@workos-inc/node 10.10.0 → 10.12.0

package/lib/{factory-2nVUxmEk.mjs → factory-AQv-AfDk.mjs}

@@ -321,7 +321,7 @@ var FetchHttpClient = class FetchHttpClient extends HttpClient {
 				message: `Request timeout after ${timeout}ms`,
 				response: {
 					status: 408,
-					headers: {},
+					headers: new Headers(),
 					data: { error: "Request timeout" }
 				}
 			});
@@ -610,10 +610,11 @@ var UnprocessableEntityException = class extends Error {
 	message = "Unprocessable entity";
 	code;
 	requestID;
-	constructor({ code, errors, message, requestID }) {
+	constructor({ code, error, errors, message, requestID }) {
 		super();
 		this.requestID = requestID;
 		if (message) this.message = message;
+		else if (error) this.message = `Error: ${error}`;
 		if (code) this.code = code;
 		if (errors) {
 			const requirement = errors.length === 1 ? "requirement" : "requirements";
@@ -1242,7 +1243,8 @@ var Actions = class {
 			tolerance
 		};
 		await this.verifyHeader(options);
-		return deserializeAction(typeof payload === "string" || isBinaryPayload(payload) ? JSON.parse(decodePayloadToString(payload)) : payload);
+		const parsed = typeof payload === "string" || isBinaryPayload(payload) ? JSON.parse(decodePayloadToString(payload)) : payload;
+		return deserializeAction(parsed);
 	}
 };
 //#endregion
@@ -1410,6 +1412,19 @@ const serializeCreateOrganizationOptions = (options) => ({
 	metadata: options.metadata
 });
 //#endregion
+//#region src/organizations/serializers/it-contact-options.serializer.ts
+const serializeCreateItContactOptions = (options) => ({ email: options.email });
+const serializeInviteItContactOptions = (options) => ({ intents: options.intents });
+//#endregion
+//#region src/organizations/serializers/it-contact.serializer.ts
+const deserializeItContact = (itContact) => ({
+	object: itContact.object,
+	id: itContact.id,
+	email: itContact.email,
+	createdAt: itContact.created_at,
+	updatedAt: itContact.updated_at
+});
+//#endregion
 //#region src/organizations/serializers/update-organization-options.serializer.ts
 const serializeUpdateOrganizationOptions = (options) => ({
 	name: options.name,
@@ -1658,6 +1673,30 @@ const deserializeOrganizationDomainVerificationFailed = (organizationDomainVerif
 });
 //#endregion
 //#region src/common/serializers/event.serializer.ts
+const deserializePipesConnectedAccount = (connectedAccount) => ({
+	object: connectedAccount.object,
+	id: connectedAccount.id,
+	dataIntegrationId: connectedAccount.data_integration_id,
+	providerSlug: connectedAccount.provider_slug,
+	userId: connectedAccount.user_id,
+	organizationId: connectedAccount.organization_id,
+	scopes: connectedAccount.scopes,
+	state: connectedAccount.state,
+	createdAt: connectedAccount.created_at,
+	updatedAt: connectedAccount.updated_at
+});
+const deserializePipesConnectionFailed = (connectionFailed) => ({
+	object: connectionFailed.object,
+	dataIntegrationId: connectionFailed.data_integration_id,
+	providerSlug: connectionFailed.provider_slug,
+	userId: connectionFailed.user_id,
+	organizationId: connectionFailed.organization_id,
+	errorCode: connectionFailed.error_code,
+	errorReason: connectionFailed.error_reason,
+	providerError: connectionFailed.provider_error,
+	providerErrorDescription: connectionFailed.provider_error_description,
+	createdAt: connectionFailed.created_at
+});
 const deserializeEvent = (event) => {
 	const eventBase = {
 		id: event.id,
@@ -1850,6 +1889,18 @@ const deserializeEvent = (event) => {
 				organizationMembershipId: event.data.organization_membership_id
 			}
 		};
+		case "pipes.connected_account.connected":
+		case "pipes.connected_account.disconnected":
+		case "pipes.connected_account.reauthorization_needed": return {
+			...eventBase,
+			event: event.event,
