@thunderid/javascript 1.4.0 → 1.5.0

package/dist/index.js

@@ -1,4 +1,6 @@
-import * as jose from "jose";
+import * as base64url from "jose/base64url";
+import { importJWK } from "jose/key/import";
+import { jwtVerify } from "jose/jwt/verify";
 
 //#region rolldown:runtime
 var __defProp = Object.defineProperty;
@@ -87,6 +89,16 @@ var IsomorphicCrypto = class {
 		return this.cryptoUtils.base64URLEncode(this.cryptoUtils.generateRandomBytes(32));
 	}
 	/**
+	* Generates the random part of an authorization request `state` from 32 random bytes. Only
+	* letters and digits are kept, so the value never contains the `_` that separates the parts of
+	* the state.
+	*
+	* @returns A random string of about 42 characters.
+	*/
+	generateState() {
+		return this.cryptoUtils.base64URLEncode(this.cryptoUtils.generateRandomBytes(32)).replace(/[^A-Za-z0-9]/g, "");
+	}
+	/**
 	* Derive code challenge from the code verifier.
 	*
 	* @param verifier - Code verifier.
@@ -2225,7 +2237,10 @@ const OIDCRequestConstants = {
 		SIGN_OUT_SUCCESS: "sign_out_success",
 		STATE: "state"
 	},
-	SignIn: { Payload: { DEFAULT_SCOPES: [ScopeConstants_default.OPENID, ScopeConstants_default.PROFILE] } },
+	SignIn: {
+		Payload: { DEFAULT_SCOPES: [ScopeConstants_default.OPENID, ScopeConstants_default.PROFILE] },
+		Storage: { StorageKeys: { STATE: "authorization_state" } }
+	},
 	SignOut: { Storage: { StorageKeys: { SIGN_OUT_URL: "sign_out_url" } } }
 };
 var OIDCRequestConstants_default = OIDCRequestConstants;
@@ -2682,11 +2697,11 @@ var DefaultCacheStore = class {
 */
 var DefaultCrypto = class {
 	base64URLDecode(value) {
-		const decodedArray = jose.base64url.decode(value);
+		const decodedArray = base64url.decode(value);
 		return new TextDecoder().decode(decodedArray);
 	}
 	base64URLEncode(value) {
-		return jose.base64url.encode(value);
+		return base64url.encode(value);
 	}
 	generateRandomBytes(length) {
 		return crypto.getRandomValues(new Uint8Array(length));
@@ -2697,8 +2712,7 @@ var DefaultCrypto = class {
 		return new Uint8Array(hashBuffer);
 	}
 	async verifyJwt(idToken, jwk, algorithms, clientId, issuer, subject, clockTolerance, validateJwtIssuer = true) {
-		const key = await jose.importJWK(jwk);
-		await jose.jwtVerify(idToken, key, {
+		await jwtVerify(idToken, await importJWK(jwk), {
 			algorithms,
 			audience: [clientId],
 			clockTolerance,
@@ -2785,6 +2799,7 @@ var StorageManager = class StorageManager {
 		return `${store}-${this.id}`;
 	}
 	static isLocalStorageAvailable() {
+		if (typeof window === "undefined") return false;
 		try {
 			const testValue = "__AUTH_SDK_STORAGE_TEST__";
 			localStorage.setItem(testValue, testValue);
@@ -3208,7 +3223,7 @@ var AuthenticationHelper = class {
 	* Maps the config-defined OIDC endpoint overrides to their discovery-metadata form.
 	*
 	* Endpoint names are converted from camelCase to snake_case, and resource-server endpoints
-	* (`RESOURCE_ENDPOINT_KEYS`) are excluded — those are resolved separately via
+	* (`RESOURCE_ENDPOINT_KEYS`) and the backend overrides are excluded — those are resolved separately via
 	* `resolveResourceEndpoint` and must not leak into the OIDC provider metadata.
 	*
 	* @param configData - The resolved auth client config.
@@ -3217,7 +3232,7 @@ var AuthenticationHelper = class {
 	mapConfiguredOidcEndpoints(configData) {
 		const endpoints = {};
 		if (!configData.endpoints) return endpoints;
-		Object.keys(configData.endpoints).filter((endpointName) => !RESOURCE_ENDPOINT_KEYS.includes(endpointName)).forEach((endpointName) => {
+		Object.keys(configData.endpoints).filter((endpointName) => endpointName !== "backend" && !RESOURCE_ENDPOINT_KEYS.includes(endpointName)).forEach((endpointName) => {
 			const snakeCasedName = endpointName.replace(/[A-Z]/g, (letter) => `_${letter.toLowerCase()}`);
 			endpoints[snakeCasedName] = configData.endpoints ? configData.endpoints[endpointName] : "";
 		});
@@ -3424,7 +3439,7 @@ var AuthenticationHelper = class {
 		} else sessionData = await this.storageManager.getSessionData(userId);
 		const scope = processOpenIDScopes_default(configData.scopes);
 		if (typeof text !== "string") return text;
-		return text.replace(TokenExchangeConstants_default.Placeholders.ACCESS_TOKEN, sessionData.access_token).replace(TokenExchangeConstants_default.Placeholders.USERNAME, this.getAuthenticatedUserInfo(sessionData.id_token).username ?? "").replace(TokenExchangeConstants_default.Placeholders.SCOPES, scope).replace(TokenExchangeConstants_default.Placeholders.CLIENT_ID, configData.clientId ?? "").replace(TokenExchangeConstants_default.Placeholders.CLIENT_SECRET, configData.clientSecret ?? "");
+		return text.replace(TokenExchangeConstants_default.Placeholders.ACCESS_TOKEN, () => sessionData?.access_token ?? "").replace(TokenExchangeConstants_default.Placeholders.USERNAME, () => sessionData?.id_token ? this.getAuthenticatedUserInfo(sessionData.id_token).username ?? "" : "").replace(TokenExchangeConstants_default.Placeholders.SCOPES, scope).replace(TokenExchangeConstants_default.Placeholders.CLIENT_ID, configData.clientId ?? "").replace(TokenExchangeConstants_default.Placeholders.CLIENT_SECRET, configData.clientSecret ?? "");
 	}
 	/**
 	* Clears all temporary and session data for the given user.
@@ -3479,7 +3494,7 @@ var AuthenticationHelper_default = AuthenticationHelper;
 /**
 * Encodes a string to standard base64 using `jose` (already a package dependency).
 *
-* `jose.base64url.encode` is environment-agnostic (browser, Node.js, Deno, Bun,
+* jose's `base64url.encode` is environment-agnostic (browser, Node.js, Deno, Bun,
 * edge/service-worker runtimes). It produces base64url output, which is then
 * converted to standard base64 by restoring the `+`/`/` characters and adding
 * `=` padding.
@@ -3493,7 +3508,7 @@ var AuthenticationHelper_default = AuthenticationHelper;
 * ```
 */
 const base64Encode = (value) => {
-	const b64url = jose.base64url.encode(new TextEncoder().encode(value));
+	const b64url = base64url.encode(new TextEncoder().encode(value));
 	const rem = b64url.length % 4;
 	return (rem === 0 ? b64url : b64url + "=".repeat(4 - rem)).replace(/-/g, "+").replace(/_/g, "/");
 };
@@ -3628,7 +3643,7 @@ var generateStateParamForRequestCorrelation_default = generateStateParamForReque
 * This utility ensures the `openid` scope is always included, handles both string and array forms of the `scope` parameter,
 * and supports PKCE and custom parameters. Throws if a code challenge is provided without a code challenge method.
 *
-* @param options - The main options for the authorization request, including redirectUri, clientId, scope, responseMode, codeChallenge, codeChallengeMethod, and prompt.
+* @param options - The main options for the authorization request, including redirectUri, clientId, scope, responseMode, codeChallenge, codeChallengeMethod, prompt, and randomState (a value generated from random bytes that makes the `state` unique to this request).
 * @param pkceOptions - PKCE options, including the PKCE key for state correlation.
 * @param customParams - Optional custom parameters to include in the request (excluding the `state` param, which is handled separately).
 * @returns A Map of key-value pairs representing the authorization request URL parameters.
@@ -3673,14 +3688,67 @@ const getAuthorizeRequestUrlParams = (options, pkceOptions, customParams) => {
 	const customState = customParams?.[OIDCRequestConstants_default.Params.STATE]?.toString() ?? "";
 	let customStateValue = customState;
 	if (options.instanceId) customStateValue = AUTH_INSTANCE_PREFIX + options.instanceId + (customState ? `_${customState}` : "");
+	if (options.randomState) customStateValue = customStateValue ? `${customStateValue}_${options.randomState}` : options.randomState;
 	authorizeRequestParams.set(OIDCRequestConstants_default.Params.STATE, generateStateParamForRequestCorrelation_default(pkceKey, customStateValue));
 	return authorizeRequestParams;
 };
 var getAuthorizeRequestUrlParams_default = getAuthorizeRequestUrlParams;
 
+//#endregion
+//#region src/utils/getOAuthErrorMessage.ts
+/**
+* Builds a readable message from the body of an OAuth 2.0 error response (RFC 6749 section 5.2).
+*
+* Only the `error` and `error_description` members are read, so nothing else in the body, such as
+* a token, can end up in the message.
+*
+* @param body - The parsed response body, or its raw text.
+* @param fallback - The message to use when the body carries neither member.
+* @returns `"<error>: <error_description>"`, whichever of the two is present, or `fallback`.
