@memberjunction/auth-providers 5.43.0 → 5.45.0

package/.turbo/turbo-build.log

@@ -1,4 +1,4 @@
 
-> @memberjunction/auth-providers@5.43.0 build
+> @memberjunction/auth-providers@5.45.0 build
 > tsc && tsc-alias -f
 

package/CHANGELOG.md

@@ -1,5 +1,43 @@
 # @memberjunction/auth-providers
 
+## 5.45.0
+
+### Patch Changes
+
+- Updated dependencies [45d121b]
+- Updated dependencies [21e33fe]
+- Updated dependencies [b7cf50f]
+- Updated dependencies [f4f11fa]
+- Updated dependencies [e370816]
+- Updated dependencies [fbee64c]
+- Updated dependencies [b2927f1]
+- Updated dependencies [c1f2d3d]
+- Updated dependencies [0b1e009]
+  - @memberjunction/core@5.45.0
+  - @memberjunction/global@5.45.0
+
+## 5.44.0
+
+### Minor Changes
+
+- 2f9b863: Add WorkOS (AuthKit) as a first-class authentication provider — end to end, server-side JWT validation and browser-side login. A deployment can now set `type: 'workos'` (server) / `AUTH_TYPE: 'workos'` (browser) and authenticate users through WorkOS just like Auth0, Okta, MSAL, Cognito, or Google.
+  - **Server** (`@memberjunction/auth-providers`): `WorkOSProvider` extends `BaseAuthProvider`, registered via `@RegisterClass(BaseAuthProvider, 'workos')`. Maps AuthKit JWT claims to `AuthUserInfo` (with graceful fallbacks) and validates `clientId`; issuer matching, JWKS caching, and retry/backoff are inherited. Wired into `AuthProviderFactory`.
+  - **Client** (`@memberjunction/ng-auth-services`): `MJWorkOSProvider` extends `MJAuthBase`, registered via `@RegisterClass(MJAuthBase, 'workos')`. Wraps the `@workos-inc/authkit-js` SDK (`createClient`/`signIn`/`signOut`/`getUser`/`getAccessToken`) behind the standardized provider contract with semantic error classification.
+  - **Core** (`@memberjunction/core`): `AUTH_PROVIDER_TYPES` gains `WORKOS: 'workos'`.
+  - **Env typing** (`@memberjunction/ng-bootstrap`): the `AUTH_TYPE` union gains `'workos'`, plus `WORKOS_CLIENTID` / `WORKOS_REDIRECT_URI` / `WORKOS_API_HOSTNAME` / `WORKOS_DEV_MODE` keys.
+
+  Includes a full end-to-end integration guide (`packages/AuthProviders/WORKOS.md`) covering the two WorkOS-specific gotchas: the required `email` JWT Template (AuthKit access tokens omit email, which MJ keys users on) and matching the enforced `aud` claim. Additive only.
+
+### Patch Changes
+
+- Updated dependencies [5396d90]
+- Updated dependencies [7279819]
+- Updated dependencies [d44e430]
+- Updated dependencies [6f74b17]
+- Updated dependencies [2f9b863]
+  - @memberjunction/core@5.44.0
+  - @memberjunction/global@5.44.0
+
 ## 5.43.0
 
 ### Patch Changes

package/README.md

@@ -9,7 +9,9 @@ This package gives the MJ server (and any other Node.js consumer) a uniform, plu
 - Extract a normalized `AuthUserInfo` from provider-specific claim shapes
 - Register additional providers at runtime via the MJ class-factory system
 
-It ships with first-class support for **Auth0**, **Microsoft Entra ID / MSAL**, **Okta**, **AWS Cognito**, and **Google Identity Platform**, and is the extension point used to plug custom providers into [`@memberjunction/server`](../MJServer/README.md).
+It ships with first-class support for **Auth0**, **Microsoft Entra ID / MSAL**, **Okta**, **AWS Cognito**, **Google Identity Platform**, and **WorkOS (AuthKit)**, and is the extension point used to plug custom providers into [`@memberjunction/server`](../MJServer/README.md).
+
+> **Integrating WorkOS?** See the dedicated end-to-end guide: **[WORKOS.md](WORKOS.md)** — it covers the browser + server setup and the two WorkOS-specific gotchas (the required `email` JWT Template and matching the `aud` claim).
 
 ## When to use this package
 
@@ -67,6 +69,7 @@ This package is a Node.js / server-side package. It depends on:
 │           ├─ @RegisterClass(BaseAuthProvider, 'okta')            │
 │           ├─ @RegisterClass(BaseAuthProvider, 'cognito')         │
 │           ├─ @RegisterClass(BaseAuthProvider, 'google')          │
+│           ├─ @RegisterClass(BaseAuthProvider, 'workos')          │
 │           └─ @RegisterClass(BaseAuthProvider, 'your-custom')     │
 └──────────────────────────────────────────────────────────────────┘
 ```
@@ -95,6 +98,7 @@ Each built-in provider is registered with the MJ class factory under a lowercase
 | `okta`     | `OktaProvider`    | `clientId`, `domain`                                     |
 | `cognito`  | `CognitoProvider` | `clientId`, `region`, `userPoolId`                       |
 | `google`   | `GoogleProvider`  | `clientId`                                               |
+| `workos`   | `WorkOSProvider`  | `clientId` (see [WORKOS.md](WORKOS.md) for the required `email` JWT Template + `aud`) |
 
 Every provider also requires the base fields: `name`, `type`, `issuer`, `audience`, `jwksUri`. See [`AuthProviderConfig`](../MJCore/src/generic/authTypes.ts) for the full shape.
 
@@ -124,11 +128,23 @@ module.exports = {
       audience: 'https://api.example.com',
       jwksUri: 'https://tenant.auth0.com/.well-known/jwks.json',
     },
+    {
+      name: 'workos-prod',
+      type: 'workos',
+      clientId: process.env.WORKOS_CLIENT_ID, // client_01H...
+      issuer: `https://api.workos.com/user_management/${process.env.WORKOS_CLIENT_ID}`,
+      jwksUri: `https://api.workos.com/sso/jwks/${process.env.WORKOS_CLIENT_ID}`,
+      audience: process.env.WORKOS_CLIENT_ID, // must match the token's `aud` — see WORKOS.md
+    },
     // ...add more providers here
   ],
 };
 ```
 
+> **WorkOS needs two extra steps** beyond this config — an `email` JWT Template (its access tokens
+> omit email, which MJ keys users on) and matching the `aud` claim. The full walkthrough is in
+> **[WORKOS.md](WORKOS.md)**.
+
 > **Multiple audiences on the same issuer.** When two MJ apps share an Auth0 domain but use different client IDs, register both as separate entries — `AuthProviderFactory.getAllByIssuer()` returns every match so the validator can try each audience.
 