+			data: deserializePipesConnectedAccount(event.data)
+		};
+		case "pipes.connected_account.connection_failed": return {
+			...eventBase,
+			event: event.event,
+			data: deserializePipesConnectionFailed(event.data)
+		};
 		case "vault.data.created": return {
 			...eventBase,
 			event: event.event,
@@ -2057,7 +2108,8 @@ var Webhooks = class {
 			tolerance
 		};
 		await this.verifyHeader(options);
-		return deserializeEvent(this.parseVerifiedPayload(payload));
+		const webhookPayload = this.parseVerifiedPayload(payload);
+		return deserializeEvent(webhookPayload);
 	}
 	parseVerifiedPayload(payload) {
 		if (typeof payload === "object" && !isBinaryPayload(payload)) return payload;
@@ -2130,7 +2182,7 @@ let _josePromise;
 * @returns Promise that resolves to the jose module
 */
 function getJose() {
-	return _josePromise ??= import("./webapi-BgpV54gi.mjs");
+	return _josePromise ??= import("./webapi-BlhUk1KL.mjs");
 }
 //#endregion
 //#region src/agents/serializers/agent-registration.serializer.ts
@@ -2348,7 +2400,7 @@ var Agents = class {
 		const { clientId } = this.workos;
 		if (!clientId) throw new Error("Missing client ID. Did you provide it when initializing WorkOS?");
 		const { createRemoteJWKSet } = await getJose();
-		this._jwks ??= createRemoteJWKSet(new URL(`${this.workos.baseURL}/sso/jwks/${clientId}`), { cooldownDuration: 1e3 * 60 * 5 });
+		this._jwks ??= createRemoteJWKSet(new URL(`${this.workos.baseURL}/sso/jwks/${clientId}`), { cooldownDuration: 3e5 });
 		return this._jwks;
 	}
 };
@@ -3047,6 +3099,88 @@ var Organizations = class {
 		const { data } = await this.workos.put(`/organizations/${organizationId}`, serializeUpdateOrganizationOptions(payload));
 		return deserializeOrganization(data);
 	}
+	/**
+	* List IT Contacts
+	*
+	* Get the IT Contacts for an Organization.
+	* @param options - Object containing the Organization ID.
+	* @returns {Promise<List<ItContact>>}
+	* @throws {AuthorizationException} 403
+	* @throws {NotFoundException} 404
+	*/
+	async listItContacts(options) {
+		const { organizationId } = options;
+		const { data } = await this.workos.get(`/organizations/${organizationId}/it_contacts`);
+		return {
+			object: data.object,
+			data: data.data.map(deserializeItContact),
+			listMetadata: {
+				before: data.list_metadata.before,
+				after: data.list_metadata.after
+			}
+		};
+	}
+	/**
+	* Create an IT Contact
+	*
+	* Add an IT Contact to an Organization. No Admin Portal invitation is sent,
+	* though the contact is notified if the Organization has a connection
+	* certificate nearing expiry.
+	* @param options - Object containing the Organization ID and the email address.
+	* @returns {Promise<ItContact>}
+	* @throws {AuthorizationException} 403
+	* @throws {NotFoundException} 404
+	* @throws {ConflictException} 409
+	* @throws {UnprocessableEntityException} 422
+	*/
+	async createItContact(options) {
+		const { organizationId, ...payload } = options;
+		const { data } = await this.workos.post(`/organizations/${organizationId}/it_contacts`, serializeCreateItContactOptions(payload));
+		return deserializeItContact(data);
+	}
+	/**
+	* Delete an IT Contact
+	*
+	* Remove an IT Contact from an Organization and revoke the contact's active
+	* setup links.
+	* @param options - Object containing the Organization ID and the IT Contact ID.
+	* @returns {Promise<void>}
+	* @throws {AuthorizationException} 403
+	* @throws {NotFoundException} 404
+	*/
+	async deleteItContact(options) {
+		const { organizationId, contactId } = options;
+		await this.workos.delete(`/organizations/${organizationId}/it_contacts/${contactId}`);
+	}
+	/**
+	* Invite an IT Contact
+	*
+	* Create an Admin Portal setup link and email it to the IT Contact. An
+	* Organization can have at most one active invitation.
