@thunderid/node 1.3.1 → 1.5.0

package/dist/ThunderIDNodeClient.d.ts

@@ -1,5 +1,6 @@
 import { BackchannelLogoutResult, ExtendedAuthorizeRequestUrlParams, IdToken, ManagedFlowListResponse, ManagedUserListResponse, ManagedUserTypeListResponse, OIDCEndpoints, Storage, ThunderIDJavaScriptClient, TokenExchangeRequestConfig, TokenResponse, User } from '@thunderid/javascript';
 import { ThunderIDNodeConfig } from './models/config';
+import { ThunderIDNodeManagementClient } from './models/management';
 declare class ThunderIDNodeClient<T extends ThunderIDNodeConfig = ThunderIDNodeConfig> extends ThunderIDJavaScriptClient<T> {
     private _nodeInstanceId;
     private _handledLogoutTokens;
@@ -74,6 +75,38 @@ declare class ThunderIDNodeClient<T extends ThunderIDNodeConfig = ThunderIDNodeC
      * `userId`. The access token stays on the server.
      */
     private managementRequestConfig;
+    /**
+     * Returns the management operations (users, groups, roles, agents, and their sub-resources) bound
+     * to the session identified by `sessionId`.
+     *
+     * Every request is authorized with that session's access token, read at the time of each call; the
+     * token is never copied onto the returned object or exposed to the caller. Whether a call succeeds
+     * is the server's decision: the token needs the permissions the server requires for that resource.
+     *
+     * The collection URL comes from, in order: the `url` passed to the call, then `endpoints.<resource>`
+     * in the configuration, then `{baseUrl}/{collection}`.
+     *
+     * @param sessionId - The session whose access token authorizes the requests.
+     * @returns The session-bound management client.
+     * @throws {ThunderIDRuntimeError} `NODE-MANAGEMENT-RC-NF01`, from an operation, when the session
+     *   has no access token. Raised before any request is sent.
+     * @throws {ThunderIDAPIError} From an operation, when the server rejects the request. HTTP 403 and
+     *   404 surface as `<operation>-ForbiddenError-001` and `<operation>-NotFoundError-001`.
+     *
+     * @example
+     * ```typescript
+     * const admin = client.management(sessionId);
+     * const {users, totalResults} = await admin.users.list({limit: 20});
+     * await admin.groups.addMembers(groupId, [{id: users[0].id, type: 'user'}]);
+     * ```
+     */
+    management(sessionId?: string): ThunderIDNodeManagementClient;
+    /**
+     * The URL inputs and bearer token for a management request made through {@link management}. Unlike
+     * {@link managementRequestConfig}, a session without an access token is refused here rather than
+     * sent to the server with an empty credential.
+     */
+    private sessionManagementRequestConfig;
     /**
      * Retrieves one page of the user directory on behalf of the session identified by `userId`.
      *

package/dist/ThunderIDNodeClient.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ThunderIDNodeClient.d.ts","sourceRoot":"","sources":["../src/ThunderIDNodeClient.ts"],"names":[],"mappings":"AAGA,OAAO,EAGL,uBAAuB,EACvB,iCAAiC,EAIjC,OAAO,EAIP,uBAAuB,EACvB,uBAAuB,EACvB,2BAA2B,EAC3B,aAAa,EAGb,OAAO,EAEP,yBAAyB,EACzB,0BAA0B,EAC1B,aAAa,EAEb,IAAI,EACL,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EAAC,mBAAmB,EAAC,MAAM,iBAAiB,CAAC;AAKpD,cAAM,mBAAmB,CAAC,CAAC,SAAS,mBAAmB,GAAG,mBAAmB,CAAE,SAAQ,yBAAyB,CAAC,CAAC,CAAC;IACjH,OAAO,CAAC,eAAe,CAAK;IAG5B,OAAO,CAAC,oBAAoB,CAAkD;IAG9E,OAAO,CAAC,kBAAkB,CAGtB;gBAEe,UAAU,SAAI;IAKX,UAAU,CAAC,MAAM,EAAE,CAAC,EAAE,OAAO,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IAMhE,aAAa,IAAI,MAAM;IAIjB,MAAM,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC,aAAa,CAAC;IAsE9C,YAAY,CAChC,aAAa,CAAC,EAAE,iCAAiC,EACjD,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,MAAM,CAAC;IAcI,OAAO,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC;IAe9D;;;;;;;;;;;;;OAaG;IACU,uBAAuB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,CAAC;IAsD3F;;;;;OAKG;YACW,aAAa;IAYX,YAAY,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI;cAI7B,iBAAiB,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAK7E;;;OAGG;YACW,YAAY;YAYZ,kBAAkB;IAgBhC;;;OAGG;IACH,OAAO,CAAC,iBAAiB;IAezB,OAAO,CAAC,eAAe;IAIvB;;;;OAIG;IACmB,UAAU,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAkC7C,UAAU,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAalE;;;OAGG;IACmB,kBAAkB,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC;IAsBlE,iBAAiB,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,OAAO,CAAC;IAO/D,iBAAiB,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAItE,cAAc,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAIhD,OAAO,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIvC,0BAA0B,IAAI,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IAI7D,aAAa,CACjC,MAAM,EAAE,0BAA0B,EAClC,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,aAAa,GAAG,QAAQ,GAAG,IAAI,CAAC;IAI3C;;;OAGG;IACU,qBAAqB,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAcnG;;;OAGG;YACW,uBAAuB;IAerC;;;;OAIG;IACU,QAAQ,CACnB,OAAO,GAAE;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,WAAW,CAAA;KAAM,EACtF,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,uBAAuB,CAAC;IAInC;;;;OAIG;IACU,QAAQ,CACnB,OAAO,GAAE;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,WAAW,CAAA;KAAM,EACxF,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,uBAAuB,CAAC;IAInC;;;;OAIG;IACU,YAAY,CACvB,OAAO,GAAE;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,WAAW,CAAA;KAAM,EACrE,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,2BAA2B,CAAC;CAGxC;AAED,eAAe,mBAAmB,CAAC"}
+{"version":3,"file":"ThunderIDNodeClient.d.ts","sourceRoot":"","sources":["../src/ThunderIDNodeClient.ts"],"names":[],"mappings":"AAGA,OAAO,EAGL,uBAAuB,EACvB,iCAAiC,EAIjC,OAAO,EAIP,uBAAuB,EACvB,uBAAuB,EACvB,2BAA2B,EAC3B,aAAa,EAGb,OAAO,EAEP,yBAAyB,EACzB,0BAA0B,EAE1B,aAAa,EAEb,IAAI,EACL,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EAAC,mBAAmB,EAAC,MAAM,iBAAiB,CAAC;AACpD,OAAO,EAAwB,6BAA6B,EAAC,MAAM,qBAAqB,CAAC;AAMzF,cAAM,mBAAmB,CAAC,CAAC,SAAS,mBAAmB,GAAG,mBAAmB,CAAE,SAAQ,yBAAyB,CAAC,CAAC,CAAC;IACjH,OAAO,CAAC,eAAe,CAAK;IAG5B,OAAO,CAAC,oBAAoB,CAAkD;IAG9E,OAAO,CAAC,kBAAkB,CAGtB;gBAEe,UAAU,SAAI;IAKX,UAAU,CAAC,MAAM,EAAE,CAAC,EAAE,OAAO,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IAMhE,aAAa,IAAI,MAAM;IAIjB,MAAM,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC,aAAa,CAAC;IAsE9C,YAAY,CAChC,aAAa,CAAC,EAAE,iCAAiC,EACjD,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,MAAM,CAAC;IAcI,OAAO,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC;IAe9D;;;;;;;;;;;;;OAaG;IACU,uBAAuB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,CAAC;IAsD3F;;;;;OAKG;YACW,aAAa;IAYX,YAAY,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI;cAI7B,iBAAiB,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAK7E;;;OAGG;YACW,YAAY;YAYZ,kBAAkB;IAgBhC;;;OAGG;IACH,OAAO,CAAC,iBAAiB;IAezB,OAAO,CAAC,eAAe;IAIvB;;;;OAIG;IACmB,UAAU,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAkC7C,UAAU,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAalE;;;OAGG;IACmB,kBAAkB,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC;IAsBlE,iBAAiB,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,OAAO,CAAC;IAO/D,iBAAiB,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAItE,cAAc,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAIhD,OAAO,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIvC,0BAA0B,IAAI,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IAI7D,aAAa,CACjC,MAAM,EAAE,0BAA0B,EAClC,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,aAAa,GAAG,QAAQ,GAAG,IAAI,CAAC;IAI3C;;;OAGG;IACU,qBAAqB,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAcnG;;;OAGG;YACW,uBAAuB;IAerC;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACI,UAAU,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,6BAA6B;IAMpE;;;;OAIG;YACW,8BAA8B;IAyB5C;;;;OAIG;IACU,QAAQ,CACnB,OAAO,GAAE;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,WAAW,CAAA;KAAM,EACtF,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,uBAAuB,CAAC;IAInC;;;;OAIG;IACU,QAAQ,CACnB,OAAO,GAAE;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,WAAW,CAAA;KAAM,EACxF,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,uBAAuB,CAAC;IAInC;;;;OAIG;IACU,YAAY,CACvB,OAAO,GAAE;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,WAAW,CAAA;KAAM,EACrE,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,2BAA2B,CAAC;CAGxC;AAED,eAAe,mBAAmB,CAAC"}

