@workos-inc/node 8.0.0-beta.1 → 8.0.0-beta.3

package/lib/vault/vault.js

@@ -1,156 +1,179 @@
-var __defProp = Object.defineProperty;
-var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
-import { decodeUInt32, encodeUInt32 } from "leb";
-import { base64ToUint8Array, uint8ArrayToBase64 } from "../common/utils/base64";
-import {
-  deserializeCreateDataKeyResponse,
-  deserializeDecryptDataKeyResponse
-} from "./serializers/vault-key.serializer";
-import {
-  deserializeListObjects,
-  deserializeObject,
-  deserializeObjectMetadata,
-  desrializeListObjectVersions,
-  serializeCreateObjectEntity,
-  serializeUpdateObjectEntity
-} from "./serializers/vault-object.serializer";
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Vault = void 0;
+const leb_1 = require("leb");
+const base64_1 = require("../common/utils/base64");
+const vault_key_serializer_1 = require("./serializers/vault-key.serializer");
+const vault_object_serializer_1 = require("./serializers/vault-object.serializer");
 class Vault {
-  constructor(workos) {
-    this.workos = workos;
-    this.cryptoProvider = workos.getCryptoProvider();
-  }
-  static {
-    __name(this, "Vault");
-  }
-  decode(payload) {
-    const inputData = base64ToUint8Array(payload);
-    const iv = new Uint8Array(inputData.subarray(0, 12));
-    const tag = new Uint8Array(inputData.subarray(12, 28));
-    const { value: keyLen, nextIndex } = decodeUInt32(inputData, 28);
-    const keysBuffer = inputData.subarray(nextIndex, nextIndex + keyLen);
-    const keys = uint8ArrayToBase64(keysBuffer);
-    const ciphertext = new Uint8Array(inputData.subarray(nextIndex + keyLen));
-    return {
-      iv,
-      tag,
-      keys,
-      ciphertext
-    };
-  }
-  async createObject(options) {
-    const { data } = await this.workos.post(
-      `/vault/v1/kv`,
-      serializeCreateObjectEntity(options)
-    );
-    return deserializeObjectMetadata(data);
-  }
-  async listObjects(options) {
-    const url = new URL("/vault/v1/kv", this.workos.baseURL);
-    if (options?.after) {
-      url.searchParams.set("after", options.after);
+    constructor(workos) {
+        this.workos = workos;
+        /*
+         * @deprecated Use `createObject` instead.
+         */
+        this.createSecret = this.createObject;
+        /*
+         * @deprecated Use `listObjects` instead.
+         */
+        this.listSecrets = this.listObjects;
+        /*
+         * @deprecated Use `listObjectVersions` instead.
+         */
+        this.listSecretVersions = this.listObjectVersions;
+        /*
+         * @deprecated Use `readObject` instead.
+         */
+        this.readSecret = this.readObject;
+        /*
+         * @deprecated Use `describeObject` instead.
+         */
+        this.describeSecret = this.describeObject;
+        /*
+         * @deprecated Use `updateObject` instead.
+         */
+        this.updateSecret = this.updateObject;
+        /*
+         * @deprecated Use `deleteObject` instead.
+         */
+        this.deleteSecret = this.deleteObject;
+        this.cryptoProvider = workos.getCryptoProvider();
     }
-    if (options?.limit) {
-      url.searchParams.set("limit", options.limit.toString());
+    decode(payload) {
+        const inputData = (0, base64_1.base64ToUint8Array)(payload);
+        // Use 12 bytes for IV (standard for AES-GCM)
+        const iv = new Uint8Array(inputData.subarray(0, 12));
+        const tag = new Uint8Array(inputData.subarray(12, 28));
+        const { value: keyLen, nextIndex } = (0, leb_1.decodeUInt32)(inputData, 28);
+        // Use subarray instead of slice and convert directly to base64
+        const keysBuffer = inputData.subarray(nextIndex, nextIndex + keyLen);
+        const keys = (0, base64_1.uint8ArrayToBase64)(keysBuffer);
+        const ciphertext = new Uint8Array(inputData.subarray(nextIndex + keyLen));
+        return {
+            iv,
+            tag,
+            keys,
+            ciphertext,
+        };
+    }
+    createObject(options) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const { data } = yield this.workos.post(`/vault/v1/kv`, (0, vault_object_serializer_1.serializeCreateObjectEntity)(options));
+            return (0, vault_object_serializer_1.deserializeObjectMetadata)(data);
+        });
+    }
+    listObjects(options) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const url = new URL('/vault/v1/kv', this.workos.baseURL);
+            if (options === null || options === void 0 ? void 0 : options.after) {
+                url.searchParams.set('after', options.after);
+            }
+            if (options === null || options === void 0 ? void 0 : options.limit) {
+                url.searchParams.set('limit', options.limit.toString());
+            }
+            const { data } = yield this.workos.get(url.toString());
+            return (0, vault_object_serializer_1.deserializeListObjects)(data);
+        });
+    }
+    listObjectVersions(options) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const { data } = yield this.workos.get(`/vault/v1/kv/${encodeURIComponent(options.id)}/versions`);
+            return (0, vault_object_serializer_1.desrializeListObjectVersions)(data);
+        });
+    }
+    readObject(options) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const { data } = yield this.workos.get(`/vault/v1/kv/${encodeURIComponent(options.id)}`);
+            return (0, vault_object_serializer_1.deserializeObject)(data);
+        });
+    }
+    describeObject(options) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const { data } = yield this.workos.get(`/vault/v1/kv/${encodeURIComponent(options.id)}/metadata`);