+*
+* @example
+* getOAuthErrorMessage({error: 'invalid_grant', error_description: 'The code has expired.'}, 'Failed');
+* // Returns: "invalid_grant: The code has expired."
+*/
+const getOAuthErrorMessage = (body, fallback) => {
+	let parsed = body;
+	if (typeof body === "string") try {
+		parsed = JSON.parse(body);
+	} catch {
+		return fallback;
+	}
+	if (!parsed || typeof parsed !== "object") return fallback;
+	const { error: error$1, error_description: description } = parsed;
+	const parts = [error$1, description].filter((part) => typeof part === "string" && part.trim().length > 0);
+	return parts.length > 0 ? parts.join(": ") : fallback;
+};
+var getOAuthErrorMessage_default = getOAuthErrorMessage;
+
 //#endregion
 //#region src/ThunderIDJavaScriptClient.ts
 const WELL_KNOWN_PATH = "/.well-known/openid-configuration";
+/**
+* The issuer a discovery document must name: the configured `endpoints.issuer`, else the URL the
+* well-known path was appended to (OpenID Connect Discovery 1.0, section 4.3).
+*/
+const getExpectedIssuer = (configuredIssuer, wellKnownOverride, baseUrl) => {
+	if (configuredIssuer) return configuredIssuer;
+	if (wellKnownOverride) return wellKnownOverride.endsWith(WELL_KNOWN_PATH) ? wellKnownOverride.slice(0, -33) : void 0;
+	return baseUrl || void 0;
+};
+/**
+* Compares two issuers exactly, apart from a trailing slash on either side.
+*/
+const issuersMatch = (discovered, expected) => typeof discovered === "string" && discovered.replace(/\/+$/, "") === expected.replace(/\/+$/, "");
+/**
+* Reads a readable message from the body of a failed token, revocation, or custom grant response.
+*/
+const readErrorMessage = async (response, fallback) => getOAuthErrorMessage_default(await response.json().catch(() => void 0), fallback);
+/**
+* The storage key of the `state` sent with the authorization request whose PKCE key is given. Both
+* share the request index, so the callback finds the state from the index at the end of `state`.
+*/
+const getStateStorageKey = (pkceKey) => pkceKey.replace(PKCEConstants_default.Storage.StorageKeys.CODE_VERIFIER, OIDCRequestConstants_default.SignIn.Storage.StorageKeys.STATE);
 const REVOKE_ACCESS_TOKEN_REQUEST_TIMEOUT_MS = 1e4;
 const DEFAULT_CONFIG = {
 	enablePKCE: true,
@@ -3738,12 +3806,19 @@ var ThunderIDJavaScriptClient = class {
 		await this.loadOpenIDProviderConfiguration(true);
 		return true;
 	}
-	getConfiguration() {
-		return this.storageManager.getConfigData();
+	async getConfiguration() {
+		return await this.storageManager.getConfigData();
 	}
+	/**
+	* Returns the signed-in user, read from the claims of the session's ID token.
+	*
+	* @param userId - The session to read, on a server.
+	* @throws {ThunderIDRuntimeError} With code `JS-AUTH_CORE-GU-NF01` when the session holds no ID token.
+	*/
 	async getUser(userId) {
 		const sessionData = await this.storageManager.getSessionData(userId);
-		const authenticatedUser = this.authHelper.getAuthenticatedUserInfo(sessionData?.id_token);
+		if (!sessionData?.id_token) throw new ThunderIDRuntimeError("No signed-in session was found.", "JS-AUTH_CORE-GU-NF01", "javascript");
+		const authenticatedUser = this.authHelper.getAuthenticatedUserInfo(sessionData.id_token);
 		Object.keys(authenticatedUser).forEach((key) => {
 			if (authenticatedUser[key] === void 0 || authenticatedUser[key] === "" || authenticatedUser[key] === null) delete authenticatedUser[key];
 		});
@@ -3812,7 +3887,7 @@ var ThunderIDJavaScriptClient = class {
 		};
 		if (config.attachToken) requestHeaders = {
 			...requestHeaders,
-			Authorization: `Bearer ${(await this.storageManager.getSessionData(sessionId)).access_token}`
+			Authorization: `Bearer ${(await this.storageManager.getSessionData(sessionId))?.access_token}`
 		};
 		const requestConfig = {
 			body: data.join("&"),
@@ -3826,7 +3901,7 @@ var ThunderIDJavaScriptClient = class {
 		} catch (error$1) {
 			throw new ThunderIDAuthException("JS-AUTH_CORE-RCG-NE02", "The custom grant request failed.", error$1 ?? "The request sent to get the custom grant failed.");
 		}
-		if (response.status !== 200 || !response.ok) throw new ThunderIDAuthException("JS-AUTH_CORE-RCG-HE03", `Invalid response status received for the custom grant request. (${response.statusText})`, await response.json());
+		if (response.status !== 200 || !response.ok) throw new ThunderIDAuthException("JS-AUTH_CORE-RCG-HE03", `Invalid response status received for the custom grant request. (${response.statusText})`, await readErrorMessage(response, "The custom grant request was rejected."));
 		if (config.returnsSession) return this.authHelper.handleTokenResponse(response, sessionId);
 		return await response.json();
 	}
@@ -3858,7 +3933,8 @@ var ThunderIDJavaScriptClient = class {
 		const configData = await this.configProvider();
 		if (!forceInit && await this.storageManager.getTemporaryDataParameter(OIDCDiscoveryConstants_default.Storage.StorageKeys.OPENID_PROVIDER_CONFIG_INITIATED)) return;
 		const { discovery, baseUrl, endpoints } = configData;
-		const resolvedWellKnownEndpoint = endpoints?.wellKnown || (discovery?.wellKnown?.enabled !== false && baseUrl ? `${baseUrl}${WELL_KNOWN_PATH}` : void 0);
+		const wellKnownOverride = endpoints?.wellKnown;
+		const resolvedWellKnownEndpoint = wellKnownOverride || (discovery?.wellKnown?.enabled !== false && baseUrl ? `${baseUrl}${WELL_KNOWN_PATH}` : void 0);
 		if (resolvedWellKnownEndpoint) {
 			let response;
 			try {
@@ -3873,8 +3949,19 @@ var ThunderIDJavaScriptClient = class {
 			}
 			if (response) {
 				let discoveryResolved = false;
+				let discovered;
+				try {
+					discovered = await response.json();
+				} catch {
+					discovered = void 0;
+				}
+				if (discovered && typeof discovered === "object") {
+					const expectedIssuer = getExpectedIssuer(endpoints?.issuer, wellKnownOverride, baseUrl);
+					if (expectedIssuer !== void 0 && !issuersMatch(discovered.issuer, expectedIssuer)) throw new ThunderIDRuntimeError("The discovered issuer does not match the expected issuer. Set endpoints.issuer if your server uses a custom issuer.", "JS-AUTH_CORE-GOPMD-IV03", "javascript");
+				}
 				try {
-					await this.storageManager.setOIDCProviderMetaData(await this.authHelper.resolveEndpoints(await response.json()));
+					if (!discovered || typeof discovered !== "object") throw new Error("The discovery response is not a JSON object.");
+					await this.storageManager.setOIDCProviderMetaData(await this.authHelper.resolveEndpoints(discovered));
 					discoveryResolved = true;
 				} catch (error$1) {
 					logger_default.warn(`ThunderIDJavaScriptClient: Could not resolve endpoints from the discovery response of ${resolvedWellKnownEndpoint}; falling back to endpoints derived from the base URL.`, error$1);
@@ -3922,10 +4009,12 @@ var ThunderIDJavaScriptClient = class {
 				codeChallengeMethod: PKCEConstants_default.DEFAULT_CODE_CHALLENGE_METHOD,
 				instanceId: this.getInstanceId().toString(),
 				prompt: configData.prompt,
+				randomState: this.cryptoHelper.generateState(),
 				redirectUri: configData.afterSignInUrl ?? "",
 				responseMode: configData.responseMode,
 				scopes: processOpenIDScopes_default(configData.scopes)
 			}).filter(([, v]) => v !== void 0)), { key: pkceKey }, authRequestConfig);
+			await this.storageManager.setHybridDataParameter(getStateStorageKey(pkceKey), authorizeRequestParams.get(OIDCRequestConstants_default.Params.STATE) ?? "", userId);
 			Array.from(authorizeRequestParams.entries()).forEach(([paramKey, paramValue]) => {
 				authorizeRequest.searchParams.append(paramKey, paramValue);
 			});
@@ -3936,6 +4025,10 @@ var ThunderIDJavaScriptClient = class {
 	}
 	async requestAccessToken(authorizationCode, state, userId, tokenRequestConfig) {
 		if (!await this.storageManager.getTemporaryDataParameter(OIDCDiscoveryConstants_default.Storage.StorageKeys.OPENID_PROVIDER_CONFIG_INITIATED)) await this.loadOpenIDProviderConfiguration(false);
+		const stateStorageKey = getStateStorageKey(extractPkceStorageKeyFromState_default(state ?? ""));
+		const expectedState = await this.storageManager.getHybridDataParameter(stateStorageKey, userId);
+		if (!state || typeof expectedState !== "string" || !expectedState || state !== expectedState) throw new ThunderIDRuntimeError("The state returned to the callback does not match the state of the authorization request.", "JS-AUTH_CORE-RAT1-IV04", "javascript");
+		await this.storageManager.removeHybridDataParameter(stateStorageKey, userId);
 		const tokenEndpoint = (await this.oidcProviderMetaDataProvider()).token_endpoint;
 		const configData = await this.configProvider();
 		if (!tokenEndpoint || tokenEndpoint.trim().length === 0) throw new ThunderIDAuthException("JS-AUTH_CORE-RAT1-NF01", "Token endpoint not found.", "No token endpoint was found in the OIDC provider meta data returned by the well-known endpoint or the token endpoint passed to the SDK is empty.");
@@ -3970,7 +4063,7 @@ var ThunderIDJavaScriptClient = class {
 		} catch (error$1) {
 			throw new ThunderIDAuthException("JS-AUTH_CORE-RAT1-NE02", "Requesting access token failed", error$1 ?? "The request to get the access token from the server failed.");
 		}
-		if (!tokenResponse.ok) throw new ThunderIDAuthException("JS-AUTH_CORE-RAT1-HE03", `Requesting access token failed with ${tokenResponse.statusText}`, await tokenResponse.json());
+		if (!tokenResponse.ok) throw new ThunderIDAuthException("JS-AUTH_CORE-RAT1-HE03", `Requesting access token failed with ${tokenResponse.statusText}`, await readErrorMessage(tokenResponse, "The token request was rejected."));
 		return this.authHelper.handleTokenResponse(tokenResponse, userId);
 	}
 	async getSignOutUrl(userId) {
@@ -3987,7 +4080,11 @@ var ThunderIDJavaScriptClient = class {
 		queryParams.set("state", OIDCRequestConstants_default.Params.SIGN_OUT_SUCCESS);
 		return `${logoutEndpoint}?${queryParams.toString()}`;
 	}
+	/**
+	* Returns the endpoints the SDK calls. Loads the discovery document first when no other call has.
