@workos-inc/node 8.0.0-rc.1 → 8.0.0-rc.3

package/lib/cjs/mfa/mfa.d.cts

@@ -1,4 +1,4 @@
-export { M as Mfa } from '../workos-BcNRiAbw.cjs';
+export { M as Mfa } from '../workos-X1cDErJB.cjs';
 import './interfaces/challenge-factor-options.cjs';
 import './interfaces/challenge.interface.cjs';
 import './interfaces/enroll-factor-options.cjs';
@@ -10,12 +10,18 @@ import '../common/interfaces/post-options.interface.cjs';
 import '../common/interfaces/put-options.interface.cjs';
 import '../common/interfaces/workos-options.interface.cjs';
 import '../common/interfaces/app-info.interface.cjs';
-import '../events/interfaces/list-events-options.interface.cjs';
-import '../common/interfaces/event.interface.cjs';
+import '../common/utils/pagination.cjs';
+import '../common/interfaces/pagination-options.interface.cjs';
+import '../common/interfaces/list.interface.cjs';
 import '../directory-sync/interfaces/directory.interface.cjs';
 import '../directory-sync/interfaces/directory-group.interface.cjs';
+import '../directory-sync/interfaces/list-directories-options.interface.cjs';
+import '../directory-sync/interfaces/list-groups-options.interface.cjs';
+import '../directory-sync/interfaces/list-directory-users-options.interface.cjs';
 import '../directory-sync/interfaces/directory-user.interface.cjs';
 import '../roles/interfaces/role.interface.cjs';
+import '../events/interfaces/list-events-options.interface.cjs';
+import '../common/interfaces/event.interface.cjs';
 import '../organizations/interfaces/organization.interface.cjs';
 import '../organization-domains/interfaces/organization-domain.interface.cjs';
 import '../sso/interfaces/connection.interface.cjs';
@@ -30,9 +36,6 @@ import '../user-management/interfaces/magic-auth.interface.cjs';
 import '../user-management/interfaces/password-reset.interface.cjs';
 import '../user-management/interfaces/session.interface.cjs';
 import '../user-management/interfaces/impersonator.interface.cjs';
-import '../common/interfaces/list.interface.cjs';
-import '../common/utils/pagination.cjs';
-import '../common/interfaces/pagination-options.interface.cjs';
 import '../organizations/interfaces/create-organization-options.interface.cjs';
 import '../organizations/interfaces/domain-data.interface.cjs';
 import '../organizations/interfaces/list-organization-feature-flags-options.interface.cjs';
@@ -122,7 +125,6 @@ import '../vault/interfaces/object/delete-object.interface.cjs';
 import '../vault/interfaces/object/read-object.interface.cjs';
 import '../vault/interfaces/object.interface.cjs';
 import '../vault/interfaces/object/update-object.interface.cjs';
-import '../directory-sync/interfaces/list-directories-options.interface.cjs';
-import '../directory-sync/interfaces/list-groups-options.interface.cjs';
-import '../directory-sync/interfaces/list-directory-users-options.interface.cjs';
+import '../api-keys/interfaces/validate-api-key.interface.cjs';
+import '../api-keys/interfaces/api-key.interface.cjs';
 import './interfaces/sms.interface.cjs';

package/lib/cjs/organization-domains/organization-domains.d.cts

@@ -1,4 +1,4 @@
-export { a as OrganizationDomains } from '../workos-BcNRiAbw.cjs';
+export { a as OrganizationDomains } from '../workos-X1cDErJB.cjs';
 import './interfaces/create-organization-domain-options.interface.cjs';
 import './interfaces/organization-domain.interface.cjs';
 import '../common/interfaces/get-options.interface.cjs';
@@ -6,12 +6,18 @@ import '../common/interfaces/post-options.interface.cjs';
 import '../common/interfaces/put-options.interface.cjs';
 import '../common/interfaces/workos-options.interface.cjs';
 import '../common/interfaces/app-info.interface.cjs';
-import '../events/interfaces/list-events-options.interface.cjs';
-import '../common/interfaces/event.interface.cjs';
+import '../common/utils/pagination.cjs';
+import '../common/interfaces/pagination-options.interface.cjs';
+import '../common/interfaces/list.interface.cjs';
 import '../directory-sync/interfaces/directory.interface.cjs';
 import '../directory-sync/interfaces/directory-group.interface.cjs';
+import '../directory-sync/interfaces/list-directories-options.interface.cjs';
+import '../directory-sync/interfaces/list-groups-options.interface.cjs';
+import '../directory-sync/interfaces/list-directory-users-options.interface.cjs';
 import '../directory-sync/interfaces/directory-user.interface.cjs';
 import '../roles/interfaces/role.interface.cjs';
+import '../events/interfaces/list-events-options.interface.cjs';
+import '../common/interfaces/event.interface.cjs';
 import '../organizations/interfaces/organization.interface.cjs';
 import '../sso/interfaces/connection.interface.cjs';
 import '../sso/interfaces/connection-type.enum.cjs';
@@ -25,9 +31,6 @@ import '../user-management/interfaces/magic-auth.interface.cjs';
 import '../user-management/interfaces/password-reset.interface.cjs';
 import '../user-management/interfaces/session.interface.cjs';
 import '../user-management/interfaces/impersonator.interface.cjs';
-import '../common/interfaces/list.interface.cjs';
-import '../common/utils/pagination.cjs';
-import '../common/interfaces/pagination-options.interface.cjs';
 import '../organizations/interfaces/create-organization-options.interface.cjs';
 import '../organizations/interfaces/domain-data.interface.cjs';
 import '../organizations/interfaces/list-organization-feature-flags-options.interface.cjs';
@@ -123,6 +126,5 @@ import '../vault/interfaces/object/delete-object.interface.cjs';
 import '../vault/interfaces/object/read-object.interface.cjs';
 import '../vault/interfaces/object.interface.cjs';
 import '../vault/interfaces/object/update-object.interface.cjs';
-import '../directory-sync/interfaces/list-directories-options.interface.cjs';
-import '../directory-sync/interfaces/list-groups-options.interface.cjs';
-import '../directory-sync/interfaces/list-directory-users-options.interface.cjs';
+import '../api-keys/interfaces/validate-api-key.interface.cjs';
+import '../api-keys/interfaces/api-key.interface.cjs';