+            return (0, vault_object_serializer_1.deserializeObject)(data);
+        });
+    }
+    updateObject(options) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const { data } = yield this.workos.put(`/vault/v1/kv/${encodeURIComponent(options.id)}`, (0, vault_object_serializer_1.serializeUpdateObjectEntity)(options));
+            return (0, vault_object_serializer_1.deserializeObject)(data);
+        });
+    }
+    deleteObject(options) {
+        return __awaiter(this, void 0, void 0, function* () {
+            return this.workos.delete(`/vault/v1/kv/${encodeURIComponent(options.id)}`);
+        });
+    }
+    createDataKey(options) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const { data } = yield this.workos.post(`/vault/v1/keys/data-key`, options);
+            return (0, vault_key_serializer_1.deserializeCreateDataKeyResponse)(data);
+        });
+    }
+    decryptDataKey(options) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const { data } = yield this.workos.post(`/vault/v1/keys/decrypt`, options);
+            return (0, vault_key_serializer_1.deserializeDecryptDataKeyResponse)(data);
+        });
+    }
+    encrypt(data, context, associatedData) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const keyPair = yield this.createDataKey({
+                context,
+            });
+            // Convert base64 key to Uint8Array
+            const encoder = new TextEncoder();
+            // Use our cross-runtime base64 utility
+            const key = (0, base64_1.base64ToUint8Array)(keyPair.dataKey.key);
+            const keyBlob = (0, base64_1.base64ToUint8Array)(keyPair.encryptedKeys);
+            const prefixLenBuffer = (0, leb_1.encodeUInt32)(keyBlob.length);
+            const aadBuffer = associatedData
+                ? encoder.encode(associatedData)
+                : undefined;
+            // Use a 12-byte IV for AES-GCM (industry standard)
+            const iv = this.cryptoProvider.randomBytes(12);
+            const { ciphertext, iv: resultIv, tag, } = yield this.cryptoProvider.encrypt(encoder.encode(data), key, iv, aadBuffer);
+            // Concatenate all parts into a single array
+            const resultArray = new Uint8Array(resultIv.length +
+                tag.length +
+                prefixLenBuffer.length +
+                keyBlob.length +
+                ciphertext.length);
+            let offset = 0;
+            resultArray.set(resultIv, offset);
+            offset += resultIv.length;
+            resultArray.set(tag, offset);
+            offset += tag.length;
+            resultArray.set(new Uint8Array(prefixLenBuffer), offset);
+            offset += prefixLenBuffer.length;
+            resultArray.set(keyBlob, offset);
+            offset += keyBlob.length;
+            resultArray.set(ciphertext, offset);
+            // Convert to base64 using our cross-runtime utility
+            return (0, base64_1.uint8ArrayToBase64)(resultArray);
+        });
+    }
+    decrypt(encryptedData, associatedData) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const decoded = this.decode(encryptedData);
+            const dataKey = yield this.decryptDataKey({ keys: decoded.keys });
+            // Convert base64 key to Uint8Array using our cross-runtime utility
+            const key = (0, base64_1.base64ToUint8Array)(dataKey.key);
+            const encoder = new TextEncoder();
+            const aadBuffer = associatedData
+                ? encoder.encode(associatedData)
+                : undefined;
+            const decrypted = yield this.cryptoProvider.decrypt(decoded.ciphertext, key, decoded.iv, decoded.tag, aadBuffer);
+            return new TextDecoder().decode(decrypted);
+        });
     }
-    const { data } = await this.workos.get(
-      url.toString()
-    );
-    return deserializeListObjects(data);
-  }
-  async listObjectVersions(options) {
-    const { data } = await this.workos.get(
-      `/vault/v1/kv/${encodeURIComponent(options.id)}/versions`
-    );
-    return desrializeListObjectVersions(data);
-  }
-  async readObject(options) {
-    const { data } = await this.workos.get(
-      `/vault/v1/kv/${encodeURIComponent(options.id)}`
-    );
-    return deserializeObject(data);
-  }
-  async describeObject(options) {
-    const { data } = await this.workos.get(
-      `/vault/v1/kv/${encodeURIComponent(options.id)}/metadata`
-    );
-    return deserializeObject(data);
-  }
-  async updateObject(options) {
-    const { data } = await this.workos.put(
-      `/vault/v1/kv/${encodeURIComponent(options.id)}`,
-      serializeUpdateObjectEntity(options)
-    );
-    return deserializeObject(data);
-  }
-  async deleteObject(options) {
-    return this.workos.delete(`/vault/v1/kv/${encodeURIComponent(options.id)}`);
-  }
-  async createDataKey(options) {
-    const { data } = await this.workos.post(
-      `/vault/v1/keys/data-key`,
-      options
-    );
-    return deserializeCreateDataKeyResponse(data);
-  }
-  async decryptDataKey(options) {
-    const { data } = await this.workos.post(
-      `/vault/v1/keys/decrypt`,
-      options
-    );
-    return deserializeDecryptDataKeyResponse(data);
-  }
-  async encrypt(data, context, associatedData) {
-    const keyPair = await this.createDataKey({
-      context
-    });
-    const encoder = new TextEncoder();
-    const key = base64ToUint8Array(keyPair.dataKey.key);
-    const keyBlob = base64ToUint8Array(keyPair.encryptedKeys);
-    const prefixLenBuffer = encodeUInt32(keyBlob.length);
-    const aadBuffer = associatedData ? encoder.encode(associatedData) : void 0;
-    const iv = this.cryptoProvider.randomBytes(12);
-    const {