+	*/
 	async getOpenIDProviderEndpoints() {
+		await this.loadOpenIDProviderConfiguration(false);
 		const meta = await this.oidcProviderMetaDataProvider();
 		return {
 			authorizationEndpoint: meta.authorization_endpoint ?? "",
@@ -4001,16 +4098,27 @@ var ThunderIDJavaScriptClient = class {
 			userinfoEndpoint: meta.userinfo_endpoint ?? ""
 		};
 	}
+	/**
+	* Returns the discovery document. Loads it first when no other call has. Resolves to `null`
+	* before `initialize()`.
+	*/
 	async getDiscoveryResponse() {
 		if (!this.storageManager) return null;
+		await this.loadOpenIDProviderConfiguration(false);
 		return this.storageManager.loadOpenIDProviderConfiguration();
 	}
+	/**
+	* Returns the claims of the session's ID token, or of `idToken` when the session holds none.
+	*
+	* @throws {ThunderIDRuntimeError} With code `JS-AUTH_CORE-GDIT-NF01` when there is no ID token to decode.
+	*/
 	async getDecodedIdToken(userId, idToken) {
-		const storedIdToken = (await this.storageManager.getSessionData(userId)).id_token;
-		return this.cryptoHelper.decodeJwtToken(storedIdToken ?? idToken);
+		const token = (await this.storageManager.getSessionData(userId))?.id_token ?? idToken;
+		if (!token) throw new ThunderIDRuntimeError("No signed-in session was found.", "JS-AUTH_CORE-GDIT-NF01", "javascript");
+		return this.cryptoHelper.decodeJwtToken(token);
 	}
 	async getIdToken(userId) {
-		return (await this.storageManager.getSessionData(userId)).id_token;
+		return (await this.storageManager.getSessionData(userId))?.id_token;
 	}
 	async getUserSession(userId) {
 		return { scopes: (await this.storageManager.getSessionData(userId))?.scope?.split(" ") };
@@ -4041,7 +4149,7 @@ var ThunderIDJavaScriptClient = class {
 		} catch (error$1) {
 			throw new ThunderIDAuthException("JS-AUTH_CORE-RAT2-NR03", "Refresh access token request failed.", error$1 ?? "The request to refresh the access token failed.");
 		}
-		if (!tokenResponse.ok) throw new ThunderIDAuthException("JS-AUTH_CORE-RAT2-HE04", `Refreshing access token failed with ${tokenResponse.statusText}`, await tokenResponse.json());
+		if (!tokenResponse.ok) throw new ThunderIDAuthException("JS-AUTH_CORE-RAT2-HE04", `Refreshing access token failed with ${tokenResponse.statusText}`, await readErrorMessage(tokenResponse, "The refresh token request was rejected."));
 		return this.authHelper.handleTokenResponse(tokenResponse, userId);
 	}
 	/**
@@ -4080,7 +4188,7 @@ var ThunderIDJavaScriptClient = class {
 		} catch (error$1) {
 			throw new ThunderIDAuthException("JS-AUTH_CORE-RCCT-NE02", "Requesting client credentials token failed.", error$1 ?? "The request to get the client credentials access token failed.");
 		}
-		if (!tokenResponse.ok) throw new ThunderIDAuthException("JS-AUTH_CORE-RCCT-HE03", `Requesting client credentials token failed with ${tokenResponse.statusText}`, await tokenResponse.json());
+		if (!tokenResponse.ok) throw new ThunderIDAuthException("JS-AUTH_CORE-RCCT-HE03", `Requesting client credentials token failed with ${tokenResponse.statusText}`, await readErrorMessage(tokenResponse, "The client credentials token request was rejected."));
 		const parsedResponse = await tokenResponse.json();
 		parsedResponse.created_at = (/* @__PURE__ */ new Date()).getTime();
 		await this.storageManager.setSessionData(parsedResponse, sessionId);
@@ -4124,7 +4232,7 @@ var ThunderIDJavaScriptClient = class {
 		} catch (error$1) {
 			throw new ThunderIDAuthException("JS-AUTH_CORE-RAT3-NE02", "The request to revoke access token failed.", error$1 ?? "The request sent to revoke the access token failed.");
 		}
-		if (response.status !== 200 || !response.ok) throw new ThunderIDAuthException("JS-AUTH_CORE-RAT3-HE03", `Invalid response status received for revoke access token request (${response.statusText}).`, await response.json());
+		if (response.status !== 200 || !response.ok) throw new ThunderIDAuthException("JS-AUTH_CORE-RAT3-HE03", `Invalid response status received for revoke access token request (${response.statusText}).`, await readErrorMessage(response, "The revocation request was rejected."));
 		return response;
 	}
 	async revokeAccessToken(userId) {
@@ -4180,7 +4288,7 @@ var ThunderIDJavaScriptClient = class {
 		} catch {
 			parsedBody = rawBody;
 		}
-		if (!response.ok) throw new ThunderIDAPIError(parsedBody, "JS-AUTH_CORE-CIBA1-HE03", "javascript", response.status, response.statusText, "CIBA backchannel authentication request failed");
+		if (!response.ok) throw new ThunderIDAPIError(getOAuthErrorMessage_default(parsedBody, "The backchannel authentication request was rejected."), "JS-AUTH_CORE-CIBA1-HE03", "javascript", response.status, response.statusText, "CIBA backchannel authentication request failed");
 		const payload = parsedBody;
 		if (!payload.auth_req_id) throw new ThunderIDAPIError("The server response did not include an auth_req_id.", "JS-AUTH_CORE-CIBA1-PR04", "javascript");
 		return {
@@ -4812,9 +4920,9 @@ var arrayBufferToBase64url_default = arrayBufferToBase64url;
 *
 * @see {@link arrayBufferToBase64url} - The inverse function for encoding ArrayBuffer to base64url
 */
-const base64urlToArrayBuffer = (base64url) => {
-	const padding = "=".repeat((4 - base64url.length % 4) % 4);
-	const base64 = base64url.replace(/-/g, "+").replace(/_/g, "/") + padding;
+const base64urlToArrayBuffer = (base64url$1) => {
+	const padding = "=".repeat((4 - base64url$1.length % 4) % 4);
+	const base64 = base64url$1.replace(/-/g, "+").replace(/_/g, "/") + padding;
 	const binaryString = atob(base64);
 	const bytes = new Uint8Array(binaryString.length);
 	for (let i = 0; i < binaryString.length; i += 1) bytes[i] = binaryString.charCodeAt(i);
@@ -5229,6 +5337,43 @@ const resolveFieldName = (field) => {
 };
 var resolveFieldName_default = resolveFieldName;
 
+//#endregion
+//#region src/utils/resolveBackendEndpoints.ts
+const DEFAULT_BACKEND_BASE_PATH = "/api/auth";
+/**
+* Resolves the backend endpoints from `endpoints.backend`, or returns `undefined` when it is not set
+* and sign-in does not run on a backend.
+*
+* @param config - The client config.
+* @param origin - The app's origin, used as the API base when `baseUrl` is not set.
+* @returns The resolved endpoints, or `undefined` when `endpoints.backend` is not set.
