@workos-inc/node 8.0.0-rc.1 → 8.0.0-rc.3

package/lib/esm/user-management/user-management.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/user-management/user-management.ts"],"sourcesContent":["import { sealData, unsealData } from 'iron-session';\nimport { createRemoteJWKSet, decodeJwt, jwtVerify } from 'jose';\nimport * as clientUserManagement from '../client/user-management';\nimport { PaginationOptions } from '../common/interfaces/pagination-options.interface';\nimport { fetchAndDeserialize } from '../common/utils/fetch-and-deserialize';\nimport { AutoPaginatable } from '../common/utils/pagination';\nimport { getEnv } from '../common/utils/env';\nimport { Challenge, ChallengeResponse } from '../mfa/interfaces';\nimport { deserializeChallenge } from '../mfa/serializers';\nimport {\n  FeatureFlag,\n  FeatureFlagResponse,\n} from '../feature-flags/interfaces/feature-flag.interface';\nimport { deserializeFeatureFlag } from '../feature-flags/serializers/feature-flag.serializer';\nimport { WorkOS } from '../workos';\nimport {\n  AuthenticateWithCodeAndVerifierOptions,\n  AuthenticateWithCodeOptions,\n  AuthenticateWithMagicAuthOptions,\n  AuthenticateWithPasswordOptions,\n  AuthenticateWithRefreshTokenOptions,\n  AuthenticateWithSessionOptions,\n  AuthenticateWithTotpOptions,\n  AuthenticationResponse,\n  AuthenticationResponseResponse,\n  CreateMagicAuthOptions,\n  CreatePasswordResetOptions,\n  CreateUserOptions,\n  EmailVerification,\n  EmailVerificationResponse,\n  EnrollAuthFactorOptions,\n  ListAuthFactorsOptions,\n  ListSessionsOptions,\n  ListUsersOptions,\n  ListUserFeatureFlagsOptions,\n  MagicAuth,\n  MagicAuthResponse,\n  PasswordReset,\n  PasswordResetResponse,\n  ResetPasswordOptions,\n  SendVerificationEmailOptions,\n  SerializedAuthenticateWithCodeAndVerifierOptions,\n  SerializedAuthenticateWithCodeOptions,\n  SerializedAuthenticateWithMagicAuthOptions,\n  SerializedAuthenticateWithPasswordOptions,\n  SerializedAuthenticateWithRefreshTokenOptions,\n  SerializedAuthenticateWithTotpOptions,\n  SerializedCreateMagicAuthOptions,\n  SerializedCreatePasswordResetOptions,\n  SerializedCreateUserOptions,\n  SerializedListSessionsOptions,\n  SerializedListUsersOptions,\n  SerializedResetPasswordOptions,\n  SerializedVerifyEmailOptions,\n  Session,\n  SessionResponse,\n  UpdateUserOptions,\n  User,\n  UserResponse,\n  VerifyEmailOptions,\n} from './interfaces';\nimport {\n  AuthenticateWithEmailVerificationOptions,\n  SerializedAuthenticateWithEmailVerificationOptions,\n} from './interfaces/authenticate-with-email-verification-options.interface';\nimport {\n  AuthenticateWithOrganizationSelectionOptions,\n  SerializedAuthenticateWithOrganizationSelectionOptions,\n} from './interfaces/authenticate-with-organization-selection.interface';\nimport {\n  AccessToken,\n  AuthenticateWithSessionCookieFailedResponse,\n  AuthenticateWithSessionCookieFailureReason,\n  AuthenticateWithSessionCookieOptions,\n  AuthenticateWithSessionCookieSuccessResponse,\n  SessionCookieData,\n} from './interfaces/authenticate-with-session-cookie.interface';\nimport { UserManagementAuthorizationURLOptions } from './interfaces/authorization-url-options.interface';\nimport {\n  CreateOrganizationMembershipOptions,\n  SerializedCreateOrganizationMembershipOptions,\n} from './interfaces/create-organization-membership-options.interface';\nimport {\n  Factor,\n  FactorResponse,\n  FactorWithSecrets,\n  FactorWithSecretsResponse,\n} from './interfaces/factor.interface';\nimport { Identity, IdentityResponse } from './interfaces/identity.interface';\nimport {\n  Invitation,\n  InvitationResponse,\n} from './interfaces/invitation.interface';\nimport {\n  ListInvitationsOptions,\n  SerializedListInvitationsOptions,\n} from './interfaces/list-invitations-options.interface';\nimport {\n  ListOrganizationMembershipsOptions,\n  SerializedListOrganizationMembershipsOptions,\n} from './interfaces/list-organization-memberships-options.interface';\nimport {\n  OrganizationMembership,\n  OrganizationMembershipResponse,\n} from './interfaces/organization-membership.interface';\nimport {\n  RevokeSessionOptions,\n  SerializedRevokeSessionOptions,\n  serializeRevokeSessionOptions,\n} from './interfaces/revoke-session-options.interface';\nimport {\n  SendInvitationOptions,\n  SerializedSendInvitationOptions,\n} from './interfaces/send-invitation-options.interface';\nimport { SessionHandlerOptions } from './interfaces/session-handler-options.interface';\nimport {\n  SerializedUpdateOrganizationMembershipOptions,\n  UpdateOrganizationMembershipOptions,\n} from './interfaces/update-organization-membership-options.interface';\nimport {\n  deserializeAuthenticationResponse,\n  deserializeEmailVerification,\n  deserializeFactorWithSecrets,\n  deserializeMagicAuth,\n  deserializePasswordReset,\n  deserializeSession,\n  deserializeUser,\n  serializeAuthenticateWithCodeAndVerifierOptions,\n  serializeAuthenticateWithCodeOptions,\n  serializeAuthenticateWithMagicAuthOptions,\n  serializeAuthenticateWithPasswordOptions,\n  serializeAuthenticateWithRefreshTokenOptions,\n  serializeAuthenticateWithTotpOptions,\n  serializeCreateMagicAuthOptions,\n  serializeCreatePasswordResetOptions,\n  serializeCreateUserOptions,\n  serializeEnrollAuthFactorOptions,\n  serializeListSessionsOptions,\n  serializeResetPasswordOptions,\n  serializeUpdateUserOptions,\n} from './serializers';\nimport { serializeAuthenticateWithEmailVerificationOptions } from './serializers/authenticate-with-email-verification.serializer';\nimport { serializeAuthenticateWithOrganizationSelectionOptions } from './serializers/authenticate-with-organization-selection-options.serializer';\nimport { serializeCreateOrganizationMembershipOptions } from './serializers/create-organization-membership-options.serializer';\nimport { deserializeFactor } from './serializers/factor.serializer';\nimport { deserializeIdentities } from './serializers/identity.serializer';\nimport { deserializeInvitation } from './serializers/invitation.serializer';\nimport { serializeListInvitationsOptions } from './serializers/list-invitations-options.serializer';\nimport { serializeListOrganizationMembershipsOptions } from './serializers/list-organization-memberships-options.serializer';\nimport { serializeListUsersOptions } from './serializers/list-users-options.serializer';\nimport { deserializeOrganizationMembership } from './serializers/organization-membership.serializer';\nimport { serializeSendInvitationOptions } from './serializers/send-invitation-options.serializer';\nimport { serializeUpdateOrganizationMembershipOptions } from './serializers/update-organization-membership-options.serializer';\nimport { CookieSession } from './session';\n\nexport class UserManagement {\n  private _jwks: ReturnType<typeof createRemoteJWKSet> | undefined;\n  public clientId: string | undefined;\n\n  constructor(private readonly workos: WorkOS) {\n    const { clientId } = workos.options;\n\n    this.clientId = clientId;\n  }\n\n  get jwks(): ReturnType<typeof createRemoteJWKSet> | undefined {\n    if (!this.clientId) {\n      return;\n    }\n\n    // Set the JWKS URL. This is used to verify if the JWT is still valid\n    this._jwks ??= createRemoteJWKSet(new URL(this.getJwksUrl(this.clientId)), {\n      cooldownDuration: 1000 * 60 * 5,\n    });\n\n    return this._jwks;\n  }\n\n  /**\n   * Loads a sealed session using the provided session data and cookie password.\n   *\n   * @param options - The options for loading the sealed session.\n   * @param options.sessionData - The sealed session data.\n   * @param options.cookiePassword - The password used to encrypt the session data.\n   * @returns The session class.\n   */\n  loadSealedSession(options: {\n    sessionData: string;\n    cookiePassword: string;\n  }): CookieSession {\n    return new CookieSession(this, options.sessionData, options.cookiePassword);\n  }\n\n  async getUser(userId: string): Promise<User> {\n    const { data } = await this.workos.get<UserResponse>(\n      `/user_management/users/${userId}`,\n    );\n\n    return deserializeUser(data);\n  }\n\n  async getUserByExternalId(externalId: string): Promise<User> {\n    const { data } = await this.workos.get<UserResponse>(\n      `/user_management/users/external_id/${externalId}`,\n    );\n\n    return deserializeUser(data);\n  }\n\n  async listUsers(\n    options?: ListUsersOptions,\n  ): Promise<AutoPaginatable<User, SerializedListUsersOptions>> {\n    return new AutoPaginatable(\n      await fetchAndDeserialize<UserResponse, User>(\n        this.workos,\n        '/user_management/users',\n        deserializeUser,\n        options ? serializeListUsersOptions(options) : undefined,\n      ),\n      (params) =>\n        fetchAndDeserialize<UserResponse, User>(\n          this.workos,\n          '/user_management/users',\n          deserializeUser,\n          params,\n        ),\n      options ? serializeListUsersOptions(options) : undefined,\n    );\n  }\n\n  async createUser(payload: CreateUserOptions): Promise<User> {\n    const { data } = await this.workos.post<\n      UserResponse,\n      SerializedCreateUserOptions\n    >('/user_management/users', serializeCreateUserOptions(payload));\n\n    return deserializeUser(data);\n  }\n\n  async authenticateWithMagicAuth(\n    payload: AuthenticateWithMagicAuthOptions,\n  ): Promise<AuthenticationResponse> {\n    const { session, ...remainingPayload } = payload;\n\n    const { data } = await this.workos.post<\n      AuthenticationResponseResponse,\n      SerializedAuthenticateWithMagicAuthOptions\n    >(\n      '/user_management/authenticate',\n      serializeAuthenticateWithMagicAuthOptions({\n        ...remainingPayload,\n        clientSecret: this.workos.key,\n      }),\n    );\n\n    return this.prepareAuthenticationResponse({\n      authenticationResponse: deserializeAuthenticationResponse(data),\n      session,\n    });\n  }\n\n  async authenticateWithPassword(\n    payload: AuthenticateWithPasswordOptions,\n  ): Promise<AuthenticationResponse> {\n    const { session, ...remainingPayload } = payload;\n\n    const { data } = await this.workos.post<\n      AuthenticationResponseResponse,\n      SerializedAuthenticateWithPasswordOptions\n    >(\n      '/user_management/authenticate',\n      serializeAuthenticateWithPasswordOptions({\n        ...remainingPayload,\n        clientSecret: this.workos.key,\n      }),\n    );\n\n    return this.prepareAuthenticationResponse({\n      authenticationResponse: deserializeAuthenticationResponse(data),\n      session,\n    });\n  }\n\n  async authenticateWithCode(\n    payload: AuthenticateWithCodeOptions,\n  ): Promise<AuthenticationResponse> {\n    const { session, ...remainingPayload } = payload;\n\n    const { data } = await this.workos.post<\n      AuthenticationResponseResponse,\n      SerializedAuthenticateWithCodeOptions\n    >(\n      '/user_management/authenticate',\n      serializeAuthenticateWithCodeOptions({\n        ...remainingPayload,\n        clientSecret: this.workos.key,\n      }),\n    );\n\n    return this.prepareAuthenticationResponse({\n      authenticationResponse: deserializeAuthenticationResponse(data),\n      session,\n    });\n  }\n\n  async authenticateWithCodeAndVerifier(\n    payload: AuthenticateWithCodeAndVerifierOptions,\n  ): Promise<AuthenticationResponse> {\n    const { session, ...remainingPayload } = payload;\n\n    const { data } = await this.workos.post<\n      AuthenticationResponseResponse,\n      SerializedAuthenticateWithCodeAndVerifierOptions\n    >(\n      '/user_management/authenticate',\n      serializeAuthenticateWithCodeAndVerifierOptions(remainingPayload),\n    );\n\n    return this.prepareAuthenticationResponse({\n      authenticationResponse: deserializeAuthenticationResponse(data),\n      session,\n    });\n  }\n\n  async authenticateWithRefreshToken(\n    payload: AuthenticateWithRefreshTokenOptions,\n  ): Promise<AuthenticationResponse> {\n    const { session, ...remainingPayload } = payload;\n\n    const { data } = await this.workos.post<\n      AuthenticationResponseResponse,\n      SerializedAuthenticateWithRefreshTokenOptions\n    >(\n      '/user_management/authenticate',\n      serializeAuthenticateWithRefreshTokenOptions({\n        ...remainingPayload,\n        clientSecret: this.workos.key,\n      }),\n    );\n\n    return this.prepareAuthenticationResponse({\n      authenticationResponse: deserializeAuthenticationResponse(data),\n      session,\n    });\n  }\n\n  async authenticateWithTotp(\n    payload: AuthenticateWithTotpOptions,\n  ): Promise<AuthenticationResponse> {\n    const { session, ...remainingPayload } = payload;\n\n    const { data } = await this.workos.post<\n      AuthenticationResponseResponse,\n      SerializedAuthenticateWithTotpOptions\n    >(\n      '/user_management/authenticate',\n      serializeAuthenticateWithTotpOptions({\n        ...remainingPayload,\n        clientSecret: this.workos.key,\n      }),\n    );\n\n    return this.prepareAuthenticationResponse({\n      authenticationResponse: deserializeAuthenticationResponse(data),\n      session,\n    });\n  }\n\n  async authenticateWithEmailVerification(\n    payload: AuthenticateWithEmailVerificationOptions,\n  ): Promise<AuthenticationResponse> {\n    const { session, ...remainingPayload } = payload;\n\n    const { data } = await this.workos.post<\n      AuthenticationResponseResponse,\n      SerializedAuthenticateWithEmailVerificationOptions\n    >(\n      '/user_management/authenticate',\n      serializeAuthenticateWithEmailVerificationOptions({\n        ...remainingPayload,\n        clientSecret: this.workos.key,\n      }),\n    );\n\n    return this.prepareAuthenticationResponse({\n      authenticationResponse: deserializeAuthenticationResponse(data),\n      session,\n    });\n  }\n\n  async authenticateWithOrganizationSelection(\n    payload: AuthenticateWithOrganizationSelectionOptions,\n  ): Promise<AuthenticationResponse> {\n    const { session, ...remainingPayload } = payload;\n\n    const { data } = await this.workos.post<\n      AuthenticationResponseResponse,\n      SerializedAuthenticateWithOrganizationSelectionOptions\n    >(\n      '/user_management/authenticate',\n      serializeAuthenticateWithOrganizationSelectionOptions({\n        ...remainingPayload,\n        clientSecret: this.workos.key,\n      }),\n    );\n\n    return this.prepareAuthenticationResponse({\n      authenticationResponse: deserializeAuthenticationResponse(data),\n      session,\n    });\n  }\n\n  async authenticateWithSessionCookie({\n    sessionData,\n    cookiePassword = getEnv('WORKOS_COOKIE_PASSWORD'),\n  }: AuthenticateWithSessionCookieOptions): Promise<\n    | AuthenticateWithSessionCookieSuccessResponse\n    | AuthenticateWithSessionCookieFailedResponse\n  > {\n    if (!cookiePassword) {\n      throw new Error('Cookie password is required');\n    }\n\n    if (!this.jwks) {\n      throw new Error('Must provide clientId to initialize JWKS');\n    }\n\n    if (!sessionData) {\n      return {\n        authenticated: false,\n        reason:\n          AuthenticateWithSessionCookieFailureReason.NO_SESSION_COOKIE_PROVIDED,\n      };\n    }\n\n    const session = await unsealData<SessionCookieData>(sessionData, {\n      password: cookiePassword,\n    });\n\n    if (!session.accessToken) {\n      return {\n        authenticated: false,\n        reason:\n          AuthenticateWithSessionCookieFailureReason.INVALID_SESSION_COOKIE,\n      };\n    }\n\n    if (!(await this.isValidJwt(session.accessToken))) {\n      return {\n        authenticated: false,\n        reason: AuthenticateWithSessionCookieFailureReason.INVALID_JWT,\n      };\n    }\n\n    const {\n      sid: sessionId,\n      org_id: organizationId,\n      role,\n      roles,\n      permissions,\n      entitlements,\n      feature_flags: featureFlags,\n    } = decodeJwt<AccessToken>(session.accessToken);\n\n    return {\n      authenticated: true,\n      sessionId,\n      organizationId,\n      role,\n      roles,\n      user: session.user,\n      permissions,\n      entitlements,\n      featureFlags,\n      accessToken: session.accessToken,\n    };\n  }\n\n  private async isValidJwt(accessToken: string): Promise<boolean> {\n    if (!this.jwks) {\n      throw new Error('Must provide clientId to initialize JWKS');\n    }\n\n    try {\n      await jwtVerify(accessToken, this.jwks);\n      return true;\n    } catch (e) {\n      return false;\n    }\n  }\n\n  private async prepareAuthenticationResponse({\n    authenticationResponse,\n    session,\n  }: {\n    authenticationResponse: AuthenticationResponse;\n    session?: AuthenticateWithSessionOptions;\n  }): Promise<AuthenticationResponse> {\n    if (session?.sealSession) {\n      return {\n        ...authenticationResponse,\n        sealedSession: await this.sealSessionDataFromAuthenticationResponse({\n          authenticationResponse,\n          cookiePassword: session.cookiePassword,\n        }),\n      };\n    }\n\n    return authenticationResponse;\n  }\n\n  private async sealSessionDataFromAuthenticationResponse({\n    authenticationResponse,\n    cookiePassword,\n  }: {\n    authenticationResponse: AuthenticationResponse;\n    cookiePassword?: string;\n  }): Promise<string> {\n    if (!cookiePassword) {\n      throw new Error('Cookie password is required');\n    }\n\n    const { org_id: organizationIdFromAccessToken } = decodeJwt<AccessToken>(\n      authenticationResponse.accessToken,\n    );\n\n    const sessionData: SessionCookieData = {\n      organizationId: organizationIdFromAccessToken,\n      user: authenticationResponse.user,\n      accessToken: authenticationResponse.accessToken,\n      refreshToken: authenticationResponse.refreshToken,\n      impersonator: authenticationResponse.impersonator,\n    };\n\n    return sealData(sessionData, {\n      password: cookiePassword,\n    });\n  }\n\n  async getSessionFromCookie({\n    sessionData,\n    cookiePassword = getEnv('WORKOS_COOKIE_PASSWORD'),\n  }: SessionHandlerOptions): Promise<SessionCookieData | undefined> {\n    if (!cookiePassword) {\n      throw new Error('Cookie password is required');\n    }\n\n    if (sessionData) {\n      return unsealData<SessionCookieData>(sessionData, {\n        password: cookiePassword,\n      });\n    }\n\n    return undefined;\n  }\n\n  async getEmailVerification(\n    emailVerificationId: string,\n  ): Promise<EmailVerification> {\n    const { data } = await this.workos.get<EmailVerificationResponse>(\n      `/user_management/email_verification/${emailVerificationId}`,\n    );\n\n    return deserializeEmailVerification(data);\n  }\n\n  async sendVerificationEmail({\n    userId,\n  }: SendVerificationEmailOptions): Promise<{ user: User }> {\n    const { data } = await this.workos.post<{ user: UserResponse }>(\n      `/user_management/users/${userId}/email_verification/send`,\n      {},\n    );\n\n    return { user: deserializeUser(data.user) };\n  }\n\n  async getMagicAuth(magicAuthId: string): Promise<MagicAuth> {\n    const { data } = await this.workos.get<MagicAuthResponse>(\n      `/user_management/magic_auth/${magicAuthId}`,\n    );\n\n    return deserializeMagicAuth(data);\n  }\n\n  async createMagicAuth(options: CreateMagicAuthOptions): Promise<MagicAuth> {\n    const { data } = await this.workos.post<\n      MagicAuthResponse,\n      SerializedCreateMagicAuthOptions\n    >(\n      '/user_management/magic_auth',\n      serializeCreateMagicAuthOptions({\n        ...options,\n      }),\n    );\n\n    return deserializeMagicAuth(data);\n  }\n\n  async verifyEmail({\n    code,\n    userId,\n  }: VerifyEmailOptions): Promise<{ user: User }> {\n    const { data } = await this.workos.post<\n      { user: UserResponse },\n      SerializedVerifyEmailOptions\n    >(`/user_management/users/${userId}/email_verification/confirm`, {\n      code,\n    });\n\n    return { user: deserializeUser(data.user) };\n  }\n\n  async getPasswordReset(passwordResetId: string): Promise<PasswordReset> {\n    const { data } = await this.workos.get<PasswordResetResponse>(\n      `/user_management/password_reset/${passwordResetId}`,\n    );\n\n    return deserializePasswordReset(data);\n  }\n\n  async createPasswordReset(\n    options: CreatePasswordResetOptions,\n  ): Promise<PasswordReset> {\n    const { data } = await this.workos.post<\n      PasswordResetResponse,\n      SerializedCreatePasswordResetOptions\n    >(\n      '/user_management/password_reset',\n      serializeCreatePasswordResetOptions({\n        ...options,\n      }),\n    );\n\n    return deserializePasswordReset(data);\n  }\n\n  async resetPassword(payload: ResetPasswordOptions): Promise<{ user: User }> {\n    const { data } = await this.workos.post<\n      { user: UserResponse },\n      SerializedResetPasswordOptions\n    >(\n      '/user_management/password_reset/confirm',\n      serializeResetPasswordOptions(payload),\n    );\n\n    return { user: deserializeUser(data.user) };\n  }\n\n  async updateUser(payload: UpdateUserOptions): Promise<User> {\n    const { data } = await this.workos.put<UserResponse>(\n      `/user_management/users/${payload.userId}`,\n      serializeUpdateUserOptions(payload),\n    );\n\n    return deserializeUser(data);\n  }\n\n  async enrollAuthFactor(payload: EnrollAuthFactorOptions): Promise<{\n    authenticationFactor: FactorWithSecrets;\n    authenticationChallenge: Challenge;\n  }> {\n    const { data } = await this.workos.post<{\n      authentication_factor: FactorWithSecretsResponse;\n      authentication_challenge: ChallengeResponse;\n    }>(\n      `/user_management/users/${payload.userId}/auth_factors`,\n      serializeEnrollAuthFactorOptions(payload),\n    );\n\n    return {\n      authenticationFactor: deserializeFactorWithSecrets(\n        data.authentication_factor,\n      ),\n      authenticationChallenge: deserializeChallenge(\n        data.authentication_challenge,\n      ),\n    };\n  }\n\n  async listAuthFactors(\n    options: ListAuthFactorsOptions,\n  ): Promise<AutoPaginatable<Factor, PaginationOptions>> {\n    const { userId, ...restOfOptions } = options;\n    return new AutoPaginatable(\n      await fetchAndDeserialize<FactorResponse, Factor>(\n        this.workos,\n        `/user_management/users/${userId}/auth_factors`,\n        deserializeFactor,\n        restOfOptions,\n      ),\n      (params) =>\n        fetchAndDeserialize<FactorResponse, Factor>(\n          this.workos,\n          `/user_management/users/${userId}/auth_factors`,\n          deserializeFactor,\n          params,\n        ),\n      restOfOptions,\n    );\n  }\n\n  async listUserFeatureFlags(\n    options: ListUserFeatureFlagsOptions,\n  ): Promise<AutoPaginatable<FeatureFlag>> {\n    const { userId, ...paginationOptions } = options;\n\n    return new AutoPaginatable(\n      await fetchAndDeserialize<FeatureFlagResponse, FeatureFlag>(\n        this.workos,\n        `/user_management/users/${userId}/feature-flags`,\n        deserializeFeatureFlag,\n        paginationOptions,\n      ),\n      (params) =>\n        fetchAndDeserialize<FeatureFlagResponse, FeatureFlag>(\n          this.workos,\n          `/user_management/users/${userId}/feature-flags`,\n          deserializeFeatureFlag,\n          params,\n        ),\n      paginationOptions,\n    );\n  }\n\n  async listSessions(\n    userId: string,\n    options?: ListSessionsOptions,\n  ): Promise<AutoPaginatable<Session, SerializedListSessionsOptions>> {\n    return new AutoPaginatable(\n      await fetchAndDeserialize<SessionResponse, Session>(\n        this.workos,\n        `/user_management/users/${userId}/sessions`,\n        deserializeSession,\n        options ? serializeListSessionsOptions(options) : undefined,\n      ),\n      (params) =>\n        fetchAndDeserialize<SessionResponse, Session>(\n          this.workos,\n          `/user_management/users/${userId}/sessions`,\n          deserializeSession,\n          params,\n        ),\n      options ? serializeListSessionsOptions(options) : undefined,\n    );\n  }\n\n  async deleteUser(userId: string) {\n    await this.workos.delete(`/user_management/users/${userId}`);\n  }\n\n  async getUserIdentities(userId: string): Promise<Identity[]> {\n    if (!userId) {\n      throw new TypeError(`Incomplete arguments. Need to specify 'userId'.