@distilled.cloud/workos 0.0.0 → 0.15.0

package/src/operations/SsoControllerAuthorize.ts

@@ -0,0 +1,80 @@
+import * as Schema from "effect/Schema";
+import { API } from "../client.ts";
+import * as T from "../traits.ts";
+
+// Input Schema
+export const SsoControllerAuthorizeInput =
+  /*@__PURE__*/ /*#__PURE__*/ Schema.Struct({
+    provider_scopes: Schema.optional(Schema.String),
+    provider_query_params: Schema.optional(Schema.String),
+    client_id: Schema.String,
+    domain: Schema.optional(Schema.String),
+    provider: Schema.optional(
+      Schema.Literals([
+        "AppleOAuth",
+        "BitbucketOAuth",
+        "GitHubOAuth",
+        "GitLabOAuth",
+        "GoogleOAuth",
+        "IntuitOAuth",
+        "LinkedInOAuth",
+        "MicrosoftOAuth",
+        "SalesforceOAuth",
+        "SlackOAuth",
+        "VercelMarketplaceOAuth",
+        "VercelOAuth",
+        "XeroOAuth",
+      ]),
+    ),
+    redirect_uri: Schema.String,
+    response_type: Schema.String,
+    state: Schema.optional(Schema.String),
+    connection: Schema.optional(Schema.String),
+    organization: Schema.optional(Schema.String),
+    domain_hint: Schema.optional(Schema.String),
+    login_hint: Schema.optional(Schema.String),
+    nonce: Schema.optional(Schema.String),
+  }).pipe(T.Http({ method: "GET", path: "/sso/authorize" }));
+export type SsoControllerAuthorizeInput =
+  typeof SsoControllerAuthorizeInput.Type;
+
+// Output Schema
+export const SsoControllerAuthorizeOutput =
+  /*@__PURE__*/ /*#__PURE__*/ Schema.Struct({
+    url: Schema.String,
+  });
+export type SsoControllerAuthorizeOutput =
+  typeof SsoControllerAuthorizeOutput.Type;
+
+// The operation
+/**
+ * Initiate SSO
+ *
+ * Initiates the single sign-on flow.
+ *
+ * @param provider_scopes - Additional scopes to request from the identity provider. Applicable when using OAuth or OpenID Connect connections.
+ * @param provider_query_params - Key/value pairs of query parameters to pass to the OAuth provider. Only applicable when using OAuth connections.
+ * @param client_id - The unique identifier of the WorkOS environment client.
+ * @param domain - Deprecated. Use `connection` or `organization` instead. Used to initiate SSO for a connection by domain. The domain must be associated with a connection in your WorkOS environment.
+ * @param provider - Used to initiate OAuth authentication with various providers.
+ * @param redirect_uri - Where to redirect the user after they complete the authentication process. You must use one of the redirect URIs configured via the [Redirects](https://dashboard.workos.com/redirects) page on the dashboard.
+ * @param response_type - The only valid option for the response type parameter is `"code"`.
+
+The `"code"` parameter value initiates an [authorization code grant type](https://tools.ietf.org/html/rfc6749#section-4.1). This grant type allows you to exchange an authorization code for an access token during the redirect that takes place after a user has authenticated with an identity provider.
+ * @param state - An optional parameter that can be used to encode arbitrary information to help restore application state between redirects. If included, the redirect URI received from WorkOS will contain the exact `state` that was passed.
+ * @param connection - Used to initiate SSO for a connection. The value should be a WorkOS connection ID.
+
+You can persist the WorkOS connection ID with application user or team identifiers. WorkOS will use the connection indicated by the connection parameter to direct the user to the corresponding IdP for authentication.
+ * @param organization - Used to initiate SSO for an organization. The value should be a WorkOS organization ID.
+
+You can persist the WorkOS organization ID with application user or team identifiers. WorkOS will use the organization ID to determine the appropriate connection and the IdP to direct the user to for authentication.
+ * @param domain_hint - Can be used to pre-fill the domain field when initiating authentication with Microsoft OAuth or with a Google SAML connection type.
+ * @param login_hint - Can be used to pre-fill the username/email address field of the IdP sign-in page for the user, if you know their username ahead of time. Currently supported for OAuth, OpenID Connect, Okta, and Entra ID connections.
+ * @param nonce - A random string generated by the client that is used to mitigate replay attacks.
+ */
+export const SsoControllerAuthorize = /*@__PURE__*/ /*#__PURE__*/ API.make(
+  () => ({
+    inputSchema: SsoControllerAuthorizeInput,
+    outputSchema: SsoControllerAuthorizeOutput,
+  }),
+);