package/lib/cjs/organizations/organizations.d.cts

@@ -1,5 +1,5 @@
 import '../common/utils/pagination.cjs';
-export { O as Organizations } from '../workos-BcNRiAbw.cjs';
+export { O as Organizations } from '../workos-X1cDErJB.cjs';
 import './interfaces/create-organization-options.interface.cjs';
 import './interfaces/list-organization-feature-flags-options.interface.cjs';
 import './interfaces/list-organizations-options.interface.cjs';
@@ -15,11 +15,14 @@ import '../common/interfaces/post-options.interface.cjs';
 import '../common/interfaces/put-options.interface.cjs';
 import '../common/interfaces/workos-options.interface.cjs';
 import '../common/interfaces/app-info.interface.cjs';
-import '../events/interfaces/list-events-options.interface.cjs';
-import '../common/interfaces/event.interface.cjs';
 import '../directory-sync/interfaces/directory.interface.cjs';
 import '../directory-sync/interfaces/directory-group.interface.cjs';
+import '../directory-sync/interfaces/list-directories-options.interface.cjs';
+import '../directory-sync/interfaces/list-groups-options.interface.cjs';
+import '../directory-sync/interfaces/list-directory-users-options.interface.cjs';
 import '../directory-sync/interfaces/directory-user.interface.cjs';
+import '../events/interfaces/list-events-options.interface.cjs';
+import '../common/interfaces/event.interface.cjs';
 import '../sso/interfaces/connection.interface.cjs';
 import '../sso/interfaces/connection-type.enum.cjs';
 import '../user-management/interfaces/user.interface.cjs';
@@ -122,7 +125,6 @@ import '../vault/interfaces/object/delete-object.interface.cjs';
 import '../vault/interfaces/object/read-object.interface.cjs';
 import '../vault/interfaces/object.interface.cjs';
 import '../vault/interfaces/object/update-object.interface.cjs';
-import '../directory-sync/interfaces/list-directories-options.interface.cjs';
-import '../directory-sync/interfaces/list-groups-options.interface.cjs';
-import '../directory-sync/interfaces/list-directory-users-options.interface.cjs';
+import '../api-keys/interfaces/validate-api-key.interface.cjs';
+import '../api-keys/interfaces/api-key.interface.cjs';
 import './interfaces/domain-data.interface.cjs';

package/lib/cjs/passwordless/passwordless.d.cts

@@ -1,4 +1,4 @@
-export { P as Passwordless } from '../workos-BcNRiAbw.cjs';
+export { P as Passwordless } from '../workos-X1cDErJB.cjs';
 import './interfaces/passwordless-session.interface.cjs';
 import './interfaces/create-passwordless-session-options.interface.cjs';
 import './interfaces/send-session-response.interface.cjs';
@@ -7,12 +7,18 @@ import '../common/interfaces/post-options.interface.cjs';
 import '../common/interfaces/put-options.interface.cjs';
 import '../common/interfaces/workos-options.interface.cjs';
 import '../common/interfaces/app-info.interface.cjs';
-import '../events/interfaces/list-events-options.interface.cjs';
-import '../common/interfaces/event.interface.cjs';
+import '../common/utils/pagination.cjs';
+import '../common/interfaces/pagination-options.interface.cjs';
+import '../common/interfaces/list.interface.cjs';
 import '../directory-sync/interfaces/directory.interface.cjs';
 import '../directory-sync/interfaces/directory-group.interface.cjs';
+import '../directory-sync/interfaces/list-directories-options.interface.cjs';
+import '../directory-sync/interfaces/list-groups-options.interface.cjs';
+import '../directory-sync/interfaces/list-directory-users-options.interface.cjs';
 import '../directory-sync/interfaces/directory-user.interface.cjs';
 import '../roles/interfaces/role.interface.cjs';
+import '../events/interfaces/list-events-options.interface.cjs';
+import '../common/interfaces/event.interface.cjs';
 import '../organizations/interfaces/organization.interface.cjs';
 import '../organization-domains/interfaces/organization-domain.interface.cjs';
 import '../sso/interfaces/connection.interface.cjs';
@@ -27,9 +33,6 @@ import '../user-management/interfaces/magic-auth.interface.cjs';
 import '../user-management/interfaces/password-reset.interface.cjs';
 import '../user-management/interfaces/session.interface.cjs';
 import '../user-management/interfaces/impersonator.interface.cjs';
-import '../common/interfaces/list.interface.cjs';
-import '../common/utils/pagination.cjs';
-import '../common/interfaces/pagination-options.interface.cjs';
 import '../organizations/interfaces/create-organization-options.interface.cjs';
 import '../organizations/interfaces/domain-data.interface.cjs';
 import '../organizations/interfaces/list-organization-feature-flags-options.interface.cjs';
@@ -123,6 +126,5 @@ import '../vault/interfaces/object/delete-object.interface.cjs';
 import '../vault/interfaces/object/read-object.interface.cjs';
 import '../vault/interfaces/object.interface.cjs';
 import '../vault/interfaces/object/update-object.interface.cjs';
-import '../directory-sync/interfaces/list-directories-options.interface.cjs';
-import '../directory-sync/interfaces/list-groups-options.interface.cjs';
-import '../directory-sync/interfaces/list-directory-users-options.interface.cjs';
+import '../api-keys/interfaces/validate-api-key.interface.cjs';
+import '../api-keys/interfaces/api-key.interface.cjs';

package/lib/cjs/portal/portal.d.cts

@@ -1,16 +1,22 @@
-export { b as Portal } from '../workos-BcNRiAbw.cjs';
+export { b as Portal } from '../workos-X1cDErJB.cjs';
 import './interfaces/generate-portal-link-intent.interface.cjs';
 import '../common/interfaces/get-options.interface.cjs';
 import '../common/interfaces/post-options.interface.cjs';
 import '../common/interfaces/put-options.interface.cjs';
 import '../common/interfaces/workos-options.interface.cjs';
 import '../common/interfaces/app-info.interface.cjs';
-import '../events/interfaces/list-events-options.interface.cjs';
-import '../common/interfaces/event.interface.cjs';
+import '../common/utils/pagination.cjs';
+import '../common/interfaces/pagination-options.interface.cjs';
+import '../common/interfaces/list.interface.cjs';
 import '../directory-sync/interfaces/directory.interface.cjs';
 import '../directory-sync/interfaces/directory-group.interface.cjs';
+import '../directory-sync/interfaces/list-directories-options.interface.cjs';
+import '../directory-sync/interfaces/list-groups-options.interface.cjs';
+import '../directory-sync/interfaces/list-directory-users-options.interface.cjs';
 import '../directory-sync/interfaces/directory-user.interface.cjs';
 import '../roles/interfaces/role.interface.cjs';
+import '../events/interfaces/list-events-options.interface.cjs';
+import '../common/interfaces/event.interface.cjs';
 import '../organizations/interfaces/organization.interface.cjs';
 import '../organization-domains/interfaces/organization-domain.interface.cjs';
 import '../sso/interfaces/connection.interface.cjs';
@@ -25,9 +31,6 @@ import '../user-management/interfaces/magic-auth.interface.cjs';
 import '../user-management/interfaces/password-reset.interface.cjs';
 import '../user-management/interfaces/session.interface.cjs';
 import '../user-management/interfaces/impersonator.interface.cjs';
-import '../common/interfaces/list.interface.cjs';
-import '../common/utils/pagination.cjs';
-import '../common/interfaces/pagination-options.interface.cjs';
 import '../organizations/interfaces/create-organization-options.interface.cjs';
 import '../organizations/interfaces/domain-data.interface.cjs';
 import '../organizations/interfaces/list-organization-feature-flags-options.interface.cjs';
@@ -123,6 +126,5 @@ import '../vault/interfaces/object/delete-object.interface.cjs';
 import '../vault/interfaces/object/read-object.interface.cjs';
 import '../vault/interfaces/object.interface.cjs';
 import '../vault/interfaces/object/update-object.interface.cjs';
-import '../directory-sync/interfaces/list-directories-options.interface.cjs';
-import '../directory-sync/interfaces/list-groups-options.interface.cjs';
-import '../directory-sync/interfaces/list-directory-users-options.interface.cjs';
+import '../api-keys/interfaces/validate-api-key.interface.cjs';
+import '../api-keys/interfaces/api-key.interface.cjs';