+*
+* @example
+* ```typescript
+* resolveBackendEndpoints({endpoints: {backend: {signIn: '/auth/signin'}}}, window.location.origin);
+* // {signIn: '/auth/signin', session: '/api/auth/session', ..., apiBaseUrl: 'https://...'}
+* ```
+*/
+const resolveBackendEndpoints = (config, origin) => {
+	const endpoints = config?.endpoints?.backend;
+	if (!endpoints) return;
+	return {
+		apiBaseUrl: (config?.baseUrl || origin).replace(/\/+$/, ""),
+		bypass: {
+			attachToken: endpoints.bypass?.attachToken ?? true,
+			urls: (endpoints.bypass?.urls ?? []).map((url) => url.replace(/\/+$/, ""))
+		},
+		checkSession: endpoints.checkSession ?? `${DEFAULT_BACKEND_BASE_PATH}/checksession`,
+		proxy: (endpoints.proxy ?? `${DEFAULT_BACKEND_BASE_PATH}/proxy`).replace(/\/+$/, ""),
+		refresh: endpoints.refresh ?? `${DEFAULT_BACKEND_BASE_PATH}/refresh`,
+		session: endpoints.session ?? `${DEFAULT_BACKEND_BASE_PATH}/session`,
+		signIn: endpoints.signIn ?? `${DEFAULT_BACKEND_BASE_PATH}/signin`,
+		signOut: endpoints.signOut ?? `${DEFAULT_BACKEND_BASE_PATH}/signout`,
+		token: endpoints.token ?? `${DEFAULT_BACKEND_BASE_PATH}/token`
+	};
+};
+var resolveBackendEndpoints_default = resolveBackendEndpoints;
+
 //#endregion
 //#region src/utils/computeNextPageOffset.ts
 /**
@@ -7769,4 +7914,4 @@ const normalizeTranslations = (translations) => {
 var normalizeTranslations_default = normalizeTranslations;
 
 //#endregion
-export { AgentQueryKeys_default as AgentQueryKeys, ApplicationNativeAuthenticationConstants_default as ApplicationNativeAuthenticationConstants, ApplicationQueryKeys_default as ApplicationQueryKeys, AuthFlowSelectConstants_default as AuthFlowSelectConstants, AuthenticationHelper_default as AuthenticationHelper, BackchannelLogoutConstants_default as BackchannelLogoutConstants, ConsentConstants_default as ConsentConstants, CredentialConstants_default as CredentialConstants, DEFAULT_THEME, DEFAULT_VALIDATION_MESSAGE_KEYS, EMOJI_URI_SCHEME, EmbeddedFlowActionVariant, EmbeddedFlowComponentType, EmbeddedFlowEventType, EmbeddedFlowResponseType, EmbeddedFlowTextVariant, EmbeddedFlowType, EmbeddedRecoveryFlowStatus, EmbeddedRecoveryFlowType, EmbeddedSignInFlowStatus, EmbeddedSignInFlowType, EmbeddedSignUpFlowStatus, EmbeddedSignUpFlowType, FieldType, FlowMetaType, FlowMode, HttpClient, InboundAuthTypes, InvalidLogoutTokenError, IsomorphicCrypto, OAuth2GrantTypes, OAuth2ResponseTypes, OIDCRequestConstants_default as OIDCRequestConstants, REFRESH_TOKEN_ISSUING_GRANTS, SelectConstants_default as SelectConstants, StorageManager_default as StorageManager, ThunderIDAPIError, ThunderIDAuthException, ThunderIDError, ThunderIDJavaScriptClient_default as ThunderIDJavaScriptClient, ThunderIDRuntimeError, TokenConstants_default as TokenConstants, TokenEndpointAuthMethods, TranslationBundleConstants_default as TranslationBundleConstants, UserQueryKeys_default as UserQueryKeys, UserSelectConstants_default as UserSelectConstants, UserTypeSelectConstants_default as UserTypeSelectConstants, VendorConstants_default as VendorConstants, arrayBufferToBase64url_default as arrayBufferToBase64url, base64urlToArrayBuffer_default as base64urlToArrayBuffer, bem_default as bem, buildValidatorFromRules_default as buildValidatorFromRules, capPageSize_default as capPageSize, computeNextPageOffset_default as computeNextPageOffset, configure as configureLogger, countryCodeToFlagEmoji, createAgent_default as createAgent, createApplication_default as createApplication, createComponentLogger, createLogger, createPackageComponentLogger, createPackageLogger, createResourceFailureLogger, createResourceOptionsLoader_default as createResourceOptionsLoader, createTheme_default as createTheme, createUser_default as createUser, debug, dedupeSelectOptions_default as dedupeSelectOptions, deepMerge_default as deepMerge, deleteAgent_default as deleteAgent, deleteApplication_default as deleteApplication, deleteUser_default as deleteUser, error, evaluateChangePasswordForm_default as evaluateChangePasswordForm, evaluatePasswordPolicy_default as evaluatePasswordPolicy, evaluateValidationRule_default as evaluateValidationRule, executeEmbeddedRecoveryFlow_default as executeEmbeddedRecoveryFlow, executeEmbeddedSignInFlow_default as executeEmbeddedSignInFlow, executeEmbeddedSignUpFlow_default as executeEmbeddedSignUpFlow, executeEmbeddedUserOnboardingFlow_default as executeEmbeddedUserOnboardingFlow, extractEmojiFromUri_default as extractEmojiFromUri, extractPkceStorageKeyFromState_default as extractPkceStorageKeyFromState, extractUserClaimsFromIdToken_default as extractUserClaimsFromIdToken, formatDate_default as formatDate, generateFlattenedUserProfile_default as generateFlattenedUserProfile, get_default as get, getAgent_default as getAgent, getAgents_default as getAgents, getApplication_default as getApplication, getApplications_default as getApplications, getBaseLanguage, getDefaultI18nBundles_default as getDefaultI18nBundles, getFlowMeta_default as getFlowMeta, getFlows_default as getFlows, getLatestStateParam_default as getLatestStateParam, getOrganizationUnitChildren_default as getOrganizationUnitChildren, getRedirectBasedSignUpUrl_default as getRedirectBasedSignUpUrl, getSelectMessages_default as getSelectMessages, getUser_default as getUser, getUserInfo_default as getUserInfo, getUserTypes_default as getUserTypes, getUsers_default as getUsers, getUsersMe_default as getUsersMe, getUsersMeMeta_default as getUsersMeMeta, getVendorPrefix_default as getVendorPrefix, hasUnresolvedTranslationParams, info, isAdvancingPageOffset_default as isAdvancingPageOffset, isEmojiUri_default as isEmojiUri, isEmpty_default as isEmpty, isRecognizedBaseUrlPattern_default as isRecognizedBaseUrlPattern, isRetryableError_default as isRetryableError, loadPageWithRetryAndLog_default as loadPageWithRetryAndLog, loadUntilOptionsGrow_default as loadUntilOptionsGrow, logResourceFailure, logger_default as logger, mapCredentialUpdateError_default as mapCredentialUpdateError, mapSelectPageError_default as mapSelectPageError, mergeOptionsBatch_default as mergeOptionsBatch, normalizeLocaleTag, normalizeSelectOptions_default as normalizeSelectOptions, normalizeTranslations_default as normalizeTranslations, parseKeyValuePairs_default as parseKeyValuePairs, parseSelectPageQuery_default as parseSelectPageQuery, processOpenIDScopes_default as processOpenIDScopes, removeTrailingSlash_default as removeTrailingSlash, resolveChangeCredentialPolicy_default as resolveChangeCredentialPolicy, resolveFieldName_default as resolveFieldName, resolveFlowTemplateLiterals, resolveLocaleDisplayName, resolveLocaleEmoji_default as resolveLocaleEmoji, resolveMeta, resolvePageSize_default as resolvePageSize, resolveResourceEndpoint_default as resolveResourceEndpoint, set_default as set, startCase_default as startCase, substituteTranslationParams_default as substituteTranslationParams, supportsCredential_default as supportsCredential, toAuthFlowSelectPage_default as toAuthFlowSelectPage, toError_default as toError, toSelectOption_default as toSelectOption, toSelectOptions_default as toSelectOptions, toUserSelectOption_default as toUserSelectOption, toUserSelectPage_default as toUserSelectPage, toUserTypeSelectPage_default as toUserTypeSelectPage, updateAgent_default as updateAgent, updateApplication_default as updateApplication, updateMeCredentials_default as updateMeCredentials, updateMeProfile_default as updateMeProfile, updateUser_default as updateUser, validateLogoutTokenClaims_default as validateLogoutTokenClaims, warn, withRetry_default as withRetry, withVendorCSSClassPrefix_default as withVendorCSSClassPrefix };
+export { AgentQueryKeys_default as AgentQueryKeys, ApplicationNativeAuthenticationConstants_default as ApplicationNativeAuthenticationConstants, ApplicationQueryKeys_default as ApplicationQueryKeys, AuthFlowSelectConstants_default as AuthFlowSelectConstants, AuthenticationHelper_default as AuthenticationHelper, BackchannelLogoutConstants_default as BackchannelLogoutConstants, ConsentConstants_default as ConsentConstants, CredentialConstants_default as CredentialConstants, DEFAULT_THEME, DEFAULT_VALIDATION_MESSAGE_KEYS, EMOJI_URI_SCHEME, EmbeddedFlowActionVariant, EmbeddedFlowComponentType, EmbeddedFlowEventType, EmbeddedFlowResponseType, EmbeddedFlowTextVariant, EmbeddedFlowType, EmbeddedRecoveryFlowStatus, EmbeddedRecoveryFlowType, EmbeddedSignInFlowStatus, EmbeddedSignInFlowType, EmbeddedSignUpFlowStatus, EmbeddedSignUpFlowType, FieldType, FlowMetaType, FlowMode, HttpClient, InboundAuthTypes, InvalidLogoutTokenError, IsomorphicCrypto, OAuth2GrantTypes, OAuth2ResponseTypes, OIDCRequestConstants_default as OIDCRequestConstants, REFRESH_TOKEN_ISSUING_GRANTS, SelectConstants_default as SelectConstants, StorageManager_default as StorageManager, ThunderIDAPIError, ThunderIDAuthException, ThunderIDError, ThunderIDJavaScriptClient_default as ThunderIDJavaScriptClient, ThunderIDRuntimeError, TokenConstants_default as TokenConstants, TokenEndpointAuthMethods, TranslationBundleConstants_default as TranslationBundleConstants, UserQueryKeys_default