package/src/operations/SsoControllerGetProfile.ts

@@ -0,0 +1,101 @@
+import * as Schema from "effect/Schema";
+import { API } from "../client.ts";
+import * as T from "../traits.ts";
+import { NotFound } from "../errors.ts";
+
+// Input Schema
+export const SsoControllerGetProfileInput =
+  /*@__PURE__*/ /*#__PURE__*/ Schema.Struct({}).pipe(
+    T.Http({ method: "GET", path: "/sso/profile" }),
+  );
+export type SsoControllerGetProfileInput =
+  typeof SsoControllerGetProfileInput.Type;
+
+// Output Schema
+export const SsoControllerGetProfileOutput =
+  /*@__PURE__*/ /*#__PURE__*/ Schema.Struct({
+    object: Schema.String,
+    id: Schema.String,
+    organization_id: Schema.NullOr(Schema.String),
+    connection_id: Schema.String,
+    connection_type: Schema.Literals([
+      "Pending",
+      "ADFSSAML",
+      "AdpOidc",
+      "AppleOAuth",
+      "Auth0Migration",
+      "Auth0SAML",
+      "AzureSAML",
+      "BitbucketOAuth",
+      "CasSAML",
+      "ClassLinkSAML",
+      "CleverOIDC",
+      "CloudflareSAML",
+      "CyberArkSAML",
+      "DiscordOAuth",
+      "DuoSAML",
+      "EntraIdOIDC",
+      "GenericOIDC",
+      "GenericSAML",
+      "GitHubOAuth",
+      "GitLabOAuth",
+      "GoogleOAuth",
+      "GoogleOIDC",
+      "GoogleSAML",
+      "IntuitOAuth",
+      "JumpCloudSAML",
+      "KeycloakSAML",
+      "LastPassSAML",
+      "LinkedInOAuth",
+      "LoginGovOidc",
+      "MagicLink",
+      "MicrosoftOAuth",
+      "MiniOrangeSAML",
+      "NetIqSAML",
+      "OktaOIDC",
+      "OktaSAML",
+      "OneLoginSAML",
+      "OracleSAML",
+      "PingFederateSAML",
+      "PingOneSAML",
+      "RipplingSAML",
+      "SalesforceSAML",
+      "ShibbolethGenericSAML",
+      "ShibbolethSAML",
+      "SimpleSamlPhpSAML",
+      "SalesforceOAuth",
+      "SlackOAuth",
+      "TestIdp",
+      "VercelMarketplaceOAuth",
+      "VercelOAuth",
+      "VMwareSAML",
+      "XeroOAuth",
+    ]),
+    idp_id: Schema.String,
+    email: Schema.String,
+    first_name: Schema.NullOr(Schema.String),
+    last_name: Schema.NullOr(Schema.String),
+    role: Schema.optional(Schema.Unknown),
+    roles: Schema.optional(Schema.Unknown),
+    groups: Schema.optional(Schema.Array(Schema.String)),
+    custom_attributes: Schema.optional(
+      Schema.Record(Schema.String, Schema.Unknown),
+    ),
+    raw_attributes: Schema.Record(Schema.String, Schema.Unknown),
+  });
+export type SsoControllerGetProfileOutput =
+  typeof SsoControllerGetProfileOutput.Type;
+
+// The operation
+/**
+ * Get a User Profile
+ *
+ * Exchange an access token for a user's [Profile](/reference/sso/profile). Because this profile is returned in the [Get a Profile and Token endpoint](/reference/sso/profile/get-profile-and-token) your application usually does not need to call this endpoint. It is available for any authentication flows that require an additional endpoint to retrieve a user's profile.
+ */
+export const SsoControllerGetProfile = /*@__PURE__*/ /*#__PURE__*/ API.make(
+  () => ({
+    inputSchema: SsoControllerGetProfileInput,
+    outputSchema: SsoControllerGetProfileOutput,
+    errors: [NotFound] as const,
+  }),
+);