 ## Usage

package/WORKOS.md

@@ -0,0 +1,256 @@
+# WorkOS (AuthKit) Integration Guide
+
+This guide walks you through wiring **WorkOS AuthKit** into MemberJunction end to end —
+browser login and server-side token validation — so users sign in through WorkOS exactly like
+they would through Auth0, Okta, MSAL, Cognito, or Google.
+
+WorkOS is consumed as an OIDC/JWT identity provider. MemberJunction does **not** replace WorkOS;
+WorkOS handles authentication (hosted login, SSO, MFA, Directory Sync) and MJ handles everything
+after the user is identified (entities, permissions, agents, audit).
+
+> **TL;DR — the one thing that trips everyone up:** a WorkOS AuthKit **access token does not
+> include the user's email by default**, and MemberJunction resolves users by email. You must add
+> an `email` claim with a [WorkOS **JWT Template**](#step-3--add-an-email-claim-jwt-template).
+> Skip this and every login will fail user lookup on the server. See
+> [Step 3](#step-3--add-an-email-claim-jwt-template).
+
+---
+
+## Table of contents
+
+1. [How it fits together](#how-it-fits-together)
+2. [What's in this package](#whats-in-this-package)
+3. [Prerequisites](#prerequisites)
+4. [Step 1 — Configure the WorkOS dashboard](#step-1--configure-the-workos-dashboard)
+5. [Step 2 — Configure the MJ server (`mj.config.cjs`)](#step-2--configure-the-mj-server-mjconfigcjs)
+6. [Step 3 — Add an `email` claim (JWT Template)](#step-3--add-an-email-claim-jwt-template)
+7. [Step 4 — Configure the browser (MJExplorer)](#step-4--configure-the-browser-mjexplorer)
+8. [Token claims reference](#token-claims-reference)
+9. [How validation works under the hood](#how-validation-works-under-the-hood)
+10. [Troubleshooting](#troubleshooting)
+11. [Scope & non-goals](#scope--non-goals)
+
+---
+
+## How it fits together
+
+```
+┌─ Browser (MJExplorer) ─────────────────┐        ┌─ MJ GraphQL Server ─────────────────────┐
+│                                         │        │                                          │
+│  MJWorkOSProvider (extends MJAuthBase)  │        │  WorkOSProvider (extends BaseAuthProvider)│
+│   @RegisterClass(MJAuthBase,'workos')   │        │   @RegisterClass(BaseAuthProvider,'workos')│
+│        │                                │        │        ▲                                 │
+│   @workos-inc/authkit-js                │        │        │ jwks-rsa + jsonwebtoken         │
+│        │  signIn → hosted login         │        │        │ (verify signature, iss, aud)    │
+│        │  getUser()  (email for display)│        │        │                                 │
+│        └─ getAccessToken() ── Bearer ───┼────────┼──▶ AuthProviderFactory.getByIssuer(iss)  │
+│                                         │        │      → WorkOSProvider.extractUserInfo()  │
+│                                         │        │      → verifyUserRecord(email)           │
+└─────────────────────────────────────────┘        └──────────────────────────────────────────┘
+```
+
+Both ends register under the same lowercase key, `workos`, through MJ's class factory. The server
+trusts the issuer/JWKS to verify the signature; the browser SDK manages the session and silent
+token refresh.
+
+## What's in this package
+
+| Side | Class | File | Registers as |
+|---|---|---|---|
+| Server | `WorkOSProvider` | [`src/providers/WorkOSProvider.ts`](src/providers/WorkOSProvider.ts) | `@RegisterClass(BaseAuthProvider, 'workos')` |
+| Browser | `MJWorkOSProvider` | `@memberjunction/ng-auth-services` → `src/lib/providers/mjexplorer-workos-provider.service.ts` | `@RegisterClass(MJAuthBase, 'workos')` |
+
+The server provider is registered automatically (it's imported by
+[`AuthProviderFactory.ts`](src/AuthProviderFactory.ts)); you only need to add a config entry.
+
+## Prerequisites
+
+- A [WorkOS](https://workos.com) account with **AuthKit / User Management** enabled.
+- Your **Client ID** (looks like `client_01H...`) from the WorkOS dashboard.
+- The browser app must depend on `@workos-inc/authkit-js` (already declared as a peer dependency
+  of `@memberjunction/ng-auth-services`, and a direct dependency of MJExplorer).
+
+---
+
+## Step 1 — Configure the WorkOS dashboard
+
+1. In the WorkOS dashboard, go to **Authentication → AuthKit** and enable it.
+2. Under **Redirects**, add your app's redirect URI (e.g. `http://localhost:4200` for local
+   development, plus your production origin). This is where WorkOS returns the user after login.
+3. Set a **Logout URI** (the page WorkOS returns to after sign-out — typically the same origin).
+4. Note your **Client ID**. You'll use it in three places: the server `issuer`/`jwksUri`, the
+   server `clientId`, and the browser `WORKOS_CLIENTID`.
+
+## Step 2 — Configure the MJ server (`mj.config.cjs`)
+
+Add a `workos` entry to `authProviders`. The `issuer` and `jwksUri` are derived from your Client
+ID:
+
+```javascript
+// mj.config.cjs
+module.exports = {
+  authProviders: [
+    {
+      name: 'workos-prod',
+      type: 'workos',
+      clientId: process.env.WORKOS_CLIENT_ID,            // client_01H...
+      issuer: `https://api.workos.com/user_management/${process.env.WORKOS_CLIENT_ID}`,
+      jwksUri: `https://api.workos.com/sso/jwks/${process.env.WORKOS_CLIENT_ID}`,
+      // The audience MUST match the token's `aud` claim — see the note below.
+      audience: process.env.WORKOS_CLIENT_ID,
+    },
+    // ...other providers can coexist; the factory routes by the token's `iss` claim
+  ],
+};
+```
+
+### Getting `audience` right
+
+MemberJunction **always enforces the `aud` claim** during verification. WorkOS sets `aud`
+automatically (you cannot override it via a JWT Template — it's a reserved claim):
+
+- **No Resource Indicators configured (default):** WorkOS uses a default audience unique to your
+  WorkOS environment. Decode a real access token (e.g. at [jwt.io](https://jwt.io)) and copy the
+  exact `aud` value into your `audience` config.
+- **Resource Indicators configured:** the `aud` matches the requested resource — set `audience`
+  to that resource identifier.
+
+> If `audience` does not match the token's `aud`, verification fails with
+> `jwt audience invalid`. This is the second most common misconfiguration after the missing email
+> claim.
+
+## Step 3 — Add an `email` claim (JWT Template)
+
+**This step is required.** A WorkOS AuthKit access token carries identity/session claims
+(`sub`, `sid`, `org_id`, `role`, `permissions`) but **not** the user's email. MemberJunction
+looks the user up by email server-side, so you must add it.
+
+In the WorkOS dashboard, go to **Authentication → Sessions → JWT Template** (or
+**JWT Templates**) and add:
+
+```json
+{
+  "email": "{{user.email}}",
+  "given_name": "{{user.first_name}}",
+  "family_name": "{{user.last_name}}"
+}
+```
+
+- `email` is what MJ matches against the `User.Email` column — **required**.
+- `given_name` / `family_name` are optional but recommended: they let MJ
+  [auto-provision new users](../MJServer/README.md) with proper names when
+  `userHandling.autoCreateNewUsers` is enabled.
+- WorkOS JWT Templates drop any claim whose value renders to `null`, so users missing a first/last
+  name simply won't have those claims — the provider handles that gracefully (it falls back to
+  splitting a `name` claim, or to the email).
+
+> **Why not just read email from the ID token?** The browser SDK's `getUser()` always has the
+> email (used for display), but the **server** only sees the bearer **access token**. The JWT
+> Template is what puts the email into that access token.
+
+## Step 4 — Configure the browser (MJExplorer)
+
+Set `AUTH_TYPE` to `workos` and provide the WorkOS environment keys. These flow into the provider
+through `AuthServicesModule.forRoot(environment)`:
+
+```typescript
+// environment.ts
+export const environment = {
+  // ...
+  AUTH_TYPE: 'workos',
+  WORKOS_CLIENTID: 'client_01H...',          // required
+  WORKOS_REDIRECT_URI: window.location.origin, // optional; defaults to window.location.origin
+  WORKOS_API_HOSTNAME: undefined,             // optional; only for custom domains / proxies
+  WORKOS_DEV_MODE: false,                      // optional; localStorage session for local dev
+};
+```
+
+| Env key | Required | Purpose |
+|---|---|---|
+| `AUTH_TYPE` | ✅ | Must be `'workos'` to select this provider |
+| `WORKOS_CLIENTID` | ✅ | Your AuthKit Client ID |
+| `WORKOS_REDIRECT_URI` | — | Redirect target after login (default: `window.location.origin`) |
+| `WORKOS_API_HOSTNAME` | — | Override the WorkOS API hostname (custom domains / proxy) |
+| `WORKOS_DEV_MODE` | — | AuthKit dev mode — localStorage-backed session for local development |
+
+That's it. On startup, `MJWorkOSProvider.initialize()` constructs the AuthKit client (which also
+processes any pending redirect callback), establishes the session, and the rest of MJ works
+unchanged — `getIdToken()` hands the access token to the GraphQL client as a Bearer token.
+
+---
+
+## Token claims reference
+
+A WorkOS AuthKit **access token** (what `getAccessToken()` returns and the server validates),
+**after** adding the recommended JWT Template:
+
+```jsonc
+{
+  "iss": "https://api.workos.com/user_management/client_01H...",
+  "sub": "user_01HXYZ...",       // WorkOS user id → AuthUserInfo.userId
+  "sid": "session_01H...",       // session id
+  "jti": "01H...",
+  "aud": "<environment default or resource indicator>",  // MJ enforces this
+  "org_id": "org_01H...",        // present for organization-scoped sessions
+  "role": "admin",               // organization-membership role
+  "permissions": ["posts:read"], // role permissions
+  "exp": 1717000000,
+  "iat": 1716996400,
+
+  // ── added by your JWT Template ──
+  "email": "ada@example.com",    // REQUIRED for MJ user resolution
+  "given_name": "Ada",
+  "family_name": "Lovelace"
+}
+```
+
+`WorkOSProvider.extractUserInfo()` maps this to MJ's `AuthUserInfo`:
+
+| `AuthUserInfo` field | Source claim | Fallback |
+|---|---|---|
+| `email` | `email` | — (undefined if no JWT Template) |
+| `firstName` | `given_name` | first word of `name` |
+| `lastName` | `family_name` | second word of `name`, else first word |
+| `fullName` | `name` | — |
+| `preferredUsername` | `preferred_username` | `email` |
+| `userId` | `sub` | — |
+
+## How validation works under the hood
+
+1. The browser sends `Authorization: Bearer <accessToken>` to the MJ GraphQL API.
+2. MJServer decodes the token (without verifying) to read the `iss` claim.
+3. `AuthProviderFactory.getByIssuer(iss)` resolves the `WorkOSProvider` instance (issuer matching
+   is case-insensitive and trailing-slash tolerant).
+4. `jwt.verify()` validates the RS256 signature against the JWKS at
+   `https://api.workos.com/sso/jwks/<clientId>` (cached, with retry/backoff handled by
+   `BaseAuthProvider`), and checks `iss` + `aud`.
+5. `WorkOSProvider.extractUserInfo(payload)` produces the normalized identity.
+6. MJServer resolves/creates the `User` record by **email** and builds the request context.
+
+See [`@memberjunction/auth-providers` README](README.md) and
+[`@memberjunction/server`](../MJServer/README.md) for the shared validation pipeline.
+
+## Troubleshooting
+
+| Symptom | Likely cause | Fix |
+|---|---|---|
+| Server logs "user not found" / login bounces | Access token has no `email` claim | [Add the JWT Template](#step-3--add-an-email-claim-jwt-template) |
+| `jwt audience invalid` | `audience` config ≠ token `aud` | Decode a real token, copy its `aud` into `audience` ([Step 2](#getting-audience-right)) |
+| `No authentication provider found for issuer` | `issuer` config doesn't match the token | Ensure `issuer` is `https://api.workos.com/user_management/<clientId>` with your real Client ID |
+| `jwt expired` right after login | Clock skew or stale token | The browser SDK auto-refreshes; ensure server time is correct |
+| Login redirect loops | Redirect URI not registered | Add your exact origin under WorkOS dashboard → Redirects |
+| New users not auto-created | Missing `given_name`/`family_name` or `autoCreateNewUsers` off | Add name claims to the JWT Template; check `userHandling` config |
+
+## Scope & non-goals
+
+- **In scope:** WorkOS **AuthKit / User Management** (OIDC/JWT bearer login + validation). This is
+  the same OIDC/JWT model every other MJ provider uses.
+- **Out of scope (today):** WorkOS **SSO via SAML assertions** and **Directory Sync (SCIM)**
+  user provisioning as distinct flows. AuthKit can itself broker SSO connections behind its hosted
+  login, so SSO end-users still authenticate through the `workos` provider — but MJ does not parse
+  raw SAML assertions or run SCIM provisioning. Those would be a separate, larger effort.
+
+---
+
+*Part of [`@memberjunction/auth-providers`](README.md) in the
+[MemberJunction](https://github.com/MemberJunction/MJ) monorepo.*