package/dist/cjs/index.cjs

@@ -58,6 +58,202 @@ var MemoryCacheStore = class {
 };
 var MemoryCacheStore_default = MemoryCacheStore;
 
+//#endregion
+//#region src/utils/createManagementClient.ts
+/**
+* Rejects a missing or blank resource identifier before any request is made. The core API functions
+* reject a blank string, but an `undefined` identifier would otherwise address the whole collection,
+* which for a delete or update is never what the caller meant. Uses the same code the core raises.
+*/
+const requireId = (id, operation) => {
+	if (typeof id !== "string" || id.trim() === "") throw new __thunderid_javascript.ThunderIDAPIError("A resource identifier is required.", `${operation}-ValidationError-002`, "node", 400, "The provided resource identifier is empty.");
+	return id;
+};
+/**
+* Builds the server-side management client for one session.
+*
+* Each operation resolves its request config through `resolve` at call time, so the access token is
+* read fresh for every request and never held by the returned object.
+*
+* @param resolve - Supplies the base URL, collection URL, and `Authorization` header for a request.
+* @returns The session-bound management operations.
+*/
+const createManagementClient = (resolve) => {
+	const config = async (key, { fetcher, signal, url } = {}) => ({
+		...fetcher ? { fetcher } : {},
+		...signal ? { signal } : {},
+		...await resolve(key, url)
+	});
+	return {
+		agentTypes: { list: async ({ limit, offset,...options } = {}) => (0, __thunderid_javascript.getAgentTypes)({
+			limit,
+			offset,
+			...await config("agentTypes", options)
+		}) },
+		agents: {
+			create: async (payload, options) => (0, __thunderid_javascript.createAgent)({
+				payload,
+				...await config("agents", options)
+			}),
+			delete: async (agentId, options) => (0, __thunderid_javascript.deleteAgent)({
+				agentId: requireId(agentId, "deleteAgent"),
+				...await config("agents", options)
+			}),
+			get: async (agentId, options) => (0, __thunderid_javascript.getAgent)({
+				agentId: requireId(agentId, "getAgent"),
+				...await config("agents", options)
+			}),
+			list: async ({ filter, limit, offset,...options } = {}) => (0, __thunderid_javascript.getAgents)({
+				filter,
+				limit,
+				offset,
+				...await config("agents", options)
+			}),
+			listGroups: async (agentId, { limit, offset,...options } = {}) => (0, __thunderid_javascript.getAgentGroups)({
+				agentId: requireId(agentId, "getAgentGroups"),
+				limit,
+				offset,
+				...await config("agents", options)
+			}),
+			listRoles: async (agentId, { limit, offset,...options } = {}) => (0, __thunderid_javascript.getAgentRoles)({
+				agentId: requireId(agentId, "getAgentRoles"),
+				limit,
+				offset,
+				...await config("agents", options)
+			}),
+			update: async (agentId, payload, options) => (0, __thunderid_javascript.updateAgent)({
+				agentId: requireId(agentId, "updateAgent"),
+				payload,
+				...await config("agents", options)
+			})
+		},
+		flows: { list: async ({ flowType, limit, offset,...options } = {}) => (0, __thunderid_javascript.getFlows)({
+			flowType,
+			limit,
+			offset,
+			...await config("flows", options)
+		}) },
+		groups: {
+			addMembers: async (groupId, members, options) => (0, __thunderid_javascript.addGroupMembers)({
+				groupId: requireId(groupId, "addGroupMembers"),
+				members,
+				...await config("groups", options)
+			}),
+			create: async (payload, options) => (0, __thunderid_javascript.createGroup)({
+				payload,
+				...await config("groups", options)
+			}),
+			delete: async (groupId, options) => (0, __thunderid_javascript.deleteGroup)({
+				groupId: requireId(groupId, "deleteGroup"),
+				...await config("groups", options)
+			}),
+			get: async (groupId, options) => (0, __thunderid_javascript.getGroup)({
+				groupId: requireId(groupId, "getGroup"),
+				...await config("groups", options)
+			}),
+			list: async ({ limit, offset,...options } = {}) => (0, __thunderid_javascript.getGroups)({
+				limit,
+				offset,
+				...await config("groups", options)
+			}),
+			listMembers: async (groupId, { limit, offset,...options } = {}) => (0, __thunderid_javascript.getGroupMembers)({
+				groupId: requireId(groupId, "getGroupMembers"),
+				limit,
+				offset,
+				...await config("groups", options)
+			}),
+			removeMembers: async (groupId, members, options) => (0, __thunderid_javascript.removeGroupMembers)({
+				groupId: requireId(groupId, "removeGroupMembers"),
+				members,
+				...await config("groups", options)
+			}),
+			update: async (groupId, payload, options) => (0, __thunderid_javascript.updateGroup)({
+				groupId: requireId(groupId, "updateGroup"),
+				payload,
+				...await config("groups", options)
+			})
+		},
+		roles: {
+			addAssignments: async (roleId, assignments, options) => (0, __thunderid_javascript.addRoleAssignments)({
+				assignments,
+				roleId: requireId(roleId, "addRoleAssignments"),
+				...await config("roles", options)
+			}),
+			create: async (payload, options) => (0, __thunderid_javascript.createRole)({
+				payload,
+				...await config("roles", options)
+			}),
+			delete: async (roleId, options) => (0, __thunderid_javascript.deleteRole)({
+				roleId: requireId(roleId, "deleteRole"),
+				...await config("roles", options)
+			}),
+			get: async (roleId, options) => (0, __thunderid_javascript.getRole)({
+				roleId: requireId(roleId, "getRole"),
+				...await config("roles", options)
+			}),
+			list: async ({ limit, offset,...options } = {}) => (0, __thunderid_javascript.getRoles)({
+				limit,
+				offset,
+				...await config("roles", options)
+			}),
+			listAssignments: async (roleId, { limit, offset, type,...options } = {}) => (0, __thunderid_javascript.getRoleAssignments)({
+				limit,
+				offset,
+				roleId: requireId(roleId, "getRoleAssignments"),
+				type,
+				...await config("roles", options)
+			}),
+			removeAssignments: async (roleId, assignments, options) => (0, __thunderid_javascript.removeRoleAssignments)({
+				assignments,
+				roleId: requireId(roleId, "removeRoleAssignments"),
+				...await config("roles", options)
+			}),
+			update: async (roleId, payload, options) => (0, __thunderid_javascript.updateRole)({
+				payload,
+				roleId: requireId(roleId, "updateRole"),
+				...await config("roles", options)
+			})
+		},
+		userTypes: { list: async ({ limit, offset,...options } = {}) => (0, __thunderid_javascript.getUserTypes)({
+			limit,
+			offset,
+			...await config("userTypes", options)
+		}) },
+		users: {
+			create: async (payload, options) => (0, __thunderid_javascript.createUser)({
+				payload,
+				...await config("users", options)
+			}),
+			delete: async (userId, options) => (0, __thunderid_javascript.deleteUser)({
+				userId: requireId(userId, "deleteUser"),
+				...await config("users", options)
+			}),
+			get: async (userId, options) => (0, __thunderid_javascript.getUser)({
+				userId: requireId(userId, "getUser"),
+				...await config("users", options)
+			}),
+			list: async ({ filter, limit, offset,...options } = {}) => (0, __thunderid_javascript.getUsers)({
+				filter,
+				limit,
+				offset,
+				...await config("users", options)
+			}),
+			listGroups: async (userId, { limit, offset,...options } = {}) => (0, __thunderid_javascript.getUserGroups)({
+				limit,
+				offset,
+				userId: requireId(userId, "getUserGroups"),
+				...await config("users", options)
+			}),
+			update: async (userId, payload, options) => (0, __thunderid_javascript.updateUser)({
+				payload,
+				userId: requireId(userId, "updateUser"),
+				...await config("users", options)
+			})
+		}
+	};
+};
+var createManagementClient_default = createManagementClient;
+
 //#endregion
 //#region src/utils/NodeCryptoUtils.ts
 /**
@@ -437,6 +633,49 @@ var ThunderIDNodeClient = class extends __thunderid_javascript.ThunderIDJavaScri
 		};
 	}
 	/**
+	* Returns the management operations (users, groups, roles, agents, and their sub-resources) bound
+	* to the session identified by `sessionId`.
+	*
+	* Every request is authorized with that session's access token, read at the time of each call; the
+	* token is never copied onto the returned object or exposed to the caller. Whether a call succeeds
+	* is the server's decision: the token needs the permissions the server requires for that resource.
+	*
+	* The collection URL comes from, in order: the `url` passed to the call, then `endpoints.<resource>`
+	* in the configuration, then `{baseUrl}/{collection}`.
+	*
+	* @param sessionId - The session whose access token authorizes the requests.
+	* @returns The session-bound management client.
+	* @throws {ThunderIDRuntimeError} `NODE-MANAGEMENT-RC-NF01`, from an operation, when the session
+	*   has no access token. Raised before any request is sent.
+	* @throws {ThunderIDAPIError} From an operation, when the server rejects the request. HTTP 403 and
+	*   404 surface as `<operation>-ForbiddenError-001` and `<operation>-NotFoundError-001`.
+	*
+	* @example
+	* ```typescript
+	* const admin = client.management(sessionId);
+	* const {users, totalResults} = await admin.users.list({limit: 20});
+	* await admin.groups.addMembers(groupId, [{id: users[0].id, type: 'user'}]);
+	* ```
+	*/
+	management(sessionId) {
+		return createManagementClient_default((key, explicitUrl) => this.sessionManagementRequestConfig(key, sessionId, explicitUrl));
+	}
+	/**
+	* The URL inputs and bearer token for a management request made through {@link management}. Unlike
+	* {@link managementRequestConfig}, a session without an access token is refused here rather than
+	* sent to the server with an empty credential.
+	*/
+	async sessionManagementRequestConfig(key, sessionId, explicitUrl) {
+		const configData = await this.getStorageManager().getConfigData();
+		const accessToken = await this.getAccessToken(sessionId);
+		if (!accessToken) throw new __thunderid_javascript.ThunderIDRuntimeError("No access token is available for the session. Sign in before calling a management operation.", "NODE-MANAGEMENT-RC-NF01", "node");
+		return {
+			baseUrl: configData?.baseUrl,
+			headers: { Authorization: `Bearer ${accessToken}` },
+			url: (0, __thunderid_javascript.resolveResourceEndpoint)(key, configData, explicitUrl)
+		};
+	}
+	/**
 	* Retrieves one page of the user directory on behalf of the session identified by `userId`.
 	*
 	* Makes a single request and does not follow `links`. The access token stays on the server.
@@ -715,6 +954,64 @@ var LoggedOutSessions_default = LoggedOutSessions;
 const generateSessionId = () => (/* @__PURE__ */ new Date()).getTime().toString(36) + Math.random().toString(36).substring(2);
 var generateSessionId_default = generateSessionId;
 
