@workos-inc/node 8.0.0-rc.1 → 8.0.0-rc.3

package/lib/cjs/user-management/user-management.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/user-management/user-management.ts"],"sourcesContent":["import { sealData, unsealData } from 'iron-session';\nimport { createRemoteJWKSet, decodeJwt, jwtVerify } from 'jose';\nimport * as clientUserManagement from '../client/user-management';\nimport { PaginationOptions } from '../common/interfaces/pagination-options.interface';\nimport { fetchAndDeserialize } from '../common/utils/fetch-and-deserialize';\nimport { AutoPaginatable } from '../common/utils/pagination';\nimport { getEnv } from '../common/utils/env';\nimport { Challenge, ChallengeResponse } from '../mfa/interfaces';\nimport { deserializeChallenge } from '../mfa/serializers';\nimport {\n  FeatureFlag,\n  FeatureFlagResponse,\n} from '../feature-flags/interfaces/feature-flag.interface';\nimport { deserializeFeatureFlag } from '../feature-flags/serializers/feature-flag.serializer';\nimport { WorkOS } from '../workos';\nimport {\n  AuthenticateWithCodeAndVerifierOptions,\n  AuthenticateWithCodeOptions,\n  AuthenticateWithMagicAuthOptions,\n  AuthenticateWithPasswordOptions,\n  AuthenticateWithRefreshTokenOptions,\n  AuthenticateWithSessionOptions,\n  AuthenticateWithTotpOptions,\n  AuthenticationResponse,\n  AuthenticationResponseResponse,\n  CreateMagicAuthOptions,\n  CreatePasswordResetOptions,\n  CreateUserOptions,\n  EmailVerification,\n  EmailVerificationResponse,\n  EnrollAuthFactorOptions,\n  ListAuthFactorsOptions,\n  ListSessionsOptions,\n  ListUsersOptions,\n  ListUserFeatureFlagsOptions,\n  MagicAuth,\n  MagicAuthResponse,\n  PasswordReset,\n  PasswordResetResponse,\n  ResetPasswordOptions,\n  SendVerificationEmailOptions,\n  SerializedAuthenticateWithCodeAndVerifierOptions,\n  SerializedAuthenticateWithCodeOptions,\n  SerializedAuthenticateWithMagicAuthOptions,\n  SerializedAuthenticateWithPasswordOptions,\n  SerializedAuthenticateWithRefreshTokenOptions,\n  SerializedAuthenticateWithTotpOptions,\n  SerializedCreateMagicAuthOptions,\n  SerializedCreatePasswordResetOptions,\n  SerializedCreateUserOptions,\n  SerializedListSessionsOptions,\n  SerializedListUsersOptions,\n  SerializedResetPasswordOptions,\n  SerializedVerifyEmailOptions,\n  Session,\n  SessionResponse,\n  UpdateUserOptions,\n  User,\n  UserResponse,\n  VerifyEmailOptions,\n} from './interfaces';\nimport {\n  AuthenticateWithEmailVerificationOptions,\n  SerializedAuthenticateWithEmailVerificationOptions,\n} from './interfaces/authenticate-with-email-verification-options.interface';\nimport {\n  AuthenticateWithOrganizationSelectionOptions,\n  SerializedAuthenticateWithOrganizationSelectionOptions,\n} from './interfaces/authenticate-with-organization-selection.interface';\nimport {\n  AccessToken,\n  AuthenticateWithSessionCookieFailedResponse,\n  AuthenticateWithSessionCookieFailureReason,\n  AuthenticateWithSessionCookieOptions,\n  AuthenticateWithSessionCookieSuccessResponse,\n  SessionCookieData,\n} from './interfaces/authenticate-with-session-cookie.interface';\nimport { UserManagementAuthorizationURLOptions } from './interfaces/authorization-url-options.interface';\nimport {\n  CreateOrganizationMembershipOptions,\n  SerializedCreateOrganizationMembershipOptions,\n} from './interfaces/create-organization-membership-options.interface';\nimport {\n  Factor,\n  FactorResponse,\n  FactorWithSecrets,\n  FactorWithSecretsResponse,\n} from './interfaces/factor.interface';\nimport { Identity, IdentityResponse } from './interfaces/identity.interface';\nimport {\n  Invitation,\n  InvitationResponse,\n} from './interfaces/invitation.interface';\nimport {\n  ListInvitationsOptions,\n  SerializedListInvitationsOptions,\n} from './interfaces/list-invitations-options.interface';\nimport {\n  ListOrganizationMembershipsOptions,\n  SerializedListOrganizationMembershipsOptions,\n} from './interfaces/list-organization-memberships-options.interface';\nimport {\n  OrganizationMembership,\n  OrganizationMembershipResponse,\n} from './interfaces/organization-membership.interface';\nimport {\n  RevokeSessionOptions,\n  SerializedRevokeSessionOptions,\n  serializeRevokeSessionOptions,\n} from './interfaces/revoke-session-options.interface';\nimport {\n  SendInvitationOptions,\n  SerializedSendInvitationOptions,\n} from './interfaces/send-invitation-options.interface';\nimport { SessionHandlerOptions } from './interfaces/session-handler-options.interface';\nimport {\n  SerializedUpdateOrganizationMembershipOptions,\n  UpdateOrganizationMembershipOptions,\n} from './interfaces/update-organization-membership-options.interface';\nimport {\n  deserializeAuthenticationResponse,\n  deserializeEmailVerification,\n  deserializeFactorWithSecrets,\n  deserializeMagicAuth,\n  deserializePasswordReset,\n  deserializeSession,\n  deserializeUser,\n  serializeAuthenticateWithCodeAndVerifierOptions,\n  serializeAuthenticateWithCodeOptions,\n  serializeAuthenticateWithMagicAuthOptions,\n  serializeAuthenticateWithPasswordOptions,\n  serializeAuthenticateWithRefreshTokenOptions,\n  serializeAuthenticateWithTotpOptions,\n  serializeCreateMagicAuthOptions,\n  serializeCreatePasswordResetOptions,\n  serializeCreateUserOptions,\n  serializeEnrollAuthFactorOptions,\n  serializeListSessionsOptions,\n  serializeResetPasswordOptions,\n  serializeUpdateUserOptions,\n} from './serializers';\nimport { serializeAuthenticateWithEmailVerificationOptions } from './serializers/authenticate-with-email-verification.serializer';\nimport { serializeAuthenticateWithOrganizationSelectionOptions } from './serializers/authenticate-with-organization-selection-options.serializer';\nimport { serializeCreateOrganizationMembershipOptions } from './serializers/create-organization-membership-options.serializer';\nimport { deserializeFactor } from './serializers/factor.serializer';\nimport { deserializeIdentities } from './serializers/identity.serializer';\nimport { deserializeInvitation } from './serializers/invitation.serializer';\nimport { serializeListInvitationsOptions } from './serializers/list-invitations-options.serializer';\nimport { serializeListOrganizationMembershipsOptions } from './serializers/list-organization-memberships-options.serializer';\nimport { serializeListUsersOptions } from './serializers/list-users-options.serializer';\nimport { deserializeOrganizationMembership } from './serializers/organization-membership.serializer';\nimport { serializeSendInvitationOptions } from './serializers/send-invitation-options.serializer';\nimport { serializeUpdateOrganizationMembershipOptions } from './serializers/update-organization-membership-options.serializer';\nimport { CookieSession } from './session';\n\nexport class UserManagement {\n  private _jwks: ReturnType<typeof createRemoteJWKSet> | undefined;\n  public clientId: string | undefined;\n\n  constructor(private readonly workos: WorkOS) {\n    const { clientId } = workos.options;\n\n    this.clientId = clientId;\n  }\n\n  get jwks(): ReturnType<typeof createRemoteJWKSet> | undefined {\n    if (!this.clientId) {\n      return;\n    }\n\n    // Set the JWKS URL. This is used to verify if the JWT is still valid\n    this._jwks ??= createRemoteJWKSet(new URL(this.getJwksUrl(this.clientId)), {\n      cooldownDuration: 1000 * 60 * 5,\n    });\n\n    return this._jwks;\n  }\n\n  /**\n   * Loads a sealed session using the provided session data and cookie password.\n   *\n   * @param options - The options for loading the sealed session.\n   * @param options.sessionData - The sealed session data.\n   * @param options.cookiePassword - The password used to encrypt the session data.\n   * @returns The session class.\n   */\n  loadSealedSession(options: {\n    sessionData: string;\n    cookiePassword: string;\n  }): CookieSession {\n    return new CookieSession(this, options.sessionData, options.cookiePassword);\n  }\n\n  async getUser(userId: string): Promise<User> {\n    const { data } = await this.workos.get<UserResponse>(\n      `/user_management/users/${userId}`,\n    );\n\n    return deserializeUser(data);\n  }\n\n  async getUserByExternalId(externalId: string): Promise<User> {\n    const { data } = await this.workos.get<UserResponse>(\n      `/user_management/users/external_id/${externalId}`,\n    );\n\n    return deserializeUser(data);\n  }\n\n  async listUsers(\n    options?: ListUsersOptions,\n  ): Promise<AutoPaginatable<User, SerializedListUsersOptions>> {\n    return new AutoPaginatable(\n      await fetchAndDeserialize<UserResponse, User>(\n        this.workos,\n        '/user_management/users',\n        deserializeUser,\n        options ? serializeListUsersOptions(options) : undefined,\n      ),\n      (params) =>\n        fetchAndDeserialize<UserResponse, User>(\n          this.workos,\n          '/user_management/users',\n          deserializeUser,\n          params,\n        ),\n      options ? serializeListUsersOptions(options) : undefined,\n    );\n  }\n\n  async createUser(payload: CreateUserOptions): Promise<User> {\n    const { data } = await this.workos.post<\n      UserResponse,\n      SerializedCreateUserOptions\n    >('/user_management/users', serializeCreateUserOptions(payload));\n\n    return deserializeUser(data);\n  }\n\n  async authenticateWithMagicAuth(\n    payload: AuthenticateWithMagicAuthOptions,\n  ): Promise<AuthenticationResponse> {\n    const { session, ...remainingPayload } = payload;\n\n    const { data } = await this.workos.post<\n      AuthenticationResponseResponse,\n      SerializedAuthenticateWithMagicAuthOptions\n    >(\n      '/user_management/authenticate',\n      serializeAuthenticateWithMagicAuthOptions({\n        ...remainingPayload,\n        clientSecret: this.workos.key,\n      }),\n    );\n\n    return this.prepareAuthenticationResponse({\n      authenticationResponse: deserializeAuthenticationResponse(data),\n      session,\n    });\n  }\n\n  async authenticateWithPassword(\n    payload: AuthenticateWithPasswordOptions,\n  ): Promise<AuthenticationResponse> {\n    const { session, ...remainingPayload } = payload;\n\n    const { data } = await this.workos.post<\n      AuthenticationResponseResponse,\n      SerializedAuthenticateWithPasswordOptions\n    >(\n      '/user_management/authenticate',\n      serializeAuthenticateWithPasswordOptions({\n        ...remainingPayload,\n        clientSecret: this.workos.key,\n      }),\n    );\n\n    return this.prepareAuthenticationResponse({\n      authenticationResponse: deserializeAuthenticationResponse(data),\n      session,\n    });\n  }\n\n  async authenticateWithCode(\n    payload: AuthenticateWithCodeOptions,\n  ): Promise<AuthenticationResponse> {\n    const { session, ...remainingPayload } = payload;\n\n    const { data } = await this.workos.post<\n      AuthenticationResponseResponse,\n      SerializedAuthenticateWithCodeOptions\n    >(\n      '/user_management/authenticate',\n      serializeAuthenticateWithCodeOptions({\n        ...remainingPayload,\n        clientSecret: this.workos.key,\n      }),\n    );\n\n    return this.prepareAuthenticationResponse({\n      authenticationResponse: deserializeAuthenticationResponse(data),\n      session,\n    });\n  }\n\n  async authenticateWithCodeAndVerifier(\n    payload: AuthenticateWithCodeAndVerifierOptions,\n  ): Promise<AuthenticationResponse> {\n    const { session, ...remainingPayload } = payload;\n\n    const { data } = await this.workos.post<\n      AuthenticationResponseResponse,\n      SerializedAuthenticateWithCodeAndVerifierOptions\n    >(\n      '/user_management/authenticate',\n      serializeAuthenticateWithCodeAndVerifierOptions(remainingPayload),\n    );\n\n    return this.prepareAuthenticationResponse({\n      authenticationResponse: deserializeAuthenticationResponse(data),\n      session,\n    });\n  }\n\n  async authenticateWithRefreshToken(\n    payload: AuthenticateWithRefreshTokenOptions,\n  ): Promise<AuthenticationResponse> {\n    const { session, ...remainingPayload } = payload;\n\n    const { data } = await this.workos.post<\n      AuthenticationResponseResponse,\n      SerializedAuthenticateWithRefreshTokenOptions\n    >(\n      '/user_management/authenticate',\n      serializeAuthenticateWithRefreshTokenOptions({\n        ...remainingPayload,\n        clientSecret: this.workos.key,\n      }),\n    );\n\n    return this.prepareAuthenticationResponse({\n      authenticationResponse: deserializeAuthenticationResponse(data),\n      session,\n    });\n  }\n\n  async authenticateWithTotp(\n    payload: AuthenticateWithTotpOptions,\n  ): Promise<AuthenticationResponse> {\n    const { session, ...remainingPayload } = payload;\n\n    const { data } = await this.workos.post<\n      AuthenticationResponseResponse,\n      SerializedAuthenticateWithTotpOptions\n    >(\n      '/user_management/authenticate',\n      serializeAuthenticateWithTotpOptions({\n        ...remainingPayload,\n        clientSecret: this.workos.key,\n      }),\n    );\n\n    return this.prepareAuthenticationResponse({\n      authenticationResponse: deserializeAuthenticationResponse(data),\n      session,\n    });\n  }\n\n  async authenticateWithEmailVerification(\n    payload: AuthenticateWithEmailVerificationOptions,\n  ): Promise<AuthenticationResponse> {\n    const { session, ...remainingPayload } = payload;\n\n    const { data } = await this.workos.post<\n      AuthenticationResponseResponse,\n      SerializedAuthenticateWithEmailVerificationOptions\n    >(\n      '/user_management/authenticate',\n      serializeAuthenticateWithEmailVerificationOptions({\n        ...remainingPayload,\n        clientSecret: this.workos.key,\n      }),\n    );\n\n    return this.prepareAuthenticationResponse({\n      authenticationResponse: deserializeAuthenticationResponse(data),\n      session,\n    });\n  }\n\n  async authenticateWithOrganizationSelection(\n    payload: AuthenticateWithOrganizationSelectionOptions,\n  ): Promise<AuthenticationResponse> {\n    const { session, ...remainingPayload } = payload;\n\n    const { data } = await this.workos.post<\n      AuthenticationResponseResponse,\n      SerializedAuthenticateWithOrganizationSelectionOptions\n    >(\n      '/user_management/authenticate',\n      serializeAuthenticateWithOrganizationSelectionOptions({\n        ...remainingPayload,\n        clientSecret: this.workos.key,\n      }),\n    );\n\n    return this.prepareAuthenticationResponse({\n      authenticationResponse: deserializeAuthenticationResponse(data),\n      session,\n    });\n  }\n\n  async authenticateWithSessionCookie({\n    sessionData,\n    cookiePassword = getEnv('WORKOS_COOKIE_PASSWORD'),\n  }: AuthenticateWithSessionCookieOptions): Promise<\n    | AuthenticateWithSessionCookieSuccessResponse\n    | AuthenticateWithSessionCookieFailedResponse\n  > {\n    if (!cookiePassword) {\n      throw new Error('Cookie password is required');\n    }\n\n    if (!this.jwks) {\n      throw new Error('Must provide clientId to initialize JWKS');\n    }\n\n    if (!sessionData) {\n      return {\n        authenticated: false,\n        reason:\n          AuthenticateWithSessionCookieFailureReason.NO_SESSION_COOKIE_PROVIDED,\n      };\n    }\n\n    const session = await unsealData<SessionCookieData>(sessionData, {\n      password: cookiePassword,\n    });\n\n    if (!session.accessToken) {\n      return {\n        authenticated: false,\n        reason:\n          AuthenticateWithSessionCookieFailureReason.INVALID_SESSION_COOKIE,\n      };\n    }\n\n    if (!