@thunderid/node 1.4.0 → 1.6.0

package/dist/index.js

@@ -1,5 +1,5 @@
 import fetch, { Headers, Request, Response } from "cross-fetch";
-import { BackchannelLogoutConstants, InvalidLogoutTokenError, ThunderIDAuthException, ThunderIDJavaScriptClient, getFlows, getUserTypes, getUsers, getVendorPrefix, logger, resolveResourceEndpoint, updateMeCredentials } from "@thunderid/javascript";
+import { BackchannelLogoutConstants, InvalidLogoutTokenError, ThunderIDAPIError, ThunderIDAuthException, ThunderIDJavaScriptClient, ThunderIDRuntimeError, addGroupMembers, addRoleAssignments, applyGatewayConfiguration, createAction, createAgent, createAgentType, createApplication, createApplicationSharingPolicy, createConfigurationVersion, createConnection, createDesignTheme, createFlow, createGateway, createGatewaySecret, createGatewayVariable, createGroup, createLayout, createNotificationTemplate, createOrganizationUnit, createResource, createResourceServer, createRole, createSecret, createUser, createUserByPath, createUserSharingPolicy, createVariable, deleteAction, deleteAgent, deleteAgentType, deleteApplication, deleteApplicationSharingPolicy, deleteConnection, deleteDesignTheme, deleteFlow, deleteGateway, deleteGatewaySecret, deleteGatewayVariable, deleteGroup, deleteImportedConfiguration, deleteLayout, deleteNotificationTemplate, deleteOrganizationUnit, deleteOrganizationUnitByPath, deleteResource, deleteResourceServer, deleteRole, deleteSecret, deleteTranslation, deleteTranslations, deleteUser, deleteUserSharingPolicy, deleteVariable, exportConfiguration, getAction, getActions, getAgent, getAgentGroups, getAgentRoles, getAgentType, getAgentTypes, getAgents, getApplication, getApplicationOverlayRules, getApplicationSharingPolicies, getApplicationSharingPolicy, getApplications, getConfigurationVersion, getConfigurationVersions, getConnection, getConnectionUsages, getConnections, getConnectionsMeta, getDesignTheme, getDesignThemeUsages, getDesignThemes, getFlow, getFlowUsages, getFlowVersion, getFlowVersions, getFlows, getGateway, getGatewayAppliedConfiguration, getGatewayAppliedVersion, getGatewayConfigurationDiff, getGatewaySecret, getGatewaySecrets, getGatewayVariable, getGatewayVariables, getGateways, getGroup, getGroupMembers, getGroups, getLanguages, getLayout, getLayoutUsages, getLayouts, getNotificationTemplate, getNotificationTemplates, getOrganizationUnit, getOrganizationUnitByPath, getOrganizationUnitChildren, getOrganizationUnitGroups, getOrganizationUnitRoles, getOrganizationUnitUsers, getOrganizationUnits, getResource, getResourceServer, getResourceServers, getResources, getRole, getRoleAssignments, getRoles, getSecret, getSecrets, getServerConfig, getServerConfigs, getUser, getUserGroups, getUserOverlayRules, getUserSharingPolicies, getUserSharingPolicy, getUserTypes, getUsers, getUsersByPath, getVariable, getVariables, getVendorPrefix, importConfiguration, logger, previewCimdDocument, regenerateClientSecret, regenerateFlowSecret, removeGroupMembers, removeRoleAssignments, resolveDesign, resolveResourceEndpoint, resolveTranslation, resolveTranslations, restoreFlowVersion, revertGatewayConfiguration, setTranslation, setTranslations, suspendAgent, suspendApplication, suspendUser, unlockAgent, unlockUser, unsuspendAgent, unsuspendApplication, unsuspendUser, updateAction, updateAgent, updateAgentType, updateApplication, updateApplicationSharingPolicy, updateConnection, updateDesignTheme, updateFlow, updateGateway, updateGatewaySecret, updateGatewayVariable, updateGroup, updateLayout, updateMeCredentials, updateNotificationTemplate, updateOrganizationUnit, updateOrganizationUnitByPath, updateResource, updateResourceServer, updateRole, updateSecret, updateServerConfig, updateUser, updateUserSharingPolicy, updateVariable } from "@thunderid/javascript";
 import cache from "memory-cache";
 import base64url from "base64url";
 import sha256 from "fast-sha256";
@@ -28,6 +28,919 @@ var MemoryCacheStore = class {
 };
 var MemoryCacheStore_default = MemoryCacheStore;
 
+//#endregion
+//#region src/utils/createManagementClient.ts
+/**
+* Rejects a missing or blank resource identifier before any request is made. The core API functions
+* reject a blank string, but an `undefined` identifier would otherwise address the whole collection,
+* which for a delete or update is never what the caller meant. Uses the same code the core raises.
+*/
+const requireId = (id, operation) => {
+	if (typeof id !== "string" || id.trim() === "") throw new ThunderIDAPIError("A resource identifier is required.", `${operation}-ValidationError-002`, "node", 400, "The provided resource identifier is empty.");
+	return id;
+};
+/**
+* Builds the server-side management client for one session.
+*
+* Each operation resolves its request config through `resolve` at call time, so the access token is
+* read fresh for every request and never held by the returned object.
+*
+* @param resolve - Supplies the base URL, collection URL, and `Authorization` header for a request.
+* @returns The session-bound management operations.