+//#endregion
+//#region src/utils/managementCollections.ts
+/**
+* The management collections a browser may reach through a server-side management relay, keyed by
+* their `endpoints` override key, with the path each one has under `baseUrl`.
+*/
+const MANAGEMENT_COLLECTIONS = {
+	agentTypes: "agent-types",
+	agents: "agents",
+	groups: "groups",
+	roles: "roles",
+	userTypes: "user-types",
+	users: "users"
+};
+const MANAGEMENT_COLLECTION_KEYS = Object.keys(MANAGEMENT_COLLECTIONS);
+/**
+* The collection URLs a management request may target for this configuration: each collection's
+* `endpoints` override, or `{baseUrl}/{path}` and the organization-scoped `{baseUrl}/o/{path}`.
+*/
+const getManagementCollectionUrls = (config) => {
+	const urls = [];
+	const baseUrl = config?.baseUrl?.replace(/\/+$/, "");
+	MANAGEMENT_COLLECTION_KEYS.forEach((key) => {
+		const override = (0, __thunderid_javascript.resolveResourceEndpoint)(key, config);
+		(override ? [override] : baseUrl ? [`${baseUrl}/${MANAGEMENT_COLLECTIONS[key]}`, `${baseUrl}/o/${MANAGEMENT_COLLECTIONS[key]}`] : []).forEach((candidate) => {
+			try {
+				urls.push(new URL(candidate.replace(/\/+$/, "")));
+			} catch {}
+		});
+	});
+	return urls;
+};
+/**
+* Whether `target` addresses one of the management collections, or a resource or sub-resource under
+* one. The comparison runs on the parsed URL, so dot segments are resolved before it, and an
+* encoded slash, backslash or dot, which an upstream could decode into a different path, is refused.
+*
+* @param target - The absolute URL the browser asked for.
+* @param collections - The allowed collection URLs, from {@link getManagementCollectionUrls}.
+* @returns The parsed URL when it is allowed, otherwise `undefined`.
+*/
+const matchManagementUrl = (target, collections) => {
+	if (typeof target !== "string" || target.length > 4096) return;
+	let url;
+	try {
+		url = new URL(target);
+	} catch {
+		return;
+	}
+	if (url.protocol !== "https:" && url.protocol !== "http:" || url.username || url.password || url.hash) return;
+	if (/%(2e|2f|5c)/i.test(url.pathname)) return;
+	return collections.some((collection) => {
+		if (collection.origin !== url.origin) return false;
+		const base = collection.pathname.replace(/\/+$/, "");
+		return url.pathname === base || url.pathname.startsWith(`${base}/`);
+	}) ? url : void 0;
+};
+
 //#endregion
 //#region src/utils/getSessionCookieOptions.ts
 const getSessionCookieOptions = (options) => ({
@@ -738,13 +1035,18 @@ exports.CookieChunking = CookieChunking_default;
 exports.CookieConfig = CookieConfig_default;
 exports.InMemoryLogoutRecordStore = InMemoryLogoutRecordStore;
 exports.LoggedOutSessions = LoggedOutSessions_default;
+exports.MANAGEMENT_COLLECTIONS = MANAGEMENT_COLLECTIONS;
+exports.MANAGEMENT_COLLECTION_KEYS = MANAGEMENT_COLLECTION_KEYS;
 exports.MemoryCacheStore = MemoryCacheStore_default;
 exports.NodeCryptoUtils = NodeCryptoUtils_default;
 exports.SessionIndex = SessionIndex_default;
 exports.SessionUtils = SessionUtils_default;
 exports.ThunderIDNodeClient = ThunderIDNodeClient_default;
+exports.createManagementClient = createManagementClient_default;
 exports.generateSessionId = generateSessionId_default;
+exports.getManagementCollectionUrls = getManagementCollectionUrls;
 exports.getSessionCookieOptions = getSessionCookieOptions_default;
+exports.matchManagementUrl = matchManagementUrl;
 Object.keys(__thunderid_javascript).forEach(function (k) {
   if (k !== 'default' && !Object.prototype.hasOwnProperty.call(exports, k)) Object.defineProperty(exports, k, {
     enumerable: true,

