@thunderid/node 1.4.0 → 1.6.0

package/dist/cjs/index.cjs

@@ -58,6 +58,919 @@ var MemoryCacheStore = class {
 };
 var MemoryCacheStore_default = MemoryCacheStore;
 
+//#endregion
+//#region src/utils/createManagementClient.ts
+/**
+* Rejects a missing or blank resource identifier before any request is made. The core API functions
+* reject a blank string, but an `undefined` identifier would otherwise address the whole collection,
+* which for a delete or update is never what the caller meant. Uses the same code the core raises.
+*/
+const requireId = (id, operation) => {
+	if (typeof id !== "string" || id.trim() === "") throw new __thunderid_javascript.ThunderIDAPIError("A resource identifier is required.", `${operation}-ValidationError-002`, "node", 400, "The provided resource identifier is empty.");
+	return id;
+};
+/**
+* Builds the server-side management client for one session.
+*
+* Each operation resolves its request config through `resolve` at call time, so the access token is
+* read fresh for every request and never held by the returned object.
+*
+* @param resolve - Supplies the base URL, collection URL, and `Authorization` header for a request.
+* @returns The session-bound management operations.
+*/
+const createManagementClient = (resolve) => {
+	const config = async (key, { fetcher, signal, url } = {}) => ({
+		...fetcher ? { fetcher } : {},
+		...signal ? { signal } : {},
+		...await resolve(key, url)
+	});
+	return {
+		agentTypes: {
+			create: async (payload, options) => (0, __thunderid_javascript.createAgentType)({
+				payload,
+				...await config("agentTypes", options)
+			}),
+			delete: async (agentTypeId, options) => (0, __thunderid_javascript.deleteAgentType)({
+				agentTypeId: requireId(agentTypeId, "deleteAgentType"),
+				...await config("agentTypes", options)
+			}),
+			get: async (agentTypeId, options) => (0, __thunderid_javascript.getAgentType)({
+				agentTypeId: requireId(agentTypeId, "getAgentType"),
+				...await config("agentTypes", options)
+			}),
+			list: async ({ limit, offset,...options } = {}) => (0, __thunderid_javascript.getAgentTypes)({
+				limit,
+				offset,
+				...await config("agentTypes", options)
+			}),
+			update: async (agentTypeId, payload, options) => (0, __thunderid_javascript.updateAgentType)({
+				agentTypeId: requireId(agentTypeId, "updateAgentType"),
+				payload,
+				...await config("agentTypes", options)
+			})
+		},
+		agents: {
+			create: async (payload, options) => (0, __thunderid_javascript.createAgent)({
+				payload,
+				...await config("agents", options)
+			}),
+			delete: async (agentId, options) => (0, __thunderid_javascript.deleteAgent)({
+				agentId: requireId(agentId, "deleteAgent"),
+				...await config("agents", options)
+			}),
+			get: async (agentId, options) => (0, __thunderid_javascript.getAgent)({
+				agentId: requireId(agentId, "getAgent"),
+				...await config("agents", options)
+			}),
+			list: async ({ filter, limit, offset,...options } = {}) => (0, __thunderid_javascript.getAgents)({
+				filter,
+				limit,
+				offset,
+				...await config("agents", options)
+			}),
+			listGroups: async (agentId, { limit, offset,...options } = {}) => (0, __thunderid_javascript.getAgentGroups)({
+				agentId: requireId(agentId, "getAgentGroups"),
+				limit,
+				offset,
+				...await config("agents", options)
+			}),
+			listRoles: async (agentId, { limit, offset,...options } = {}) => (0, __thunderid_javascript.getAgentRoles)({
+				agentId: requireId(agentId, "getAgentRoles"),
+				limit,
+				offset,
+				...await config("agents", options)
+			}),
+			suspend: async (agentId, { operatorNote,...options } = {}) => (0, __thunderid_javascript.suspendAgent)({
+				agentId: requireId(agentId, "suspendAgent"),
+				operatorNote,
+				...await config("agents", options)
+			}),
+			unlock: async (agentId, { operatorNote,...options } = {}) => (0, __thunderid_javascript.unlockAgent)({
+				agentId: requireId(agentId, "unlockAgent"),
+				operatorNote,
+				...await config("agents", options)
+			}),
+			unsuspend: async (agentId, { operatorNote,...options } = {}) => (0, __thunderid_javascript.unsuspendAgent)({
+				agentId: requireId(agentId, "unsuspendAgent"),
+				operatorNote,
+				...await config("agents", options)
+			}),
+			update: async (agentId, payload, options) => (0, __thunderid_javascript.updateAgent)({
+				agentId: requireId(agentId, "updateAgent"),
+				payload,
+				...await config("agents", options)
+			})
+		},
+		applications: {
+			create: async (payload, options) => (0, __thunderid_javascript.createApplication)({
+				payload,
+				...await config("applications", options)
+			}),
+			createSharingPolicy: async (applicationId, payload, options) => (0, __thunderid_javascript.createApplicationSharingPolicy)({
+				applicationId: requireId(applicationId, "createApplicationSharingPolicy"),
+				payload,
+				...await config("applications", options)
+			}),
+			delete: async (applicationId, { administrationMode,...options } = {}) => (0, __thunderid_javascript.deleteApplication)({
+				administrationMode,
+				applicationId: requireId(applicationId, "deleteApplication"),
+				...await config("applications", options)
+			}),
+			deleteSharingPolicy: async (applicationId, policyId, options) => (0, __thunderid_javascript.deleteApplicationSharingPolicy)({
+				applicationId: requireId(applicationId, "deleteApplicationSharingPolicy"),
+				policyId: requireId(policyId, "deleteApplicationSharingPolicy"),
+				...await config("applications", options)
+			}),
+			get: async (applicationId, options) => (0, __thunderid_javascript.getApplication)({
+				applicationId: requireId(applicationId, "getApplication"),
+				...await config("applications", options)
+			}),
+			getOverlayRules: async (applicationId, ouId, options) => (0, __thunderid_javascript.getApplicationOverlayRules)({