as UserQueryKeys, UserSelectConstants_default as UserSelectConstants, UserTypeSelectConstants_default as UserTypeSelectConstants, VendorConstants_default as VendorConstants, arrayBufferToBase64url_default as arrayBufferToBase64url, base64urlToArrayBuffer_default as base64urlToArrayBuffer, bem_default as bem, buildValidatorFromRules_default as buildValidatorFromRules, capPageSize_default as capPageSize, computeNextPageOffset_default as computeNextPageOffset, configure as configureLogger, countryCodeToFlagEmoji, createAgent_default as createAgent, createApplication_default as createApplication, createComponentLogger, createLogger, createPackageComponentLogger, createPackageLogger, createResourceFailureLogger, createResourceOptionsLoader_default as createResourceOptionsLoader, createTheme_default as createTheme, createUser_default as createUser, debug, dedupeSelectOptions_default as dedupeSelectOptions, deepMerge_default as deepMerge, deleteAgent_default as deleteAgent, deleteApplication_default as deleteApplication, deleteUser_default as deleteUser, error, evaluateChangePasswordForm_default as evaluateChangePasswordForm, evaluatePasswordPolicy_default as evaluatePasswordPolicy, evaluateValidationRule_default as evaluateValidationRule, executeEmbeddedRecoveryFlow_default as executeEmbeddedRecoveryFlow, executeEmbeddedSignInFlow_default as executeEmbeddedSignInFlow, executeEmbeddedSignUpFlow_default as executeEmbeddedSignUpFlow, executeEmbeddedUserOnboardingFlow_default as executeEmbeddedUserOnboardingFlow, extractEmojiFromUri_default as extractEmojiFromUri, extractPkceStorageKeyFromState_default as extractPkceStorageKeyFromState, extractUserClaimsFromIdToken_default as extractUserClaimsFromIdToken, formatDate_default as formatDate, generateFlattenedUserProfile_default as generateFlattenedUserProfile, get_default as get, getAgent_default as getAgent, getAgents_default as getAgents, getApplication_default as getApplication, getApplications_default as getApplications, getBaseLanguage, getDefaultI18nBundles_default as getDefaultI18nBundles, getFlowMeta_default as getFlowMeta, getFlows_default as getFlows, getLatestStateParam_default as getLatestStateParam, getOrganizationUnitChildren_default as getOrganizationUnitChildren, getRedirectBasedSignUpUrl_default as getRedirectBasedSignUpUrl, getSelectMessages_default as getSelectMessages, getUser_default as getUser, getUserInfo_default as getUserInfo, getUserTypes_default as getUserTypes, getUsers_default as getUsers, getUsersMe_default as getUsersMe, getUsersMeMeta_default as getUsersMeMeta, getVendorPrefix_default as getVendorPrefix, hasUnresolvedTranslationParams, info, isAdvancingPageOffset_default as isAdvancingPageOffset, isEmojiUri_default as isEmojiUri, isEmpty_default as isEmpty, isRecognizedBaseUrlPattern_default as isRecognizedBaseUrlPattern, isRetryableError_default as isRetryableError, loadPageWithRetryAndLog_default as loadPageWithRetryAndLog, loadUntilOptionsGrow_default as loadUntilOptionsGrow, logResourceFailure, logger_default as logger, mapCredentialUpdateError_default as mapCredentialUpdateError, mapSelectPageError_default as mapSelectPageError, mergeOptionsBatch_default as mergeOptionsBatch, normalizeLocaleTag, normalizeSelectOptions_default as normalizeSelectOptions, normalizeTranslations_default as normalizeTranslations, parseKeyValuePairs_default as parseKeyValuePairs, parseSelectPageQuery_default as parseSelectPageQuery, processOpenIDScopes_default as processOpenIDScopes, removeTrailingSlash_default as removeTrailingSlash, resolveBackendEndpoints_default as resolveBackendEndpoints, resolveChangeCredentialPolicy_default as resolveChangeCredentialPolicy, resolveFieldName_default as resolveFieldName, resolveFlowTemplateLiterals, resolveLocaleDisplayName, resolveLocaleEmoji_default as resolveLocaleEmoji, resolveMeta, resolvePageSize_default as resolvePageSize, resolveResourceEndpoint_default as resolveResourceEndpoint, set_default as set, startCase_default as startCase, substituteTranslationParams_default as substituteTranslationParams, supportsCredential_default as supportsCredential, toAuthFlowSelectPage_default as toAuthFlowSelectPage, toError_default as toError, toSelectOption_default as toSelectOption, toSelectOptions_default as toSelectOptions, toUserSelectOption_default as toUserSelectOption, toUserSelectPage_default as toUserSelectPage, toUserTypeSelectPage_default as toUserTypeSelectPage, updateAgent_default as updateAgent, updateApplication_default as updateApplication, updateMeCredentials_default as updateMeCredentials, updateMeProfile_default as updateMeProfile, updateUser_default as updateUser, validateLogoutTokenClaims_default as validateLogoutTokenClaims, warn, withRetry_default as withRetry, withVendorCSSClassPrefix_default as withVendorCSSClassPrefix };

package/dist/models/backend.d.ts

@@ -0,0 +1,72 @@
+/**
+ * The app backend's auth endpoints, set under `endpoints.backend`. Setting them hands sign-in to the
+ * app's backend (the Backend for Frontend pattern): the backend, on the app's own origin, runs the
+ * OAuth flow and keeps the tokens. The browser only holds an `HttpOnly` cookie it cannot read, and
+ * API calls go through the backend, which attaches the access token.
+ *
+ * Any endpoint left unset defaults to a fixed path under `/api/auth`.
+ *
+ * @example
+ * endpoints: {backend: {signIn: '/api/auth/signin'}}
+ */
+export interface BackendEndpoints {
+    /** Starts sign-in. Defaults to `/api/auth/signin`. */
+    signIn?: string;
+    /** Reports the signed-in user. Defaults to `/api/auth/session`. */
+    session?: string;
+    /**
+     * Reports only whether the session is still live, without refreshing it or counting as activity,
+     * so the SDK can poll it. Defaults to `/api/auth/checksession`.
+     */
+    checkSession?: string;
+    /** Refreshes the session. Defaults to `/api/auth/refresh`. */
+    refresh?: string;
+    /** Ends the session. Defaults to `/api/auth/signout`. */
+    signOut?: string;
+    /**
+     * Prefix of the API proxy. Requests under `baseUrl`, or under the app's origin when `baseUrl` is
+     * not set, are sent through it. Defaults to `/api/auth/proxy`.
+     */
+    proxy?: string;
+    /**
+     * Issues the access token for `bypass`, as an OAuth token response without a refresh token.
+     * Defaults to `/api/auth/token`.
+     */
+    token?: string;
+    /** Requests that skip the proxy and go straight from the browser. */
+    bypass?: BackendBypass;
+}
+/**
+ * Requests the browser sends directly rather than through the proxy, such as calls to a data plane on
+ * another origin. They always carry the cookies.
+ *
+ * @example
+ * bypass: {urls: ['https://dp.example.com/api']}
+ */
+export interface BackendBypass {
+    /** Base URLs whose requests skip the proxy. A request matches its own base URL or anything under it. */
+    urls: string[];
+    /**
+     * Attach the access token from `token` as `Authorization: Bearer`, and get a new one and retry once
+     * on a 401. Defaults to `true`. With `false`, requests go out with only the cookies.
+     */
+    attachToken?: boolean;
+}
+/**
+ * The backend endpoints, fully resolved, with the API base whose requests go through the proxy.
+ */
+export type ResolvedBackendEndpoints = Required<Omit<BackendEndpoints, 'bypass'>> & {
+    apiBaseUrl: string;
+    bypass: Required<BackendBypass>;
+};
+/**
+ * What the backend's session endpoint reports.
+ */
+export interface BackendSession {
+    isSignedIn: boolean;
+    /** The ID token's user claims, without the protocol claims. */
+    user?: Record<string, unknown>;
+    /** When the access token expires, in seconds since the epoch. */
+    expiresAt?: number;
+}
+//# sourceMappingURL=backend.d.ts.map

package/dist/models/backend.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"backend.d.ts","sourceRoot":"","sources":["../../src/models/backend.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;GAUG;AACH,MAAM,WAAW,gBAAgB;IAC/B,sDAAsD;IACtD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,mEAAmE;IACnE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,8DAA8D;IAC9D,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,yDAAyD;IACzD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,qEAAqE;IACrE,MAAM,CAAC,EAAE,aAAa,CAAC;CACxB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,aAAa;IAC5B,wGAAwG;IACxG,IAAI,EAAE,MAAM,EAAE,CAAC;IACf;;;OAGG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED;;GAEG;AACH,MAAM,MAAM,wBAAwB,GAAG,QAAQ,CAAC,IAAI,CAAC,gBAAgB,EAAE,QAAQ,CAAC,CAAC,GAAG;IAClF,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,QAAQ,CAAC,aAAa,CAAC,CAAC;CACjC,CAAC;AAEF;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,UAAU,EAAE,OAAO,CAAC;IACpB,+DAA+D;IAC/D,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,iEAAiE;IACjE,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB"}

package/dist/models/client.d.ts

@@ -39,9 +39,9 @@ export interface ThunderIDClient<T> {
     getAccessToken(sessionId?: string): Promise<string>;
     /**
      * Gets the client configuration.