-      ciphertext,
-      iv: resultIv,
-      tag
-    } = await this.cryptoProvider.encrypt(
-      encoder.encode(data),
-      key,
-      iv,
-      aadBuffer
-    );
-    const resultArray = new Uint8Array(
-      resultIv.length + tag.length + prefixLenBuffer.length + keyBlob.length + ciphertext.length
-    );
-    let offset = 0;
-    resultArray.set(resultIv, offset);
-    offset += resultIv.length;
-    resultArray.set(tag, offset);
-    offset += tag.length;
-    resultArray.set(new Uint8Array(prefixLenBuffer), offset);
-    offset += prefixLenBuffer.length;
-    resultArray.set(keyBlob, offset);
-    offset += keyBlob.length;
-    resultArray.set(ciphertext, offset);
-    return uint8ArrayToBase64(resultArray);
-  }
-  async decrypt(encryptedData, associatedData) {
-    const decoded = this.decode(encryptedData);
-    const dataKey = await this.decryptDataKey({ keys: decoded.keys });
-    const key = base64ToUint8Array(dataKey.key);
-    const encoder = new TextEncoder();
-    const aadBuffer = associatedData ? encoder.encode(associatedData) : void 0;
-    const decrypted = await this.cryptoProvider.decrypt(
-      decoded.ciphertext,
-      key,
-      decoded.iv,
-      decoded.tag,
-      aadBuffer
-    );
-    return new TextDecoder().decode(decrypted);
-  }
 }
-export {
-  Vault
-};
-//# sourceMappingURL=vault.js.map
+exports.Vault = Vault;

package/lib/vault/vault.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/vault/vault.ts"],"sourcesContent":["import { decodeUInt32, encodeUInt32 } from 'leb';\nimport { CryptoProvider } from '../common/crypto/crypto-provider';\nimport { List, ListResponse } from '../common/interfaces';\nimport { PaginationOptions } from '../index.worker';\nimport { base64ToUint8Array, uint8ArrayToBase64 } from '../common/utils/base64';\nimport type { WorkOS } from '../workos';\nimport {\n  CreateDataKeyOptions,\n  CreateDataKeyResponse,\n  CreateObjectOptions,\n  DataKey,\n  DataKeyPair,\n  DecryptDataKeyOptions,\n  DecryptDataKeyResponse,\n  DeleteObjectOptions,\n  KeyContext,\n  ListObjectVersionsResponse,\n  ObjectDigest,\n  ObjectDigestResponse,\n  ObjectMetadata,\n  ObjectVersion,\n  ReadObjectMetadataResponse,\n  ReadObjectOptions,\n  ReadObjectResponse,\n  UpdateObjectOptions,\n  VaultObject,\n} from './interfaces';\nimport {\n  deserializeCreateDataKeyResponse,\n  deserializeDecryptDataKeyResponse,\n} from './serializers/vault-key.serializer';\nimport {\n  deserializeListObjects,\n  deserializeObject,\n  deserializeObjectMetadata,\n  desrializeListObjectVersions,\n  serializeCreateObjectEntity,\n  serializeUpdateObjectEntity,\n} from './serializers/vault-object.serializer';\n\ninterface Decoded {\n  iv: Uint8Array;\n  tag: Uint8Array;\n  keys: string;\n  ciphertext: Uint8Array;\n}\n\nexport class Vault {\n  private cryptoProvider: CryptoProvider;\n\n  constructor(private readonly workos: WorkOS) {\n    this.cryptoProvider = workos.getCryptoProvider();\n  }\n\n  private decode(payload: string): Decoded {\n    const inputData = base64ToUint8Array(payload);\n    // Use 12 bytes for IV (standard for AES-GCM)\n    const iv = new Uint8Array(inputData.subarray(0, 12));\n    const tag = new Uint8Array(inputData.subarray(12, 28));\n    const { value: keyLen, nextIndex } = decodeUInt32(inputData, 28);\n\n    // Use subarray instead of slice and convert directly to base64\n    const keysBuffer = inputData.subarray(nextIndex, nextIndex + keyLen);\n    const keys = uint8ArrayToBase64(keysBuffer);\n\n    const ciphertext = new Uint8Array(inputData.subarray(nextIndex + keyLen));\n\n    return {\n      iv,\n      tag,\n      keys,\n      ciphertext,\n    };\n  }\n\n  async createObject(options: CreateObjectOptions): Promise<ObjectMetadata> {\n    const { data } = await this.workos.post<ReadObjectMetadataResponse>(\n      `/vault/v1/kv`,\n      serializeCreateObjectEntity(options),\n    );\n    return deserializeObjectMetadata(data);\n  }\n\n  async listObjects(\n    options?: PaginationOptions | undefined,\n  ): Promise<List<ObjectDigest>> {\n    const url = new URL('/vault/v1/kv', this.workos.baseURL);\n    if (options?.after) {\n      url.searchParams.set('after', options.after);\n    }\n    if (options?.limit) {\n      url.searchParams.set('limit', options.limit.toString());\n    }\n\n    const { data } = await this.workos.get<ListResponse<ObjectDigestResponse>>(\n      url.toString(),\n    );\n    return deserializeListObjects(data);\n  }\n\n  async listObjectVersions(\n    options: ReadObjectOptions,\n  ): Promise<ObjectVersion[]> {\n    const { data } = await this.workos.get<ListObjectVersionsResponse>(\n      `/vault/v1/kv/${encodeURIComponent(options.id)}/versions`,\n    );\n    return desrializeListObjectVersions(data);\n  }\n\n  async readObject(options: ReadObjectOptions): Promise<VaultObject> {\n    const { data } = await this.workos.get<ReadObjectResponse>(\n      `/vault/v1/kv/${encodeURIComponent(options.id)}`,\n    );\n    return deserializeObject(data);\n  }\n\n  async describeObject(options: ReadObjectOptions): Promise<VaultObject> {\n    const { data } = await this.workos.get<ReadObjectResponse>(\n      `/vault/v1/kv/${encodeURIComponent(options.id)}/metadata`,\n    );\n    return deserializeObject(data);\n  }\n\n  async updateObject(options: UpdateObjectOptions): Promise<VaultObject> {\n    const { data } = await this.workos.put<ReadObjectResponse>(\n      `/vault/v1/kv/${encodeURIComponent(options.id)}`,\n      serializeUpdateObjectEntity(options),\n    );\n    return deserializeObject(data);\n  }\n\n  async deleteObject(options: DeleteObjectOptions): Promise<void> {\n    return this.workos.delete(`/vault/v1/kv/${encodeURIComponent(options.id)}`);\n  }\n\n  async createDataKey(options: CreateDataKeyOptions): Promise<DataKeyPair> {\n    const { data } = await this.workos.post<CreateDataKeyResponse>(\n      `/vault/v1/keys/data-key`,\n      options,\n    );\n    return deserializeCreateDataKeyResponse(data);\n  }\n\n  async decryptDataKey(options: DecryptDataKeyOptions): Promise<DataKey> {\n    const { data } = await this.workos.post<DecryptDataKeyResponse>(\n      `/vault/v1/keys/decrypt`,\n      options,\n    );\n    return deserializeDecryptDataKeyResponse(data);\n  }\n\n  async encrypt(\n    data: string,\n    context: KeyContext,\n    associatedData?: string,\n  ): Promise<string> {\n    const keyPair = await this.createDataKey({\n      context,\n    });\n\n    // Convert base64 key to Uint8Array\n    const encoder = new TextEncoder();\n\n    // Use our cross-runtime base64 utility\n    const key = base64ToUint8Array(keyPair.dataKey.key);\n    const keyBlob = base64ToUint8Array(keyPair.encryptedKeys);\n\n    const prefixLenBuffer = encodeUInt32(keyBlob.length);\n    const aadBuffer = associatedData\n      ? encoder.encode(associatedData)\n      : undefined;\n\n    // Use a 12-byte IV for AES-GCM (industry standard)\n    const iv = this.cryptoProvider.randomBytes(12);\n\n    const {\n      ciphertext,\n      iv: resultIv,\n      tag,\n    } = await this.cryptoProvider.encrypt(\n      encoder.encode(data),\n      key,\n      iv,\n      aadBuffer,\n    );\n\n    // Concatenate all parts into a single array\n    const resultArray = new Uint8Array(\n      resultIv.length +\n        tag.length +\n        prefixLenBuffer.length +\n        keyBlob.length +\n        ciphertext.length,\n    );\n\n    let offset = 0;\n    resultArray.set(resultIv, offset);\n    offset += resultIv.length;\n\n    resultArray.set(tag, offset);\n    offset += tag.length;\n\n    resultArray.set(new Uint8Array(prefixLenBuffer), offset);\n    offset += prefixLenBuffer.length;\n\n    resultArray.set(keyBlob, offset);\n    offset += keyBlob.length;\n\n    resultArray.set(ciphertext, offset);\n\n    // Convert to base64 using our cross-runtime utility\n    return uint8ArrayToBase64(resultArray);\n  }\n\n  async decrypt(\n    encryptedData: string,\n    associatedData?: string,\n  ): Promise<string> {\n    const decoded = this.decode(encryptedData);\n    const dataKey = await this.decryptDataKey({ keys: decoded.keys });\n\n    // Convert base64 key to Uint8Array using our cross-runtime utility\n    const key = base64ToUint8Array(dataKey.key);\n\n    const encoder = new TextEncoder();\n    const aadBuffer = associatedData\n      ? encoder.encode(associatedData)\n      : undefined;\n\n    const decrypted = await this.cryptoProvider.decrypt(\n      decoded.ciphertext,\n      key,\n      decoded.iv,\n      decoded.tag,\n      aadBuffer,\n    );\n\n    return new TextDecoder().decode(decrypted);\n  }\n}\n"],"mappings":";;AAAA,SAAS,cAAc,oBAAoB;AAI3C,SAAS,oBAAoB,0BAA0B;AAuBvD;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AASA,MAAM,MAAM;AAAA,EAGjB,YAA6B,QAAgB;AAAhB;AAC3B,SAAK,iBAAiB,OAAO,kBAAkB;AAAA,EACjD;AAAA,EApDF,OA+CmB;AAAA;AAAA;AAAA,EAOT,OAAO,SAA0B;AACvC,UAAM,YAAY,mBAAmB,OAAO;AAE5C,UAAM,KAAK,IAAI,WAAW,UAAU,SAAS,GAAG,EAAE,CAAC;AACnD,UAAM,MAAM,IAAI,WAAW,UAAU,SAAS,IAAI,EAAE,CAAC;AACrD,UAAM,EAAE,OAAO,QAAQ,UAAU,IAAI,aAAa,WAAW,EAAE;AAG/D,UAAM,aAAa,UAAU,SAAS,WAAW,YAAY,MAAM;AACnE,UAAM,OAAO,mBAAmB,UAAU;AAE1C,UAAM,aAAa,IAAI,WAAW,UAAU,SAAS,YAAY,MAAM,CAAC;AAExE,WAAO;AAAA,MACL;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,aAAa,SAAuD;AACxE,UAAM,EAAE,KAAK,IAAI,MAAM,KAAK,OAAO;AAAA,MACjC;AAAA,MACA,4BAA4B,OAAO;AAAA,IACrC;AACA,WAAO,0BAA0B,IAAI;AAAA,EACvC;AAAA,EAEA,MAAM,YACJ,SAC6B;AAC7B,UAAM,MAAM,IAAI,IAAI,gBAAgB,KAAK,OAAO,OAAO;AACvD,QAAI,SAAS,OAAO;AAClB,UAAI,aAAa,IAAI,SAAS,QAAQ,KAAK;AAAA,IAC7C;AACA,QAAI,SAAS,OAAO;AAClB,UAAI,aAAa,IAAI,SAAS,QAAQ,MAAM,SAAS,CAAC;AAAA,IACxD;AAEA,UAAM,EAAE,KAAK,IAAI,MAAM,KAAK,OAAO;AAAA,MACjC,IAAI,SAAS;AAAA,IACf;AACA,WAAO,uBAAuB,IAAI;AAAA,EACpC;AAAA,EAEA,MAAM,mBACJ,SAC0B;AAC1B,UAAM,EAAE,KAAK,IAAI,MAAM,KAAK,OAAO;AAAA,MACjC,gBAAgB,mBAAmB,QAAQ,EAAE,CAAC;AAAA,IAChD;AACA,WAAO,6BAA6B,IAAI;AAAA,EAC1C;AAAA,EAEA,MAAM,WAAW,SAAkD;AACjE,UAAM,EAAE,KAAK,IAAI,MAAM,KAAK,OAAO;AAAA,MACjC,gBAAgB,mBAAmB,QAAQ,EAAE,CAAC;AAAA,IAChD;AACA,WAAO,kBAAkB,IAAI;AAAA,EAC/B;AAAA,EAEA,MAAM,eAAe,SAAkD;AACrE,UAAM,EAAE,KAAK,IAAI,MAAM,KAAK,OAAO;AAAA,MACjC,gBAAgB,mBAAmB,QAAQ,EAAE,CAAC;AAAA,IAChD;AACA,WAAO,kBAAkB,IAAI;AAAA,EAC/B;AAAA,EAEA,MAAM,aAAa,SAAoD;AACrE,UAAM,EAAE,KAAK,IAAI,MAAM,KAAK,OAAO;AAAA,MACjC,gBAAgB,mBAAmB,QAAQ,EAAE,CAAC;AAAA,MAC9C,4BAA4B,OAAO;AAAA,IACrC;AACA,WAAO,kBAAkB,IAAI;AAAA,EAC/B;AAAA,EAEA,MAAM,aAAa,SAA6C;AAC9D,WAAO,KAAK,OAAO,OAAO,gBAAgB,mBAAmB,QAAQ,EAAE,CAAC,EAAE;AAAA,EAC5E;AAAA,EAEA,MAAM,cAAc,SAAqD;AACvE,UAAM,EAAE,KAAK,IAAI,MAAM,KAAK,OAAO;AAAA,MACjC;AAAA,MACA;AAAA,IACF;AACA,WAAO,iCAAiC,IAAI;AAAA,EAC9C;AAAA,EAEA,MAAM,eAAe,SAAkD;AACrE,UAAM,EAAE,KAAK,IAAI,MAAM,KAAK,OAAO;AAAA,MACjC;AAAA,MACA;AAAA,IACF;AACA,WAAO,kCAAkC,IAAI;AAAA,EAC/C;AAAA,EAEA,MAAM,QACJ,MACA,SACA,gBACiB;AACjB,UAAM,UAAU,MAAM,KAAK,cAAc;AAAA,MACvC;AAAA,IACF,CAAC;AAGD,UAAM,UAAU,IAAI,YAAY;AAGhC,UAAM,MAAM,mBAAmB,QAAQ,QAAQ,GAAG;AAClD,UAAM,UAAU,mBAAmB,QAAQ,aAAa;AAExD,UAAM,kBAAkB,aAAa,QAAQ,MAAM;AACnD,UAAM,YAAY,iBACd,QAAQ,OAAO,cAAc,IAC7B;AAGJ,UAAM,KAAK,KAAK,eAAe,YAAY,EAAE;AAE7C,UAAM;AAAA,MACJ;AAAA,MACA,IAAI;AAAA,MACJ;AAAA,IACF,IAAI,MAAM,KAAK,eAAe;AAAA,MAC5B,QAAQ,OAAO,IAAI;AAAA,MACnB;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAGA,UAAM,cAAc,IAAI;AAAA,MACtB,SAAS,SACP,IAAI,SACJ,gBAAgB,SAChB,QAAQ,SACR,WAAW;AAAA,IACf;AAEA,QAAI,SAAS;AACb,gBAAY,IAAI,UAAU,MAAM;AAChC,cAAU,SAAS;AAEnB,gBAAY,IAAI,KAAK,MAAM;AAC3B,cAAU,IAAI;AAEd,gBAAY,IAAI,IAAI,WAAW,eAAe,GAAG,MAAM;AACvD,cAAU,gBAAgB;AAE1B,gBAAY,IAAI,SAAS,MAAM;AAC/B,cAAU,QAAQ;AAElB,gBAAY,IAAI,YAAY,MAAM;AAGlC,WAAO,mBAAmB,WAAW;AAAA,EACvC;AAAA,EAEA,MAAM,QACJ,eACA,gBACiB;AACjB,UAAM,UAAU,KAAK,OAAO,aAAa;AACzC,UAAM,UAAU,MAAM,KAAK,eAAe,EAAE,MAAM,QAAQ,KAAK,CAAC;AAGhE,UAAM,MAAM,mBAAmB,QAAQ,GAAG;AAE1C,UAAM,UAAU,IAAI,YAAY;AAChC,UAAM,YAAY,iBACd,QAAQ,OAAO,cAAc,IAC7B;AAEJ,UAAM,YAAY,MAAM,KAAK,eAAe;AAAA,MAC1C,QAAQ;AAAA,MACR;AAAA,MACA,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR;AAAA,IACF;AAEA,WAAO,IAAI,YAAY,EAAE,OAAO,SAAS;AAAA,EAC3C;AACF;","names":[]}