package/dist/index.d.ts

@@ -5,6 +5,7 @@ export { default as ThunderIDNodeClient } from './ThunderIDNodeClient';
 export { default as CookieConfig } from './constants/CookieConfig';
 export type { ThunderIDNodeConfig, SessionCookieConfig } from './models/config';
 export type { default as AuthURLCallback } from './models/AuthURLCallback';
+export type { ManagementCallOptions, ManagementGroupMemberInput, ManagementListOptions, ManagementRequestConfigResolver, ManagementResourceKey, ThunderIDNodeManagementClient, } from './models/management';
 export { default as MemoryCacheStore } from './stores/MemoryCacheStore';
 export { default as CookieChunking } from './utils/CookieChunking';
 export { default as NodeCryptoUtils } from './utils/NodeCryptoUtils';
@@ -14,6 +15,8 @@ export { default as LoggedOutSessions, InMemoryLogoutRecordStore } from './utils
 export type { LogoutRecordStore, PresentedSession } from './utils/LoggedOutSessions';
 export type { IndexedSessions, SessionBinding } from './utils/SessionIndex';
 export { default as generateSessionId } from './utils/generateSessionId';
+export { default as createManagementClient } from './utils/createManagementClient';
+export { MANAGEMENT_COLLECTIONS, MANAGEMENT_COLLECTION_KEYS, getManagementCollectionUrls, matchManagementUrl, type ManagementCollectionKey, } from './utils/managementCollections';
 export { default as getSessionCookieOptions } from './utils/getSessionCookieOptions';
 export * from '@thunderid/javascript';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAaA;;GAEG;AAGH,OAAO,EAAC,OAAO,IAAI,mBAAmB,EAAC,MAAM,uBAAuB,CAAC;AAGrE,OAAO,EAAC,OAAO,IAAI,YAAY,EAAC,MAAM,0BAA0B,CAAC;AAGjE,YAAY,EAAC,mBAAmB,EAAE,mBAAmB,EAAC,MAAM,iBAAiB,CAAC;AAC9E,YAAY,EAAC,OAAO,IAAI,eAAe,EAAC,MAAM,0BAA0B,CAAC;AAGzE,OAAO,EAAC,OAAO,IAAI,gBAAgB,EAAC,MAAM,2BAA2B,CAAC;AAGtE,OAAO,EAAC,OAAO,IAAI,cAAc,EAAC,MAAM,wBAAwB,CAAC;AACjE,OAAO,EAAC,OAAO,IAAI,eAAe,EAAC,MAAM,yBAAyB,CAAC;AACnE,OAAO,EAAC,OAAO,IAAI,YAAY,EAAC,MAAM,sBAAsB,CAAC;AAC7D,OAAO,EAAC,OAAO,IAAI,YAAY,EAAC,MAAM,sBAAsB,CAAC;AAC7D,OAAO,EAAC,OAAO,IAAI,iBAAiB,EAAE,yBAAyB,EAAC,MAAM,2BAA2B,CAAC;AAClG,YAAY,EAAC,iBAAiB,EAAE,gBAAgB,EAAC,MAAM,2BAA2B,CAAC;AACnF,YAAY,EAAC,eAAe,EAAE,cAAc,EAAC,MAAM,sBAAsB,CAAC;AAC1E,OAAO,EAAC,OAAO,IAAI,iBAAiB,EAAC,MAAM,2BAA2B,CAAC;AACvE,OAAO,EAAC,OAAO,IAAI,uBAAuB,EAAC,MAAM,iCAAiC,CAAC;AAGnF,cAAc,uBAAuB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAaA;;GAEG;AAGH,OAAO,EAAC,OAAO,IAAI,mBAAmB,EAAC,MAAM,uBAAuB,CAAC;AAGrE,OAAO,EAAC,OAAO,IAAI,YAAY,EAAC,MAAM,0BAA0B,CAAC;AAGjE,YAAY,EAAC,mBAAmB,EAAE,mBAAmB,EAAC,MAAM,iBAAiB,CAAC;AAC9E,YAAY,EAAC,OAAO,IAAI,eAAe,EAAC,MAAM,0BAA0B,CAAC;AACzE,YAAY,EACV,qBAAqB,EACrB,0BAA0B,EAC1B,qBAAqB,EACrB,+BAA+B,EAC/B,qBAAqB,EACrB,6BAA6B,GAC9B,MAAM,qBAAqB,CAAC;AAG7B,OAAO,EAAC,OAAO,IAAI,gBAAgB,EAAC,MAAM,2BAA2B,CAAC;AAGtE,OAAO,EAAC,OAAO,IAAI,cAAc,EAAC,MAAM,wBAAwB,CAAC;AACjE,OAAO,EAAC,OAAO,IAAI,eAAe,EAAC,MAAM,yBAAyB,CAAC;AACnE,OAAO,EAAC,OAAO,IAAI,YAAY,EAAC,MAAM,sBAAsB,CAAC;AAC7D,OAAO,EAAC,OAAO,IAAI,YAAY,EAAC,MAAM,sBAAsB,CAAC;AAC7D,OAAO,EAAC,OAAO,IAAI,iBAAiB,EAAE,yBAAyB,EAAC,MAAM,2BAA2B,CAAC;AAClG,YAAY,EAAC,iBAAiB,EAAE,gBAAgB,EAAC,MAAM,2BAA2B,CAAC;AACnF,YAAY,EAAC,eAAe,EAAE,cAAc,EAAC,MAAM,sBAAsB,CAAC;AAC1E,OAAO,EAAC,OAAO,IAAI,iBAAiB,EAAC,MAAM,2BAA2B,CAAC;AACvE,OAAO,EAAC,OAAO,IAAI,sBAAsB,EAAC,MAAM,gCAAgC,CAAC;AACjF,OAAO,EACL,sBAAsB,EACtB,0BAA0B,EAC1B,2BAA2B,EAC3B,kBAAkB,EAClB,KAAK,uBAAuB,GAC7B,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAC,OAAO,IAAI,uBAAuB,EAAC,MAAM,iCAAiC,CAAC;AAGnF,cAAc,uBAAuB,CAAC"}

package/dist/index.js

@@ -1,5 +1,5 @@
 import fetch, { Headers, Request, Response } from "cross-fetch";
-import { BackchannelLogoutConstants, InvalidLogoutTokenError, ThunderIDAuthException, ThunderIDJavaScriptClient, getFlows, getUserTypes, getUsers, getVendorPrefix, logger, resolveResourceEndpoint, updateMeCredentials } from "@thunderid/javascript";
+import { BackchannelLogoutConstants, InvalidLogoutTokenError, ThunderIDAPIError, ThunderIDAuthException, ThunderIDJavaScriptClient, ThunderIDRuntimeError, addGroupMembers, addRoleAssignments, createAgent, createGroup, createRole, createUser, deleteAgent, deleteGroup, deleteRole, deleteUser, getAgent, getAgentGroups, getAgentRoles, getAgentTypes, getAgents, getFlows, getGroup, getGroupMembers, getGroups, getRole, getRoleAssignments, getRoles, getUser, getUserGroups, getUserTypes, getUsers, getVendorPrefix, logger, removeGroupMembers, removeRoleAssignments, resolveResourceEndpoint, updateAgent, updateGroup, updateMeCredentials, updateRole, updateUser } from "@thunderid/javascript";
 import cache from "memory-cache";
 import base64url from "base64url";
 import sha256 from "fast-sha256";
@@ -28,6 +28,202 @@ var MemoryCacheStore = class {
 };
 var MemoryCacheStore_default = MemoryCacheStore;
 