(await this.isValidJwt(session.accessToken))) {\n      return {\n        authenticated: false,\n        reason: AuthenticateWithSessionCookieFailureReason.INVALID_JWT,\n      };\n    }\n\n    const {\n      sid: sessionId,\n      org_id: organizationId,\n      role,\n      roles,\n      permissions,\n      entitlements,\n      feature_flags: featureFlags,\n    } = decodeJwt<AccessToken>(session.accessToken);\n\n    return {\n      authenticated: true,\n      sessionId,\n      organizationId,\n      role,\n      roles,\n      user: session.user,\n      permissions,\n      entitlements,\n      featureFlags,\n      accessToken: session.accessToken,\n    };\n  }\n\n  private async isValidJwt(accessToken: string): Promise<boolean> {\n    if (!this.jwks) {\n      throw new Error('Must provide clientId to initialize JWKS');\n    }\n\n    try {\n      await jwtVerify(accessToken, this.jwks);\n      return true;\n    } catch (e) {\n      return false;\n    }\n  }\n\n  private async prepareAuthenticationResponse({\n    authenticationResponse,\n    session,\n  }: {\n    authenticationResponse: AuthenticationResponse;\n    session?: AuthenticateWithSessionOptions;\n  }): Promise<AuthenticationResponse> {\n    if (session?.sealSession) {\n      return {\n        ...authenticationResponse,\n        sealedSession: await this.sealSessionDataFromAuthenticationResponse({\n          authenticationResponse,\n          cookiePassword: session.cookiePassword,\n        }),\n      };\n    }\n\n    return authenticationResponse;\n  }\n\n  private async sealSessionDataFromAuthenticationResponse({\n    authenticationResponse,\n    cookiePassword,\n  }: {\n    authenticationResponse: AuthenticationResponse;\n    cookiePassword?: string;\n  }): Promise<string> {\n    if (!cookiePassword) {\n      throw new Error('Cookie password is required');\n    }\n\n    const { org_id: organizationIdFromAccessToken } = decodeJwt<AccessToken>(\n      authenticationResponse.accessToken,\n    );\n\n    const sessionData: SessionCookieData = {\n      organizationId: organizationIdFromAccessToken,\n      user: authenticationResponse.user,\n      accessToken: authenticationResponse.accessToken,\n      refreshToken: authenticationResponse.refreshToken,\n      impersonator: authenticationResponse.impersonator,\n    };\n\n    return sealData(sessionData, {\n      password: cookiePassword,\n    });\n  }\n\n  async getSessionFromCookie({\n    sessionData,\n    cookiePassword = getEnv('WORKOS_COOKIE_PASSWORD'),\n  }: SessionHandlerOptions): Promise<SessionCookieData | undefined> {\n    if (!cookiePassword) {\n      throw new Error('Cookie password is required');\n    }\n\n    if (sessionData) {\n      return unsealData<SessionCookieData>(sessionData, {\n        password: cookiePassword,\n      });\n    }\n\n    return undefined;\n  }\n\n  async getEmailVerification(\n    emailVerificationId: string,\n  ): Promise<EmailVerification> {\n    const { data } = await this.workos.get<EmailVerificationResponse>(\n      `/user_management/email_verification/${emailVerificationId}`,\n    );\n\n    return deserializeEmailVerification(data);\n  }\n\n  async sendVerificationEmail({\n    userId,\n  }: SendVerificationEmailOptions): Promise<{ user: User }> {\n    const { data } = await this.workos.post<{ user: UserResponse }>(\n      `/user_management/users/${userId}/email_verification/send`,\n      {},\n    );\n\n    return { user: deserializeUser(data.user) };\n  }\n\n  async getMagicAuth(magicAuthId: string): Promise<MagicAuth> {\n    const { data } = await this.workos.get<MagicAuthResponse>(\n      `/user_management/magic_auth/${magicAuthId}`,\n    );\n\n    return deserializeMagicAuth(data);\n  }\n\n  async createMagicAuth(options: CreateMagicAuthOptions): Promise<MagicAuth> {\n    const { data } = await this.workos.post<\n      MagicAuthResponse,\n      SerializedCreateMagicAuthOptions\n    >(\n      '/user_management/magic_auth',\n      serializeCreateMagicAuthOptions({\n        ...options,\n      }),\n    );\n\n    return deserializeMagicAuth(data);\n  }\n\n  async verifyEmail({\n    code,\n    userId,\n  }: VerifyEmailOptions): Promise<{ user: User }> {\n    const { data } = await this.workos.post<\n      { user: UserResponse },\n      SerializedVerifyEmailOptions\n    >(`/user_management/users/${userId}/email_verification/confirm`, {\n      code,\n    });\n\n    return { user: deserializeUser(data.user) };\n  }\n\n  async getPasswordReset(passwordResetId: string): Promise<PasswordReset> {\n    const { data } = await this.workos.get<PasswordResetResponse>(\n      `/user_management/password_reset/${passwordResetId}`,\n    );\n\n    return deserializePasswordReset(data);\n  }\n\n  async createPasswordReset(\n    options: CreatePasswordResetOptions,\n  ): Promise<PasswordReset> {\n    const { data } = await this.workos.post<\n      PasswordResetResponse,\n      SerializedCreatePasswordResetOptions\n    >(\n      '/user_management/password_reset',\n      serializeCreatePasswordResetOptions({\n        ...options,\n      }),\n    );\n\n    return deserializePasswordReset(data);\n  }\n\n  async resetPassword(payload: ResetPasswordOptions): Promise<{ user: User }> {\n    const { data } = await this.workos.post<\n      { user: UserResponse },\n      SerializedResetPasswordOptions\n    >(\n      '/user_management/password_reset/confirm',\n      serializeResetPasswordOptions(payload),\n    );\n\n    return { user: deserializeUser(data.user) };\n  }\n\n  async updateUser(payload: UpdateUserOptions): Promise<User> {\n    const { data } = await this.workos.put<UserResponse>(\n      `/user_management/users/${payload.userId}`,\n      serializeUpdateUserOptions(payload),\n    );\n\n    return deserializeUser(data);\n  }\n\n  async enrollAuthFactor(payload: EnrollAuthFactorOptions): Promise<{\n    authenticationFactor: FactorWithSecrets;\n    authenticationChallenge: Challenge;\n  }> {\n    const { data } = await this.workos.post<{\n      authentication_factor: FactorWithSecretsResponse;\n      authentication_challenge: ChallengeResponse;\n    }>(\n      `/user_management/users/${payload.userId}/auth_factors`,\n      serializeEnrollAuthFactorOptions(payload),\n    );\n\n    return {\n      authenticationFactor: deserializeFactorWithSecrets(\n        data.authentication_factor,\n      ),\n      authenticationChallenge: deserializeChallenge(\n        data.authentication_challenge,\n      ),\n    };\n  }\n\n  async listAuthFactors(\n    options: ListAuthFactorsOptions,\n  ): Promise<AutoPaginatable<Factor, PaginationOptions>> {\n    const { userId, ...restOfOptions } = options;\n    return new AutoPaginatable(\n      await fetchAndDeserialize<FactorResponse, Factor>(\n        this.workos,\n        `/user_management/users/${userId}/auth_factors`,\n        deserializeFactor,\n        restOfOptions,\n      ),\n      (params) =>\n        fetchAndDeserialize<FactorResponse, Factor>(\n          this.workos,\n          `/user_management/users/${userId}/auth_factors`,\n          deserializeFactor,\n          params,\n        ),\n      restOfOptions,\n    );\n  }\n\n  async listUserFeatureFlags(\n    options: ListUserFeatureFlagsOptions,\n  ): Promise<AutoPaginatable<FeatureFlag>> {\n    const { userId, ...paginationOptions } = options;\n\n    return new AutoPaginatable(\n      await fetchAndDeserialize<FeatureFlagResponse, FeatureFlag>(\n        this.workos,\n        `/user_management/users/${userId}/feature-flags`,\n        deserializeFeatureFlag,\n        paginationOptions,\n      ),\n      (params) =>\n        fetchAndDeserialize<FeatureFlagResponse, FeatureFlag>(\n          this.workos,\n          `/user_management/users/${userId}/feature-flags`,\n          deserializeFeatureFlag,\n          params,\n        ),\n      paginationOptions,\n    );\n  }\n\n  async listSessions(\n    userId: string,\n    options?: ListSessionsOptions,\n  ): Promise<AutoPaginatable<Session, SerializedListSessionsOptions>> {\n    return new AutoPaginatable(\n      await fetchAndDeserialize<SessionResponse, Session>(\n        this.workos,\n        `/user_management/users/${userId}/sessions`,\n        deserializeSession,\n        options ? serializeListSessionsOptions(options) : undefined,\n      ),\n      (params) =>\n        fetchAndDeserialize<SessionResponse, Session>(\n          this.workos,\n          `/user_management/users/${userId}/sessions`,\n          deserializeSession,\n          params,\n        ),\n      options ? serializeListSessionsOptions(options) : undefined,\n    );\n  }\n\n  async deleteUser(userId: string) {\n    await this.workos.delete(`/user_management/users/${userId}`);\n  }\n\n  async getUserIdentities(userId: string): Promise<Identity[]> {\n    if (!userId) {\n      throw new TypeError(`Incomplete arguments. Need to specify 'userId'.`);\n    }\n\n    const { data } = await this.workos.get<IdentityResponse[]>(\n      `/user_management/users/${userId}/identities`,\n    );\n\n    return deserializeIdentities(data);\n  }\n\n  async getOrganizationMembership(\n    organizationMembershipId: string,\n  ): Promise<OrganizationMembership> {\n    const { data } = await this.workos.get<OrganizationMembershipResponse>(\n      `/user_management/organization_memberships/${organizationMembershipId}`,\n    );\n\n    return deserializeOrganizationMembership(data);\n  }\n\n  async listOrganizationMemberships(\n    options: ListOrganizationMembershipsOptions,\n  ): Promise<\n    AutoPaginatable<\n      OrganizationMembership,\n      SerializedListOrganizationMembershipsOptions\n    >\n  > {\n    const serializedOptions =\n      serializeListOrganizationMembershipsOptions(options);\n\n    return new AutoPaginatable(\n      await fetchAndDeserialize<\n        OrganizationMembershipResponse,\n        OrganizationMembership\n      >(\n        this.workos,\n        '/user_management/organization_memberships',\n        deserializeOrganizationMembership,\n        serializedOptions,\n      ),\n      (params) =>\n        fetchAndDeserialize<\n          OrganizationMembershipResponse,\n          OrganizationMembership\n        >(\n          this.workos,\n          '/user_management/organization_memberships',\n          deserializeOrganizationMembership,\n          params,\n        ),\n      serializedOptions,\n    );\n  }\n\n  async createOrganizationMembership(\n    options: CreateOrganizationMembershipOptions,\n  ): Promise<OrganizationMembership> {\n    const { data } = await this.workos.post<\n      OrganizationMembershipResponse,\n      SerializedCreateOrganizationMembershipOptions\n    >(\n      '/user_management/organization_memberships',\n      serializeCreateOrganizationMembershipOptions(options),\n    );\n\n    return deserializeOrganizationMembership(data);\n  }\n\n  async updateOrganizationMembership(\n    organizationMembershipId: string,\n    options: UpdateOrganizationMembershipOptions,\n  ): Promise<OrganizationMembership> {\n    const { data } = await this.workos.put<\n      OrganizationMembershipResponse,\n      SerializedUpdateOrganizationMembershipOptions\n    >(\n      `/user_management/organization_memberships/${organizationMembershipId}`,\n      serializeUpdateOrganizationMembershipOptions(options),\n    );\n\n    return deserializeOrganizationMembership(data);\n  }\n\n  async deleteOrganizationMembership(\n    organizationMembershipId: string,\n  ): Promise<void> {\n    await this.workos.delete(\n      `/user_management/organization_memberships/${organizationMembershipId}`,\n    );\n  }\n\n  async deactivateOrganizationMembership(\n    organizationMembershipId: string,\n  ): Promise<OrganizationMembership> {\n    const { data } = await this.workos.put<OrganizationMembershipResponse>(\n      `/user_management/organization_memberships/${organizationMembershipId}/deactivate`,\n      {},\n    );\n\n    return deserializeOrganizationMembership(data);\n  }\n\n  async reactivateOrganizationMembership(\n    organizationMembershipId: string,\n  ): Promise<OrganizationMembership> {\n    const { data } = await this.workos.put<OrganizationMembershipResponse>(\n      `/user_management/organization_memberships/${organizationMembershipId}/reactivate`,\n      {},\n    );\n\n    return deserializeOrganizationMembership(data);\n  }\n\n  async getInvitation(invitationId: string): Promise<Invitation> {\n    const { data } = await this.workos.get<InvitationResponse>(\n      `/user_management/invitations/${invitationId}`,\n    );\n\n    return deserializeInvitation(data);\n  }\n\n  async findInvitationByToken(invitationToken: string): Promise<Invitation> {\n    const { data } = await this.workos.get<InvitationResponse>(\n      `/user_management/invitations/by_token/${invitationToken}`,\n    );\n\n    return deserializeInvitation(data);\n  }\n\n  async listInvitations(\n    options: ListInvitationsOptions,\n  ): Promise<AutoPaginatable<Invitation, SerializedListInvitationsOptions>> {\n    return new AutoPaginatable(\n      await fetchAndDeserialize<InvitationResponse, Invitation>(\n        this.workos,\n        '/user_management/invitations',\n        deserializeInvitation,\n        options ? serializeListInvitationsOptions(options) : undefined,\n      ),\n      (params) =>\n        fetchAndDeserialize<InvitationResponse, Invitation>(\n          this.workos,\n          '/user_management/invitations',\n          deserializeInvitation,\n          params,\n        ),\n      options ? serializeListInvitationsOptions(options) : undefined,\n    );\n  }\n\n  async sendInvitation(payload: SendInvitationOptions): Promise<Invitation> {\n    const { data } = await this.workos.post<\n      InvitationResponse,\n      SerializedSendInvitationOptions\n    >(\n      '/user_management/invitations',\n      serializeSendInvitationOptions({\n        ...payload,\n      }),\n    );\n\n    return deserializeInvitation(data);\n  }\n\n  async acceptInvitation(invitationId: string): Promise<Invitation> {\n    const { data } = await this.workos.post<InvitationResponse, any>(\n      `/user_management/invitations/${invitationId}/accept`,\n      null,\n    );\n\n    return deserializeInvitation(data);\n  }\n\n  async revokeInvitation(invitationId: string): Promise<Invitation> {\n    const { data } = await this.workos.post<InvitationResponse, any>(\n      `/user_management/invitations/${invitationId}/revoke`,\n      null,\n    );\n\n    return deserializeInvitation(data);\n  }\n\n  async revokeSession(payload: RevokeSessionOptions): Promise<void> {\n    await this.workos.post<void, SerializedRevokeSessionOptions>(\n      '/user_management/sessions/revoke',\n      serializeRevokeSessionOptions(payload),\n    );\n  }\n\n  getAuthorizationUrl(options: UserManagementAuthorizationURLOptions): string {\n    // Delegate to client implementation\n    return clientUserManagement.getAuthorizationUrl({\n      ...options,\n      baseURL: this.workos.baseURL,\n    });\n  }\n\n  getLogoutUrl(options: clientUserManagement.LogoutURLOptions): string {\n    // Delegate to client implementation\n    return clientUserManagement.getLogoutUrl({\n      ...options,\n      baseURL: this.workos.baseURL,\n    });\n  }\n\n  getJwksUrl(clientId: string): string {\n    // Delegate to client implementation\n    return clientUserManagement.getJwksUrl(clientId, this.workos.baseURL);\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,0BAAqC;AACrC,kBAAyD;AACzD,2BAAsC;AAEtC,mCAAoC;AACpC,wBAAgC;AAChC,iBAAuB;AAEvB,yBAAqC;AAKrC,IAAAA,uBAAuC;AAwDvC,8CAOO;AA6BP,oCAIO;AAUP,IAAAC,sBAqBO;AACP,kDAAkE;AAClE,8DAAsE;AACtE,IAAAC,iDAA6D;AAC7D,IAAAC,iBAAkC;AAClC,IAAAC,mBAAsC;AACtC,IAAAC,qBAAsC;AACtC,IAAAC,mCAAgD;AAChD,IAAAC,gDAA4D;AAC5D,gCAA0C;AAC1C,IAAAC,kCAAkD;AAClD,IAAAC,kCAA+C;AAC/C,IAAAC,iDAA6D;AAC7D,qBAA8B;AAEvB,MAAM,eAAe;AAAA,EAI1B,YAA6B,QAAgB;AAAhB;AAC3B,UAAM,EAAE,SAAS,IAAI,OAAO;AAE5B,SAAK,WAAW;AAAA,EAClB;AAAA,EAnKF,OA2J4B;AAAA;AAAA;AAAA,EAClB;AAAA,EACD;AAAA,EAQP,IAAI,OAA0D;AAC5D,QAAI,CAAC,KAAK,UAAU;AAClB;AAAA,IACF;AAGA,SAAK,cAAU,gCAAmB,IAAI,IAAI,KAAK,WAAW,KAAK,QAAQ,CAAC,GAAG;AAAA,MACzE,kBAAkB,MAAO,KAAK;AAAA,IAChC,CAAC;AAED,WAAO,KAAK;AAAA,EACd;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,kBAAkB,SAGA;AAChB,WAAO,IAAI,6BAAc,MAAM,QAAQ,aAAa,QAAQ,cAAc;AAAA,EAC5E;AAAA,EAEA,MAAM,QAAQ,QAA+B;AAC3C,UAAM,EAAE,KAAK,IAAI,MAAM,KAAK,OAAO;AAAA,MACjC,0BAA0B,MAAM;AAAA,IAClC;AAEA,eAAO,qCAAgB,IAAI;AAAA,EAC7B;AAAA,EAEA,MAAM,oBAAoB,YAAmC;AAC3D,UAAM,EAAE,KAAK,IAAI,MAAM,KAAK,OAAO;AAAA,MACjC,sCAAsC,UAAU;AAAA,IAClD;AAEA,eAAO,qCAAgB,IAAI;AAAA,EAC7B;AAAA,EAEA,MAAM,UACJ,SAC4D;AAC5D,WAAO,IAAI;AAAA,MACT,UAAM;AAAA,QACJ,KAAK;AAAA,QACL;AAAA,QACA;AAAA,QACA,cAAU,qDAA0B,OAAO,IAAI;AAAA,MACjD;AAAA,MACA,CAAC,eACC;AAAA,QACE,KAAK;AAAA,QACL;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,MACF,cAAU,qDAA0B,OAAO,IAAI;AAAA,IACjD;AAAA,EACF;AAAA,EAEA,MAAM,WAAW,SAA2C;AAC1D,UAAM,EAAE,KAAK,IAAI,MAAM,KAAK,OAAO,KAGjC,8BAA0B,gDAA2B,OAAO,CAAC;AAE/D,eAAO,qCAAgB,IAAI;AAAA,EAC7B;AAAA,EAEA,MAAM,0BACJ,SACiC;AACjC,UAAM,EAAE,SAAS,GAAG,iBAAiB,IAAI;AAEzC,UAAM,EAAE,KAAK,IAAI,MAAM,KAAK,OAAO;AAAA,MAIjC;AAAA,UACA,+DAA0C;AAAA,QACxC,GAAG;AAAA,QACH,cAAc,KAAK,OAAO;AAAA,MAC5B,CAAC;AAAA,IACH;AAEA,WAAO,KAAK,8BAA8B;AAAA,MACxC,4BAAwB,uDAAkC,IAAI;AAAA,MAC9D;AAAA,IACF,CAAC;AAAA,EACH;AAAA,EAEA,MAAM,yBACJ,SACiC;AACjC,UAAM,EAAE,SAAS,GAAG,iBAAiB,IAAI;AAEzC,UAAM,EAAE,KAAK,IAAI,MAAM,KAAK,OAAO;AAAA,MAIjC;AAAA,UACA,8DAAyC;AAAA,QACvC,GAAG;AAAA,QACH,cAAc,KAAK,OAAO;AAAA,MAC5B,CAAC;AAAA,IACH;AAEA,WAAO,KAAK,8BAA8B;AAAA,MACxC,4BAAwB,uDAAkC,IAAI;AAAA,MAC9D;AAAA,IACF,CAAC;AAAA,EACH;AAAA,EAEA,MAAM,qBACJ,SACiC;AACjC,UAAM,EAAE,SAAS,GAAG,iBAAiB,IAAI;AAEzC,UAAM,EAAE,KAAK,IAAI,MAAM,KAAK,OAAO;AAAA,MAIjC;AAAA,UACA,0DAAqC;AAAA,QACnC,GAAG;AAAA,QACH,cAAc,KAAK,OAAO;AAAA,MAC5B,CAAC;AAAA,IACH;AAEA,WAAO,KAAK,8BAA8B;AAAA,MACxC,4BAAwB,uDAAkC,IAAI;AAAA,MAC9D;AAAA,IACF,CAAC;AAAA,EACH;AAAA,EAEA,MAAM,gCACJ,SACiC;AACjC,UAAM,EAAE,SAAS,GAAG,iBAAiB,IAAI;AAEzC,UAAM,EAAE,KAAK,IAAI,MAAM,KAAK,OAAO;AAAA,MAIjC;AAAA,UACA,qEAAgD,gBAAgB;AAAA,IAClE;AAEA,WAAO,KAAK,8BAA8B;AAAA,MACxC,4BAAwB,uDAAkC,IAAI;AAAA,MAC9D;AAAA,IACF,CAAC;AAAA,EACH;AAAA,EAEA,MAAM,6BACJ,SACiC;AACjC,UAAM,EAAE,SAAS,GAAG,iBAAiB,IAAI;AAEzC,UAAM,EAAE,KAAK,IAAI,MAAM,KAAK,OAAO;AAAA,MAIjC;AAAA,UACA,kEAA6C;AAAA,QAC3C,GAAG;AAAA,QACH,cAAc,KAAK,OAAO;AAAA,MAC5B,CAAC;AAAA,IACH;AAEA,WAAO,KAAK,8BAA8B;AAAA,MACxC,4BAAwB,uDAAkC,IAAI;AAAA,MAC9D;AAAA,IACF,CAAC;AAAA,EACH;AAAA,EAEA,MAAM,qBACJ,SACiC;AACjC,UAAM,EAAE,SAAS,GAAG,iBAAiB,IAAI;AAEzC,UAAM,EAAE,KAAK,IAAI,MAAM,KAAK,OAAO;AAAA,MAIjC;AAAA,UACA,0DAAqC;AAAA,QACnC,GAAG;AAAA,QACH,cAAc,KAAK,OAAO;AAAA,MAC5B,CAAC;AAAA,IACH;AAEA,WAAO,KAAK,8BAA8B;AAAA,MACxC