-     * @returns The client configuration.
+     * @returns A promise that resolves to the client configuration.
      */
-    getConfiguration(): T;
+    getConfiguration(): Promise<T>;
     /**
      * Gets user information from the session.
      *

package/dist/models/client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/models/client.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAC,mBAAmB,EAAE,oBAAoB,EAAE,eAAe,EAAC,MAAM,QAAQ,CAAC;AACvF,OAAO,EAAC,aAAa,EAAE,cAAc,EAAE,aAAa,EAAC,MAAM,UAAU,CAAC;AACtE,OAAO,EAAC,OAAO,EAAC,MAAM,SAAS,CAAC;AAChC,OAAO,EAAC,0BAA0B,EAAE,aAAa,EAAC,MAAM,SAAS,CAAC;AAClE,OAAO,EAAC,IAAI,EAAE,WAAW,EAAC,MAAM,QAAQ,CAAC;AAEzC;;;;;;;;;GASG;AACH,MAAM,WAAW,eAAe,CAAC,CAAC;IAChC;;;OAGG;IACH,YAAY,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAEvC;;;;OAIG;IACH,cAAc,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAEvE;;;;OAIG;IACH,aAAa,CAAC,MAAM,EAAE,0BAA0B,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,QAAQ,GAAG,IAAI,CAAC,CAAC;IAEhH;;;;OAIG;IACH,cAAc,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAEpD;;;OAGG;IACH,gBAAgB,IAAI,CAAC,CAAC;IAEtB;;;;OAIG;IACH,OAAO,CAAC,OAAO,CAAC,EAAE,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEtC;;;OAGG;IACH,YAAY,CAAC,OAAO,EAAE,mBAAmB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAE1E;;;;;;;OAOG;IACH,QAAQ,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,eAAe,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;IAEjG;;;;OAIG;IACH,cAAc,CAAC,OAAO,CAAC,EAAE,GAAG,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IAEpD;;;;;;OAMG;IACH,UAAU,CAAC,MAAM,EAAE,CAAC,EAAE,OAAO,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAE3D;;;;;OAKG;IACH,SAAS,IAAI,OAAO,CAAC;IAErB;;;;;OAKG;IACH,UAAU,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IAE/B;;;;;;;;OAQG;IACH,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAEnD,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAEzB;;;;OAIG;IACH,UAAU,CAAC,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEpF;;;;;;;OAOG;IACH,MAAM,CACJ,OAAO,CAAC,EAAE,aAAa,EACvB,SAAS,CAAC,EAAE,MAAM,EAClB,eAAe,CAAC,EAAE,CAAC,cAAc,EAAE,MAAM,KAAK,IAAI,GACjD,OAAO,CAAC,IAAI,GAAG,aAAa,GAAG,SAAS,CAAC,CAAC;IAE7C;;;;;;;;OAQG;IACH,cAAc,CAAC,OAAO,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,GAAG,OAAO,GAAG,SAAS,CAAC,CAAC;IAE7E;;;;;;OAMG;IACH,OAAO,CAAC,OAAO,CAAC,EAAE,cAAc,EAAE,YAAY,CAAC,EAAE,CAAC,eAAe,EAAE,MAAM,KAAK,IAAI,GAAG,OAAO,CAAC,MAAM,GAAG,OAAO,CAAC,CAAC;IAE/G;;;;;;;;OAQG;IACH,OAAO,CACL,OAAO,CAAC,EAAE,cAAc,EACxB,SAAS,CAAC,EAAE,MAAM,EAClB,YAAY,CAAC,EAAE,CAAC,eAAe,EAAE,MAAM,KAAK,IAAI,GAC/C,OAAO,CAAC,MAAM,GAAG,OAAO,CAAC,CAAC;IAE7B;;;;;OAKG;IACH,MAAM,CAAC,OAAO,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE/C;;;;OAIG;IACH,iBAAiB,CAAC,OAAO,EAAE,GAAG,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACjE"}
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/models/client.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAC,mBAAmB,EAAE,oBAAoB,EAAE,eAAe,EAAC,MAAM,QAAQ,CAAC;AACvF,OAAO,EAAC,aAAa,EAAE,cAAc,EAAE,aAAa,EAAC,MAAM,UAAU,CAAC;AACtE,OAAO,EAAC,OAAO,EAAC,MAAM,SAAS,CAAC;AAChC,OAAO,EAAC,0BAA0B,EAAE,aAAa,EAAC,MAAM,SAAS,CAAC;AAClE,OAAO,EAAC,IAAI,EAAE,WAAW,EAAC,MAAM,QAAQ,CAAC;AAEzC;;;;;;;;;GASG;AACH,MAAM,WAAW,eAAe,CAAC,CAAC;IAChC;;;OAGG;IACH,YAAY,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAEvC;;;;OAIG;IACH,cAAc,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAEvE;;;;OAIG;IACH,aAAa,CAAC,MAAM,EAAE,0BAA0B,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,QAAQ,GAAG,IAAI,CAAC,CAAC;IAEhH;;;;OAIG;IACH,cAAc,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAEpD;;;OAGG;IACH,gBAAgB,IAAI,OAAO,CAAC,CAAC,CAAC,CAAC;IAE/B;;;;OAIG;IACH,OAAO,CAAC,OAAO,CAAC,EAAE,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEtC;;;OAGG;IACH,YAAY,CAAC,OAAO,EAAE,mBAAmB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAE1E;;;;;;;OAOG;IACH,QAAQ,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,eAAe,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;IAEjG;;;;OAIG;IACH,cAAc,CAAC,OAAO,CAAC,EAAE,GAAG,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IAEpD;;;;;;OAMG;IACH,UAAU,CAAC,MAAM,EAAE,CAAC,EAAE,OAAO,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAE3D;;;;;OAKG;IACH,SAAS,IAAI,OAAO,CAAC;IAErB;;;;;OAKG;IACH,UAAU,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IAE/B;;;;;;;;OAQG;IACH,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAEnD,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAEzB;;;;OAIG;IACH,UAAU,CAAC,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEpF;;;;;;;OAOG;IACH,MAAM,CACJ,OAAO,CAAC,EAAE,aAAa,EACvB,SAAS,CAAC,EAAE,MAAM,EAClB,eAAe,CAAC,EAAE,CAAC,cAAc,EAAE,MAAM,KAAK,IAAI,GACjD,OAAO,CAAC,IAAI,GAAG,aAAa,GAAG,SAAS,CAAC,CAAC;IAE7C;;;;;;;;OAQG;IACH,cAAc,CAAC,OAAO,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,GAAG,OAAO,GAAG,SAAS,CAAC,CAAC;IAE7E;;;;;;OAMG;IACH,OAAO,CAAC,OAAO,CAAC,EAAE,cAAc,EAAE,YAAY,CAAC,EAAE,CAAC,eAAe,EAAE,MAAM,KAAK,IAAI,GAAG,OAAO,CAAC,MAAM,GAAG,OAAO,CAAC,CAAC;IAE/G;;;;;;;;OAQG;IACH,OAAO,CACL,OAAO,CAAC,EAAE,cAAc,EACxB,SAAS,CAAC,EAAE,MAAM,EAClB,YAAY,CAAC,EAAE,CAAC,eAAe,EAAE,MAAM,KAAK,IAAI,GAC/C,OAAO,CAAC,MAAM,GAAG,OAAO,CAAC,CAAC;IAE7B;;;;;OAKG;IACH,MAAM,CAAC,OAAO,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE/C;;;;OAIG;IACH,iBAAiB,CAAC,OAAO,EAAE,GAAG,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACjE"}

package/dist/models/config.d.ts

@@ -1,3 +1,4 @@
+import type { BackendEndpoints } from './backend';
 import { ComponentsExtensions } from './extensions/components';
 import type { OAuthResponseMode } from './oauth-response';
 import type { OIDCEndpoints } from './oidc-endpoints';
@@ -39,6 +40,14 @@ export type SignUpOptions = Record<string, unknown>;
  * Options for the ThunderID SSO session. See {@link BaseConfig.session}.
  */
 export interface SessionConfig {
+    /**
+     * How often to ask the app's backend whether the session is still live, in seconds. Only applies
+     * when sign-in runs on a backend (`endpoints.backend`): the backend's check endpoint reports
+     * liveness without refreshing the session or counting as activity, so polling it does not keep an
+     * idle session alive. Unset or `0` leaves only the check that runs when the page regains focus.
+     * @default 0
+     */
+    checkInterval?: number;
     /**
      * Silent sign-in: a `prompt=none` authorize request in a hidden iframe that signs the user in from
      * an existing ThunderID SSO session without any interaction.
@@ -261,6 +270,12 @@ export interface BaseConfig<T = unknown> extends WithPreferences, WithExtensions
          * If not provided, resolved from the well-known discovery document.
          */
         authorization?: string;
+        /**
+         * The app backend's auth endpoints. Setting them hands sign-in to the backend: the SDK then signs
+         * in, reads the session, and sends API calls through the backend, and never holds a token.