+	* @param options - Object containing the Organization ID, the IT Contact ID and the intents.
+	* @returns {Promise<void>}
+	* @throws {AuthorizationException} 403
+	* @throws {NotFoundException} 404
+	* @throws {ConflictException} 409
+	* @throws {UnprocessableEntityException} 422
+	*/
+	async inviteItContact(options) {
+		const { organizationId, contactId, ...payload } = options;
+		await this.workos.post(`/organizations/${organizationId}/it_contacts/${contactId}/invite`, serializeInviteItContactOptions(payload));
+	}
+	/**
+	* Revoke an IT Contact's invitation
+	*
+	* Revoke the Organization's active Admin Portal invitation.
+	* @param options - Object containing the Organization ID and the IT Contact ID.
+	* @returns {Promise<void>}
+	* @throws {AuthorizationException} 403
+	* @throws {NotFoundException} 404
+	*/
+	async revokeItContact(options) {
+		const { organizationId, contactId } = options;
+		await this.workos.post(`/organizations/${organizationId}/it_contacts/${contactId}/revoke`, {});
+	}
 };
 //#endregion
 //#region src/organization-domains/serializers/create-organization-domain-options.serializer.ts
@@ -5037,7 +5171,7 @@ var UserManagement = class {
 	async getJWKS() {
 		const { createRemoteJWKSet } = await getJose();
 		if (!this.clientId) return;
-		this._jwks ??= createRemoteJWKSet(new URL(this.getJwksUrl(this.clientId)), { cooldownDuration: 1e3 * 60 * 5 });
+		this._jwks ??= createRemoteJWKSet(new URL(this.getJwksUrl(this.clientId)), { cooldownDuration: 3e5 });
 		return this._jwks;
 	}
 	/**
@@ -5947,31 +6081,91 @@ var InMemoryStore = class {
 };
 //#endregion
 //#region src/feature-flags/evaluator.ts
+const TARGET_TYPE_PATTERN = /^[a-z][a-z0-9_-]{0,63}$/;
+const TARGET_ID_PATTERN = /^[A-Za-z0-9._:-]{1,255}$/;
+const LEGACY_KEY_TO_TARGET_TYPE = /* @__PURE__ */ new Map([["userId", "user"], ["organizationId", "organization"]]);
+const isEvaluationResource = (value) => typeof value === "object" && value !== null && "id" in value && typeof value.id === "string";
 var Evaluator = class {
 	store;
-	constructor(store) {
+	logger;
+	constructor(store, logger) {
 		this.store = store;
+		this.logger = logger;
 	}
 	isEnabled(flagKey, context = {}, defaultValue = false) {
-		const entry = this.store.get(flagKey);
-		if (!entry) return defaultValue;
-		if (!entry.enabled) return false;
-		if (context.userId) {
-			const userTarget = entry.targets.users.find((t) => t.id === context.userId);
-			if (userTarget) return userTarget.enabled;
-		}
-		if (context.organizationId) {
-			const orgTarget = entry.targets.organizations.find((t) => t.id === context.organizationId);
-			if (orgTarget) return orgTarget.enabled;
-		}
-		return entry.default_value;
+		return this.evaluate(this.store.get(flagKey), this.normalizeContext(context), defaultValue);
 	}
 	getAllFlags(context = {}) {
+		const normalizedContext = this.normalizeContext(context);
 		const flags = this.store.getAll();
 		const result = {};
-		for (const slug of Object.keys(flags)) result[slug] = this.isEnabled(slug, context);
+		for (const slug of Object.keys(flags)) result[slug] = this.evaluate(flags[slug], normalizedContext, false);
 		return result;
 	}
+	evaluate(entry, normalizedContext, defaultValue) {
+		if (!entry) return defaultValue;
+		if (!entry.enabled) return false;
+		for (const [targetType, targetId] of normalizedContext) if (this.hasEnabledTarget(entry, targetType, targetId)) return true;
+		return entry.default_value;
+	}
+	/**
+	* Reduces either context form to target type → ID pairs. Evaluation must
+	* never throw in application code, so every invalid piece of context
+	* degrades to "matches no targets" with a logged warning instead of an
+	* error.