package/lib/cjs/sso/sso.d.cts

@@ -1,6 +1,6 @@
 import '../common/interfaces/unknown-record.interface.cjs';
 import '../common/utils/pagination.cjs';
-export { S as SSO } from '../workos-BcNRiAbw.cjs';
+export { S as SSO } from '../workos-X1cDErJB.cjs';
 import './interfaces/authorization-url-options.interface.cjs';
 import './interfaces/connection.interface.cjs';
 import './interfaces/get-profile-options.interface.cjs';
@@ -15,12 +15,15 @@ import '../common/interfaces/post-options.interface.cjs';
 import '../common/interfaces/put-options.interface.cjs';
 import '../common/interfaces/workos-options.interface.cjs';
 import '../common/interfaces/app-info.interface.cjs';
-import '../events/interfaces/list-events-options.interface.cjs';
-import '../common/interfaces/event.interface.cjs';
 import '../directory-sync/interfaces/directory.interface.cjs';
 import '../directory-sync/interfaces/directory-group.interface.cjs';
+import '../directory-sync/interfaces/list-directories-options.interface.cjs';
+import '../directory-sync/interfaces/list-groups-options.interface.cjs';
+import '../directory-sync/interfaces/list-directory-users-options.interface.cjs';
 import '../directory-sync/interfaces/directory-user.interface.cjs';
 import '../roles/interfaces/role.interface.cjs';
+import '../events/interfaces/list-events-options.interface.cjs';
+import '../common/interfaces/event.interface.cjs';
 import '../organizations/interfaces/organization.interface.cjs';
 import '../organization-domains/interfaces/organization-domain.interface.cjs';
 import '../user-management/interfaces/user.interface.cjs';
@@ -123,6 +126,5 @@ import '../vault/interfaces/object/delete-object.interface.cjs';
 import '../vault/interfaces/object/read-object.interface.cjs';
 import '../vault/interfaces/object.interface.cjs';
 import '../vault/interfaces/object/update-object.interface.cjs';
-import '../directory-sync/interfaces/list-directories-options.interface.cjs';
-import '../directory-sync/interfaces/list-groups-options.interface.cjs';
-import '../directory-sync/interfaces/list-directory-users-options.interface.cjs';
+import '../api-keys/interfaces/validate-api-key.interface.cjs';
+import '../api-keys/interfaces/api-key.interface.cjs';

package/lib/cjs/user-management/session.cjs

@@ -22,15 +22,14 @@ __export(session_exports, {
   CookieSession: () => CookieSession
 });
 module.exports = __toCommonJS(session_exports);
-var import_jose = require("jose");
 var import_oauth = require('../common/exceptions/oauth.exception.cjs');
 var import_interfaces = require('./interfaces/index.cjs');
 var import_iron_session = require("iron-session");
+var import_jose = require('../utils/jose.cjs');
 class CookieSession {
   static {
     __name(this, "CookieSession");
   }
-  jwks;
   userManagement;
   cookiePassword;
   sessionData;
@@ -41,7 +40,6 @@ class CookieSession {
     this.userManagement = userManagement;
     this.cookiePassword = cookiePassword;
     this.sessionData = sessionData;
-    this.jwks = this.userManagement.jwks;
   }
   /**
    * Authenticates a user with a session cookie.
@@ -78,6 +76,7 @@ class CookieSession {
         reason: import_interfaces.AuthenticateWithSessionCookieFailureReason.INVALID_JWT
       };
     }
+    const { decodeJwt } = await (0, import_jose.getJose)();
     const {
       sid: sessionId,
       org_id: organizationId,
@@ -86,7 +85,7 @@ class CookieSession {
       permissions,
       entitlements,
       feature_flags: featureFlags
-    } = (0, import_jose.decodeJwt)(session.accessToken);
+    } = decodeJwt(session.accessToken);
     return {
       authenticated: true,
       sessionId,
@@ -110,6 +109,7 @@ class CookieSession {
    * @returns An object indicating whether the refresh was successful or not. If successful, it will include the new sealed session data.
    */
   async refresh(options = {}) {
+    const { decodeJwt } = await (0, import_jose.getJose)();
     const session = await (0, import_iron_session.unsealData)(this.sessionData, {
       password: this.cookiePassword
     });
@@ -119,7 +119,7 @@ class CookieSession {
         reason: import_interfaces.RefreshSessionFailureReason.INVALID_SESSION_COOKIE
       };
     }
-    const { org_id: organizationIdFromAccessToken } = (0, import_jose.decodeJwt)(
+    const { org_id: organizationIdFromAccessToken } = decodeJwt(
       session.accessToken
     );
     try {
@@ -146,7 +146,7 @@ class CookieSession {
         permissions,
         entitlements,
         feature_flags: featureFlags
-      } = (0, import_jose.decodeJwt)(authenticationResponse.accessToken);
+      } = decodeJwt(authenticationResponse.accessToken);
       return {
         authenticated: true,
         sealedSession: authenticationResponse.sealedSession,
@@ -191,13 +191,15 @@ class CookieSession {
     });
   }
   async isValidJwt(accessToken) {
-    if (!this.jwks) {
+    const { jwtVerify } = await (0, import_jose.getJose)();
+    const jwks = await this.userManagement.getJWKS();
+    if (!jwks) {
       throw new Error(
         "Missing client ID. Did you provide it when initializing WorkOS?"
       );
     }
     try {
-      await (0, import_jose.jwtVerify)(accessToken, this.jwks);
+      await jwtVerify(accessToken, jwks);
       return true;
     } catch (e) {
       return false;