+*/
+const createManagementClient = (resolve) => {
+	const config = async (key, { fetcher, signal, url } = {}) => ({
+		...fetcher ? { fetcher } : {},
+		...signal ? { signal } : {},
+		...await resolve(key, url)
+	});
+	return {
+		agentTypes: {
+			create: async (payload, options) => createAgentType({
+				payload,
+				...await config("agentTypes", options)
+			}),
+			delete: async (agentTypeId, options) => deleteAgentType({
+				agentTypeId: requireId(agentTypeId, "deleteAgentType"),
+				...await config("agentTypes", options)
+			}),
+			get: async (agentTypeId, options) => getAgentType({
+				agentTypeId: requireId(agentTypeId, "getAgentType"),
+				...await config("agentTypes", options)
+			}),
+			list: async ({ limit, offset,...options } = {}) => getAgentTypes({
+				limit,
+				offset,
+				...await config("agentTypes", options)
+			}),
+			update: async (agentTypeId, payload, options) => updateAgentType({
+				agentTypeId: requireId(agentTypeId, "updateAgentType"),
+				payload,
+				...await config("agentTypes", options)
+			})
+		},
+		agents: {
+			create: async (payload, options) => createAgent({
+				payload,
+				...await config("agents", options)
+			}),
+			delete: async (agentId, options) => deleteAgent({
+				agentId: requireId(agentId, "deleteAgent"),
+				...await config("agents", options)
+			}),
+			get: async (agentId, options) => getAgent({
+				agentId: requireId(agentId, "getAgent"),
+				...await config("agents", options)
+			}),
+			list: async ({ filter, limit, offset,...options } = {}) => getAgents({
+				filter,
+				limit,
+				offset,
+				...await config("agents", options)
+			}),
+			listGroups: async (agentId, { limit, offset,...options } = {}) => getAgentGroups({
+				agentId: requireId(agentId, "getAgentGroups"),
+				limit,
+				offset,
+				...await config("agents", options)
+			}),
+			listRoles: async (agentId, { limit, offset,...options } = {}) => getAgentRoles({
+				agentId: requireId(agentId, "getAgentRoles"),
+				limit,
+				offset,
+				...await config("agents", options)
+			}),
+			suspend: async (agentId, { operatorNote,...options } = {}) => suspendAgent({
+				agentId: requireId(agentId, "suspendAgent"),
+				operatorNote,
+				...await config("agents", options)
+			}),
+			unlock: async (agentId, { operatorNote,...options } = {}) => unlockAgent({
+				agentId: requireId(agentId, "unlockAgent"),
+				operatorNote,
+				...await config("agents", options)
+			}),
+			unsuspend: async (agentId, { operatorNote,...options } = {}) => unsuspendAgent({
+				agentId: requireId(agentId, "unsuspendAgent"),
+				operatorNote,
+				...await config("agents", options)
+			}),
+			update: async (agentId, payload, options) => updateAgent({
+				agentId: requireId(agentId, "updateAgent"),
+				payload,
+				...await config("agents", options)
+			})
+		},
+		applications: {
+			create: async (payload, options) => createApplication({
+				payload,
+				...await config("applications", options)
+			}),
+			createSharingPolicy: async (applicationId, payload, options) => createApplicationSharingPolicy({
+				applicationId: requireId(applicationId, "createApplicationSharingPolicy"),
+				payload,
+				...await config("applications", options)
+			}),
+			delete: async (applicationId, { administrationMode,...options } = {}) => deleteApplication({
+				administrationMode,
+				applicationId: requireId(applicationId, "deleteApplication"),
+				...await config("applications", options)
+			}),
+			deleteSharingPolicy: async (applicationId, policyId, options) => deleteApplicationSharingPolicy({
+				applicationId: requireId(applicationId, "deleteApplicationSharingPolicy"),
+				policyId: requireId(policyId, "deleteApplicationSharingPolicy"),
+				...await config("applications", options)
+			}),
+			get: async (applicationId, options) => getApplication({
+				applicationId: requireId(applicationId, "getApplication"),
+				...await config("applications", options)
+			}),
+			getOverlayRules: async (applicationId, ouId, options) => getApplicationOverlayRules({
+				applicationId: requireId(applicationId, "getApplicationOverlayRules"),
+				ouId: requireId(ouId, "getApplicationOverlayRules"),
+				...await config("applications", options)
+			}),
+			getSharingPolicy: async (applicationId, policyId, options) => getApplicationSharingPolicy({
+				applicationId: requireId(applicationId, "getApplicationSharingPolicy"),
+				policyId: requireId(policyId, "getApplicationSharingPolicy"),
+				...await config("applications", options)
+			}),
+			list: async ({ limit, offset,...options } = {}) => getApplications({
+				limit,
+				offset,
+				...await config("applications", options)
+			}),
+			listSharingPolicies: async (applicationId, { limit, offset,...options } = {}) => getApplicationSharingPolicies({
+				applicationId: requireId(applicationId, "getApplicationSharingPolicies"),
+				limit,
+				offset,
+				...await config("applications", options)
+			}),
+			previewCimdDocument: async (clientId, options) => previewCimdDocument({
+				clientId: requireId(clientId, "previewCimdDocument"),
+				...await config("applications", options)
+			}),
+			regenerateClientSecret: async (applicationId, { administrationMode,...options } = {}) => regenerateClientSecret({
+				administrationMode,
+				applicationId: requireId(applicationId, "regenerateClientSecret"),
+				...await config("applications", options)
+			}),
+			regenerateFlowSecret: async (applicationId, options) => regenerateFlowSecret({
+				applicationId: requireId(applicationId, "regenerateFlowSecret"),
+				...await config("applications", options)
+			}),
+			suspend: async (applicationId, { operatorNote,...options } = {}) => suspendApplication({
+				applicationId: requireId(applicationId, "suspendApplication"),
+				operatorNote,
+				...await config("applications", options)
+			}),
+			unsuspend: async (applicationId, { operatorNote,...options } = {}) => unsuspendApplication({