+	*/
+	normalizeContext(context) {
+		const normalized = /* @__PURE__ */ new Map();
+		const record = context;
+		const legacyEntries = [];
+		const typedKeys = [];
+		for (const [key, value] of Object.entries(record)) {
+			if (value === void 0 || value === null) continue;
+			const legacyTargetType = LEGACY_KEY_TO_TARGET_TYPE.get(key);
+			if (legacyTargetType) {
+				if (typeof value === "string" && value !== "") legacyEntries.push([legacyTargetType, value]);
+				continue;
+			}
+			typedKeys.push(key);
+		}
+		const resourceShapedKeys = typedKeys.filter((key) => typeof record[key] === "object");
+		if (legacyEntries.length > 0 && resourceShapedKeys.length > 0) {
+			this.logger?.warn("Evaluation context mixes legacy keys (userId/organizationId) with typed target keys; no targets will match", { keys: Object.keys(record) });
+			return normalized;
+		}
+		if (legacyEntries.length > 0) {
+			for (const [targetType, targetId] of legacyEntries) normalized.set(targetType, targetId);
+			return normalized;
+		}
+		for (const key of typedKeys) {
+			if (!TARGET_TYPE_PATTERN.test(key)) {
+				this.logger?.warn(`Ignoring invalid target type in evaluation context: ${key}`);
+				continue;
+			}
+			const value = record[key];
+			if (!isEvaluationResource(value)) {
+				this.logger?.warn(`Ignoring target type with a missing or invalid resource id in evaluation context: ${key}`);
+				continue;
+			}
+			const { id } = value;
+			if (!TARGET_ID_PATTERN.test(id) || id === "." || id === "..") {
+				this.logger?.warn(`Ignoring invalid target id in evaluation context for type: ${key}`);
+				continue;
+			}
+			normalized.set(key, id);
+		}
+		return normalized;
+	}
+	/**
+	* A target participates in evaluation only while its `enabled` is true. A
+	* `false` value is reserved for future disabled overrides and is treated
+	* as if the target were absent.
+	*/
+	hasEnabledTarget(entry, targetType, targetId) {
+		if (targetType === "user") return entry.targets.users.some((t) => t.id === targetId && t.enabled);
+		if (targetType === "organization") return entry.targets.organizations.some((t) => t.id === targetId && t.enabled);
+		return (entry.targets.custom_targets ?? []).some((t) => t.type === targetType && t.id === targetId && t.enabled);
+	}
 };
 //#endregion
 //#region src/feature-flags/runtime-client.ts
@@ -6013,7 +6207,7 @@ var FeatureFlagsRuntimeClient = class extends EventEmitter {
 		this.requestTimeoutMs = options.requestTimeoutMs ?? DEFAULT_REQUEST_TIMEOUT_MS;
 		this.logger = options.logger;
 		this.store = new InMemoryStore();
-		this.evaluator = new Evaluator(this.store);
+		this.evaluator = new Evaluator(this.store, this.logger);
 		this.readyPromise = new Promise((resolve, reject) => {
 			this.readyResolve = resolve;
 			this.readyReject = reject;
@@ -6158,7 +6352,12 @@ var FeatureFlagsRuntimeClient = class extends EventEmitter {
 			const map = new Map(ys.map((t) => [t.id, t.enabled]));
 			return xs.some((t) => map.get(t.id) !== t.enabled);
 		};
-		return targetsChanged(a.targets.users, b.targets.users) || targetsChanged(a.targets.organizations, b.targets.organizations);
+		const customTargetsChanged = (xs, ys) => {
+			if (xs.length !== ys.length) return true;
+			const map = new Map(ys.map((t) => [`${t.type}:${t.id}`, t.enabled]));
+			return xs.some((t) => map.get(`${t.type}:${t.id}`) !== t.enabled);
+		};
+		return targetsChanged(a.targets.users, b.targets.users) || targetsChanged(a.targets.organizations, b.targets.organizations) || customTargetsChanged(a.targets.custom_targets ?? [], b.targets.custom_targets ?? []);