package/dist/AuthProviderFactory.d.ts

@@ -6,6 +6,7 @@ import './providers/MSALProvider.js';
 import './providers/OktaProvider.js';
 import './providers/CognitoProvider.js';
 import './providers/GoogleProvider.js';
+import './providers/WorkOSProvider.js';
 import './providers/MagicLinkProvider.js';
 /**
  * Factory and registry for managing authentication providers

package/dist/AuthProviderFactory.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"AuthProviderFactory.d.ts","sourceRoot":"","sources":["../src/AuthProviderFactory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAe,MAAM,sBAAsB,CAAC;AACvE,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAEnD,OAAO,EAAY,aAAa,EAAc,MAAM,wBAAwB,CAAC;AAG7E,OAAO,8BAA8B,CAAC;AACtC,OAAO,6BAA6B,CAAC;AACrC,OAAO,6BAA6B,CAAC;AACrC,OAAO,gCAAgC,CAAC;AACxC,OAAO,+BAA+B,CAAC;AACvC,OAAO,kCAAkC,CAAC;AAE1C;;;GAGG;AACH,qBAAa,mBAAoB,SAAQ,aAAa,CAAC,mBAAmB,CAAC;IACzE,OAAO,CAAC,SAAS,CAAyC;IAC1D;;;;;;OAMG;IACH,OAAO,CAAC,WAAW,CAA6F;IAChH;;OAEG;IACH,OAAO,CAAC,gBAAgB,CAAiG;;IAMzH;;OAEG;IACH,WAAkB,QAAQ,IAAI,mBAAmB,CAEhD;IAED;;;OAGG;IACH,MAAM,CAAC,cAAc,CAAC,MAAM,EAAE,kBAAkB,GAAG,aAAa;IAsBhE;;OAEG;IACH,QAAQ,CAAC,QAAQ,EAAE,aAAa,GAAG,IAAI;IAiBvC;;OAEG;IACH,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,aAAa,GAAG,SAAS;IAmBtD;;;;;;OAMG;IACH,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,aAAa,EAAE;IAqB/C;;OAEG;IACH,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,aAAa,GAAG,SAAS;IAIlD;;OAEG;IACH,eAAe,IAAI,aAAa,EAAE;IAIlC;;OAEG;IACH,YAAY,IAAI,OAAO;IAIvB;;OAEG;IACH,KAAK,IAAI,IAAI;IAMb;;OAEG;IACH,MAAM,CAAC,0BAA0B,IAAI,MAAM,EAAE;IAW7C;;OAEG;IACH,MAAM,CAAC,wBAAwB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;CASvD"}
+{"version":3,"file":"AuthProviderFactory.d.ts","sourceRoot":"","sources":["../src/AuthProviderFactory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAe,MAAM,sBAAsB,CAAC;AACvE,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAEnD,OAAO,EAAY,aAAa,EAAc,MAAM,wBAAwB,CAAC;AAG7E,OAAO,8BAA8B,CAAC;AACtC,OAAO,6BAA6B,CAAC;AACrC,OAAO,6BAA6B,CAAC;AACrC,OAAO,gCAAgC,CAAC;AACxC,OAAO,+BAA+B,CAAC;AACvC,OAAO,+BAA+B,CAAC;AACvC,OAAO,kCAAkC,CAAC;AAE1C;;;GAGG;AACH,qBAAa,mBAAoB,SAAQ,aAAa,CAAC,mBAAmB,CAAC;IACzE,OAAO,CAAC,SAAS,CAAyC;IAC1D;;;;;;OAMG;IACH,OAAO,CAAC,WAAW,CAA6F;IAChH;;OAEG;IACH,OAAO,CAAC,gBAAgB,CAAiG;;IAMzH;;OAEG;IACH,WAAkB,QAAQ,IAAI,mBAAmB,CAEhD;IAED;;;OAGG;IACH,MAAM,CAAC,cAAc,CAAC,MAAM,EAAE,kBAAkB,GAAG,aAAa;IAsBhE;;OAEG;IACH,QAAQ,CAAC,QAAQ,EAAE,aAAa,GAAG,IAAI;IAiBvC;;OAEG;IACH,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,aAAa,GAAG,SAAS;IAmBtD;;;;;;OAMG;IACH,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,aAAa,EAAE;IAqB/C;;OAEG;IACH,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,aAAa,GAAG,SAAS;IAIlD;;OAEG;IACH,eAAe,IAAI,aAAa,EAAE;IAIlC;;OAEG;IACH,YAAY,IAAI,OAAO;IAIvB;;OAEG;IACH,KAAK,IAAI,IAAI;IAMb;;OAEG;IACH,MAAM,CAAC,0BAA0B,IAAI,MAAM,EAAE;IAW7C;;OAEG;IACH,MAAM,CAAC,wBAAwB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;CASvD"}

package/dist/AuthProviderFactory.js

@@ -7,6 +7,7 @@ import './providers/MSALProvider.js';
 import './providers/OktaProvider.js';
 import './providers/CognitoProvider.js';
 import './providers/GoogleProvider.js';
+import './providers/WorkOSProvider.js';
 import './providers/MagicLinkProvider.js';
 /**
  * Factory and registry for managing authentication providers