package/lib/cjs/user-management/session.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/user-management/session.ts"],"sourcesContent":["import { createRemoteJWKSet, decodeJwt, jwtVerify } from 'jose';\nimport { OauthException } from '../common/exceptions/oauth.exception';\nimport {\n  AccessToken,\n  AuthenticateWithSessionCookieFailedResponse,\n  AuthenticateWithSessionCookieFailureReason,\n  AuthenticateWithSessionCookieSuccessResponse,\n  AuthenticationResponse,\n  RefreshSessionFailureReason,\n  RefreshSessionResponse,\n  SessionCookieData,\n} from './interfaces';\nimport { UserManagement } from './user-management';\nimport { unsealData } from 'iron-session';\n\ntype RefreshOptions = {\n  cookiePassword?: string;\n  organizationId?: string;\n};\n\nexport class CookieSession {\n  private jwks: ReturnType<typeof createRemoteJWKSet> | undefined;\n  private userManagement: UserManagement;\n  private cookiePassword: string;\n  private sessionData: string;\n\n  constructor(\n    userManagement: UserManagement,\n    sessionData: string,\n    cookiePassword: string,\n  ) {\n    if (!cookiePassword) {\n      throw new Error('cookiePassword is required');\n    }\n\n    this.userManagement = userManagement;\n    this.cookiePassword = cookiePassword;\n    this.sessionData = sessionData;\n\n    this.jwks = this.userManagement.jwks;\n  }\n\n  /**\n   * Authenticates a user with a session cookie.\n   *\n   * @returns An object indicating whether the authentication was successful or not. If successful, it will include the user's session data.\n   */\n  async authenticate(): Promise<\n    | AuthenticateWithSessionCookieSuccessResponse\n    | AuthenticateWithSessionCookieFailedResponse\n  > {\n    if (!this.sessionData) {\n      return {\n        authenticated: false,\n        reason:\n          AuthenticateWithSessionCookieFailureReason.NO_SESSION_COOKIE_PROVIDED,\n      };\n    }\n\n    let session: SessionCookieData;\n\n    try {\n      session = await unsealData<SessionCookieData>(this.sessionData, {\n        password: this.cookiePassword,\n      });\n    } catch (e) {\n      return {\n        authenticated: false,\n        reason:\n          AuthenticateWithSessionCookieFailureReason.INVALID_SESSION_COOKIE,\n      };\n    }\n\n    if (!session.accessToken) {\n      return {\n        authenticated: false,\n        reason:\n          AuthenticateWithSessionCookieFailureReason.INVALID_SESSION_COOKIE,\n      };\n    }\n\n    if (!(await this.isValidJwt(session.accessToken))) {\n      return {\n        authenticated: false,\n        reason: AuthenticateWithSessionCookieFailureReason.INVALID_JWT,\n      };\n    }\n\n    const {\n      sid: sessionId,\n      org_id: organizationId,\n      role,\n      roles,\n      permissions,\n      entitlements,\n      feature_flags: featureFlags,\n    } = decodeJwt<AccessToken>(session.accessToken);\n\n    return {\n      authenticated: true,\n      sessionId,\n      organizationId,\n      role,\n      roles,\n      permissions,\n      entitlements,\n      featureFlags,\n      user: session.user,\n      impersonator: session.impersonator,\n      accessToken: session.accessToken,\n    };\n  }\n\n  /**\n   * Refreshes the user's session.\n   *\n   * @param options - Optional options for refreshing the session.\n   * @param options.cookiePassword - The password to use for the new session cookie.\n   * @param options.organizationId - The organization ID to use for the new session cookie.\n   * @returns An object indicating whether the refresh was successful or not. If successful, it will include the new sealed session data.\n   */\n  async refresh(options: RefreshOptions = {}): Promise<RefreshSessionResponse> {\n    const session = await unsealData<SessionCookieData>(this.sessionData, {\n      password: this.cookiePassword,\n    });\n\n    if (!session.refreshToken || !session.user) {\n      return {\n        authenticated: false,\n        reason: RefreshSessionFailureReason.INVALID_SESSION_COOKIE,\n      };\n    }\n\n    const { org_id: organizationIdFromAccessToken } = decodeJwt<AccessToken>(\n      session.accessToken,\n    );\n\n    try {\n      const cookiePassword = options.cookiePassword ?? this.cookiePassword;\n\n      const authenticationResponse =\n        await this.userManagement.authenticateWithRefreshToken({\n          clientId: this.userManagement.clientId as string,\n          refreshToken: session.refreshToken,\n          organizationId:\n            options.organizationId ?? organizationIdFromAccessToken,\n          session: {\n            // We want to store the new sealed session in this class instance, so this always needs to be true\n            sealSession: true,\n            cookiePassword,\n          },\n        });\n\n      // Update the password if a new one was provided\n      if (options.cookiePassword) {\n        this.cookiePassword = options.cookiePassword;\n      }\n\n      this.sessionData = authenticationResponse.sealedSession as string;\n\n      const {\n        sid: sessionId,\n        org_id: organizationId,\n        role,\n        roles,\n        permissions,\n        entitlements,\n        feature_flags: featureFlags,\n      } = decodeJwt<AccessToken>(authenticationResponse.accessToken);\n\n      // TODO: Returning `session` here means there's some duplicated data.