+				applicationId: requireId(applicationId, "getApplicationOverlayRules"),
+				ouId: requireId(ouId, "getApplicationOverlayRules"),
+				...await config("applications", options)
+			}),
+			getSharingPolicy: async (applicationId, policyId, options) => (0, __thunderid_javascript.getApplicationSharingPolicy)({
+				applicationId: requireId(applicationId, "getApplicationSharingPolicy"),
+				policyId: requireId(policyId, "getApplicationSharingPolicy"),
+				...await config("applications", options)
+			}),
+			list: async ({ limit, offset,...options } = {}) => (0, __thunderid_javascript.getApplications)({
+				limit,
+				offset,
+				...await config("applications", options)
+			}),
+			listSharingPolicies: async (applicationId, { limit, offset,...options } = {}) => (0, __thunderid_javascript.getApplicationSharingPolicies)({
+				applicationId: requireId(applicationId, "getApplicationSharingPolicies"),
+				limit,
+				offset,
+				...await config("applications", options)
+			}),
+			previewCimdDocument: async (clientId, options) => (0, __thunderid_javascript.previewCimdDocument)({
+				clientId: requireId(clientId, "previewCimdDocument"),
+				...await config("applications", options)
+			}),
+			regenerateClientSecret: async (applicationId, { administrationMode,...options } = {}) => (0, __thunderid_javascript.regenerateClientSecret)({
+				administrationMode,
+				applicationId: requireId(applicationId, "regenerateClientSecret"),
+				...await config("applications", options)
+			}),
+			regenerateFlowSecret: async (applicationId, options) => (0, __thunderid_javascript.regenerateFlowSecret)({
+				applicationId: requireId(applicationId, "regenerateFlowSecret"),
+				...await config("applications", options)
+			}),
+			suspend: async (applicationId, { operatorNote,...options } = {}) => (0, __thunderid_javascript.suspendApplication)({
+				applicationId: requireId(applicationId, "suspendApplication"),
+				operatorNote,
+				...await config("applications", options)
+			}),
+			unsuspend: async (applicationId, { operatorNote,...options } = {}) => (0, __thunderid_javascript.unsuspendApplication)({
+				applicationId: requireId(applicationId, "unsuspendApplication"),
+				operatorNote,
+				...await config("applications", options)
+			}),
+			update: async (applicationId, payload, options) => (0, __thunderid_javascript.updateApplication)({
+				applicationId: requireId(applicationId, "updateApplication"),
+				payload,
+				...await config("applications", options)
+			}),
+			updateSharingPolicy: async (applicationId, policyId, payload, options) => (0, __thunderid_javascript.updateApplicationSharingPolicy)({
+				applicationId: requireId(applicationId, "updateApplicationSharingPolicy"),
+				payload,
+				policyId: requireId(policyId, "updateApplicationSharingPolicy"),
+				...await config("applications", options)
+			})
+		},
+		configuration: {
+			captureVersion: async (payload, options) => (0, __thunderid_javascript.createConfigurationVersion)({
+				payload,
+				...await config("configurationVersions", options)
+			}),
+			deleteImported: async (payload, options) => (0, __thunderid_javascript.deleteImportedConfiguration)({
+				payload,
+				...await config("import", options)
+			}),
+			export: async (payload, options) => (0, __thunderid_javascript.exportConfiguration)({
+				payload,
+				...await config("export", options)
+			}),
+			getVersion: async (version, options) => (0, __thunderid_javascript.getConfigurationVersion)({
+				version: requireId(version, "getConfigurationVersion"),
+				...await config("configurationVersions", options)
+			}),
+			import: async (payload, options) => (0, __thunderid_javascript.importConfiguration)({
+				payload,
+				...await config("import", options)
+			}),
+			listVersions: async (options) => (0, __thunderid_javascript.getConfigurationVersions)(await config("configurationVersions", options))
+		},
+		connections: {
+			create: async (type, payload, options) => (0, __thunderid_javascript.createConnection)({
+				payload,
+				type: requireId(type, "createConnection"),
+				...await config("connections", options)
+			}),
+			delete: async (type, connectionId, options) => (0, __thunderid_javascript.deleteConnection)({
+				connectionId: requireId(connectionId, "deleteConnection"),
+				type: requireId(type, "deleteConnection"),
+				...await config("connections", options)
+			}),
+			get: async (type, connectionId, options) => (0, __thunderid_javascript.getConnection)({
+				connectionId: requireId(connectionId, "getConnection"),
+				type: requireId(type, "getConnection"),
+				...await config("connections", options)
+			}),
+			getMeta: async ({ vendor,...options } = {}) => (0, __thunderid_javascript.getConnectionsMeta)({
+				vendor,
+				...await config("connections", options)
+			}),
+			list: async ({ category, limit, offset,...options } = {}) => (0, __thunderid_javascript.getConnections)({
+				category,
+				limit,
+				offset,
+				...await config("connections", options)
+			}),
+			listByType: async (type, options) => (0, __thunderid_javascript.getConnections)({
+				type: requireId(type, "getConnections"),
+				...await config("connections", options)
+			}),
+			listUsages: async (type, connectionId, options) => (0, __thunderid_javascript.getConnectionUsages)({
+				connectionId: requireId(connectionId, "getConnectionUsages"),
+				type: requireId(type, "getConnectionUsages"),
+				...await config("connections", options)
+			}),
+			update: async (type, connectionId, payload, options) => (0, __thunderid_javascript.updateConnection)({
+				connectionId: requireId(connectionId, "updateConnection"),
+				payload,
+				type: requireId(type, "updateConnection"),
+				...await config("connections", options)
+			})
+		},
+		design: {
+			createLayout: async (payload, options) => (0, __thunderid_javascript.createLayout)({