package/dist/AuthProviderFactory.js.map

@@ -1 +1 @@
-{"version":3,"file":"AuthProviderFactory.js","sourceRoot":"","sources":["../src/AuthProviderFactory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAsB,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAEvE,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAE7E,gDAAgD;AAChD,OAAO,8BAA8B,CAAC;AACtC,OAAO,6BAA6B,CAAC;AACrC,OAAO,6BAA6B,CAAC;AACrC,OAAO,gCAAgC,CAAC;AACxC,OAAO,+BAA+B,CAAC;AACvC,OAAO,kCAAkC,CAAC;AAE1C;;;GAGG;AACH,MAAM,OAAO,mBAAoB,SAAQ,aAAkC;IAezE;QACE,KAAK,EAAE,CAAC;QAfF,cAAS,GAA+B,IAAI,GAAG,EAAE,CAAC;QAC1D;;;;;;WAMG;QACK,gBAAW,GAAsC,IAAI,UAAU,CAAwB,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC;QAChH;;WAEG;QACK,qBAAgB,GAAwC,IAAI,UAAU,CAA0B,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC;IAIzH,CAAC;IAED;;OAEG;IACI,MAAM,KAAK,QAAQ;QACxB,OAAO,mBAAmB,CAAC,WAAW,EAAuB,CAAC;IAChE,CAAC;IAED;;;OAGG;IACH,MAAM,CAAC,cAAc,CAAC,MAA0B;QAC9C,IAAI,CAAC;YACH,4DAA4D;YAC5D,0EAA0E;YAC1E,0EAA0E;YAC1E,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC,cAAc,CAC5D,gBAAgB,EAChB,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,EACzB,MAAM,CACP,CAAC;YAEF,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,MAAM,IAAI,KAAK,CAAC,oCAAoC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;YACrE,CAAC;YAED,OAAO,QAAQ,CAAC;QAClB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACvE,MAAM,IAAI,KAAK,CAAC,sDAAsD,MAAM,CAAC,IAAI,MAAM,OAAO,EAAE,CAAC,CAAC;QACpG,CAAC;IACH,CAAC;IAED;;OAEG;IACH,QAAQ,CAAC,QAAuB;QAC9B,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,EAAE,CAAC;YAC/B,MAAM,IAAI,KAAK,CAAC,uCAAuC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;QAC1E,CAAC;QAED,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QAE5C,oDAAoD;QACpD,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,gBAAgB,CAAC,KAAK,EAAE,CAAC;QAE9B,oFAAoF;QACpF,sFAAsF;QACtF,sFAAsF;QACtF,WAAW,CAAC,EAAE,OAAO,EAAE,6BAA6B,QAAQ,CAAC,IAAI,iBAAiB,QAAQ,CAAC,MAAM,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5H,CAAC;IAED;;OAEG;IACH,WAAW,CAAC,MAAc;QACxB,oBAAoB;QACpB,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC5C,IAAI,MAAM,EAAE,CAAC;YACX,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,2BAA2B;QAC3B,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,CAAC;YAC/C,IAAI,QAAQ,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC;gBACnC,2BAA2B;gBAC3B,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;gBACvC,OAAO,QAAQ,CAAC;YAClB,CAAC;QACH,CAAC;QAED,OAAO,SAAS,CAAC;IACnB,CAAC;IAED;;;;;;OAMG;IACH,cAAc,CAAC,MAAc;QAC3B,mCAAmC;QACnC,MAAM,MAAM,GAAG,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACjD,IAAI,MAAM,EAAE,CAAC;YACX,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,MAAM,OAAO,GAAoB,EAAE,CAAC;QACpC,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,CAAC;YAC/C,IAAI,QAAQ,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC;gBACnC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACzB,CAAC;QACH,CAAC;QAED,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAC7C,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;OAEG;IACH,SAAS,CAAC,IAAY;QACpB,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAClC,CAAC;IAED;;OAEG;IACH,eAAe;QACb,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC;IAC7C,CAAC;IAED;;OAEG;IACH,YAAY;QACV,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,GAAG,CAAC,CAAC;IACjC,CAAC;IAED;;OAEG;IACH,KAAK;QACH,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC;QACvB,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,gBAAgB,CAAC,KAAK,EAAE,CAAC;IAChC,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,0BAA0B;QAC/B,+DAA+D;QAC/D,MAAM,aAAa,GAAG,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC,mBAAmB,CAAC,gBAAgB,CAAC,CAAC;QAC3F,0DAA0D;QAC1D,MAAM,aAAa,GAAG,aAAa;aAChC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC;aACnB,MAAM,CAAC,CAAC,GAAG,EAAiB,EAAE,CAAC,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,SAAS,CAAC,CAAC;QACrE,+BAA+B;QAC/B,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC;IAC5C,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,wBAAwB,CAAC,IAAY;QAC1C,IAAI,CAAC;YACH,qDAAqD;YACrD,MAAM,YAAY,GAAG,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC,eAAe,CAAC,gBAAgB,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;YAC1G,OAAO,YAAY,KAAK,IAAI,IAAI,YAAY,KAAK,SAAS,CAAC;QAC7D,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;CACF"}
+{"version":3,"file":"AuthProviderFactory.js","sourceRoot":"","sources":["../src/AuthProviderFactory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAsB,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAEvE,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAE7E,gDAAgD;AAChD,OAAO,8BAA8B,CAAC;AACtC,OAAO,6BAA6B,CAAC;AACrC,OAAO,6BAA6B,CAAC;AACrC,OAAO,gCAAgC,CAAC;AACxC,OAAO,+BAA+B,CAAC;AACvC,OAAO,+BAA+B,CAAC;AACvC,OAAO,kCAAkC,CAAC;AAE1C;;;GAGG;AACH,MAAM,OAAO,mBAAoB,SAAQ,aAAkC;IAezE;QACE,KAAK,EAAE,CAAC;QAfF,cAAS,GAA+B,IAAI,GAAG,EAAE,CAAC;QAC1D;;;;;;WAMG;QACK,gBAAW,GAAsC,IAAI,UAAU,CAAwB,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC;QAChH;;WAEG;QACK,qBAAgB,GAAwC,IAAI,UAAU,CAA0B,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC;IAIzH,CAAC;IAED;;OAEG;IACI,MAAM,KAAK,QAAQ;QACxB,OAAO,mBAAmB,CAAC,WAAW,EAAuB,CAAC;IAChE,CAAC;IAED;;;OAGG;IACH,MAAM,CAAC,cAAc,CAAC,MAA0B;QAC9C,IAAI,CAAC;YACH,4DAA4D;YAC5D,0EAA0E;YAC1E,0EAA0E;YAC1E,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC,cAAc,CAC5D,gBAAgB,EAChB,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,EACzB,MAAM,CACP,CAAC;YAEF,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,MAAM,IAAI,KAAK,CAAC,oCAAoC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;YACrE,CAAC;YAED,OAAO,QAAQ,CAAC;QAClB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACvE,MAAM,IAAI,KAAK,CAAC,sDAAsD,MAAM,CAAC,IAAI,MAAM,OAAO,EAAE,CAAC,CAAC;QACpG,CAAC;IACH,CAAC;IAED;;OAEG;IACH,QAAQ,CAAC,QAAuB;QAC9B,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,EAAE,CAAC;YAC/B,MAAM,IAAI,KAAK,CAAC,uCAAuC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;QAC1E,CAAC;QAED,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QAE5C,oDAAoD;QACpD,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,gBAAgB,CAAC,KAAK,EAAE,CAAC;QAE9B,oFAAoF;QACpF,sFAAsF;QACtF,sFAAsF;QACtF,WAAW,CAAC,EAAE,OAAO,EAAE,6BAA6B,QAAQ,CAAC,IAAI,iBAAiB,QAAQ,CAAC,MAAM,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5H,CAAC;IAED;;OAEG;IACH,WAAW,CAAC,MAAc;QACxB,oBAAoB;QACpB,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC5C,IAAI,MAAM,EAAE,CAAC;YACX,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,2BAA2B;QAC3B,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,CAAC;YAC/C,IAAI,QAAQ,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC;gBACnC,2BAA2B;gBAC3B,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;gBACvC,OAAO,QAAQ,CAAC;YAClB,CAAC;QACH,CAAC;QAED,OAAO,SAAS,CAAC;IACnB,CAAC;IAED;;;;;;OAMG;IACH,cAAc,CAAC,MAAc;QAC3B,mCAAmC;QACnC,MAAM,MAAM,GAAG,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACjD,IAAI,MAAM,EAAE,CAAC;YACX,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,MAAM,OAAO,GAAoB,EAAE,CAAC;QACpC,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,CAAC;YAC/C,IAAI,QAAQ,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC;gBACnC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACzB,CAAC;QACH,CAAC;QAED,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAC7C,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;OAEG;IACH,SAAS,CAAC,IAAY;QACpB,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAClC,CAAC;IAED;;OAEG;IACH,eAAe;QACb,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC;IAC7C,CAAC;IAED;;OAEG;IACH,YAAY;QACV,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,GAAG,CAAC,CAAC;IACjC,CAAC;IAED;;OAEG;IACH,KAAK;QACH,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC;QACvB,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,gBAAgB,CAAC,KAAK,EAAE,CAAC;IAChC,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,0BAA0B;QAC/B,+DAA+D;QAC/D,MAAM,aAAa,GAAG,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC,mBAAmB,CAAC,gBAAgB,CAAC,CAAC;QAC3F,0DAA0D;QAC1D,MAAM,aAAa,GAAG,aAAa;aAChC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC;aACnB,MAAM,CAAC,CAAC,GAAG,EAAiB,EAAE,CAAC,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,SAAS,CAAC,CAAC;QACrE,+BAA+B;QAC/B,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC;IAC5C,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,wBAAwB,CAAC,IAAY;QAC1C,IAAI,CAAC;YACH,qDAAqD;YACrD,MAAM,YAAY,GAAG,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC,eAAe,CAAC,gBAAgB,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;YAC1G,OAAO,YAAY,KAAK,IAAI,IAAI,YAAY,KAAK,SAAS,CAAC;QAC7D,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;CACF"}

package/dist/index.d.ts

@@ -3,5 +3,6 @@ export { BaseAuthProvider } from './BaseAuthProvider.js';
 export { AuthProviderFactory } from './AuthProviderFactory.js';
 export { TokenExpiredError } from './tokenExpiredError.js';
 export { MagicLinkProvider } from './providers/MagicLinkProvider.js';
+export { HostIdentityProvider, type HostAssertionVerifyResult, type HostAssertionError, } from './providers/HostIdentityProvider.js';
 export type { AuthProviderConfig, AuthUserInfo } from '@memberjunction/core';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAC/D,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AAGrE,YAAY,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAC/D,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AACrE,OAAO,EACL,oBAAoB,EACpB,KAAK,yBAAyB,EAC9B,KAAK,kBAAkB,GACxB,MAAM,qCAAqC,CAAC;AAG7C,YAAY,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC"}

package/dist/index.js

@@ -2,4 +2,5 @@ export { BaseAuthProvider } from './BaseAuthProvider.js';
 export { AuthProviderFactory } from './AuthProviderFactory.js';
 export { TokenExpiredError } from './tokenExpiredError.js';
 export { MagicLinkProvider } from './providers/MagicLinkProvider.js';
+export { HostIdentityProvider, } from './providers/HostIdentityProvider.js';
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAC/D,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAC/D,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AACrE,OAAO,EACL,oBAAoB,GAGrB,MAAM,qCAAqC,CAAC"}

package/dist/providers/HostIdentityProvider.d.ts

@@ -0,0 +1,59 @@
+import { JwtPayload } from 'jsonwebtoken';
+import { AuthProviderConfig, AuthUserInfo } from '@memberjunction/core';
+import { BaseAuthProvider } from '../BaseAuthProvider.js';
+/** Why a host-assertion verification failed (mirrors the public web-widget mint error codes). */
+export type HostAssertionError = 'missing' | 'bad_signature' | 'expired' | 'no_email' | 'no_key';
+/** Result of verifying a host-signed identity assertion. `userInfo` is present iff `ok` is true. */
+export interface HostAssertionVerifyResult {
+    ok: boolean;
+    userInfo?: AuthUserInfo;
+    /** The host's opaque user id for the visitor (assertion `sub`) — audit correlation, not an MJ user id. */
+    hostUserId?: string;
+    errorCode?: HostAssertionError;
+}
+/**
+ * Authentication provider for the public web-widget **host-identity** strategy (D1).
+ *
+ * When a widget is embedded in an already-authenticated host portal, the host signs a short-lived
+ * RS256 assertion (with ITS OWN key) describing the visitor. Unlike Auth0/magic-link tokens — validated
+ * by the standard issuer→JWKS path — a host assertion is verified against a STATIC per-widget public key
+ * (stored on `WidgetInstance.HostPublicKey`) and exchanged at `POST /widget/session` for an MJ guest JWT.
+ * So this provider does NOT use the JWKS machinery: it exposes {@link VerifyHostAssertion} (static-PEM
+ * RS256 verification) + {@link extractUserInfo}, and the widget mint resolves it via the ClassFactory.
+ *
+ * SECURITY INVARIANT — key/assertion provenance MUST be independent. The party that presents a signed
+ * assertion must NOT also be able to provide or influence the public key used to verify it. If one party
+ * controlled both, the signature would prove nothing: an attacker could mint a fresh keypair, sign any
+ * claims with the private key, hand over the matching public key, and the check would trivially pass. The
+ * verifying key must therefore come from an independent trust path — here, out-of-band administrator
+ * configuration on `WidgetInstance.HostPublicKey` (the analog, for a static PEM, of pinning a trusted
+ * issuer's JWKS endpoint). That is why {@link VerifyHostAssertion} takes the PEM as a caller-supplied
+ * argument rather than reading any key material from the assertion itself: the caller (the widget mint)
+ * is responsible for sourcing the PEM from the registered widget record, never from the request payload.
+ *
+ * It still subclasses {@link BaseAuthProvider} (and registers in the same factory) so host-identity is a
+ * first-class, discoverable provider rather than ad-hoc mint code — the architecture the widget plan calls
+ * for. The base constructor builds a JWKS client from `jwksUri`; host-identity has no JWKS, so callers pass
+ * a placeholder `jwksUri` that is never contacted (verification goes through {@link VerifyHostAssertion}).
+ */
+export declare class HostIdentityProvider extends BaseAuthProvider {
+    constructor(config: AuthProviderConfig);
+    /** Host identity never uses JWKS — config is valid as long as it names the provider. */
+    validateConfig(): boolean;
+    /**
+     * Verifies a host-signed RS256 assertion against the host's STATIC public key (PEM) and extracts the
+     * asserted visitor identity. The assertion's `aud` must equal `expectedAudience` (the widget key, bound
+     * at the host) and it must carry an `email`. It must also be short-lived: it must declare its own `exp`
+     * AND be no older than {@link HOST_ASSERTION_MAX_AGE_SECONDS} since `iat` — so a misbehaving host cannot
+     * mint an unbounded token. Never throws — returns a structured result.
+     *
+     * SECURITY: `hostPublicKeyPem` MUST originate from an independent trust path (the registered
+     * `WidgetInstance.HostPublicKey`, set out-of-band by an administrator) — NEVER from the same request
+     * that carries `assertion`. Passing a key the assertion's presenter could influence defeats the
+     * signature check entirely (see the class-level SECURITY INVARIANT note).
+     */
+    VerifyHostAssertion(assertion: string | undefined, hostPublicKeyPem: string | undefined, expectedAudience: string): HostAssertionVerifyResult;
+    /** Maps a verified host-assertion payload to standard MJ identity fields. */
+    extractUserInfo(payload: JwtPayload): AuthUserInfo;
+}
+//# sourceMappingURL=HostIdentityProvider.d.ts.map