,4BAAwB,uDAAkC,IAAI;AAAA,MAC9D;AAAA,IACF,CAAC;AAAA,EACH;AAAA,EAEA,MAAM,kCACJ,SACiC;AACjC,UAAM,EAAE,SAAS,GAAG,iBAAiB,IAAI;AAEzC,UAAM,EAAE,KAAK,IAAI,MAAM,KAAK,OAAO;AAAA,MAIjC;AAAA,UACA,+FAAkD;AAAA,QAChD,GAAG;AAAA,QACH,cAAc,KAAK,OAAO;AAAA,MAC5B,CAAC;AAAA,IACH;AAEA,WAAO,KAAK,8BAA8B;AAAA,MACxC,4BAAwB,uDAAkC,IAAI;AAAA,MAC9D;AAAA,IACF,CAAC;AAAA,EACH;AAAA,EAEA,MAAM,sCACJ,SACiC;AACjC,UAAM,EAAE,SAAS,GAAG,iBAAiB,IAAI;AAEzC,UAAM,EAAE,KAAK,IAAI,MAAM,KAAK,OAAO;AAAA,MAIjC;AAAA,UACA,+GAAsD;AAAA,QACpD,GAAG;AAAA,QACH,cAAc,KAAK,OAAO;AAAA,MAC5B,CAAC;AAAA,IACH;AAEA,WAAO,KAAK,8BAA8B;AAAA,MACxC,4BAAwB,uDAAkC,IAAI;AAAA,MAC9D;AAAA,IACF,CAAC;AAAA,EACH;AAAA,EAEA,MAAM,8BAA8B;AAAA,IAClC;AAAA,IACA,qBAAiB,mBAAO,wBAAwB;AAAA,EAClD,GAGE;AACA,QAAI,CAAC,gBAAgB;AACnB,YAAM,IAAI,MAAM,6BAA6B;AAAA,IAC/C;AAEA,QAAI,CAAC,KAAK,MAAM;AACd,YAAM,IAAI,MAAM,0CAA0C;AAAA,IAC5D;AAEA,QAAI,CAAC,aAAa;AAChB,aAAO;AAAA,QACL,eAAe;AAAA,QACf,QACE,mFAA2C;AAAA,MAC/C;AAAA,IACF;AAEA,UAAM,UAAU,UAAM,gCAA8B,aAAa;AAAA,MAC/D,UAAU;AAAA,IACZ,CAAC;AAED,QAAI,CAAC,QAAQ,aAAa;AACxB,aAAO;AAAA,QACL,eAAe;AAAA,QACf,QACE,mFAA2C;AAAA,MAC/C;AAAA,IACF;AAEA,QAAI,CAAE,MAAM,KAAK,WAAW,QAAQ,WAAW,GAAI;AACjD,aAAO;AAAA,QACL,eAAe;AAAA,QACf,QAAQ,mFAA2C;AAAA,MACrD;AAAA,IACF;AAEA,UAAM;AAAA,MACJ,KAAK;AAAA,MACL,QAAQ;AAAA,MACR;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,eAAe;AAAA,IACjB,QAAI,uBAAuB,QAAQ,WAAW;AAE9C,WAAO;AAAA,MACL,eAAe;AAAA,MACf;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,MAAM,QAAQ;AAAA,MACd;AAAA,MACA;AAAA,MACA;AAAA,MACA,aAAa,QAAQ;AAAA,IACvB;AAAA,EACF;AAAA,EAEA,MAAc,WAAW,aAAuC;AAC9D,QAAI,CAAC,KAAK,MAAM;AACd,YAAM,IAAI,MAAM,0CAA0C;AAAA,IAC5D;AAEA,QAAI;AACF,gBAAM,uBAAU,aAAa,KAAK,IAAI;AACtC,aAAO;AAAA,IACT,SAAS,GAAG;AACV,aAAO;AAAA,IACT;AAAA,EACF;AAAA,EAEA,MAAc,8BAA8B;AAAA,IAC1C;AAAA,IACA;AAAA,EACF,GAGoC;AAClC,QAAI,SAAS,aAAa;AACxB,aAAO;AAAA,QACL,GAAG;AAAA,QACH,eAAe,MAAM,KAAK,0CAA0C;AAAA,UAClE;AAAA,UACA,gBAAgB,QAAQ;AAAA,QAC1B,CAAC;AAAA,MACH;AAAA,IACF;AAEA,WAAO;AAAA,EACT;AAAA,EAEA,MAAc,0CAA0C;AAAA,IACtD;AAAA,IACA;AAAA,EACF,GAGoB;AAClB,QAAI,CAAC,gBAAgB;AACnB,YAAM,IAAI,MAAM,6BAA6B;AAAA,IAC/C;AAEA,UAAM,EAAE,QAAQ,8BAA8B,QAAI;AAAA,MAChD,uBAAuB;AAAA,IACzB;AAEA,UAAM,cAAiC;AAAA,MACrC,gBAAgB;AAAA,MAChB,MAAM,uBAAuB;AAAA,MAC7B,aAAa,uBAAuB;AAAA,MACpC,cAAc,uBAAuB;AAAA,MACrC,cAAc,uBAAuB;AAAA,IACvC;AAEA,eAAO,8BAAS,aAAa;AAAA,MAC3B,UAAU;AAAA,IACZ,CAAC;AAAA,EACH;AAAA,EAEA,MAAM,qBAAqB;AAAA,IACzB;AAAA,IACA,qBAAiB,mBAAO,wBAAwB;AAAA,EAClD,GAAkE;AAChE,QAAI,CAAC,gBAAgB;AACnB,YAAM,IAAI,MAAM,6BAA6B;AAAA,IAC/C;AAEA,QAAI,aAAa;AACf,iBAAO,gCAA8B,aAAa;AAAA,QAChD,UAAU;AAAA,MACZ,CAAC;AAAA,IACH;AAEA,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,qBACJ,qBAC4B;AAC5B,UAAM,EAAE,KAAK,IAAI,MAAM,KAAK,OAAO;AAAA,MACjC,uCAAuC,mBAAmB;AAAA,IAC5D;AAEA,eAAO,kDAA6B,IAAI;AAAA,EAC1C;AAAA,EAEA,MAAM,sBAAsB;AAAA,IAC1B;AAAA,EACF,GAA0D;AACxD,UAAM,EAAE,KAAK,IAAI,MAAM,KAAK,OAAO;AAAA,MACjC,0BAA0B,MAAM;AAAA,MAChC,CAAC;AAAA,IACH;AAEA,WAAO,EAAE,UAAM,qCAAgB,KAAK,IAAI,EAAE;AAAA,EAC5C;AAAA,EAEA,MAAM,aAAa,aAAyC;AAC1D,UAAM,EAAE,KAAK,IAAI,MAAM,KAAK,OAAO;AAAA,MACjC,+BAA+B,WAAW;AAAA,IAC5C;AAEA,eAAO,0CAAqB,IAAI;AAAA,EAClC;AAAA,EAEA,MAAM,gBAAgB,SAAqD;AACzE,UAAM,EAAE,KAAK,IAAI,MAAM,KAAK,OAAO;AAAA,MAIjC;AAAA,UACA,qDAAgC;AAAA,QAC9B,GAAG;AAAA,MACL,CAAC;AAAA,IACH;AAEA,eAAO,0CAAqB,IAAI;AAAA,EAClC;AAAA,EAEA,MAAM,YAAY;AAAA,IAChB;AAAA,IACA;AAAA,EACF,GAAgD;AAC9C,UAAM,EAAE,KAAK,IAAI,MAAM,KAAK,OAAO,KAGjC,0BAA0B,MAAM,+BAA+B;AAAA,MAC/D;AAAA,IACF,CAAC;AAED,WAAO,EAAE,UAAM,qCAAgB,KAAK,IAAI,EAAE;AAAA,EAC5C;AAAA,EAEA,MAAM,iBAAiB,iBAAiD;AACtE,UAAM,EAAE,KAAK,IAAI,MAAM,KAAK,OAAO;AAAA,MACjC,mCAAmC,eAAe;AAAA,IACpD;AAEA,eAAO,8CAAyB,IAAI;AAAA,EACtC;AAAA,EAEA,MAAM,oBACJ,SACwB;AACxB,UAAM,EAAE,KAAK,IAAI,MAAM,KAAK,OAAO;AAAA,MAIjC;AAAA,UACA,yDAAoC;AAAA,QAClC,GAAG;AAAA,MACL,CAAC;AAAA,IACH;AAEA,eAAO,8CAAyB,IAAI;AAAA,EACtC;AAAA,EAEA,MAAM,cAAc,SAAwD;AAC1E,UAAM,EAAE,KAAK,IAAI,MAAM,KAAK,OAAO;AAAA,MAIjC;AAAA,UACA,mDAA8B,OAAO;AAAA,IACvC;AAEA,WAAO,EAAE,UAAM,qCAAgB,KAAK,IAAI,EAAE;AAAA,EAC5C;AAAA,EAEA,MAAM,WAAW,SAA2C;AAC1D,UAAM,EAAE,KAAK,IAAI,MAAM,KAAK,OAAO;AAAA,MACjC,0BAA0B,QAAQ,MAAM;AAAA,UACxC,gDAA2B,OAAO;AAAA,IACpC;AAEA,eAAO,qCAAgB,IAAI;AAAA,EAC7B;AAAA,EAEA,MAAM,iBAAiB,SAGpB;AACD,UAAM,EAAE,KAAK,IAAI,MAAM,KAAK,OAAO;AAAA,MAIjC,0BAA0B,QAAQ,MAAM;AAAA,UACxC,sDAAiC,OAAO;AAAA,IAC1C;AAEA,WAAO;AAAA,MACL,0BAAsB;AAAA,QACpB,KAAK;AAAA,MACP;AAAA,MACA,6BAAyB;AAAA,QACvB,KAAK;AAAA,MACP;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,gBACJ,SACqD;AACrD,UAAM,EAAE,QAAQ,GAAG,cAAc,IAAI;AACrC,WAAO,IAAI;AAAA,MACT,UAAM;AAAA,QACJ,KAAK;AAAA,QACL,0BAA0B,MAAM;AAAA,QAChC;AAAA,QACA;AAAA,MACF;AAAA,MACA,CAAC,eACC;AAAA,QACE,KAAK;AAAA,QACL,0BAA0B,MAAM;AAAA,QAChC;AAAA,QACA;AAAA,MACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,qBACJ,SACuC;AACvC,UAAM,EAAE,QAAQ,GAAG,kBAAkB,IAAI;AAEzC,WAAO,IAAI;AAAA,MACT,UAAM;AAAA,QACJ,KAAK;AAAA,QACL,0BAA0B,MAAM;AAAA,QAChC;AAAA,QACA;AAAA,MACF;AAAA,MACA,CAAC,eACC;AAAA,QACE,KAAK;AAAA,QACL,0BAA0B,MAAM;AAAA,QAChC;AAAA,QACA;AAAA,MACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,aACJ,QACA,SACkE;AAClE,WAAO,IAAI;AAAA,MACT,UAAM;AAAA,QACJ,KAAK;AAAA,QACL,0BAA0B,MAAM;AAAA,QAChC;AAAA,QACA,cAAU,kDAA6B,OAAO,IAAI;AAAA,MACpD;AAAA,MACA,CAAC,eACC;AAAA,QACE,KAAK;AAAA,QACL,0BAA0B,MAAM;AAAA,QAChC;AAAA,QACA;AAAA,MACF;AAAA,MACF,cAAU,kDAA6B,OAAO,IAAI;AAAA,IACpD;AAAA,EACF;AAAA,EAEA,MAAM,WAAW,QAAgB;AAC/B,UAAM,KAAK,OAAO,OAAO,0BAA0B,MAAM,EAAE;AAAA,EAC7D;AAAA,EAEA,MAAM,kBAAkB,QAAqC;AAC3D,QAAI,CAAC,QAAQ;AACX,YAAM,IAAI,UAAU,iDAAiD;AAAA,IACvE;AAEA,UAAM,EAAE,KAAK,IAAI,MAAM,KAAK,OAAO;AAAA,MACjC,0BAA0B,MAAM;AAAA,IAClC;AAEA,eAAO,wCAAsB,IAAI;AAAA,EACnC;AAAA,EAEA,MAAM,0BACJ,0BACiC;AACjC,UAAM,EAAE,KAAK,IAAI,MAAM,KAAK,OAAO;AAAA,MACjC,6CAA6C,wBAAwB;AAAA,IACvE;AAEA,eAAO,mEAAkC,IAAI;AAAA,EAC/C;AAAA,EAEA,MAAM,4BACJ,SAMA;AACA,UAAM,wBACJ,2FAA4C,OAAO;AAErD,WAAO,IAAI;AAAA,MACT,UAAM;AAAA,QAIJ,KAAK;AAAA,QACL;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,MACA,CAAC,eACC;AAAA,QAIE,KAAK;AAAA,QACL;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,6BACJ,SACiC;AACjC,UAAM,EAAE,KAAK,IAAI,MAAM,KAAK,OAAO;AAAA,MAIjC;AAAA,UACA,6FAA6C,OAAO;AAAA,IACtD;AAEA,eAAO,mEAAkC,IAAI;AAAA,EAC/C;AAAA,EAEA,MAAM,6BACJ,0BACA,SACiC;AACjC,UAAM,EAAE,KAAK,IAAI,MAAM,KAAK,OAAO;AAAA,MAIjC,6CAA6C,wBAAwB;AAAA,UACrE,6FAA6C,OAAO;AAAA,IACtD;AAEA,eAAO,mEAAkC,IAAI;AAAA,EAC/C;AAAA,EAEA,MAAM,6BACJ,0BACe;AACf,UAAM,KAAK,OAAO;AAAA,MAChB,6CAA6C,wBAAwB;AAAA,IACvE;AAAA,EACF;AAAA,EAEA,MAAM,iCACJ,0BACiC;AACjC,UAAM,EAAE,KAAK,IAAI,MAAM,KAAK,OAAO;AAAA,MACjC,6CAA6C,wBAAwB;AAAA,MACrE,CAAC;AAAA,IACH;AAEA,eAAO,mEAAkC,IAAI;AAAA,EAC/C;AAAA,EAEA,MAAM,iCACJ,0BACiC;AACjC,UAAM,EAAE,KAAK,IAAI,MAAM,KAAK,OAAO;AAAA,MACjC,6CAA6C,wBAAwB;AAAA,MACrE,CAAC;AAAA,IACH;AAEA,eAAO,mEAAkC,IAAI;AAAA,EAC/C;AAAA,EAEA,MAAM,cAAc,cAA2C;AAC7D,UAAM,EAAE,KAAK,IAAI,MAAM,KAAK,OAAO;AAAA,MACjC,gCAAgC,YAAY;AAAA,IAC9C;AAEA,eAAO,0CAAsB,IAAI;AAAA,EACnC;AAAA,EAEA,MAAM,sBAAsB,iBAA8C;AACxE,UAAM,EAAE,KAAK,IAAI,MAAM,KAAK,OAAO;AAAA,MACjC,yCAAyC,eAAe;AAAA,IAC1D;AAEA,eAAO,0CAAsB,IAAI;AAAA,EACnC;AAAA,EAEA,MAAM,gBACJ,SACwE;AACxE,WAAO,IAAI;AAAA,MACT,UAAM;AAAA,QACJ,KAAK;AAAA,QACL;AAAA,QACA;AAAA,QACA,cAAU,kEAAgC,OAAO,IAAI;AAAA,MACvD;AAAA,MACA,CAAC,eACC;AAAA,QACE,KAAK;AAAA,QACL;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,MACF,cAAU,kEAAgC,OAAO,IAAI;AAAA,IACvD;AAAA,EACF;AAAA,EAEA,MAAM,eAAe,SAAqD;AACxE,UAAM,EAAE,KAAK,IAAI,MAAM,KAAK,OAAO;AAAA,MAIjC;AAAA,UACA,gEAA+B;AAAA,QAC7B,GAAG;AAAA,MACL,CAAC;AAAA,IACH;AAEA,eAAO,0CAAsB,IAAI;AAAA,EACnC;AAAA,EAEA,MAAM,iBAAiB,cAA2C;AAChE,UAAM,EAAE,KAAK,IAAI,MAAM,KAAK,OAAO;AAAA,MACjC,gCAAgC,YAAY;AAAA,MAC5C;AAAA,IACF;AAEA,eAAO,0CAAsB,IAAI;AAAA,EACnC;AAAA,EAEA,MAAM,iBAAiB,cAA2C;AAChE,UAAM,EAAE,KAAK,IAAI,MAAM,KAAK,OAAO;AAAA,MACjC,gCAAgC,YAAY;AAAA,MAC5C;AAAA,IACF;AAEA,eAAO,0CAAsB,IAAI;AAAA,EACnC;AAAA,EAEA,MAAM,cAAc,SAA8C;AAChE,UAAM,KAAK,OAAO;AAAA,MAChB;AAAA,UACA,6DAA8B,OAAO;AAAA,IACvC;AAAA,EACF;AAAA,EAEA,oBAAoB,SAAwD;AAE1E,WAAO,qBAAqB,oBAAoB;AAAA,MAC9C,GAAG;AAAA,MACH,SAAS,KAAK,OAAO;AAAA,IACvB,CAAC;AAAA,EACH;AAAA,EAEA,aAAa,SAAwD;AAEnE,WAAO,qBAAqB,aAAa;AAAA,MACvC,GAAG;AAAA,MACH,SAAS,KAAK,OAAO;AAAA,IACvB,CAAC;AAAA,EACH;AAAA,EAEA,WAAW,UAA0B;AAEnC,WAAO,qBAAqB,WAAW,UAAU,KAAK,OAAO,OAAO;AAAA,EACtE;AACF;","names":["import_feature_flag","import_serializers","import_create_organization_membership_options","import_factor","import_identity","import_invitation","import_list_invitations_options","import_list_organization_memberships_options","import_organization_membership","import_send_invitation_options","import_update_organization_membership_options"]}
+{"version":3,"sources":["../../../src/user-management/user-management.ts"],"sourcesContent":["import { sealData, unsealData } from 'iron-session';\nimport * as clientUserManagement from '../client/user-management';\nimport { PaginationOptions } from '../common/interfaces/pagination-options.interface';\nimport { fetchAndDeserialize } from '../common/utils/fetch-and-deserialize';\nimport { AutoPaginatable } from '../common/utils/pagination';\nimport { getEnv } from '../common/utils/env';\nimport { Challenge, ChallengeResponse } from '../mfa/interfaces';\nimport { deserializeChallenge } from '../mfa/serializers';\nimport {\n  FeatureFlag,\n  FeatureFlagResponse,\n} from '../feature-flags/interfaces/feature-flag.interface';\nimport { deserializeFeatureFlag } from '../feature-flags/serializers/feature-flag.serializer';\nimport { WorkOS } from '../workos';\nimport {\n  AuthenticateWithCodeAndVerifierOptions,\n  AuthenticateWithCodeOptions,\n  AuthenticateWithMagicAuthOptions,\n  AuthenticateWithPasswordOptions,\n  AuthenticateWithRefreshTokenOptions,\n  AuthenticateWithSessionOptions,\n  AuthenticateWithTotpOptions,\n  AuthenticationResponse,\n  AuthenticationResponseResponse,\n  CreateMagicAuthOptions,\n  CreatePasswordResetOptions,\n  CreateUserOptions,\n  EmailVerification,\n  EmailVerificationResponse,\n  EnrollAuthFactorOptions,\n  ListAuthFactorsOptions,\n  ListSessionsOptions,\n  ListUsersOptions,\n  ListUserFeatureFlagsOptions,\n  MagicAuth,\n  MagicAuthResponse,\n  PasswordReset,\n  PasswordResetResponse,\n  ResetPasswordOptions,\n  SendVerificationEmailOptions,\n  SerializedAuthenticateWithCodeAndVerifierOptions,\n  SerializedAuthenticateWithCodeOptions,\n  SerializedAuthenticateWithMagicAuthOptions,\n  SerializedAuthenticateWithPasswordOptions,\n  SerializedAuthenticateWithRefreshTokenOptions,\n  SerializedAuthenticateWithTotpOptions,\n  SerializedCreateMagicAuthOptions,\n  SerializedCreatePasswordResetOptions,\n  SerializedCreateUserOptions,\n  SerializedListSessionsOptions,\n  SerializedListUsersOptions,\n  SerializedResetPasswordOptions,\n  SerializedVerifyEmailOptions,\n  Session,\n  SessionResponse,\n  UpdateUserOptions,\n  User,\n  UserResponse,\n  VerifyEmailOptions,\n} from './interfaces';\nimport {\n  AuthenticateWithEmailVerificationOptions,\n  SerializedAuthenticateWithEmailVerificationOptions,\n} from './interfaces/authenticate-with-email-verification-options.interface';\nimport {\n  AuthenticateWithOrganizationSelectionOptions,\n  SerializedAuthenticateWithOrganizationSelectionOptions,\n} from './interfaces/authenticate-with-organization-selection.interface';\nimport {\n  AccessToken,\n  AuthenticateWithSessionCookieFailedResponse,\n  AuthenticateWithSessionCookieFailureReason,\n  AuthenticateWithSessionCookieOptions,\n  AuthenticateWithSessionCookieSuccessResponse,\n  SessionCookieData,\n} from './interfaces/authenticate-with-session-cookie.interface';\nimport { UserManagementAuthorizationURLOptions } from './interfaces/authorization-url-options.interface';\nimport {\n  CreateOrganizationMembershipOptions,\n  SerializedCreateOrganizationMembershipOptions,\n} from './interfaces/create-organization-membership-options.interface';\nimport {\n  Factor,\n  FactorResponse,\n  FactorWithSecrets,\n  FactorWithSecretsResponse,\n} from './interfaces/factor.interface';\nimport { Identity, IdentityResponse } from './interfaces/identity.interface';\nimport {\n  Invitation,\n  InvitationResponse,\n} from './interfaces/invitation.interface';\nimport {\n  ListInvitationsOptions,\n  SerializedListInvitationsOptions,\n} from './interfaces/list-invitations-options.interface';\nimport {\n  ListOrganizationMembershipsOptions,\n  SerializedListOrganizationMembershipsOptions,\n} from './interfaces/list-organization-memberships-options.interface';\nimport {\n  OrganizationMembership,\n  OrganizationMembershipResponse,\n} from './interfaces/organization-membership.interface';\nimport {\n  RevokeSessionOptions,\n  SerializedRevokeSessionOptions,\n  serializeRevokeSessionOptions,\n} from './interfaces/revoke-session-options.interface';\nimport {\n  SendInvitationOptions,\n  SerializedSendInvitationOptions,\n} from './interfaces/send-invitation-options.interface';\nimport { SessionHandlerOptions } from './interfaces/session-handler-options.interface';\nimport {\n  SerializedUpdateOrganizationMembershipOptions,\n  UpdateOrganizationMembershipOptions,\n} from './interfaces/update-organization-membership-options.interface';\nimport {\n  deserializeAuthenticationResponse,\n  deserializeEmailVerification,\n  deserializeFactorWithSecrets,\n  deserializeMagicAuth,\n  deserializePasswordReset,\n  deserializeSession,\n  deserializeUser,\n  serializeAuthenticateWithCodeAndVerifierOptions,\n  serializeAuthenticateWithCodeOptions,\n  serializeAuthenticateWithMagicAuthOptions,\n  serializeAuthenticateWithPasswordOptions,\n  serializeAuthenticateWithRefreshTokenOptions,\n  serializeAuthenticateWithTotpOptions,\n  serializeCreateMagicAuthOptions,\n  serializeCreatePasswordResetOptions,\n  serializeCreateUserOptions,\n  serializeEnrollAuthFactorOptions,\n  serializeListSessionsOptions,\n  serializeResetPasswordOptions,\n  serializeUpdateUserOptions,\n} from './serializers';\nimport { serializeAuthenticateWithEmailVerificationOptions } from './serializers/authenticate-with-email-verification.serializer';\nimport { serializeAuthenticateWithOrganizationSelectionOptions } from './serializers/authenticate-with-organization-selection-options.serializer';\nimport { serializeCreateOrganizationMembershipOptions } from './serializers/create-organization-membership-options.serializer';\nimport { deserializeFactor } from './serializers/factor.serializer';\nimport { deserializeIdentities } from './serializers/identity.serializer';\nimport { deserializeInvitation } from './serializers/invitation.serializer';\nimport { serializeListInvitationsOptions } from './serializers/list-invitations-options.serializer';\nimport { serializeListOrganizationMembershipsOptions } from './serializers/list-organization-memberships-options.serializer';\nimport { serializeListUsersOptions } from './serializers/list-users-options.serializer';\nimport { deserializeOrganizationMembership } from './serializers/organization-membership.serializer';\nimport { serializeSendInvitationOptions } from './serializers/send-invitation-options.serializer';\nimport { serializeUpdateOrganizationMembershipOptions } from './serializers/update-organization-membership-options.serializer';\nimport { CookieSession } from './session';\nimport { getJose } from '../utils/jose';\n\nexport class UserManagement {\n  private _jwks:\n    | ReturnType<typeof import('jose').createRemoteJWKSet>\n    | undefined;\n  public clientId: string | undefined;\n\n  constructor(private readonly workos: WorkOS) {\n    const { clientId } = workos.options;\n\n    this.clientId = clientId;\n  }\n\n  async getJWKS(): Promise<\n    ReturnType<typeof import('jose').createRemoteJWKSet> | undefined\n  > {\n    const { createRemoteJWKSet } = await getJose();\n    if (!this.clientId) {\n      return;\n    }\n\n    // Set the JWKS URL. This is used to verify if the JWT is still valid\n    this._jwks ??= createRemoteJWKSet(new URL(this.getJwksUrl(this.clientId)), {\n      cooldownDuration: 1000 * 60 * 5,\n    });\n\n    return this._jwks;\n  }\n\n  /**\n   * Loads a sealed session using the provided session data and cookie password.\n   *\n   * @param options - The options for loading the sealed session.\n   * @param options.sessionData - The sealed session data.\n   * @param options.cookiePassword - The password used to encrypt the session data.\n   * @returns The session class.