+				payload,
+				...await config("design", options)
+			}),
+			createTheme: async (payload, options) => (0, __thunderid_javascript.createDesignTheme)({
+				payload,
+				...await config("design", options)
+			}),
+			deleteLayout: async (layoutId, options) => (0, __thunderid_javascript.deleteLayout)({
+				layoutId: requireId(layoutId, "deleteLayout"),
+				...await config("design", options)
+			}),
+			deleteTheme: async (themeId, options) => (0, __thunderid_javascript.deleteDesignTheme)({
+				themeId: requireId(themeId, "deleteDesignTheme"),
+				...await config("design", options)
+			}),
+			getLayout: async (layoutId, options) => (0, __thunderid_javascript.getLayout)({
+				layoutId: requireId(layoutId, "getLayout"),
+				...await config("design", options)
+			}),
+			getTheme: async (themeId, options) => (0, __thunderid_javascript.getDesignTheme)({
+				themeId: requireId(themeId, "getDesignTheme"),
+				...await config("design", options)
+			}),
+			listLayoutUsages: async (layoutId, { limit, offset,...options } = {}) => (0, __thunderid_javascript.getLayoutUsages)({
+				layoutId: requireId(layoutId, "getLayoutUsages"),
+				limit,
+				offset,
+				...await config("design", options)
+			}),
+			listLayouts: async ({ limit, offset,...options } = {}) => (0, __thunderid_javascript.getLayouts)({
+				limit,
+				offset,
+				...await config("design", options)
+			}),
+			listThemeUsages: async (themeId, { limit, offset,...options } = {}) => (0, __thunderid_javascript.getDesignThemeUsages)({
+				limit,
+				offset,
+				themeId: requireId(themeId, "getDesignThemeUsages"),
+				...await config("design", options)
+			}),
+			listThemes: async ({ limit, offset,...options } = {}) => (0, __thunderid_javascript.getDesignThemes)({
+				limit,
+				offset,
+				...await config("design", options)
+			}),
+			resolve: async (type, id, options) => (0, __thunderid_javascript.resolveDesign)({
+				id: requireId(id, "resolveDesign"),
+				type,
+				...await config("design", options)
+			}),
+			updateLayout: async (layoutId, payload, options) => (0, __thunderid_javascript.updateLayout)({
+				layoutId: requireId(layoutId, "updateLayout"),
+				payload,
+				...await config("design", options)
+			}),
+			updateTheme: async (themeId, payload, options) => (0, __thunderid_javascript.updateDesignTheme)({
+				payload,
+				themeId: requireId(themeId, "updateDesignTheme"),
+				...await config("design", options)
+			})
+		},
+		flows: {
+			create: async (payload, options) => (0, __thunderid_javascript.createFlow)({
+				payload,
+				...await config("flows", options)
+			}),
+			delete: async (flowId, options) => (0, __thunderid_javascript.deleteFlow)({
+				flowId: requireId(flowId, "deleteFlow"),
+				...await config("flows", options)
+			}),
+			get: async (flowId, options) => (0, __thunderid_javascript.getFlow)({
+				flowId: requireId(flowId, "getFlow"),
+				...await config("flows", options)
+			}),
+			getVersion: async (flowId, version, options) => (0, __thunderid_javascript.getFlowVersion)({
+				flowId: requireId(flowId, "getFlowVersion"),
+				version,
+				...await config("flows", options)
+			}),
+			list: async ({ flowType, limit, offset,...options } = {}) => (0, __thunderid_javascript.getFlows)({
+				flowType,
+				limit,
+				offset,
+				...await config("flows", options)
+			}),
+			listUsages: async (flowId, options) => (0, __thunderid_javascript.getFlowUsages)({
+				flowId: requireId(flowId, "getFlowUsages"),
+				...await config("flows", options)
+			}),
+			listVersions: async (flowId, options) => (0, __thunderid_javascript.getFlowVersions)({
+				flowId: requireId(flowId, "getFlowVersions"),
+				...await config("flows", options)
+			}),
+			restoreVersion: async (flowId, version, options) => (0, __thunderid_javascript.restoreFlowVersion)({
+				flowId: requireId(flowId, "restoreFlowVersion"),
+				version,
+				...await config("flows", options)
+			}),
+			update: async (flowId, payload, options) => (0, __thunderid_javascript.updateFlow)({
+				flowId: requireId(flowId, "updateFlow"),
+				payload,
+				...await config("flows", options)
+			})
+		},
+		gateways: {
+			applyConfiguration: async (gatewayId, payload, options) => (0, __thunderid_javascript.applyGatewayConfiguration)({
+				gatewayId: requireId(gatewayId, "applyGatewayConfiguration"),
+				payload,
+				...await config("gateways", options)
+			}),
+			create: async (payload, options) => (0, __thunderid_javascript.createGateway)({
+				payload,
+				...await config("gateways", options)
+			}),
+			createSecret: async (gatewayId, payload, options) => (0, __thunderid_javascript.createGatewaySecret)({
+				gatewayId: requireId(gatewayId, "createGatewaySecret"),
+				payload,
+				...await config("gateways", options)
+			}),
+			createVariable: async (gatewayId, payload, options) => (0, __thunderid_javascript.createGatewayVariable)({
+				gatewayId: requireId(gatewayId, "createGatewayVariable"),
+				payload,
+				...await config("gateways", options)
+			}),
+			delete: async (gatewayId, options) => (0, __thunderid_javascript.deleteGateway)({
+				gatewayId: requireId(gatewayId, "deleteGateway"),
+				...await config("gateways", options)
+			}),
+			deleteSecret: async (gatewayId, name, options) => (0, __thunderid_javascript.deleteGatewaySecret)({
+				gatewayId: requireId(gatewayId, "deleteGatewaySecret"),
+				name: requireId(name, "deleteGatewaySecret"),
+				...await config("gateways", options)
+			}),
+			deleteVariable: async (gatewayId, name, options) => (0, __thunderid_javascript.deleteGatewayVariable)({
+				gatewayId: requireId(gatewayId, "deleteGatewayVariable"),
+				name: requireId(name, "deleteGatewayVariable"),
+				...await config("gateways", options)
+			}),
+			get: async (gatewayId, options) => (0, __thunderid_javascript.getGateway)({