\n      // Slim down the return type in a future major version.\n      return {\n        authenticated: true,\n        sealedSession: authenticationResponse.sealedSession,\n        session: authenticationResponse as AuthenticationResponse,\n        sessionId,\n        organizationId,\n        role,\n        roles,\n        permissions,\n        entitlements,\n        featureFlags,\n        user: session.user,\n        impersonator: session.impersonator,\n      };\n    } catch (error) {\n      if (\n        error instanceof OauthException &&\n        // TODO: Add additional known errors and remove re-throw\n        (error.error === RefreshSessionFailureReason.INVALID_GRANT ||\n          error.error === RefreshSessionFailureReason.MFA_ENROLLMENT ||\n          error.error === RefreshSessionFailureReason.SSO_REQUIRED)\n      ) {\n        return {\n          authenticated: false,\n          reason: error.error,\n        };\n      }\n\n      throw error;\n    }\n  }\n\n  /**\n   * Gets the URL to redirect the user to for logging out.\n   *\n   * @returns The URL to redirect the user to for logging out.\n   */\n  async getLogoutUrl({\n    returnTo,\n  }: { returnTo?: string } = {}): Promise<string> {\n    const authenticationResponse = await this.authenticate();\n\n    if (!authenticationResponse.authenticated) {\n      const { reason } = authenticationResponse;\n      throw new Error(`Failed to extract session ID for logout URL: ${reason}`);\n    }\n\n    return this.userManagement.getLogoutUrl({\n      sessionId: authenticationResponse.sessionId,\n      returnTo,\n    });\n  }\n\n  private async isValidJwt(accessToken: string): Promise<boolean> {\n    if (!this.jwks) {\n      throw new Error(\n        'Missing client ID. Did you provide it when initializing WorkOS?',\n      );\n    }\n\n    try {\n      await jwtVerify(accessToken, this.jwks);\n      return true;\n    } catch (e) {\n      return false;\n    }\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,kBAAyD;AACzD,mBAA+B;AAC/B,wBASO;AAEP,0BAA2B;AAOpB,MAAM,cAAc;AAAA,EApB3B,OAoB2B;AAAA;AAAA;AAAA,EACjB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAER,YACE,gBACA,aACA,gBACA;AACA,QAAI,CAAC,gBAAgB;AACnB,YAAM,IAAI,MAAM,4BAA4B;AAAA,IAC9C;AAEA,SAAK,iBAAiB;AACtB,SAAK,iBAAiB;AACtB,SAAK,cAAc;AAEnB,SAAK,OAAO,KAAK,eAAe;AAAA,EAClC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,eAGJ;AACA,QAAI,CAAC,KAAK,aAAa;AACrB,aAAO;AAAA,QACL,eAAe;AAAA,QACf,QACE,6DAA2C;AAAA,MAC/C;AAAA,IACF;AAEA,QAAI;AAEJ,QAAI;AACF,gBAAU,UAAM,gCAA8B,KAAK,aAAa;AAAA,QAC9D,UAAU,KAAK;AAAA,MACjB,CAAC;AAAA,IACH,SAAS,GAAG;AACV,aAAO;AAAA,QACL,eAAe;AAAA,QACf,QACE,6DAA2C;AAAA,MAC/C;AAAA,IACF;AAEA,QAAI,CAAC,QAAQ,aAAa;AACxB,aAAO;AAAA,QACL,eAAe;AAAA,QACf,QACE,6DAA2C;AAAA,MAC/C;AAAA,IACF;AAEA,QAAI,CAAE,MAAM,KAAK,WAAW,QAAQ,WAAW,GAAI;AACjD,aAAO;AAAA,QACL,eAAe;AAAA,QACf,QAAQ,6DAA2C;AAAA,MACrD;AAAA,IACF;AAEA,UAAM;AAAA,MACJ,KAAK;AAAA,MACL,QAAQ;AAAA,MACR;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,eAAe;AAAA,IACjB,QAAI,uBAAuB,QAAQ,WAAW;AAE9C,WAAO;AAAA,MACL,eAAe;AAAA,MACf;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,MAAM,QAAQ;AAAA,MACd,cAAc,QAAQ;AAAA,MACtB,aAAa,QAAQ;AAAA,IACvB;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,MAAM,QAAQ,UAA0B,CAAC,GAAoC;AAC3E,UAAM,UAAU,UAAM,gCAA8B,KAAK,aAAa;AAAA,MACpE,UAAU,KAAK;AAAA,IACjB,CAAC;AAED,QAAI,CAAC,QAAQ,gBAAgB,CAAC,QAAQ,MAAM;AAC1C,aAAO;AAAA,QACL,eAAe;AAAA,QACf,QAAQ,8CAA4B;AAAA,MACtC;AAAA,IACF;AAEA,UAAM,EAAE,QAAQ,8BAA8B,QAAI;AAAA,MAChD,QAAQ;AAAA,IACV;AAEA,QAAI;AACF,YAAM,iBAAiB,QAAQ,kBAAkB,KAAK;AAEtD,YAAM,yBACJ,MAAM,KAAK,eAAe,6BAA6B;AAAA,QACrD,UAAU,KAAK,eAAe;AAAA,QAC9B,cAAc,QAAQ;AAAA,QACtB,gBACE,QAAQ,kBAAkB;AAAA,QAC5B,SAAS;AAAA;AAAA,UAEP,aAAa;AAAA,UACb;AAAA,QACF;AAAA,MACF,CAAC;AAGH,UAAI,QAAQ,gBAAgB;AAC1B,aAAK,iBAAiB,QAAQ;AAAA,MAChC;AAEA,WAAK,cAAc,uBAAuB;AAE1C,YAAM;AAAA,QACJ,KAAK;AAAA,QACL,QAAQ;AAAA,QACR;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA,eAAe;AAAA,MACjB,QAAI,uBAAuB,uBAAuB,WAAW;AAI7D,aAAO;AAAA,QACL,eAAe;AAAA,QACf,eAAe,uBAAuB;AAAA,QACtC,SAAS;AAAA,QACT;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA,MAAM,QAAQ;AAAA,QACd,cAAc,QAAQ;AAAA,MACxB;AAAA,IACF,SAAS,OAAO;AACd,UACE,iBAAiB;AAAA,OAEhB,MAAM,UAAU,8CAA4B,iBAC3C,MAAM,UAAU,8CAA4B,kBAC5C,MAAM,UAAU,8CAA4B,eAC9C;AACA,eAAO;AAAA,UACL,eAAe;AAAA,UACf,QAAQ,MAAM;AAAA,QAChB;AAAA,MACF;AAEA,YAAM;AAAA,IACR;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,aAAa;AAAA,IACjB;AAAA,EACF,IAA2B,CAAC,GAAoB;AAC9C,UAAM,yBAAyB,MAAM,KAAK,aAAa;AAEvD,QAAI,CAAC,uBAAuB,eAAe;AACzC,YAAM,EAAE,OAAO,IAAI;AACnB,YAAM,IAAI,MAAM,gDAAgD,MAAM,EAAE;AAAA,IAC1E;AAEA,WAAO,KAAK,eAAe,aAAa;AAAA,MACtC,WAAW,uBAAuB;AAAA,MAClC;AAAA,IACF,CAAC;AAAA,EACH;AAAA,EAEA,MAAc,WAAW,aAAuC;AAC9D,QAAI,CAAC,KAAK,MAAM;AACd,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAEA,QAAI;AACF,gBAAM,uBAAU,aAAa,KAAK,IAAI;AACtC,aAAO;AAAA,IACT,SAAS,GAAG;AACV,aAAO;AAAA,IACT;AAAA,EACF;AACF;","names":[]}