+{"version":3,"sources":["../../src/vault/vault.ts"],"sourcesContent":["import { decodeUInt32, encodeUInt32 } from 'leb';\nimport { CryptoProvider } from '../common/crypto/crypto-provider';\nimport { List, ListResponse } from '../common/interfaces';\nimport { PaginationOptions } from '../index.worker';\nimport { base64ToUint8Array, uint8ArrayToBase64 } from '../common/utils/base64';\nimport type { WorkOS } from '../workos';\nimport {\n  CreateDataKeyOptions,\n  CreateDataKeyResponse,\n  CreateObjectOptions,\n  DataKey,\n  DataKeyPair,\n  DecryptDataKeyOptions,\n  DecryptDataKeyResponse,\n  DeleteObjectOptions,\n  KeyContext,\n  ListObjectVersionsResponse,\n  ObjectDigest,\n  ObjectDigestResponse,\n  ObjectMetadata,\n  ObjectVersion,\n  ReadObjectMetadataResponse,\n  ReadObjectOptions,\n  ReadObjectResponse,\n  UpdateObjectOptions,\n  VaultObject,\n} from './interfaces';\nimport {\n  deserializeCreateDataKeyResponse,\n  deserializeDecryptDataKeyResponse,\n} from './serializers/vault-key.serializer';\nimport {\n  deserializeListObjects,\n  deserializeObject,\n  deserializeObjectMetadata,\n  desrializeListObjectVersions,\n  serializeCreateObjectEntity,\n  serializeUpdateObjectEntity,\n} from './serializers/vault-object.serializer';\n\ninterface Decoded {\n  iv: Uint8Array;\n  tag: Uint8Array;\n  keys: string;\n  ciphertext: Uint8Array;\n}\n\nexport class Vault {\n  private cryptoProvider: CryptoProvider;\n\n  constructor(private readonly workos: WorkOS) {\n    this.cryptoProvider = workos.getCryptoProvider();\n  }\n\n  private decode(payload: string): Decoded {\n    const inputData = base64ToUint8Array(payload);\n    // Use 12 bytes for IV (standard for AES-GCM)\n    const iv = new Uint8Array(inputData.subarray(0, 12));\n    const tag = new Uint8Array(inputData.subarray(12, 28));\n    const { value: keyLen, nextIndex } = decodeUInt32(inputData, 28);\n\n    // Use subarray instead of slice and convert directly to base64\n    const keysBuffer = inputData.subarray(nextIndex, nextIndex + keyLen);\n    const keys = uint8ArrayToBase64(keysBuffer);\n\n    const ciphertext = new Uint8Array(inputData.subarray(nextIndex + keyLen));\n\n    return {\n      iv,\n      tag,\n      keys,\n      ciphertext,\n    };\n  }\n\n  async createObject(options: CreateObjectOptions): Promise<ObjectMetadata> {\n    const { data } = await this.workos.post<ReadObjectMetadataResponse>(\n      `/vault/v1/kv`,\n      serializeCreateObjectEntity(options),\n    );\n    return deserializeObjectMetadata(data);\n  }\n\n  async listObjects(\n    options?: PaginationOptions | undefined,\n  ): Promise<List<ObjectDigest>> {\n    const url = new URL('/vault/v1/kv', this.workos.baseURL);\n    if (options?.after) {\n      url.searchParams.set('after', options.after);\n    }\n    if (options?.limit) {\n      url.searchParams.set('limit', options.limit.toString());\n    }\n\n    const { data } = await this.workos.get<ListResponse<ObjectDigestResponse>>(\n      url.toString(),\n    );\n    return deserializeListObjects(data);\n  }\n\n  async listObjectVersions(\n    options: ReadObjectOptions,\n  ): Promise<ObjectVersion[]> {\n    const { data } = await this.workos.get<ListObjectVersionsResponse>(\n      `/vault/v1/kv/${encodeURIComponent(options.id)}/versions`,\n    );\n    return desrializeListObjectVersions(data);\n  }\n\n  async readObject(options: ReadObjectOptions): Promise<VaultObject> {\n    const { data } = await this.workos.get<ReadObjectResponse>(\n      `/vault/v1/kv/${encodeURIComponent(options.id)}`,\n    );\n    return deserializeObject(data);\n  }\n\n  async describeObject(options: ReadObjectOptions): Promise<VaultObject> {\n    const { data } = await this.workos.get<ReadObjectResponse>(\n      `/vault/v1/kv/${encodeURIComponent(options.id)}/metadata`,\n    );\n    return deserializeObject(data);\n  }\n\n  async updateObject(options: UpdateObjectOptions): Promise<VaultObject> {\n    const { data } = await this.workos.put<ReadObjectResponse>(\n      `/vault/v1/kv/${encodeURIComponent(options.id)}`,\n      serializeUpdateObjectEntity(options),\n    );\n    return deserializeObject(data);\n  }\n\n  async deleteObject(options: DeleteObjectOptions): Promise<void> {\n    return this.workos.delete(`/vault/v1/kv/${encodeURIComponent(options.id)}`);\n  }\n\n  async createDataKey(options: CreateDataKeyOptions): Promise<DataKeyPair> {\n    const { data } = await this.workos.post<CreateDataKeyResponse>(\n      `/vault/v1/keys/data-key`,\n      options,\n    );\n    return deserializeCreateDataKeyResponse(data);\n  }\n\n  async decryptDataKey(options: DecryptDataKeyOptions): Promise<DataKey> {\n    const { data } = await this.workos.post<DecryptDataKeyResponse>(\n      `/vault/v1/keys/decrypt`,\n      options,\n    );\n    return deserializeDecryptDataKeyResponse(data);\n  }\n\n  async encrypt(\n    data: string,\n    context: KeyContext,\n    associatedData?: string,\n  ): Promise<string> {\n    const keyPair = await this.createDataKey({\n      context,\n    });\n\n    // Convert base64 key to Uint8Array\n    const encoder = new TextEncoder();\n\n    // Use our cross-runtime base64 utility\n    