+				gatewayId: requireId(gatewayId, "getGateway"),
+				...await config("gateways", options)
+			}),
+			getAppliedConfiguration: async (gatewayId, options) => (0, __thunderid_javascript.getGatewayAppliedConfiguration)({
+				gatewayId: requireId(gatewayId, "getGatewayAppliedConfiguration"),
+				...await config("gateways", options)
+			}),
+			getAppliedVersion: async (gatewayId, options) => (0, __thunderid_javascript.getGatewayAppliedVersion)({
+				gatewayId: requireId(gatewayId, "getGatewayAppliedVersion"),
+				...await config("gateways", options)
+			}),
+			getConfigurationDiff: async (gatewayId, { version,...options } = {}) => (0, __thunderid_javascript.getGatewayConfigurationDiff)({
+				gatewayId: requireId(gatewayId, "getGatewayConfigurationDiff"),
+				version,
+				...await config("gateways", options)
+			}),
+			getSecret: async (gatewayId, name, options) => (0, __thunderid_javascript.getGatewaySecret)({
+				gatewayId: requireId(gatewayId, "getGatewaySecret"),
+				name: requireId(name, "getGatewaySecret"),
+				...await config("gateways", options)
+			}),
+			getVariable: async (gatewayId, name, options) => (0, __thunderid_javascript.getGatewayVariable)({
+				gatewayId: requireId(gatewayId, "getGatewayVariable"),
+				name: requireId(name, "getGatewayVariable"),
+				...await config("gateways", options)
+			}),
+			list: async (options) => (0, __thunderid_javascript.getGateways)(await config("gateways", options)),
+			listSecrets: async (gatewayId, { filter, limit, names, offset,...options } = {}) => (0, __thunderid_javascript.getGatewaySecrets)({
+				filter,
+				gatewayId: requireId(gatewayId, "getGatewaySecrets"),
+				limit,
+				names,
+				offset,
+				...await config("gateways", options)
+			}),
+			listVariables: async (gatewayId, { filter, limit, names, offset,...options } = {}) => (0, __thunderid_javascript.getGatewayVariables)({
+				filter,
+				gatewayId: requireId(gatewayId, "getGatewayVariables"),
+				limit,
+				names,
+				offset,
+				...await config("gateways", options)
+			}),
+			revertConfiguration: async (gatewayId, payload, options) => (0, __thunderid_javascript.revertGatewayConfiguration)({
+				gatewayId: requireId(gatewayId, "revertGatewayConfiguration"),
+				payload,
+				...await config("gateways", options)
+			}),
+			update: async (gatewayId, payload, options) => (0, __thunderid_javascript.updateGateway)({
+				gatewayId: requireId(gatewayId, "updateGateway"),
+				payload,
+				...await config("gateways", options)
+			}),
+			updateSecret: async (gatewayId, name, payload, options) => (0, __thunderid_javascript.updateGatewaySecret)({
+				gatewayId: requireId(gatewayId, "updateGatewaySecret"),
+				name: requireId(name, "updateGatewaySecret"),
+				payload,
+				...await config("gateways", options)
+			}),
+			updateVariable: async (gatewayId, name, payload, options) => (0, __thunderid_javascript.updateGatewayVariable)({
+				gatewayId: requireId(gatewayId, "updateGatewayVariable"),
+				name: requireId(name, "updateGatewayVariable"),
+				payload,
+				...await config("gateways", options)
+			})
+		},
+		groups: {
+			addMembers: async (groupId, members, options) => (0, __thunderid_javascript.addGroupMembers)({
+				groupId: requireId(groupId, "addGroupMembers"),
+				members,
+				...await config("groups", options)
+			}),
+			create: async (payload, options) => (0, __thunderid_javascript.createGroup)({
+				payload,
+				...await config("groups", options)
+			}),
+			delete: async (groupId, options) => (0, __thunderid_javascript.deleteGroup)({
+				groupId: requireId(groupId, "deleteGroup"),
+				...await config("groups", options)
+			}),
+			get: async (groupId, options) => (0, __thunderid_javascript.getGroup)({
+				groupId: requireId(groupId, "getGroup"),
+				...await config("groups", options)
+			}),
+			list: async ({ limit, offset,...options } = {}) => (0, __thunderid_javascript.getGroups)({
+				limit,
+				offset,
+				...await config("groups", options)
+			}),
+			listMembers: async (groupId, { limit, offset,...options } = {}) => (0, __thunderid_javascript.getGroupMembers)({
+				groupId: requireId(groupId, "getGroupMembers"),
+				limit,
+				offset,
+				...await config("groups", options)
+			}),
+			removeMembers: async (groupId, members, options) => (0, __thunderid_javascript.removeGroupMembers)({
+				groupId: requireId(groupId, "removeGroupMembers"),
+				members,
+				...await config("groups", options)
+			}),
+			update: async (groupId, payload, options) => (0, __thunderid_javascript.updateGroup)({
+				groupId: requireId(groupId, "updateGroup"),
+				payload,
+				...await config("groups", options)
+			})
+		},
+		i18n: {
+			deleteTranslation: async (language, namespace, key, options) => (0, __thunderid_javascript.deleteTranslation)({
+				key,
+				language,
+				namespace,
+				...await config("i18n", options)
+			}),
+			deleteTranslations: async (language, options) => (0, __thunderid_javascript.deleteTranslations)({
+				language: requireId(language, "deleteTranslations"),
+				...await config("i18n", options)
+			}),
+			listLanguages: async (options) => (0, __thunderid_javascript.getLanguages)(await config("i18n", options)),
+			resolveTranslation: async (language, namespace, key, options) => (0, __thunderid_javascript.resolveTranslation)({
+				key,
+				language,
+				namespace,
+				...await config("i18n", options)
+			}),
+			resolveTranslations: async (language, { namespace,...options } = {}) => (0, __thunderid_javascript.resolveTranslations)({
+				language,
+				namespace,
+				...await config("i18n", options)
+			}),
+			setTranslation: async (language, namespace, key, payload, options) => (0, __thunderid_javascript.setTranslation)({
+				key,
+				language,
+				namespace,
+				payload,
+				...await config("i18n", options)
+			}),