package/src/operations/SsoControllerJsonWebKeySet.ts

@@ -0,0 +1,47 @@
+import * as Schema from "effect/Schema";
+import { API } from "../client.ts";
+import * as T from "../traits.ts";
+import { NotFound } from "../errors.ts";
+
+// Input Schema
+export const SsoControllerJsonWebKeySetInput =
+  /*@__PURE__*/ /*#__PURE__*/ Schema.Struct({
+    clientId: Schema.String.pipe(T.PathParam()),
+  }).pipe(T.Http({ method: "GET", path: "/sso/jwks/{clientId}" }));
+export type SsoControllerJsonWebKeySetInput =
+  typeof SsoControllerJsonWebKeySetInput.Type;
+
+// Output Schema
+export const SsoControllerJsonWebKeySetOutput =
+  /*@__PURE__*/ /*#__PURE__*/ Schema.Struct({
+    keys: Schema.Array(
+      Schema.Struct({
+        alg: Schema.String,
+        kty: Schema.String,
+        use: Schema.String,
+        x5c: Schema.Array(Schema.String),
+        n: Schema.String,
+        e: Schema.String,
+        kid: Schema.String,
+        "x5t#S256": Schema.String,
+      }),
+    ),
+  });
+export type SsoControllerJsonWebKeySetOutput =
+  typeof SsoControllerJsonWebKeySetOutput.Type;
+
+// The operation
+/**
+ * Get JWKS
+ *
+ * Returns the JSON Web Key Set (JWKS) containing the public keys used for verifying access tokens.
+ *
+ * @param clientId - Identifies the application making the request to the WorkOS server. You can obtain your client ID from the [API Keys](https://dashboard.workos.com/api-keys) page in the dashboard.
+ */
+export const SsoControllerJsonWebKeySet = /*@__PURE__*/ /*#__PURE__*/ API.make(
+  () => ({
+    inputSchema: SsoControllerJsonWebKeySetInput,
+    outputSchema: SsoControllerJsonWebKeySetOutput,
+    errors: [NotFound] as const,
+  }),
+);

package/src/operations/SsoControllerLogout.ts

@@ -0,0 +1,31 @@
+import * as Schema from "effect/Schema";
+import { API } from "../client.ts";
+import * as T from "../traits.ts";
+import { NotFound } from "../errors.ts";
+
+// Input Schema
+export const SsoControllerLogoutInput =
+  /*@__PURE__*/ /*#__PURE__*/ Schema.Struct({
+    token: Schema.String,
+  }).pipe(T.Http({ method: "GET", path: "/sso/logout" }));
+export type SsoControllerLogoutInput = typeof SsoControllerLogoutInput.Type;
+
+// Output Schema
+export const SsoControllerLogoutOutput =
+  /*@__PURE__*/ /*#__PURE__*/ Schema.Void;
+export type SsoControllerLogoutOutput = typeof SsoControllerLogoutOutput.Type;
+
+// The operation
+/**
+ * Logout Redirect
+ *
+ * Logout allows to sign out a user from your application by triggering the identity provider sign out flow. This `GET` endpoint should be a redirection, since the identity provider user will be identified in the browser session.
+ * Before redirecting to this endpoint, you need to generate a short-lived logout token using the [Logout Authorize](/reference/sso/logout/authorize) endpoint.
+ *
+ * @param token - The logout token returned from the [Logout Authorize](/reference/sso/logout/authorize) endpoint.
+ */
+export const SsoControllerLogout = /*@__PURE__*/ /*#__PURE__*/ API.make(() => ({
+  inputSchema: SsoControllerLogoutInput,
+  outputSchema: SsoControllerLogoutOutput,
+  errors: [NotFound] as const,
+}));