const key = base64ToUint8Array(keyPair.dataKey.key);\n    const keyBlob = base64ToUint8Array(keyPair.encryptedKeys);\n\n    const prefixLenBuffer = encodeUInt32(keyBlob.length);\n    const aadBuffer = associatedData\n      ? encoder.encode(associatedData)\n      : undefined;\n\n    // Use a 12-byte IV for AES-GCM (industry standard)\n    const iv = this.cryptoProvider.randomBytes(12);\n\n    const {\n      ciphertext,\n      iv: resultIv,\n      tag,\n    } = await this.cryptoProvider.encrypt(\n      encoder.encode(data),\n      key,\n      iv,\n      aadBuffer,\n    );\n\n    // Concatenate all parts into a single array\n    const resultArray = new Uint8Array(\n      resultIv.length +\n        tag.length +\n        prefixLenBuffer.length +\n        keyBlob.length +\n        ciphertext.length,\n    );\n\n    let offset = 0;\n    resultArray.set(resultIv, offset);\n    offset += resultIv.length;\n\n    resultArray.set(tag, offset);\n    offset += tag.length;\n\n    resultArray.set(new Uint8Array(prefixLenBuffer), offset);\n    offset += prefixLenBuffer.length;\n\n    resultArray.set(keyBlob, offset);\n    offset += keyBlob.length;\n\n    resultArray.set(ciphertext, offset);\n\n    // Convert to base64 using our cross-runtime utility\n    return uint8ArrayToBase64(resultArray);\n  }\n\n  async decrypt(\n    encryptedData: string,\n    associatedData?: string,\n  ): Promise<string> {\n    const decoded = this.decode(encryptedData);\n    const dataKey = await this.decryptDataKey({ keys: decoded.keys });\n\n    // Convert base64 key to Uint8Array using our cross-runtime utility\n    const key = base64ToUint8Array(dataKey.key);\n\n    const encoder = new TextEncoder();\n    const aadBuffer = associatedData\n      ? encoder.encode(associatedData)\n      : undefined;\n\n    const decrypted = await this.cryptoProvider.decrypt(\n      decoded.ciphertext,\n      key,\n      decoded.iv,\n      decoded.tag,\n      aadBuffer,\n    );\n\n    return new TextDecoder().decode(decrypted);\n  }\n}\n"],"mappings":";;AAAA,SAAS,cAAc,oBAAoB;AAI3C,SAAS,oBAAoB,0BAA0B;AAuBvD;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AASA,MAAM,MAAM;AAAA,EAGjB,YAA6B,QAAgB;AAAhB;AAC3B,SAAK,iBAAiB,OAAO,kBAAkB;AAAA,EACjD;AAAA,EApDF,OA+CmB;AAAA;AAAA;AAAA,EACT;AAAA,EAMA,OAAO,SAA0B;AACvC,UAAM,YAAY,mBAAmB,OAAO;AAE5C,UAAM,KAAK,IAAI,WAAW,UAAU,SAAS,GAAG,EAAE,CAAC;AACnD,UAAM,MAAM,IAAI,WAAW,UAAU,SAAS,IAAI,EAAE,CAAC;AACrD,UAAM,EAAE,OAAO,QAAQ,UAAU,IAAI,aAAa,WAAW,EAAE;AAG/D,UAAM,aAAa,UAAU,SAAS,WAAW,YAAY,MAAM;AACnE,UAAM,OAAO,mBAAmB,UAAU;AAE1C,UAAM,aAAa,IAAI,WAAW,UAAU,SAAS,YAAY,MAAM,CAAC;AAExE,WAAO;AAAA,MACL;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,aAAa,SAAuD;AACxE,UAAM,EAAE,KAAK,IAAI,MAAM,KAAK,OAAO;AAAA,MACjC;AAAA,MACA,4BAA4B,OAAO;AAAA,IACrC;AACA,WAAO,0BAA0B,IAAI;AAAA,EACvC;AAAA,EAEA,MAAM,YACJ,SAC6B;AAC7B,UAAM,MAAM,IAAI,IAAI,gBAAgB,KAAK,OAAO,OAAO;AACvD,QAAI,SAAS,OAAO;AAClB,UAAI,aAAa,IAAI,SAAS,QAAQ,KAAK;AAAA,IAC7C;AACA,QAAI,SAAS,OAAO;AAClB,UAAI,aAAa,IAAI,SAAS,QAAQ,MAAM,SAAS,CAAC;AAAA,IACxD;AAEA,UAAM,EAAE,KAAK,IAAI,MAAM,KAAK,OAAO;AAAA,MACjC,IAAI,SAAS;AAAA,IACf;AACA,WAAO,uBAAuB,IAAI;AAAA,EACpC;AAAA,EAEA,MAAM,mBACJ,SAC0B;AAC1B,UAAM,EAAE,KAAK,IAAI,MAAM,KAAK,OAAO;AAAA,MACjC,gBAAgB,mBAAmB,QAAQ,EAAE,CAAC;AAAA,IAChD;AACA,WAAO,6BAA6B,IAAI;AAAA,EAC1C;AAAA,EAEA,MAAM,WAAW,SAAkD;AACjE,UAAM,EAAE,KAAK,IAAI,MAAM,KAAK,OAAO;AAAA,MACjC,gBAAgB,mBAAmB,QAAQ,EAAE,CAAC;AAAA,IAChD;AACA,WAAO,kBAAkB,IAAI;AAAA,EAC/B;AAAA,EAEA,MAAM,eAAe,SAAkD;AACrE,UAAM,EAAE,KAAK,IAAI,MAAM,KAAK,OAAO;AAAA,MACjC,gBAAgB,mBAAmB,QAAQ,EAAE,CAAC;AAAA,IAChD;AACA,WAAO,kBAAkB,IAAI;AAAA,EAC/B;AAAA,EAEA,MAAM,aAAa,SAAoD;AACrE,UAAM,EAAE,KAAK,IAAI,MAAM,KAAK,OAAO;AAAA,MACjC,gBAAgB,mBAAmB,QAAQ,EAAE,CAAC;AAAA,MAC9C,4BAA4B,OAAO;AAAA,IACrC;AACA,WAAO,kBAAkB,IAAI;AAAA,EAC/B;AAAA,EAEA,MAAM,aAAa,SAA6C;AAC9D,WAAO,KAAK,OAAO,OAAO,gBAAgB,mBAAmB,QAAQ,EAAE,CAAC,EAAE;AAAA,EAC5E;AAAA,EAEA,MAAM,cAAc,SAAqD;AACvE,UAAM,EAAE,KAAK,IAAI,MAAM,KAAK,OAAO;AAAA,MACjC;AAAA,MACA;AAAA,IACF;AACA,WAAO,iCAAiC,IAAI;AAAA,EAC9C;AAAA,EAEA,MAAM,eAAe,SAAkD;AACrE,UAAM,EAAE,KAAK,IAAI,MAAM,KAAK,OAAO;AAAA,MACjC;AAAA,MACA;AAAA,IACF;AACA,WAAO,kCAAkC,IAAI;AAAA,EAC/C;AAAA,EAEA,MAAM,QACJ,MACA,SACA,gBACiB;AACjB,UAAM,UAAU,MAAM,KAAK,cAAc;AAAA,MACvC;AAAA,IACF,CAAC;AAGD,UAAM,UAAU,IAAI,YAAY;AAGhC,UAAM,MAAM,mBAAmB,QAAQ,QAAQ,GAAG;AAClD,UAAM,UAAU,mBAAmB,QAAQ,aAAa;AAExD,UAAM,kBAAkB,aAAa,QAAQ,MAAM;AACnD,UAAM,YAAY,iBACd,QAAQ,OAAO,cAAc,IAC7B;AAGJ,UAAM,KAAK,KAAK,eAAe,YAAY,EAAE;AAE7C,UAAM;AAAA,MACJ;AAAA,MACA,IAAI;AAAA,MACJ;AAAA,IACF,IAAI,MAAM,KAAK,eAAe;AAAA,MAC5B,QAAQ,OAAO,IAAI;AAAA,MACnB;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAGA,UAAM,cAAc,IAAI;AAAA,MACtB,SAAS,SACP,IAAI,SACJ,gBAAgB,SAChB,QAAQ,SACR,WAAW;AAAA,IACf;AAEA,QAAI,SAAS;AACb,gBAAY,IAAI,UAAU,MAAM;AAChC,cAAU,SAAS;AAEnB,gBAAY,IAAI,KAAK,MAAM;AAC3B,cAAU,IAAI;AAEd,gBAAY,IAAI,IAAI,WAAW,eAAe,GAAG,MAAM;AACvD,cAAU,gBAAgB;AAE1B,gBAAY,IAAI,SAAS,MAAM;AAC/B,cAAU,QAAQ;AAElB,gBAAY,IAAI,YAAY,MAAM;AAGlC,WAAO,mBAAmB,WAAW;AAAA,EACvC;AAAA,EAEA,MAAM,QACJ,eACA,gBACiB;AACjB,UAAM,UAAU,KAAK,OAAO,aAAa;AACzC,UAAM,UAAU,MAAM,KAAK,eAAe,EAAE,MAAM,QAAQ,KAAK,CAAC;AAGhE,UAAM,MAAM,mBAAmB,QAAQ,GAAG;AAE1C,UAAM,UAAU,IAAI,YAAY;AAChC,UAAM,YAAY,iBACd,QAAQ,OAAO,cAAc,IAC7B;AAEJ,UAAM,YAAY,MAAM,KAAK,eAAe;AAAA,MAC1C,QAAQ;AAAA,MACR;AAAA,MACA,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR;AAAA,IACF;AAEA,WAAO,IAAI,YAAY,EAAE,OAAO,SAAS;AAAA,EAC3C;AACF;","names":[]}

package/lib/vault/vault.spec.d.ts

@@ -0,0 +1 @@
+export {};

package/lib/vault/vault.spec.js

@@ -0,0 +1,286 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const jest_fetch_mock_1 = __importDefault(require("jest-fetch-mock"));
+const test_utils_1 = require("../common/utils/test-utils");
+const workos_1 = require("../workos");