`);\n    }\n\n    const { data } = await this.workos.get<IdentityResponse[]>(\n      `/user_management/users/${userId}/identities`,\n    );\n\n    return deserializeIdentities(data);\n  }\n\n  async getOrganizationMembership(\n    organizationMembershipId: string,\n  ): Promise<OrganizationMembership> {\n    const { data } = await this.workos.get<OrganizationMembershipResponse>(\n      `/user_management/organization_memberships/${organizationMembershipId}`,\n    );\n\n    return deserializeOrganizationMembership(data);\n  }\n\n  async listOrganizationMemberships(\n    options: ListOrganizationMembershipsOptions,\n  ): Promise<\n    AutoPaginatable<\n      OrganizationMembership,\n      SerializedListOrganizationMembershipsOptions\n    >\n  > {\n    const serializedOptions =\n      serializeListOrganizationMembershipsOptions(options);\n\n    return new AutoPaginatable(\n      await fetchAndDeserialize<\n        OrganizationMembershipResponse,\n        OrganizationMembership\n      >(\n        this.workos,\n        '/user_management/organization_memberships',\n        deserializeOrganizationMembership,\n        serializedOptions,\n      ),\n      (params) =>\n        fetchAndDeserialize<\n          OrganizationMembershipResponse,\n          OrganizationMembership\n        >(\n          this.workos,\n          '/user_management/organization_memberships',\n          deserializeOrganizationMembership,\n          params,\n        ),\n      serializedOptions,\n    );\n  }\n\n  async createOrganizationMembership(\n    options: CreateOrganizationMembershipOptions,\n  ): Promise<OrganizationMembership> {\n    const { data } = await this.workos.post<\n      OrganizationMembershipResponse,\n      SerializedCreateOrganizationMembershipOptions\n    >(\n      '/user_management/organization_memberships',\n      serializeCreateOrganizationMembershipOptions(options),\n    );\n\n    return deserializeOrganizationMembership(data);\n  }\n\n  async updateOrganizationMembership(\n    organizationMembershipId: string,\n    options: UpdateOrganizationMembershipOptions,\n  ): Promise<OrganizationMembership> {\n    const { data } = await this.workos.put<\n      OrganizationMembershipResponse,\n      SerializedUpdateOrganizationMembershipOptions\n    >(\n      `/user_management/organization_memberships/${organizationMembershipId}`,\n      serializeUpdateOrganizationMembershipOptions(options),\n    );\n\n    return deserializeOrganizationMembership(data);\n  }\n\n  async deleteOrganizationMembership(\n    organizationMembershipId: string,\n  ): Promise<void> {\n    await this.workos.delete(\n      `/user_management/organization_memberships/${organizationMembershipId}`,\n    );\n  }\n\n  async deactivateOrganizationMembership(\n    organizationMembershipId: string,\n  ): Promise<OrganizationMembership> {\n    const { data } = await this.workos.put<OrganizationMembershipResponse>(\n      `/user_management/organization_memberships/${organizationMembershipId}/deactivate`,\n      {},\n    );\n\n    return deserializeOrganizationMembership(data);\n  }\n\n  async reactivateOrganizationMembership(\n    organizationMembershipId: string,\n  ): Promise<OrganizationMembership> {\n    const { data } = await this.workos.put<OrganizationMembershipResponse>(\n      `/user_management/organization_memberships/${organizationMembershipId}/reactivate`,\n      {},\n    );\n\n    return deserializeOrganizationMembership(data);\n  }\n\n  async getInvitation(invitationId: string): Promise<Invitation> {\n    const { data } = await this.workos.get<InvitationResponse>(\n      `/user_management/invitations/${invitationId}`,\n    );\n\n    return deserializeInvitation(data);\n  }\n\n  async findInvitationByToken(invitationToken: string): Promise<Invitation> {\n    const { data } = await this.workos.get<InvitationResponse>(\n      `/user_management/invitations/by_token/${invitationToken}`,\n    );\n\n    return deserializeInvitation(data);\n  }\n\n  async listInvitations(\n    options: ListInvitationsOptions,\n  ): Promise<AutoPaginatable<Invitation, SerializedListInvitationsOptions>> {\n    return new AutoPaginatable(\n      await fetchAndDeserialize<InvitationResponse, Invitation>(\n        this.workos,\n        '/user_management/invitations',\n        deserializeInvitation,\n        options ? serializeListInvitationsOptions(options) : undefined,\n      ),\n      (params) =>\n        fetchAndDeserialize<InvitationResponse, Invitation>(\n          this.workos,\n          '/user_management/invitations',\n          deserializeInvitation,\n          params,\n        ),\n      options ? serializeListInvitationsOptions(options) : undefined,\n    );\n  }\n\n  async sendInvitation(payload: SendInvitationOptions): Promise<Invitation> {\n    const { data } = await this.workos.post<\n      InvitationResponse,\n      SerializedSendInvitationOptions\n    >(\n      '/user_management/invitations',\n      serializeSendInvitationOptions({\n        ...payload,\n      }),\n    );\n\n    return deserializeInvitation(data);\n  }\n\n  async acceptInvitation(invitationId: string): Promise<Invitation> {\n    const { data } = await this.workos.post<InvitationResponse, any>(\n      `/user_management/invitations/${invitationId}/accept`,\n      null,\n    );\n\n    return deserializeInvitation(data);\n  }\n\n  async revokeInvitation(invitationId: string): Promise<Invitation> {\n    const { data } = await this.workos.post<InvitationResponse, any>(\n      `/user_management/invitations/${invitationId}/revoke`,\n      null,\n    );\n\n    return deserializeInvitation(data);\n  }\n\n  async revokeSession(payload: RevokeSessionOptions): Promise<void> {\n    await this.workos.post<void, SerializedRevokeSessionOptions>(\n      '/user_management/sessions/revoke',\n      serializeRevokeSessionOptions(payload),\n    );\n  }\n\n  getAuthorizationUrl(options: UserManagementAuthorizationURLOptions): string {\n    // Delegate to client implementation\n    return clientUserManagement.getAuthorizationUrl({\n      ...options,\n      baseURL: this.workos.baseURL,\n    });\n  }\n\n  getLogoutUrl(options: clientUserManagement.LogoutURLOptions): string {\n    // Delegate to client implementation\n    return clientUserManagement.getLogoutUrl({\n      ...options,\n      baseURL: this.workos.baseURL,\n    });\n  }\n\n  getJwksUrl(clientId: string): string {\n    // Delegate to client implementation\n    return clientUserManagement.getJwksUrl(clientId, this.workos.baseURL);\n  }\n}\n"],"mappings":";;AAAA,SAAS,UAAU,kBAAkB;AACrC,SAAS,oBAAoB,WAAW,iBAAiB;AACzD,YAAY,0BAA0B;AAEtC,SAAS,2BAA2B;AACpC,SAAS,uBAAuB;AAChC,SAAS,cAAc;AAEvB,SAAS,4BAA4B;AAKrC,SAAS,8BAA8B;AAwDvC;AAAA,EAGE;AAAA,OAIK;AA6BP;AAAA,EAGE;AAAA,OACK;AAUP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,yDAAyD;AAClE,SAAS,6DAA6D;AACtE,SAAS,oDAAoD;AAC7D,SAAS,yBAAyB;AAClC,SAAS,6BAA6B;AACtC,SAAS,6BAA6B;AACtC,SAAS,uCAAuC;AAChD,SAAS,mDAAmD;AAC5D,SAAS,iCAAiC;AAC1C,SAAS,yCAAyC;AAClD,SAAS,sCAAsC;AAC/C,SAAS,oDAAoD;AAC7D,SAAS,qBAAqB;AAEvB,MAAM,eAAe;AAAA,EAI1B,YAA6B,QAAgB;AAAhB;AAC3B,UAAM,EAAE,SAAS,IAAI,OAAO;AAE5B,SAAK,WAAW;AAAA,EAClB;AAAA,EAnKF,OA2J4B;AAAA;AAAA;AAAA,EAClB;AAAA,EACD;AAAA,EAQP,IAAI,OAA0D;AAC5D,QAAI,CAAC,KAAK,UAAU;AAClB;AAAA,IACF;AAGA,SAAK,UAAU,mBAAmB,IAAI,IAAI,KAAK,WAAW,KAAK,QAAQ,CAAC,GAAG;AAAA,MACzE,kBAAkB,MAAO,KAAK;AAAA,IAChC,CAAC;AAED,WAAO,KAAK;AAAA,EACd;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,kBAAkB,SAGA;AAChB,WAAO,IAAI,cAAc,MAAM,QAAQ,aAAa,QAAQ,cAAc;AAAA,EAC5E;AAAA,EAEA,MAAM,QAAQ,QAA+B;AAC3C,UAAM,EAAE,KAAK,IAAI,MAAM,KAAK,OAAO;AAAA,MACjC,0BAA0B,MAAM;AAAA,IAClC;AAEA,WAAO,gBAAgB,IAAI;AAAA,EAC7B;AAAA,EAEA,MAAM,oBAAoB,YAAmC;AAC3D,UAAM,EAAE,KAAK,IAAI,MAAM,KAAK,OAAO;AAAA,MACjC,sCAAsC,UAAU;AAAA,IAClD;AAEA,WAAO,gBAAgB,IAAI;AAAA,EAC7B;AAAA,EAEA,MAAM,UACJ,SAC4D;AAC5D,WAAO,IAAI;AAAA,MACT,MAAM;AAAA,QACJ,KAAK;AAAA,QACL;AAAA,QACA;AAAA,QACA,UAAU,0BAA0B,OAAO,IAAI;AAAA,MACjD;AAAA,MACA,CAAC,WACC;AAAA,QACE,KAAK;AAAA,QACL;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,MACF,UAAU,0BAA0B,OAAO,IAAI;AAAA,IACjD;AAAA,EACF;AAAA,EAEA,MAAM,WAAW,SAA2C;AAC1D,UAAM,EAAE,KAAK,IAAI,MAAM,KAAK,OAAO,KAGjC,0BAA0B,2BAA2B,OAAO,CAAC;AAE/D,WAAO,gBAAgB,IAAI;AAAA,EAC7B;AAAA,EAEA,MAAM,0BACJ,SACiC;AACjC,UAAM,EAAE,SAAS,GAAG,iBAAiB,IAAI;AAEzC,UAAM,EAAE,KAAK,IAAI,MAAM,KAAK,OAAO;AAAA,MAIjC;AAAA,MACA,0CAA0C;AAAA,QACxC,GAAG;AAAA,QACH,cAAc,KAAK,OAAO;AAAA,MAC5B,CAAC;AAAA,IACH;AAEA,WAAO,KAAK,8BAA8B;AAAA,MACxC,wBAAwB,kCAAkC,IAAI;AAAA,MAC9D;AAAA,IACF,CAAC;AAAA,EACH;AAAA,EAEA,MAAM,yBACJ,SACiC;AACjC,UAAM,EAAE,SAAS,GAAG,iBAAiB,IAAI;AAEzC,UAAM,EAAE,KAAK,IAAI,MAAM,KAAK,OAAO;AAAA,MAIjC;AAAA,MACA,yCAAyC;AAAA,QACvC,GAAG;AAAA,QACH,cAAc,KAAK,OAAO;AAAA,MAC5B,CAAC;AAAA,IACH;AAEA,WAAO,KAAK,8BAA8B;AAAA,MACxC,wBAAwB,kCAAkC,IAAI;AAAA,MAC9D;AAAA,IACF,CAAC;AAAA,EACH;AAAA,EAEA,MAAM,qBACJ,SACiC;AACjC,UAAM,EAAE,SAAS,GAAG,iBAAiB,IAAI;AAEzC,UAAM,EAAE,KAAK,IAAI,MAAM,KAAK,OAAO;AAAA,MAIjC;AAAA,MACA,qCAAqC;AAAA,QACnC,GAAG;AAAA,QACH,cAAc,KAAK,OAAO;AAAA,MAC5B,CAAC;AAAA,IACH;AAEA,WAAO,KAAK,8BAA8B;AAAA,MACxC,wBAAwB,kCAAkC,IAAI;AAAA,MAC9D;AAAA,IACF,CAAC;AAAA,EACH;AAAA,EAEA,MAAM,gCACJ,SACiC;AACjC,UAAM,EAAE,SAAS,GAAG,iBAAiB,IAAI;AAEzC,UAAM,EAAE,KAAK,IAAI,MAAM,KAAK,OAAO;AAAA,MAIjC;AAAA,MACA,gDAAgD,gBAAgB;AAAA,IAClE;AAEA,WAAO,KAAK,8BAA8B;AAAA,MACxC,wBAAwB,kCAAkC,IAAI;AAAA,MAC9D;AAAA,IACF,CAAC;AAAA,EACH;AAAA,EAEA,MAAM,6BACJ,SACiC;AACjC,UAAM,EAAE,SAAS,GAAG,iBAAiB,IAAI;AAEzC,UAAM,EAAE,KAAK,IAAI,MAAM,KAAK,OAAO;AAAA,MAIjC;AAAA,MACA,6CAA6C;AAAA,QAC3C,GAAG;AAAA,QACH,cAAc,KAAK,OAAO;AAAA,MAC5B,CAAC;AAAA,IACH;AAEA,WAAO,KAAK,8BAA8B;AAAA,MACxC,wBAAwB,kCAAkC,IAAI;AAAA,MAC9D;AAAA,IACF,CAAC;AAAA,EACH;AAAA,EAEA,MAAM,qBACJ,SACiC;AACjC,UAAM,EAAE,SAAS,GAAG,iBAAiB,IAAI;AAEzC,UAAM,EAAE,KAAK,IAAI,MAAM,KAAK,OAAO;AAAA,MAIjC;AAAA,MACA,qCAAqC;AAAA,QACnC,GAAG;AAAA,QACH,cAAc,KAAK,OAAO;AAAA,MAC5B,CAAC;AAAA,IACH;AAEA,WAAO,KAAK,8BAA8B;AAAA,MACxC,wBAAwB,kCAAkC,IAAI;AAAA,MAC9D;AAAA,IACF,CAAC;AAAA,EACH;AAAA,EAEA,MAAM,kCACJ,SACiC;AACjC,UAAM,EAAE,SAAS,GAAG,iBAAiB,IAAI;AAEzC,UAAM,EAAE,KAAK,IAAI,MAAM,KAAK,OAAO;AAAA,MAIjC;AAAA,MACA,kDAAkD;AAAA,QAChD,GAAG;AAAA,QACH,cAAc,KAAK,OAAO;AAAA,MAC5B,CAAC;AAAA,IACH;AAEA,WAAO,KAAK,8BAA8B;AAAA,MACxC,wBAAwB,kCAAkC,IAAI;AAAA,MAC9D;AAAA,IACF,CAAC;AAAA,EACH;AAAA,EAEA,MAAM,sCACJ,SACiC;AACjC,UAAM,EAAE,SAAS,GAAG,iBAAiB,IAAI;AAEzC,UAAM,EAAE,KAAK,IAAI,MAAM,KAAK,OAAO;AAAA,MAIjC;AAAA,MACA,sDAAsD;AAAA,QACpD,GAAG;AAAA,QACH,cAAc,KAAK,OAAO;AAAA,MAC5B,CAAC;AAAA,IACH;AAEA,WAAO,KAAK,8BAA8B;AAAA,MACxC,wBAAwB,kCAAkC,IAAI;AAAA,MAC9D;AAAA,IACF,CAAC;AAAA,EACH;AAAA,EAEA,MAAM,8BAA8B;AAAA,IAClC;AAAA,IACA,iBAAiB,OAAO,wBAAwB;AAAA,EAClD,GAGE;AACA,QAAI,CAAC,gBAAgB;AACnB,YAAM,IAAI,MAAM,6BAA6B;AAAA,IAC/C;AAEA,QAAI,CAAC,KAAK,MAAM;AACd,YAAM,IAAI,MAAM,0CAA0C;AAAA,IAC5D;AAEA,QAAI,CAAC,aAAa;AAChB,aAAO;AAAA,QACL,eAAe;AAAA,QACf,QACE,2CAA2C;AAAA,MAC/C;AAAA,IACF;AAEA,UAAM,UAAU,MAAM,WAA8B,aAAa;AAAA,MAC/D,UAAU;AAAA,IACZ,CAAC;AAED,QAAI,CAAC,QAAQ,aAAa;AACxB,aAAO;AAAA,QACL,eAAe;AAAA,QACf,QACE,2CAA2C;AAAA,MAC/C;AAAA,IACF;AAEA,QAAI,CAAE,MAAM,KAAK,WAAW,QAAQ,WAAW,GAAI;AACjD,aAAO;AAAA,QACL,eAAe;AAAA,QACf,QAAQ,2CAA2C;AAAA,MACrD;AAAA,IACF;AAEA,UAAM;AAAA,MACJ,KAAK;AAAA,MACL,QAAQ;AAAA,MACR;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,eAAe;AAAA,IACjB,IAAI,UAAuB,QAAQ,WAAW;AAE9C,WAAO;AAAA,MACL,eAAe;AAAA,MACf;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,MAAM,QAAQ;AAAA,MACd;AAAA,MACA;AAAA,MACA;AAAA,MACA,aAAa,QAAQ;AAAA,IACvB;AAAA,EACF;AAAA,EAEA,MAAc,WAAW,aAAuC;AAC9D,QAAI,CAAC,KAAK,MAAM;AACd,YAAM,IAAI,MAAM,0CAA0C;AAAA,IAC5D;AAEA,QAAI;AACF,YAAM,UAAU,aAAa,KAAK,IAAI;AACtC,aAAO;AAAA,IACT,SAAS,GAAG;AACV,aAAO;AAAA,IACT;AAAA,EACF;AAAA,EAEA,MAAc,8BAA8B;AAAA,IAC1C;AAAA,IACA;AAAA,EACF,GAGoC;AAClC,QAAI,SAAS,aAAa;AACxB,aAAO;AAAA,QACL,GAAG;AAAA,QACH,eAAe,MAAM,KAAK,0CAA0C;AAAA,UAClE;AAAA,UACA,gBAAgB,QAAQ;AAAA,QAC1B,CAAC;AAAA,MACH;AAAA,IACF;AAEA,WAAO;AAAA,EACT;AAAA,EAEA,MAAc,0CAA0C;AAAA,IACtD;AAAA,IACA;AAAA,EACF,GAGoB;AAClB,QAAI,CAAC,gBAAgB;AACnB,YAAM,IAAI,MAAM,6BAA6B;AAAA,IAC/C;AAEA,UAAM,EAAE,QAAQ,8BAA8B,IAAI;AAAA,MAChD,uBAAuB;AAAA,IACzB;AAEA,UAAM,cAAiC;AAAA,MACrC,gBAAgB;AAAA,MAChB,MAAM,uBAAuB;AAAA,MAC7B,aAAa,uBAAuB;AAAA,MACpC,cAAc,uBAAuB;AAAA,MACrC,cAAc,uBAAuB;AAAA,IACvC;AAEA,WAAO,SAAS,aAAa;AAAA,MAC3B,UAAU;AAAA,IACZ,CAAC;AAAA,EACH;AAAA,EAEA,MAAM,qBAAqB;AAAA,IACzB;AAAA,IACA,iBAAiB,OAAO,wBAAwB;AAAA,EAClD,GAAkE;AAChE,QAAI,CAAC,gBAAgB;AACnB,YAAM,IAAI,MAAM,6BAA6B;AAAA,IAC/C;AAEA,QAAI,aAAa;AACf,aAAO,WAA8B,aAAa;AAAA,QAChD,UAAU;AAAA,MACZ,CAAC;AAAA,IACH;AAEA,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,qBACJ,qBAC4B;AAC5B,UAAM,EAAE,KAAK,IAAI,MAAM,KAAK,OAAO;AAAA,MACjC,uCAAuC,mBAAmB;AAAA,IAC5D;AAEA,WAAO,6BAA6B,IAAI;AAAA,EAC1C;AAAA,EAEA,MAAM,sBAAsB;AAAA,IAC1B;AAAA,EACF,GAA0D;AACxD,UAAM,EAAE,KAAK,IAAI,MAAM,KAAK,OAAO;AAAA,MACjC,0BAA0B,MAAM;AAAA,MAChC,CAAC;AAAA,IACH;AAEA,WAAO,EAAE,MAAM,gBAAgB,KAAK,IAAI,EAAE;AAAA,EAC5C;AAAA,EAEA,MAAM,aAAa,aAAyC;AAC1D,UAAM,EAAE,KAAK,IAAI,MAAM,KAAK,OAAO;AAAA,MACjC,+BAA+B,WAAW;AAAA,IAC5C;AAEA,WAAO,qBAAqB,IAAI;AAAA,EAClC;AAAA,EAEA,MAAM,gBAAgB,SAAqD;AACzE,UAAM,EAAE,KAAK,IAAI,MAAM,KAAK,OAAO;AAAA,MAIjC;AAAA,MACA,gCAAgC;AAAA,QAC9B,GAAG;AAAA,MACL,CAAC;AAAA,IACH;AAEA,WAAO,qBAAqB,IAAI;AAAA,EAClC;AAAA,EAEA,MAAM,YAAY;AAAA,IAChB;AAAA,IACA;AAAA,EACF,GAAgD;AAC9C,UAAM,EAAE,KAAK,IAAI,MAAM,KAAK,OAAO,KAGjC,0BAA0B,MAAM,+BAA+B;AAAA,MAC/D;AAAA,IACF,CAAC;AAED,WAAO,EAAE,MAAM,gBAAgB,KAAK,IAAI,EAAE;AAAA,EAC5C;AAAA,EAEA,MAAM,iBAAiB,iBAAiD;AACtE,UAAM,EAAE,KAAK,IAAI,MAAM,KAAK,OAAO;AAAA,MACjC,mCAAmC,eAAe;AAAA,IACpD;AAEA,WAAO,yBAAyB,IAAI;AAAA,EACtC;AAAA,EAEA,MAAM,oBACJ,SACwB;AACxB,UAAM,EAAE,KAAK,IAAI,MAAM,KAAK,OAAO;AAAA,MAIjC;AAAA,MACA,oCAAoC;AAAA,QAClC,GAAG;AAAA,MACL,CAAC;AAAA,IACH;AAEA,WAAO,yBAAyB,IAAI;AAAA,EACtC;AAAA,EAEA,MAAM,cAAc,SAAwD;AAC1E,UAAM,EAAE,KAAK,IAAI,MAAM,KAAK,OAAO;AAAA,MAIjC;AAAA,MACA,8BAA8B,OAAO;AAAA,IACvC;AAEA,WAAO,EAAE,MAAM,gBAAgB,KAAK,IAAI,EAAE;AAAA,EAC5C;AAAA,EAEA,MAAM,WAAW,SAA2C;AAC1D,UAAM,EAAE,KAAK,IAAI,MAAM,KAAK,OAAO;AAAA,MACjC,0BAA0B,QAAQ,MAAM;AAAA,MACxC,2BAA2B,OAAO;AAAA,IACpC;AAEA,WAAO,gBAAgB,IAAI;AAAA,EAC7B;AAAA,EAEA,MAAM,iBAAiB,SAGpB;AACD,UAAM,EAAE,KAAK,IAAI,MAAM,KAAK,OAAO;AAAA,MAIjC,0BAA0B,QAAQ,MAAM;AAAA,MACxC,iCAAiC,OAAO;AAAA,IAC1C;AAEA,WAAO;AAAA,MACL,sBAAsB;AAAA,QACpB,KAAK;AAAA,MACP;AAAA,MACA,yBAAyB;AAAA,QACvB,KAAK;AAAA,MACP;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,gBACJ,SACqD;AACrD,UAAM,EAAE,QAAQ,GAAG,cAAc,IAAI;AACrC,WAAO,IAAI;AAAA,MACT,MAAM;AAAA,QACJ,KAAK;AAAA,QACL,0BAA0B,MAAM;AAAA,QAChC;AAAA,QACA;AAAA,MACF;AAAA,MACA,CAAC,WACC;AAAA,QACE,KAAK;AAAA,QACL,0BAA0B,MAAM;AAAA,QAChC;AAAA,QACA;AAAA,MACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,qBACJ,SACuC;AACvC,UAAM,EAAE,QAAQ,GAAG,kBAAkB,IAAI;AAEzC,WAAO,IAAI;AAAA,MACT,MAAM;AAAA,QACJ,KAAK;AAAA,QACL,0BAA0B,MAAM;AAAA,QAChC;AAAA,QACA;AAAA,MACF;AAAA,MACA,CAAC,WACC;AAAA,QACE,KAAK;AAAA,QACL,0BAA0B,MAAM;AAAA,QAChC;AAAA,QACA;AAAA,MACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,aACJ,QACA,SACkE;AAClE,WAAO,IAAI;AAAA,MACT,MAAM;AAAA,QACJ,KAAK;AAAA,QACL,0BAA0B,MAAM;AAAA,QAChC;AAAA,QACA,UAAU,6BAA6B,OAAO,IAAI;AAAA,MACpD;AAAA,MACA,CAAC,WACC;AAAA,QACE,KAAK;AAAA,QACL,0BAA0B,MAAM;AAAA,QAChC;AAAA,QACA;AAAA,MACF;AAAA,MACF,UAAU,6BAA6B,OAAO,IAAI;AAAA,IACpD;AAAA,EACF;AAAA,EAEA,MAAM,WAAW,QAAgB;AAC/B,UAAM,KAAK,OAAO,OAAO,0BAA0B,MAAM,EAAE;AAAA,EAC7D;AAAA,EAEA,MAAM,kBAAkB,QAAqC;AAC3D,QAAI,CAAC,QAAQ;AACX,YAAM,IAAI,UAAU,iDAAiD;AAAA,IACvE;AAEA,UAAM,EAAE,KAAK,IAAI,MAAM,KAAK,OAAO;AAAA,MACjC,0BAA0B,MAAM;AAAA,IAClC;AAEA,WAAO,sBAAsB,IAAI;AAAA,EACnC;AAAA,EAEA,MAAM,0BACJ,0BACiC;AACjC,UAAM,EAAE,KAAK,IAAI,MAAM,KAAK,OAAO;AAAA,MACjC,6CAA6C,wBAAwB;AAAA,IACvE;AAEA,WAAO,kCAAkC,IAAI;AAAA,EAC/C;AAAA,EAEA,MAAM,4BACJ,SAMA;AACA,UAAM,oBACJ,4CAA4C,OAAO;AAErD,WAAO,IAAI;AAAA,MACT,MAAM;AAAA,QAIJ,KAAK;AAAA,QACL;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,MACA,CAAC,WACC;AAAA,QAIE,KAAK;AAAA,QACL;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,6BACJ,SACiC;AACjC,UAAM,EAAE,KAAK,IAAI,MAAM,KAAK,OAAO;AAAA,MAIjC;AAAA,MACA,6CAA6C,OAAO;AAAA,IACtD;AAEA,WAAO,kCAAkC,IAAI;AAAA,EAC/C;AAAA,EAEA,MAAM,6BACJ,0BACA,SACiC;AACjC,UAAM,EAAE,KAAK,IAAI,MAAM,KAAK,OAAO;AAAA,MAIjC,6CAA6C,wBAAwB;AAAA,MACrE,6CAA6C,OAAO;AAAA,IACtD;AAEA,WAAO,kCAAkC,IAAI;AAAA,EAC/C;AAAA,EAEA,MAAM,6BACJ,0BACe;AACf,UAAM,KAAK,OAAO;AAAA,MAChB,6CAA6C,wBAAwB;AAAA,IACvE;AAAA,EACF;AAAA,EAEA,MAAM,iCACJ,0BACiC;AACjC,UAAM,EAAE,KAAK,IAAI,MAAM,KAAK,OAAO;AAAA,MACjC,6CAA6C,wBAAwB;AAAA,MACrE,CAAC;AAAA,IACH;AAEA,WAAO,kCAAkC,IAAI;AAAA,EAC/C;AAAA,EAEA,MAAM,iCACJ,0BACiC;AACjC,UAAM,EAAE,KAAK,IAAI,MAAM,KAAK,OAAO;AAAA,MACjC,6CAA6C,wBAAwB;AAAA,MACrE,CAAC;AAAA,IACH;AAEA,WAAO,kCAAkC,IAAI;AAAA,EAC/C;AAAA,EAEA,MAAM,cAAc,cAA2C;AAC7D,UAAM,EAAE,KAAK,IAAI,MAAM,KAAK,OAAO;AAAA,MACjC,gCAAgC,YAAY;AAAA,IAC9C;AAEA,WAAO,sBAAsB,IAAI;AAAA,EACnC;AAAA,EAEA,MAAM,sBAAsB,iBAA8C;AACxE,UAAM,EAAE,KAAK,IAAI,MAAM,KAAK,OAAO;AAAA,MACjC,yCAAyC,eAAe;AAAA,IAC1D;AAEA,WAAO,sBAAsB,IAAI;AAAA,EACnC;AAAA,EAEA,MAAM,gBACJ,SACwE;AACxE,WAAO,IAAI;AAAA,MACT,MAAM;AAAA,QACJ,KAAK;AAAA,QACL;AAAA,QACA;AAAA,QACA,UAAU,gCAAgC,OAAO,IAAI;AAAA,MACvD;AAAA,MACA,CAAC,WACC;AAAA,QACE,KAAK;AAAA,QACL;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,MACF,UAAU,gCAAgC,OAAO,IAAI;AAAA,IACvD;AAAA,EACF;AAAA,EAEA,MAAM,eAAe,SAAqD;AACxE,UAAM,EAAE,KAAK,IAAI,MAAM,KAAK,OAAO;AAAA,MAIjC;AAAA,MACA,+BAA+B;AAAA,QAC7B,GAAG;AAAA,MACL,CAAC;AAAA,IACH;AAEA,WAAO,sBAAsB,IAAI;AAAA,EACnC;AAAA,EAEA,MAAM,iBAAiB,cAA2C;AAChE,UAAM,EAAE,KAAK,IAAI,MAAM,KAAK,OAAO;AAAA,MACjC,gCAAgC,YAAY;AAAA,MAC5C;AAAA,IACF;AAEA,WAAO,sBAAsB,IAAI;AAAA,EACnC;AAAA,EAEA,MAAM,iBAAiB,cAA2C;AAChE,UAAM,EAAE,KAAK,IAAI,MAAM,KAAK,OAAO;AAAA,MACjC,gCAAgC,YAAY;AAAA,MAC5C;AAAA,IACF;AAEA,WAAO,sBAAsB,IAAI;AAAA,EACnC;AAAA,EAEA,MAAM,cAAc,SAA8C;AAChE,UAAM,KAAK,OAAO;AAAA,MAChB;AAAA,MACA,8BAA8B,OAAO;AAAA,IACvC;AAAA,EACF;AAAA,EAEA,oBAAoB,SAAwD;AAE1E,WAAO,qBAAqB,oBAAoB;AAAA,MAC9C,GAAG;AAAA,MACH,SAAS,KAAK,OAAO;AAAA,IACvB,CAAC;AAAA,EACH;AAAA,EAEA,aAAa,SAAwD;AAEnE,WAAO,qBAAqB,aAAa;AAAA,MACvC,GAAG;AAAA,MACH,SAAS,KAAK,OAAO;AAAA,IACvB,CAAC;AAAA,EACH;AAAA,EAEA,WAAW,UAA0B;AAEnC,WAAO,qBAAqB,WAAW,UAAU,KAAK,OAAO,OAAO;AAAA,EACtE;AACF;","names":[]}
+{"version":3,"sources":["../../../src/user-management/user-management.ts"],"sourcesContent":["import { sealData, unsealData } from 'iron-session';\nimport * as clientUserManagement from '../client/user-management';\nimport { PaginationOptions } from '../common/interfaces/pagination-options.interface';\nimport { fetchAndDeserialize } from '../common/utils/fetch-and-deserialize';\nimport { AutoPaginatable } from '../common/utils/pagination';\nimport { getEnv } from '../common/utils/env';\nimport { Challenge, ChallengeResponse } from '../mfa/interfaces';\nimport { deserializeChallenge } from '../mfa/serializers';\nimport {\n  FeatureFlag,\n  FeatureFlagResponse,\n} from '../feature-flags/interfaces/feature-flag.interface';\nimport { deserializeFeatureFlag } from '../feature-flags/serializers/feature-flag.serializer';\nimport { WorkOS } from '../workos';\nimport {\n  AuthenticateWithCodeAndVerifierOptions,\n  AuthenticateWithCodeOptions,\n  AuthenticateWithMagicAuthOptions,\n  AuthenticateWithPasswordOptions,\n  AuthenticateWithRefreshTokenOptions,\n  AuthenticateWithSessionOptions,\n  AuthenticateWithTotpOptions,\n  AuthenticationResponse,\n  AuthenticationResponseResponse,\n  CreateMagicAuthOptions,\n  CreatePasswordResetOptions,\n  CreateUserOptions,\n  EmailVerification,\n  EmailVerificationResponse,\n  EnrollAuthFactorOptions,\n  ListAuthFactorsOptions,\n  ListSessionsOptions,\n  ListUsersOptions,\n  ListUserFeatureFlagsOptions,\n  MagicAuth,\n  MagicAuthResponse,\n  PasswordReset,\n  PasswordResetResponse,\n  ResetPasswordOptions,\n  SendVerificationEmailOptions,\n  SerializedAuthenticateWithCodeAndVerifierOptions,\n  SerializedAuthenticateWithCodeOptions,\n  SerializedAuthenticateWithMagicAuthOptions,\n  SerializedAuthenticateWithPasswordOptions,\n  SerializedAuthenticateWithRefreshTokenOptions,\n  SerializedAuthenticateWithTotpOptions,\n  SerializedCreateMagicAuthOptions,\n  SerializedCreatePasswordResetOptions,\n  SerializedCreateUserOptions,\n  SerializedListSessionsOptions,\n  SerializedListUsersOptions,\n  SerializedResetPasswordOptions,\n  SerializedVerifyEmailOptions,\n  Session,\n  SessionResponse,\n  UpdateUserOptions,\n  User,\n  UserResponse,\n  VerifyEmailOptions,\n} from './interfaces';\nimport {\n  AuthenticateWithEmailVerificationOptions,\n  SerializedAuthenticateWithEmailVerificationOptions,\n} from './interfaces/authenticate-with-email-verification-options.interface';\nimport {\n  AuthenticateWithOrganizationSelectionOptions,\n  SerializedAuthenticateWithOrganizationSelectionOptions,\n} from './interfaces/authenticate-with-organization-selection.interface';\nimport {\n  AccessToken,\n  AuthenticateWithSessionCookieFailedResponse,\n  AuthenticateWithSessionCookieFailureReason,\n  AuthenticateWithSessionCookieOptions,\n  AuthenticateWithSessionCookieSuccessResponse,\n  SessionCookieData,\n} from './interfaces/authenticate-with-session-cookie.interface';\nimport { UserManagementAuthorizationURLOptions } from './interfaces/authorization-url-options.interface';\nimport {\n  CreateOrganizationMembershipOptions,\n  SerializedCreateOrganizationMembershipOptions,\n} from './interfaces/create-organization-membership-options.interface';\nimport {\n  Factor,\n  FactorResponse,\n  FactorWithSecrets,\n  FactorWithSecretsResponse,\n} from './interfaces/factor.interface';\nimport { Identity, IdentityResponse } from './interfaces/identity.interface';\nimport {\n  Invitation,\n  InvitationResponse,\n} from './interfaces/invitation.interface';\nimport {\n  ListInvitationsOptions,\n  SerializedListInvitationsOptions,\n} from './interfaces/list-invitations-options.interface';\nimport {\n  ListOrganizationMembershipsOptions,\n  SerializedListOrganizationMembershipsOptions,\n} from './interfaces/list-organization-memberships-options.interface';\nimport {\n  OrganizationMembership,\n  OrganizationMembershipResponse,\n} from './interfaces/organization-membership.interface';\nimport {\n  RevokeSessionOptions,\n  SerializedRevokeSessionOptions,\n  serializeRevokeSessionOptions,\n} from './interfaces/revoke-session-options.interface';\nimport {\n  SendInvitationOptions,\n  SerializedSendInvitationOptions,\n} from './interfaces/send-invitation-options.interface';\nimport { SessionHandlerOptions } from './interfaces/session-handler-options.interface';\nimport {\n  SerializedUpdateOrganizationMembershipOptions,\n  UpdateOrganizationMembershipOptions,\n} from './interfaces/update-organization-membership-options.interface';\nimport {\n  deserializeAuthenticationResponse,\n  deserializeEmailVerification,\n  deserializeFactorWithSecrets,\n  deserializeMagicAuth,\n  deserializePasswordReset,\n  deserializeSession,\n  deserializeUser,\n  serializeAuthenticateWithCodeAndVerifierOptions,\n  serializeAuthenticateWithCodeOptions,\n  serializeAuthenticateWithMagicAuthOptions,\n  serializeAuthenticateWithPasswordOptions,\n  serializeAuthenticateWithRefreshTokenOptions,\n  serializeAuthenticateWithTotpOptions,\n  serializeCreateMagicAuthOptions,\n  serializeCreatePasswordResetOptions,\n  serializeCreateUserOptions,\n  serializeEnrollAuthFactorOptions,\n  serializeListSessionsOptions,\n  serializeResetPasswordOptions,\n  serializeUpdateUserOptions,\n} from './serializers';\nimport { serializeAuthenticateWithEmailVerificationOptions } from './serializers/authenticate-with-email-verification.serializer';\nimport { serializeAuthenticateWithOrganizationSelectionOptions } from './serializers/authenticate-with-organization-selection-options.serializer';\nimport { serializeCreateOrganizationMembershipOptions } from './serializers/create-organization-membership-options.serializer';\nimport { deserializeFactor } from './serializers/factor.serializer';\nimport { deserializeIdentities } from './serializers/identity.serializer';\nimport { deserializeInvitation } from './serializers/invitation.serializer';\nimport { serializeListInvitationsOptions } from './serializers/list-invitations-options.serializer';\nimport { serializeListOrganizationMembershipsOptions } from './serializers/list-organization-memberships-options.serializer';\nimport { serializeListUsersOptions } from './serializers/list-users-options.serializer';\nimport { deserializeOrganizationMembership } from './serializers/organization-membership.serializer';\nimport { serializeSendInvitationOptions } from './serializers/send-invitation-options.serializer';\nimport { serializeUpdateOrganizationMembershipOptions } from './serializers/update-organization-membership-options.serializer';\nimport { CookieSession } from './session';\nimport { getJose } from '../utils/jose';\n\nexport class UserManagement {\n  private _jwks:\n    | ReturnType<typeof import('jose').createRemoteJWKSet>\n    | undefined;\n  public clientId: string | undefined;\n\n  constructor(private readonly workos: WorkOS) {\n    const { clientId } = workos.options;\n\n    this.clientId = clientId;\n  }\n\n  async getJWKS(): Promise<\n    ReturnType<typeof import('jose').createRemoteJWKSet> | undefined\n  > {\n    const { createRemoteJWKSet } = await getJose();\n    if (!this.clientId) {\n      return;\n    }\n\n    // Set the JWKS URL. This is used to verify if the JWT is still valid\n    this._jwks ??