+{"version":3,"sources":["../../../src/user-management/session.ts"],"sourcesContent":["import { OauthException } from '../common/exceptions/oauth.exception';\nimport {\n  AccessToken,\n  AuthenticateWithSessionCookieFailedResponse,\n  AuthenticateWithSessionCookieFailureReason,\n  AuthenticateWithSessionCookieSuccessResponse,\n  AuthenticationResponse,\n  RefreshSessionFailureReason,\n  RefreshSessionResponse,\n  SessionCookieData,\n} from './interfaces';\nimport { UserManagement } from './user-management';\nimport { unsealData } from 'iron-session';\nimport { getJose } from '../utils/jose';\n\ntype RefreshOptions = {\n  cookiePassword?: string;\n  organizationId?: string;\n};\n\nexport class CookieSession {\n  private userManagement: UserManagement;\n  private cookiePassword: string;\n  private sessionData: string;\n\n  constructor(\n    userManagement: UserManagement,\n    sessionData: string,\n    cookiePassword: string,\n  ) {\n    if (!cookiePassword) {\n      throw new Error('cookiePassword is required');\n    }\n\n    this.userManagement = userManagement;\n    this.cookiePassword = cookiePassword;\n    this.sessionData = sessionData;\n  }\n\n  /**\n   * Authenticates a user with a session cookie.\n   *\n   * @returns An object indicating whether the authentication was successful or not. If successful, it will include the user's session data.\n   */\n  async authenticate(): Promise<\n    | AuthenticateWithSessionCookieSuccessResponse\n    | AuthenticateWithSessionCookieFailedResponse\n  > {\n    if (!this.sessionData) {\n      return {\n        authenticated: false,\n        reason:\n          AuthenticateWithSessionCookieFailureReason.NO_SESSION_COOKIE_PROVIDED,\n      };\n    }\n\n    let session: SessionCookieData;\n\n    try {\n      session = await unsealData<SessionCookieData>(this.sessionData, {\n        password: this.cookiePassword,\n      });\n    } catch (e) {\n      return {\n        authenticated: false,\n        reason:\n          AuthenticateWithSessionCookieFailureReason.INVALID_SESSION_COOKIE,\n      };\n    }\n\n    if (!session.accessToken) {\n      return {\n        authenticated: false,\n        reason:\n          AuthenticateWithSessionCookieFailureReason.INVALID_SESSION_COOKIE,\n      };\n    }\n\n    if (!(await this.isValidJwt(session.accessToken))) {\n      return {\n        authenticated: false,\n        reason: AuthenticateWithSessionCookieFailureReason.INVALID_JWT,\n      };\n    }\n\n    const { decodeJwt } = await getJose();\n\n    const {\n      sid: sessionId,\n      org_id: organizationId,\n      role,\n      roles,\n      permissions,\n      entitlements,\n      feature_flags: featureFlags,\n    } = decodeJwt<AccessToken>(session.accessToken);\n\n    return {\n      authenticated: true,\n      sessionId,\n      organizationId,\n      role,\n      roles,\n      permissions,\n      entitlements,\n      featureFlags,\n      user: session.user,\n      impersonator: session.impersonator,\n      accessToken: session.accessToken,\n    };\n  }\n\n  /**\n   * Refreshes the user's session.\n   *\n   * @param options - Optional options for refreshing the session.\n   * @param options.cookiePassword - The password to use for the new session cookie.\n   * @param options.organizationId - The organization ID to use for the new session cookie.\n   * @returns An object indicating whether the refresh was successful or not. If successful, it will include the new sealed session data.\n   */\n  async refresh(options: RefreshOptions = {}): Promise<RefreshSessionResponse> {\n    const { decodeJwt } = await getJose();\n    const session = await unsealData<SessionCookieData>(this.sessionData, {\n      password: this.cookiePassword,\n    });\n\n    if (!session.refreshToken || !session.user) {\n      return {\n        authenticated: false,\n        reason: RefreshSessionFailureReason.INVALID_SESSION_COOKIE,\n      };\n    }\n\n    const { org_id: organizationIdFromAccessToken } = decodeJwt<AccessToken>(\n      session.accessToken,\n    );\n\n    try {\n      const cookiePassword = options.cookiePassword ?? this.cookiePassword;\n\n      const authenticationResponse =\n        await this.userManagement.authenticateWithRefreshToken({\n          clientId: this.userManagement.clientId as string,\n          refreshToken: session.refreshToken,\n          organizationId:\n            options.organizationId ?? organizationIdFromAccessToken,\n          session: {\n            // We want to store the new sealed session in this class instance, so this always needs to be true\n            sealSession: true,\n            cookiePassword,\n          },\n        });\n\n      // Update the password if a new one was provided\n      if (options.cookiePassword) {\n        this.cookiePassword = options.cookiePassword;\n      }\n\n      this.sessionData = authenticationResponse.sealedSession as string;\n\n      const {\n        sid: sessionId,\n        org_id: organizationId,\n        role,\n        roles,\n        permissions,\n        entitlements,\n        feature_flags: featureFlags,\n      } = decodeJwt<AccessToken>(authenticationResponse.accessToken);\n\n      // TODO: Returning `session` here means there's some duplicated data.