+				applicationId: requireId(applicationId, "unsuspendApplication"),
+				operatorNote,
+				...await config("applications", options)
+			}),
+			update: async (applicationId, payload, options) => updateApplication({
+				applicationId: requireId(applicationId, "updateApplication"),
+				payload,
+				...await config("applications", options)
+			}),
+			updateSharingPolicy: async (applicationId, policyId, payload, options) => updateApplicationSharingPolicy({
+				applicationId: requireId(applicationId, "updateApplicationSharingPolicy"),
+				payload,
+				policyId: requireId(policyId, "updateApplicationSharingPolicy"),
+				...await config("applications", options)
+			})
+		},
+		configuration: {
+			captureVersion: async (payload, options) => createConfigurationVersion({
+				payload,
+				...await config("configurationVersions", options)
+			}),
+			deleteImported: async (payload, options) => deleteImportedConfiguration({
+				payload,
+				...await config("import", options)
+			}),
+			export: async (payload, options) => exportConfiguration({
+				payload,
+				...await config("export", options)
+			}),
+			getVersion: async (version$1, options) => getConfigurationVersion({
+				version: requireId(version$1, "getConfigurationVersion"),
+				...await config("configurationVersions", options)
+			}),
+			import: async (payload, options) => importConfiguration({
+				payload,
+				...await config("import", options)
+			}),
+			listVersions: async (options) => getConfigurationVersions(await config("configurationVersions", options))
+		},
+		connections: {
+			create: async (type, payload, options) => createConnection({
+				payload,
+				type: requireId(type, "createConnection"),
+				...await config("connections", options)
+			}),
+			delete: async (type, connectionId, options) => deleteConnection({
+				connectionId: requireId(connectionId, "deleteConnection"),
+				type: requireId(type, "deleteConnection"),
+				...await config("connections", options)
+			}),
+			get: async (type, connectionId, options) => getConnection({
+				connectionId: requireId(connectionId, "getConnection"),
+				type: requireId(type, "getConnection"),
+				...await config("connections", options)
+			}),
+			getMeta: async ({ vendor,...options } = {}) => getConnectionsMeta({
+				vendor,
+				...await config("connections", options)
+			}),
+			list: async ({ category, limit, offset,...options } = {}) => getConnections({
+				category,
+				limit,
+				offset,
+				...await config("connections", options)
+			}),
+			listByType: async (type, options) => getConnections({
+				type: requireId(type, "getConnections"),
+				...await config("connections", options)
+			}),
+			listUsages: async (type, connectionId, options) => getConnectionUsages({
+				connectionId: requireId(connectionId, "getConnectionUsages"),
+				type: requireId(type, "getConnectionUsages"),
+				...await config("connections", options)
+			}),
+			update: async (type, connectionId, payload, options) => updateConnection({
+				connectionId: requireId(connectionId, "updateConnection"),
+				payload,
+				type: requireId(type, "updateConnection"),
+				...await config("connections", options)
+			})
+		},
+		design: {
+			createLayout: async (payload, options) => createLayout({
+				payload,
+				...await config("design", options)
+			}),
+			createTheme: async (payload, options) => createDesignTheme({
+				payload,
+				...await config("design", options)
+			}),
+			deleteLayout: async (layoutId, options) => deleteLayout({
+				layoutId: requireId(layoutId, "deleteLayout"),
+				...await config("design", options)
+			}),
+			deleteTheme: async (themeId, options) => deleteDesignTheme({
+				themeId: requireId(themeId, "deleteDesignTheme"),
+				...await config("design", options)
+			}),
+			getLayout: async (layoutId, options) => getLayout({
+				layoutId: requireId(layoutId, "getLayout"),
+				...await config("design", options)
+			}),
+			getTheme: async (themeId, options) => getDesignTheme({
+				themeId: requireId(themeId, "getDesignTheme"),
+				...await config("design", options)
+			}),
+			listLayoutUsages: async (layoutId, { limit, offset,...options } = {}) => getLayoutUsages({
+				layoutId: requireId(layoutId, "getLayoutUsages"),
+				limit,
+				offset,
+				...await config("design", options)
+			}),
+			listLayouts: async ({ limit, offset,...options } = {}) => getLayouts({
+				limit,
+				offset,
+				...await config("design", options)
+			}),
+			listThemeUsages: async (themeId, { limit, offset,...options } = {}) => getDesignThemeUsages({
+				limit,
+				offset,
+				themeId: requireId(themeId, "getDesignThemeUsages"),
+				...await config("design", options)
+			}),
+			listThemes: async ({ limit, offset,...options } = {}) => getDesignThemes({
+				limit,
+				offset,
+				...await config("design", options)
+			}),
+			resolve: async (type, id, options) => resolveDesign({
+				id: requireId(id, "resolveDesign"),
+				type,
+				...await config("design", options)
+			}),
+			updateLayout: async (layoutId, payload, options) => updateLayout({
+				layoutId: requireId(layoutId, "updateLayout"),
+				payload,
+				...await config("design", options)
+			}),
+			updateTheme: async (themeId, payload, options) => updateDesignTheme({
+				payload,
+				themeId: requireId(themeId, "updateDesignTheme"),
+				...await config("design", options)
+			})
+		},
+		flows: {
+			create: async (payload, options) => createFlow({
+				payload,
+				...await config("flows", options)
+			}),
+			delete: async (flowId, options) => deleteFlow({
+				flowId: requireId(flowId, "deleteFlow"),
+				...await config("flows", options)
+			}),
+			get: async (flowId, options) => getFlow({
+				flowId: requireId(flowId, "getFlow"),
+				...await config("flows", options)
+			}),
+			getVersion: async (flowId, version$1, options) => getFlowVersion({
+				flowId: requireId(flowId, "getFlowVersion"),