+//#endregion
+//#region src/utils/createManagementClient.ts
+/**
+* Rejects a missing or blank resource identifier before any request is made. The core API functions
+* reject a blank string, but an `undefined` identifier would otherwise address the whole collection,
+* which for a delete or update is never what the caller meant. Uses the same code the core raises.
+*/
+const requireId = (id, operation) => {
+	if (typeof id !== "string" || id.trim() === "") throw new ThunderIDAPIError("A resource identifier is required.", `${operation}-ValidationError-002`, "node", 400, "The provided resource identifier is empty.");
+	return id;
+};
+/**
+* Builds the server-side management client for one session.
+*
+* Each operation resolves its request config through `resolve` at call time, so the access token is
+* read fresh for every request and never held by the returned object.
+*
+* @param resolve - Supplies the base URL, collection URL, and `Authorization` header for a request.
+* @returns The session-bound management operations.
+*/
+const createManagementClient = (resolve) => {
+	const config = async (key, { fetcher, signal, url } = {}) => ({
+		...fetcher ? { fetcher } : {},
+		...signal ? { signal } : {},
+		...await resolve(key, url)
+	});
+	return {
+		agentTypes: { list: async ({ limit, offset,...options } = {}) => getAgentTypes({
+			limit,
+			offset,
+			...await config("agentTypes", options)
+		}) },
+		agents: {
+			create: async (payload, options) => createAgent({
+				payload,
+				...await config("agents", options)
+			}),
+			delete: async (agentId, options) => deleteAgent({
+				agentId: requireId(agentId, "deleteAgent"),
+				...await config("agents", options)
+			}),
+			get: async (agentId, options) => getAgent({
+				agentId: requireId(agentId, "getAgent"),
+				...await config("agents", options)
+			}),
+			list: async ({ filter, limit, offset,...options } = {}) => getAgents({
+				filter,
+				limit,
+				offset,
+				...await config("agents", options)
+			}),
+			listGroups: async (agentId, { limit, offset,...options } = {}) => getAgentGroups({
+				agentId: requireId(agentId, "getAgentGroups"),
+				limit,
+				offset,
+				...await config("agents", options)
+			}),
+			listRoles: async (agentId, { limit, offset,...options } = {}) => getAgentRoles({
+				agentId: requireId(agentId, "getAgentRoles"),
+				limit,
+				offset,
+				...await config("agents", options)
+			}),
+			update: async (agentId, payload, options) => updateAgent({
+				agentId: requireId(agentId, "updateAgent"),
+				payload,
+				...await config("agents", options)
+			})
+		},
+		flows: { list: async ({ flowType, limit, offset,...options } = {}) => getFlows({
+			flowType,
+			limit,
+			offset,
+			...await config("flows", options)
+		}) },
+		groups: {
+			addMembers: async (groupId, members, options) => addGroupMembers({
+				groupId: requireId(groupId, "addGroupMembers"),
+				members,
+				...await config("groups", options)
+			}),
+			create: async (payload, options) => createGroup({
+				payload,
+				...await config("groups", options)
+			}),
+			delete: async (groupId, options) => deleteGroup({
+				groupId: requireId(groupId, "deleteGroup"),
+				...await config("groups", options)
+			}),
+			get: async (groupId, options) => getGroup({
+				groupId: requireId(groupId, "getGroup"),
+				...await config("groups", options)
+			}),
+			list: async ({ limit, offset,...options } = {}) => getGroups({
+				limit,
+				offset,
+				...await config("groups", options)
+			}),
+			listMembers: async (groupId, { limit, offset,...options } = {}) => getGroupMembers({
+				groupId: requireId(groupId, "getGroupMembers"),
+				limit,
+				offset,
+				...await config("groups", options)
+			}),
+			removeMembers: async (groupId, members, options) => removeGroupMembers({
+				groupId: requireId(groupId, "removeGroupMembers"),
+				members,
+				...await config("groups", options)
+			}),
+			update: async (groupId, payload, options) => updateGroup({
+				groupId: requireId(groupId, "updateGroup"),
+				payload,
+				...await config("groups", options)
+			})
+		},
+		roles: {
+			addAssignments: async (roleId, assignments, options) => addRoleAssignments({
+				assignments,
+				roleId: requireId(roleId, "addRoleAssignments"),
+				...await config("roles", options)
+			}),
+			create: async (payload, options) => createRole({
+				payload,
+				...await config("roles", options)
+			}),
+			delete: async (roleId, options) => deleteRole({
+				roleId: requireId(roleId, "deleteRole"),
+				...await config("roles", options)
+			}),
+			get: async (roleId, options) => getRole({
+				roleId: requireId(roleId, "getRole"),
+				...await config("roles", options)
+			}),
+			list: async ({ limit, offset,...options } = {}) => getRoles({
+				limit,
+				offset,
+				...await config("roles", options)
+			}),
+			listAssignments: async (roleId, { limit, offset, type,...options } = {}) => getRoleAssignments({
+				limit,
+				offset,
+				roleId: requireId(roleId, "getRoleAssignments"),
+				type,
+				...await config("roles", options)
+			}),
+			removeAssignments: async (roleId, assignments, options) => removeRoleAssignments({
+				assignments,
+				roleId: requireId(roleId, "removeRoleAssignments"),
+				...await config("roles", options)
+			}),
+			update: async (roleId, payload, options) => updateRole({
+				payload,
+				roleId: requireId(roleId, "updateRole"),
+				...await config("roles", options)
+			})
+		},
+		userTypes: { list: async ({ limit, offset,...options } = {}) => getUserTypes({
+			limit,
+			offset,
+			...await config("userTypes", options)
+		}) },
+		users: {
+			create: async (payload, options) => createUser({
+				payload,
+				...await config("users", options)
+			}),
+			delete: async (userId, options) => deleteUser({
+				userId: requireId(userId, "deleteUser"),
+				...await config("users", options)
+			}),
+			get: async (userId, options) => getUser({
+				userId: requireId(userId, "getUser"),
+				...await config("users", options)
+			}),
+			list: async ({ filter, limit, offset,...options } = {}) => getUsers({
+				filter,
+				limit,
+				offset,
+				...await config("users", options)
+			}),
+			listGroups: async (userId, { limit, offset,...options } = {}) => getUserGroups({
+				limit,
+				offset,
+				userId: requireId(userId, "getUserGroups"),
+				...await config("users", options)
+			}),
+			update: async (userId, payload, options) => updateUser({
+				payload,
+				userId: requireId(userId, "updateUser"),
+				...await config("users", options)
+			})
+		}
+	};
+};
+var createManagementClient_default = createManagementClient;
+
 //#endregion
 //#region src/utils/NodeCryptoUtils.ts
 /**
@@ -407,6 +603,49 @@ var ThunderIDNodeClient = class extends ThunderIDJavaScriptClient {
 		};
 	}
 	/**
+	* Returns the management operations (users, groups, roles, agents, and their sub-resources) bound
+	* to the session identified by `sessionId`.
+	*
+	* Every request is authorized with that session's access token, read at the time of each call; the
+	* token is never copied onto the returned object or exposed to the caller. Whether a call succeeds
+	* is the server's decision: the token needs the permissions the server requires for that resource.
+	*
+	* The collection URL comes from, in order: the `url` passed to the call, then `endpoints.<resource>`
+	* in the configuration, then `{baseUrl}/{collection}`.
+	*
+	* @param sessionId - The session whose access token authorizes the requests.
+	* @returns The session-bound management client.
+	* @throws {ThunderIDRuntimeError} `NODE-MANAGEMENT-RC-NF01`, from an operation, when the session
+	*   has no access token. Raised before any request is sent.
+	* @throws {ThunderIDAPIError} From an operation, when the server rejects the request. HTTP 403 and
+	*   404 surface as `<operation>-ForbiddenError-001` and `<operation>-NotFoundError-001`.
+	*
+	* @example
+	* ```typescript
+	* const admin = client.management(sessionId);
+	* const {users, totalResults} = await admin.users.list({limit: 20});
+	* await admin.groups.addMembers(groupId, [{id: users[0].id, type: 'user'}]);
+	* ```
+	*/
+	management(sessionId) {
+		return createManagementClient_default((key, explicitUrl) => this.sessionManagementRequestConfig(key, sessionId, explicitUrl));
+	}
+	/**
+	* The URL inputs and bearer token for a management request made through {@link management}. Unlike
+	* {@link managementRequestConfig}, a session without an access token is refused here rather than
+	* sent to the server with an empty credential.
+	*/
+	async sessionManagementRequestConfig(key, sessionId, explicitUrl) {
+		const configData = await this.getStorageManager().getConfigData();
+		const accessToken = await this.getAccessToken(sessionId);
+		if (!accessToken) throw new ThunderIDRuntimeError("No access token is available for the session. Sign in before calling a management operation.", "NODE-MANAGEMENT-RC-NF01", "node");
+		return {
+			baseUrl: configData?.baseUrl,
+			headers: { Authorization: `Bearer ${accessToken}` },
+			url: resolveResourceEndpoint(key, configData, explicitUrl)
+		};
+	}
+	/**
 	* Retrieves one page of the user directory on behalf of the session identified by `userId`.
 	*
 	* Makes a single request and does not follow `links`. The access token stays on the server.
@@ -685,6 +924,64 @@ var LoggedOutSessions_default = LoggedOutSessions;
 const generateSessionId = () => (/* @__PURE__ */ new Date()).getTime().toString(36) + Math.random().toString(36).substring(2);
 var generateSessionId_default = generateSessionId;
 