\n   */\n  loadSealedSession(options: {\n    sessionData: string;\n    cookiePassword: string;\n  }): CookieSession {\n    return new CookieSession(this, options.sessionData, options.cookiePassword);\n  }\n\n  async getUser(userId: string): Promise<User> {\n    const { data } = await this.workos.get<UserResponse>(\n      `/user_management/users/${userId}`,\n    );\n\n    return deserializeUser(data);\n  }\n\n  async getUserByExternalId(externalId: string): Promise<User> {\n    const { data } = await this.workos.get<UserResponse>(\n      `/user_management/users/external_id/${externalId}`,\n    );\n\n    return deserializeUser(data);\n  }\n\n  async listUsers(\n    options?: ListUsersOptions,\n  ): Promise<AutoPaginatable<User, SerializedListUsersOptions>> {\n    return new AutoPaginatable(\n      await fetchAndDeserialize<UserResponse, User>(\n        this.workos,\n        '/user_management/users',\n        deserializeUser,\n        options ? serializeListUsersOptions(options) : undefined,\n      ),\n      (params) =>\n        fetchAndDeserialize<UserResponse, User>(\n          this.workos,\n          '/user_management/users',\n          deserializeUser,\n          params,\n        ),\n      options ? serializeListUsersOptions(options) : undefined,\n    );\n  }\n\n  async createUser(payload: CreateUserOptions): Promise<User> {\n    const { data } = await this.workos.post<\n      UserResponse,\n      SerializedCreateUserOptions\n    >('/user_management/users', serializeCreateUserOptions(payload));\n\n    return deserializeUser(data);\n  }\n\n  async authenticateWithMagicAuth(\n    payload: AuthenticateWithMagicAuthOptions,\n  ): Promise<AuthenticationResponse> {\n    const { session, ...remainingPayload } = payload;\n\n    const { data } = await this.workos.post<\n      AuthenticationResponseResponse,\n      SerializedAuthenticateWithMagicAuthOptions\n    >(\n      '/user_management/authenticate',\n      serializeAuthenticateWithMagicAuthOptions({\n        ...remainingPayload,\n        clientSecret: this.workos.key,\n      }),\n    );\n\n    return this.prepareAuthenticationResponse({\n      authenticationResponse: deserializeAuthenticationResponse(data),\n      session,\n    });\n  }\n\n  async authenticateWithPassword(\n    payload: AuthenticateWithPasswordOptions,\n  ): Promise<AuthenticationResponse> {\n    const { session, ...remainingPayload } = payload;\n\n    const { data } = await this.workos.post<\n      AuthenticationResponseResponse,\n      SerializedAuthenticateWithPasswordOptions\n    >(\n      '/user_management/authenticate',\n      serializeAuthenticateWithPasswordOptions({\n        ...remainingPayload,\n        clientSecret: this.workos.key,\n      }),\n    );\n\n    return this.prepareAuthenticationResponse({\n      authenticationResponse: deserializeAuthenticationResponse(data),\n      session,\n    });\n  }\n\n  async authenticateWithCode(\n    payload: AuthenticateWithCodeOptions,\n  ): Promise<AuthenticationResponse> {\n    const { session, ...remainingPayload } = payload;\n\n    const { data } = await this.workos.post<\n      AuthenticationResponseResponse,\n      SerializedAuthenticateWithCodeOptions\n    >(\n      '/user_management/authenticate',\n      serializeAuthenticateWithCodeOptions({\n        ...remainingPayload,\n        clientSecret: this.workos.key,\n      }),\n    );\n\n    return this.prepareAuthenticationResponse({\n      authenticationResponse: deserializeAuthenticationResponse(data),\n      session,\n    });\n  }\n\n  async authenticateWithCodeAndVerifier(\n    payload: AuthenticateWithCodeAndVerifierOptions,\n  ): Promise<AuthenticationResponse> {\n    const { session, ...remainingPayload } = payload;\n\n    const { data } = await this.workos.post<\n      AuthenticationResponseResponse,\n      SerializedAuthenticateWithCodeAndVerifierOptions\n    >(\n      '/user_management/authenticate',\n      serializeAuthenticateWithCodeAndVerifierOptions(remainingPayload),\n    );\n\n    return this.prepareAuthenticationResponse({\n      authenticationResponse: deserializeAuthenticationResponse(data),\n      session,\n    });\n  }\n\n  async authenticateWithRefreshToken(\n    payload: AuthenticateWithRefreshTokenOptions,\n  ): Promise<AuthenticationResponse> {\n    const { session, ...remainingPayload } = payload;\n\n    const { data } = await this.workos.post<\n      AuthenticationResponseResponse,\n      SerializedAuthenticateWithRefreshTokenOptions\n    >(\n      '/user_management/authenticate',\n      serializeAuthenticateWithRefreshTokenOptions({\n        ...remainingPayload,\n        clientSecret: this.workos.key,\n      }),\n    );\n\n    return this.prepareAuthenticationResponse({\n      authenticationResponse: deserializeAuthenticationResponse(data),\n      session,\n    });\n  }\n\n  async authenticateWithTotp(\n    payload: AuthenticateWithTotpOptions,\n  ): Promise<AuthenticationResponse> {\n    const { session, ...remainingPayload } = payload;\n\n    const { data } = await this.workos.post<\n      AuthenticationResponseResponse,\n      SerializedAuthenticateWithTotpOptions\n    >(\n      '/user_management/authenticate',\n      serializeAuthenticateWithTotpOptions({\n        ...remainingPayload,\n        clientSecret: this.workos.key,\n      }),\n    );\n\n    return this.prepareAuthenticationResponse({\n      authenticationResponse: deserializeAuthenticationResponse(data),\n      session,\n    });\n  }\n\n  async authenticateWithEmailVerification(\n    payload: AuthenticateWithEmailVerificationOptions,\n  ): Promise<AuthenticationResponse> {\n    const { session, ...remainingPayload } = payload;\n\n    const { data } = await this.workos.post<\n      AuthenticationResponseResponse,\n      SerializedAuthenticateWithEmailVerificationOptions\n    >(\n      '/user_management/authenticate',\n      serializeAuthenticateWithEmailVerificationOptions({\n        ...remainingPayload,\n        clientSecret: this.workos.key,\n      }),\n    );\n\n    return this.prepareAuthenticationResponse({\n      authenticationResponse: deserializeAuthenticationResponse(data),\n      session,\n    });\n  }\n\n  async authenticateWithOrganizationSelection(\n    payload: AuthenticateWithOrganizationSelectionOptions,\n  ): Promise<AuthenticationResponse> {\n    const { session, ...remainingPayload } = payload;\n\n    const { data } = await this.workos.post<\n      AuthenticationResponseResponse,\n      SerializedAuthenticateWithOrganizationSelectionOptions\n    >(\n      '/user_management/authenticate',\n      serializeAuthenticateWithOrganizationSelectionOptions({\n        ...remainingPayload,\n        clientSecret: this.workos.key,\n      }),\n    );\n\n    return this.prepareAuthenticationResponse({\n      authenticationResponse: deserializeAuthenticationResponse(data),\n      session,\n    });\n  }\n\n  async authenticateWithSessionCookie({\n    sessionData,\n    cookiePassword = getEnv('WORKOS_COOKIE_PASSWORD'),\n  }: AuthenticateWithSessionCookieOptions): Promise<\n    | AuthenticateWithSessionCookieSuccessResponse\n    | AuthenticateWithSessionCookieFailedResponse\n  > {\n    if (!cookiePassword) {\n      throw new Error('Cookie password is required');\n    }\n\n    const jwks = await this.getJWKS();\n\n    if (!jwks) {\n      throw new Error('Must provide clientId to initialize JWKS');\n    }\n\n    const { decodeJwt } = await getJose();\n\n    if (!sessionData) {\n      return {\n        authenticated: false,\n        reason:\n          AuthenticateWithSessionCookieFailureReason.NO_SESSION_COOKIE_PROVIDED,\n      };\n    }\n\n    const session = await unsealData<SessionCookieData>(sessionData, {\n      password: cookiePassword,\n    });\n\n    if (!session.accessToken) {\n      return {\n        authenticated: false,\n        reason:\n          AuthenticateWithSessionCookieFailureReason.INVALID_SESSION_COOKIE,\n      };\n    }\n\n    if (!(await this.isValidJwt(session.accessToken))) {\n      return {\n        authenticated: false,\n        reason: AuthenticateWithSessionCookieFailureReason.INVALID_JWT,\n      };\n    }\n\n    const {\n      sid: sessionId,\n      org_id: organizationId,\n      role,\n      roles,\n      permissions,\n      entitlements,\n      feature_flags: featureFlags,\n    } = decodeJwt<AccessToken>(session.accessToken);\n\n    return {\n      authenticated: true,\n      sessionId,\n      organizationId,\n      role,\n      roles,\n      user: session.user,\n      permissions,\n      entitlements,\n      featureFlags,\n      accessToken: session.accessToken,\n    };\n  }\n\n  private async isValidJwt(accessToken: string): Promise<boolean> {\n    const jwks = await this.getJWKS();\n    const { jwtVerify } = await getJose();\n    if (!jwks) {\n      throw new Error('Must provide clientId to initialize JWKS');\n    }\n\n    try {\n      await jwtVerify(accessToken, jwks);\n      return true;\n    } catch (e) {\n      return false;\n    }\n  }\n\n  private async prepareAuthenticationResponse({\n    authenticationResponse,\n    session,\n  }: {\n    authenticationResponse: AuthenticationResponse;\n    session?: AuthenticateWithSessionOptions;\n  }): Promise<AuthenticationResponse> {\n    if (session?.sealSession) {\n      return {\n        ...authenticationResponse,\n        sealedSession: await this.sealSessionDataFromAuthenticationResponse({\n          authenticationResponse,\n          cookiePassword: session.cookiePassword,\n        }),\n      };\n    }\n\n    return authenticationResponse;\n  }\n\n  private async sealSessionDataFromAuthenticationResponse({\n    authenticationResponse,\n    cookiePassword,\n  }: {\n    authenticationResponse: AuthenticationResponse;\n    cookiePassword?: string;\n  }): Promise<string> {\n    if (!cookiePassword) {\n      throw new Error('Cookie password is required');\n    }\n\n    const { decodeJwt } = await getJose();\n\n    const { org_id: organizationIdFromAccessToken } = decodeJwt<AccessToken>(\n      authenticationResponse.accessToken,\n    );\n\n    const sessionData: SessionCookieData = {\n      organizationId: organizationIdFromAccessToken,\n      user: authenticationResponse.user,\n      accessToken: authenticationResponse.accessToken,\n      refreshToken: authenticationResponse.refreshToken,\n      impersonator: authenticationResponse.impersonator,\n    };\n\n    return sealData(sessionData, {\n      password: cookiePassword,\n    });\n  }\n\n  async getSessionFromCookie({\n    sessionData,\n    cookiePassword = getEnv('WORKOS_COOKIE_PASSWORD'),\n  }: SessionHandlerOptions): Promise<SessionCookieData | undefined> {\n    if (!cookiePassword) {\n      throw new Error('Cookie password is required');\n    }\n\n    if (sessionData) {\n      return unsealData<SessionCookieData>(sessionData, {\n        password: cookiePassword,\n      });\n    }\n\n    return undefined;\n  }\n\n  async getEmailVerification(\n    emailVerificationId: string,\n  ): Promise<EmailVerification> {\n    const { data } = await this.workos.get<EmailVerificationResponse>(\n      `/user_management/email_verification/${emailVerificationId}`,\n    );\n\n    return deserializeEmailVerification(data);\n  }\n\n  async sendVerificationEmail({\n    userId,\n  }: SendVerificationEmailOptions): Promise<{ user: User }> {\n    const { data } = await this.workos.post<{ user: UserResponse }>(\n      `/user_management/users/${userId}/email_verification/send`,\n      {},\n    );\n\n    return { user: deserializeUser(data.user) };\n  }\n\n  async getMagicAuth(magicAuthId: string): Promise<MagicAuth> {\n    const { data } = await this.workos.get<MagicAuthResponse>(\n      `/user_management/magic_auth/${magicAuthId}`,\n    );\n\n    return deserializeMagicAuth(data);\n  }\n\n  async createMagicAuth(options: CreateMagicAuthOptions): Promise<MagicAuth> {\n    const { data } = await this.workos.post<\n      MagicAuthResponse,\n      SerializedCreateMagicAuthOptions\n    >(\n      '/user_management/magic_auth',\n      serializeCreateMagicAuthOptions({\n        ...options,\n      }),\n    );\n\n    return deserializeMagicAuth(data);\n  }\n\n  async verifyEmail({\n    code,\n    userId,\n  }: VerifyEmailOptions): Promise<{ user: User }> {\n    const { data } = await this.workos.post<\n      { user: UserResponse },\n      SerializedVerifyEmailOptions\n    >(`/user_management/users/${userId}/email_verification/confirm`, {\n      code,\n    });\n\n    return { user: deserializeUser(data.user) };\n  }\n\n  async getPasswordReset(passwordResetId: string): Promise<PasswordReset> {\n    const { data } = await this.workos.get<PasswordResetResponse>(\n      `/user_management/password_reset/${passwordResetId}`,\n    );\n\n    return deserializePasswordReset(data);\n  }\n\n  async createPasswordReset(\n    options: CreatePasswordResetOptions,\n  ): Promise<PasswordReset> {\n    const { data } = await this.workos.post<\n      PasswordResetResponse,\n      SerializedCreatePasswordResetOptions\n    >(\n      '/user_management/password_reset',\n      serializeCreatePasswordResetOptions({\n        ...options,\n      }),\n    );\n\n    return deserializePasswordReset(data);\n  }\n\n  async resetPassword(payload: ResetPasswordOptions): Promise<{ user: User }> {\n    const { data } = await this.workos.post<\n      { user: UserResponse },\n      SerializedResetPasswordOptions\n    >(\n      '/user_management/password_reset/confirm',\n      serializeResetPasswordOptions(payload),\n    );\n\n    return { user: deserializeUser(data.user) };\n  }\n\n  async updateUser(payload: UpdateUserOptions): Promise<User> {\n    const { data } = await this.workos.put<UserResponse>(\n      `/user_management/users/${payload.userId}`,\n      serializeUpdateUserOptions(payload),\n    );\n\n    return deserializeUser(data);\n  }\n\n  async enrollAuthFactor(payload: EnrollAuthFactorOptions): Promise<{\n    authenticationFactor: FactorWithSecrets;\n    authenticationChallenge: Challenge;\n  }> {\n    const { data } = await this.workos.post<{\n      authentication_factor: FactorWithSecretsResponse;\n      authentication_challenge: ChallengeResponse;\n    }>(\n      `/user_management/users/${payload.userId}/auth_factors`,\n      serializeEnrollAuthFactorOptions(payload),\n    );\n\n    return {\n      authenticationFactor: deserializeFactorWithSecrets(\n        data.authentication_factor,\n      ),\n      authenticationChallenge: deserializeChallenge(\n        data.authentication_challenge,\n      ),\n    };\n  }\n\n  async listAuthFactors(\n    options: ListAuthFactorsOptions,\n  ): Promise<AutoPaginatable<Factor, PaginationOptions>> {\n    const { userId, ...restOfOptions } = options;\n    return new AutoPaginatable(\n      await fetchAndDeserialize<FactorResponse, Factor>(\n        this.workos,\n        `/user_management/users/${userId}/auth_factors`,\n        deserializeFactor,\n        restOfOptions,\n      ),\n      (params) =>\n        fetchAndDeserialize<FactorResponse, Factor>(\n          this.workos,\n          `/user_management/users/${userId}/auth_factors`,\n          deserializeFactor,\n          params,\n        ),\n      restOfOptions,\n    );\n  }\n\n  async listUserFeatureFlags(\n    options: ListUserFeatureFlagsOptions,\n  ): Promise<AutoPaginatable<FeatureFlag>> {\n    const { userId, ...paginationOptions } = options;\n\n    return new AutoPaginatable(\n      await fetchAndDeserialize<FeatureFlagResponse, FeatureFlag>(\n        this.workos,\n        `/user_management/users/${userId}/feature-flags`,\n        deserializeFeatureFlag,\n        paginationOptions,\n      ),\n      (params) =>\n        fetchAndDeserialize<FeatureFlagResponse, FeatureFlag>(\n          this.workos,\n          `/user_management/users/${userId}/feature-flags`,\n          deserializeFeatureFlag,\n          params,\n        ),\n      paginationOptions,\n    );\n  }\n\n  async listSessions(\n    userId: string,\n    options?: ListSessionsOptions,\n  ): Promise<AutoPaginatable<Session, SerializedListSessionsOptions>> {\n    return new AutoPaginatable(\n      await fetchAndDeserialize<SessionResponse, Session>(\n        this.workos,\n        `/user_management/users/${userId}/sessions`,\n        deserializeSession,\n        options ? serializeListSessionsOptions(options) : undefined,\n      ),\n      (params) =>\n        fetchAndDeserialize<SessionResponse, Session>(\n          this.workos,\n          `/user_management/users/${userId}/sessions`,\n          deserializeSession,\n          params,\n        ),\n      options ? serializeListSessionsOptions(options) : undefined,\n    );\n  }\n\n  async deleteUser(userId: string) {\n    await this.workos.delete(`/user_management/users/${userId}`);\n  }\n\n  async getUserIdentities(userId: string): Promise<Identity[]> {\n    if (!userId) {\n      throw new TypeError(`Incomplete arguments. Need to specify 'userId'.