package/dist/providers/HostIdentityProvider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"HostIdentityProvider.d.ts","sourceRoot":"","sources":["../../src/providers/HostIdentityProvider.ts"],"names":[],"mappings":"AAAA,OAAY,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAE/C,OAAO,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACxE,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAE1D,iGAAiG;AACjG,MAAM,MAAM,kBAAkB,GAAG,SAAS,GAAG,eAAe,GAAG,SAAS,GAAG,UAAU,GAAG,QAAQ,CAAC;AAUjG,oGAAoG;AACpG,MAAM,WAAW,yBAAyB;IACxC,EAAE,EAAE,OAAO,CAAC;IACZ,QAAQ,CAAC,EAAE,YAAY,CAAC;IACxB,0GAA0G;IAC1G,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,kBAAkB,CAAC;CAChC;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,qBACa,oBAAqB,SAAQ,gBAAgB;gBAC5C,MAAM,EAAE,kBAAkB;IAItC,wFAAwF;IAC/E,cAAc,IAAI,OAAO;IAIlC;;;;;;;;;;;OAWG;IACH,mBAAmB,CACjB,SAAS,EAAE,MAAM,GAAG,SAAS,EAC7B,gBAAgB,EAAE,MAAM,GAAG,SAAS,EACpC,gBAAgB,EAAE,MAAM,GACvB,yBAAyB;IAiC5B,6EAA6E;IAC7E,eAAe,CAAC,OAAO,EAAE,UAAU,GAAG,YAAY;CAanD"}

package/dist/providers/HostIdentityProvider.js

@@ -0,0 +1,118 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+import jwt from 'jsonwebtoken';
+import { RegisterClass } from '@memberjunction/global';
+import { BaseAuthProvider } from '../BaseAuthProvider.js';
+/**
+ * Absolute ceiling on a host assertion's age (measured from its `iat`), independent of the host-chosen
+ * `exp`. Even if a host mints a long-lived — or `exp`-less — assertion, MJ refuses to accept it beyond
+ * this window. Enforces the "short-lived" contract the strategy assumes rather than trusting the host to
+ * honor it. Effective lifetime is therefore min(assertion `exp`, `iat` + this).
+ */
+const HOST_ASSERTION_MAX_AGE_SECONDS = 600; // 10 minutes
+/**
+ * Authentication provider for the public web-widget **host-identity** strategy (D1).
+ *
+ * When a widget is embedded in an already-authenticated host portal, the host signs a short-lived
+ * RS256 assertion (with ITS OWN key) describing the visitor. Unlike Auth0/magic-link tokens — validated
+ * by the standard issuer→JWKS path — a host assertion is verified against a STATIC per-widget public key
+ * (stored on `WidgetInstance.HostPublicKey`) and exchanged at `POST /widget/session` for an MJ guest JWT.
+ * So this provider does NOT use the JWKS machinery: it exposes {@link VerifyHostAssertion} (static-PEM
+ * RS256 verification) + {@link extractUserInfo}, and the widget mint resolves it via the ClassFactory.
+ *
+ * SECURITY INVARIANT — key/assertion provenance MUST be independent. The party that presents a signed
+ * assertion must NOT also be able to provide or influence the public key used to verify it. If one party
+ * controlled both, the signature would prove nothing: an attacker could mint a fresh keypair, sign any
+ * claims with the private key, hand over the matching public key, and the check would trivially pass. The
+ * verifying key must therefore come from an independent trust path — here, out-of-band administrator
+ * configuration on `WidgetInstance.HostPublicKey` (the analog, for a static PEM, of pinning a trusted
+ * issuer's JWKS endpoint). That is why {@link VerifyHostAssertion} takes the PEM as a caller-supplied
+ * argument rather than reading any key material from the assertion itself: the caller (the widget mint)
+ * is responsible for sourcing the PEM from the registered widget record, never from the request payload.
+ *
+ * It still subclasses {@link BaseAuthProvider} (and registers in the same factory) so host-identity is a
+ * first-class, discoverable provider rather than ad-hoc mint code — the architecture the widget plan calls
+ * for. The base constructor builds a JWKS client from `jwksUri`; host-identity has no JWKS, so callers pass
+ * a placeholder `jwksUri` that is never contacted (verification goes through {@link VerifyHostAssertion}).
+ */
+let HostIdentityProvider = class HostIdentityProvider extends BaseAuthProvider {
+    constructor(config) {
+        super(config);
+    }
+    /** Host identity never uses JWKS — config is valid as long as it names the provider. */
+    validateConfig() {
+        return !!this.name;
+    }
+    /**
+     * Verifies a host-signed RS256 assertion against the host's STATIC public key (PEM) and extracts the
+     * asserted visitor identity. The assertion's `aud` must equal `expectedAudience` (the widget key, bound
+     * at the host) and it must carry an `email`. It must also be short-lived: it must declare its own `exp`
+     * AND be no older than {@link HOST_ASSERTION_MAX_AGE_SECONDS} since `iat` — so a misbehaving host cannot
+     * mint an unbounded token. Never throws — returns a structured result.
+     *
+     * SECURITY: `hostPublicKeyPem` MUST originate from an independent trust path (the registered
+     * `WidgetInstance.HostPublicKey`, set out-of-band by an administrator) — NEVER from the same request
+     * that carries `assertion`. Passing a key the assertion's presenter could influence defeats the
+     * signature check entirely (see the class-level SECURITY INVARIANT note).
+     */
+    VerifyHostAssertion(assertion, hostPublicKeyPem, expectedAudience) {
+        if (!assertion) {
+            return { ok: false, errorCode: 'missing' };
+        }
+        if (!hostPublicKeyPem) {
+            return { ok: false, errorCode: 'no_key' };
+        }
+        let payload;
+        try {
+            // maxAge caps the assertion's age from `iat` regardless of the host-chosen `exp` (and requires `iat`
+            // to be present); jsonwebtoken surfaces a breach as TokenExpiredError, same as a normal expiry.
+            payload = jwt.verify(assertion, hostPublicKeyPem, {
+                algorithms: ['RS256'],
+                audience: expectedAudience,
+                maxAge: HOST_ASSERTION_MAX_AGE_SECONDS,
+            });
+        }
+        catch (e) {
+            // jsonwebtoken throws TokenExpiredError for expiry / maxAge; everything else is a signature/format fault.
+            return { ok: false, errorCode: e instanceof jwt.TokenExpiredError ? 'expired' : 'bad_signature' };
+        }
+        // Require an explicit expiry: we refuse to treat an unbounded assertion as valid even inside the maxAge
+        // window, so the host's "short-lived" contract is enforced, not merely assumed.
+        if (typeof payload.exp !== 'number') {
+            return { ok: false, errorCode: 'expired' };
+        }
+        const userInfo = this.extractUserInfo(payload);
+        if (!userInfo.email) {
+            return { ok: false, errorCode: 'no_email' };
+        }
+        const sub = typeof payload.sub === 'string' ? payload.sub : undefined;
+        return { ok: true, userInfo, hostUserId: sub };
+    }
+    /** Maps a verified host-assertion payload to standard MJ identity fields. */
+    extractUserInfo(payload) {
+        const str = (v) => (typeof v === 'string' && v ? v : undefined);
+        const email = str(payload.email);
+        const firstName = str(payload.given_name) ?? str(payload['firstName']);
+        const lastName = str(payload.family_name) ?? str(payload['lastName']);
+        return {
+            email,
+            firstName,
+            lastName,
+            fullName: str(payload.name) ?? ([firstName, lastName].filter(Boolean).join(' ') || undefined),
+            preferredUsername: email,
+        };
+    }
+};
+HostIdentityProvider = __decorate([
+    RegisterClass(BaseAuthProvider, 'host-identity'),
+    __metadata("design:paramtypes", [Object])
+], HostIdentityProvider);
+export { HostIdentityProvider };
+//# sourceMappingURL=HostIdentityProvider.js.map