+//#endregion
+//#region src/utils/managementCollections.ts
+/**
+* The management collections a browser may reach through a server-side management relay, keyed by
+* their `endpoints` override key, with the path each one has under `baseUrl`.
+*/
+const MANAGEMENT_COLLECTIONS = {
+	agentTypes: "agent-types",
+	agents: "agents",
+	groups: "groups",
+	roles: "roles",
+	userTypes: "user-types",
+	users: "users"
+};
+const MANAGEMENT_COLLECTION_KEYS = Object.keys(MANAGEMENT_COLLECTIONS);
+/**
+* The collection URLs a management request may target for this configuration: each collection's
+* `endpoints` override, or `{baseUrl}/{path}` and the organization-scoped `{baseUrl}/o/{path}`.
+*/
+const getManagementCollectionUrls = (config) => {
+	const urls = [];
+	const baseUrl = config?.baseUrl?.replace(/\/+$/, "");
+	MANAGEMENT_COLLECTION_KEYS.forEach((key) => {
+		const override = resolveResourceEndpoint(key, config);
+		(override ? [override] : baseUrl ? [`${baseUrl}/${MANAGEMENT_COLLECTIONS[key]}`, `${baseUrl}/o/${MANAGEMENT_COLLECTIONS[key]}`] : []).forEach((candidate) => {
+			try {
+				urls.push(new URL(candidate.replace(/\/+$/, "")));
+			} catch {}
+		});
+	});
+	return urls;
+};
+/**
+* Whether `target` addresses one of the management collections, or a resource or sub-resource under
+* one. The comparison runs on the parsed URL, so dot segments are resolved before it, and an
+* encoded slash, backslash or dot, which an upstream could decode into a different path, is refused.
+*
+* @param target - The absolute URL the browser asked for.
+* @param collections - The allowed collection URLs, from {@link getManagementCollectionUrls}.
+* @returns The parsed URL when it is allowed, otherwise `undefined`.
+*/
+const matchManagementUrl = (target, collections) => {
+	if (typeof target !== "string" || target.length > 4096) return;
+	let url;
+	try {
+		url = new URL(target);
+	} catch {
+		return;
+	}
+	if (url.protocol !== "https:" && url.protocol !== "http:" || url.username || url.password || url.hash) return;
+	if (/%(2e|2f|5c)/i.test(url.pathname)) return;
+	return collections.some((collection) => {
+		if (collection.origin !== url.origin) return false;
+		const base = collection.pathname.replace(/\/+$/, "");
+		return url.pathname === base || url.pathname.startsWith(`${base}/`);
+	}) ? url : void 0;
+};
+
 //#endregion
 //#region src/utils/getSessionCookieOptions.ts
 const getSessionCookieOptions = (options) => ({
@@ -704,4 +1001,4 @@ if (!globalThis.fetch) {
 }
 
 //#endregion
-export { CookieChunking_default as CookieChunking, CookieConfig_default as CookieConfig, InMemoryLogoutRecordStore, LoggedOutSessions_default as LoggedOutSessions, MemoryCacheStore_default as MemoryCacheStore, NodeCryptoUtils_default as NodeCryptoUtils, SessionIndex_default as SessionIndex, SessionUtils_default as SessionUtils, ThunderIDNodeClient_default as ThunderIDNodeClient, generateSessionId_default as generateSessionId, getSessionCookieOptions_default as getSessionCookieOptions };
+export { CookieChunking_default as CookieChunking, CookieConfig_default as CookieConfig, InMemoryLogoutRecordStore, LoggedOutSessions_default as LoggedOutSessions, MANAGEMENT_COLLECTIONS, MANAGEMENT_COLLECTION_KEYS, MemoryCacheStore_default as MemoryCacheStore, NodeCryptoUtils_default as NodeCryptoUtils, SessionIndex_default as SessionIndex, SessionUtils_default as SessionUtils, ThunderIDNodeClient_default as ThunderIDNodeClient, createManagementClient_default as createManagementClient, generateSessionId_default as generateSessionId, getManagementCollectionUrls, getSessionCookieOptions_default as getSessionCookieOptions, matchManagementUrl };