+				version: version$1,
+				...await config("flows", options)
+			}),
+			list: async ({ flowType, limit, offset,...options } = {}) => getFlows({
+				flowType,
+				limit,
+				offset,
+				...await config("flows", options)
+			}),
+			listUsages: async (flowId, options) => getFlowUsages({
+				flowId: requireId(flowId, "getFlowUsages"),
+				...await config("flows", options)
+			}),
+			listVersions: async (flowId, options) => getFlowVersions({
+				flowId: requireId(flowId, "getFlowVersions"),
+				...await config("flows", options)
+			}),
+			restoreVersion: async (flowId, version$1, options) => restoreFlowVersion({
+				flowId: requireId(flowId, "restoreFlowVersion"),
+				version: version$1,
+				...await config("flows", options)
+			}),
+			update: async (flowId, payload, options) => updateFlow({
+				flowId: requireId(flowId, "updateFlow"),
+				payload,
+				...await config("flows", options)
+			})
+		},
+		gateways: {
+			applyConfiguration: async (gatewayId, payload, options) => applyGatewayConfiguration({
+				gatewayId: requireId(gatewayId, "applyGatewayConfiguration"),
+				payload,
+				...await config("gateways", options)
+			}),
+			create: async (payload, options) => createGateway({
+				payload,
+				...await config("gateways", options)
+			}),
+			createSecret: async (gatewayId, payload, options) => createGatewaySecret({
+				gatewayId: requireId(gatewayId, "createGatewaySecret"),
+				payload,
+				...await config("gateways", options)
+			}),
+			createVariable: async (gatewayId, payload, options) => createGatewayVariable({
+				gatewayId: requireId(gatewayId, "createGatewayVariable"),
+				payload,
+				...await config("gateways", options)
+			}),
+			delete: async (gatewayId, options) => deleteGateway({
+				gatewayId: requireId(gatewayId, "deleteGateway"),
+				...await config("gateways", options)
+			}),
+			deleteSecret: async (gatewayId, name, options) => deleteGatewaySecret({
+				gatewayId: requireId(gatewayId, "deleteGatewaySecret"),
+				name: requireId(name, "deleteGatewaySecret"),
+				...await config("gateways", options)
+			}),
+			deleteVariable: async (gatewayId, name, options) => deleteGatewayVariable({
+				gatewayId: requireId(gatewayId, "deleteGatewayVariable"),
+				name: requireId(name, "deleteGatewayVariable"),
+				...await config("gateways", options)
+			}),
+			get: async (gatewayId, options) => getGateway({
+				gatewayId: requireId(gatewayId, "getGateway"),
+				...await config("gateways", options)
+			}),
+			getAppliedConfiguration: async (gatewayId, options) => getGatewayAppliedConfiguration({
+				gatewayId: requireId(gatewayId, "getGatewayAppliedConfiguration"),
+				...await config("gateways", options)
+			}),
+			getAppliedVersion: async (gatewayId, options) => getGatewayAppliedVersion({
+				gatewayId: requireId(gatewayId, "getGatewayAppliedVersion"),
+				...await config("gateways", options)
+			}),
+			getConfigurationDiff: async (gatewayId, { version: version$1,...options } = {}) => getGatewayConfigurationDiff({
+				gatewayId: requireId(gatewayId, "getGatewayConfigurationDiff"),
+				version: version$1,
+				...await config("gateways", options)
+			}),
+			getSecret: async (gatewayId, name, options) => getGatewaySecret({
+				gatewayId: requireId(gatewayId, "getGatewaySecret"),
+				name: requireId(name, "getGatewaySecret"),
+				...await config("gateways", options)
+			}),
+			getVariable: async (gatewayId, name, options) => getGatewayVariable({
+				gatewayId: requireId(gatewayId, "getGatewayVariable"),
+				name: requireId(name, "getGatewayVariable"),
+				...await config("gateways", options)
+			}),
+			list: async (options) => getGateways(await config("gateways", options)),
+			listSecrets: async (gatewayId, { filter, limit, names, offset,...options } = {}) => getGatewaySecrets({
+				filter,
+				gatewayId: requireId(gatewayId, "getGatewaySecrets"),
+				limit,
+				names,
+				offset,
+				...await config("gateways", options)
+			}),
+			listVariables: async (gatewayId, { filter, limit, names, offset,...options } = {}) => getGatewayVariables({
+				filter,
+				gatewayId: requireId(gatewayId, "getGatewayVariables"),
+				limit,
+				names,
+				offset,
+				...await config("gateways", options)
+			}),
+			revertConfiguration: async (gatewayId, payload, options) => revertGatewayConfiguration({
+				gatewayId: requireId(gatewayId, "revertGatewayConfiguration"),
+				payload,
+				...await config("gateways", options)
+			}),
+			update: async (gatewayId, payload, options) => updateGateway({
+				gatewayId: requireId(gatewayId, "updateGateway"),
+				payload,
+				...await config("gateways", options)
+			}),
+			updateSecret: async (gatewayId, name, payload, options) => updateGatewaySecret({
+				gatewayId: requireId(gatewayId, "updateGatewaySecret"),
+				name: requireId(name, "updateGatewaySecret"),
+				payload,
+				...await config("gateways", options)
+			}),
+			updateVariable: async (gatewayId, name, payload, options) => updateGatewayVariable({
+				gatewayId: requireId(gatewayId, "updateGatewayVariable"),
+				name: requireId(name, "updateGatewayVariable"),
+				payload,
+				...await config("gateways", options)
+			})
+		},
+		groups: {
+			addMembers: async (groupId, members, options) => addGroupMembers({
+				groupId: requireId(groupId, "addGroupMembers"),
+				members,
+				...await config("groups", options)
+			}),
+			create: async (payload, options) => createGroup({
+				payload,
+				...await config("groups", options)
+			}),
+			delete: async (groupId, options) => deleteGroup({
+				groupId: requireId(groupId, "deleteGroup"),
+				...await config("groups", options)
+			}),
+			get: async (groupId, options) => getGroup({
+				groupId: requireId(groupId, "getGroup"),
+				...await config("groups", options)
+			}),
+			list: async ({ limit, offset,...options } = {}) => getGroups({
+				limit,
+				offset,
+				...await config("groups", options)