= createRemoteJWKSet(new URL(this.getJwksUrl(this.clientId)), {\n      cooldownDuration: 1000 * 60 * 5,\n    });\n\n    return this._jwks;\n  }\n\n  /**\n   * Loads a sealed session using the provided session data and cookie password.\n   *\n   * @param options - The options for loading the sealed session.\n   * @param options.sessionData - The sealed session data.\n   * @param options.cookiePassword - The password used to encrypt the session data.\n   * @returns The session class.\n   */\n  loadSealedSession(options: {\n    sessionData: string;\n    cookiePassword: string;\n  }): CookieSession {\n    return new CookieSession(this, options.sessionData, options.cookiePassword);\n  }\n\n  async getUser(userId: string): Promise<User> {\n    const { data } = await this.workos.get<UserResponse>(\n      `/user_management/users/${userId}`,\n    );\n\n    return deserializeUser(data);\n  }\n\n  async getUserByExternalId(externalId: string): Promise<User> {\n    const { data } = await this.workos.get<UserResponse>(\n      `/user_management/users/external_id/${externalId}`,\n    );\n\n    return deserializeUser(data);\n  }\n\n  async listUsers(\n    options?: ListUsersOptions,\n  ): Promise<AutoPaginatable<User, SerializedListUsersOptions>> {\n    return new AutoPaginatable(\n      await fetchAndDeserialize<UserResponse, User>(\n        this.workos,\n        '/user_management/users',\n        deserializeUser,\n        options ? serializeListUsersOptions(options) : undefined,\n      ),\n      (params) =>\n        fetchAndDeserialize<UserResponse, User>(\n          this.workos,\n          '/user_management/users',\n          deserializeUser,\n          params,\n        ),\n      options ? serializeListUsersOptions(options) : undefined,\n    );\n  }\n\n  async createUser(payload: CreateUserOptions): Promise<User> {\n    const { data } = await this.workos.post<\n      UserResponse,\n      SerializedCreateUserOptions\n    >('/user_management/users', serializeCreateUserOptions(payload));\n\n    return deserializeUser(data);\n  }\n\n  async authenticateWithMagicAuth(\n    payload: AuthenticateWithMagicAuthOptions,\n  ): Promise<AuthenticationResponse> {\n    const { session, ...remainingPayload } = payload;\n\n    const { data } = await this.workos.post<\n      AuthenticationResponseResponse,\n      SerializedAuthenticateWithMagicAuthOptions\n    >(\n      '/user_management/authenticate',\n      serializeAuthenticateWithMagicAuthOptions({\n        ...remainingPayload,\n        clientSecret: this.workos.key,\n      }),\n    );\n\n    return this.prepareAuthenticationResponse({\n      authenticationResponse: deserializeAuthenticationResponse(data),\n      session,\n    });\n  }\n\n  async authenticateWithPassword(\n    payload: AuthenticateWithPasswordOptions,\n  ): Promise<AuthenticationResponse> {\n    const { session, ...remainingPayload } = payload;\n\n    const { data } = await this.workos.post<\n      AuthenticationResponseResponse,\n      SerializedAuthenticateWithPasswordOptions\n    >(\n      '/user_management/authenticate',\n      serializeAuthenticateWithPasswordOptions({\n        ...remainingPayload,\n        clientSecret: this.workos.key,\n      }),\n    );\n\n    return this.prepareAuthenticationResponse({\n      authenticationResponse: deserializeAuthenticationResponse(data),\n      session,\n    });\n  }\n\n  async authenticateWithCode(\n    payload: AuthenticateWithCodeOptions,\n  ): Promise<AuthenticationResponse> {\n    const { session, ...remainingPayload } = payload;\n\n    const { data } = await this.workos.post<\n      AuthenticationResponseResponse,\n      SerializedAuthenticateWithCodeOptions\n    >(\n      '/user_management/authenticate',\n      serializeAuthenticateWithCodeOptions({\n        ...remainingPayload,\n        clientSecret: this.workos.key,\n      }),\n    );\n\n    return this.prepareAuthenticationResponse({\n      authenticationResponse: deserializeAuthenticationResponse(data),\n      session,\n    });\n  }\n\n  async authenticateWithCodeAndVerifier(\n    payload: AuthenticateWithCodeAndVerifierOptions,\n  ): Promise<AuthenticationResponse> {\n    const { session, ...remainingPayload } = payload;\n\n    const { data } = await this.workos.post<\n      AuthenticationResponseResponse,\n      SerializedAuthenticateWithCodeAndVerifierOptions\n    >(\n      '/user_management/authenticate',\n      serializeAuthenticateWithCodeAndVerifierOptions(remainingPayload),\n    );\n\n    return this.prepareAuthenticationResponse({\n      authenticationResponse: deserializeAuthenticationResponse(data),\n      session,\n    });\n  }\n\n  async authenticateWithRefreshToken(\n    payload: AuthenticateWithRefreshTokenOptions,\n  ): Promise<AuthenticationResponse> {\n    const { session, ...remainingPayload } = payload;\n\n    const { data } = await this.workos.post<\n      AuthenticationResponseResponse,\n      SerializedAuthenticateWithRefreshTokenOptions\n    >(\n      '/user_management/authenticate',\n      serializeAuthenticateWithRefreshTokenOptions({\n        ...remainingPayload,\n        clientSecret: this.workos.key,\n      }),\n    );\n\n    return this.prepareAuthenticationResponse({\n      authenticationResponse: deserializeAuthenticationResponse(data),\n      session,\n    });\n  }\n\n  async authenticateWithTotp(\n    payload: AuthenticateWithTotpOptions,\n  ): Promise<AuthenticationResponse> {\n    const { session, ...remainingPayload } = payload;\n\n    const { data } = await this.workos.post<\n      AuthenticationResponseResponse,\n      SerializedAuthenticateWithTotpOptions\n    >(\n      '/user_management/authenticate',\n      serializeAuthenticateWithTotpOptions({\n        ...remainingPayload,\n        clientSecret: this.workos.key,\n      }),\n    );\n\n    return this.prepareAuthenticationResponse({\n      authenticationResponse: deserializeAuthenticationResponse(data),\n      session,\n    });\n  }\n\n  async authenticateWithEmailVerification(\n    payload: AuthenticateWithEmailVerificationOptions,\n  ): Promise<AuthenticationResponse> {\n    const { session, ...remainingPayload } = payload;\n\n    const { data } = await this.workos.post<\n      AuthenticationResponseResponse,\n      SerializedAuthenticateWithEmailVerificationOptions\n    >(\n      '/user_management/authenticate',\n      serializeAuthenticateWithEmailVerificationOptions({\n        ...remainingPayload,\n        clientSecret: this.workos.key,\n      }),\n    );\n\n    return this.prepareAuthenticationResponse({\n      authenticationResponse: deserializeAuthenticationResponse(data),\n      session,\n    });\n  }\n\n  async authenticateWithOrganizationSelection(\n    payload: AuthenticateWithOrganizationSelectionOptions,\n  ): Promise<AuthenticationResponse> {\n    const { session, ...remainingPayload } = payload;\n\n    const { data } = await this.workos.post<\n      AuthenticationResponseResponse,\n      SerializedAuthenticateWithOrganizationSelectionOptions\n    >(\n      '/user_management/authenticate',\n      serializeAuthenticateWithOrganizationSelectionOptions({\n        ...remainingPayload,\n        clientSecret: this.workos.key,\n      }),\n    );\n\n    return this.prepareAuthenticationResponse({\n      authenticationResponse: deserializeAuthenticationResponse(data),\n      session,\n    });\n  }\n\n  async authenticateWithSessionCookie({\n    sessionData,\n    cookiePassword = getEnv('WORKOS_COOKIE_PASSWORD'),\n  }: AuthenticateWithSessionCookieOptions): Promise<\n    | AuthenticateWithSessionCookieSuccessResponse\n    | AuthenticateWithSessionCookieFailedResponse\n  > {\n    if (!cookiePassword) {\n      throw new Error('Cookie password is required');\n    }\n\n    const jwks = await this.getJWKS();\n\n    if (!jwks) {\n      throw new Error('Must provide clientId to initialize JWKS');\n    }\n\n    const { decodeJwt } = await getJose();\n\n    if (!sessionData) {\n      return {\n        authenticated: false,\n        reason:\n          AuthenticateWithSessionCookieFailureReason.NO_SESSION_COOKIE_PROVIDED,\n      };\n    }\n\n    const session = await unsealData<SessionCookieData>(sessionData, {\n      password: cookiePassword,\n    });\n\n    if (!session.accessToken) {\n      return {\n        authenticated: false,\n        reason:\n          AuthenticateWithSessionCookieFailureReason.INVALID_SESSION_COOKIE,\n      };\n    }\n\n    if (!(await this.isValidJwt(session.accessToken))) {\n      return {\n        authenticated: false,\n        reason: AuthenticateWithSessionCookieFailureReason.INVALID_JWT,\n      };\n    }\n\n    const {\n      sid: sessionId,\n      org_id: organizationId,\n      role,\n      roles,\n      permissions,\n      entitlements,\n      feature_flags: featureFlags,\n    } = decodeJwt<AccessToken>(session.accessToken);\n\n    return {\n      authenticated: true,\n      sessionId,\n      organizationId,\n      role,\n      roles,\n      user: session.user,\n      permissions,\n      entitlements,\n      featureFlags,\n      accessToken: session.accessToken,\n    };\n  }\n\n  private async isValidJwt(accessToken: string): Promise<boolean> {\n    const jwks = await this.getJWKS();\n    const { jwtVerify } = await getJose();\n    if (!jwks) {\n      throw new Error('Must provide clientId to initialize JWKS');\n    }\n\n    try {\n      await jwtVerify(accessToken, jwks);\n      return true;\n    } catch (e) {\n      return false;\n    }\n  }\n\n  private async prepareAuthenticationResponse({\n    authenticationResponse,\n    session,\n  }: {\n    authenticationResponse: AuthenticationResponse;\n    session?: AuthenticateWithSessionOptions;\n  }): Promise<AuthenticationResponse> {\n    if (session?.sealSession) {\n      return {\n        ...authenticationResponse,\n        sealedSession: await this.sealSessionDataFromAuthenticationResponse({\n          authenticationResponse,\n          cookiePassword: session.cookiePassword,\n        }),\n      };\n    }\n\n    return authenticationResponse;\n  }\n\n  private async sealSessionDataFromAuthenticationResponse({\n    authenticationResponse,\n    cookiePassword,\n  }: {\n    authenticationResponse: AuthenticationResponse;\n    cookiePassword?: string;\n  }): Promise<string> {\n    if (!cookiePassword) {\n      throw new Error('Cookie password is required');\n    }\n\n    const { decodeJwt } = await getJose();\n\n    const { org_id: organizationIdFromAccessToken } = decodeJwt<AccessToken>(\n      authenticationResponse.accessToken,\n    );\n\n    const sessionData: SessionCookieData = {\n      organizationId: organizationIdFromAccessToken,\n      user: authenticationResponse.user,\n      accessToken: authenticationResponse.accessToken,\n      refreshToken: authenticationResponse.refreshToken,\n      impersonator: authenticationResponse.impersonator,\n    };\n\n    return sealData(sessionData, {\n      password: cookiePassword,\n    });\n  }\n\n  async getSessionFromCookie({\n    sessionData,\n    cookiePassword = getEnv('WORKOS_COOKIE_PASSWORD'),\n  }: SessionHandlerOptions): Promise<SessionCookieData | undefined> {\n    if (!cookiePassword) {\n      throw new Error('Cookie password is required');\n    }\n\n    if (sessionData) {\n      return unsealData<SessionCookieData>(sessionData, {\n        password: cookiePassword,\n      });\n    }\n\n    return undefined;\n  }\n\n  async getEmailVerification(\n    emailVerificationId: string,\n  ): Promise<EmailVerification> {\n    const { data } = await