package/src/operations/SsoControllerLogoutAuthorize.ts

@@ -0,0 +1,34 @@
+import * as Schema from "effect/Schema";
+import { API } from "../client.ts";
+import * as T from "../traits.ts";
+import { BadRequest, NotFound } from "../errors.ts";
+
+// Input Schema
+export const SsoControllerLogoutAuthorizeInput =
+  /*@__PURE__*/ /*#__PURE__*/ Schema.Struct({
+    profile_id: Schema.String,
+  }).pipe(T.Http({ method: "POST", path: "/sso/logout/authorize" }));
+export type SsoControllerLogoutAuthorizeInput =
+  typeof SsoControllerLogoutAuthorizeInput.Type;
+
+// Output Schema
+export const SsoControllerLogoutAuthorizeOutput =
+  /*@__PURE__*/ /*#__PURE__*/ Schema.Struct({
+    logout_url: Schema.String,
+    logout_token: Schema.String,
+  });
+export type SsoControllerLogoutAuthorizeOutput =
+  typeof SsoControllerLogoutAuthorizeOutput.Type;
+
+// The operation
+/**
+ * Logout Authorize
+ *
+ * You should call this endpoint from your server to generate a logout token which is required for the [Logout Redirect](/reference/sso/logout) endpoint.
+ */
+export const SsoControllerLogoutAuthorize =
+  /*@__PURE__*/ /*#__PURE__*/ API.make(() => ({
+    inputSchema: SsoControllerLogoutAuthorizeInput,
+    outputSchema: SsoControllerLogoutAuthorizeOutput,
+    errors: [BadRequest, NotFound] as const,
+  }));

package/src/operations/SsoControllerToken.ts

@@ -0,0 +1,120 @@
+import * as Schema from "effect/Schema";
+import { API } from "../client.ts";
+import * as T from "../traits.ts";
+import { BadRequest, NotFound, UnprocessableEntity } from "../errors.ts";
+import { SensitiveString } from "../sensitive.ts";
+
+// Input Schema
+export const SsoControllerTokenInput =
+  /*@__PURE__*/ /*#__PURE__*/ Schema.Struct({
+    client_id: Schema.String,
+    client_secret: Schema.String,
+    code: Schema.String,
+    grant_type: Schema.String,
+  }).pipe(T.Http({ method: "POST", path: "/sso/token" }));
+export type SsoControllerTokenInput = typeof SsoControllerTokenInput.Type;
+
+// Output Schema
+export const SsoControllerTokenOutput =
+  /*@__PURE__*/ /*#__PURE__*/ Schema.Struct({
+    token_type: Schema.String,
+    access_token: SensitiveString,
+    expires_in: Schema.Number,
+    profile: Schema.Struct({
+      object: Schema.String,
+      id: Schema.String,
+      organization_id: Schema.NullOr(Schema.String),
+      connection_id: Schema.String,
+      connection_type: Schema.Literals([
+        "Pending",
+        "ADFSSAML",
+        "AdpOidc",
+        "AppleOAuth",
+        "Auth0Migration",
+        "Auth0SAML",
+        "AzureSAML",
+        "BitbucketOAuth",
+        "CasSAML",
+        "ClassLinkSAML",
+        "CleverOIDC",
+        "CloudflareSAML",
+        "CyberArkSAML",
+        "DiscordOAuth",
+        "DuoSAML",
+        "EntraIdOIDC",
+        "GenericOIDC",
+        "GenericSAML",
+        "GitHubOAuth",
+        "GitLabOAuth",
+        "GoogleOAuth",
+        "GoogleOIDC",
+        "GoogleSAML",
+        "IntuitOAuth",
+        "JumpCloudSAML",
+        "KeycloakSAML",
+        "LastPassSAML",
+        "LinkedInOAuth",
+        "LoginGovOidc",
+        "MagicLink",
+        "MicrosoftOAuth",
+        "MiniOrangeSAML",
+        "NetIqSAML",
+        "OktaOIDC",
+        "OktaSAML",
+        "OneLoginSAML",
+        "OracleSAML",
+        "PingFederateSAML",
+        "PingOneSAML",
+        "RipplingSAML",
+        "SalesforceSAML",
+        "ShibbolethGenericSAML",
+        "ShibbolethSAML",
+        "SimpleSamlPhpSAML",
+        "SalesforceOAuth",
+        "SlackOAuth",
+        "TestIdp",
+        "VercelMarketplaceOAuth",
+        "VercelOAuth",
+        "VMwareSAML",
+        "XeroOAuth",
+      ]),
+      idp_id: Schema.String,
+      email: Schema.String,
+      first_name: Schema.NullOr(Schema.String),
+      last_name: Schema.NullOr(Schema.String),
+      role: Schema.optional(Schema.Unknown),
+      roles: Schema.optional(Schema.Unknown),
+      groups: Schema.optional(Schema.Array(Schema.String)),
+      custom_attributes: Schema.optional(
+        Schema.Record(Schema.String, Schema.Unknown),
+      ),
+      raw_attributes: Schema.Record(Schema.String, Schema.Unknown),
+    }),
+    oauth_tokens: Schema.optional(
+      Schema.Struct({
+        provider: Schema.String,
+        refresh_token: SensitiveString,
+        access_token: SensitiveString,
+        expires_at: Schema.Number,
+        scopes: Schema.Array(Schema.String),
+      }),
+    ),
+  });
+export type SsoControllerTokenOutput = typeof SsoControllerTokenOutput.Type;
+
+// The operation
+/**
+ * Get a Profile and Token
+ *
+ * Get an access token along with the user [Profile](/reference/sso/profile) using the code passed to your [Redirect URI](/reference/sso/get-authorization-url/redirect-uri).
+ *
+ * @param client_id - The client ID of the WorkOS environment.
+ * @param client_secret - The client secret of the WorkOS environment.
+ * @param code - The authorization code received from the authorization callback.
+ * @param grant_type - The grant type for the token request.
+ */
+export const SsoControllerToken = /*@__PURE__*/ /*#__PURE__*/ API.make(() => ({
+  inputSchema: SsoControllerTokenInput,
+  outputSchema: SsoControllerTokenOutput,
+  errors: [BadRequest, NotFound, UnprocessableEntity] as const,
+}));