package/dist/models/management.d.ts

@@ -0,0 +1,107 @@
+import { Agent, AgentListResponse, AgentRoleListResponse, AgentTypeListResponse, ApiFetcher, ApiFilteringParams, CreateAgentRequest, CreateGroupRequest, CreateManagedUserRequest, CreateRoleRequest, Group, GroupListResponse, GroupMember, GroupMemberListResponse, ManagedFlowListResponse, ManagedUser, ManagedUserListResponse, ManagedUserTypeListResponse, ManagementRequestConfig, MembershipGroupListResponse, ResourceEndpointKey, Role, RoleAssigneeType, RoleAssignmentInput, RoleAssignmentListResponse, RoleListResponse, UpdateAgentRequest, UpdateGroupRequest, UpdateManagedUserRequest, UpdateRoleRequest } from '@thunderid/javascript';
+/**
+ * The management resource collections the server-side management client addresses.
+ */
+export type ManagementResourceKey = Extract<ResourceEndpointKey, 'agents' | 'agentTypes' | 'flows' | 'groups' | 'roles' | 'users' | 'userTypes'>;
+/**
+ * Per-call options accepted by every management operation.
+ */
+export interface ManagementCallOptions {
+    /**
+     * Transport for this call. Takes precedence over the SDK's default `fetch`. The SDK still sets the
+     * `Authorization` header; a fetcher cannot be used to drop or replace the session's bearer token.
+     */
+    fetcher?: ApiFetcher;
+    /**
+     * Aborts the request.
+     */
+    signal?: AbortSignal;
+    /**
+     * Explicit collection URL for this call. Takes precedence over a `config.endpoints` override, which
+     * takes precedence over `{baseUrl}/{collection}`. A single resource is addressed as this URL followed
+     * by its identifier.
+     */
+    url?: string;
+}
+/**
+ * Options for a paginated list.
+ */
+export type ManagementListOptions = ManagementCallOptions & Pick<ApiFilteringParams, 'limit' | 'offset'>;
+/**
+ * Member reference accepted when adding or removing group members.
+ */
+export type ManagementGroupMemberInput = Pick<GroupMember, 'id' | 'type'>;
+/**
+ * Resolves the URL inputs and bearer token for one management request. Implemented by
+ * `ThunderIDNodeClient`, which reads the access token of the bound session on every call.
+ *
+ * @param key - The resource collection the request targets.
+ * @param explicitUrl - A collection URL passed to the call, if any.
+ */
+export type ManagementRequestConfigResolver = (key: ManagementResourceKey, explicitUrl?: string) => Promise<Pick<ManagementRequestConfig, 'baseUrl' | 'url'> & {
+    headers: {
+        Authorization: string;
+    };
+}>;
+/**
+ * Server-side management operations bound to one session. Every request is authorized with that
+ * session's access token, read at the time of the call, so the token is never copied, cached, or
+ * exposed to the caller.
+ *
+ * Resources returned here are server records (`ManagedUser`, `Group`, `Role`, `Agent`), never the
+ * signed-in user. Failures are raised as `ThunderIDAPIError`, with HTTP 403 and 404 carrying the
+ * `<operation>-ForbiddenError-001` and `<operation>-NotFoundError-001` codes.
+ */
+export interface ThunderIDNodeManagementClient {
+    agentTypes: {
+        list(options?: ManagementListOptions): Promise<AgentTypeListResponse>;
+    };
+    agents: {
+        create(payload: CreateAgentRequest, options?: ManagementCallOptions): Promise<Agent>;
+        delete(agentId: string, options?: ManagementCallOptions): Promise<void>;
+        get(agentId: string, options?: ManagementCallOptions): Promise<Agent>;
+        list(options?: ManagementCallOptions & ApiFilteringParams): Promise<AgentListResponse>;
+        listGroups(agentId: string, options?: ManagementListOptions): Promise<MembershipGroupListResponse>;
+        listRoles(agentId: string, options?: ManagementListOptions): Promise<AgentRoleListResponse>;
+        update(agentId: string, payload: UpdateAgentRequest, options?: ManagementCallOptions): Promise<Agent>;
+    };
+    flows: {
+        list(options?: ManagementListOptions & {
+            flowType?: string;
+        }): Promise<ManagedFlowListResponse>;
+    };
+    groups: {
+        addMembers(groupId: string, members: ManagementGroupMemberInput[], options?: ManagementCallOptions): Promise<Group>;
+        create(payload: CreateGroupRequest, options?: ManagementCallOptions): Promise<Group>;
+        delete(groupId: string, options?: ManagementCallOptions): Promise<void>;
+        get(groupId: string, options?: ManagementCallOptions): Promise<Group>;
+        list(options?: ManagementListOptions): Promise<GroupListResponse>;
+        listMembers(groupId: string, options?: ManagementListOptions): Promise<GroupMemberListResponse>;
+        removeMembers(groupId: string, members: ManagementGroupMemberInput[], options?: ManagementCallOptions): Promise<Group>;
+        update(groupId: string, payload: UpdateGroupRequest, options?: ManagementCallOptions): Promise<Group>;
+    };
+    roles: {
+        addAssignments(roleId: string, assignments: RoleAssignmentInput[], options?: ManagementCallOptions): Promise<void>;
+        create(payload: CreateRoleRequest, options?: ManagementCallOptions): Promise<Role>;
+        delete(roleId: string, options?: ManagementCallOptions): Promise<void>;
+        get(roleId: string, options?: ManagementCallOptions): Promise<Role>;
+        list(options?: ManagementListOptions): Promise<RoleListResponse>;
+        listAssignments(roleId: string, options?: ManagementListOptions & {
+            type?: RoleAssigneeType;
+        }): Promise<RoleAssignmentListResponse>;
+        removeAssignments(roleId: string, assignments: RoleAssignmentInput[], options?: ManagementCallOptions): Promise<void>;
+        update(roleId: string, payload: UpdateRoleRequest, options?: ManagementCallOptions): Promise<Role>;
+    };
+    userTypes: {
+        list(options?: ManagementListOptions): Promise<ManagedUserTypeListResponse>;
+    };
+    users: {
+        create(payload: CreateManagedUserRequest, options?: ManagementCallOptions): Promise<ManagedUser>;
+        delete(userId: string, options?: ManagementCallOptions): Promise<void>;
+        get(userId: string, options?: ManagementCallOptions): Promise<ManagedUser>;
+        list(options?: ManagementCallOptions & ApiFilteringParams): Promise<ManagedUserListResponse>;
+        listGroups(userId: string, options?: ManagementListOptions): Promise<MembershipGroupListResponse>;
+        update(userId: string, payload: UpdateManagedUserRequest, options?: ManagementCallOptions): Promise<ManagedUser>;
+    };
+}
+//# sourceMappingURL=management.d.ts.map

package/dist/models/management.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"management.d.ts","sourceRoot":"","sources":["../../src/models/management.ts"],"names":[],"mappings":"AAGA,OAAO,EACL,KAAK,EACL,iBAAiB,EACjB,qBAAqB,EACrB,qBAAqB,EACrB,UAAU,EACV,kBAAkB,EAClB,kBAAkB,EAClB,kBAAkB,EAClB,wBAAwB,EACxB,iBAAiB,EACjB,KAAK,EACL,iBAAiB,EACjB,WAAW,EACX,uBAAuB,EACvB,uBAAuB,EACvB,WAAW,EACX,uBAAuB,EACvB,2BAA2B,EAC3B,uBAAuB,EACvB,2BAA2B,EAC3B,mBAAmB,EACnB,IAAI,EACJ,gBAAgB,EAChB,mBAAmB,EACnB,0BAA0B,EAC1B,gBAAgB,EAChB,kBAAkB,EAClB,kBAAkB,EAClB,wBAAwB,EACxB,iBAAiB,EAClB,MAAM,uBAAuB,CAAC;AAE/B;;GAEG;AACH,MAAM,MAAM,qBAAqB,GAAG,OAAO,CACzC,mBAAmB,EACnB,QAAQ,GAAG,YAAY,GAAG,OAAO,GAAG,QAAQ,GAAG,OAAO,GAAG,OAAO,GAAG,WAAW,CAC/E,CAAC;AAEF;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC;;;OAGG;IACH,OAAO,CAAC,EAAE,UAAU,CAAC;IACrB;;OAEG;IACH,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB;;;;OAIG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED;;GAEG;AACH,MAAM,MAAM,qBAAqB,GAAG,qBAAqB,GAAG,IAAI,CAAC,kBAAkB,EAAE,OAAO,GAAG,QAAQ,CAAC,CAAC;AAEzG;;GAEG;AACH,MAAM,MAAM,0BAA0B,GAAG,IAAI,CAAC,WAAW,EAAE,IAAI,GAAG,MAAM,CAAC,CAAC;AAE1E;;;;;;GAMG;AACH,MAAM,MAAM,+BAA+B,GAAG,CAC5C,GAAG,EAAE,qBAAqB,EAC1B,WAAW,CAAC,EAAE,MAAM,KACjB,OAAO,CAAC,IAAI,CAAC,uBAAuB,EAAE,SAAS,GAAG,KAAK,CAAC,GAAG;IAAC,OAAO,EAAE;QAAC,aAAa,EAAE,MAAM,CAAA;KAAC,CAAA;CAAC,CAAC,CAAC;AAEpG;;;;;;;;GAQG;AACH,MAAM,WAAW,6BAA6B;IAC5C,UAAU,EAAE;QACV,IAAI,CAAC,OAAO,CAAC,EAAE,qBAAqB,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAAC;KACvE,CAAC;IACF,MAAM,EAAE;QACN,MAAM,CAAC,OAAO,EAAE,kBAAkB,EAAE,OAAO,CAAC,EAAE,qBAAqB,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;QACrF,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,qBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QACxE,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,qBAAqB,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;QACtE,IAAI,CAAC,OAAO,CAAC,EAAE,qBAAqB,GAAG,kBAAkB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;QACvF,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,qBAAqB,GAAG,OAAO,CAAC,2BAA2B,CAAC,CAAC;QACnG,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,qBAAqB,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAAC;QAC5F,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,kBAAkB,EAAE,OAAO,CAAC,EAAE,qBAAqB,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;KACvG,CAAC;IACF,KAAK,EAAE;QACL,IAAI,CAAC,OAAO,CAAC,EAAE,qBAAqB,GAAG;YAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;SAAC,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAAC;KAC/F,CAAC;IACF,MAAM,EAAE;QACN,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,0BAA0B,EAAE,EAAE,OAAO,CAAC,EAAE,qBAAqB,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;QACpH,MAAM,CAAC,OAAO,EAAE,kBAAkB,EAAE,OAAO,CAAC,EAAE,qBAAqB,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;QACrF,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,qBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QACxE,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,qBAAqB,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;QACtE,IAAI,CAAC,OAAO,CAAC,EAAE,qBAAqB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;QAClE,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,qBAAqB,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAAC;QAChG,aAAa,CACX,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,0BAA0B,EAAE,EACrC,OAAO,CAAC,EAAE,qBAAqB,GAC9B,OAAO,CAAC,KAAK,CAAC,CAAC;QAClB,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,kBAAkB,EAAE,OAAO,CAAC,EAAE,qBAAqB,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;KACvG,CAAC;IACF,KAAK,EAAE;QACL,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,mBAAmB,EAAE,EAAE,OAAO,CAAC,EAAE,qBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QACnH,MAAM,CAAC,OAAO,EAAE,iBAAiB,EAAE,OAAO,CAAC,EAAE,qBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QACnF,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,qBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QACvE,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,qBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QACpE,IAAI,CAAC,OAAO,CAAC,EAAE,qBAAqB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;QACjE,eAAe,CACb,MAAM,EAAE,MAAM,EACd,OAAO,CAAC,EAAE,qBAAqB,GAAG;YAAC,IAAI,CAAC,EAAE,gBAAgB,CAAA;SAAC,GAC1D,OAAO,CAAC,0BAA0B,CAAC,CAAC;QACvC,iBAAiB,CACf,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,mBAAmB,EAAE,EAClC,OAAO,CAAC,EAAE,qBAAqB,GAC9B,OAAO,CAAC,IAAI,CAAC,CAAC;QACjB,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,iBAAiB,EAAE,OAAO,CAAC,EAAE,qBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;KACpG,CAAC;IACF,SAAS,EAAE;QACT,IAAI,CAAC,OAAO,CAAC,EAAE,qBAAqB,GAAG,OAAO,CAAC,2BAA2B,CAAC,CAAC;KAC7E,CAAC;IACF,KAAK,EAAE;QACL,MAAM,CAAC,OAAO,EAAE,wBAAwB,EAAE,OAAO,CAAC,EAAE,qBAAqB,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;QACjG,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,qBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QACvE,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,qBAAqB,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;QAC3E,IAAI,CAAC,OAAO,CAAC,EAAE,qBAAqB,GAAG,kBAAkB,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAAC;QAC7F,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,qBAAqB,GAAG,OAAO,CAAC,2BAA2B,CAAC,CAAC;QAClG,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,wBAAwB,EAAE,OAAO,CAAC,EAAE,qBAAqB,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;KAClH,CAAC;CACH"}