+			setTranslations: async (language, payload, options) => (0, __thunderid_javascript.setTranslations)({
+				language,
+				payload,
+				...await config("i18n", options)
+			})
+		},
+		notificationTemplates: {
+			create: async (channel, payload, options) => (0, __thunderid_javascript.createNotificationTemplate)({
+				channel: requireId(channel, "createNotificationTemplate"),
+				payload,
+				...await config("notificationTemplates", options)
+			}),
+			delete: async (channel, templateId, options) => (0, __thunderid_javascript.deleteNotificationTemplate)({
+				channel: requireId(channel, "deleteNotificationTemplate"),
+				templateId: requireId(templateId, "deleteNotificationTemplate"),
+				...await config("notificationTemplates", options)
+			}),
+			get: async (channel, templateId, options) => (0, __thunderid_javascript.getNotificationTemplate)({
+				channel: requireId(channel, "getNotificationTemplate"),
+				templateId: requireId(templateId, "getNotificationTemplate"),
+				...await config("notificationTemplates", options)
+			}),
+			list: async (channel, { limit, offset,...options } = {}) => (0, __thunderid_javascript.getNotificationTemplates)({
+				channel: requireId(channel, "getNotificationTemplates"),
+				limit,
+				offset,
+				...await config("notificationTemplates", options)
+			}),
+			update: async (channel, templateId, payload, options) => (0, __thunderid_javascript.updateNotificationTemplate)({
+				channel: requireId(channel, "updateNotificationTemplate"),
+				payload,
+				templateId: requireId(templateId, "updateNotificationTemplate"),
+				...await config("notificationTemplates", options)
+			})
+		},
+		organizationUnits: {
+			create: async (payload, options) => (0, __thunderid_javascript.createOrganizationUnit)({
+				payload,
+				...await config("organizationUnits", options)
+			}),
+			delete: async (ouId, options) => (0, __thunderid_javascript.deleteOrganizationUnit)({
+				ouId: requireId(ouId, "deleteOrganizationUnit"),
+				...await config("organizationUnits", options)
+			}),
+			deleteByPath: async (path, options) => (0, __thunderid_javascript.deleteOrganizationUnitByPath)({
+				path,
+				...await config("organizationUnits", options)
+			}),
+			get: async (ouId, options) => (0, __thunderid_javascript.getOrganizationUnit)({
+				ouId: requireId(ouId, "getOrganizationUnit"),
+				...await config("organizationUnits", options)
+			}),
+			getByPath: async (path, options) => (0, __thunderid_javascript.getOrganizationUnitByPath)({
+				path,
+				...await config("organizationUnits", options)
+			}),
+			list: async ({ filter, limit, offset,...options } = {}) => (0, __thunderid_javascript.getOrganizationUnits)({
+				filter,
+				limit,
+				offset,
+				...await config("organizationUnits", options)
+			}),
+			listChildren: async (unit, { filter, limit, offset,...options } = {}) => (0, __thunderid_javascript.getOrganizationUnitChildren)({
+				filter,
+				limit,
+				offset,
+				ouId: unit?.ouId,
+				path: unit?.path,
+				...await config("organizationUnits", options)
+			}),
+			listGroups: async (unit, { limit, offset,...options } = {}) => (0, __thunderid_javascript.getOrganizationUnitGroups)({
+				...unit,
+				limit,
+				offset,
+				...await config("organizationUnits", options)
+			}),
+			listRoles: async (unit, { limit, offset,...options } = {}) => (0, __thunderid_javascript.getOrganizationUnitRoles)({
+				...unit,
+				limit,
+				offset,
+				...await config("organizationUnits", options)
+			}),
+			listUsers: async (unit, { limit, offset,...options } = {}) => (0, __thunderid_javascript.getOrganizationUnitUsers)({
+				...unit,
+				limit,
+				offset,
+				...await config("organizationUnits", options)
+			}),
+			update: async (ouId, payload, options) => (0, __thunderid_javascript.updateOrganizationUnit)({
+				ouId: requireId(ouId, "updateOrganizationUnit"),
+				payload,
+				...await config("organizationUnits", options)
+			}),
+			updateByPath: async (path, payload, options) => (0, __thunderid_javascript.updateOrganizationUnitByPath)({
+				path,
+				payload,
+				...await config("organizationUnits", options)
+			})
+		},
+		resourceServers: {
+			create: async (payload, options) => (0, __thunderid_javascript.createResourceServer)({
+				payload,
+				...await config("resourceServers", options)
+			}),
+			createAction: async (resourceServerId, payload, { resourceId,...options } = {}) => (0, __thunderid_javascript.createAction)({
+				payload,
+				resourceId,
+				resourceServerId: requireId(resourceServerId, "createAction"),
+				...await config("resourceServers", options)
+			}),
+			createResource: async (resourceServerId, payload, options) => (0, __thunderid_javascript.createResource)({
+				payload,
+				resourceServerId: requireId(resourceServerId, "createResource"),
+				...await config("resourceServers", options)
+			}),
+			delete: async (resourceServerId, options) => (0, __thunderid_javascript.deleteResourceServer)({
+				resourceServerId: requireId(resourceServerId, "deleteResourceServer"),
+				...await config("resourceServers", options)
+			}),
+			deleteAction: async (resourceServerId, actionId, { administrationMode, resourceId,...options } = {}) => (0, __thunderid_javascript.deleteAction)({
+				actionId: requireId(actionId, "deleteAction"),
+				administrationMode,
+				resourceId,
+				resourceServerId: requireId(resourceServerId, "deleteAction"),
+				...await config("resourceServers", options)
+			}),
+			deleteResource: async (resourceServerId, resourceId, options) => (0, __thunderid_javascript.deleteResource)({
+				resourceId: requireId(resourceId, "deleteResource"),
+				resourceServerId: requireId(resourceServerId, "deleteResource"),
+				...await config("resourceServers", options)
+			}),
+			get: async (resourceServerId, options) => (0, __thunderid_javascript.getResourceServer)({