\n      // Slim down the return type in a future major version.\n      return {\n        authenticated: true,\n        sealedSession: authenticationResponse.sealedSession,\n        session: authenticationResponse as AuthenticationResponse,\n        sessionId,\n        organizationId,\n        role,\n        roles,\n        permissions,\n        entitlements,\n        featureFlags,\n        user: session.user,\n        impersonator: session.impersonator,\n      };\n    } catch (error) {\n      if (\n        error instanceof OauthException &&\n        // TODO: Add additional known errors and remove re-throw\n        (error.error === RefreshSessionFailureReason.INVALID_GRANT ||\n          error.error === RefreshSessionFailureReason.MFA_ENROLLMENT ||\n          error.error === RefreshSessionFailureReason.SSO_REQUIRED)\n      ) {\n        return {\n          authenticated: false,\n          reason: error.error,\n        };\n      }\n\n      throw error;\n    }\n  }\n\n  /**\n   * Gets the URL to redirect the user to for logging out.\n   *\n   * @returns The URL to redirect the user to for logging out.\n   */\n  async getLogoutUrl({\n    returnTo,\n  }: { returnTo?: string } = {}): Promise<string> {\n    const authenticationResponse = await this.authenticate();\n\n    if (!authenticationResponse.authenticated) {\n      const { reason } = authenticationResponse;\n      throw new Error(`Failed to extract session ID for logout URL: ${reason}`);\n    }\n\n    return this.userManagement.getLogoutUrl({\n      sessionId: authenticationResponse.sessionId,\n      returnTo,\n    });\n  }\n\n  private async isValidJwt(accessToken: string): Promise<boolean> {\n    const { jwtVerify } = await getJose();\n    const jwks = await this.userManagement.getJWKS();\n    if (!jwks) {\n      throw new Error(\n        'Missing client ID. Did you provide it when initializing WorkOS?',\n      );\n    }\n\n    try {\n      await jwtVerify(accessToken, jwks);\n      return true;\n    } catch (e) {\n      return false;\n    }\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,mBAA+B;AAC/B,wBASO;AAEP,0BAA2B;AAC3B,kBAAwB;AAOjB,MAAM,cAAc;AAAA,EApB3B,OAoB2B;AAAA;AAAA;AAAA,EACjB;AAAA,EACA;AAAA,EACA;AAAA,EAER,YACE,gBACA,aACA,gBACA;AACA,QAAI,CAAC,gBAAgB;AACnB,YAAM,IAAI,MAAM,4BAA4B;AAAA,IAC9C;AAEA,SAAK,iBAAiB;AACtB,SAAK,iBAAiB;AACtB,SAAK,cAAc;AAAA,EACrB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,eAGJ;AACA,QAAI,CAAC,KAAK,aAAa;AACrB,aAAO;AAAA,QACL,eAAe;AAAA,QACf,QACE,6DAA2C;AAAA,MAC/C;AAAA,IACF;AAEA,QAAI;AAEJ,QAAI;AACF,gBAAU,UAAM,gCAA8B,KAAK,aAAa;AAAA,QAC9D,UAAU,KAAK;AAAA,MACjB,CAAC;AAAA,IACH,SAAS,GAAG;AACV,aAAO;AAAA,QACL,eAAe;AAAA,QACf,QACE,6DAA2C;AAAA,MAC/C;AAAA,IACF;AAEA,QAAI,CAAC,QAAQ,aAAa;AACxB,aAAO;AAAA,QACL,eAAe;AAAA,QACf,QACE,6DAA2C;AAAA,MAC/C;AAAA,IACF;AAEA,QAAI,CAAE,MAAM,KAAK,WAAW,QAAQ,WAAW,GAAI;AACjD,aAAO;AAAA,QACL,eAAe;AAAA,QACf,QAAQ,6DAA2C;AAAA,MACrD;AAAA,IACF;AAEA,UAAM,EAAE,UAAU,IAAI,UAAM,qBAAQ;AAEpC,UAAM;AAAA,MACJ,KAAK;AAAA,MACL,QAAQ;AAAA,MACR;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,eAAe;AAAA,IACjB,IAAI,UAAuB,QAAQ,WAAW;AAE9C,WAAO;AAAA,MACL,eAAe;AAAA,MACf;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,MAAM,QAAQ;AAAA,MACd,cAAc,QAAQ;AAAA,MACtB,aAAa,QAAQ;AAAA,IACvB;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,MAAM,QAAQ,UAA0B,CAAC,GAAoC;AAC3E,UAAM,EAAE,UAAU,IAAI,UAAM,qBAAQ;AACpC,UAAM,UAAU,UAAM,gCAA8B,KAAK,aAAa;AAAA,MACpE,UAAU,KAAK;AAAA,IACjB,CAAC;AAED,QAAI,CAAC,QAAQ,gBAAgB,CAAC,QAAQ,MAAM;AAC1C,aAAO;AAAA,QACL,eAAe;AAAA,QACf,QAAQ,8CAA4B;AAAA,MACtC;AAAA,IACF;AAEA,UAAM,EAAE,QAAQ,8BAA8B,IAAI;AAAA,MAChD,QAAQ;AAAA,IACV;AAEA,QAAI;AACF,YAAM,iBAAiB,QAAQ,kBAAkB,KAAK;AAEtD,YAAM,yBACJ,MAAM,KAAK,eAAe,6BAA6B;AAAA,QACrD,UAAU,KAAK,eAAe;AAAA,QAC9B,cAAc,QAAQ;AAAA,QACtB,gBACE,QAAQ,kBAAkB;AAAA,QAC5B,SAAS;AAAA;AAAA,UAEP,aAAa;AAAA,UACb;AAAA,QACF;AAAA,MACF,CAAC;AAGH,UAAI,QAAQ,gBAAgB;AAC1B,aAAK,iBAAiB,QAAQ;AAAA,MAChC;AAEA,WAAK,cAAc,uBAAuB;AAE1C,YAAM;AAAA,QACJ,KAAK;AAAA,QACL,QAAQ;AAAA,QACR;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA,eAAe;AAAA,MACjB,IAAI,UAAuB,uBAAuB,WAAW;AAI7D,aAAO;AAAA,QACL,eAAe;AAAA,QACf,eAAe,uBAAuB;AAAA,QACtC,SAAS;AAAA,QACT;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA,MAAM,QAAQ;AAAA,QACd,cAAc,QAAQ;AAAA,MACxB;AAAA,IACF,SAAS,OAAO;AACd,UACE,iBAAiB;AAAA,OAEhB,MAAM,UAAU,8CAA4B,iBAC3C,MAAM,UAAU,8CAA4B,kBAC5C,MAAM,UAAU,8CAA4B,eAC9C;AACA,eAAO;AAAA,UACL,eAAe;AAAA,UACf,QAAQ,MAAM;AAAA,QAChB;AAAA,MACF;AAEA,YAAM;AAAA,IACR;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,aAAa;AAAA,IACjB;AAAA,EACF,IAA2B,CAAC,GAAoB;AAC9C,UAAM,yBAAyB,MAAM,KAAK,aAAa;AAEvD,QAAI,CAAC,uBAAuB,eAAe;AACzC,YAAM,EAAE,OAAO,IAAI;AACnB,YAAM,IAAI,MAAM,gDAAgD,MAAM,EAAE;AAAA,IAC1E;AAEA,WAAO,KAAK,eAAe,aAAa;AAAA,MACtC,WAAW,uBAAuB;AAAA,MAClC;AAAA,IACF,CAAC;AAAA,EACH;AAAA,EAEA,MAAc,WAAW,aAAuC;AAC9D,UAAM,EAAE,UAAU,IAAI,UAAM,qBAAQ;AACpC,UAAM,OAAO,MAAM,KAAK,eAAe,QAAQ;AAC/C,QAAI,CAAC,MAAM;AACT,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAEA,QAAI;AACF,YAAM,UAAU,aAAa,IAAI;AACjC,aAAO;AAAA,IACT,SAAS,GAAG;AACV,aAAO;AAAA,IACT;AAAA,EACF;AACF;","names":[]}