`);\n    }\n\n    const { data } = await this.workos.get<IdentityResponse[]>(\n      `/user_management/users/${userId}/identities`,\n    );\n\n    return deserializeIdentities(data);\n  }\n\n  async getOrganizationMembership(\n    organizationMembershipId: string,\n  ): Promise<OrganizationMembership> {\n    const { data } = await this.workos.get<OrganizationMembershipResponse>(\n      `/user_management/organization_memberships/${organizationMembershipId}`,\n    );\n\n    return deserializeOrganizationMembership(data);\n  }\n\n  async listOrganizationMemberships(\n    options: ListOrganizationMembershipsOptions,\n  ): Promise<\n    AutoPaginatable<\n      OrganizationMembership,\n      SerializedListOrganizationMembershipsOptions\n    >\n  > {\n    const serializedOptions =\n      serializeListOrganizationMembershipsOptions(options);\n\n    return new AutoPaginatable(\n      await fetchAndDeserialize<\n        OrganizationMembershipResponse,\n        OrganizationMembership\n      >(\n        this.workos,\n        '/user_management/organization_memberships',\n        deserializeOrganizationMembership,\n        serializedOptions,\n      ),\n      (params) =>\n        fetchAndDeserialize<\n          OrganizationMembershipResponse,\n          OrganizationMembership\n        >(\n          this.workos,\n          '/user_management/organization_memberships',\n          deserializeOrganizationMembership,\n          params,\n        ),\n      serializedOptions,\n    );\n  }\n\n  async createOrganizationMembership(\n    options: CreateOrganizationMembershipOptions,\n  ): Promise<OrganizationMembership> {\n    const { data } = await this.workos.post<\n      OrganizationMembershipResponse,\n      SerializedCreateOrganizationMembershipOptions\n    >(\n      '/user_management/organization_memberships',\n      serializeCreateOrganizationMembershipOptions(options),\n    );\n\n    return deserializeOrganizationMembership(data);\n  }\n\n  async updateOrganizationMembership(\n    organizationMembershipId: string,\n    options: UpdateOrganizationMembershipOptions,\n  ): Promise<OrganizationMembership> {\n    const { data } = await this.workos.put<\n      OrganizationMembershipResponse,\n      SerializedUpdateOrganizationMembershipOptions\n    >(\n      `/user_management/organization_memberships/${organizationMembershipId}`,\n      serializeUpdateOrganizationMembershipOptions(options),\n    );\n\n    return deserializeOrganizationMembership(data);\n  }\n\n  async deleteOrganizationMembership(\n    organizationMembershipId: string,\n  ): Promise<void> {\n    await this.workos.delete(\n      `/user_management/organization_memberships/${organizationMembershipId}`,\n    );\n  }\n\n  async deactivateOrganizationMembership(\n    organizationMembershipId: string,\n  ): Promise<OrganizationMembership> {\n    const { data } = await this.workos.put<OrganizationMembershipResponse>(\n      `/user_management/organization_memberships/${organizationMembershipId}/deactivate`,\n      {},\n    );\n\n    return deserializeOrganizationMembership(data);\n  }\n\n  async reactivateOrganizationMembership(\n    organizationMembershipId: string,\n  ): Promise<OrganizationMembership> {\n    const { data } = await this.workos.put<OrganizationMembershipResponse>(\n      `/user_management/organization_memberships/${organizationMembershipId}/reactivate`,\n      {},\n    );\n\n    return deserializeOrganizationMembership(data);\n  }\n\n  async getInvitation(invitationId: string): Promise<Invitation> {\n    const { data } = await this.workos.get<InvitationResponse>(\n      `/user_management/invitations/${invitationId}`,\n    );\n\n    return deserializeInvitation(data);\n  }\n\n  async findInvitationByToken(invitationToken: string): Promise<Invitation> {\n    const { data } = await this.workos.get<InvitationResponse>(\n      `/user_management/invitations/by_token/${invitationToken}`,\n    );\n\n    return deserializeInvitation(data);\n  }\n\n  async listInvitations(\n    options: ListInvitationsOptions,\n  ): Promise<AutoPaginatable<Invitation, SerializedListInvitationsOptions>> {\n    return new AutoPaginatable(\n      await fetchAndDeserialize<InvitationResponse, Invitation>(\n        this.workos,\n        '/user_management/invitations',\n        deserializeInvitation,\n        options ? serializeListInvitationsOptions(options) : undefined,\n      ),\n      (params) =>\n        fetchAndDeserialize<InvitationResponse, Invitation>(\n          this.workos,\n          '/user_management/invitations',\n          deserializeInvitation,\n          params,\n        ),\n      options ? serializeListInvitationsOptions(options) : undefined,\n    );\n  }\n\n  async sendInvitation(payload: SendInvitationOptions): Promise<Invitation> {\n    const { data } = await this.workos.post<\n      InvitationResponse,\n      SerializedSendInvitationOptions\n    >(\n      '/user_management/invitations',\n      serializeSendInvitationOptions({\n        ...payload,\n      }),\n    );\n\n    return deserializeInvitation(data);\n  }\n\n  async acceptInvitation(invitationId: string): Promise<Invitation> {\n    const { data } = await this.workos.post<InvitationResponse, any>(\n      `/user_management/invitations/${invitationId}/accept`,\n      null,\n    );\n\n    return deserializeInvitation(data);\n  }\n\n  async revokeInvitation(invitationId: string): Promise<Invitation> {\n    const { data } = await this.workos.post<InvitationResponse, any>(\n      `/user_management/invitations/${invitationId}/revoke`,\n      null,\n    );\n\n    return deserializeInvitation(data);\n  }\n\n  async revokeSession(payload: RevokeSessionOptions): Promise<void> {\n    await this.workos.post<void, SerializedRevokeSessionOptions>(\n      '/user_management/sessions/revoke',\n      serializeRevokeSessionOptions(payload),\n    );\n  }\n\n  getAuthorizationUrl(options: UserManagementAuthorizationURLOptions): string {\n    // Delegate to client implementation\n    return clientUserManagement.getAuthorizationUrl({\n      ...options,\n      baseURL: this.workos.baseURL,\n    });\n  }\n\n  getLogoutUrl(options: clientUserManagement.LogoutURLOptions): string {\n    // Delegate to client implementation\n    return clientUserManagement.getLogoutUrl({\n      ...options,\n      baseURL: this.workos.baseURL,\n    });\n  }\n\n  getJwksUrl(clientId: string): string {\n    // Delegate to client implementation\n    return clientUserManagement.getJwksUrl(clientId, this.workos.baseURL);\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,0BAAqC;AACrC,2BAAsC;AAEtC,mCAAoC;AACpC,wBAAgC;AAChC,iBAAuB;AAEvB,yBAAqC;AAKrC,IAAAA,uBAAuC;AAwDvC,8CAOO;AA6BP,oCAIO;AAUP,IAAAC,sBAqBO;AACP,kDAAkE;AAClE,8DAAsE;AACtE,IAAAC,iDAA6D;AAC7D,IAAAC,iBAAkC;AAClC,IAAAC,mBAAsC;AACtC,IAAAC,qBAAsC;AACtC,IAAAC,mCAAgD;AAChD,IAAAC,gDAA4D;AAC5D,gCAA0C;AAC1C,IAAAC,kCAAkD;AAClD,IAAAC,kCAA+C;AAC/C,IAAAC,iDAA6D;AAC7D,qBAA8B;AAC9B,kBAAwB;AAEjB,MAAM,eAAe;AAAA,EAM1B,YAA6B,QAAgB;AAAhB;AAC3B,UAAM,EAAE,SAAS,IAAI,OAAO;AAE5B,SAAK,WAAW;AAAA,EAClB;AAAA,EArKF,OA2J4B;AAAA;AAAA;AAAA,EAClB;AAAA,EAGD;AAAA,EAQP,MAAM,UAEJ;AACA,UAAM,EAAE,mBAAmB,IAAI,UAAM,qBAAQ;AAC7C,QAAI,CAAC,KAAK,UAAU;AAClB;AAAA,IACF;AAGA,SAAK,UAAU,mBAAmB,IAAI,IAAI,KAAK,WAAW,KAAK,QAAQ,CAAC,GAAG;AAAA,MACzE,kBAAkB,MAAO,KAAK;AAAA,IAChC,CAAC;AAED,WAAO,KAAK;AAAA,EACd;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,kBAAkB,SAGA;AAChB,WAAO,IAAI,6BAAc,MAAM,QAAQ,aAAa,QAAQ,cAAc;AAAA,EAC5E;AAAA,EAEA,MAAM,QAAQ,QAA+B;AAC3C,UAAM,EAAE,KAAK,IAAI,MAAM,KAAK,OAAO;AAAA,MACjC,0BAA0B,MAAM;AAAA,IAClC;AAEA,eAAO,qCAAgB,IAAI;AAAA,EAC7B;AAAA,EAEA,MAAM,oBAAoB,YAAmC;AAC3D,UAAM,EAAE,KAAK,IAAI,MAAM,KAAK,OAAO;AAAA,MACjC,sCAAsC,UAAU;AAAA,IAClD;AAEA,eAAO,qCAAgB,IAAI;AAAA,EAC7B;AAAA,EAEA,MAAM,UACJ,SAC4D;AAC5D,WAAO,IAAI;AAAA,MACT,UAAM;AAAA,QACJ,KAAK;AAAA,QACL;AAAA,QACA;AAAA,QACA,cAAU,qDAA0B,OAAO,IAAI;AAAA,MACjD;AAAA,MACA,CAAC,eACC;AAAA,QACE,KAAK;AAAA,QACL;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,MACF,cAAU,qDAA0B,OAAO,IAAI;AAAA,IACjD;AAAA,EACF;AAAA,EAEA,MAAM,WAAW,SAA2C;AAC1D,UAAM,EAAE,KAAK,IAAI,MAAM,KAAK,OAAO,KAGjC,8BAA0B,gDAA2B,OAAO,CAAC;AAE/D,eAAO,qCAAgB,IAAI;AAAA,EAC7B;AAAA,EAEA,MAAM,0BACJ,SACiC;AACjC,UAAM,EAAE,SAAS,GAAG,iBAAiB,IAAI;AAEzC,UAAM,EAAE,KAAK,IAAI,MAAM,KAAK,OAAO;AAAA,MAIjC;AAAA,UACA,+DAA0C;AAAA,QACxC,GAAG;AAAA,QACH,cAAc,KAAK,OAAO;AAAA,MAC5B,CAAC;AAAA,IACH;AAEA,WAAO,KAAK,8BAA8B;AAAA,MACxC,4BAAwB,uDAAkC,IAAI;AAAA,MAC9D;AAAA,IACF,CAAC;AAAA,EACH;AAAA,EAEA,MAAM,yBACJ,SACiC;AACjC,UAAM,EAAE,SAAS,GAAG,iBAAiB,IAAI;AAEzC,UAAM,EAAE,KAAK,IAAI,MAAM,KAAK,OAAO;AAAA,MAIjC;AAAA,UACA,8DAAyC;AAAA,QACvC,GAAG;AAAA,QACH,cAAc,KAAK,OAAO;AAAA,MAC5B,CAAC;AAAA,IACH;AAEA,WAAO,KAAK,8BAA8B;AAAA,MACxC,4BAAwB,uDAAkC,IAAI;AAAA,MAC9D;AAAA,IACF,CAAC;AAAA,EACH;AAAA,EAEA,MAAM,qBACJ,SACiC;AACjC,UAAM,EAAE,SAAS,GAAG,iBAAiB,IAAI;AAEzC,UAAM,EAAE,KAAK,IAAI,MAAM,KAAK,OAAO;AAAA,MAIjC;AAAA,UACA,0DAAqC;AAAA,QACnC,GAAG;AAAA,QACH,cAAc,KAAK,OAAO;AAAA,MAC5B,CAAC;AAAA,IACH;AAEA,WAAO,KAAK,8BAA8B;AAAA,MACxC,4BAAwB,uDAAkC,IAAI;AAAA,MAC9D;AAAA,IACF,CAAC;AAAA,EACH;AAAA,EAEA,MAAM,gCACJ,SACiC;AACjC,UAAM,EAAE,SAAS,GAAG,iBAAiB,IAAI;AAEzC,UAAM,EAAE,KAAK,IAAI,MAAM,KAAK,OAAO;AAAA,MAIjC;AAAA,UACA,qEAAgD,gBAAgB;AAAA,IAClE;AAEA,WAAO,KAAK,8BAA8B;AAAA,MACxC,4BAAwB,uDAAkC,IAAI;AAAA,MAC9D;AAAA,IACF,CAAC;AAAA,EACH;AAAA,EAEA,MAAM,6BACJ,SACiC;AACjC,UAAM,EAAE,SAAS,GAAG,iBAAiB,IAAI;AAEzC,UAAM,EAAE,KAAK,IAAI,MAAM,KAAK,OAAO;AAAA,MAIjC;AAAA,UACA,kEAA6C;AAAA,QAC3C,GAAG;AAAA,QACH,cAAc,KAAK,OAAO;AAAA,MAC5B,CAAC;AAAA,IACH;AAEA,WAAO,KAAK,8BAA8B;AAAA,MACxC,4BAAwB,uDAAkC,IAAI;AAAA,MAC9D;AAAA,IACF,CAAC;AAAA,EACH;AAAA,EAEA,MAAM,qBACJ,SACiC;AACjC,UAAM,EAAE,SAAS,GAAG,iBAAiB,IAAI;AAEzC,UAAM,EAAE,KAAK,IAAI,MAAM,KAAK,OAAO;AAAA,MAIjC;AAAA,UACA,0DAAqC;AAAA,QACnC,GAAG;AAAA,QACH,cAAc,KAAK,OAAO;AAAA,MAC5B,CAAC;AAAA,IACH;AAEA,WAAO,KAAK,8BAA8B;AAAA,MACxC,4BAAwB,uDAAkC,IAAI;AAAA,MAC9D;AAAA,IACF,CAAC;AAAA,EACH;AAAA,EAEA,MAAM,kCACJ,SACiC;AACjC,UAAM,EAAE,SAAS,GAAG,iBAAiB,IAAI;AAEzC,UAAM,EAAE,KAAK,IAAI,MAAM,KAAK,OAAO;AAAA,MAIjC;AAAA,UACA,+FAAkD;AAAA,QAChD,GAAG;AAAA,QACH,cAAc,KAAK,OAAO;AAAA,MAC5B,CAAC;AAAA,IACH;AAEA,WAAO,KAAK,8BAA8B;AAAA,MACxC,4BAAwB,uDAAkC,IAAI;AAAA,MAC9D;AAAA,IACF,CAAC;AAAA,EACH;AAAA,EAEA,MAAM,sCACJ,SACiC;AACjC,UAAM,EAAE,SAAS,GAAG,iBAAiB,IAAI;AAEzC,UAAM,EAAE,KAAK,IAAI,MAAM,KAAK,OAAO;AAAA,MAIjC;AAAA,UACA,+GAAsD;AAAA,QACpD,GAAG;AAAA,QACH,cAAc,KAAK,OAAO;AAAA,MAC5B,CAAC;AAAA,IACH;AAEA,WAAO,KAAK,8BAA8B;AAAA,MACxC,4BAAwB,uDAAkC,IAAI;AAAA,MAC9D;AAAA,IACF,CAAC;AAAA,EACH;AAAA,EAEA,MAAM,8BAA8B;AAAA,IAClC;AAAA,IACA,qBAAiB,mBAAO,wBAAwB;AAAA,EAClD,GAGE;AACA,QAAI,CAAC,gBAAgB;AACnB,YAAM,IAAI,MAAM,6BAA6B;AAAA,IAC/C;AAEA,UAAM,OAAO,MAAM,KAAK,QAAQ;AAEhC,QAAI,CAAC,MAAM;AACT,YAAM,IAAI,MAAM,0CAA0C;AAAA,IAC5D;AAEA,UAAM,EAAE,UAAU,IAAI,UAAM,qBAAQ;AAEpC,QAAI,CAAC,aAAa;AAChB,aAAO;AAAA,QACL,eAAe;AAAA,QACf,QACE,mFAA2C;AAAA,MAC/C;AAAA,IACF;AAEA,UAAM,UAAU,UAAM,gCAA8B,aAAa;AAAA,MAC/D,UAAU;AAAA,IACZ,CAAC;AAED,QAAI,CAAC,QAAQ,aAAa;AACxB,aAAO;AAAA,QACL,eAAe;AAAA,QACf,QACE,mFAA2C;AAAA,MAC/C;AAAA,IACF;AAEA,QAAI,CAAE,MAAM,KAAK,WAAW,QAAQ,WAAW,GAAI;AACjD,aAAO;AAAA,QACL,eAAe;AAAA,QACf,QAAQ,mFAA2C;AAAA,MACrD;AAAA,IACF;AAEA,UAAM;AAAA,MACJ,KAAK;AAAA,MACL,QAAQ;AAAA,MACR;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,eAAe;AAAA,IACjB,IAAI,UAAuB,QAAQ,WAAW;AAE9C,WAAO;AAAA,MACL,eAAe;AAAA,MACf;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,MAAM,QAAQ;AAAA,MACd;AAAA,MACA;AAAA,MACA;AAAA,MACA,aAAa,QAAQ;AAAA,IACvB;AAAA,EACF;AAAA,EAEA,MAAc,WAAW,aAAuC;AAC9D,UAAM,OAAO,MAAM,KAAK,QAAQ;AAChC,UAAM,EAAE,UAAU,IAAI,UAAM,qBAAQ;AACpC,QAAI,CAAC,MAAM;AACT,YAAM,IAAI,MAAM,0CAA0C;AAAA,IAC5D;AAEA,QAAI;AACF,YAAM,UAAU,aAAa,IAAI;AACjC,aAAO;AAAA,IACT,SAAS,GAAG;AACV,aAAO;AAAA,IACT;AAAA,EACF;AAAA,EAEA,MAAc,8BAA8B;AAAA,IAC1C;AAAA,IACA;AAAA,EACF,GAGoC;AAClC,QAAI,SAAS,aAAa;AACxB,aAAO;AAAA,QACL,GAAG;AAAA,QACH,eAAe,MAAM,KAAK,0CAA0C;AAAA,UAClE;AAAA,UACA,gBAAgB,QAAQ;AAAA,QAC1B,CAAC;AAAA,MACH;AAAA,IACF;AAEA,WAAO;AAAA,EACT;AAAA,EAEA,MAAc,0CAA0C;AAAA,IACtD;AAAA,IACA;AAAA,EACF,GAGoB;AAClB,QAAI,CAAC,gBAAgB;AACnB,YAAM,IAAI,MAAM,6BAA6B;AAAA,IAC/C;AAEA,UAAM,EAAE,UAAU,IAAI,UAAM,qBAAQ;AAEpC,UAAM,EAAE,QAAQ,8BAA8B,IAAI;AAAA,MAChD,uBAAuB;AAAA,IACzB;AAEA,UAAM,cAAiC;AAAA,MACrC,gBAAgB;AAAA,MAChB,MAAM,uBAAuB;AAAA,MAC7B,aAAa,uBAAuB;AAAA,MACpC,cAAc,uBAAuB;AAAA,MACrC,cAAc,uBAAuB;AAAA,IACvC;AAEA,eAAO,8BAAS,aAAa;AAAA,MAC3B,UAAU;AAAA,IACZ,CAAC;AAAA,EACH;AAAA,EAEA,MAAM,qBAAqB;AAAA,IACzB;AAAA,IACA,qBAAiB,mBAAO,wBAAwB;AAAA,EAClD,GAAkE;AAChE,QAAI,CAAC,gBAAgB;AACnB,YAAM,IAAI,MAAM,6BAA6B;AAAA,IAC/C;AAEA,QAAI,aAAa;AACf,iBAAO,gCAA8B,aAAa;AAAA,QAChD,UAAU;AAAA,MACZ,CAAC;AAAA,IACH;AAEA,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,qBACJ,qBAC4B;AAC5B,UAAM,EAAE,KAAK,IAAI,MAAM,KAAK,OAAO;AAAA,MACjC,uCAAuC,mBAAmB;AAAA,IAC5D;AAEA,eAAO,kDAA6B,IAAI;AAAA,EAC1C;AAAA,EAEA,MAAM,sBAAsB;AAAA,IAC1B;AAAA,EACF,GAA0D;AACxD,UAAM,EAAE,KAAK,IAAI,MAAM,KAAK,OAAO;AAAA,MACjC,0BAA0B,MAAM;AAAA,MAChC,CAAC;AAAA,IACH;AAEA,WAAO,EAAE,UAAM,qCAAgB,KAAK,IAAI,EAAE;AAAA,EAC5C;AAAA,EAEA,MAAM,aAAa,aAAyC;AAC1D,UAAM,EAAE,KAAK,IAAI,MAAM,KAAK,OAAO;AAAA,MACjC,+BAA+B,WAAW;AAAA,IAC5C;AAEA,eAAO,0CAAqB,IAAI;AAAA,EAClC;AAAA,EAEA,MAAM,gBAAgB,SAAqD;AACzE,UAAM,EAAE,KAAK,IAAI,MAAM,KAAK,OAAO;AAAA,MAIjC;AAAA,UACA,qDAAgC;AAAA,QAC9B,GAAG;AAAA,MACL,CAAC;AAAA,IACH;AAEA,eAAO,0CAAqB,IAAI;AAAA,EAClC;AAAA,EAEA,MAAM,YAAY;AAAA,IAChB;AAAA,IACA;AAAA,EACF,GAAgD;AAC9C,UAAM,EAAE,KAAK,IAAI,MAAM,KAAK,OAAO,KAGjC,0BAA0B,MAAM,+BAA+B;AAAA,MAC/D;AAAA,IACF,CAAC;AAED,WAAO,EAAE,UAAM,qCAAgB,KAAK,IAAI,EAAE;AAAA,EAC5C;AAAA,EAEA,MAAM,iBAAiB,iBAAiD;AACtE,UAAM,EAAE,KAAK,IAAI,MAAM,KAAK,OAAO;AAAA,MACjC,mCAAmC,eAAe;AAAA,IACpD;AAEA,eAAO,8CAAyB,IAAI;AAAA,EACtC;AAAA,EAEA,MAAM,oBACJ,SACwB;AACxB,UAAM,EAAE,KAAK,IAAI,MAAM,KAAK,OAAO;AAAA,MAIjC;AAAA,UACA,yDAAoC;AAAA,QAClC,GAAG;AAAA,MACL,CAAC;AAAA,IACH;AAEA,eAAO,8CAAyB,IAAI;AAAA,EACtC;AAAA,EAEA,MAAM,cAAc,SAAwD;AAC1E,UAAM,EAAE,KAAK,IAAI,MAAM,KAAK,OAAO;AAAA,MAIjC;AAAA,UACA,mDAA8B,OAAO;AAAA,IACvC;AAEA,WAAO,EAAE,UAAM,qCAAgB,KAAK,IAAI,EAAE;AAAA,EAC5C;AAAA,EAEA,MAAM,WAAW,SAA2C;AAC1D,UAAM,EAAE,KAAK,IAAI,MAAM,KAAK,OAAO;AAAA,MACjC,0BAA0B,QAAQ,MAAM;AAAA,UACxC,gDAA2B,OAAO;AAAA,IACpC;AAEA,eAAO,qCAAgB,IAAI;AAAA,EAC7B;AAAA,EAEA,MAAM,iBAAiB,SAGpB;AACD,UAAM,EAAE,KAAK,IAAI,MAAM,KAAK,OAAO;AAAA,MAIjC,0BAA0B,QAAQ,MAAM;AAAA,UACxC,sDAAiC,OAAO;AAAA,IAC1C;AAEA,WAAO;AAAA,MACL,0BAAsB;AAAA,QACpB,KAAK;AAAA,MACP;AAAA,MACA,6BAAyB;AAAA,QACvB,KAAK;AAAA,MACP;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,gBACJ,SACqD;AACrD,UAAM,EAAE,QAAQ,GAAG,cAAc,IAAI;AACrC,WAAO,IAAI;AAAA,MACT,UAAM;AAAA,QACJ,KAAK;AAAA,QACL,0BAA0B,MAAM;AAAA,QAChC;AAAA,QACA;AAAA,MACF;AAAA,MACA,CAAC,eACC;AAAA,QACE,KAAK;AAAA,QACL,0BAA0B,MAAM;AAAA,QAChC;AAAA,QACA;AAAA,MACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,qBACJ,SACuC;AACvC,UAAM,EAAE,QAAQ,GAAG,kBAAkB,IAAI;AAEzC,WAAO,IAAI;AAAA,MACT,UAAM;AAAA,QACJ,KAAK;AAAA,QACL,0BAA0B,MAAM;AAAA,QAChC;AAAA,QACA;AAAA,MACF;AAAA,MACA,CAAC,eACC;AAAA,QACE,KAAK;AAAA,QACL,0BAA0B,MAAM;AAAA,QAChC;AAAA,QACA;AAAA,MACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,aACJ,QACA,SACkE;AAClE,WAAO,IAAI;AAAA,MACT,UAAM;AAAA,QACJ,KAAK;AAAA,QACL,0BAA0B,MAAM;AAAA,QAChC;AAAA,QACA,cAAU,kDAA6B,OAAO,IAAI;AAAA,MACpD;AAAA,MACA,CAAC,eACC;AAAA,QACE,KAAK;AAAA,QACL,0BAA0B,MAAM;AAAA,QAChC;AAAA,QACA;AAAA,MACF;AAAA,MACF,cAAU,kDAA6B,OAAO,IAAI;AAAA,IACpD;AAAA,EACF;AAAA,EAEA,MAAM,WAAW,QAAgB;AAC/B,UAAM,KAAK,OAAO,OAAO,0BAA0B,MAAM,EAAE;AAAA,EAC7D;AAAA,EAEA,MAAM,kBAAkB,QAAqC;AAC3D,QAAI,CAAC,QAAQ;AACX,YAAM,IAAI,UAAU,iDAAiD;AAAA,IACvE;AAEA,UAAM,EAAE,KAAK,IAAI,MAAM,KAAK,OAAO;AAAA,MACjC,0BAA0B,MAAM;AAAA,IAClC;AAEA,eAAO,wCAAsB,IAAI;AAAA,EACnC;AAAA,EAEA,MAAM,0BACJ,0BACiC;AACjC,UAAM,EAAE,KAAK,IAAI,MAAM,KAAK,OAAO;AAAA,MACjC,6CAA6C,wBAAwB;AAAA,IACvE;AAEA,eAAO,mEAAkC,IAAI;AAAA,EAC/C;AAAA,EAEA,MAAM,4BACJ,SAMA;AACA,UAAM,wBACJ,2FAA4C,OAAO;AAErD,WAAO,IAAI;AAAA,MACT,UAAM;AAAA,QAIJ,KAAK;AAAA,QACL;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,MACA,CAAC,eACC;AAAA,QAIE,KAAK;AAAA,QACL;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,6BACJ,SACiC;AACjC,UAAM,EAAE,KAAK,IAAI,MAAM,KAAK,OAAO;AAAA,MAIjC;AAAA,UACA,6FAA6C,OAAO;AAAA,IACtD;AAEA,eAAO,mEAAkC,IAAI;AAAA,EAC/C;AAAA,EAEA,MAAM,6BACJ,0BACA,SACiC;AACjC,UAAM,EAAE,KAAK,IAAI,MAAM,KAAK,OAAO;AAAA,MAIjC,6CAA6C,wBAAwB;AAAA,UACrE,6FAA6C,OAAO;AAAA,IACtD;AAEA,eAAO,mEAAkC,IAAI;AAAA,EAC/C;AAAA,EAEA,MAAM,6BACJ,0BACe;AACf,UAAM,KAAK,OAAO;AAAA,MAChB,6CAA6C,wBAAwB;AAAA,IACvE;AAAA,EACF;AAAA,EAEA,MAAM,iCACJ,0BACiC;AACjC,UAAM,EAAE,KAAK,IAAI,MAAM,KAAK,OAAO;AAAA,MACjC,6CAA6C,wBAAwB;AAAA,MACrE,CAAC;AAAA,IACH;AAEA,eAAO,mEAAkC,IAAI;AAAA,EAC/C;AAAA,EAEA,MAAM,iCACJ,0BACiC;AACjC,UAAM,EAAE,KAAK,IAAI,MAAM,KAAK,OAAO;AAAA,MACjC,6CAA6C,wBAAwB;AAAA,MACrE,CAAC;AAAA,IACH;AAEA,eAAO,mEAAkC,IAAI;AAAA,EAC/C;AAAA,EAEA,MAAM,cAAc,cAA2C;AAC7D,UAAM,EAAE,KAAK,IAAI,MAAM,KAAK,OAAO;AAAA,MACjC,gCAAgC,YAAY;AAAA,IAC9C;AAEA,eAAO,0CAAsB,IAAI;AAAA,EACnC;AAAA,EAEA,MAAM,sBAAsB,iBAA8C;AACxE,UAAM,EAAE,KAAK,IAAI,MAAM,KAAK,OAAO;AAAA,MACjC,yCAAyC,eAAe;AAAA,IAC1D;AAEA,eAAO,0CAAsB,IAAI;AAAA,EACnC;AAAA,EAEA,MAAM,gBACJ,SACwE;AACxE,WAAO,IAAI;AAAA,MACT,UAAM;AAAA,QACJ,KAAK;AAAA,QACL;AAAA,QACA;AAAA,QACA,cAAU,kEAAgC,OAAO,IAAI;AAAA,MACvD;AAAA,MACA,CAAC,eACC;AAAA,QACE,KAAK;AAAA,QACL;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,MACF,cAAU,kEAAgC,OAAO,IAAI;AAAA,IACvD;AAAA,EACF;AAAA,EAEA,MAAM,eAAe,SAAqD;AACxE,UAAM,EAAE,KAAK,IAAI,MAAM,KAAK,OAAO;AAAA,MAIjC;AAAA,UACA,gEAA+B;AAAA,QAC7B,GAAG;AAAA,MACL,CAAC;AAAA,IACH;AAEA,eAAO,0CAAsB,IAAI;AAAA,EACnC;AAAA,EAEA,MAAM,iBAAiB,cAA2C;AAChE,UAAM,EAAE,KAAK,IAAI,MAAM,KAAK,OAAO;AAAA,MACjC,gCAAgC,YAAY;AAAA,MAC5C;AAAA,IACF;AAEA,eAAO,0CAAsB,IAAI;AAAA,EACnC;AAAA,EAEA,MAAM,iBAAiB,cAA2C;AAChE,UAAM,EAAE,KAAK,IAAI,MAAM,KAAK,OAAO;AAAA,MACjC,gCAAgC,YAAY;AAAA,MAC5C;AAAA,IACF;AAEA,eAAO,0CAAsB,IAAI;AAAA,EACnC;AAAA,EAEA,MAAM,cAAc,SAA8C;AAChE,UAAM,KAAK,OAAO;AAAA,MAChB;AAAA,UACA,6DAA8B,OAAO;AAAA,IACvC;AAAA,EACF;AAAA,EAEA,oBAAoB,SAAwD;AAE1E,WAAO,qBAAqB,oBAAoB;AAAA,MAC9C,GAAG;AAAA,MACH,SAAS,KAAK,OAAO;AAAA,IACvB,CAAC;AAAA,EACH;AAAA,EAEA,aAAa,SAAwD;AAEnE,WAAO,qBAAqB,aAAa;AAAA,MACvC,GAAG;AAAA,MACH,SAAS,KAAK,OAAO;AAAA,IACvB,CAAC;AAAA,EACH;AAAA,EAEA,WAAW,UAA0B;AAEnC,WAAO,qBAAqB,WAAW,UAAU,KAAK,OAAO,OAAO;AAAA,EACtE;AACF;","names":["import_feature_flag","import_serializers","import_create_organization_membership_options","import_factor","import_identity","import_invitation","import_list_invitations_options","import_list_organization_memberships_options","import_organization_membership","import_send_invitation_options","import_update_organization_membership_options"]}