package/dist/providers/HostIdentityProvider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"HostIdentityProvider.js","sourceRoot":"","sources":["../../src/providers/HostIdentityProvider.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,GAAmB,MAAM,cAAc,CAAC;AAC/C,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAEvD,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAK1D;;;;;GAKG;AACH,MAAM,8BAA8B,GAAG,GAAG,CAAC,CAAC,aAAa;AAWzD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEI,IAAM,oBAAoB,GAA1B,MAAM,oBAAqB,SAAQ,gBAAgB;IACxD,YAAY,MAA0B;QACpC,KAAK,CAAC,MAAM,CAAC,CAAC;IAChB,CAAC;IAED,wFAAwF;IAC/E,cAAc;QACrB,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;IACrB,CAAC;IAED;;;;;;;;;;;OAWG;IACH,mBAAmB,CACjB,SAA6B,EAC7B,gBAAoC,EACpC,gBAAwB;QAExB,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;QAC7C,CAAC;QACD,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACtB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;QAC5C,CAAC;QACD,IAAI,OAAmB,CAAC;QACxB,IAAI,CAAC;YACH,qGAAqG;YACrG,gGAAgG;YAChG,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,SAAS,EAAE,gBAAgB,EAAE;gBAChD,UAAU,EAAE,CAAC,OAAO,CAAC;gBACrB,QAAQ,EAAE,gBAAgB;gBAC1B,MAAM,EAAE,8BAA8B;aACvC,CAAe,CAAC;QACnB,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,0GAA0G;YAC1G,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,YAAY,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,eAAe,EAAE,CAAC;QACpG,CAAC;QACD,wGAAwG;QACxG,gFAAgF;QAChF,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;YACpC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;QAC7C,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;QAC/C,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;YACpB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC;QAC9C,CAAC;QACD,MAAM,GAAG,GAAG,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;QACtE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC;IACjD,CAAC;IAED,6EAA6E;IAC7E,eAAe,CAAC,OAAmB;QACjC,MAAM,GAAG,GAAG,CAAC,CAAU,EAAsB,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAC7F,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACjC,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC;QACvE,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC;QACtE,OAAO;YACL,KAAK;YACL,SAAS;YACT,QAAQ;YACR,QAAQ,EAAE,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,SAAS,CAAC;YAC7F,iBAAiB,EAAE,KAAK;SACzB,CAAC;IACJ,CAAC;CACF,CAAA;AAzEY,oBAAoB;IADhC,aAAa,CAAC,gBAAgB,EAAE,eAAe,CAAC;;GACpC,oBAAoB,CAyEhC"}

package/dist/providers/WorkOSProvider.d.ts

@@ -0,0 +1,48 @@
+import { JwtPayload } from 'jsonwebtoken';
+import { AuthProviderConfig, AuthUserInfo } from '@memberjunction/core';
+import { BaseAuthProvider } from '../BaseAuthProvider.js';
+/**
+ * WorkOS (AuthKit) authentication provider implementation.
+ *
+ * Validates JWT access tokens minted by WorkOS AuthKit / User Management. These tokens are
+ * signed with RS256 and verified against the per-environment JWKS endpoint
+ * (`https://api.workos.com/sso/jwks/<clientId>`); their `iss` claim is
+ * `https://api.workos.com/user_management/<clientId>`.
+ *
+ * ## Email is required — and is NOT in a WorkOS token by default
+ * MemberJunction resolves the signed-in user by **email**, but a WorkOS AuthKit access token
+ * only carries identity/session claims (`sub`, `sid`, `org_id`, `role`, `permissions`) out of
+ * the box — it does **not** include `email`. To use WorkOS with MJ you must add the email (and
+ * ideally the name) to the token via a WorkOS **JWT Template**:
+ *
+ * ```json
+ * {
+ *   "email": "{{user.email}}",
+ *   "given_name": "{{user.first_name}}",
+ *   "family_name": "{{user.last_name}}"
+ * }
+ * ```
+ *
+ * See `WORKOS.md` in this package for the full, step-by-step integration guide.
+ */
+export declare class WorkOSProvider extends BaseAuthProvider {
+    constructor(config: AuthProviderConfig);
+    /**
+     * Extracts user information from a WorkOS AuthKit JWT payload.
+     *
+     * `email`, `given_name`, and `family_name` are expected to be supplied by a WorkOS JWT
+     * Template (see class docs). `sub` is the stable WorkOS user id (`user_...`). We fall back
+     * through standard OIDC claim names so a token shaped by a custom template (e.g. one that
+     * only sets `name`) still resolves a usable identity.
+     */
+    extractUserInfo(payload: JwtPayload): AuthUserInfo;
+    /**
+     * Validates WorkOS-specific configuration.
+     *
+     * Beyond the base requirements (`name`, `issuer`, `audience`, `jwksUri`), WorkOS needs a
+     * `clientId` — it appears in both the issuer and JWKS URLs and identifies the AuthKit
+     * environment.
+     */
+    validateConfig(): boolean;
+}
+//# sourceMappingURL=WorkOSProvider.d.ts.map

package/dist/providers/WorkOSProvider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"WorkOSProvider.d.ts","sourceRoot":"","sources":["../../src/providers/WorkOSProvider.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAE1C,OAAO,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACxE,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAG1D;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,qBACa,cAAe,SAAQ,gBAAgB;gBACtC,MAAM,EAAE,kBAAkB;IAItC;;;;;;;OAOG;IACH,eAAe,CAAC,OAAO,EAAE,UAAU,GAAG,YAAY;IAoBlD;;;;;;OAMG;IACH,cAAc,IAAI,OAAO;CAM1B"}

package/dist/providers/WorkOSProvider.js

@@ -0,0 +1,84 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+import { RegisterClass } from '@memberjunction/global';
+import { BaseAuthProvider } from '../BaseAuthProvider.js';
+/**
+ * WorkOS (AuthKit) authentication provider implementation.
+ *
+ * Validates JWT access tokens minted by WorkOS AuthKit / User Management. These tokens are
+ * signed with RS256 and verified against the per-environment JWKS endpoint
+ * (`https://api.workos.com/sso/jwks/<clientId>`); their `iss` claim is
+ * `https://api.workos.com/user_management/<clientId>`.
+ *
+ * ## Email is required — and is NOT in a WorkOS token by default
+ * MemberJunction resolves the signed-in user by **email**, but a WorkOS AuthKit access token
+ * only carries identity/session claims (`sub`, `sid`, `org_id`, `role`, `permissions`) out of
+ * the box — it does **not** include `email`. To use WorkOS with MJ you must add the email (and
+ * ideally the name) to the token via a WorkOS **JWT Template**:
+ *
+ * ```json
+ * {
+ *   "email": "{{user.email}}",
+ *   "given_name": "{{user.first_name}}",
+ *   "family_name": "{{user.last_name}}"
+ * }
+ * ```
+ *
+ * See `WORKOS.md` in this package for the full, step-by-step integration guide.
+ */
+let WorkOSProvider = class WorkOSProvider extends BaseAuthProvider {
+    constructor(config) {
+        super(config);
+    }
+    /**
+     * Extracts user information from a WorkOS AuthKit JWT payload.
+     *
+     * `email`, `given_name`, and `family_name` are expected to be supplied by a WorkOS JWT
+     * Template (see class docs). `sub` is the stable WorkOS user id (`user_...`). We fall back
+     * through standard OIDC claim names so a token shaped by a custom template (e.g. one that
+     * only sets `name`) still resolves a usable identity.
+     */
+    extractUserInfo(payload) {
+        const email = payload.email;
+        const fullName = payload.name;
+        const firstName = payload.given_name;
+        const lastName = payload.family_name;
+        // WorkOS access tokens have no `preferred_username`; email is the natural handle.
+        const preferredUsername = payload.preferred_username || email;
+        // `sub` is the WorkOS user identifier (e.g. "user_01H...").
+        const userId = payload.sub;
+        return {
+            email,
+            firstName: firstName || fullName?.split(' ')[0],
+            lastName: lastName || fullName?.split(' ')[1] || fullName?.split(' ')[0],
+            fullName,
+            preferredUsername,
+            userId
+        };
+    }
+    /**
+     * Validates WorkOS-specific configuration.
+     *
+     * Beyond the base requirements (`name`, `issuer`, `audience`, `jwksUri`), WorkOS needs a
+     * `clientId` — it appears in both the issuer and JWKS URLs and identifies the AuthKit
+     * environment.
+     */
+    validateConfig() {
+        const baseValid = super.validateConfig();
+        const hasClientId = !!this.config.clientId;
+        return baseValid && hasClientId;
+    }
+};
+WorkOSProvider = __decorate([
+    RegisterClass(BaseAuthProvider, 'workos'),
+    __metadata("design:paramtypes", [Object])
+], WorkOSProvider);
+export { WorkOSProvider };
+//# sourceMappingURL=WorkOSProvider.js.map