package/src/operations/UserlandMagicAuthControllerGet.ts

@@ -0,0 +1,42 @@
+import * as Schema from "effect/Schema";
+import { API } from "../client.ts";
+import * as T from "../traits.ts";
+import { NotFound } from "../errors.ts";
+
+// Input Schema
+export const UserlandMagicAuthControllerGetInput =
+  /*@__PURE__*/ /*#__PURE__*/ Schema.Struct({
+    id: Schema.String.pipe(T.PathParam()),
+  }).pipe(T.Http({ method: "GET", path: "/user_management/magic_auth/{id}" }));
+export type UserlandMagicAuthControllerGetInput =
+  typeof UserlandMagicAuthControllerGetInput.Type;
+
+// Output Schema
+export const UserlandMagicAuthControllerGetOutput =
+  /*@__PURE__*/ /*#__PURE__*/ Schema.Struct({
+    object: Schema.String,
+    id: Schema.String,
+    user_id: Schema.String,
+    email: Schema.String,
+    expires_at: Schema.String,
+    created_at: Schema.String,
+    updated_at: Schema.String,
+    code: Schema.String,
+  });
+export type UserlandMagicAuthControllerGetOutput =
+  typeof UserlandMagicAuthControllerGetOutput.Type;
+
+// The operation
+/**
+ * Get Magic Auth code details
+ *
+ * Get the details of an existing [Magic Auth](/reference/authkit/magic-auth) code that can be used to send an email to a user for authentication.
+ *
+ * @param id - The unique ID of the Magic Auth code.
+ */
+export const UserlandMagicAuthControllerGet =
+  /*@__PURE__*/ /*#__PURE__*/ API.make(() => ({
+    inputSchema: UserlandMagicAuthControllerGetInput,
+    outputSchema: UserlandMagicAuthControllerGetOutput,
+    errors: [NotFound] as const,
+  }));