package/lib/cjs/user-management/user-management.d.cts

@@ -4,7 +4,7 @@ import '../common/interfaces/pagination-options.interface.cjs';
 import '../common/utils/pagination.cjs';
 import '../mfa/interfaces/challenge.interface.cjs';
 import '../feature-flags/interfaces/feature-flag.interface.cjs';
-export { U as UserManagement } from '../workos-BcNRiAbw.cjs';
+export { U as UserManagement } from '../workos-X1cDErJB.cjs';
 import './interfaces/authenticate-with-code-options.interface.cjs';
 import './interfaces/authenticate-with-code-and-verifier-options.interface.cjs';
 import './interfaces/authenticate-with-email-verification-options.interface.cjs';
@@ -50,12 +50,15 @@ import '../common/interfaces/post-options.interface.cjs';
 import '../common/interfaces/put-options.interface.cjs';
 import '../common/interfaces/workos-options.interface.cjs';
 import '../common/interfaces/app-info.interface.cjs';
-import '../events/interfaces/list-events-options.interface.cjs';
-import '../common/interfaces/event.interface.cjs';
 import '../directory-sync/interfaces/directory.interface.cjs';
 import '../directory-sync/interfaces/directory-group.interface.cjs';
+import '../directory-sync/interfaces/list-directories-options.interface.cjs';
+import '../directory-sync/interfaces/list-groups-options.interface.cjs';
+import '../directory-sync/interfaces/list-directory-users-options.interface.cjs';
 import '../directory-sync/interfaces/directory-user.interface.cjs';
 import '../roles/interfaces/role.interface.cjs';
+import '../events/interfaces/list-events-options.interface.cjs';
+import '../common/interfaces/event.interface.cjs';
 import '../organizations/interfaces/organization.interface.cjs';
 import '../organization-domains/interfaces/organization-domain.interface.cjs';
 import '../sso/interfaces/connection.interface.cjs';
@@ -121,8 +124,7 @@ import '../vault/interfaces/object/delete-object.interface.cjs';
 import '../vault/interfaces/object/read-object.interface.cjs';
 import '../vault/interfaces/object.interface.cjs';
 import '../vault/interfaces/object/update-object.interface.cjs';
-import '../directory-sync/interfaces/list-directories-options.interface.cjs';
-import '../directory-sync/interfaces/list-groups-options.interface.cjs';
-import '../directory-sync/interfaces/list-directory-users-options.interface.cjs';
+import '../api-keys/interfaces/validate-api-key.interface.cjs';
+import '../api-keys/interfaces/api-key.interface.cjs';
 import './interfaces/authenticate-with-options-base.interface.cjs';
 import './interfaces/password-hash-type.interface.cjs';

package/lib/cjs/{client/utils.cjs → utils/jose.cjs}

@@ -27,23 +27,18 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
   mod
 ));
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
-var utils_exports = {};
-__export(utils_exports, {
-  toQueryString: () => toQueryString
+var jose_exports = {};
+__export(jose_exports, {
+  getJose: () => getJose
 });
-module.exports = __toCommonJS(utils_exports);
-var import_qs = __toESM(require("qs"), 1);
-const toQueryString = /* @__PURE__ */ __name((options) => {
-  return import_qs.default.stringify(options, {
-    arrayFormat: "repeat",
-    // sorts the keys alphabetically to maintain backwards compatibility
-    sort: /* @__PURE__ */ __name((a, b) => a.localeCompare(b), "sort"),
-    // encodes space as + instead of %20 to maintain backwards compatibility
-    format: "RFC1738"
-  });
-}, "toQueryString");
+module.exports = __toCommonJS(jose_exports);
+let _josePromise;
+function getJose() {
+  return _josePromise ??= import("jose");
+}
+__name(getJose, "getJose");
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
-  toQueryString
+  getJose
 });
-//# sourceMappingURL=utils.cjs.map
+//# sourceMappingURL=jose.cjs.map

package/lib/cjs/utils/jose.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/utils/jose.ts"],"sourcesContent":["let _josePromise: Promise<typeof import('jose')> | undefined;\n\n/**\n * Dynamically imports the jose library using import() to support Node.js 20.0-20.18.\n *\n * The jose library is ESM-only and cannot be loaded via require() in Node.js versions\n * before 20.19.0. This wrapper uses dynamic import() which works in both ESM and CJS\n * across all Node.js 20+ versions.\n *\n * This workaround can be removed when Node.js 20 reaches end-of-life (April 2026),\n * at which point we can bump to Node.js 22+ and use direct imports.\n *\n * @returns Promise that resolves to the jose module\n */\nexport function getJose() {\n  return (_josePromise ??= import('jose'));\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAAI;AAcG,SAAS,UAAU;AACxB,SAAQ,iBAAiB,OAAO,MAAM;AACxC;AAFgB;","names":[]}

package/lib/cjs/utils/jose.d.cts

@@ -0,0 +1,17 @@
+import * as jose from 'jose';
+
+/**
+ * Dynamically imports the jose library using import() to support Node.js 20.0-20.18.
+ *
+ * The jose library is ESM-only and cannot be loaded via require() in Node.js versions
+ * before 20.19.0. This wrapper uses dynamic import() which works in both ESM and CJS
+ * across all Node.js 20+ versions.
+ *
+ * This workaround can be removed when Node.js 20 reaches end-of-life (April 2026),
+ * at which point we can bump to Node.js 22+ and use direct imports.
+ *
+ * @returns Promise that resolves to the jose module
+ */
+declare function getJose(): Promise<typeof jose>;
+
+export { getJose };

package/lib/cjs/vault/vault.cjs

@@ -22,7 +22,7 @@ __export(vault_exports, {
   Vault: () => Vault
 });
 module.exports = __toCommonJS(vault_exports);
-var import_leb = require("leb");
+var import_leb128 = require('../common/utils/leb128.cjs');
 var import_base64 = require('../common/utils/base64.cjs');
 var import_vault_key = require('./serializers/vault-key.serializer.cjs');
 var import_vault_object = require('./serializers/vault-object.serializer.cjs');
@@ -39,7 +39,7 @@ class Vault {
     const inputData = (0, import_base64.base64ToUint8Array)(payload);
     const iv = new Uint8Array(inputData.subarray(0, 12));
     const tag = new Uint8Array(inputData.subarray(12, 28));
-    const { value: keyLen, nextIndex } = (0, import_leb.decodeUInt32)(inputData, 28);
+    const { value: keyLen, nextIndex } = (0, import_leb128.decodeUInt32)(inputData, 28);
     const keysBuffer = inputData.subarray(nextIndex, nextIndex + keyLen);
     const keys = (0, import_base64.uint8ArrayToBase64)(keysBuffer);
     const ciphertext = new Uint8Array(inputData.subarray(nextIndex + keyLen));
@@ -119,7 +119,7 @@ class Vault {
     const encoder = new TextEncoder();
     const key = (0, import_base64.base64ToUint8Array)(keyPair.dataKey.key);
     const keyBlob = (0, import_base64.base64ToUint8Array)(keyPair.encryptedKeys);
-    const prefixLenBuffer = (0, import_leb.encodeUInt32)(keyBlob.length);
+    const prefixLenBuffer = (0, import_leb128.encodeUInt32)(keyBlob.length);
     const aadBuffer = associatedData ? encoder.encode(associatedData) : void 0;
     const iv = this.cryptoProvider.randomBytes(12);
     const {