+				resourceServerId: requireId(resourceServerId, "getResourceServer"),
+				...await config("resourceServers", options)
+			}),
+			getAction: async (resourceServerId, actionId, { resourceId,...options } = {}) => (0, __thunderid_javascript.getAction)({
+				actionId: requireId(actionId, "getAction"),
+				resourceId,
+				resourceServerId: requireId(resourceServerId, "getAction"),
+				...await config("resourceServers", options)
+			}),
+			getResource: async (resourceServerId, resourceId, options) => (0, __thunderid_javascript.getResource)({
+				resourceId: requireId(resourceId, "getResource"),
+				resourceServerId: requireId(resourceServerId, "getResource"),
+				...await config("resourceServers", options)
+			}),
+			list: async ({ limit, offset,...options } = {}) => (0, __thunderid_javascript.getResourceServers)({
+				limit,
+				offset,
+				...await config("resourceServers", options)
+			}),
+			listActions: async (resourceServerId, { kind, limit, offset, resourceId,...options } = {}) => (0, __thunderid_javascript.getActions)({
+				kind,
+				limit,
+				offset,
+				resourceId,
+				resourceServerId: requireId(resourceServerId, "getActions"),
+				...await config("resourceServers", options)
+			}),
+			listResources: async (resourceServerId, { limit, offset, parentId,...options } = {}) => (0, __thunderid_javascript.getResources)({
+				limit,
+				offset,
+				parentId,
+				resourceServerId: requireId(resourceServerId, "getResources"),
+				...await config("resourceServers", options)
+			}),
+			update: async (resourceServerId, payload, options) => (0, __thunderid_javascript.updateResourceServer)({
+				payload,
+				resourceServerId: requireId(resourceServerId, "updateResourceServer"),
+				...await config("resourceServers", options)
+			}),
+			updateAction: async (resourceServerId, actionId, payload, { resourceId,...options } = {}) => (0, __thunderid_javascript.updateAction)({
+				actionId: requireId(actionId, "updateAction"),
+				payload,
+				resourceId,
+				resourceServerId: requireId(resourceServerId, "updateAction"),
+				...await config("resourceServers", options)
+			}),
+			updateResource: async (resourceServerId, resourceId, payload, options) => (0, __thunderid_javascript.updateResource)({
+				payload,
+				resourceId: requireId(resourceId, "updateResource"),
+				resourceServerId: requireId(resourceServerId, "updateResource"),
+				...await config("resourceServers", options)
+			})
+		},
+		roles: {
+			addAssignments: async (roleId, assignments, options) => (0, __thunderid_javascript.addRoleAssignments)({
+				assignments,
+				roleId: requireId(roleId, "addRoleAssignments"),
+				...await config("roles", options)
+			}),
+			create: async (payload, options) => (0, __thunderid_javascript.createRole)({
+				payload,
+				...await config("roles", options)
+			}),
+			delete: async (roleId, options) => (0, __thunderid_javascript.deleteRole)({
+				roleId: requireId(roleId, "deleteRole"),
+				...await config("roles", options)
+			}),
+			get: async (roleId, options) => (0, __thunderid_javascript.getRole)({
+				roleId: requireId(roleId, "getRole"),
+				...await config("roles", options)
+			}),
+			list: async ({ limit, offset,...options } = {}) => (0, __thunderid_javascript.getRoles)({
+				limit,
+				offset,
+				...await config("roles", options)
+			}),
+			listAssignments: async (roleId, { limit, offset, type,...options } = {}) => (0, __thunderid_javascript.getRoleAssignments)({
+				limit,
+				offset,
+				roleId: requireId(roleId, "getRoleAssignments"),
+				type,
+				...await config("roles", options)
+			}),
+			removeAssignments: async (roleId, assignments, options) => (0, __thunderid_javascript.removeRoleAssignments)({
+				assignments,
+				roleId: requireId(roleId, "removeRoleAssignments"),
+				...await config("roles", options)
+			}),
+			update: async (roleId, payload, options) => (0, __thunderid_javascript.updateRole)({
+				payload,
+				roleId: requireId(roleId, "updateRole"),
+				...await config("roles", options)
+			})
+		},
+		secrets: {
+			create: async (payload, options) => (0, __thunderid_javascript.createSecret)({
+				payload,
+				...await config("secrets", options)
+			}),
+			delete: async (name, options) => (0, __thunderid_javascript.deleteSecret)({
+				name: requireId(name, "deleteSecret"),
+				...await config("secrets", options)
+			}),
+			get: async (name, options) => (0, __thunderid_javascript.getSecret)({
+				name: requireId(name, "getSecret"),
+				...await config("secrets", options)
+			}),
+			list: async ({ filter, limit, names, offset,...options } = {}) => (0, __thunderid_javascript.getSecrets)({
+				filter,
+				limit,
+				names,
+				offset,
+				...await config("secrets", options)
+			}),
+			update: async (name, payload, options) => (0, __thunderid_javascript.updateSecret)({
+				name: requireId(name, "updateSecret"),
+				payload,
+				...await config("secrets", options)
+			})
+		},
+		serverConfig: {
+			get: async (name, options) => (0, __thunderid_javascript.getServerConfig)({
+				name: requireId(name, "getServerConfig"),
+				...await config("serverConfig", options)
+			}),
+			list: async (options) => (0, __thunderid_javascript.getServerConfigs)(await config("serverConfig", options)),
+			update: async (name, payload, options) => (0, __thunderid_javascript.updateServerConfig)({
+				name: requireId(name, "updateServerConfig"),
+				payload,
+				...await config("serverConfig", options)
+			})
+		},
+		userTypes: { list: async ({ limit, offset,...options } = {}) => (0, __thunderid_javascript.getUserTypes)({
+			limit,
+			offset,
+			...await config("userTypes", options)
+		}) },
+		users: {
+			create: async (payload, options) => (0, __thunderid_javascript.createUser)({
+				payload,
+				...await config("users", options)
+			}),