+			}),
+			listMembers: async (groupId, { limit, offset,...options } = {}) => getGroupMembers({
+				groupId: requireId(groupId, "getGroupMembers"),
+				limit,
+				offset,
+				...await config("groups", options)
+			}),
+			removeMembers: async (groupId, members, options) => removeGroupMembers({
+				groupId: requireId(groupId, "removeGroupMembers"),
+				members,
+				...await config("groups", options)
+			}),
+			update: async (groupId, payload, options) => updateGroup({
+				groupId: requireId(groupId, "updateGroup"),
+				payload,
+				...await config("groups", options)
+			})
+		},
+		i18n: {
+			deleteTranslation: async (language, namespace, key, options) => deleteTranslation({
+				key,
+				language,
+				namespace,
+				...await config("i18n", options)
+			}),
+			deleteTranslations: async (language, options) => deleteTranslations({
+				language: requireId(language, "deleteTranslations"),
+				...await config("i18n", options)
+			}),
+			listLanguages: async (options) => getLanguages(await config("i18n", options)),
+			resolveTranslation: async (language, namespace, key, options) => resolveTranslation({
+				key,
+				language,
+				namespace,
+				...await config("i18n", options)
+			}),
+			resolveTranslations: async (language, { namespace,...options } = {}) => resolveTranslations({
+				language,
+				namespace,
+				...await config("i18n", options)
+			}),
+			setTranslation: async (language, namespace, key, payload, options) => setTranslation({
+				key,
+				language,
+				namespace,
+				payload,
+				...await config("i18n", options)
+			}),
+			setTranslations: async (language, payload, options) => setTranslations({
+				language,
+				payload,
+				...await config("i18n", options)
+			})
+		},
+		notificationTemplates: {
+			create: async (channel, payload, options) => createNotificationTemplate({
+				channel: requireId(channel, "createNotificationTemplate"),
+				payload,
+				...await config("notificationTemplates", options)
+			}),
+			delete: async (channel, templateId, options) => deleteNotificationTemplate({
+				channel: requireId(channel, "deleteNotificationTemplate"),
+				templateId: requireId(templateId, "deleteNotificationTemplate"),
+				...await config("notificationTemplates", options)
+			}),
+			get: async (channel, templateId, options) => getNotificationTemplate({
+				channel: requireId(channel, "getNotificationTemplate"),
+				templateId: requireId(templateId, "getNotificationTemplate"),
+				...await config("notificationTemplates", options)
+			}),
+			list: async (channel, { limit, offset,...options } = {}) => getNotificationTemplates({
+				channel: requireId(channel, "getNotificationTemplates"),
+				limit,
+				offset,
+				...await config("notificationTemplates", options)
+			}),
+			update: async (channel, templateId, payload, options) => updateNotificationTemplate({
+				channel: requireId(channel, "updateNotificationTemplate"),
+				payload,
+				templateId: requireId(templateId, "updateNotificationTemplate"),
+				...await config("notificationTemplates", options)
+			})
+		},
+		organizationUnits: {
+			create: async (payload, options) => createOrganizationUnit({
+				payload,
+				...await config("organizationUnits", options)
+			}),
+			delete: async (ouId, options) => deleteOrganizationUnit({
+				ouId: requireId(ouId, "deleteOrganizationUnit"),
+				...await config("organizationUnits", options)
+			}),
+			deleteByPath: async (path, options) => deleteOrganizationUnitByPath({
+				path,
+				...await config("organizationUnits", options)
+			}),
+			get: async (ouId, options) => getOrganizationUnit({
+				ouId: requireId(ouId, "getOrganizationUnit"),
+				...await config("organizationUnits", options)
+			}),
+			getByPath: async (path, options) => getOrganizationUnitByPath({
+				path,
+				...await config("organizationUnits", options)
+			}),
+			list: async ({ filter, limit, offset,...options } = {}) => getOrganizationUnits({
+				filter,
+				limit,
+				offset,
+				...await config("organizationUnits", options)
+			}),
+			listChildren: async (unit, { filter, limit, offset,...options } = {}) => getOrganizationUnitChildren({
+				filter,
+				limit,
+				offset,
+				ouId: unit?.ouId,
+				path: unit?.path,
+				...await config("organizationUnits", options)
+			}),
+			listGroups: async (unit, { limit, offset,...options } = {}) => getOrganizationUnitGroups({
+				...unit,
+				limit,
+				offset,
+				...await config("organizationUnits", options)
+			}),
+			listRoles: async (unit, { limit, offset,...options } = {}) => getOrganizationUnitRoles({
+				...unit,
+				limit,
+				offset,
+				...await config("organizationUnits", options)
+			}),
+			listUsers: async (unit, { limit, offset,...options } = {}) => getOrganizationUnitUsers({
+				...unit,
+				limit,
+				offset,
+				...await config("organizationUnits", options)
+			}),
+			update: async (ouId, payload, options) => updateOrganizationUnit({
+				ouId: requireId(ouId, "updateOrganizationUnit"),
+				payload,
+				...await config("organizationUnits", options)
+			}),
+			updateByPath: async (path, payload, options) => updateOrganizationUnitByPath({
+				path,
+				payload,
+				...await config("organizationUnits", options)
+			})
+		},
+		resourceServers: {
+			create: async (payload, options) => createResourceServer({
+				payload,
+				...await config("resourceServers", options)
+			}),
+			createAction: async (resourceServerId, payload, { resourceId,...options } = {}) => createAction({
+				payload,
+				resourceId,
+				resourceServerId: requireId(resourceServerId, "createAction"),
+				...await config("resourceServers", options)
+			}),
+			createResource: async (resourceServerId, payload, options) => createResource({
+				payload,
+				resourceServerId: requireId(resourceServerId, "createResource"),
+				...await config("resourceServers", options)
+			}),
+			delete: async (resourceServerId, options) => deleteResourceServer({