+const conflict_exception_1 = require("../common/exceptions/conflict.exception");
+const workos = new workos_1.WorkOS('sk_test_Sz3IQjepeSWaI4cMS4ms4sMuU');
+describe('Vault', () => {
+    beforeEach(() => jest_fetch_mock_1.default.resetMocks());
+    describe('createSecret', () => {
+        it('creates secret', () => __awaiter(void 0, void 0, void 0, function* () {
+            const secretName = 'charger';
+            (0, test_utils_1.fetchOnce)({
+                id: 's1',
+                context: {
+                    type: 'spore',
+                },
+                environment_id: 'xxx',
+                key_id: 'k1',
+                updated_at: '2029-03-17T04:37:46.748303Z',
+                updated_by: {
+                    id: 'key_xxx',
+                    name: 'Local Test Key',
+                },
+                version_id: 'v1',
+            });
+            const resource = yield workos.vault.createSecret({
+                name: secretName,
+                context: { type: 'spore' },
+                value: 'Full speed ahead',
+            });
+            expect((0, test_utils_1.fetchURL)()).toContain(`/vault/v1/kv`);
+            expect((0, test_utils_1.fetchMethod)()).toBe('POST');
+            expect(resource).toStrictEqual({
+                id: 's1',
+                context: {
+                    type: 'spore',
+                },
+                environmentId: 'xxx',
+                keyId: 'k1',
+                updatedAt: new Date(Date.parse('2029-03-17T04:37:46.748303Z')),
+                updatedBy: {
+                    id: 'key_xxx',
+                    name: 'Local Test Key',
+                },
+                versionId: 'v1',
+            });
+        }));
+        it('throws an error if secret exists', () => __awaiter(void 0, void 0, void 0, function* () {
+            const secretName = 'charger';
+            (0, test_utils_1.fetchOnce)({
+                error: 'Item already exists',
+            }, { status: 409 });
+            yield expect(workos.vault.createSecret({
+                name: secretName,
+                context: { type: 'spore' },
+                value: 'Full speed ahead',
+            })).rejects.toThrow(conflict_exception_1.ConflictException);
+            expect((0, test_utils_1.fetchURL)()).toContain(`/vault/v1/kv`);
+            expect((0, test_utils_1.fetchMethod)()).toBe('POST');
+        }));
+    });
+    describe('readSecret', () => {
+        it('reads a secret by id', () => __awaiter(void 0, void 0, void 0, function* () {
+            const secretName = 'lima';
+            const secretId = 'secret1';
+            (0, test_utils_1.fetchOnce)({
+                id: secretId,
+                metadata: {
+                    id: secretId,
+                    context: {
+                        emporer: 'groove',
+                    },
+                    environment_id: 'environment_d',
+                    key_id: 'key1',
+                    updated_at: '2025-03-11T02:18:54.250931Z',
+                    updated_by: {
+                        id: 'key_xxx',
+                        name: 'Local Test Key',
+                    },
+                    version_id: 'version1',
+                },
+                name: secretName,
+                value: 'Pull the lever Gronk',
+            });
+            const resource = yield workos.vault.readSecret({
+                id: secretId,
+            });
+            expect((0, test_utils_1.fetchURL)()).toContain(`/vault/v1/kv/${secretId}`);
+            expect((0, test_utils_1.fetchMethod)()).toBe('GET');
+            expect(resource).toStrictEqual({
+                id: secretId,
+                metadata: {
+                    id: secretId,
+                    context: {
+                        emporer: 'groove',
+                    },
+                    environmentId: 'environment_d',
+                    keyId: 'key1',
+                    updatedAt: new Date(Date.parse('2025-03-11T02:18:54.250931Z')),
+                    updatedBy: {
+                        id: 'key_xxx',
+                        name: 'Local Test Key',
+                    },
+                    versionId: 'version1',
+                },
+                name: secretName,
+                value: 'Pull the lever Gronk',
+            });
+        }));
+    });
+    describe('listSecrets', () => {
+        it('gets a paginated list of secrets', () => __awaiter(void 0, void 0, void 0, function* () {
+            (0, test_utils_1.fetchOnce)({
+                data: [
+                    {
+                        id: 's1',
+                        name: 'charger',
+                        updated_at: '2029-03-17T04:37:46.748303Z',
+                    },
+                ],
+                list_metadata: {
+                    after: null,
+                    before: 'charger',
+                },
+            });
+            const resource = yield workos.vault.listSecrets();
+            expect((0, test_utils_1.fetchURL)()).toContain(`/vault/v1/kv`);
+            expect((0, test_utils_1.fetchMethod)()).toBe('GET');
+            expect(resource).toStrictEqual({
+                object: 'list',
+                data: [
+                    {
+                        id: 's1',
+                        name: 'charger',
+                        updatedAt: new Date(Date.parse('2029-03-17T04:37:46.748303Z')),
+                    },
+                ],
+                listMetadata: {
+                    after: undefined,
+                    before: 'charger',
+                },
+            });
+        }));
+    });
+    describe('listSecretVersions', () => {