+         * Browser clients only. Unset entries default to a fixed path under `/api/auth`.
+         */
+        backend?: BackendEndpoints;
         /**
          * The end-session (logout) endpoint URL.
          * If not provided, resolved from the well-known discovery document.

package/dist/models/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/models/config.ts"],"names":[],"mappings":"AAGA,OAAO,EAAC,oBAAoB,EAAC,MAAM,yBAAyB,CAAC;AAC7D,OAAO,KAAK,EAAC,iBAAiB,EAAC,MAAM,kBAAkB,CAAC;AACxD,OAAO,KAAK,EAAC,aAAa,EAAC,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAC,uBAAuB,EAAC,MAAM,uBAAuB,CAAC;AAC9D,OAAO,EAAC,gBAAgB,EAAC,MAAM,iBAAiB,CAAC;AACjD,OAAO,EAAC,UAAU,EAAC,MAAM,qBAAqB,CAAC;AAC/C,OAAO,EAAC,WAAW,EAAE,SAAS,EAAC,MAAM,gBAAgB,CAAC;AAEtD;;;;;;;;GAQG;AACH,MAAM,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;AAEhD;;;;;;;;GAQG;AACH,MAAM,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAErD;;;;;;;;GAQG;AACH,MAAM,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAEpD;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B;;;OAGG;IACH,YAAY,CAAC,EAAE,kBAAkB,CAAC;CACnC;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC;;;;;OAKG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;IAEzB;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,UAAU,CAAC,CAAC,GAAG,OAAO,CAAE,SAAQ,eAAe,EAAE,cAAc;IAC9E;;;;;;OAMG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;IAErB;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAEhB;;;;;OAKG;IACH,YAAY,CAAC,EAAE,iBAAiB,CAAC;IAEjC;;;;;OAKG;IACH,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAEhC;;;;;;;;;OASG;IACH,0BAA0B,CAAC,EAAE,OAAO,CAAC;IAErC;;;;;;;;;;OAUG;IACH,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAE5B;;;;;;;;OAQG;IACH,cAAc,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAEpC;;;;;;;;;OASG;IACH,eAAe,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAErC;;;;;;;;;;;;;;;OAeG;IACH,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC;IAE/B;;;;;OAKG;IACH,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAEnC;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAEhB;;;OAGG;IACH,OAAO,EAAE,MAAM,GAAG,SAAS,CAAC;IAE5B;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAE9B;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAElC;;;;;;;;;;;;OAYG;IACH,SAAS,CAAC,EAAE;QACV;;;WAGG;QACH,SAAS,CAAC,EAAE;YACV;;;eAGG;YACH,OAAO,CAAC,EAAE,OAAO,CAAC;SACnB,CAAC;KACH,CAAC;IAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAmCG;IACH,SAAS,CAAC,EAAE;QACV;;;;WAIG;QACH,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB;;;;WAIG;QACH,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB;;;WAGG;QACH,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB;;;WAGG;QACH,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB;;;;WAIG;QACH,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB;;;WAGG;QACH,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB;;;WAGG;QACH,KAAK,CAAC,EAAE,MAAM,CAAC;QACf;;;WAGG;QACH,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB;;;WAGG;QACH,IAAI,CAAC,EAAE,MAAM,CAAC;QACd;;;WAGG;QACH,KAAK,CAAC,EAAE,MAAM,CAAC;QACf;;;WAGG;QACH,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB;;;;WAIG;QACH,KAAK,CAAC,EAAE,MAAM,CAAC;QACf;;;WAGG;QACH,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB;;;;WAIG;QACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;QAC5B;;;WAGG;QACH,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB;;;WAGG;QACH,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB;;;WAGG;QACH,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,CAAC;IAEF;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB;;;;;;;;OAQG;IACH,IAAI,CAAC,EAAE,UAAU,GAAG,UAAU,CAAC;IAE/B;;;;;;;;;;OAUG;IACH,SAAS,CAAC,EAAE,oBAAoB,GAAG,oBAAoB,CAAC;IAExD;;;;OAIG;IACH,iBAAiB,CAAC,EAAE;QAClB;;;WAGG;QACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;QAC1B;;;WAGG;QACH,oBAAoB,CAAC,EAAE,MAAM,CAAC;KAC/B,CAAC;IAEF;;;;;OAKG;IACH,kBAAkB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAExC;;;;;;;;;;;OAWG;IACH,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC;IAEvC;;;OAGG;IACH,aAAa,CAAC,EAAE,aAAa,CAAC;IAE9B;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAE/B;;;OAGG;IACH,cAAc,CAAC,EAAE,cAAc,CAAC;IAEhC;;;OAGG;IACH,aAAa,CAAC,EAAE,aAAa,CAAC;IAE9B;;;;;OAKG;IACH,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAE/B;;;OAGG;IACH,OAAO,CAAC,EAAE,CAAC,CAAC;IAEZ;;;;;;;;OAQG;IACH,OAAO,CAAC,EAAE,aAAa,CAAC;IAExB;;OAEG;IACH,cAAc,CAAC,EAAE;QACf;;WAEG;QACH,YAAY,CAAC,EAAE;YACb;;eAEG;YACH,WAAW,CAAC,EAAE,OAAO,CAAC;SACvB,CAAC;QAEF;;WAEG;QACH,WAAW,CAAC,EAAE;YACZ;;;;;;;;;eASG;YACH,eAAe,CAAC,EAAE,OAAO,CAAC;SAC3B,CAAC;KACH,CAAC;IAEF;;OAEG;IACH,YAAY,CAAC,EAAE;QACb;;;;;;;;;;WAUG;QACH,UAAU,CAAC,EAAE,uBAAuB,CAAC;QACrC;;;;;;WAMG;QACH,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KAClC,CAAC;IAEF;;;;;;OAMG;IACH,eAAe,CAAC,EAAE;QAChB;;WAEG;QACH,OAAO,CAAC,EAAE;YACR;;eAEG;YACH,cAAc,CAAC,EAAE,MAAM,CAAC;YACxB;;eAEG;YACH,QAAQ,CAAC,EAAE,OAAO,CAAC;YACnB;;eAEG;YACH,cAAc,CAAC,EAAE,OAAO,CAAC;SAC1B,CAAC;KACH,CAAC;CACH;AAED,MAAM,WAAW,eAAe;IAC9B;;OAEG;IACH,WAAW,CAAC,EAAE,WAAW,CAAC;CAC3B;AAED,MAAM,WAAW,UAAU;IACzB;;OAEG;IACH,UAAU,CAAC,EAAE,oBAAoB,CAAC;CACnC;AAED,MAAM,WAAW,cAAc;IAC7B;;OAEG;IACH,UAAU,CAAC,EAAE,UAAU,CAAC;CACzB;AAED,MAAM,MAAM,MAAM,CAAC,CAAC,GAAG,OAAO,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC;AAEhD,MAAM,WAAW,gBAAgB;IAC/B;;;OAGG;IACH,SAAS,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC;IAC1B;;OAEG;IACH,IAAI,CAAC,EAAE,SAAS,CAAC;IACjB;;OAEG;IACH,SAAS,CAAC,EAAE,gBAAgB,CAAC,WAAW,CAAC,CAAC;CAC3C;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,mBAAmB,GAAG,QAAQ,GAAG,cAAc,GAAG,MAAM,CAAC;AAErE,MAAM,WAAW,eAAe;IAC9B;;OAEG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IACrC;;;;;;OAMG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;OAGG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;OAGG;IACH,eAAe,CAAC,EAAE,mBAAmB,CAAC;IACtC;;;;;;;;OAQG;IACH,QAAQ,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC;CAC3B;AAED,MAAM,WAAW,eAAe;IAC9B;;;;;;;;OAQG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC5B;AAED,MAAM,WAAW,WAAW;IAC1B;;OAEG;IACH,IAAI,CAAC,EAAE,eAAe,CAAC;IACvB;;OAEG;IACH,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B;;OAEG;IACH,KAAK,CAAC,EAAE,gBAAgB,CAAC;IACzB;;;OAGG;IACH,IAAI,CAAC,EAAE,eAAe,CAAC;CACxB;AAED;;;;;GAKG;AACH,MAAM,MAAM,gBAAgB,CAAC,CAAC,GAAG,OAAO,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC;AAEtD;;;GAGG;AACH,MAAM,MAAM,sBAAsB,GAAG,MAAM,CAAC;AAE5C;;;GAGG;AACH,MAAM,MAAM,uBAAuB,GAAG,MAAM,CAAC;AAE7C;;;GAGG;AACH,MAAM,MAAM,yBAAyB,GAAG,MAAM,GAAG;IAAC,SAAS,CAAC,EAAE;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAC,CAAA;CAAC,CAAC;AAEpF;;GAEG;AACH,MAAM,MAAM,uBAAuB,GAAG,MAAM,GAAG;IAAC,OAAO,EAAE,MAAM,CAAA;CAAC,CAAC;AAEjE;;GAEG;AACH,MAAM,MAAM,wBAAwB,GAAG,MAAM,GAAG;IAAC,SAAS,EAAE,OAAO,CAAC,aAAa,CAAC,CAAA;CAAC,CAAC"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/models/config.