this.workos.get<EmailVerificationResponse>(\n      `/user_management/email_verification/${emailVerificationId}`,\n    );\n\n    return deserializeEmailVerification(data);\n  }\n\n  async sendVerificationEmail({\n    userId,\n  }: SendVerificationEmailOptions): Promise<{ user: User }> {\n    const { data } = await this.workos.post<{ user: UserResponse }>(\n      `/user_management/users/${userId}/email_verification/send`,\n      {},\n    );\n\n    return { user: deserializeUser(data.user) };\n  }\n\n  async getMagicAuth(magicAuthId: string): Promise<MagicAuth> {\n    const { data } = await this.workos.get<MagicAuthResponse>(\n      `/user_management/magic_auth/${magicAuthId}`,\n    );\n\n    return deserializeMagicAuth(data);\n  }\n\n  async createMagicAuth(options: CreateMagicAuthOptions): Promise<MagicAuth> {\n    const { data } = await this.workos.post<\n      MagicAuthResponse,\n      SerializedCreateMagicAuthOptions\n    >(\n      '/user_management/magic_auth',\n      serializeCreateMagicAuthOptions({\n        ...options,\n      }),\n    );\n\n    return deserializeMagicAuth(data);\n  }\n\n  async verifyEmail({\n    code,\n    userId,\n  }: VerifyEmailOptions): Promise<{ user: User }> {\n    const { data } = await this.workos.post<\n      { user: UserResponse },\n      SerializedVerifyEmailOptions\n    >(`/user_management/users/${userId}/email_verification/confirm`, {\n      code,\n    });\n\n    return { user: deserializeUser(data.user) };\n  }\n\n  async getPasswordReset(passwordResetId: string): Promise<PasswordReset> {\n    const { data } = await this.workos.get<PasswordResetResponse>(\n      `/user_management/password_reset/${passwordResetId}`,\n    );\n\n    return deserializePasswordReset(data);\n  }\n\n  async createPasswordReset(\n    options: CreatePasswordResetOptions,\n  ): Promise<PasswordReset> {\n    const { data } = await this.workos.post<\n      PasswordResetResponse,\n      SerializedCreatePasswordResetOptions\n    >(\n      '/user_management/password_reset',\n      serializeCreatePasswordResetOptions({\n        ...options,\n      }),\n    );\n\n    return deserializePasswordReset(data);\n  }\n\n  async resetPassword(payload: ResetPasswordOptions): Promise<{ user: User }> {\n    const { data } = await this.workos.post<\n      { user: UserResponse },\n      SerializedResetPasswordOptions\n    >(\n      '/user_management/password_reset/confirm',\n      serializeResetPasswordOptions(payload),\n    );\n\n    return { user: deserializeUser(data.user) };\n  }\n\n  async updateUser(payload: UpdateUserOptions): Promise<User> {\n    const { data } = await this.workos.put<UserResponse>(\n      `/user_management/users/${payload.userId}`,\n      serializeUpdateUserOptions(payload),\n    );\n\n    return deserializeUser(data);\n  }\n\n  async enrollAuthFactor(payload: EnrollAuthFactorOptions): Promise<{\n    authenticationFactor: FactorWithSecrets;\n    authenticationChallenge: Challenge;\n  }> {\n    const { data } = await this.workos.post<{\n      authentication_factor: FactorWithSecretsResponse;\n      authentication_challenge: ChallengeResponse;\n    }>(\n      `/user_management/users/${payload.userId}/auth_factors`,\n      serializeEnrollAuthFactorOptions(payload),\n    );\n\n    return {\n      authenticationFactor: deserializeFactorWithSecrets(\n        data.authentication_factor,\n      ),\n      authenticationChallenge: deserializeChallenge(\n        data.authentication_challenge,\n      ),\n    };\n  }\n\n  async listAuthFactors(\n    options: ListAuthFactorsOptions,\n  ): Promise<AutoPaginatable<Factor, PaginationOptions>> {\n    const { userId, ...restOfOptions } = options;\n    return new AutoPaginatable(\n      await fetchAndDeserialize<FactorResponse, Factor>(\n        this.workos,\n        `/user_management/users/${userId}/auth_factors`,\n        deserializeFactor,\n        restOfOptions,\n      ),\n      (params) =>\n        fetchAndDeserialize<FactorResponse, Factor>(\n          this.workos,\n          `/user_management/users/${userId}/auth_factors`,\n          deserializeFactor,\n          params,\n        ),\n      restOfOptions,\n    );\n  }\n\n  async listUserFeatureFlags(\n    options: ListUserFeatureFlagsOptions,\n  ): Promise<AutoPaginatable<FeatureFlag>> {\n    const { userId, ...paginationOptions } = options;\n\n    return new AutoPaginatable(\n      await fetchAndDeserialize<FeatureFlagResponse, FeatureFlag>(\n        this.workos,\n        `/user_management/users/${userId}/feature-flags`,\n        deserializeFeatureFlag,\n        paginationOptions,\n      ),\n      (params) =>\n        fetchAndDeserialize<FeatureFlagResponse, FeatureFlag>(\n          this.workos,\n          `/user_management/users/${userId}/feature-flags`,\n          deserializeFeatureFlag,\n          params,\n        ),\n      paginationOptions,\n    );\n  }\n\n  async listSessions(\n    userId: string,\n    options?: ListSessionsOptions,\n  ): Promise<AutoPaginatable<Session, SerializedListSessionsOptions>> {\n    return new AutoPaginatable(\n      await fetchAndDeserialize<SessionResponse, Session>(\n        this.workos,\n        `/user_management/users/${userId}/sessions`,\n        deserializeSession,\n        options ? serializeListSessionsOptions(options) : undefined,\n      ),\n      (params) =>\n        fetchAndDeserialize<SessionResponse, Session>(\n          this.workos,\n          `/user_management/users/${userId}/sessions`,\n          deserializeSession,\n          params,\n        ),\n      options ? serializeListSessionsOptions(options) : undefined,\n    );\n  }\n\n  async deleteUser(userId: string) {\n    await this.workos.delete(`/user_management/users/${userId}`);\n  }\n\n  async getUserIdentities(userId: string): Promise<Identity[]> {\n    if (!userId) {\n      throw new TypeError(`Incomplete arguments. Need to specify 'userId'.`);\n    }\n\n    const { data } = await this.workos.get<IdentityResponse[]>(\n      `/user_management/users/${userId}/identities`,\n    );\n\n    return deserializeIdentities(data);\n  }\n\n  async getOrganizationMembership(\n    organizationMembershipId: string,\n  ): Promise<OrganizationMembership> {\n    const { data } = await this.workos.get<OrganizationMembershipResponse>(\n      `/user_management/organization_memberships/${organizationMembershipId}`,\n    );\n\n    return deserializeOrganizationMembership(data);\n  }\n\n  async listOrganizationMemberships(\n    options: ListOrganizationMembershipsOptions,\n  ): Promise<\n    AutoPaginatable<\n      OrganizationMembership,\n      SerializedListOrganizationMembershipsOptions\n    >\n  > {\n    const serializedOptions =\n      serializeListOrganizationMembershipsOptions(options);\n\n    return new AutoPaginatable(\n      await fetchAndDeserialize<\n        OrganizationMembershipResponse,\n        OrganizationMembership\n      >(\n        this.workos,\n        '/user_management/organization_memberships',\n        deserializeOrganizationMembership,\n        serializedOptions,\n      ),\n      (params) =>\n        fetchAndDeserialize<\n          OrganizationMembershipResponse,\n          OrganizationMembership\n        >(\n          this.workos,\n          '/user_management/organization_memberships',\n          deserializeOrganizationMembership,\n          params,\n        ),\n      serializedOptions,\n    );\n  }\n\n  async createOrganizationMembership(\n    options: CreateOrganizationMembershipOptions,\n  ): Promise<OrganizationMembership> {\n    const { data } = await this.workos.post<\n      OrganizationMembershipResponse,\n      SerializedCreateOrganizationMembershipOptions\n    >(\n      '/user_management/organization_memberships',\n      serializeCreateOrganizationMembershipOptions(options),\n    );\n\n    return deserializeOrganizationMembership(data);\n  }\n\n  async updateOrganizationMembership(\n    organizationMembershipId: string,\n    options: UpdateOrganizationMembershipOptions,\n  ): Promise<OrganizationMembership> {\n    const { data } = await this.workos.put<\n      OrganizationMembershipResponse,\n      SerializedUpdateOrganizationMembershipOptions\n    >(\n      `/user_management/organization_memberships/${organizationMembershipId}`,\n      serializeUpdateOrganizationMembershipOptions(options),\n    );\n\n    return deserializeOrganizationMembership(data);\n  }\n\n  async deleteOrganizationMembership(\n    organizationMembershipId: string,\n  ): Promise<void> {\n    await this.workos.delete(\n      `/user_management/organization_memberships/${organizationMembershipId}`,\n    );\n  }\n\n  async deactivateOrganizationMembership(\n    organizationMembershipId: string,\n  ): Promise<OrganizationMembership> {\n    const { data } = await this.workos.put<OrganizationMembershipResponse>(\n      `/user_management/organization_memberships/${organizationMembershipId}/deactivate`,\n      {},\n    );\n\n    return deserializeOrganizationMembership(data);\n  }\n\n  async reactivateOrganizationMembership(\n    organizationMembershipId: string,\n  ): Promise<OrganizationMembership> {\n    const { data } = await this.workos.put<OrganizationMembershipResponse>(\n      `/user_management/organization_memberships/${organizationMembershipId}/reactivate`,\n      {},\n    );\n\n    return deserializeOrganizationMembership(data);\n  }\n\n  async getInvitation(invitationId: string): Promise<Invitation> {\n    const { data } = await this.workos.get<InvitationResponse>(\n      `/user_management/invitations/${invitationId}`,\n    );\n\n    return deserializeInvitation(data);\n  }\n\n  async findInvitationByToken(invitationToken: string): Promise<Invitation> {\n    const { data } = await this.workos.get<InvitationResponse>(\n      `/user_management/invitations/by_token/${invitationToken}`,\n    );\n\n    return deserializeInvitation(data);\n  }\n\n  async listInvitations(\n    options: ListInvitationsOptions,\n  ): Promise<AutoPaginatable<Invitation, SerializedListInvitationsOptions>> {\n    return new AutoPaginatable(\n      await fetchAndDeserialize<InvitationResponse, Invitation>(\n        this.workos,\n        '/user_management/invitations',\n        deserializeInvitation,\n        options ? serializeListInvitationsOptions(options) : undefined,\n      ),\n      (params) =>\n        fetchAndDeserialize<InvitationResponse, Invitation>(\n          this.workos,\n          '/user_management/invitations',\n          deserializeInvitation,\n          params,\n        ),\n      options ? serializeListInvitationsOptions(options) : undefined,\n    );\n  }\n\n  async sendInvitation(payload: SendInvitationOptions): Promise<Invitation> {\n    const { data } = await this.workos.post<\n      InvitationResponse,\n      SerializedSendInvitationOptions\n    >(\n      '/user_management/invitations',\n      serializeSendInvitationOptions({\n        ...payload,\n      }),\n    );\n\n    return deserializeInvitation(data);\n  }\n\n  async acceptInvitation(invitationId: string): Promise<Invitation> {\n    const { data } = await this.workos.post<InvitationResponse, any>(\n      `/user_management/invitations/${invitationId}/accept`,\n      null,\n    );\n\n    return deserializeInvitation(data);\n  }\n\n  async revokeInvitation(invitationId: string): Promise<Invitation> {\n    const { data } = await this.workos.post<InvitationResponse, any>(\n      `/user_management/invitations/${invitationId}/revoke`,\n      null,\n    );\n\n    return deserializeInvitation(data);\n  }\n\n  async revokeSession(payload: RevokeSessionOptions): Promise<void> {\n    await this.workos.post<void, SerializedRevokeSessionOptions>(\n      '/user_management/sessions/revoke',\n      serializeRevokeSessionOptions(payload),\n    );\n  }\n\n  getAuthorizationUrl(options: UserManagementAuthorizationURLOptions): string {\n    // Delegate to client implementation\n    return clientUserManagement.getAuthorizationUrl({\n      ...options,\n      baseURL: this.workos.baseURL,\n    });\n  }\n\n  getLogoutUrl(options: clientUserManagement.LogoutURLOptions): string {\n    // Delegate to client implementation\n    return clientUserManagement.getLogoutUrl({\n      ...options,\n      baseURL: this.workos.baseURL,\n    });\n  }\n\n  getJwksUrl(clientId: string): string {\n    // Delegate to client implementation\n    return clientUserManagement.getJwksUrl(clientId, this.workos.baseURL);\n  }\n}\n"],"mappings":";;AAAA,SAAS,UAAU,kBAAkB;AACrC,YAAY,0BAA0B;AAEtC,SAAS,2BAA2B;AACpC,SAAS,uBAAuB;AAChC,SAAS,cAAc;AAEvB,SAAS,4BAA4B;AAKrC,SAAS,8BAA8B;AAwDvC;AAAA,EAGE;AAAA,OAIK;AA6BP;AAAA,EAGE;AAAA,OACK;AAUP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,yDAAyD;AAClE,SAAS,6DAA6D;AACtE,SAAS,oDAAoD;AAC7D,SAAS,yBAAyB;AAClC,SAAS,6BAA6B;AACtC,SAAS,6BAA6B;AACtC,SAAS,uCAAuC;AAChD,SAAS,mDAAmD;AAC5D,SAAS,iCAAiC;AAC1C,SAAS,yCAAyC;AAClD,SAAS,sCAAsC;AAC/C,SAAS,oDAAoD;AAC7D,SAAS,qBAAqB;AAC9B,SAAS,eAAe;AAEjB,MAAM,eAAe;AAAA,EAM1B,YAA6B,QAAgB;AAAhB;AAC3B,UAAM,EAAE,SAAS,IAAI,OAAO;AAE5B,SAAK,WAAW;AAAA,EAClB;AAAA,EArKF,OA2J4B;AAAA;AAAA;AAAA,EAClB;AAAA,EAGD;AAAA,EAQP,MAAM,UAEJ;AACA,UAAM,EAAE,mBAAmB,IAAI,MAAM,QAAQ;AAC7C,QAAI,CAAC,KAAK,UAAU;AAClB;AAAA,IACF;AAGA,SAAK,UAAU,mBAAmB,IAAI,IAAI,KAAK,WAAW,KAAK,QAAQ,CAAC,GAAG;AAAA,MACzE,kBAAkB,MAAO,KAAK;AAAA,IAChC,CAAC;AAED,WAAO,KAAK;AAAA,EACd;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,kBAAkB,SAGA;AAChB,WAAO,IAAI,cAAc,MAAM,QAAQ,aAAa,QAAQ,cAAc;AAAA,EAC5E;AAAA,EAEA,MAAM,QAAQ,QAA+B;AAC3C,UAAM,EAAE,KAAK,IAAI,MAAM,KAAK,OAAO;AAAA,MACjC,0BAA0B,MAAM;AAAA,IAClC;AAEA,WAAO,gBAAgB,IAAI;AAAA,EAC7B;AAAA,EAEA,MAAM,oBAAoB,YAAmC;AAC3D,UAAM,EAAE,KAAK,IAAI,MAAM,KAAK,OAAO;AAAA,MACjC,sCAAsC,UAAU;AAAA,IAClD;AAEA,WAAO,gBAAgB,IAAI;AAAA,EAC7B;AAAA,EAEA,MAAM,UACJ,SAC4D;AAC5D,WAAO,IAAI;AAAA,MACT,MAAM;AAAA,QACJ,KAAK;AAAA,QACL;AAAA,QACA;AAAA,QACA,UAAU,0BAA0B,OAAO,IAAI;AAAA,MACjD;AAAA,MACA,CAAC,WACC;AAAA,QACE,KAAK;AAAA,QACL;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,MACF,UAAU,0BAA0B,OAAO,IAAI;AAAA,IACjD;AAAA,EACF;AAAA,EAEA,MAAM,WAAW,SAA2C;AAC1D,UAAM,EAAE,KAAK,IAAI,MAAM,KAAK,OAAO,KAGjC,0BAA0B,2BAA2B,OAAO,CAAC;AAE/D,WAAO,gBAAgB,IAAI;AAAA,EAC7B;AAAA,EAEA,MAAM,0BACJ,SACiC;AACjC,UAAM,EAAE,SAAS,GAAG,iBAAiB,IAAI;AAEzC,UAAM,EAAE,KAAK,IAAI,MAAM,KAAK,OAAO;AAAA,MAIjC;AAAA,MACA,0CAA0C;AAAA,QACxC,GAAG;AAAA,QACH,cAAc,KAAK,OAAO;AAAA,MAC5B,CAAC;AAAA,IACH;AAEA,WAAO,KAAK,8BAA8B;AAAA,MACxC,wBAAwB,kCAAkC,IAAI;AAAA,MAC9D;AAAA,IACF,CAAC;AAAA,EACH;AAAA,EAEA,MAAM,yBACJ,SACiC;AACjC,UAAM,EAAE,SAAS,GAAG,iBAAiB,IAAI;AAEzC,UAAM,EAAE,KAAK,IAAI,MAAM,KAAK,OAAO;AAAA,MAIjC;AAAA,MACA,yCAAyC;AAAA,QACvC,GAAG;AAAA,QACH,cAAc,KAAK,OAAO;AAAA,MAC5B,CAAC;AAAA,IACH;AAEA,WAAO,KAAK,8BAA8B;AAAA,MACxC,wBAAwB,kCAAkC,IAAI;AAAA,MAC9D;AAAA,IACF,CAAC;AAAA,EACH;AAAA,EAEA,MAAM,qBACJ,SACiC;AACjC,UAAM,EAAE,SAAS,GAAG,iBAAiB,IAAI;AAEzC,UAAM,EAAE,KAAK,IAAI,MAAM,KAAK,OAAO;AAAA,MAIjC;AAAA,MACA,qCAAqC;AAAA,QACnC,GAAG;AAAA,QACH,cAAc,KAAK,OAAO;AAAA,MAC5B,CAAC;AAAA,IACH;AAEA,WAAO,KAAK,8BAA8B;AAAA,MACxC,wBAAwB,kCAAkC,IAAI;AAAA,MAC9D;AAAA,IACF,CAAC;AAAA,EACH;AAAA,EAEA,MAAM,gCACJ,SACiC;AACjC,UAAM,EAAE,SAAS,GAAG,iBAAiB,IAAI;AAEzC,UAAM,EAAE,KAAK,IAAI,MAAM,KAAK,OAAO;AAAA,MAIjC;AAAA,MACA,gDAAgD,gBAAgB;AAAA,IAClE;AAEA,WAAO,KAAK,8BAA8B;AAAA,MACxC,wBAAwB,kCAAkC,IAAI;AAAA,MAC9D;AAAA,IACF,CAAC;AAAA,EACH;AAAA,EAEA,MAAM,6BACJ,SACiC;AACjC,UAAM,EAAE,SAAS,GAAG,iBAAiB,IAAI;AAEzC,UAAM,EAAE,KAAK,IAAI,MAAM,KAAK,OAAO;AAAA,MAIjC;AAAA,MACA,6CAA6C;AAAA,QAC3C,GAAG;AAAA,QACH,cAAc,KAAK,OAAO;AAAA,MAC5B,CAAC;AAAA,IACH;AAEA,WAAO,KAAK,8BAA8B;AAAA,MACxC,wBAAwB,kCAAkC,IAAI;AAAA,MAC9D;AAAA,IACF,CAAC;AAAA,EACH;AAAA,EAEA,MAAM,qBACJ,SACiC;AACjC,UAAM,EAAE,SAAS,GAAG,iBAAiB,IAAI;AAEzC,UAAM,EAAE,KAAK,IAAI,MAAM,KAAK,OAAO;AAAA,MAIjC;AAAA,MACA,qCAAqC;AAAA,QACnC,GAAG;AAAA,QACH,cAAc,KAAK,OAAO;AAAA,MAC5B,CAAC;AAAA,IACH;AAEA,WAAO,KAAK,8BAA8B;AAAA,MACxC,wBAAwB,kCAAkC,IAAI;AAAA,MAC9D;AAAA,IACF,CAAC;AAAA,EACH;AAAA,EAEA,MAAM,kCACJ,SACiC;AACjC,UAAM,EAAE,SAAS,GAAG,iBAAiB,IAAI;AAEzC,UAAM,EAAE,KAAK,IAAI,MAAM,KAAK,OAAO;AAAA,MAIjC;AAAA,MACA,kDAAkD;AAAA,QAChD,GAAG;AAAA,QACH,cAAc,KAAK,OAAO;AAAA,MAC5B,CAAC;AAAA,IACH;AAEA,WAAO,KAAK,8BAA8B;AAAA,MACxC,wBAAwB,kCAAkC,IAAI;AAAA,MAC9D;AAAA,IACF,CAAC;AAAA,EACH;AAAA,EAEA,MAAM,sCACJ,SACiC;AACjC,UAAM,EAAE,SAAS,GAAG,iBAAiB,IAAI;AAEzC,UAAM,EAAE,KAAK,IAAI,MAAM,KAAK,OAAO;AAAA,MAIjC;AAAA,MACA,sDAAsD;AAAA,QACpD,GAAG;AAAA,QACH,cAAc,KAAK,OAAO;AAAA,MAC5B,CAAC;AAAA,IACH;AAEA,WAAO,KAAK,8BAA8B;AAAA,MACxC,wBAAwB,kCAAkC,IAAI;AAAA,MAC9D;AAAA,IACF,CAAC;AAAA,EACH;AAAA,EAEA,MAAM,8BAA8B;AAAA,IAClC;AAAA,IACA,iBAAiB,OAAO,wBAAwB;AAAA,EAClD,GAGE;AACA,QAAI,CAAC,gBAAgB;AACnB,YAAM,IAAI,MAAM,6BAA6B;AAAA,IAC/C;AAEA,UAAM,OAAO,MAAM,KAAK,QAAQ;AAEhC,QAAI,CAAC,MAAM;AACT,YAAM,IAAI,MAAM,0CAA0C;AAAA,IAC5D;AAEA,UAAM,EAAE,UAAU,IAAI,MAAM,QAAQ;AAEpC,QAAI,CAAC,aAAa;AAChB,aAAO;AAAA,QACL,eAAe;AAAA,QACf,QACE,2CAA2C;AAAA,MAC/C;AAAA,IACF;AAEA,UAAM,UAAU,MAAM,WAA8B,aAAa;AAAA,MAC/D,UAAU;AAAA,IACZ,CAAC;AAED,QAAI,CAAC,QAAQ,aAAa;AACxB,aAAO;AAAA,QACL,eAAe;AAAA,QACf,QACE,2CAA2C;AAAA,MAC/C;AAAA,IACF;AAEA,QAAI,CAAE,MAAM,KAAK,WAAW,QAAQ,WAAW,GAAI;AACjD,aAAO;AAAA,QACL,eAAe;AAAA,QACf,QAAQ,2CAA2C;AAAA,MACrD;AAAA,IACF;AAEA,UAAM;AAAA,MACJ,KAAK;AAAA,MACL,QAAQ;AAAA,MACR;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,eAAe;AAAA,IACjB,IAAI,UAAuB,QAAQ,WAAW;AAE9C,WAAO;AAAA,MACL,eAAe;AAAA,MACf;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,MAAM,QAAQ;AAAA,MACd;AAAA,MACA;AAAA,MACA;AAAA,MACA,aAAa,QAAQ;AAAA,IACvB;AAAA,EACF;AAAA,EAEA,MAAc,WAAW,aAAuC;AAC9D,UAAM,OAAO,MAAM,KAAK,QAAQ;AAChC,UAAM,EAAE,UAAU,IAAI,MAAM,QAAQ;AACpC,QAAI,CAAC,MAAM;AACT,YAAM,IAAI,MAAM,0CAA0C;AAAA,IAC5D;AAEA,QAAI;AACF,YAAM,UAAU,aAAa,IAAI;AACjC,aAAO;AAAA,IACT,SAAS,GAAG;AACV,aAAO;AAAA,IACT;AAAA,EACF;AAAA,EAEA,MAAc,8BAA8B;AAAA,IAC1C;AAAA,IACA;AAAA,EACF,GAGoC;AAClC,QAAI,SAAS,aAAa;AACxB,aAAO;AAAA,QACL,GAAG;AAAA,QACH,eAAe,MAAM,KAAK,0CAA0C;AAAA,UAClE;AAAA,UACA,gBAAgB,QAAQ;AAAA,QAC1B,CAAC;AAAA,MACH;AAAA,IACF;AAEA,WAAO;AAAA,EACT;AAAA,EAEA,MAAc,0CAA0C;AAAA,IACtD;AAAA,IACA;AAAA,EACF,GAGoB;AAClB,QAAI,CAAC,gBAAgB;AACnB,YAAM,IAAI,MAAM,6BAA6B;AAAA,IAC/C;AAEA,UAAM,EAAE,UAAU,IAAI,MAAM,QAAQ;AAEpC,UAAM,EAAE,QAAQ,8BAA8B,IAAI;AAAA,MAChD,uBAAuB;AAAA,IACzB;AAEA,UAAM,cAAiC;AAAA,MACrC,gBAAgB;AAAA,MAChB,MAAM,uBAAuB;AAAA,MAC7B,aAAa,uBAAuB;AAAA,MACpC,cAAc,uBAAuB;AAAA,MACrC,cAAc,uBAAuB;AAAA,IACvC;AAEA,WAAO,SAAS,aAAa;AAAA,MAC3B,UAAU;AAAA,IACZ,CAAC;AAAA,EACH;AAAA,EAEA,MAAM,qBAAqB;AAAA,IACzB;AAAA,IACA,iBAAiB,OAAO,wBAAwB;AAAA,EAClD,GAAkE;AAChE,QAAI,CAAC,gBAAgB;AACnB,YAAM,IAAI,MAAM,6BAA6B;AAAA,IAC/C;AAEA,QAAI,aAAa;AACf,aAAO,WAA8B,aAAa;AAAA,QAChD,UAAU;AAAA,MACZ,CAAC;AAAA,IACH;AAEA,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,qBACJ,qBAC4B;AAC5B,UAAM,EAAE,KAAK,IAAI,MAAM,KAAK,OAAO;AAAA,MACjC,uCAAuC,mBAAmB;AAAA,IAC5D;AAEA,WAAO,6BAA6B,IAAI;AAAA,EAC1C;AAAA,EAEA,MAAM,sBAAsB;AAAA,IAC1B;AAAA,EACF,GAA0D;AACxD,UAAM,EAAE,KAAK,IAAI,MAAM,KAAK,OAAO;AAAA,MACjC,0BAA0B,MAAM;AAAA,MAChC,CAAC;AAAA,IACH;AAEA,WAAO,EAAE,MAAM,gBAAgB,KAAK,IAAI,EAAE;AAAA,EAC5C;AAAA,EAEA,MAAM,aAAa,aAAyC;AAC1D,UAAM,EAAE,KAAK,IAAI,MAAM,KAAK,OAAO;AAAA,MACjC,+BAA+B,WAAW;AAAA,IAC5C;AAEA,WAAO,qBAAqB,IAAI;AAAA,EAClC;AAAA,EAEA,MAAM,gBAAgB,SAAqD;AACzE,UAAM,EAAE,KAAK,IAAI,MAAM,KAAK,OAAO;AAAA,MAIjC;AAAA,MACA,gCAAgC;AAAA,QAC9B,GAAG;AAAA,MACL,CAAC;AAAA,IACH;AAEA,WAAO,qBAAqB,IAAI;AAAA,EAClC;AAAA,EAEA,MAAM,YAAY;AAAA,IAChB;AAAA,IACA;AAAA,EACF,GAAgD;AAC9C,UAAM,EAAE,KAAK,IAAI,MAAM,KAAK,OAAO,KAGjC,0BAA0B,MAAM,+BAA+B;AAAA,MAC/D;AAAA,IACF,CAAC;AAED,WAAO,EAAE,MAAM,gBAAgB,KAAK,IAAI,EAAE;AAAA,EAC5C;AAAA,EAEA,MAAM,iBAAiB,iBAAiD;AACtE,UAAM,EAAE,KAAK,IAAI,MAAM,KAAK,OAAO;AAAA,MACjC,mCAAmC,eAAe;AAAA,IACpD;AAEA,WAAO,yBAAyB,IAAI;AAAA,EACtC;AAAA,EAEA,MAAM,oBACJ,SACwB;AACxB,UAAM,EAAE,KAAK,IAAI,MAAM,KAAK,OAAO;AAAA,MAIjC;AAAA,MACA,oCAAoC;AAAA,QAClC,GAAG;AAAA,MACL,CAAC;AAAA,IACH;AAEA,WAAO,yBAAyB,IAAI;AAAA,EACtC;AAAA,EAEA,MAAM,cAAc,SAAwD;AAC1E,UAAM,EAAE,KAAK,IAAI,MAAM,KAAK,OAAO;AAAA,MAIjC;AAAA,MACA,8BAA8B,OAAO;AAAA,IACvC;AAEA,WAAO,EAAE,MAAM,gBAAgB,KAAK,IAAI,EAAE;AAAA,EAC5C;AAAA,EAEA,MAAM,WAAW,SAA2C;AAC1D,UAAM,EAAE,KAAK,IAAI,MAAM,KAAK,OAAO;AAAA,MACjC,0BAA0B,QAAQ,MAAM;AAAA,MACxC,2BAA2B,OAAO;AAAA,IACpC;AAEA,WAAO,gBAAgB,IAAI;AAAA,EAC7B;AAAA,EAEA,MAAM,iBAAiB,SAGpB;AACD,UAAM,EAAE,KAAK,IAAI,MAAM,KAAK,OAAO;AAAA,MAIjC,0BAA0B,QAAQ,MAAM;AAAA,MACxC,iCAAiC,OAAO;AAAA,IAC1C;AAEA,WAAO;AAAA,MACL,sBAAsB;AAAA,QACpB,KAAK;AAAA,MACP;AAAA,MACA,yBAAyB;AAAA,QACvB,KAAK;AAAA,MACP;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,gBACJ,SACqD;AACrD,UAAM,EAAE,QAAQ,GAAG,cAAc,IAAI;AACrC,WAAO,IAAI;AAAA,MACT,MAAM;AAAA,QACJ,KAAK;AAAA,QACL,0BAA0B,MAAM;AAAA,QAChC;AAAA,QACA;AAAA,MACF;AAAA,MACA,CAAC,WACC;AAAA,QACE,KAAK;AAAA,QACL,0BAA0B,MAAM;AAAA,QAChC;AAAA,QACA;AAAA,MACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,qBACJ,SACuC;AACvC,UAAM,EAAE,QAAQ,GAAG,kBAAkB,IAAI;AAEzC,WAAO,IAAI;AAAA,MACT,MAAM;AAAA,QACJ,KAAK;AAAA,QACL,0BAA0B,MAAM;AAAA,QAChC;AAAA,QACA;AAAA,MACF;AAAA,MACA,CAAC,WACC;AAAA,QACE,KAAK;AAAA,QACL,0BAA0B,MAAM;AAAA,QAChC;AAAA,QACA;AAAA,MACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,aACJ,QACA,SACkE;AAClE,WAAO,IAAI;AAAA,MACT,MAAM;AAAA,QACJ,KAAK;AAAA,QACL,0BAA0B,MAAM;AAAA,QAChC;AAAA,QACA,UAAU,6BAA6B,OAAO,IAAI;AAAA,MACpD;AAAA,MACA,CAAC,WACC;AAAA,QACE,KAAK;AAAA,QACL,0BAA0B,MAAM;AAAA,QAChC;AAAA,QACA;AAAA,MACF;AAAA,MACF,UAAU,6BAA6B,OAAO,IAAI;AAAA,IACpD;AAAA,EACF;AAAA,EAEA,MAAM,WAAW,QAAgB;AAC/B,UAAM,KAAK,OAAO,OAAO,0BAA0B,MAAM,EAAE;AAAA,EAC7D;AAAA,EAEA,MAAM,kBAAkB,QAAqC;AAC3D,QAAI,CAAC,QAAQ;AACX,YAAM,IAAI,UAAU,iDAAiD;AAAA,IACvE;AAEA,UAAM,EAAE,KAAK,IAAI,MAAM,KAAK,OAAO;AAAA,MACjC,0BAA0B,MAAM;AAAA,IAClC;AAEA,WAAO,sBAAsB,IAAI;AAAA,EACnC;AAAA,EAEA,MAAM,0BACJ,0BACiC;AACjC,UAAM,EAAE,KAAK,IAAI,MAAM,KAAK,OAAO;AAAA,MACjC,6CAA6C,wBAAwB;AAAA,IACvE;AAEA,WAAO,kCAAkC,IAAI;AAAA,EAC/C;AAAA,EAEA,MAAM,4BACJ,SAMA;AACA,UAAM,oBACJ,4CAA4C,OAAO;AAErD,WAAO,IAAI;AAAA,MACT,MAAM;AAAA,QAIJ,KAAK;AAAA,QACL;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,MACA,CAAC,WACC;AAAA,QAIE,KAAK;AAAA,QACL;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,6BACJ,SACiC;AACjC,UAAM,EAAE,KAAK,IAAI,MAAM,KAAK,OAAO;AAAA,MAIjC;AAAA,MACA,6CAA6C,OAAO;AAAA,IACtD;AAEA,WAAO,kCAAkC,IAAI;AAAA,EAC/C;AAAA,EAEA,MAAM,6BACJ,0BACA,SACiC;AACjC,UAAM,EAAE,KAAK,IAAI,MAAM,KAAK,OAAO;AAAA,MAIjC,6CAA6C,wBAAwB;AAAA,MACrE,6CAA6C,OAAO;AAAA,IACtD;AAEA,WAAO,kCAAkC,IAAI;AAAA,EAC/C;AAAA,EAEA,MAAM,6BACJ,0BACe;AACf,UAAM,KAAK,OAAO;AAAA,MAChB,6CAA6C,wBAAwB;AAAA,IACvE;AAAA,EACF;AAAA,EAEA,MAAM,iCACJ,0BACiC;AACjC,UAAM,EAAE,KAAK,IAAI,MAAM,KAAK,OAAO;AAAA,MACjC,6CAA6C,wBAAwB;AAAA,MACrE,CAAC;AAAA,IACH;AAEA,WAAO,kCAAkC,IAAI;AAAA,EAC/C;AAAA,EAEA,MAAM,iCACJ,0BACiC;AACjC,UAAM,EAAE,KAAK,IAAI,MAAM,KAAK,OAAO;AAAA,MACjC,6CAA6C,wBAAwB;AAAA,MACrE,CAAC;AAAA,IACH;AAEA,WAAO,kCAAkC,IAAI;AAAA,EAC/C;AAAA,EAEA,MAAM,cAAc,cAA2C;AAC7D,UAAM,EAAE,KAAK,IAAI,MAAM,KAAK,OAAO;AAAA,MACjC,gCAAgC,YAAY;AAAA,IAC9C;AAEA,WAAO,sBAAsB,IAAI;AAAA,EACnC;AAAA,EAEA,MAAM,sBAAsB,iBAA8C;AACxE,UAAM,EAAE,KAAK,IAAI,MAAM,KAAK,OAAO;AAAA,MACjC,yCAAyC,eAAe;AAAA,IAC1D;AAEA,WAAO,sBAAsB,IAAI;AAAA,EACnC;AAAA,EAEA,MAAM,gBACJ,SACwE;AACxE,WAAO,IAAI;AAAA,MACT,MAAM;AAAA,QACJ,KAAK;AAAA,QACL;AAAA,QACA;AAAA,QACA,UAAU,gCAAgC,OAAO,IAAI;AAAA,MACvD;AAAA,MACA,CAAC,WACC;AAAA,QACE,KAAK;AAAA,QACL;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,MACF,UAAU,gCAAgC,OAAO,IAAI;AAAA,IACvD;AAAA,EACF;AAAA,EAEA,MAAM,eAAe,SAAqD;AACxE,UAAM,EAAE,KAAK,IAAI,MAAM,KAAK,OAAO;AAAA,MAIjC;AAAA,MACA,+BAA+B;AAAA,QAC7B,GAAG;AAAA,MACL,CAAC;AAAA,IACH;AAEA,WAAO,sBAAsB,IAAI;AAAA,EACnC;AAAA,EAEA,MAAM,iBAAiB,cAA2C;AAChE,UAAM,EAAE,KAAK,IAAI,MAAM,KAAK,OAAO;AAAA,MACjC,gCAAgC,YAAY;AAAA,MAC5C;AAAA,IACF;AAEA,WAAO,sBAAsB,IAAI;AAAA,EACnC;AAAA,EAEA,MAAM,iBAAiB,cAA2C;AAChE,UAAM,EAAE,KAAK,IAAI,MAAM,KAAK,OAAO;AAAA,MACjC,gCAAgC,YAAY;AAAA,MAC5C;AAAA,IACF;AAEA,WAAO,sBAAsB,IAAI;AAAA,EACnC;AAAA,EAEA,MAAM,cAAc,SAA8C;AAChE,UAAM,KAAK,OAAO;AAAA,MAChB;AAAA,MACA,8BAA8B,OAAO;AAAA,IACvC;AAAA,EACF;AAAA,EAEA,oBAAoB,SAAwD;AAE1E,WAAO,qBAAqB,oBAAoB;AAAA,MAC9C,GAAG;AAAA,MACH,SAAS,KAAK,OAAO;AAAA,IACvB,CAAC;AAAA,EACH;AAAA,EAEA,aAAa,SAAwD;AAEnE,WAAO,qBAAqB,aAAa;AAAA,MACvC,GAAG;AAAA,MACH,SAAS,KAAK,OAAO;AAAA,IACvB,CAAC;AAAA,EACH;AAAA,EAEA,WAAW,UAA0B;AAEnC,WAAO,qBAAqB,WAAW,UAAU,KAAK,OAAO,OAAO;AAAA,EACtE;AACF;","names":[]}

package/lib/esm/utils/jose.d.ts

@@ -0,0 +1,17 @@
+import * as jose from 'jose';
+
+/**
+ * Dynamically imports the jose library using import() to support Node.js 20.0-20.18.
+ *
+ * The jose library is ESM-only and cannot be loaded via require() in Node.js versions
+ * before 20.19.0. This wrapper uses dynamic import() which works in both ESM and CJS
+ * across all Node.js 20+ versions.
+ *
+ * This workaround can be removed when Node.js 20 reaches end-of-life (April 2026),
+ * at which point we can bump to Node.js 22+ and use direct imports.