package/src/operations/UserlandMagicAuthControllerSendMagicAuthCodeAndReturn.ts

@@ -0,0 +1,41 @@
+import * as Schema from "effect/Schema";
+import { API } from "../client.ts";
+import * as T from "../traits.ts";
+import { BadRequest, UnprocessableEntity } from "../errors.ts";
+
+// Input Schema
+export const UserlandMagicAuthControllerSendMagicAuthCodeAndReturnInput =
+  /*@__PURE__*/ /*#__PURE__*/ Schema.Struct({
+    email: Schema.String,
+    invitation_token: Schema.optional(Schema.String),
+  }).pipe(T.Http({ method: "POST", path: "/user_management/magic_auth" }));
+export type UserlandMagicAuthControllerSendMagicAuthCodeAndReturnInput =
+  typeof UserlandMagicAuthControllerSendMagicAuthCodeAndReturnInput.Type;
+
+// Output Schema
+export const UserlandMagicAuthControllerSendMagicAuthCodeAndReturnOutput =
+  /*@__PURE__*/ /*#__PURE__*/ Schema.Struct({
+    object: Schema.String,
+    id: Schema.String,
+    user_id: Schema.String,
+    email: Schema.String,
+    expires_at: Schema.String,
+    created_at: Schema.String,
+    updated_at: Schema.String,
+    code: Schema.String,
+  });
+export type UserlandMagicAuthControllerSendMagicAuthCodeAndReturnOutput =
+  typeof UserlandMagicAuthControllerSendMagicAuthCodeAndReturnOutput.Type;
+
+// The operation
+/**
+ * Create a Magic Auth code
+ *
+ * Creates a one-time authentication code that can be sent to the user's email address. The code expires in 10 minutes. To verify the code, [authenticate the user with Magic Auth](/reference/authkit/authentication/magic-auth).
+ */
+export const UserlandMagicAuthControllerSendMagicAuthCodeAndReturn =
+  /*@__PURE__*/ /*#__PURE__*/ API.make(() => ({
+    inputSchema: UserlandMagicAuthControllerSendMagicAuthCodeAndReturnInput,
+    outputSchema: UserlandMagicAuthControllerSendMagicAuthCodeAndReturnOutput,
+    errors: [BadRequest, UnprocessableEntity] as const,
+  }));

package/src/operations/UserlandSessionsControllerAuthenticate.ts

@@ -0,0 +1,98 @@
+import * as Schema from "effect/Schema";
+import { API } from "../client.ts";
+import * as T from "../traits.ts";
+import {
+  BadRequest,
+  Forbidden,
+  NotFound,
+  UnprocessableEntity,
+} from "../errors.ts";
+import { SensitiveString } from "../sensitive.ts";
+
+// Input Schema
+export const UserlandSessionsControllerAuthenticateInput =
+  /*@__PURE__*/ /*#__PURE__*/ Schema.Struct({}).pipe(
+    T.Http({ method: "POST", path: "/user_management/authenticate" }),
+  );
+export type UserlandSessionsControllerAuthenticateInput =
+  typeof UserlandSessionsControllerAuthenticateInput.Type;
+
+// Output Schema
+export const UserlandSessionsControllerAuthenticateOutput =
+  /*@__PURE__*/ /*#__PURE__*/ Schema.Struct({
+    user: Schema.Struct({
+      object: Schema.String,
+      id: Schema.String,
+      first_name: Schema.NullOr(Schema.String),
+      last_name: Schema.NullOr(Schema.String),
+      profile_picture_url: Schema.NullOr(Schema.String),
+      email: Schema.String,
+      email_verified: Schema.Boolean,
+      external_id: Schema.NullOr(Schema.String),
+      metadata: Schema.optional(Schema.Record(Schema.String, Schema.String)),
+      last_sign_in_at: Schema.NullOr(Schema.String),
+      locale: Schema.optional(Schema.NullOr(Schema.String)),
+      created_at: Schema.String,
+      updated_at: Schema.String,
+    }),
+    organization_id: Schema.optional(Schema.String),
+    authkit_authorization_code: Schema.optional(Schema.String),
+    access_token: SensitiveString,
+    refresh_token: SensitiveString,
+    authentication_method: Schema.optional(
+      Schema.Literals([
+        "SSO",
+        "Password",
+        "Passkey",
+        "AppleOAuth",
+        "BitbucketOAuth",
+        "CrossAppAuth",
+        "DiscordOAuth",
+        "ExternalAuth",
+        "GitHubOAuth",
+        "GitLabOAuth",
+        "GoogleOAuth",
+        "IntuitOAuth",
+        "LinkedInOAuth",
+        "MicrosoftOAuth",
+        "SalesforceOAuth",
+        "SlackOAuth",
+        "VercelMarketplaceOAuth",
+        "VercelOAuth",
+        "XeroOAuth",
+        "MagicAuth",
+        "Impersonation",
+        "MigratedSession",
+      ]),
+    ),
+    impersonator: Schema.optional(
+      Schema.Struct({
+        email: Schema.String,
+        reason: Schema.NullOr(Schema.String),
+      }),
+    ),
+    oauth_tokens: Schema.optional(
+      Schema.Struct({
+        provider: Schema.String,
+        refresh_token: SensitiveString,
+        access_token: SensitiveString,
+        expires_at: Schema.Number,
+        scopes: Schema.Array(Schema.String),
+      }),
+    ),
+  });
+export type UserlandSessionsControllerAuthenticateOutput =
+  typeof UserlandSessionsControllerAuthenticateOutput.Type;
+
+// The operation
+/**
+ * Authenticate
+ *
+ * Authenticate a user with a specified [authentication method](/reference/authkit/authentication).
+ */
+export const UserlandSessionsControllerAuthenticate =
+  /*@__PURE__*/ /*#__PURE__*/ API.make(() => ({
+    inputSchema: UserlandSessionsControllerAuthenticateInput,
+    outputSchema: UserlandSessionsControllerAuthenticateOutput,
+    errors: [BadRequest, Forbidden, NotFound, UnprocessableEntity] as const,
+  }));

