,11 @@ declare const OIDCRequestConstants: {
         readonly Payload: {
             readonly DEFAULT_SCOPES: readonly string[];
         };
+        readonly Storage: {
+            readonly StorageKeys: {
+                readonly STATE: string;
+            };
+        };
     };
     readonly SignOut: {
         readonly Storage: {

package/dist/constants/OIDCRequestConstants.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"OIDCRequestConstants.d.ts","sourceRoot":"","sources":["../../src/constants/OIDCRequestConstants.ts"],"names":[],"mappings":"AAKA;;;GAGG;AACH,QAAA,MAAM,oBAAoB,EAAE;IAC1B,QAAQ,CAAC,MAAM,EAAE;QACf,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;QACpC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;QAClC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;KACxB,CAAC;IACF,QAAQ,CAAC,MAAM,EAAE;QACf,QAAQ,CAAC,OAAO,EAAE;YAChB,QAAQ,CAAC,cAAc,EAAE,SAAS,MAAM,EAAE,CAAC;SAC5C,CAAC;KACH,CAAC;IACF,QAAQ,CAAC,OAAO,EAAE;QAChB,QAAQ,CAAC,OAAO,EAAE;YAChB,QAAQ,CAAC,WAAW,EAAE;gBACpB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;aAC/B,CAAC;SACH,CAAC;KACH,CAAC;CA0DM,CAAC;AAEX,eAAe,oBAAoB,CAAC"}
+{"version":3,"file":"OIDCRequestConstants.d.ts","sourceRoot":"","sources":["../../src/constants/OIDCRequestConstants.ts"],"names":[],"mappings":"AAKA;;;GAGG;AACH,QAAA,MAAM,oBAAoB,EAAE;IAC1B,QAAQ,CAAC,MAAM,EAAE;QACf,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;QACpC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;QAClC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;KACxB,CAAC;IACF,QAAQ,CAAC,MAAM,EAAE;QACf,QAAQ,CAAC,OAAO,EAAE;YAChB,QAAQ,CAAC,cAAc,EAAE,SAAS,MAAM,EAAE,CAAC;SAC5C,CAAC;QACF,QAAQ,CAAC,OAAO,EAAE;YAChB,QAAQ,CAAC,WAAW,EAAE;gBACpB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;aACxB,CAAC;SACH,CAAC;KACH,CAAC;IACF,QAAQ,CAAC,OAAO,EAAE;QAChB,QAAQ,CAAC,OAAO,EAAE;YAChB,QAAQ,CAAC,WAAW,EAAE;gBACpB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;aAC/B,CAAC;SACH,CAAC;KACH,CAAC;CAoEM,CAAC;AAEX,eAAe,oBAAoB,CAAC"}