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAC,gBAAgB,EAAC,MAAM,WAAW,CAAC;AAChD,OAAO,EAAC,oBAAoB,EAAC,MAAM,yBAAyB,CAAC;AAC7D,OAAO,KAAK,EAAC,iBAAiB,EAAC,MAAM,kBAAkB,CAAC;AACxD,OAAO,KAAK,EAAC,aAAa,EAAC,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAC,uBAAuB,EAAC,MAAM,uBAAuB,CAAC;AAC9D,OAAO,EAAC,gBAAgB,EAAC,MAAM,iBAAiB,CAAC;AACjD,OAAO,EAAC,UAAU,EAAC,MAAM,qBAAqB,CAAC;AAC/C,OAAO,EAAC,WAAW,EAAE,SAAS,EAAC,MAAM,gBAAgB,CAAC;AAEtD;;;;;;;;GAQG;AACH,MAAM,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;AAEhD;;;;;;;;GAQG;AACH,MAAM,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAErD;;;;;;;;GAQG;AACH,MAAM,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAEpD;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B;;;;;;OAMG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IAEvB;;;OAGG;IACH,YAAY,CAAC,EAAE,kBAAkB,CAAC;CACnC;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC;;;;;OAKG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;IAEzB;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,UAAU,CAAC,CAAC,GAAG,OAAO,CAAE,SAAQ,eAAe,EAAE,cAAc;IAC9E;;;;;;OAMG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;IAErB;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAEhB;;;;;OAKG;IACH,YAAY,CAAC,EAAE,iBAAiB,CAAC;IAEjC;;;;;OAKG;IACH,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAEhC;;;;;;;;;OASG;IACH,0BAA0B,CAAC,EAAE,OAAO,CAAC;IAErC;;;;;;;;;;OAUG;IACH,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAE5B;;;;;;;;OAQG;IACH,cAAc,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAEpC;;;;;;;;;OASG;IACH,eAAe,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAErC;;;;;;;;;;;;;;;OAeG;IACH,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC;IAE/B;;;;;OAKG;IACH,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAEnC;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAEhB;;;OAGG;IACH,OAAO,EAAE,MAAM,GAAG,SAAS,CAAC;IAE5B;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAE9B;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAElC;;;;;;;;;;;;OAYG;IACH,SAAS,CAAC,EAAE;QACV;;;WAGG;QACH,SAAS,CAAC,EAAE;YACV;;;eAGG;YACH,OAAO,CAAC,EAAE,OAAO,CAAC;SACnB,CAAC;KACH,CAAC;IAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAmCG;IACH,SAAS,CAAC,EAAE;QACV;;;;WAIG;QACH,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB;;;;WAIG;QACH,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB;;;WAGG;QACH,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB;;;;WAIG;QACH,OAAO,CAAC,EAAE,gBAAgB,CAAC;QAC3B;;;WAGG;QACH,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB;;;;WAIG;QACH,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB;;;WAGG;QACH,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB;;;WAGG;QACH,KAAK,CAAC,EAAE,MAAM,CAAC;QACf;;;WAGG;QACH,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB;;;WAGG;QACH,IAAI,CAAC,EAAE,MAAM,CAAC;QACd;;;WAGG;QACH,KAAK,CAAC,EAAE,MAAM,CAAC;QACf;;;WAGG;QACH,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB;;;;WAIG;QACH,KAAK,CAAC,EAAE,MAAM,CAAC;QACf;;;WAGG;QACH,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB;;;;WAIG;QACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;QAC5B;;;WAGG;QACH,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB;;;WAGG;QACH,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB;;;WAGG;QACH,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,CAAC;IAEF;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB;;;;;;;;OAQG;IACH,IAAI,CAAC,EAAE,UAAU,GAAG,UAAU,CAAC;IAE/B;;;;;;;;;;OAUG;IACH,SAAS,CAAC,EAAE,oBAAoB,GAAG,oBAAoB,CAAC;IAExD;;;;OAIG;IACH,iBAAiB,CAAC,EAAE;QAClB;;;WAGG;QACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;QAC1B;;;WAGG;QACH,oBAAoB,CAAC,EAAE,MAAM,CAAC;KAC/B,CAAC;IAEF;;;;;OAKG;IACH,kBAAkB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAExC;;;;;;;;;;;OAWG;IACH,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC;IAEvC;;;OAGG;IACH,aAAa,CAAC,EAAE,aAAa,CAAC;IAE9B;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAE/B;;;OAGG;IACH,cAAc,CAAC,EAAE,cAAc,CAAC;IAEhC;;;OAGG;IACH,aAAa,CAAC,EAAE,aAAa,CAAC;IAE9B;;;;;OAKG;IACH,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAE/B;;;OAGG;IACH,OAAO,CAAC,EAAE,CAAC,CAAC;IAEZ;;;;;;;;OAQG;IACH,OAAO,CAAC,EAAE,aAAa,CAAC;IAExB;;OAEG;IACH,cAAc,CAAC,EAAE;QACf;;WAEG;QACH,YAAY,CAAC,EAAE;YACb;;eAEG;YACH,WAAW,CAAC,EAAE,OAAO,CAAC;SACvB,CAAC;QAEF;;WAEG;QACH,WAAW,CAAC,EAAE;YACZ;;;;;;;;;eASG;YACH,eAAe,CAAC,EAAE,OAAO,CAAC;SAC3B,CAAC;KACH,CAAC;IAEF;;OAEG;IACH,YAAY,CAAC,EAAE;QACb;;;;;;;;;;WAUG;QACH,UAAU,CAAC,EAAE,uBAAuB,CAAC;QACrC;;;;;;WAMG;QACH,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KAClC,CAAC;IAEF;;;;;;OAMG;IACH,eAAe,CAAC,EAAE;QAChB;;WAEG;QACH,OAAO,CAAC,EAAE;YACR;;eAEG;YACH,cAAc,CAAC,EAAE,MAAM,CAAC;YACxB;;eAEG;YACH,QAAQ,CAAC,EAAE,OAAO,CAAC;YACnB;;eAEG;YACH,cAAc,CAAC,EAAE,OAAO,CAAC;SAC1B,CAAC;KACH,CAAC;CACH;AAED,MAAM,WAAW,eAAe;IAC9B;;OAEG;IACH,WAAW,CAAC,EAAE,WAAW,CAAC;CAC3B;AAED,MAAM,WAAW,UAAU;IACzB;;OAEG;IACH,UAAU,CAAC,EAAE,oBAAoB,CAAC;CACnC;AAED,MAAM,WAAW,cAAc;IAC7B;;OAEG;IACH,UAAU,CAAC,EAAE,UAAU,CAAC;CACzB;AAED,MAAM,MAAM,MAAM,CAAC,CAAC,GAAG,OAAO,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC;AAEhD,MAAM,WAAW,gBAAgB;IAC/B;;;OAGG;IACH,SAAS,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC;IAC1B;;OAEG;IACH,IAAI,CAAC,EAAE,SAAS,CAAC;IACjB;;OAEG;IACH,SAAS,CAAC,EAAE,gBAAgB,CAAC,WAAW,CAAC,CAAC;CAC3C;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,mBAAmB,GAAG,QAAQ,GAAG,cAAc,GAAG,MAAM,CAAC;AAErE,MAAM,WAAW,eAAe;IAC9B;;OAEG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IACrC;;;;;;OAMG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;OAGG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;OAGG;IACH,eAAe,CAAC,EAAE,mBAAmB,CAAC;IACtC;;;;;;;;OAQG;IACH,QAAQ,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC;CAC3B;AAED,MAAM,WAAW,eAAe;IAC9B;;;;;;;;OAQG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC5B;AAED,MAAM,WAAW,WAAW;IAC1B;;OAEG;IACH,IAAI,CAAC,EAAE,eAAe,CAAC;IACvB;;OAEG;IACH,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B;;OAEG;IACH,KAAK,CAAC,EAAE,gBAAgB,CAAC;IACzB;;;OAGG;IACH,IAAI,CAAC,EAAE,eAAe,CAAC;CACxB;AAED;;;;;GAKG;AACH,MAAM,MAAM,gBAAgB,CAAC,CAAC,GAAG,OAAO,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC;AAEtD;;;GAGG;AACH,MAAM,MAAM,sBAAsB,GAAG,MAAM,CAAC;AAE5C;;;GAGG;AACH,MAAM,MAAM,uBAAuB,GAAG,MAAM,CAAC;AAE7C;;;GAGG;AACH,MAAM,MAAM,yBAAyB,GAAG,MAAM,GAAG;IAAC,SAAS,CAAC,EAAE;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAC,CAAA;CAAC,CAAC;AAEpF;;GAEG;AACH,MAAM,MAAM,uBAAuB,GAAG,MAAM,GAAG;IAAC,OAAO,EAAE,MAAM,CAAA;CAAC,CAAC;AAEjE;;GAEG;AACH,MAAM,MAAM,wBAAwB,GAAG,MAAM,GAAG;IAAC,SAAS,EAAE,OAAO,CAAC,aAAa,CAAC,CAAA;CAAC,CAAC"}

package/dist/utils/AuthenticationHelper.d.ts

@@ -29,7 +29,7 @@ declare class AuthenticationHelper<T> {
      * Maps the config-defined OIDC endpoint overrides to their discovery-metadata form.
      *
      * Endpoint names are converted from camelCase to snake_case, and resource-server endpoints
-     * (`RESOURCE_ENDPOINT_KEYS`) are excluded — those are resolved separately via
+     * (`RESOURCE_ENDPOINT_KEYS`) and the backend overrides are excluded — those are resolved separately via
      * `resolveResourceEndpoint` and must not leak into the OIDC provider metadata.
      *
      * @param configData - The resolved auth client config.