+			createByPath: async (path, payload, options) => (0, __thunderid_javascript.createUserByPath)({
+				path,
+				payload,
+				...await config("users", options)
+			}),
+			createSharingPolicy: async (userId, payload, options) => (0, __thunderid_javascript.createUserSharingPolicy)({
+				payload,
+				userId: requireId(userId, "createUserSharingPolicy"),
+				...await config("users", options)
+			}),
+			delete: async (userId, options) => (0, __thunderid_javascript.deleteUser)({
+				userId: requireId(userId, "deleteUser"),
+				...await config("users", options)
+			}),
+			deleteSharingPolicy: async (userId, policyId, options) => (0, __thunderid_javascript.deleteUserSharingPolicy)({
+				policyId: requireId(policyId, "deleteUserSharingPolicy"),
+				userId: requireId(userId, "deleteUserSharingPolicy"),
+				...await config("users", options)
+			}),
+			get: async (userId, options) => (0, __thunderid_javascript.getUser)({
+				userId: requireId(userId, "getUser"),
+				...await config("users", options)
+			}),
+			getOverlayRules: async (userId, ouId, options) => (0, __thunderid_javascript.getUserOverlayRules)({
+				ouId: requireId(ouId, "getUserOverlayRules"),
+				userId: requireId(userId, "getUserOverlayRules"),
+				...await config("users", options)
+			}),
+			getSharingPolicy: async (userId, policyId, options) => (0, __thunderid_javascript.getUserSharingPolicy)({
+				policyId: requireId(policyId, "getUserSharingPolicy"),
+				userId: requireId(userId, "getUserSharingPolicy"),
+				...await config("users", options)
+			}),
+			list: async ({ filter, limit, offset,...options } = {}) => (0, __thunderid_javascript.getUsers)({
+				filter,
+				limit,
+				offset,
+				...await config("users", options)
+			}),
+			listByPath: async (path, { limit, offset,...options } = {}) => (0, __thunderid_javascript.getUsersByPath)({
+				limit,
+				offset,
+				path,
+				...await config("users", options)
+			}),
+			listGroups: async (userId, { limit, offset,...options } = {}) => (0, __thunderid_javascript.getUserGroups)({
+				limit,
+				offset,
+				userId: requireId(userId, "getUserGroups"),
+				...await config("users", options)
+			}),
+			listSharingPolicies: async (userId, { limit, offset,...options } = {}) => (0, __thunderid_javascript.getUserSharingPolicies)({
+				limit,
+				offset,
+				userId: requireId(userId, "getUserSharingPolicies"),
+				...await config("users", options)
+			}),
+			suspend: async (userId, { operatorNote,...options } = {}) => (0, __thunderid_javascript.suspendUser)({
+				operatorNote,
+				userId: requireId(userId, "suspendUser"),
+				...await config("users", options)
+			}),
+			unlock: async (userId, { operatorNote,...options } = {}) => (0, __thunderid_javascript.unlockUser)({
+				operatorNote,
+				userId: requireId(userId, "unlockUser"),
+				...await config("users", options)
+			}),
+			unsuspend: async (userId, { operatorNote,...options } = {}) => (0, __thunderid_javascript.unsuspendUser)({
+				operatorNote,
+				userId: requireId(userId, "unsuspendUser"),
+				...await config("users", options)
+			}),
+			update: async (userId, payload, options) => (0, __thunderid_javascript.updateUser)({
+				payload,
+				userId: requireId(userId, "updateUser"),
+				...await config("users", options)
+			}),
+			updateSharingPolicy: async (userId, policyId, payload, options) => (0, __thunderid_javascript.updateUserSharingPolicy)({
+				payload,
+				policyId: requireId(policyId, "updateUserSharingPolicy"),
+				userId: requireId(userId, "updateUserSharingPolicy"),
+				...await config("users", options)
+			})
+		},
+		variables: {
+			create: async (payload, options) => (0, __thunderid_javascript.createVariable)({
+				payload,
+				...await config("variables", options)
+			}),
+			delete: async (name, options) => (0, __thunderid_javascript.deleteVariable)({
+				name: requireId(name, "deleteVariable"),
+				...await config("variables", options)
+			}),
+			get: async (name, options) => (0, __thunderid_javascript.getVariable)({
+				name: requireId(name, "getVariable"),
+				...await config("variables", options)
+			}),
+			list: async ({ filter, limit, names, offset,...options } = {}) => (0, __thunderid_javascript.getVariables)({
+				filter,
+				limit,
+				names,
+				offset,
+				...await config("variables", options)
+			}),
+			update: async (name, payload, options) => (0, __thunderid_javascript.updateVariable)({
+				name: requireId(name, "updateVariable"),
+				payload,
+				...await config("variables", options)
+			})
+		}
+	};
+};
+var createManagementClient_default = createManagementClient;
+
 //#endregion
 //#region src/utils/NodeCryptoUtils.ts
 /**
@@ -437,6 +1350,49 @@ var ThunderIDNodeClient = class extends __thunderid_javascript.ThunderIDJavaScri
 		};
 	}
 	/**
+	* Returns the management operations (users, groups, roles, agents, and their sub-resources) bound
+	* to the session identified by `sessionId`.
+	*
+	* Every request is authorized with that session's access token, read at the time of each call; the
+	* token is never copied onto the returned object or exposed to the caller. Whether a call succeeds
+	* is the server's decision: the token needs the permissions the server requires for that resource.
+	*
+	* The collection URL comes from, in order: the `url` passed to the call, then `endpoints.<resource>`
+	* in the configuration, then `{baseUrl}/{collection}`.
+	*
+	* @param sessionId - The session whose access token authorizes the requests.
+	* @returns The session-bound management client.
+	* @throws {ThunderIDRuntimeError} `NODE-MANAGEMENT-RC-NF01`, from an operation, when the session
+	*   has no access token. Raised before any request is sent.
+	* @throws {ThunderIDAPIError} From an operation, when the server rejects the request. HTTP 403 and
+	*   404 surface as `<operation>-ForbiddenError-001` and `<operation>-NotFoundError-001`.