+				resourceServerId: requireId(resourceServerId, "deleteResourceServer"),
+				...await config("resourceServers", options)
+			}),
+			deleteAction: async (resourceServerId, actionId, { administrationMode, resourceId,...options } = {}) => deleteAction({
+				actionId: requireId(actionId, "deleteAction"),
+				administrationMode,
+				resourceId,
+				resourceServerId: requireId(resourceServerId, "deleteAction"),
+				...await config("resourceServers", options)
+			}),
+			deleteResource: async (resourceServerId, resourceId, options) => deleteResource({
+				resourceId: requireId(resourceId, "deleteResource"),
+				resourceServerId: requireId(resourceServerId, "deleteResource"),
+				...await config("resourceServers", options)
+			}),
+			get: async (resourceServerId, options) => getResourceServer({
+				resourceServerId: requireId(resourceServerId, "getResourceServer"),
+				...await config("resourceServers", options)
+			}),
+			getAction: async (resourceServerId, actionId, { resourceId,...options } = {}) => getAction({
+				actionId: requireId(actionId, "getAction"),
+				resourceId,
+				resourceServerId: requireId(resourceServerId, "getAction"),
+				...await config("resourceServers", options)
+			}),
+			getResource: async (resourceServerId, resourceId, options) => getResource({
+				resourceId: requireId(resourceId, "getResource"),
+				resourceServerId: requireId(resourceServerId, "getResource"),
+				...await config("resourceServers", options)
+			}),
+			list: async ({ limit, offset,...options } = {}) => getResourceServers({
+				limit,
+				offset,
+				...await config("resourceServers", options)
+			}),
+			listActions: async (resourceServerId, { kind, limit, offset, resourceId,...options } = {}) => getActions({
+				kind,
+				limit,
+				offset,
+				resourceId,
+				resourceServerId: requireId(resourceServerId, "getActions"),
+				...await config("resourceServers", options)
+			}),
+			listResources: async (resourceServerId, { limit, offset, parentId,...options } = {}) => getResources({
+				limit,
+				offset,
+				parentId,
+				resourceServerId: requireId(resourceServerId, "getResources"),
+				...await config("resourceServers", options)
+			}),
+			update: async (resourceServerId, payload, options) => updateResourceServer({
+				payload,
+				resourceServerId: requireId(resourceServerId, "updateResourceServer"),
+				...await config("resourceServers", options)
+			}),
+			updateAction: async (resourceServerId, actionId, payload, { resourceId,...options } = {}) => updateAction({
+				actionId: requireId(actionId, "updateAction"),
+				payload,
+				resourceId,
+				resourceServerId: requireId(resourceServerId, "updateAction"),
+				...await config("resourceServers", options)
+			}),
+			updateResource: async (resourceServerId, resourceId, payload, options) => updateResource({
+				payload,
+				resourceId: requireId(resourceId, "updateResource"),
+				resourceServerId: requireId(resourceServerId, "updateResource"),
+				...await config("resourceServers", options)
+			})
+		},
+		roles: {
+			addAssignments: async (roleId, assignments, options) => addRoleAssignments({
+				assignments,
+				roleId: requireId(roleId, "addRoleAssignments"),
+				...await config("roles", options)
+			}),
+			create: async (payload, options) => createRole({
+				payload,
+				...await config("roles", options)
+			}),
+			delete: async (roleId, options) => deleteRole({
+				roleId: requireId(roleId, "deleteRole"),
+				...await config("roles", options)
+			}),
+			get: async (roleId, options) => getRole({
+				roleId: requireId(roleId, "getRole"),
+				...await config("roles", options)
+			}),
+			list: async ({ limit, offset,...options } = {}) => getRoles({
+				limit,
+				offset,
+				...await config("roles", options)
+			}),
+			listAssignments: async (roleId, { limit, offset, type,...options } = {}) => getRoleAssignments({
+				limit,
+				offset,
+				roleId: requireId(roleId, "getRoleAssignments"),
+				type,
+				...await config("roles", options)
+			}),
+			removeAssignments: async (roleId, assignments, options) => removeRoleAssignments({
+				assignments,
+				roleId: requireId(roleId, "removeRoleAssignments"),
+				...await config("roles", options)
+			}),
+			update: async (roleId, payload, options) => updateRole({
+				payload,
+				roleId: requireId(roleId, "updateRole"),
+				...await config("roles", options)
+			})
+		},
+		secrets: {
+			create: async (payload, options) => createSecret({
+				payload,
+				...await config("secrets", options)
+			}),
+			delete: async (name, options) => deleteSecret({
+				name: requireId(name, "deleteSecret"),
+				...await config("secrets", options)
+			}),
+			get: async (name, options) => getSecret({
+				name: requireId(name, "getSecret"),
+				...await config("secrets", options)
+			}),
+			list: async ({ filter, limit, names, offset,...options } = {}) => getSecrets({
+				filter,
+				limit,
+				names,
+				offset,
+				...await config("secrets", options)
+			}),
+			update: async (name, payload, options) => updateSecret({
+				name: requireId(name, "updateSecret"),
+				payload,
+				...await config("secrets", options)
+			})
+		},
+		serverConfig: {
+			get: async (name, options) => getServerConfig({
+				name: requireId(name, "getServerConfig"),
+				...await config("serverConfig", options)
+			}),
+			list: async (options) => getServerConfigs(await config("serverConfig", options)),
+			update: async (name, payload, options) => updateServerConfig({
+				name: requireId(name, "updateServerConfig"),
+				payload,
+				...await config("serverConfig", options)
+			})
+		},
+		userTypes: { list: async ({ limit, offset,...options } = {}) => getUserTypes({
+			limit,
+			offset,
+			...await config("userTypes", options)
+		}) },
+		users: {
+			create: async (payload, options) => createUser({
+				payload,
+				...await config("users", options)
+			}),