package/dist/providers/WorkOSProvider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"WorkOSProvider.js","sourceRoot":"","sources":["../../src/providers/WorkOSProvider.ts"],"names":[],"mappings":";;;;;;;;;AACA,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAEvD,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAG1D;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEI,IAAM,cAAc,GAApB,MAAM,cAAe,SAAQ,gBAAgB;IAClD,YAAY,MAA0B;QACpC,KAAK,CAAC,MAAM,CAAC,CAAC;IAChB,CAAC;IAED;;;;;;;OAOG;IACH,eAAe,CAAC,OAAmB;QACjC,MAAM,KAAK,GAAG,OAAO,CAAC,KAA2B,CAAC;QAClD,MAAM,QAAQ,GAAG,OAAO,CAAC,IAA0B,CAAC;QACpD,MAAM,SAAS,GAAG,OAAO,CAAC,UAAgC,CAAC;QAC3D,MAAM,QAAQ,GAAG,OAAO,CAAC,WAAiC,CAAC;QAC3D,kFAAkF;QAClF,MAAM,iBAAiB,GAAG,OAAO,CAAC,kBAAwC,IAAI,KAAK,CAAC;QACpF,4DAA4D;QAC5D,MAAM,MAAM,GAAG,OAAO,CAAC,GAAyB,CAAC;QAEjD,OAAO;YACL,KAAK;YACL,SAAS,EAAE,SAAS,IAAI,QAAQ,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YAC/C,QAAQ,EAAE,QAAQ,IAAI,QAAQ,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,QAAQ,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YACxE,QAAQ;YACR,iBAAiB;YACjB,MAAM;SACP,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACH,cAAc;QACZ,MAAM,SAAS,GAAG,KAAK,CAAC,cAAc,EAAE,CAAC;QACzC,MAAM,WAAW,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC;QAE3C,OAAO,SAAS,IAAI,WAAW,CAAC;IAClC,CAAC;CACF,CAAA;AA9CY,cAAc;IAD1B,aAAa,CAAC,gBAAgB,EAAE,QAAQ,CAAC;;GAC7B,cAAc,CA8C1B"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@memberjunction/auth-providers",
-  "version": "5.43.0",
+  "version": "5.45.0",
   "description": "Authentication provider interfaces, base classes, and implementations for MemberJunction",
   "type": "module",
   "main": "./dist/index.js",
@@ -11,8 +11,8 @@
     "test:watch": "vitest"
   },
   "dependencies": {
-    "@memberjunction/core": "5.43.0",
-    "@memberjunction/global": "5.43.0",
+    "@memberjunction/core": "5.45.0",
+    "@memberjunction/global": "5.45.0",
     "graphql": "^16.12.0",
     "jsonwebtoken": "9.0.3",
     "jwks-rsa": "^3.2.2"

package/src/AuthProviderFactory.ts

@@ -9,6 +9,7 @@ import './providers/MSALProvider.js';
 import './providers/OktaProvider.js';
 import './providers/CognitoProvider.js';
 import './providers/GoogleProvider.js';
+import './providers/WorkOSProvider.js';
 import './providers/MagicLinkProvider.js';
 
 /**

package/src/__tests__/WorkOSProvider.test.ts

@@ -0,0 +1,169 @@
+/**
+ * Unit tests for WorkOSProvider.
+ *
+ * Covers the two pieces of logic the provider owns on top of BaseAuthProvider:
+ *   - extractUserInfo(): mapping WorkOS AuthKit JWT claims → AuthUserInfo, including the
+ *     fallbacks that keep a usable identity when a custom JWT Template only sets `name`.
+ *   - validateConfig(): the WorkOS-specific requirement (clientId) on top of the base fields.
+ *
+ * It also asserts the provider registers with the class factory under the `workos` key, which
+ * is what makes `AuthProviderFactory.createProvider({ type: 'workos', ... })` resolve it.
+ */
+import { describe, it, expect } from 'vitest';
+import type { JwtPayload } from 'jsonwebtoken';
+import { MJGlobal } from '@memberjunction/global';
+import { AuthProviderConfig } from '@memberjunction/core';
+import { BaseAuthProvider } from '../BaseAuthProvider';
+import { WorkOSProvider } from '../providers/WorkOSProvider';
+
+const CLIENT_ID = 'client_01HABCDEF';
+
+function makeConfig(overrides: Partial<AuthProviderConfig> = {}): AuthProviderConfig {
+  return {
+    name: 'workos-test',
+    type: 'workos',
+    issuer: `https://api.workos.com/user_management/${CLIENT_ID}`,
+    audience: CLIENT_ID,
+    jwksUri: `https://api.workos.com/sso/jwks/${CLIENT_ID}`,
+    clientId: CLIENT_ID,
+    ...overrides,
+  };
+}
+
+function makeProvider(overrides: Partial<AuthProviderConfig> = {}): WorkOSProvider {
+  return new WorkOSProvider(makeConfig(overrides));
+}
+
+describe('WorkOSProvider', () => {
+  describe('extractUserInfo', () => {
+    it('maps a token shaped by the recommended JWT Template (email + given/family name)', () => {
+      const provider = makeProvider();
+      const payload: JwtPayload = {
+        sub: 'user_01HXYZ',
+        email: 'ada@example.com',
+        given_name: 'Ada',
+        family_name: 'Lovelace',
+      };
+
+      const info = provider.extractUserInfo(payload);
+
+      expect(info.email).toBe('ada@example.com');
+      expect(info.firstName).toBe('Ada');
+      expect(info.lastName).toBe('Lovelace');
+      // No preferred_username on WorkOS tokens — falls back to email.
+      expect(info.preferredUsername).toBe('ada@example.com');
+      // `sub` is surfaced as the provider user id.
+      expect(info.userId).toBe('user_01HXYZ');
+    });
+
+    it('derives first/last name from a single `name` claim when given/family are absent', () => {
+      const provider = makeProvider();
+      const payload: JwtPayload = {
+        sub: 'user_01HXYZ',
+        email: 'grace.hopper@example.com',
+        name: 'Grace Hopper',
+      };
+
+      const info = provider.extractUserInfo(payload);
+
+      expect(info.fullName).toBe('Grace Hopper');
+      expect(info.firstName).toBe('Grace');
+      expect(info.lastName).toBe('Hopper');
+    });
+
+    it('falls back to the single name token for both first and last when name has one word', () => {
+      const provider = makeProvider();
+      const payload: JwtPayload = { sub: 'user_1', email: 'cher@example.com', name: 'Cher' };
+
+      const info = provider.extractUserInfo(payload);
+
+      expect(info.firstName).toBe('Cher');
+      expect(info.lastName).toBe('Cher');
+    });
+
+    it('prefers explicit given_name/family_name over the `name` split', () => {
+      const provider = makeProvider();
+      const payload: JwtPayload = {
+        sub: 'user_2',
+        email: 'jean.luc@example.com',
+        name: 'Wrong Split',
+        given_name: 'Jean-Luc',
+        family_name: 'Picard',
+      };
+
+      const info = provider.extractUserInfo(payload);
+
+      expect(info.firstName).toBe('Jean-Luc');
+      expect(info.lastName).toBe('Picard');
+    });
+
+    it('honors an explicit preferred_username when present', () => {
+      const provider = makeProvider();
+      const payload: JwtPayload = {
+        sub: 'user_3',
+        email: 'alan@example.com',
+        preferred_username: 'aturing',
+      };
+
+      const info = provider.extractUserInfo(payload);
+
+      expect(info.preferredUsername).toBe('aturing');
+    });
+
+    it('returns undefined email (rather than throwing) when no JWT Template added it', () => {
+      // This is the default WorkOS access token shape — identity/session claims only.
+      const provider = makeProvider();
+      const payload: JwtPayload = {
+        sub: 'user_4',
+        sid: 'session_01H',
+        org_id: 'org_01H',
+        role: 'admin',
+      };
+
+      const info = provider.extractUserInfo(payload);
+
+      expect(info.email).toBeUndefined();
+      expect(info.userId).toBe('user_4');
+      expect(info.preferredUsername).toBeUndefined();
+    });
+  });
+
+  describe('validateConfig', () => {
+    it('is valid with the full WorkOS config (base fields + clientId)', () => {
+      expect(makeProvider().validateConfig()).toBe(true);
+    });
+
+    it('is invalid without a clientId', () => {
+      expect(makeProvider({ clientId: undefined }).validateConfig()).toBe(false);
+    });
+
+    it('is invalid when a base field (audience) is missing', () => {
+      expect(makeProvider({ audience: '' }).validateConfig()).toBe(false);
+    });
+
+    it('exposes clientId on the instance for the OAuth proxy path', () => {
+      expect(makeProvider().clientId).toBe(CLIENT_ID);
+    });
+  });
+
+  describe('class-factory registration', () => {
+    it('is registered under the lowercase `workos` key and instantiable via the factory', () => {
+      const instance = MJGlobal.Instance.ClassFactory.CreateInstance<BaseAuthProvider>(
+        BaseAuthProvider,
+        'workos',
+        makeConfig(),
+      );
+
+      expect(instance).toBeInstanceOf(WorkOSProvider);
+    });
+  });
+
+  describe('issuer matching (inherited)', () => {
+    it('matches its configured issuer case-insensitively and ignores a trailing slash', () => {
+      const provider = makeProvider();
+      expect(provider.matchesIssuer(`https://api.workos.com/user_management/${CLIENT_ID}`)).toBe(true);
+      expect(provider.matchesIssuer(`https://api.workos.com/user_management/${CLIENT_ID}/`)).toBe(true);
+      expect(provider.matchesIssuer('https://api.workos.com/user_management/other')).toBe(false);
+    });
+  });
+});

package/src/index.ts

@@ -3,6 +3,11 @@ export { BaseAuthProvider } from './BaseAuthProvider.js';
 export { AuthProviderFactory } from './AuthProviderFactory.js';
 export { TokenExpiredError } from './tokenExpiredError.js';
 export { MagicLinkProvider } from './providers/MagicLinkProvider.js';
+export {
+  HostIdentityProvider,
+  type HostAssertionVerifyResult,
+  type HostAssertionError,
+} from './providers/HostIdentityProvider.js';
 