+        it('gets a paginated list of secret versions', () => __awaiter(void 0, void 0, void 0, function* () {
+            (0, test_utils_1.fetchOnce)({
+                data: [
+                    {
+                        id: 'raZUqoHteQkLihH6AG5bj6sYAqMcJS76',
+                        size: 270,
+                        etag: '"5147c963627323edcb15910ceea573bf"',
+                        created_at: '2029-03-17T15:51:57.000000Z',
+                        current_version: true,
+                    },
+                ],
+                list_metadata: {
+                    after: null,
+                    before: 'raZUqoHteQkLihH6AG5bj6sYAqMcJS76',
+                },
+            });
+            const resource = yield workos.vault.listSecretVersions({ id: 'secret1' });
+            expect((0, test_utils_1.fetchURL)()).toContain(`/vault/v1/kv/secret1/versions`);
+            expect((0, test_utils_1.fetchMethod)()).toBe('GET');
+            expect(resource).toStrictEqual([
+                {
+                    createdAt: new Date(Date.parse('2029-03-17T15:51:57.000000Z')),
+                    currentVersion: true,
+                    id: 'raZUqoHteQkLihH6AG5bj6sYAqMcJS76',
+                },
+            ]);
+        }));
+    });
+    describe('updateSecret', () => {
+        it('updates secret', () => __awaiter(void 0, void 0, void 0, function* () {
+            const secretId = 's1';
+            (0, test_utils_1.fetchOnce)({
+                id: secretId,
+                name: 'charger',
+                metadata: {
+                    id: secretId,
+                    context: {
+                        type: 'spore',
+                    },
+                    environment_id: 'xxx',
+                    key_id: 'k1',
+                    updated_at: '2029-03-17T04:37:46.748303Z',
+                    updated_by: {
+                        id: 'key_xxx',
+                        name: 'Local Test Key',
+                    },
+                    version_id: 'v1',
+                },
+            });
+            const resource = yield workos.vault.updateSecret({
+                id: secretId,
+                value: 'Full speed ahead',
+            });
+            expect((0, test_utils_1.fetchURL)()).toContain(`/vault/v1/kv/${secretId}`);
+            expect((0, test_utils_1.fetchMethod)()).toBe('PUT');
+            expect(resource).toStrictEqual({
+                id: secretId,
+                name: 'charger',
+                metadata: {
+                    id: secretId,
+                    context: {
+                        type: 'spore',
+                    },
+                    environmentId: 'xxx',
+                    keyId: 'k1',
+                    updatedAt: new Date(Date.parse('2029-03-17T04:37:46.748303Z')),
+                    updatedBy: {
+                        id: 'key_xxx',
+                        name: 'Local Test Key',
+                    },
+                    versionId: 'v1',
+                },
+                value: undefined,
+            });
+        }));
+        it('throws an error if secret version check fails', () => __awaiter(void 0, void 0, void 0, function* () {
+            (0, test_utils_1.fetchOnce)({
+                error: 'Item already exists',
+            }, { status: 409 });
+            yield expect(workos.vault.updateSecret({
+                id: 'secret1',
+                value: 'Full speed ahead',
+                versionCheck: 'notaversion',
+            })).rejects.toThrow(conflict_exception_1.ConflictException);
+            expect((0, test_utils_1.fetchURL)()).toContain(`/vault/v1/kv/secret1`);
+            expect((0, test_utils_1.fetchMethod)()).toBe('PUT');
+        }));
+    });
+    describe('encrypt and decrypt', () => {
+        it('correctly encrypts and decrypts data', () => __awaiter(void 0, void 0, void 0, function* () {
+            // Generate a valid 32-byte (256-bit) key for AES-256-GCM
+            const validKey = Buffer.alloc(32).fill('A').toString('base64');
+            // Mock createDataKey to return a valid key for testing
+            (0, test_utils_1.fetchOnce)({
+                data_key: validKey,
+                encrypted_keys: 'ZW5jcnlwdGVkX2tleXM=',
+                id: 'key123',
+                context: { type: 'test' },
+            });
+            // Mock decryptDataKey to return same key
+            (0, test_utils_1.fetchOnce)({
+                data_key: validKey,
+                id: 'key123',
+            });
+            const originalText = 'This is a secret message';
+            const context = { type: 'test' };
+            const associatedData = 'additional-auth-data';
+            // Encrypt the data
+            const encrypted = yield workos.vault.encrypt(originalText, context, associatedData);
+            // Verify encrypt API call
+            expect((0, test_utils_1.fetchURL)()).toContain('/vault/v1/keys/data-key');
+            expect((0, test_utils_1.fetchMethod)()).toBe('POST');
+            // Reset fetch for the decrypt call
+            jest_fetch_mock_1.default.resetMocks();
+            (0, test_utils_1.fetchOnce)({
+                data_key: validKey,
+                id: 'key123',
+            });
+            // Decrypt the data
+            const decrypted = yield workos.vault.decrypt(encrypted, associatedData);
+            // Verify decrypt API call
+            expect((0, test_utils_1.fetchURL)()).toContain('/vault/v1/keys/decrypt');
+            expect((0, test_utils_1.fetchMethod)()).toBe('POST');
+            // Verify the decrypted text matches the original
+            expect(decrypted).toBe(originalText);
+        }));
+    });
+});