+			createByPath: async (path, payload, options) => createUserByPath({
+				path,
+				payload,
+				...await config("users", options)
+			}),
+			createSharingPolicy: async (userId, payload, options) => createUserSharingPolicy({
+				payload,
+				userId: requireId(userId, "createUserSharingPolicy"),
+				...await config("users", options)
+			}),
+			delete: async (userId, options) => deleteUser({
+				userId: requireId(userId, "deleteUser"),
+				...await config("users", options)
+			}),
+			deleteSharingPolicy: async (userId, policyId, options) => deleteUserSharingPolicy({
+				policyId: requireId(policyId, "deleteUserSharingPolicy"),
+				userId: requireId(userId, "deleteUserSharingPolicy"),
+				...await config("users", options)
+			}),
+			get: async (userId, options) => getUser({
+				userId: requireId(userId, "getUser"),
+				...await config("users", options)
+			}),
+			getOverlayRules: async (userId, ouId, options) => getUserOverlayRules({
+				ouId: requireId(ouId, "getUserOverlayRules"),
+				userId: requireId(userId, "getUserOverlayRules"),
+				...await config("users", options)
+			}),
+			getSharingPolicy: async (userId, policyId, options) => getUserSharingPolicy({
+				policyId: requireId(policyId, "getUserSharingPolicy"),
+				userId: requireId(userId, "getUserSharingPolicy"),
+				...await config("users", options)
+			}),
+			list: async ({ filter, limit, offset,...options } = {}) => getUsers({
+				filter,
+				limit,
+				offset,
+				...await config("users", options)
+			}),
+			listByPath: async (path, { limit, offset,...options } = {}) => getUsersByPath({
+				limit,
+				offset,
+				path,
+				...await config("users", options)
+			}),
+			listGroups: async (userId, { limit, offset,...options } = {}) => getUserGroups({
+				limit,
+				offset,
+				userId: requireId(userId, "getUserGroups"),
+				...await config("users", options)
+			}),
+			listSharingPolicies: async (userId, { limit, offset,...options } = {}) => getUserSharingPolicies({
+				limit,
+				offset,
+				userId: requireId(userId, "getUserSharingPolicies"),
+				...await config("users", options)
+			}),
+			suspend: async (userId, { operatorNote,...options } = {}) => suspendUser({
+				operatorNote,
+				userId: requireId(userId, "suspendUser"),
+				...await config("users", options)
+			}),
+			unlock: async (userId, { operatorNote,...options } = {}) => unlockUser({
+				operatorNote,
+				userId: requireId(userId, "unlockUser"),
+				...await config("users", options)
+			}),
+			unsuspend: async (userId, { operatorNote,...options } = {}) => unsuspendUser({
+				operatorNote,
+				userId: requireId(userId, "unsuspendUser"),
+				...await config("users", options)
+			}),
+			update: async (userId, payload, options) => updateUser({
+				payload,
+				userId: requireId(userId, "updateUser"),
+				...await config("users", options)
+			}),
+			updateSharingPolicy: async (userId, policyId, payload, options) => updateUserSharingPolicy({
+				payload,
+				policyId: requireId(policyId, "updateUserSharingPolicy"),
+				userId: requireId(userId, "updateUserSharingPolicy"),
+				...await config("users", options)
+			})
+		},
+		variables: {
+			create: async (payload, options) => createVariable({
+				payload,
+				...await config("variables", options)
+			}),
+			delete: async (name, options) => deleteVariable({
+				name: requireId(name, "deleteVariable"),
+				...await config("variables", options)
+			}),
+			get: async (name, options) => getVariable({
+				name: requireId(name, "getVariable"),
+				...await config("variables", options)
+			}),
+			list: async ({ filter, limit, names, offset,...options } = {}) => getVariables({
+				filter,
+				limit,
+				names,
+				offset,
+				...await config("variables", options)
+			}),
+			update: async (name, payload, options) => updateVariable({
+				name: requireId(name, "updateVariable"),
+				payload,
+				...await config("variables", options)
+			})
+		}
+	};
+};
+var createManagementClient_default = createManagementClient;
+
 //#endregion
 //#region src/utils/NodeCryptoUtils.ts
 /**
@@ -407,6 +1320,49 @@ var ThunderIDNodeClient = class extends ThunderIDJavaScriptClient {
 		};
 	}
 	/**
+	* Returns the management operations (users, groups, roles, agents, and their sub-resources) bound
+	* to the session identified by `sessionId`.
+	*
+	* Every request is authorized with that session's access token, read at the time of each call; the
+	* token is never copied onto the returned object or exposed to the caller. Whether a call succeeds
+	* is the server's decision: the token needs the permissions the server requires for that resource.
+	*
+	* The collection URL comes from, in order: the `url` passed to the call, then `endpoints.<resource>`
+	* in the configuration, then `{baseUrl}/{collection}`.
+	*
+	* @param sessionId - The session whose access token authorizes the requests.
+	* @returns The session-bound management client.
+	* @throws {ThunderIDRuntimeError} `NODE-MANAGEMENT-RC-NF01`, from an operation, when the session
+	*   has no access token. Raised before any request is sent.
+	* @throws {ThunderIDAPIError} From an operation, when the server rejects the request. HTTP 403 and
+	*   404 surface as `<operation>-ForbiddenError-001` and `<operation>-NotFoundError-001`.
+	*
+	* @example
+	* ```typescript
+	* const admin = client.management(sessionId);
+	* const {users, totalResults} = await admin.users.list({limit: 20});
+	* await admin.groups.addMembers(groupId, [{id: users[0].id, type: 'user'}]);
+	* ```
+	*/
+	management(sessionId) {
+		return createManagementClient_default((key, explicitUrl) => this.sessionManagementRequestConfig(key, sessionId, explicitUrl));
+	}
+	/**
+	* The URL inputs and bearer token for a management request made through {@link management}. Unlike
+	* {@link managementRequestConfig}, a session without an access token is refused here rather than
+	* sent to the server with an empty credential.