+	*
+	* @example
+	* ```typescript
+	* const admin = client.management(sessionId);
+	* const {users, totalResults} = await admin.users.list({limit: 20});
+	* await admin.groups.addMembers(groupId, [{id: users[0].id, type: 'user'}]);
+	* ```
+	*/
+	management(sessionId) {
+		return createManagementClient_default((key, explicitUrl) => this.sessionManagementRequestConfig(key, sessionId, explicitUrl));
+	}
+	/**
+	* The URL inputs and bearer token for a management request made through {@link management}. Unlike
+	* {@link managementRequestConfig}, a session without an access token is refused here rather than
+	* sent to the server with an empty credential.
+	*/
+	async sessionManagementRequestConfig(key, sessionId, explicitUrl) {
+		const configData = await this.getStorageManager().getConfigData();
+		const accessToken = await this.getAccessToken(sessionId);
+		if (!accessToken) throw new __thunderid_javascript.ThunderIDRuntimeError("No access token is available for the session. Sign in before calling a management operation.", "NODE-MANAGEMENT-RC-NF01", "node");
+		return {
+			baseUrl: configData?.baseUrl,
+			headers: { Authorization: `Bearer ${accessToken}` },
+			url: (0, __thunderid_javascript.resolveResourceEndpoint)(key, configData, explicitUrl)
+		};
+	}
+	/**
 	* Retrieves one page of the user directory on behalf of the session identified by `userId`.
 	*
 	* Makes a single request and does not follow `links`. The access token stays on the server.
@@ -715,6 +1671,79 @@ var LoggedOutSessions_default = LoggedOutSessions;
 const generateSessionId = () => (/* @__PURE__ */ new Date()).getTime().toString(36) + Math.random().toString(36).substring(2);
 var generateSessionId_default = generateSessionId;
 
+//#endregion
+//#region src/utils/managementCollections.ts
+/**
+* The management collections a browser may reach through a server-side management relay, keyed by
+* their `endpoints` override key, with the path each one has under `baseUrl`.
+*/
+const MANAGEMENT_COLLECTIONS = {
+	agentTypes: "agent-types",
+	agents: "agents",
+	applications: "applications",
+	configurationVersions: "configuration-versions",
+	connections: "connections",
+	design: "design",
+	export: "export",
+	flows: "flows",
+	gateways: "gateways",
+	groups: "groups",
+	i18n: "i18n",
+	import: "import",
+	notificationTemplates: "notification-templates",
+	organizationUnits: "organization-units",
+	resourceServers: "resource-servers",
+	roles: "roles",
+	secrets: "secrets",
+	serverConfig: "server-config",
+	userTypes: "user-types",
+	users: "users",
+	variables: "variables"
+};
+const MANAGEMENT_COLLECTION_KEYS = Object.keys(MANAGEMENT_COLLECTIONS);
+/**
+* The collection URLs a management request may target for this configuration: each collection's
+* `endpoints` override, or `{baseUrl}/{path}` and the organization-scoped `{baseUrl}/o/{path}`.
+*/
+const getManagementCollectionUrls = (config) => {
+	const urls = [];
+	const baseUrl = config?.baseUrl?.replace(/\/+$/, "");
+	MANAGEMENT_COLLECTION_KEYS.forEach((key) => {
+		const override = (0, __thunderid_javascript.resolveResourceEndpoint)(key, config);
+		(override ? [override] : baseUrl ? [`${baseUrl}/${MANAGEMENT_COLLECTIONS[key]}`, `${baseUrl}/o/${MANAGEMENT_COLLECTIONS[key]}`] : []).forEach((candidate) => {
+			try {
+				urls.push(new URL(candidate.replace(/\/+$/, "")));
+			} catch {}
+		});
+	});
+	return urls;
+};
+/**
+* Whether `target` addresses one of the management collections, or a resource or sub-resource under
+* one. The comparison runs on the parsed URL, so dot segments are resolved before it, and an
+* encoded slash, backslash or dot, which an upstream could decode into a different path, is refused.
+*
+* @param target - The absolute URL the browser asked for.
+* @param collections - The allowed collection URLs, from {@link getManagementCollectionUrls}.
+* @returns The parsed URL when it is allowed, otherwise `undefined`.
+*/
+const matchManagementUrl = (target, collections) => {
+	if (typeof target !== "string" || target.length > 4096) return;
+	let url;
+	try {
+		url = new URL(target);
+	} catch {
+		return;
+	}
+	if (url.protocol !== "https:" && url.protocol !== "http:" || url.username || url.password || url.hash) return;
+	if (/%(2e|2f|5c)/i.test(url.pathname)) return;
+	return collections.some((collection) => {
+		if (collection.origin !== url.origin) return false;
+		const base = collection.pathname.replace(/\/+$/, "");
+		return url.pathname === base || url.pathname.startsWith(`${base}/`);
+	}) ? url : void 0;
+};
+
 //#endregion
 //#region src/utils/getSessionCookieOptions.ts
 const getSessionCookieOptions = (options) => ({
@@ -738,13 +1767,18 @@ exports.CookieChunking = CookieChunking_default;
 exports.CookieConfig = CookieConfig_default;
 exports.InMemoryLogoutRecordStore = InMemoryLogoutRecordStore;
 exports.LoggedOutSessions = LoggedOutSessions_default;
+exports.MANAGEMENT_COLLECTIONS = MANAGEMENT_COLLECTIONS;
+exports.MANAGEMENT_COLLECTION_KEYS = MANAGEMENT_COLLECTION_KEYS;
 exports.MemoryCacheStore = MemoryCacheStore_default;
 exports.NodeCryptoUtils = NodeCryptoUtils_default;
 exports.SessionIndex = SessionIndex_default;
 exports.SessionUtils = SessionUtils_default;
 exports.ThunderIDNodeClient = ThunderIDNodeClient_default;
+exports.createManagementClient = createManagementClient_default;
 exports.generateSessionId = generateSessionId_default;
+exports.getManagementCollectionUrls = getManagementCollectionUrls;
 exports.getSessionCookieOptions = getSessionCookieOptions_default;
+exports.matchManagementUrl = matchManagementUrl;
 Object.keys(__thunderid_javascript).forEach(function (k) {
   if (k !== 'default' && !Object.prototype.hasOwnProperty.call(exports, k)) Object.defineProperty(exports, k, {
     enumerable: true,