package/lib/cjs/vault/vault.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/vault/vault.ts"],"sourcesContent":["import { decodeUInt32, encodeUInt32 } from 'leb';\nimport { CryptoProvider } from '../common/crypto/crypto-provider';\nimport { List, ListResponse } from '../common/interfaces';\nimport { PaginationOptions } from '../index.worker';\nimport { base64ToUint8Array, uint8ArrayToBase64 } from '../common/utils/base64';\nimport type { WorkOS } from '../workos';\nimport {\n  CreateDataKeyOptions,\n  CreateDataKeyResponse,\n  CreateObjectOptions,\n  DataKey,\n  DataKeyPair,\n  DecryptDataKeyOptions,\n  DecryptDataKeyResponse,\n  DeleteObjectOptions,\n  KeyContext,\n  ListObjectVersionsResponse,\n  ObjectDigest,\n  ObjectDigestResponse,\n  ObjectMetadata,\n  ObjectVersion,\n  ReadObjectMetadataResponse,\n  ReadObjectOptions,\n  ReadObjectResponse,\n  UpdateObjectOptions,\n  VaultObject,\n} from './interfaces';\nimport {\n  deserializeCreateDataKeyResponse,\n  deserializeDecryptDataKeyResponse,\n} from './serializers/vault-key.serializer';\nimport {\n  deserializeListObjects,\n  deserializeObject,\n  deserializeObjectMetadata,\n  desrializeListObjectVersions,\n  serializeCreateObjectEntity,\n  serializeUpdateObjectEntity,\n} from './serializers/vault-object.serializer';\n\ninterface Decoded {\n  iv: Uint8Array;\n  tag: Uint8Array;\n  keys: string;\n  ciphertext: Uint8Array;\n}\n\nexport class Vault {\n  private cryptoProvider: CryptoProvider;\n\n  constructor(private readonly workos: WorkOS) {\n    this.cryptoProvider = workos.getCryptoProvider();\n  }\n\n  private decode(payload: string): Decoded {\n    const inputData = base64ToUint8Array(payload);\n    // Use 12 bytes for IV (standard for AES-GCM)\n    const iv = new Uint8Array(inputData.subarray(0, 12));\n    const tag = new Uint8Array(inputData.subarray(12, 28));\n    const { value: keyLen, nextIndex } = decodeUInt32(inputData, 28);\n\n    // Use subarray instead of slice and convert directly to base64\n    const keysBuffer = inputData.subarray(nextIndex, nextIndex + keyLen);\n    const keys = uint8ArrayToBase64(keysBuffer);\n\n    const ciphertext = new Uint8Array(inputData.subarray(nextIndex + keyLen));\n\n    return {\n      iv,\n      tag,\n      keys,\n      ciphertext,\n    };\n  }\n\n  async createObject(options: CreateObjectOptions): Promise<ObjectMetadata> {\n    const { data } = await this.workos.post<ReadObjectMetadataResponse>(\n      `/vault/v1/kv`,\n      serializeCreateObjectEntity(options),\n    );\n    return deserializeObjectMetadata(data);\n  }\n\n  async listObjects(\n    options?: PaginationOptions | undefined,\n  ): Promise<List<ObjectDigest>> {\n    const url = new URL('/vault/v1/kv', this.workos.baseURL);\n    if (options?.after) {\n      url.searchParams.set('after', options.after);\n    }\n    if (options?.limit) {\n      url.searchParams.set('limit', options.limit.toString());\n    }\n\n    const { data } = await this.workos.get<ListResponse<ObjectDigestResponse>>(\n      url.toString(),\n    );\n    return deserializeListObjects(data);\n  }\n\n  async listObjectVersions(\n    options: ReadObjectOptions,\n  ): Promise<ObjectVersion[]> {\n    const { data } = await this.workos.get<ListObjectVersionsResponse>(\n      `/vault/v1/kv/${encodeURIComponent(options.id)}/versions`,\n    );\n    return desrializeListObjectVersions(data);\n  }\n\n  async readObject(options: ReadObjectOptions): Promise<VaultObject> {\n    const { data } = await this.workos.get<ReadObjectResponse>(\n      `/vault/v1/kv/${encodeURIComponent(options.id)}`,\n    );\n    return deserializeObject(data);\n  }\n\n  async describeObject(options: ReadObjectOptions): Promise<VaultObject> {\n    const { data } = await this.workos.get<ReadObjectResponse>(\n      `/vault/v1/kv/${encodeURIComponent(options.id)}/metadata`,\n    );\n    return deserializeObject(data);\n  }\n\n  async updateObject(options: UpdateObjectOptions): Promise<VaultObject> {\n    const { data } = await this.workos.put<ReadObjectResponse>(\n      `/vault/v1/kv/${encodeURIComponent(options.id)}`,\n      serializeUpdateObjectEntity(options),\n    );\n    return deserializeObject(data);\n  }\n\n  async deleteObject(options: DeleteObjectOptions): Promise<void> {\n    return this.workos.delete(`/vault/v1/kv/${encodeURIComponent(options.id)}`);\n  }\n\n  async createDataKey(options: CreateDataKeyOptions): Promise<DataKeyPair> {\n    const { data } = await this.workos.post<CreateDataKeyResponse>(\n      `/vault/v1/keys/data-key`,\n      options,\n    );\n    return deserializeCreateDataKeyResponse(data);\n  }\n\n  async decryptDataKey(options: DecryptDataKeyOptions): Promise<DataKey> {\n    const { data } = await this.workos.post<DecryptDataKeyResponse>(\n      `/vault/v1/keys/decrypt`,\n      options,\n    );\n    return deserializeDecryptDataKeyResponse(data);\n  }\n\n  async encrypt(\n    data: string,\n    context: KeyContext,\n    associatedData?: string,\n  ): Promise<string> {\n    const keyPair = await this.createDataKey({\n      context,\n    });\n\n    // Convert base64 key to Uint8Array\n    const encoder = new TextEncoder();\n\n    // Use our cross-runtime base64 utility\n    const key = base64ToUint8Array(keyPair.dataKey.key);\n    const keyBlob = base64ToUint8Array(keyPair.encryptedKeys);\n\n    const prefixLenBuffer = encodeUInt32(keyBlob.length);\n    const aadBuffer = associatedData\n      ? encoder.encode(associatedData)\n      : undefined;\n\n    // Use a 12-byte IV for AES-GCM (industry standard)\n    const iv = this.cryptoProvider.randomBytes(12);\n\n    const {\n      ciphertext,\n      iv: resultIv,\n      tag,\n    } = await this.cryptoProvider.encrypt(\n      encoder.encode(data),\n      key,\n      iv,\n      aadBuffer,\n    );\n\n    // Concatenate all parts into a single array\n    const resultArray = new Uint8Array(\n      resultIv.length +\n        tag.length +\n        prefixLenBuffer.length +\n        keyBlob.length +\n        ciphertext.length,\n    );\n\n    let offset = 0;\n    resultArray.set(resultIv, offset);\n    offset += resultIv.length;\n\n    resultArray.set(tag, offset);\n    offset += tag.length;\n\n    resultArray.set(new Uint8Array(prefixLenBuffer), offset);\n    offset += prefixLenBuffer.length;\n\n    resultArray.set(keyBlob, offset);\n    offset += keyBlob.length;\n\n    resultArray.set(ciphertext, offset);\n\n    // Convert to base64 using our cross-runtime utility\n    return uint8ArrayToBase64(resultArray);\n  }\n\n  async decrypt(\n    encryptedData: string,\n    associatedData?: string,\n  ): Promise<string> {\n    const decoded = this.decode(encryptedData);\n    const dataKey = await this.decryptDataKey({ keys: decoded.keys });\n\n    // Convert base64 key to Uint8Array using our cross-runtime utility\n    const key = base64ToUint8Array(dataKey.key);\n\n    const encoder = new TextEncoder();\n    const aadBuffer = associatedData\n      ? encoder.encode(associatedData)\n      : undefined;\n\n    const decrypted = await this.cryptoProvider.decrypt(\n      decoded.ciphertext,\n      key,\n      decoded.iv,\n      decoded.tag,\n      aadBuffer,\n    );\n\n    return new TextDecoder().decode(decrypted);\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,iBAA2C;AAI3C,oBAAuD;AAuBvD,uBAGO;AACP,0BAOO;AASA,MAAM,MAAM;AAAA,EAGjB,YAA6B,QAAgB;AAAhB;AAC3B,SAAK,iBAAiB,OAAO,kBAAkB;AAAA,EACjD;AAAA,EApDF,OA+CmB;AAAA;AAAA;AAAA,EACT;AAAA,EAMA,OAAO,SAA0B;AACvC,UAAM,gBAAY,kCAAmB,OAAO;AAE5C,UAAM,KAAK,IAAI,WAAW,UAAU,SAAS,GAAG,EAAE,CAAC;AACnD,UAAM,MAAM,IAAI,WAAW,UAAU,SAAS,IAAI,EAAE,CAAC;AACrD,UAAM,EAAE,OAAO,QAAQ,UAAU,QAAI,yBAAa,WAAW,EAAE;AAG/D,UAAM,aAAa,UAAU,SAAS,WAAW,YAAY,MAAM;AACnE,UAAM,WAAO,kCAAmB,UAAU;AAE1C,UAAM,aAAa,IAAI,WAAW,UAAU,SAAS,YAAY,MAAM,CAAC;AAExE,WAAO;AAAA,MACL;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,aAAa,SAAuD;AACxE,UAAM,EAAE,KAAK,IAAI,MAAM,KAAK,OAAO;AAAA,MACjC;AAAA,UACA,iDAA4B,OAAO;AAAA,IACrC;AACA,eAAO,+CAA0B,IAAI;AAAA,EACvC;AAAA,EAEA,MAAM,YACJ,SAC6B;AAC7B,UAAM,MAAM,IAAI,IAAI,gBAAgB,KAAK,OAAO,OAAO;AACvD,QAAI,SAAS,OAAO;AAClB,UAAI,aAAa,IAAI,SAAS,QAAQ,KAAK;AAAA,IAC7C;AACA,QAAI,SAAS,OAAO;AAClB,UAAI,aAAa,IAAI,SAAS,QAAQ,MAAM,SAAS,CAAC;AAAA,IACxD;AAEA,UAAM,EAAE,KAAK,IAAI,MAAM,KAAK,OAAO;AAAA,MACjC,IAAI,SAAS;AAAA,IACf;AACA,eAAO,4CAAuB,IAAI;AAAA,EACpC;AAAA,EAEA,MAAM,mBACJ,SAC0B;AAC1B,UAAM,EAAE,KAAK,IAAI,MAAM,KAAK,OAAO;AAAA,MACjC,gBAAgB,mBAAmB,QAAQ,EAAE,CAAC;AAAA,IAChD;AACA,eAAO,kDAA6B,IAAI;AAAA,EAC1C;AAAA,EAEA,MAAM,WAAW,SAAkD;AACjE,UAAM,EAAE,KAAK,IAAI,MAAM,KAAK,OAAO;AAAA,MACjC,gBAAgB,mBAAmB,QAAQ,EAAE,CAAC;AAAA,IAChD;AACA,eAAO,uCAAkB,IAAI;AAAA,EAC/B;AAAA,EAEA,MAAM,eAAe,SAAkD;AACrE,UAAM,EAAE,KAAK,IAAI,MAAM,KAAK,OAAO;AAAA,MACjC,gBAAgB,mBAAmB,QAAQ,EAAE,CAAC;AAAA,IAChD;AACA,eAAO,uCAAkB,IAAI;AAAA,EAC/B;AAAA,EAEA,MAAM,aAAa,SAAoD;AACrE,UAAM,EAAE,KAAK,IAAI,MAAM,KAAK,OAAO;AAAA,MACjC,gBAAgB,mBAAmB,QAAQ,EAAE,CAAC;AAAA,UAC9C,iDAA4B,OAAO;AAAA,IACrC;AACA,eAAO,uCAAkB,IAAI;AAAA,EAC/B;AAAA,EAEA,MAAM,aAAa,SAA6C;AAC9D,WAAO,KAAK,OAAO,OAAO,gBAAgB,mBAAmB,QAAQ,EAAE,CAAC,EAAE;AAAA,EAC5E;AAAA,EAEA,MAAM,cAAc,SAAqD;AACvE,UAAM,EAAE,KAAK,IAAI,MAAM,KAAK,OAAO;AAAA,MACjC;AAAA,MACA;AAAA,IACF;AACA,eAAO,mDAAiC,IAAI;AAAA,EAC9C;AAAA,EAEA,MAAM,eAAe,SAAkD;AACrE,UAAM,EAAE,KAAK,IAAI,MAAM,KAAK,OAAO;AAAA,MACjC;AAAA,MACA;AAAA,IACF;AACA,eAAO,oDAAkC,IAAI;AAAA,EAC/C;AAAA,EAEA,MAAM,QACJ,MACA,SACA,gBACiB;AACjB,UAAM,UAAU,MAAM,KAAK,cAAc;AAAA,MACvC;AAAA,IACF,CAAC;AAGD,UAAM,UAAU,IAAI,YAAY;AAGhC,UAAM,UAAM,kCAAmB,QAAQ,QAAQ,GAAG;AAClD,UAAM,cAAU,kCAAmB,QAAQ,aAAa;AAExD,UAAM,sBAAkB,yBAAa,QAAQ,MAAM;AACnD,UAAM,YAAY,iBACd,QAAQ,OAAO,cAAc,IAC7B;AAGJ,UAAM,KAAK,KAAK,eAAe,YAAY,EAAE;AAE7C,UAAM;AAAA,MACJ;AAAA,MACA,IAAI;AAAA,MACJ;AAAA,IACF,IAAI,MAAM,KAAK,eAAe;AAAA,MAC5B,QAAQ,OAAO,IAAI;AAAA,MACnB;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAGA,UAAM,cAAc,IAAI;AAAA,MACtB,SAAS,SACP,IAAI,SACJ,gBAAgB,SAChB,QAAQ,SACR,WAAW;AAAA,IACf;AAEA,QAAI,SAAS;AACb,gBAAY,IAAI,UAAU,MAAM;AAChC,cAAU,SAAS;AAEnB,gBAAY,IAAI,KAAK,MAAM;AAC3B,cAAU,IAAI;AAEd,gBAAY,IAAI,IAAI,WAAW,eAAe,GAAG,MAAM;AACvD,cAAU,gBAAgB;AAE1B,gBAAY,IAAI,SAAS,MAAM;AAC/B,cAAU,QAAQ;AAElB,gBAAY,IAAI,YAAY,MAAM;AAGlC,eAAO,kCAAmB,WAAW;AAAA,EACvC;AAAA,EAEA,MAAM,QACJ,eACA,gBACiB;AACjB,UAAM,UAAU,KAAK,OAAO,aAAa;AACzC,UAAM,UAAU,MAAM,KAAK,eAAe,EAAE,MAAM,QAAQ,KAAK,CAAC;AAGhE,UAAM,UAAM,kCAAmB,QAAQ,GAAG;AAE1C,UAAM,UAAU,IAAI,YAAY;AAChC,UAAM,YAAY,iBACd,QAAQ,OAAO,cAAc,IAC7B;AAEJ,UAAM,YAAY,MAAM,KAAK,eAAe;AAAA,MAC1C,QAAQ;AAAA,MACR;AAAA,MACA,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR;AAAA,IACF;AAEA,WAAO,IAAI,YAAY,EAAE,OAAO,SAAS;AAAA,EAC3C;AACF;","names":[]}
+{"version":3,"sources":["../../../src/vault/vault.ts"],"sourcesContent":["import { decodeUInt32, encodeUInt32 } from '../common/utils/leb128';\nimport { CryptoProvider } from '../common/crypto/crypto-provider';\nimport { List, ListResponse } from '../common/interfaces';\nimport { PaginationOptions } from '../index.worker';\nimport { base64ToUint8Array, uint8ArrayToBase64 } from '../common/utils/base64';\nimport type { WorkOS } from '../workos';\nimport {\n  CreateDataKeyOptions,\n  CreateDataKeyResponse,\n  CreateObjectOptions,\n  DataKey,\n  DataKeyPair,\n  DecryptDataKeyOptions,\n  DecryptDataKeyResponse,\n  DeleteObjectOptions,\n  KeyContext,\n  ListObjectVersionsResponse,\n  ObjectDigest,\n  ObjectDigestResponse,\n  ObjectMetadata,\n  ObjectVersion,\n  ReadObjectMetadataResponse,\n  ReadObjectOptions,\n  ReadObjectResponse,\n  UpdateObjectOptions,\n  VaultObject,\n} from './interfaces';\nimport {\n  deserializeCreateDataKeyResponse,\n  deserializeDecryptDataKeyResponse,\n} from './serializers/vault-key.serializer';\nimport {\n  deserializeListObjects,\n  deserializeObject,\n  deserializeObjectMetadata,\n  desrializeListObjectVersions,\n  serializeCreateObjectEntity,\n  serializeUpdateObjectEntity,\n} from './serializers/vault-object.serializer';\n\ninterface Decoded {\n  iv: Uint8Array;\n  tag: Uint8Array;\n  keys: string;\n  ciphertext: Uint8Array;\n}\n\nexport class Vault {\n  private cryptoProvider: CryptoProvider;\n\n  constructor(private readonly workos: WorkOS) {\n    this.cryptoProvider = workos.getCryptoProvider();\n  }\n\n  private decode(payload: string): Decoded {\n    const inputData = base64ToUint8Array(payload);\n    // Use 12 bytes for IV (standard for AES-GCM)\n    const iv = new Uint8Array(inputData.subarray(0, 12));\n    const tag = new Uint8Array(inputData.subarray(12, 28));\n    const { value: keyLen, nextIndex } = decodeUInt32(inputData, 28);\n\n    // Use subarray instead of slice and convert directly to base64\n    const keysBuffer = inputData.subarray(nextIndex, nextIndex + keyLen);\n    const keys = uint8ArrayToBase64(keysBuffer);\n\n    const ciphertext = new Uint8Array(inputData.subarray(nextIndex + keyLen));\n\n    return {\n      iv,\n      tag,\n      keys,\n      ciphertext,\n    };\n  }\n\n  async createObject(options: CreateObjectOptions): Promise<ObjectMetadata> {\n    const { data } = await this.workos.post<ReadObjectMetadataResponse>(\n      `/vault/v1/kv`,\n      serializeCreateObjectEntity(options),\n    );\n    return deserializeObjectMetadata(data);\n  }\n\n  async listObjects(\n    options?: PaginationOptions | undefined,\n  ): Promise<List<ObjectDigest>> {\n    const url = new URL('/vault/v1/kv', this.workos.baseURL);\n    if (options?.after) {\n      url.searchParams.set('after', options.after);\n    }\n    if (options?.limit) {\n      url.searchParams.set('limit', options.limit.toString());\n    }\n\n    const { data } = await this.workos.get<ListResponse<ObjectDigestResponse>>(\n      url.toString(),\n    );\n    return deserializeListObjects(data);\n  }\n\n  async listObjectVersions(\n    options: ReadObjectOptions,\n  ): Promise<ObjectVersion[]> {\n    const { data } = await this.workos.get<ListObjectVersionsResponse>(\n      `/vault/v1/kv/${encodeURIComponent(options.id)}/versions`,\n    );\n    return desrializeListObjectVersions(data);\n  }\n\n  async readObject(options: ReadObjectOptions): Promise<VaultObject> {\n    const { data } = await this.workos.get<ReadObjectResponse>(\n      `/vault/v1/kv/${encodeURIComponent(options.id)}`,\n    );\n    return deserializeObject(data);\n  }\n\n  async describeObject(options: ReadObjectOptions): Promise<VaultObject> {\n    const { data } = await this.workos.get<ReadObjectResponse>(\n      `/vault/v1/kv/${encodeURIComponent(options.id)}/metadata`,\n    );\n    return deserializeObject(data);\n  }\n\n  async updateObject(options: UpdateObjectOptions): Promise<VaultObject> {\n    const { data } = await this.workos.put<ReadObjectResponse>(\n      `/vault/v1/kv/${encodeURIComponent(options.id)}`,\n      serializeUpdateObjectEntity(options),\n    );\n    return deserializeObject(data);\n  }\n\n  async deleteObject(options: DeleteObjectOptions): Promise<void> {\n    return this.workos.delete(`/vault/v1/kv/${encodeURIComponent(options.id)}`);\n  }\n\n  async createDataKey(options: CreateDataKeyOptions): Promise<DataKeyPair> {\n    const { data } = await this.workos.post<CreateDataKeyResponse>(\n      `/vault/v1/keys/data-key`,\n      options,\n    );\n    return deserializeCreateDataKeyResponse(data);\n  }\n\n  async decryptDataKey(options: DecryptDataKeyOptions): Promise<DataKey> {\n    const { data } = await this.workos.post<DecryptDataKeyResponse>(\n      `/vault/v1/keys/decrypt`,\n      options,\n    );\n    return deserializeDecryptDataKeyResponse(data);\n  }\n\n  async encrypt(\n    data: string,\n    context: KeyContext,\n    associatedData?: string,\n  ): Promise<string> {\n    const keyPair = await this.createDataKey({\n      context,\n    });\n\n    // Convert base64 key to Uint8Array\n    const encoder = new TextEncoder();\n\n    // Use our cross-runtime base64 utility\n    const key = base64ToUint8Array(keyPair.dataKey.key);\n    const keyBlob = base64ToUint8Array(keyPair.encryptedKeys);\n\n    const prefixLenBuffer = encodeUInt32(keyBlob.length);\n    const aadBuffer = associatedData\n      ? encoder.encode(associatedData)\n      : undefined;\n\n    // Use a 12-byte IV for AES-GCM (industry standard)\n    const iv = this.cryptoProvider.randomBytes(12);\n\n    const {\n      ciphertext,\n      iv: resultIv,\n      tag,\n    } = await this.cryptoProvider.encrypt(\n      encoder.encode(data),\n      key,\n      iv,\n      aadBuffer,\n    );\n\n    // Concatenate all parts into a single array\n    const resultArray = new Uint8Array(\n      resultIv.length +\n        tag.length +\n        prefixLenBuffer.length +\n        keyBlob.length +\n        ciphertext.length,\n    );\n\n    let offset = 0;\n    resultArray.set(resultIv, offset);\n    offset += resultIv.length;\n\n    resultArray.set(tag, offset);\n    offset += tag.length;\n\n    resultArray.set(new Uint8Array(prefixLenBuffer), offset);\n    offset += prefixLenBuffer.length;\n\n    resultArray.set(keyBlob, offset);\n    offset += keyBlob.length;\n\n    resultArray.set(ciphertext, offset);\n\n    // Convert to base64 using our cross-runtime utility\n    return uint8ArrayToBase64(resultArray);\n  }\n\n  async decrypt(\n    encryptedData: string,\n    associatedData?: string,\n  ): Promise<string> {\n    const decoded = this.decode(encryptedData);\n    const dataKey = await this.decryptDataKey({ keys: decoded.keys });\n\n    // Convert base64 key to Uint8Array using our cross-runtime utility\n    const key = base64ToUint8Array(dataKey.key);\n\n    const encoder = new TextEncoder();\n    const aadBuffer = associatedData\n      ? encoder.encode(associatedData)\n      : undefined;\n\n    const decrypted = await this.cryptoProvider.decrypt(\n      decoded.ciphertext,\n      key,\n      decoded.iv,\n      decoded.tag,\n      aadBuffer,\n    );\n\n    return new TextDecoder().decode(decrypted);\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,oBAA2C;AAI3C,oBAAuD;AAuBvD,uBAGO;AACP,0BAOO;AASA,MAAM,MAAM;AAAA,EAGjB,YAA6B,QAAgB;AAAhB;AAC3B,SAAK,iBAAiB,OAAO,kBAAkB;AAAA,EACjD;AAAA,EApDF,OA+CmB;AAAA;AAAA;AAAA,EACT;AAAA,EAMA,OAAO,SAA0B;AACvC,UAAM,gBAAY,kCAAmB,OAAO;AAE5C,UAAM,KAAK,IAAI,WAAW,UAAU,SAAS,GAAG,EAAE,CAAC;AACnD,UAAM,MAAM,IAAI,WAAW,UAAU,SAAS,IAAI,EAAE,CAAC;AACrD,UAAM,EAAE,OAAO,QAAQ,UAAU,QAAI,4BAAa,WAAW,EAAE;AAG/D,UAAM,aAAa,UAAU,SAAS,WAAW,YAAY,MAAM;AACnE,UAAM,WAAO,kCAAmB,UAAU;AAE1C,UAAM,aAAa,IAAI,WAAW,UAAU,SAAS,YAAY,MAAM,CAAC;AAExE,WAAO;AAAA,MACL;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,aAAa,SAAuD;AACxE,UAAM,EAAE,KAAK,IAAI,MAAM,KAAK,OAAO;AAAA,MACjC;AAAA,UACA,iDAA4B,OAAO;AAAA,IACrC;AACA,eAAO,+CAA0B,IAAI;AAAA,EACvC;AAAA,EAEA,MAAM,YACJ,SAC6B;AAC7B,UAAM,MAAM,IAAI,IAAI,gBAAgB,KAAK,OAAO,OAAO;AACvD,QAAI,SAAS,OAAO;AAClB,UAAI,aAAa,IAAI,SAAS,QAAQ,KAAK;AAAA,IAC7C;AACA,QAAI,SAAS,OAAO;AAClB,UAAI,aAAa,IAAI,SAAS,QAAQ,MAAM,SAAS,CAAC;AAAA,IACxD;AAEA,UAAM,EAAE,KAAK,IAAI,MAAM,KAAK,OAAO;AAAA,MACjC,IAAI,SAAS;AAAA,IACf;AACA,eAAO,4CAAuB,IAAI;AAAA,EACpC;AAAA,EAEA,MAAM,mBACJ,SAC0B;AAC1B,UAAM,EAAE,KAAK,IAAI,MAAM,KAAK,OAAO;AAAA,MACjC,gBAAgB,mBAAmB,QAAQ,EAAE,CAAC;AAAA,IAChD;AACA,eAAO,kDAA6B,IAAI;AAAA,EAC1C;AAAA,EAEA,MAAM,WAAW,SAAkD;AACjE,UAAM,EAAE,KAAK,IAAI,MAAM,KAAK,OAAO;AAAA,MACjC,gBAAgB,mBAAmB,QAAQ,EAAE,CAAC;AAAA,IAChD;AACA,eAAO,uCAAkB,IAAI;AAAA,EAC/B;AAAA,EAEA,MAAM,eAAe,SAAkD;AACrE,UAAM,EAAE,KAAK,IAAI,MAAM,KAAK,OAAO;AAAA,MACjC,gBAAgB,mBAAmB,QAAQ,EAAE,CAAC;AAAA,IAChD;AACA,eAAO,uCAAkB,IAAI;AAAA,EAC/B;AAAA,EAEA,MAAM,aAAa,SAAoD;AACrE,UAAM,EAAE,KAAK,IAAI,MAAM,KAAK,OAAO;AAAA,MACjC,gBAAgB,mBAAmB,QAAQ,EAAE,CAAC;AAAA,UAC9C,iDAA4B,OAAO;AAAA,IACrC;AACA,eAAO,uCAAkB,IAAI;AAAA,EAC/B;AAAA,EAEA,MAAM,aAAa,SAA6C;AAC9D,WAAO,KAAK,OAAO,OAAO,gBAAgB,mBAAmB,QAAQ,EAAE,CAAC,EAAE;AAAA,EAC5E;AAAA,EAEA,MAAM,cAAc,SAAqD;AACvE,UAAM,EAAE,KAAK,IAAI,MAAM,KAAK,OAAO;AAAA,MACjC;AAAA,MACA;AAAA,IACF;AACA,eAAO,mDAAiC,IAAI;AAAA,EAC9C;AAAA,EAEA,MAAM,eAAe,SAAkD;AACrE,UAAM,EAAE,KAAK,IAAI,MAAM,KAAK,OAAO;AAAA,MACjC;AAAA,MACA;AAAA,IACF;AACA,eAAO,oDAAkC,IAAI;AAAA,EAC/C;AAAA,EAEA,MAAM,QACJ,MACA,SACA,gBACiB;AACjB,UAAM,UAAU,MAAM,KAAK,cAAc;AAAA,MACvC;AAAA,IACF,CAAC;AAGD,UAAM,UAAU,IAAI,YAAY;AAGhC,UAAM,UAAM,kCAAmB,QAAQ,QAAQ,GAAG;AAClD,UAAM,cAAU,kCAAmB,QAAQ,aAAa;AAExD,UAAM,sBAAkB,4BAAa,QAAQ,MAAM;AACnD,UAAM,YAAY,iBACd,QAAQ,OAAO,cAAc,IAC7B;AAGJ,UAAM,KAAK,KAAK,eAAe,YAAY,EAAE;AAE7C,UAAM;AAAA,MACJ;AAAA,MACA,IAAI;AAAA,MACJ;AAAA,IACF,IAAI,MAAM,KAAK,eAAe;AAAA,MAC5B,QAAQ,OAAO,IAAI;AAAA,MACnB;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAGA,UAAM,cAAc,IAAI;AAAA,MACtB,SAAS,SACP,IAAI,SACJ,gBAAgB,SAChB,QAAQ,SACR,WAAW;AAAA,IACf;AAEA,QAAI,SAAS;AACb,gBAAY,IAAI,UAAU,MAAM;AAChC,cAAU,SAAS;AAEnB,gBAAY,IAAI,KAAK,MAAM;AAC3B,cAAU,IAAI;AAEd,gBAAY,IAAI,IAAI,WAAW,eAAe,GAAG,MAAM;AACvD,cAAU,gBAAgB;AAE1B,gBAAY,IAAI,SAAS,MAAM;AAC/B,cAAU,QAAQ;AAElB,gBAAY,IAAI,YAAY,MAAM;AAGlC,eAAO,kCAAmB,WAAW;AAAA,EACvC;AAAA,EAEA,MAAM,QACJ,eACA,gBACiB;AACjB,UAAM,UAAU,KAAK,OAAO,aAAa;AACzC,UAAM,UAAU,MAAM,KAAK,eAAe,EAAE,MAAM,QAAQ,KAAK,CAAC;AAGhE,UAAM,UAAM,kCAAmB,QAAQ,GAAG;AAE1C,UAAM,UAAU,IAAI,YAAY;AAChC,UAAM,YAAY,iBACd,QAAQ,OAAO,cAAc,IAC7B;AAEJ,UAAM,YAAY,MAAM,KAAK,eAAe;AAAA,MAC1C,QAAQ;AAAA,MACR;AAAA,MACA,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR;AAAA,IACF;AAEA,WAAO,IAAI,YAAY,EAAE,OAAO,SAAS;AAAA,EAC3C;AACF;","names":[]}