+	*/
+	async sessionManagementRequestConfig(key, sessionId, explicitUrl) {
+		const configData = await this.getStorageManager().getConfigData();
+		const accessToken = await this.getAccessToken(sessionId);
+		if (!accessToken) throw new ThunderIDRuntimeError("No access token is available for the session. Sign in before calling a management operation.", "NODE-MANAGEMENT-RC-NF01", "node");
+		return {
+			baseUrl: configData?.baseUrl,
+			headers: { Authorization: `Bearer ${accessToken}` },
+			url: resolveResourceEndpoint(key, configData, explicitUrl)
+		};
+	}
+	/**
 	* Retrieves one page of the user directory on behalf of the session identified by `userId`.
 	*
 	* Makes a single request and does not follow `links`. The access token stays on the server.
@@ -685,6 +1641,79 @@ var LoggedOutSessions_default = LoggedOutSessions;
 const generateSessionId = () => (/* @__PURE__ */ new Date()).getTime().toString(36) + Math.random().toString(36).substring(2);
 var generateSessionId_default = generateSessionId;
 
+//#endregion
+//#region src/utils/managementCollections.ts
+/**
+* The management collections a browser may reach through a server-side management relay, keyed by
+* their `endpoints` override key, with the path each one has under `baseUrl`.
+*/
+const MANAGEMENT_COLLECTIONS = {
+	agentTypes: "agent-types",
+	agents: "agents",
+	applications: "applications",
+	configurationVersions: "configuration-versions",
+	connections: "connections",
+	design: "design",
+	export: "export",
+	flows: "flows",
+	gateways: "gateways",
+	groups: "groups",
+	i18n: "i18n",
+	import: "import",
+	notificationTemplates: "notification-templates",
+	organizationUnits: "organization-units",
+	resourceServers: "resource-servers",
+	roles: "roles",
+	secrets: "secrets",
+	serverConfig: "server-config",
+	userTypes: "user-types",
+	users: "users",
+	variables: "variables"
+};
+const MANAGEMENT_COLLECTION_KEYS = Object.keys(MANAGEMENT_COLLECTIONS);
+/**
+* The collection URLs a management request may target for this configuration: each collection's
+* `endpoints` override, or `{baseUrl}/{path}` and the organization-scoped `{baseUrl}/o/{path}`.
+*/
+const getManagementCollectionUrls = (config) => {
+	const urls = [];
+	const baseUrl = config?.baseUrl?.replace(/\/+$/, "");
+	MANAGEMENT_COLLECTION_KEYS.forEach((key) => {
+		const override = resolveResourceEndpoint(key, config);
+		(override ? [override] : baseUrl ? [`${baseUrl}/${MANAGEMENT_COLLECTIONS[key]}`, `${baseUrl}/o/${MANAGEMENT_COLLECTIONS[key]}`] : []).forEach((candidate) => {
+			try {
+				urls.push(new URL(candidate.replace(/\/+$/, "")));
+			} catch {}
+		});
+	});
+	return urls;
+};
+/**
+* Whether `target` addresses one of the management collections, or a resource or sub-resource under
+* one. The comparison runs on the parsed URL, so dot segments are resolved before it, and an
+* encoded slash, backslash or dot, which an upstream could decode into a different path, is refused.
+*
+* @param target - The absolute URL the browser asked for.
+* @param collections - The allowed collection URLs, from {@link getManagementCollectionUrls}.
+* @returns The parsed URL when it is allowed, otherwise `undefined`.
+*/
+const matchManagementUrl = (target, collections) => {
+	if (typeof target !== "string" || target.length > 4096) return;
+	let url;
+	try {
+		url = new URL(target);
+	} catch {
+		return;
+	}
+	if (url.protocol !== "https:" && url.protocol !== "http:" || url.username || url.password || url.hash) return;
+	if (/%(2e|2f|5c)/i.test(url.pathname)) return;
+	return collections.some((collection) => {
+		if (collection.origin !== url.origin) return false;
+		const base = collection.pathname.replace(/\/+$/, "");
+		return url.pathname === base || url.pathname.startsWith(`${base}/`);
+	}) ? url : void 0;
+};
+
 //#endregion
 //#region src/utils/getSessionCookieOptions.ts
 const getSessionCookieOptions = (options) => ({
@@ -704,4 +1733,4 @@ if (!globalThis.fetch) {
 }
 
 //#endregion
-export { CookieChunking_default as CookieChunking, CookieConfig_default as CookieConfig, InMemoryLogoutRecordStore, LoggedOutSessions_default as LoggedOutSessions, MemoryCacheStore_default as MemoryCacheStore, NodeCryptoUtils_default as NodeCryptoUtils, SessionIndex_default as SessionIndex, SessionUtils_default as SessionUtils, ThunderIDNodeClient_default as ThunderIDNodeClient, generateSessionId_default as generateSessionId, getSessionCookieOptions_default as getSessionCookieOptions };
+export { CookieChunking_default as CookieChunking, CookieConfig_default as CookieConfig, InMemoryLogoutRecordStore, LoggedOutSessions_default as LoggedOutSessions, MANAGEMENT_COLLECTIONS, MANAGEMENT_COLLECTION_KEYS, MemoryCacheStore_default as MemoryCacheStore, NodeCryptoUtils_default as NodeCryptoUtils, SessionIndex_default as SessionIndex, SessionUtils_default as SessionUtils, ThunderIDNodeClient_default as ThunderIDNodeClient, createManagementClient_default as createManagementClient, generateSessionId_default as generateSessionId, getManagementCollectionUrls, getSessionCookieOptions_default as getSessionCookieOptions, matchManagementUrl };