package/src/operations/UserlandSessionsControllerLogout.ts

@@ -0,0 +1,35 @@
+import * as Schema from "effect/Schema";
+import { API } from "../client.ts";
+import * as T from "../traits.ts";
+import { UnprocessableEntity } from "../errors.ts";
+
+// Input Schema
+export const UserlandSessionsControllerLogoutInput =
+  /*@__PURE__*/ /*#__PURE__*/ Schema.Struct({
+    session_id: Schema.String,
+    return_to: Schema.optional(Schema.String),
+  }).pipe(T.Http({ method: "GET", path: "/user_management/sessions/logout" }));
+export type UserlandSessionsControllerLogoutInput =
+  typeof UserlandSessionsControllerLogoutInput.Type;
+
+// Output Schema
+export const UserlandSessionsControllerLogoutOutput =
+  /*@__PURE__*/ /*#__PURE__*/ Schema.Void;
+export type UserlandSessionsControllerLogoutOutput =
+  typeof UserlandSessionsControllerLogoutOutput.Type;
+
+// The operation
+/**
+ * Logout
+ *
+ * Logout a user from the current [session](/reference/authkit/session).
+ *
+ * @param session_id - The ID of the session to revoke. This can be extracted from the `sid` claim of the access token.
+ * @param return_to - The URL to redirect the user to after session revocation.
+ */
+export const UserlandSessionsControllerLogout =
+  /*@__PURE__*/ /*#__PURE__*/ API.make(() => ({
+    inputSchema: UserlandSessionsControllerLogoutInput,
+    outputSchema: UserlandSessionsControllerLogoutOutput,
+    errors: [UnprocessableEntity] as const,
+  }));

package/src/operations/UserlandSessionsControllerRevokeSession.ts

@@ -0,0 +1,32 @@
+import * as Schema from "effect/Schema";
+import { API } from "../client.ts";
+import * as T from "../traits.ts";
+import { BadRequest } from "../errors.ts";
+
+// Input Schema
+export const UserlandSessionsControllerRevokeSessionInput =
+  /*@__PURE__*/ /*#__PURE__*/ Schema.Struct({
+    session_id: Schema.String,
+    return_to: Schema.optional(Schema.String),
+  }).pipe(T.Http({ method: "POST", path: "/user_management/sessions/revoke" }));
+export type UserlandSessionsControllerRevokeSessionInput =
+  typeof UserlandSessionsControllerRevokeSessionInput.Type;
+
+// Output Schema
+export const UserlandSessionsControllerRevokeSessionOutput =
+  /*@__PURE__*/ /*#__PURE__*/ Schema.Void;
+export type UserlandSessionsControllerRevokeSessionOutput =
+  typeof UserlandSessionsControllerRevokeSessionOutput.Type;
+
+// The operation
+/**
+ * Revoke Session
+ *
+ * Revoke a [user session](/reference/authkit/session).
+ */
+export const UserlandSessionsControllerRevokeSession =
+  /*@__PURE__*/ /*#__PURE__*/ API.make(() => ({
+    inputSchema: UserlandSessionsControllerRevokeSessionInput,
+    outputSchema: UserlandSessionsControllerRevokeSessionOutput,
+    errors: [BadRequest] as const,
+  }));