 // Re-export types consumers commonly need alongside the auth providers
 export type { AuthProviderConfig, AuthUserInfo } from '@memberjunction/core';

package/src/providers/HostIdentityProvider.ts

@@ -0,0 +1,125 @@
+import jwt, { JwtPayload } from 'jsonwebtoken';
+import { RegisterClass } from '@memberjunction/global';
+import { AuthProviderConfig, AuthUserInfo } from '@memberjunction/core';
+import { BaseAuthProvider } from '../BaseAuthProvider.js';
+
+/** Why a host-assertion verification failed (mirrors the public web-widget mint error codes). */
+export type HostAssertionError = 'missing' | 'bad_signature' | 'expired' | 'no_email' | 'no_key';
+
+/**
+ * Absolute ceiling on a host assertion's age (measured from its `iat`), independent of the host-chosen
+ * `exp`. Even if a host mints a long-lived — or `exp`-less — assertion, MJ refuses to accept it beyond
+ * this window. Enforces the "short-lived" contract the strategy assumes rather than trusting the host to
+ * honor it. Effective lifetime is therefore min(assertion `exp`, `iat` + this).
+ */
+const HOST_ASSERTION_MAX_AGE_SECONDS = 600; // 10 minutes
+
+/** Result of verifying a host-signed identity assertion. `userInfo` is present iff `ok` is true. */
+export interface HostAssertionVerifyResult {
+  ok: boolean;
+  userInfo?: AuthUserInfo;
+  /** The host's opaque user id for the visitor (assertion `sub`) — audit correlation, not an MJ user id. */
+  hostUserId?: string;
+  errorCode?: HostAssertionError;
+}
+
+/**
+ * Authentication provider for the public web-widget **host-identity** strategy (D1).
+ *
+ * When a widget is embedded in an already-authenticated host portal, the host signs a short-lived
+ * RS256 assertion (with ITS OWN key) describing the visitor. Unlike Auth0/magic-link tokens — validated
+ * by the standard issuer→JWKS path — a host assertion is verified against a STATIC per-widget public key
+ * (stored on `WidgetInstance.HostPublicKey`) and exchanged at `POST /widget/session` for an MJ guest JWT.
+ * So this provider does NOT use the JWKS machinery: it exposes {@link VerifyHostAssertion} (static-PEM
+ * RS256 verification) + {@link extractUserInfo}, and the widget mint resolves it via the ClassFactory.
+ *
+ * SECURITY INVARIANT — key/assertion provenance MUST be independent. The party that presents a signed
+ * assertion must NOT also be able to provide or influence the public key used to verify it. If one party
+ * controlled both, the signature would prove nothing: an attacker could mint a fresh keypair, sign any
+ * claims with the private key, hand over the matching public key, and the check would trivially pass. The
+ * verifying key must therefore come from an independent trust path — here, out-of-band administrator
+ * configuration on `WidgetInstance.HostPublicKey` (the analog, for a static PEM, of pinning a trusted
+ * issuer's JWKS endpoint). That is why {@link VerifyHostAssertion} takes the PEM as a caller-supplied
+ * argument rather than reading any key material from the assertion itself: the caller (the widget mint)
+ * is responsible for sourcing the PEM from the registered widget record, never from the request payload.
+ *
+ * It still subclasses {@link BaseAuthProvider} (and registers in the same factory) so host-identity is a
+ * first-class, discoverable provider rather than ad-hoc mint code — the architecture the widget plan calls
+ * for. The base constructor builds a JWKS client from `jwksUri`; host-identity has no JWKS, so callers pass
+ * a placeholder `jwksUri` that is never contacted (verification goes through {@link VerifyHostAssertion}).
+ */
+@RegisterClass(BaseAuthProvider, 'host-identity')
+export class HostIdentityProvider extends BaseAuthProvider {
+  constructor(config: AuthProviderConfig) {
+    super(config);
+  }
+
+  /** Host identity never uses JWKS — config is valid as long as it names the provider. */
+  override validateConfig(): boolean {
+    return !!this.name;
+  }
+
+  /**
+   * Verifies a host-signed RS256 assertion against the host's STATIC public key (PEM) and extracts the
+   * asserted visitor identity. The assertion's `aud` must equal `expectedAudience` (the widget key, bound
+   * at the host) and it must carry an `email`. It must also be short-lived: it must declare its own `exp`
+   * AND be no older than {@link HOST_ASSERTION_MAX_AGE_SECONDS} since `iat` — so a misbehaving host cannot
+   * mint an unbounded token. Never throws — returns a structured result.
+   *
+   * SECURITY: `hostPublicKeyPem` MUST originate from an independent trust path (the registered
+   * `WidgetInstance.HostPublicKey`, set out-of-band by an administrator) — NEVER from the same request
+   * that carries `assertion`. Passing a key the assertion's presenter could influence defeats the
+   * signature check entirely (see the class-level SECURITY INVARIANT note).
+   */
+  VerifyHostAssertion(
+    assertion: string | undefined,
+    hostPublicKeyPem: string | undefined,
+    expectedAudience: string,
+  ): HostAssertionVerifyResult {
+    if (!assertion) {
+      return { ok: false, errorCode: 'missing' };
+    }
+    if (!hostPublicKeyPem) {
+      return { ok: false, errorCode: 'no_key' };
+    }
+    let payload: JwtPayload;
+    try {
+      // maxAge caps the assertion's age from `iat` regardless of the host-chosen `exp` (and requires `iat`
+      // to be present); jsonwebtoken surfaces a breach as TokenExpiredError, same as a normal expiry.
+      payload = jwt.verify(assertion, hostPublicKeyPem, {
+        algorithms: ['RS256'],
+        audience: expectedAudience,
+        maxAge: HOST_ASSERTION_MAX_AGE_SECONDS,
+      }) as JwtPayload;
+    } catch (e) {
+      // jsonwebtoken throws TokenExpiredError for expiry / maxAge; everything else is a signature/format fault.
+      return { ok: false, errorCode: e instanceof jwt.TokenExpiredError ? 'expired' : 'bad_signature' };
+    }
+    // Require an explicit expiry: we refuse to treat an unbounded assertion as valid even inside the maxAge
+    // window, so the host's "short-lived" contract is enforced, not merely assumed.
+    if (typeof payload.exp !== 'number') {
+      return { ok: false, errorCode: 'expired' };
+    }
+    const userInfo = this.extractUserInfo(payload);
+    if (!userInfo.email) {
+      return { ok: false, errorCode: 'no_email' };
+    }
+    const sub = typeof payload.sub === 'string' ? payload.sub : undefined;
+    return { ok: true, userInfo, hostUserId: sub };
+  }
+
+  /** Maps a verified host-assertion payload to standard MJ identity fields. */
+  extractUserInfo(payload: JwtPayload): AuthUserInfo {
+    const str = (v: unknown): string | undefined => (typeof v === 'string' && v ? v : undefined);
+    const email = str(payload.email);
+    const firstName = str(payload.given_name) ?? str(payload['firstName']);
+    const lastName = str(payload.family_name) ?? str(payload['lastName']);
+    return {
+      email,
+      firstName,
+      lastName,
+      fullName: str(payload.name) ?? ([firstName, lastName].filter(Boolean).join(' ') || undefined),
+      preferredUsername: email,
+    };
+  }
+}

package/src/providers/WorkOSProvider.ts

@@ -0,0 +1,78 @@
+import { JwtPayload } from 'jsonwebtoken';
+import { RegisterClass } from '@memberjunction/global';
+import { AuthProviderConfig, AuthUserInfo } from '@memberjunction/core';
+import { BaseAuthProvider } from '../BaseAuthProvider.js';
+
+
+/**
+ * WorkOS (AuthKit) authentication provider implementation.
+ *
+ * Validates JWT access tokens minted by WorkOS AuthKit / User Management. These tokens are
+ * signed with RS256 and verified against the per-environment JWKS endpoint
+ * (`https://api.workos.com/sso/jwks/<clientId>`); their `iss` claim is
+ * `https://api.workos.com/user_management/<clientId>`.
+ *
+ * ## Email is required — and is NOT in a WorkOS token by default
+ * MemberJunction resolves the signed-in user by **email**, but a WorkOS AuthKit access token
+ * only carries identity/session claims (`sub`, `sid`, `org_id`, `role`, `permissions`) out of
+ * the box — it does **not** include `email`. To use WorkOS with MJ you must add the email (and
+ * ideally the name) to the token via a WorkOS **JWT Template**:
+ *
+ * ```json
+ * {
+ *   "email": "{{user.email}}",
+ *   "given_name": "{{user.first_name}}",
+ *   "family_name": "{{user.last_name}}"
+ * }
+ * ```
+ *
+ * See `WORKOS.md` in this package for the full, step-by-step integration guide.
+ */
+@RegisterClass(BaseAuthProvider, 'workos')
+export class WorkOSProvider extends BaseAuthProvider {
+  constructor(config: AuthProviderConfig) {
+    super(config);
+  }
+
+  /**
+   * Extracts user information from a WorkOS AuthKit JWT payload.
+   *
+   * `email`, `given_name`, and `family_name` are expected to be supplied by a WorkOS JWT
+   * Template (see class docs). `sub` is the stable WorkOS user id (`user_...`). We fall back
+   * through standard OIDC claim names so a token shaped by a custom template (e.g. one that
+   * only sets `name`) still resolves a usable identity.
+   */
+  extractUserInfo(payload: JwtPayload): AuthUserInfo {
+    const email = payload.email as string | undefined;
+    const fullName = payload.name as string | undefined;
+    const firstName = payload.given_name as string | undefined;
+    const lastName = payload.family_name as string | undefined;
+    // WorkOS access tokens have no `preferred_username`; email is the natural handle.
+    const preferredUsername = payload.preferred_username as string | undefined || email;
+    // `sub` is the WorkOS user identifier (e.g. "user_01H...").
+    const userId = payload.sub as string | undefined;
+
+    return {
+      email,
+      firstName: firstName || fullName?.split(' ')[0],
+      lastName: lastName || fullName?.split(' ')[1] || fullName?.split(' ')[0],
+      fullName,
+      preferredUsername,
+      userId
+    };
+  }
+
+  /**
+   * Validates WorkOS-specific configuration.
+   *
+   * Beyond the base requirements (`name`, `issuer`, `audience`, `jwksUri`), WorkOS needs a
+   * `clientId` — it appears in both the issuer and JWKS URLs and identifies the AuthKit
+   * environment.
+   */
+  validateConfig(): boolean {
+    const baseValid = super.validateConfig();
+    const hasClientId = !!this.config.clientId;
+
+    return baseValid && hasClientId;
+  }
+}