 	}
 };
 //#endregion
@@ -8071,7 +8270,7 @@ var Vault = class {
 };
 //#endregion
 //#region package.json
-var version = "10.10.0";
+var version = "10.12.0";
 //#endregion
 //#region src/workos.ts
 const DEFAULT_HOSTNAME = "api.workos.com";
@@ -8302,7 +8501,7 @@ var WorkOS = class {
 		const { response } = error;
 		if (response) {
 			const { status, data, headers } = response;
-			const requestID = headers["X-Request-ID"] ?? "";
+			const requestID = headers.get("X-Request-ID") ?? "";
 			const { code, error_description: errorDescription, error, errors, message } = data;
 			switch (status) {
 				case 401: throw new UnauthorizedException(requestID);
@@ -8314,6 +8513,7 @@ var WorkOS = class {
 				});
 				case 422: throw new UnprocessableEntityException({
 					code,
+					error,
 					errors,
 					message,
 					requestID
@@ -8360,6 +8560,15 @@ let DomainDataState = /* @__PURE__ */ function(DomainDataState) {
 	return DomainDataState;
 }({});
 //#endregion
+//#region src/organizations/interfaces/it-contact-options.interface.ts
+const ItContactIntent = {
+	SSO: "sso",
+	DirectorySync: "directory_sync",
+	LogStreams: "log_streams",
+	DomainVerification: "domain_verification",
+	BringYourOwnKey: "bring_your_own_key"
+};
+//#endregion
 //#region src/organization-domains/interfaces/organization-domain.interface.ts
 let OrganizationDomainState = /* @__PURE__ */ function(OrganizationDomainState) {
 	OrganizationDomainState["Verified"] = "verified";
@@ -8421,6 +8630,6 @@ function createWorkOS(options) {
 	return new WorkOS(options);
 }
 //#endregion
-export { FetchHttpClient as A, NoApiKeyProvidedException as C, isAuthenticationErrorData as D, AuthenticationException as E, GenericServerException as O, NotFoundException as S, BadRequestException as T, UnprocessableEntityException as _, DomainDataState as a, RateLimitExceededException as b, FeatureFlagsRuntimeClient as c, serializeRevokeSessionOptions as d, AuthenticateWithSessionCookieFailureReason as f, Actions as g, AutoPaginatable as h, OrganizationDomainVerificationStrategy as i, SubtleCryptoProvider as j, ApiKeyRequiredException as k, CookieSession as l, Webhooks as m, ConnectionType as n, GenerateLinkIntent as o, PKCE as p, OrganizationDomainState as r, WorkOS as s, createWorkOS as t, RefreshSessionFailureReason as u, UnauthorizedException as v, ConflictException as w, OauthException as x, SignatureVerificationException as y };
+export { ApiKeyRequiredException as A, NotFoundException as C, AuthenticationException as D, BadRequestException as E, SubtleCryptoProvider as M, isAuthenticationErrorData as O, OauthException as S, ConflictException as T, Actions as _, ItContactIntent as a, SignatureVerificationException as b, WorkOS as c, RefreshSessionFailureReason as d, serializeRevokeSessionOptions as f, AutoPaginatable as g, Webhooks as h, OrganizationDomainVerificationStrategy as i, FetchHttpClient as j, GenericServerException as k, FeatureFlagsRuntimeClient as l, PKCE as m, ConnectionType as n, DomainDataState as o, AuthenticateWithSessionCookieFailureReason as p, OrganizationDomainState as r, GenerateLinkIntent as s, createWorkOS as t, CookieSession as u, UnprocessableEntityException as v, NoApiKeyProvidedException as w, RateLimitExceededException as x, UnauthorizedException as y };
 
-//# sourceMappingURL=factory-2nVUxmEk.mjs.map
+//# sourceMappingURL=factory-AQv-AfDk.mjs.map