package/lib/cjs/user-management/session.d.cts

@@ -1,6 +1,6 @@
 import './interfaces/authenticate-with-session-cookie.interface.cjs';
 import './interfaces/refresh-and-seal-session-data.interface.cjs';
-export { C as CookieSession } from '../workos-BcNRiAbw.cjs';
+export { C as CookieSession } from '../workos-X1cDErJB.cjs';
 import './interfaces/authentication-response.interface.cjs';
 import './interfaces/impersonator.interface.cjs';
 import './interfaces/oauth-tokens.interface.cjs';
@@ -10,12 +10,18 @@ import '../common/interfaces/post-options.interface.cjs';
 import '../common/interfaces/put-options.interface.cjs';
 import '../common/interfaces/workos-options.interface.cjs';
 import '../common/interfaces/app-info.interface.cjs';
-import '../events/interfaces/list-events-options.interface.cjs';
-import '../common/interfaces/event.interface.cjs';
+import '../common/utils/pagination.cjs';
+import '../common/interfaces/pagination-options.interface.cjs';
+import '../common/interfaces/list.interface.cjs';
 import '../directory-sync/interfaces/directory.interface.cjs';
 import '../directory-sync/interfaces/directory-group.interface.cjs';
+import '../directory-sync/interfaces/list-directories-options.interface.cjs';
+import '../directory-sync/interfaces/list-groups-options.interface.cjs';
+import '../directory-sync/interfaces/list-directory-users-options.interface.cjs';
 import '../directory-sync/interfaces/directory-user.interface.cjs';
 import '../roles/interfaces/role.interface.cjs';
+import '../events/interfaces/list-events-options.interface.cjs';
+import '../common/interfaces/event.interface.cjs';
 import '../organizations/interfaces/organization.interface.cjs';
 import '../organization-domains/interfaces/organization-domain.interface.cjs';
 import '../sso/interfaces/connection.interface.cjs';
@@ -28,9 +34,6 @@ import './interfaces/organization-membership.interface.cjs';
 import './interfaces/magic-auth.interface.cjs';
 import './interfaces/password-reset.interface.cjs';
 import './interfaces/session.interface.cjs';
-import '../common/interfaces/list.interface.cjs';
-import '../common/utils/pagination.cjs';
-import '../common/interfaces/pagination-options.interface.cjs';
 import '../organizations/interfaces/create-organization-options.interface.cjs';
 import '../organizations/interfaces/domain-data.interface.cjs';
 import '../organizations/interfaces/list-organization-feature-flags-options.interface.cjs';
@@ -123,6 +126,5 @@ import '../vault/interfaces/object/delete-object.interface.cjs';
 import '../vault/interfaces/object/read-object.interface.cjs';
 import '../vault/interfaces/object.interface.cjs';
 import '../vault/interfaces/object/update-object.interface.cjs';
-import '../directory-sync/interfaces/list-directories-options.interface.cjs';
-import '../directory-sync/interfaces/list-groups-options.interface.cjs';
-import '../directory-sync/interfaces/list-directory-users-options.interface.cjs';
+import '../api-keys/interfaces/validate-api-key.interface.cjs';
+import '../api-keys/interfaces/api-key.interface.cjs';

package/lib/cjs/user-management/user-management.cjs

@@ -33,7 +33,6 @@ __export(user_management_exports, {
 });
 module.exports = __toCommonJS(user_management_exports);
 var import_iron_session = require("iron-session");
-var import_jose = require("jose");
 var clientUserManagement = __toESM(require('../client/user-management.cjs'), 1);
 var import_fetch_and_deserialize = require('../common/utils/fetch-and-deserialize.cjs');
 var import_pagination = require('../common/utils/pagination.cjs');
@@ -56,6 +55,7 @@ var import_organization_membership2 = require('./serializers/organization-member
 var import_send_invitation_options2 = require('./serializers/send-invitation-options.serializer.cjs');
 var import_update_organization_membership_options2 = require('./serializers/update-organization-membership-options.serializer.cjs');
 var import_session = require('./session.cjs');
+var import_jose = require('../utils/jose.cjs');
 class UserManagement {
   constructor(workos) {
     this.workos = workos;
@@ -67,11 +67,12 @@ class UserManagement {
   }
   _jwks;
   clientId;
-  get jwks() {
+  async getJWKS() {
+    const { createRemoteJWKSet } = await (0, import_jose.getJose)();
     if (!this.clientId) {
       return;
     }
-    this._jwks ??= (0, import_jose.createRemoteJWKSet)(new URL(this.getJwksUrl(this.clientId)), {
+    this._jwks ??= createRemoteJWKSet(new URL(this.getJwksUrl(this.clientId)), {
       cooldownDuration: 1e3 * 60 * 5
     });
     return this._jwks;
@@ -236,9 +237,11 @@ class UserManagement {
     if (!cookiePassword) {
       throw new Error("Cookie password is required");
     }
-    if (!this.jwks) {
+    const jwks = await this.getJWKS();
+    if (!jwks) {
       throw new Error("Must provide clientId to initialize JWKS");
     }
+    const { decodeJwt } = await (0, import_jose.getJose)();
     if (!sessionData) {
       return {
         authenticated: false,
@@ -268,7 +271,7 @@ class UserManagement {
       permissions,
       entitlements,
       feature_flags: featureFlags
-    } = (0, import_jose.decodeJwt)(session.accessToken);
+    } = decodeJwt(session.accessToken);
     return {
       authenticated: true,
       sessionId,
@@ -283,11 +286,13 @@ class UserManagement {
     };
   }
   async isValidJwt(accessToken) {
-    if (!this.jwks) {
+    const jwks = await this.getJWKS();
+    const { jwtVerify } = await (0, import_jose.getJose)();
+    if (!jwks) {
       throw new Error("Must provide clientId to initialize JWKS");
     }
     try {
-      await (0, import_jose.jwtVerify)(accessToken, this.jwks);
+      await jwtVerify(accessToken, jwks);
       return true;
     } catch (e) {
       return false;
@@ -315,7 +320,8 @@ class UserManagement {
     if (!cookiePassword) {
       throw new Error("Cookie password is required");
     }
-    const { org_id: organizationIdFromAccessToken } = (0, import_jose.decodeJwt)(
+    const { decodeJwt } = await (0, import_jose.getJose)();
+    const { org_id: organizationIdFromAccessToken } = decodeJwt(
       authenticationResponse.accessToken
     );
     const sessionData = {