package/dist/utils/createManagementClient.d.ts

@@ -0,0 +1,13 @@
+import { ManagementRequestConfigResolver, ThunderIDNodeManagementClient } from '../models/management';
+/**
+ * Builds the server-side management client for one session.
+ *
+ * Each operation resolves its request config through `resolve` at call time, so the access token is
+ * read fresh for every request and never held by the returned object.
+ *
+ * @param resolve - Supplies the base URL, collection URL, and `Authorization` header for a request.
+ * @returns The session-bound management operations.
+ */
+declare const createManagementClient: (resolve: ManagementRequestConfigResolver) => ThunderIDNodeManagementClient;
+export default createManagementClient;
+//# sourceMappingURL=createManagementClient.d.ts.map

package/dist/utils/createManagementClient.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"createManagementClient.d.ts","sourceRoot":"","sources":["../../src/utils/createManagementClient.ts"],"names":[],"mappings":"AAuCA,OAAO,EAEL,+BAA+B,EAE/B,6BAA6B,EAC9B,MAAM,sBAAsB,CAAC;AAqB9B;;;;;;;;GAQG;AACH,QAAA,MAAM,sBAAsB,GAAI,SAAS,+BAA+B,KAAG,6BAiI1E,CAAC;AAEF,eAAe,sBAAsB,CAAC"}

package/dist/utils/managementCollections.d.ts

@@ -0,0 +1,26 @@
+import type { ResourceEndpointConfig, ResourceEndpointKey } from '@thunderid/javascript';
+/**
+ * The management collections a browser may reach through a server-side management relay, keyed by
+ * their `endpoints` override key, with the path each one has under `baseUrl`.
+ */
+export declare const MANAGEMENT_COLLECTIONS: Readonly<Record<Extract<ResourceEndpointKey, 'agents' | 'agentTypes' | 'groups' | 'roles' | 'users' | 'userTypes'>, string>>;
+export type ManagementCollectionKey = keyof typeof MANAGEMENT_COLLECTIONS;
+export declare const MANAGEMENT_COLLECTION_KEYS: ManagementCollectionKey[];
+/**
+ * The collection URLs a management request may target for this configuration: each collection's
+ * `endpoints` override, or `{baseUrl}/{path}` and the organization-scoped `{baseUrl}/o/{path}`.
+ */
+export declare const getManagementCollectionUrls: (config: (ResourceEndpointConfig & {
+    baseUrl?: string;
+}) | undefined) => URL[];
+/**
+ * Whether `target` addresses one of the management collections, or a resource or sub-resource under
+ * one. The comparison runs on the parsed URL, so dot segments are resolved before it, and an
+ * encoded slash, backslash or dot, which an upstream could decode into a different path, is refused.
+ *
+ * @param target - The absolute URL the browser asked for.
+ * @param collections - The allowed collection URLs, from {@link getManagementCollectionUrls}.
+ * @returns The parsed URL when it is allowed, otherwise `undefined`.
+ */
+export declare const matchManagementUrl: (target: unknown, collections: URL[]) => URL | undefined;
+//# sourceMappingURL=managementCollections.d.ts.map

package/dist/utils/managementCollections.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"managementCollections.d.ts","sourceRoot":"","sources":["../../src/utils/managementCollections.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAC,sBAAsB,EAAE,mBAAmB,EAAC,MAAM,uBAAuB,CAAC;AAKvF;;;GAGG;AACH,eAAO,MAAM,sBAAsB,EAAE,QAAQ,CAC3C,MAAM,CAAC,OAAO,CAAC,mBAAmB,EAAE,QAAQ,GAAG,YAAY,GAAG,QAAQ,GAAG,OAAO,GAAG,OAAO,GAAG,WAAW,CAAC,EAAE,MAAM,CAAC,CAQnH,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAAG,MAAM,OAAO,sBAAsB,CAAC;AAE1E,eAAO,MAAM,0BAA0B,EAAE,uBAAuB,EAElC,CAAC;AAE/B;;;GAGG;AACH,eAAO,MAAM,2BAA2B,GACtC,QAAQ,CAAC,sBAAsB,GAAG;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAC,CAAC,GAAG,SAAS,KAChE,GAAG,EAsBL,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,kBAAkB,GAAI,QAAQ,OAAO,EAAE,aAAa,GAAG,EAAE,KAAG,GAAG,GAAG,SAgC9E,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@thunderid/node",
-  "version": "1.3.1",
+  "version": "1.5.0",
   "description": "Node.js runtime SDK for ThunderID",
   "keywords": [
     "thunderid",
@@ -44,7 +44,7 @@
     "vitest": "4.1.11"
   },
   "dependencies": {
-    "@thunderid/javascript": "^1.4.1",
+    "@thunderid/javascript": "^1.6.0",
     "base64url": "3.0.1",
     "cross-fetch": "4.1.0",
     "fast-sha256": "1.3.0",