package/lib/cjs/vault/vault.d.cts

@@ -1,6 +1,6 @@
 import '../common/interfaces/pagination-options.interface.cjs';
 import '../common/interfaces/list.interface.cjs';
-export { V as Vault } from '../workos-BcNRiAbw.cjs';
+export { V as Vault } from '../workos-X1cDErJB.cjs';
 import './interfaces/key/create-data-key.interface.cjs';
 import './interfaces/key/decrypt-data-key.interface.cjs';
 import './interfaces/key.interface.cjs';
@@ -14,12 +14,16 @@ import '../common/interfaces/post-options.interface.cjs';
 import '../common/interfaces/put-options.interface.cjs';
 import '../common/interfaces/workos-options.interface.cjs';
 import '../common/interfaces/app-info.interface.cjs';
-import '../events/interfaces/list-events-options.interface.cjs';
-import '../common/interfaces/event.interface.cjs';
+import '../common/utils/pagination.cjs';
 import '../directory-sync/interfaces/directory.interface.cjs';
 import '../directory-sync/interfaces/directory-group.interface.cjs';
+import '../directory-sync/interfaces/list-directories-options.interface.cjs';
+import '../directory-sync/interfaces/list-groups-options.interface.cjs';
+import '../directory-sync/interfaces/list-directory-users-options.interface.cjs';
 import '../directory-sync/interfaces/directory-user.interface.cjs';
 import '../roles/interfaces/role.interface.cjs';
+import '../events/interfaces/list-events-options.interface.cjs';
+import '../common/interfaces/event.interface.cjs';
 import '../organizations/interfaces/organization.interface.cjs';
 import '../organization-domains/interfaces/organization-domain.interface.cjs';
 import '../sso/interfaces/connection.interface.cjs';
@@ -34,7 +38,6 @@ import '../user-management/interfaces/magic-auth.interface.cjs';
 import '../user-management/interfaces/password-reset.interface.cjs';
 import '../user-management/interfaces/session.interface.cjs';
 import '../user-management/interfaces/impersonator.interface.cjs';
-import '../common/utils/pagination.cjs';
 import '../organizations/interfaces/create-organization-options.interface.cjs';
 import '../organizations/interfaces/domain-data.interface.cjs';
 import '../organizations/interfaces/list-organization-feature-flags-options.interface.cjs';
@@ -123,6 +126,5 @@ import '../widgets/interfaces/get-token.cjs';
 import '../actions/actions.cjs';
 import '../actions/interfaces/action.interface.cjs';
 import '../actions/interfaces/response-payload.interface.cjs';
-import '../directory-sync/interfaces/list-directories-options.interface.cjs';
-import '../directory-sync/interfaces/list-groups-options.interface.cjs';
-import '../directory-sync/interfaces/list-directory-users-options.interface.cjs';
+import '../api-keys/interfaces/validate-api-key.interface.cjs';
+import '../api-keys/interfaces/api-key.interface.cjs';

package/lib/cjs/widgets/interfaces/get-token.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../src/widgets/interfaces/get-token.ts"],"sourcesContent":["export type WidgetScope =\n  | 'widgets:users-table:manage'\n  | 'widgets:sso:manage'\n  | 'widgets:domain-verification:manage';\n\nexport interface GetTokenOptions {\n  organizationId: string;\n  userId?: string;\n  scopes?: WidgetScope[];\n}\n\nexport interface SerializedGetTokenOptions {\n  organization_id: string;\n  user_id?: string;\n  scopes?: WidgetScope[];\n}\n\nexport const serializeGetTokenOptions = (\n  options: GetTokenOptions,\n): SerializedGetTokenOptions => ({\n  organization_id: options.organizationId,\n  user_id: options.userId,\n  scopes: options.scopes,\n});\n\nexport interface GetTokenResponse {\n  token: string;\n}\n\nexport interface GetTokenResponseResponse {\n  token: string;\n}\n\nexport const deserializeGetTokenResponse = (\n  data: GetTokenResponseResponse,\n): GetTokenResponse => ({\n  token: data.token,\n});\n"],"mappings":";;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAiBO,MAAM,2BAA2B,wBACtC,aAC+B;AAAA,EAC/B,iBAAiB,QAAQ;AAAA,EACzB,SAAS,QAAQ;AAAA,EACjB,QAAQ,QAAQ;AAClB,IANwC;AAgBjC,MAAM,8BAA8B,wBACzC,UACsB;AAAA,EACtB,OAAO,KAAK;AACd,IAJ2C;","names":[]}
+{"version":3,"sources":["../../../../src/widgets/interfaces/get-token.ts"],"sourcesContent":["export type WidgetScope =\n  | 'widgets:users-table:manage'\n  | 'widgets:sso:manage'\n  | 'widgets:domain-verification:manage'\n  | 'widgets:api-keys:manage';\nexport interface GetTokenOptions {\n  organizationId: string;\n  userId?: string;\n  scopes?: WidgetScope[];\n}\n\nexport interface SerializedGetTokenOptions {\n  organization_id: string;\n  user_id?: string;\n  scopes?: WidgetScope[];\n}\n\nexport const serializeGetTokenOptions = (\n  options: GetTokenOptions,\n): SerializedGetTokenOptions => ({\n  organization_id: options.organizationId,\n  user_id: options.userId,\n  scopes: options.scopes,\n});\n\nexport interface GetTokenResponse {\n  token: string;\n}\n\nexport interface GetTokenResponseResponse {\n  token: string;\n}\n\nexport const deserializeGetTokenResponse = (\n  data: GetTokenResponseResponse,\n): GetTokenResponse => ({\n  token: data.token,\n});\n"],"mappings":";;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAiBO,MAAM,2BAA2B,wBACtC,aAC+B;AAAA,EAC/B,iBAAiB,QAAQ;AAAA,EACzB,SAAS,QAAQ;AAAA,EACjB,QAAQ,QAAQ;AAClB,IANwC;AAgBjC,MAAM,8BAA8B,wBACzC,UACsB;AAAA,EACtB,OAAO,KAAK;AACd,IAJ2C;","names":[]}

package/lib/cjs/widgets/interfaces/get-token.d.cts

@@ -1,4 +1,4 @@
-type WidgetScope = 'widgets:users-table:manage' | 'widgets:sso:manage' | 'widgets:domain-verification:manage';
+type WidgetScope = 'widgets:users-table:manage' | 'widgets:sso:manage' | 'widgets:domain-verification:manage' | 'widgets:api-keys:manage';
 interface GetTokenOptions {
     organizationId: string;
     userId?: string;

package/lib/cjs/widgets/widgets.d.cts

@@ -1,16 +1,22 @@
-export { c as Widgets } from '../workos-BcNRiAbw.cjs';
+export { d as Widgets } from '../workos-X1cDErJB.cjs';
 import './interfaces/get-token.cjs';
 import '../common/interfaces/get-options.interface.cjs';
 import '../common/interfaces/post-options.interface.cjs';
 import '../common/interfaces/put-options.interface.cjs';
 import '../common/interfaces/workos-options.interface.cjs';
 import '../common/interfaces/app-info.interface.cjs';
-import '../events/interfaces/list-events-options.interface.cjs';
-import '../common/interfaces/event.interface.cjs';
+import '../common/utils/pagination.cjs';
+import '../common/interfaces/pagination-options.interface.cjs';
+import '../common/interfaces/list.interface.cjs';
 import '../directory-sync/interfaces/directory.interface.cjs';
 import '../directory-sync/interfaces/directory-group.interface.cjs';
+import '../directory-sync/interfaces/list-directories-options.interface.cjs';
+import '../directory-sync/interfaces/list-groups-options.interface.cjs';
+import '../directory-sync/interfaces/list-directory-users-options.interface.cjs';
 import '../directory-sync/interfaces/directory-user.interface.cjs';
 import '../roles/interfaces/role.interface.cjs';
+import '../events/interfaces/list-events-options.interface.cjs';
+import '../common/interfaces/event.interface.cjs';
 import '../organizations/interfaces/organization.interface.cjs';
 import '../organization-domains/interfaces/organization-domain.interface.cjs';
 import '../sso/interfaces/connection.interface.cjs';
@@ -25,9 +31,6 @@ import '../user-management/interfaces/magic-auth.interface.cjs';
 import '../user-management/interfaces/password-reset.interface.cjs';
 import '../user-management/interfaces/session.interface.cjs';
 import '../user-management/interfaces/impersonator.interface.cjs';
-import '../common/interfaces/list.interface.cjs';
-import '../common/utils/pagination.cjs';
-import '../common/interfaces/pagination-options.interface.cjs';
 import '../organizations/interfaces/create-organization-options.interface.cjs';
 import '../organizations/interfaces/domain-data.interface.cjs';
 import '../organizations/interfaces/list-organization-feature-flags-options.interface.cjs';
@@ -123,6 +126,5 @@ import '../vault/interfaces/object/delete-object.interface.cjs';
 import '../vault/interfaces/object/read-object.interface.cjs';
 import '../vault/interfaces/object.interface.cjs';
 import '../vault/interfaces/object/update-object.interface.cjs';
-import '../directory-sync/interfaces/list-directories-options.interface.cjs';
-import '../directory-sync/interfaces/list-groups-options.interface.cjs';
-import '../directory-sync/interfaces/list-directory-users-options.interface.cjs';
+import '../api-keys/interfaces/validate-api-key.interface.cjs';
+import '../api-keys/interfaces/api-key.interface.cjs';

package/lib/cjs/{workos-BcNRiAbw.d.cts → workos-X1cDErJB.d.cts}

@@ -2,10 +2,16 @@ import { GetOptions } from './common/interfaces/get-options.interface.cjs';
 import { PostOptions } from './common/interfaces/post-options.interface.cjs';
 import { PutOptions } from './common/interfaces/put-options.interface.cjs';
 import { WorkOSOptions } from './common/interfaces/workos-options.interface.cjs';
+import { AutoPaginatable } from './common/utils/pagination.cjs';
+import { Directory } from './directory-sync/interfaces/directory.interface.cjs';
+import { DirectoryGroup } from './directory-sync/interfaces/directory-group.interface.cjs';
+import { ListDirectoriesOptions, SerializedListDirectoriesOptions } from './directory-sync/interfaces/list-directories-options.interface.cjs';
+import { ListDirectoryGroupsOptions } from './directory-sync/interfaces/list-groups-options.interface.cjs';
+import { ListDirectoryUsersOptions } from './directory-sync/interfaces/list-directory-users-options.interface.cjs';
+import { DefaultCustomAttributes, DirectoryUserWithGroups } from './directory-sync/interfaces/directory-user.interface.cjs';
 import { ListEventOptions } from './events/interfaces/list-events-options.interface.cjs';
 import { Event } from './common/interfaces/event.interface.cjs';
 import { List } from './common/interfaces/list.interface.cjs';
-import { AutoPaginatable } from './common/utils/pagination.cjs';
 import { CreateOrganizationOptions, CreateOrganizationRequestOptions } from './organizations/interfaces/create-organization-options.interface.cjs';
 import { ListOrganizationFeatureFlagsOptions } from './organizations/interfaces/list-organization-feature-flags-options.interface.cjs';
 import { ListOrganizationsOptions } from './organizations/interfaces/list-organizations-options.interface.cjs';
@@ -39,7 +45,7 @@ import { AuditLogExportOptions } from './audit-logs/interfaces/audit-log-export-
 import { AuditLogExport } from './audit-logs/interfaces/audit-log-export.interface.cjs';
 import { CreateAuditLogEventOptions, CreateAuditLogEventRequestOptions } from './audit-logs/interfaces/create-audit-log-event-options.interface.cjs';
 import { CreateAuditLogSchemaOptions, CreateAuditLogSchemaRequestOptions, AuditLogSchema } from './audit-logs/interfaces/create-audit-log-schema-options.interface.cjs';
-import { createRemoteJWKSet } from 'jose';
+import * as jose from 'jose';
 import { L as LogoutURLOptions } from './user-management-qKHMGyQi.cjs';
 import { PaginationOptions } from './common/interfaces/pagination-options.interface.cjs';
 import { AuthenticateWithCodeOptions } from './user-management/interfaces/authenticate-with-code-options.interface.cjs';
@@ -100,12 +106,13 @@ import { ReadObjectOptions } from './vault/interfaces/object/read-object.interfa
 import { UpdateObjectOptions } from './vault/interfaces/object/update-object.interface.cjs';
 import { ObjectMetadata, ObjectDigest, ObjectVersion, VaultObject } from './vault/interfaces/object.interface.cjs';
 import { CryptoProvider } from './common/crypto/crypto-provider.cjs';
-import { Directory } from './directory-sync/interfaces/directory.interface.cjs';
-import { DirectoryGroup } from './directory-sync/interfaces/directory-group.interface.cjs';
-import { ListDirectoriesOptions, SerializedListDirectoriesOptions } from './directory-sync/interfaces/list-directories-options.interface.cjs';
-import { ListDirectoryGroupsOptions } from './directory-sync/interfaces/list-groups-options.interface.cjs';
-import { ListDirectoryUsersOptions } from './directory-sync/interfaces/list-directory-users-options.interface.cjs';
-import { DefaultCustomAttributes, DirectoryUserWithGroups } from './directory-sync/interfaces/directory-user.interface.cjs';
+import { ValidateApiKeyOptions, ValidateApiKeyResponse } from './api-keys/interfaces/validate-api-key.interface.cjs';
+
+declare class ApiKeys {
+    private readonly workos;
+    constructor(workos: WorkOS);
+    validateApiKey(payload: ValidateApiKeyOptions): Promise<ValidateApiKeyResponse>;
+}
 
 declare class DirectorySync {
     private readonly workos;
@@ -202,7 +209,6 @@ type RefreshOptions = {
     organizationId?: string;
 };
 declare class CookieSession {
-    private jwks;
     private userManagement;
     private cookiePassword;
     private sessionData;
@@ -238,7 +244,7 @@ declare class UserManagement {
     private _jwks;
     clientId: string | undefined;
     constructor(workos: WorkOS);
-    get jwks(): ReturnType<typeof createRemoteJWKSet> | undefined;
+    getJWKS(): Promise<ReturnType<typeof jose.createRemoteJWKSet> | undefined>;
     /**
      * Loads a sealed session using the provided session data and cookie password.
      *
@@ -359,6 +365,7 @@ declare class WorkOS {
     readonly client: HttpClient;
     readonly clientId?: string;
     readonly actions: Actions;
+    readonly apiKeys: ApiKeys;
     readonly auditLogs: AuditLogs;
     readonly directorySync: DirectorySync;
     readonly organizations: Organizations;
@@ -395,4 +402,4 @@ declare class WorkOS {
     private handleHttpError;
 }
 
-export { AuditLogs as A, CookieSession as C, DirectorySync as D, Events as E, FGA as F, Mfa as M, Organizations as O, Passwordless as P, SSO as S, UserManagement as U, Vault as V, WorkOS as W, OrganizationDomains as a, Portal as b, Widgets as c };
+export { ApiKeys as A, CookieSession as C, DirectorySync as D, Events as E, FGA as F, Mfa as M, Organizations as O, Passwordless as P, SSO as S, UserManagement as U, Vault as V, WorkOS as W, OrganizationDomains as a, Portal as b, AuditLogs as c, Widgets as d };

package/lib/cjs/workos.cjs

@@ -23,6 +23,7 @@ __export(workos_exports, {
 });
 module.exports = __toCommonJS(workos_exports);
 var import_exceptions = require('./common/exceptions/index.cjs');
+var import_api_keys = require('./api-keys/api-keys.cjs');
 var import_directory_sync = require('./directory-sync/directory-sync.cjs');
 var import_events = require('./events/events.cjs');
 var import_organizations = require('./organizations/organizations.cjs');
@@ -46,7 +47,7 @@ var import_conflict = require('./common/exceptions/conflict.exception.cjs');
 var import_parse_error = require('./common/exceptions/parse-error.cjs');
 var import_env = require('./common/utils/env.cjs');
 var import_runtime_info = require('./common/utils/runtime-info.cjs');
-const VERSION = "8.0.0-beta.4";
+const VERSION = "8.0.0-rc.3";
 const DEFAULT_HOSTNAME = "api.workos.com";
 const HEADER_AUTHORIZATION = "Authorization";
 const HEADER_IDEMPOTENCY_KEY = "Idempotency-Key";
@@ -88,6 +89,7 @@ class WorkOS {
   client;
   clientId;
   actions;
+  apiKeys = new import_api_keys.ApiKeys(this);
   auditLogs = new import_audit_logs.AuditLogs(this);
   directorySync = new import_directory_sync.DirectorySync(this);
   organizations = new import_organizations.Organizations(this);