+ *
+ * @returns Promise that resolves to the jose module
+ */
+declare function getJose(): Promise<typeof jose>;
+
+export { getJose };

package/lib/esm/utils/jose.js

@@ -0,0 +1,11 @@
+var __defProp = Object.defineProperty;
+var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
+let _josePromise;
+function getJose() {
+  return _josePromise ??= import("jose");
+}
+__name(getJose, "getJose");
+export {
+  getJose
+};
+//# sourceMappingURL=jose.js.map

package/lib/esm/utils/jose.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/utils/jose.ts"],"sourcesContent":["let _josePromise: Promise<typeof import('jose')> | undefined;\n\n/**\n * Dynamically imports the jose library using import() to support Node.js 20.0-20.18.\n *\n * The jose library is ESM-only and cannot be loaded via require() in Node.js versions\n * before 20.19.0. This wrapper uses dynamic import() which works in both ESM and CJS\n * across all Node.js 20+ versions.\n *\n * This workaround can be removed when Node.js 20 reaches end-of-life (April 2026),\n * at which point we can bump to Node.js 22+ and use direct imports.\n *\n * @returns Promise that resolves to the jose module\n */\nexport function getJose() {\n  return (_josePromise ??= import('jose'));\n}\n"],"mappings":";;AAAA,IAAI;AAcG,SAAS,UAAU;AACxB,SAAQ,iBAAiB,OAAO,MAAM;AACxC;AAFgB;","names":[]}

package/lib/esm/vault/vault.d.ts

@@ -1,6 +1,6 @@
 import '../common/interfaces/pagination-options.interface.js';
 import '../common/interfaces/list.interface.js';
-export { V as Vault } from '../workos-e5MfmByv.js';
+export { V as Vault } from '../workos-DLj13cxf.js';
 import './interfaces/key/create-data-key.interface.js';
 import './interfaces/key/decrypt-data-key.interface.js';
 import './interfaces/key.interface.js';
@@ -14,12 +14,16 @@ import '../common/interfaces/post-options.interface.js';
 import '../common/interfaces/put-options.interface.js';
 import '../common/interfaces/workos-options.interface.js';
 import '../common/interfaces/app-info.interface.js';
-import '../events/interfaces/list-events-options.interface.js';
-import '../common/interfaces/event.interface.js';
+import '../common/utils/pagination.js';
 import '../directory-sync/interfaces/directory.interface.js';
 import '../directory-sync/interfaces/directory-group.interface.js';
+import '../directory-sync/interfaces/list-directories-options.interface.js';
+import '../directory-sync/interfaces/list-groups-options.interface.js';
+import '../directory-sync/interfaces/list-directory-users-options.interface.js';
 import '../directory-sync/interfaces/directory-user.interface.js';
 import '../roles/interfaces/role.interface.js';
+import '../events/interfaces/list-events-options.interface.js';
+import '../common/interfaces/event.interface.js';
 import '../organizations/interfaces/organization.interface.js';
 import '../organization-domains/interfaces/organization-domain.interface.js';
 import '../sso/interfaces/connection.interface.js';
@@ -34,7 +38,6 @@ import '../user-management/interfaces/magic-auth.interface.js';
 import '../user-management/interfaces/password-reset.interface.js';
 import '../user-management/interfaces/session.interface.js';
 import '../user-management/interfaces/impersonator.interface.js';
-import '../common/utils/pagination.js';
 import '../organizations/interfaces/create-organization-options.interface.js';
 import '../organizations/interfaces/domain-data.interface.js';
 import '../organizations/interfaces/list-organization-feature-flags-options.interface.js';
@@ -123,6 +126,5 @@ import '../widgets/interfaces/get-token.js';
 import '../actions/actions.js';
 import '../actions/interfaces/action.interface.js';
 import '../actions/interfaces/response-payload.interface.js';
-import '../directory-sync/interfaces/list-directories-options.interface.js';
-import '../directory-sync/interfaces/list-groups-options.interface.js';
-import '../directory-sync/interfaces/list-directory-users-options.interface.js';
+import '../api-keys/interfaces/validate-api-key.interface.js';
+import '../api-keys/interfaces/api-key.interface.js';

package/lib/esm/vault/vault.js

@@ -1,6 +1,6 @@
 var __defProp = Object.defineProperty;
 var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
-import { decodeUInt32, encodeUInt32 } from "leb";
+import { decodeUInt32, encodeUInt32 } from "../common/utils/leb128.js";
 import { base64ToUint8Array, uint8ArrayToBase64 } from "../common/utils/base64.js";
 import {
   deserializeCreateDataKeyResponse,

package/lib/esm/vault/vault.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/vault/vault.ts"],"sourcesContent":["import { decodeUInt32, encodeUInt32 } from 'leb';\nimport { CryptoProvider } from '../common/crypto/crypto-provider';\nimport { List, ListResponse } from '../common/interfaces';\nimport { PaginationOptions } from '../index.worker';\nimport { base64ToUint8Array, uint8ArrayToBase64 } from '../common/utils/base64';\nimport type { WorkOS } from '../workos';\nimport {\n  CreateDataKeyOptions,\n  CreateDataKeyResponse,\n  CreateObjectOptions,\n  DataKey,\n  DataKeyPair,\n  DecryptDataKeyOptions,\n  DecryptDataKeyResponse,\n  DeleteObjectOptions,\n  KeyContext,\n  ListObjectVersionsResponse,\n  ObjectDigest,\n  ObjectDigestResponse,\n  ObjectMetadata,\n  ObjectVersion,\n  ReadObjectMetadataResponse,\n  ReadObjectOptions,\n  ReadObjectResponse,\n  UpdateObjectOptions,\n  VaultObject,\n} from './interfaces';\nimport {\n  deserializeCreateDataKeyResponse,\n  deserializeDecryptDataKeyResponse,\n} from './serializers/vault-key.serializer';\nimport {\n  deserializeListObjects,\n  deserializeObject,\n  deserializeObjectMetadata,\n  desrializeListObjectVersions,\n  serializeCreateObjectEntity,\n  serializeUpdateObjectEntity,\n} from './serializers/vault-object.serializer';\n\ninterface Decoded {\n  iv: Uint8Array;\n  tag: Uint8Array;\n  keys: string;\n  ciphertext: Uint8Array;\n}\n\nexport class Vault {\n  private cryptoProvider: CryptoProvider;\n\n  constructor(private readonly workos: WorkOS) {\n    this.cryptoProvider = workos.getCryptoProvider();\n  }\n\n  private decode(payload: string): Decoded {\n    const inputData = base64ToUint8Array(payload);\n    // Use 12 bytes for IV (standard for AES-GCM)\n    const iv = new Uint8Array(inputData.subarray(0, 12));\n    const tag = new Uint8Array(inputData.subarray(12, 28));\n    const { value: keyLen, nextIndex } = decodeUInt32(inputData, 28);\n\n    // Use subarray instead of slice and convert directly to base64\n    const keysBuffer = inputData.subarray(nextIndex, nextIndex + keyLen);\n    const keys = uint8ArrayToBase64(keysBuffer);\n\n    const ciphertext = new Uint8Array(inputData.subarray(nextIndex + keyLen));\n\n    return {\n      iv,\n      tag,\n      keys,\n      ciphertext,\n    };\n  }\n\n  async createObject(options: CreateObjectOptions): Promise<ObjectMetadata> {\n    const { data } = await this.workos.post<ReadObjectMetadataResponse>(\n      `/vault/v1/kv`,\n      serializeCreateObjectEntity(options),\n    );\n    return deserializeObjectMetadata(data);\n  }\n\n  async listObjects(\n    options?: PaginationOptions | undefined,\n  ): Promise<List<ObjectDigest>> {\n    const url = new URL('/vault/v1/kv', this.workos.baseURL);\n    if (options?.after) {\n      url.searchParams.set('after', options.after);\n    }\n    if (options?.limit) {\n      url.searchParams.set('limit', options.limit.toString());\n    }\n\n    const { data } = await this.workos.get<ListResponse<ObjectDigestResponse>>(\n      url.toString(),\n    );\n    return deserializeListObjects(data);\n  }\n\n  async listObjectVersions(\n    options: ReadObjectOptions,\n  ): Promise<ObjectVersion[]> {\n    const { data } = await this.workos.get<ListObjectVersionsResponse>(\n      `/vault/v1/kv/${encodeURIComponent(options.id)}/versions`,\n    );\n    return desrializeListObjectVersions(data);\n  }\n\n  async readObject(options: ReadObjectOptions): Promise<VaultObject> {\n    const { data } = await this.workos.get<ReadObjectResponse>(\n      `/vault/v1/kv/${encodeURIComponent(options.id)}`,\n    );\n    return deserializeObject(data);\n  }\n\n  async describeObject(options: ReadObjectOptions): Promise<VaultObject> {\n    const { data } = await this.workos.get<ReadObjectResponse>(\n      `/vault/v1/kv/${encodeURIComponent(options.id)}/metadata`,\n    );\n    return deserializeObject(data);\n  }\n\n  async updateObject(options: UpdateObjectOptions): Promise<VaultObject> {\n    const { data } = await this.workos.put<ReadObjectResponse>(\n      `/vault/v1/kv/${encodeURIComponent(options.id)}`,\n      serializeUpdateObjectEntity(options),\n    );\n    return deserializeObject(data);\n  }\n\n  async deleteObject(options: DeleteObjectOptions): Promise<void> {\n    return this.workos.delete(`/vault/v1/kv/${encodeURIComponent(options.id)}`);\n  }\n\n  async createDataKey(options: CreateDataKeyOptions): Promise<DataKeyPair> {\n    const { data } = await this.workos.post<CreateDataKeyResponse>(\n      `/vault/v1/keys/data-key`,\n      options,\n    );\n    return deserializeCreateDataKeyResponse(data);\n  }\n\n  async decryptDataKey(options: DecryptDataKeyOptions): Promise<DataKey> {\n    const { data } = await this.workos.post<DecryptDataKeyResponse>(\n      `/vault/v1/keys/decrypt`,\n      options,\n    );\n    return deserializeDecryptDataKeyResponse(data);\n  }\n\n  async encrypt(\n    data: string,\n    context: KeyContext,\n    associatedData?: string,\n  ): Promise<string> {\n    const keyPair = await this.createDataKey({\n      context,\n    });\n\n    // Convert base64 key to Uint8Array\n    const encoder = new TextEncoder();\n\n    // Use our cross-runtime base64 utility\n    const key = base64ToUint8Array(keyPair.dataKey.key);\n    const keyBlob = base64ToUint8Array(keyPair.encryptedKeys);\n\n    const prefixLenBuffer = encodeUInt32(keyBlob.length);\n    const aadBuffer = associatedData\n      ? encoder.encode(associatedData)\n      : undefined;\n\n    // Use a 12-byte IV for AES-GCM (industry standard)\n    const iv = this.cryptoProvider.randomBytes(12);\n\n    const {\n      ciphertext,\n      iv: resultIv,\n      tag,\n    } = await this.cryptoProvider.encrypt(\n      encoder.encode(data),\n      key,\n      iv,\n      aadBuffer,\n    );\n\n    // Concatenate all parts into a single array\n    const resultArray = new Uint8Array(\n      resultIv.length +\n        tag.length +\n        prefixLenBuffer.length +\n        keyBlob.length +\n        ciphertext.length,\n    );\n\n    let offset = 0;\n    resultArray.set(resultIv, offset);\n    offset += resultIv.length;\n\n    resultArray.set(tag, offset);\n    offset += tag.length;\n\n    resultArray.set(new Uint8Array(prefixLenBuffer), offset);\n    offset += prefixLenBuffer.length;\n\n    resultArray.set(keyBlob, offset);\n    offset += keyBlob.length;\n\n    resultArray.set(ciphertext, offset);\n\n    // Convert to base64 using our cross-runtime utility\n    return uint8ArrayToBase64(resultArray);\n  }\n\n  async decrypt(\n    encryptedData: string,\n    associatedData?: string,\n  ): Promise<string> {\n    const decoded = this.decode(encryptedData);\n    const dataKey = await this.decryptDataKey({ keys: decoded.keys });\n\n    // Convert base64 key to Uint8Array using our cross-runtime utility\n    const key = base64ToUint8Array(dataKey.key);\n\n    const encoder = new TextEncoder();\n    const aadBuffer = associatedData\n      ? encoder.encode(associatedData)\n      : undefined;\n\n    const decrypted = await this.cryptoProvider.decrypt(\n      decoded.ciphertext,\n      key,\n      decoded.iv,\n      decoded.tag,\n      aadBuffer,\n    );\n\n    return new TextDecoder().decode(decrypted);\n  }\n}\n"],"mappings":";;AAAA,SAAS,cAAc,oBAAoB;AAI3C,SAAS,oBAAoB,0BAA0B;AAuBvD;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AASA,MAAM,MAAM;AAAA,EAGjB,YAA6B,QAAgB;AAAhB;AAC3B,SAAK,iBAAiB,OAAO,kBAAkB;AAAA,EACjD;AAAA,EApDF,OA+CmB;AAAA;AAAA;AAAA,EACT;AAAA,EAMA,OAAO,SAA0B;AACvC,UAAM,YAAY,mBAAmB,OAAO;AAE5C,UAAM,KAAK,IAAI,WAAW,UAAU,SAAS,GAAG,EAAE,CAAC;AACnD,UAAM,MAAM,IAAI,WAAW,UAAU,SAAS,IAAI,EAAE,CAAC;AACrD,UAAM,EAAE,OAAO,QAAQ,UAAU,IAAI,aAAa,WAAW,EAAE;AAG/D,UAAM,aAAa,UAAU,SAAS,WAAW,YAAY,MAAM;AACnE,UAAM,OAAO,mBAAmB,UAAU;AAE1C,UAAM,aAAa,IAAI,WAAW,UAAU,SAAS,YAAY,MAAM,CAAC;AAExE,WAAO;AAAA,MACL;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,aAAa,SAAuD;AACxE,UAAM,EAAE,KAAK,IAAI,MAAM,KAAK,OAAO;AAAA,MACjC;AAAA,MACA,4BAA4B,OAAO;AAAA,IACrC;AACA,WAAO,0BAA0B,IAAI;AAAA,EACvC;AAAA,EAEA,MAAM,YACJ,SAC6B;AAC7B,UAAM,MAAM,IAAI,IAAI,gBAAgB,KAAK,OAAO,OAAO;AACvD,QAAI,SAAS,OAAO;AAClB,UAAI,aAAa,IAAI,SAAS,QAAQ,KAAK;AAAA,IAC7C;AACA,QAAI,SAAS,OAAO;AAClB,UAAI,aAAa,IAAI,SAAS,QAAQ,MAAM,SAAS,CAAC;AAAA,IACxD;AAEA,UAAM,EAAE,KAAK,IAAI,MAAM,KAAK,OAAO;AAAA,MACjC,IAAI,SAAS;AAAA,IACf;AACA,WAAO,uBAAuB,IAAI;AAAA,EACpC;AAAA,EAEA,MAAM,mBACJ,SAC0B;AAC1B,UAAM,EAAE,KAAK,IAAI,MAAM,KAAK,OAAO;AAAA,MACjC,gBAAgB,mBAAmB,QAAQ,EAAE,CAAC;AAAA,IAChD;AACA,WAAO,6BAA6B,IAAI;AAAA,EAC1C;AAAA,EAEA,MAAM,WAAW,SAAkD;AACjE,UAAM,EAAE,KAAK,IAAI,MAAM,KAAK,OAAO;AAAA,MACjC,gBAAgB,mBAAmB,QAAQ,EAAE,CAAC;AAAA,IAChD;AACA,WAAO,kBAAkB,IAAI;AAAA,EAC/B;AAAA,EAEA,MAAM,eAAe,SAAkD;AACrE,UAAM,EAAE,KAAK,IAAI,MAAM,KAAK,OAAO;AAAA,MACjC,gBAAgB,mBAAmB,QAAQ,EAAE,CAAC;AAAA,IAChD;AACA,WAAO,kBAAkB,IAAI;AAAA,EAC/B;AAAA,EAEA,MAAM,aAAa,SAAoD;AACrE,UAAM,EAAE,KAAK,IAAI,MAAM,KAAK,OAAO;AAAA,MACjC,gBAAgB,mBAAmB,QAAQ,EAAE,CAAC;AAAA,MAC9C,4BAA4B,OAAO;AAAA,IACrC;AACA,WAAO,kBAAkB,IAAI;AAAA,EAC/B;AAAA,EAEA,MAAM,aAAa,SAA6C;AAC9D,WAAO,KAAK,OAAO,OAAO,gBAAgB,mBAAmB,QAAQ,EAAE,CAAC,EAAE;AAAA,EAC5E;AAAA,EAEA,MAAM,cAAc,SAAqD;AACvE,UAAM,EAAE,KAAK,IAAI,MAAM,KAAK,OAAO;AAAA,MACjC;AAAA,MACA;AAAA,IACF;AACA,WAAO,iCAAiC,IAAI;AAAA,EAC9C;AAAA,EAEA,MAAM,eAAe,SAAkD;AACrE,UAAM,EAAE,KAAK,IAAI,MAAM,KAAK,OAAO;AAAA,MACjC;AAAA,MACA;AAAA,IACF;AACA,WAAO,kCAAkC,IAAI;AAAA,EAC/C;AAAA,EAEA,MAAM,QACJ,MACA,SACA,gBACiB;AACjB,UAAM,UAAU,MAAM,KAAK,cAAc;AAAA,MACvC;AAAA,IACF,CAAC;AAGD,UAAM,UAAU,IAAI,YAAY;AAGhC,UAAM,MAAM,mBAAmB,QAAQ,QAAQ,GAAG;AAClD,UAAM,UAAU,mBAAmB,QAAQ,aAAa;AAExD,UAAM,kBAAkB,aAAa,QAAQ,MAAM;AACnD,UAAM,YAAY,iBACd,QAAQ,OAAO,cAAc,IAC7B;AAGJ,UAAM,KAAK,KAAK,eAAe,YAAY,EAAE;AAE7C,UAAM;AAAA,MACJ;AAAA,MACA,IAAI;AAAA,MACJ;AAAA,IACF,IAAI,MAAM,KAAK,eAAe;AAAA,MAC5B,QAAQ,OAAO,IAAI;AAAA,MACnB;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAGA,UAAM,cAAc,IAAI;AAAA,MACtB,SAAS,SACP,IAAI,SACJ,gBAAgB,SAChB,QAAQ,SACR,WAAW;AAAA,IACf;AAEA,QAAI,SAAS;AACb,gBAAY,IAAI,UAAU,MAAM;AAChC,cAAU,SAAS;AAEnB,gBAAY,IAAI,KAAK,MAAM;AAC3B,cAAU,IAAI;AAEd,gBAAY,IAAI,IAAI,WAAW,eAAe,GAAG,MAAM;AACvD,cAAU,gBAAgB;AAE1B,gBAAY,IAAI,SAAS,MAAM;AAC/B,cAAU,QAAQ;AAElB,gBAAY,IAAI,YAAY,MAAM;AAGlC,WAAO,mBAAmB,WAAW;AAAA,EACvC;AAAA,EAEA,MAAM,QACJ,eACA,gBACiB;AACjB,UAAM,UAAU,KAAK,OAAO,aAAa;AACzC,UAAM,UAAU,MAAM,KAAK,eAAe,EAAE,MAAM,QAAQ,KAAK,CAAC;AAGhE,UAAM,MAAM,mBAAmB,QAAQ,GAAG;AAE1C,UAAM,UAAU,IAAI,YAAY;AAChC,UAAM,YAAY,iBACd,QAAQ,OAAO,cAAc,IAC7B;AAEJ,UAAM,YAAY,MAAM,KAAK,eAAe;AAAA,MAC1C,QAAQ;AAAA,MACR;AAAA,MACA,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR;AAAA,IACF;AAEA,WAAO,IAAI,YAAY,EAAE,OAAO,SAAS;AAAA,EAC3C;AACF;","names":[]}
+{"version":3,"sources":["../../../src/vault/vault.ts"],"sourcesContent":["import { decodeUInt32, encodeUInt32 } from '../common/utils/leb128';\nimport { CryptoProvider } from '../common/crypto/crypto-provider';\nimport { List, ListResponse } from '../common/interfaces';\nimport { PaginationOptions } from '../index.worker';\nimport { base64ToUint8Array, uint8ArrayToBase64 } from '../common/utils/base64';\nimport type { WorkOS } from '../workos';\nimport {\n  CreateDataKeyOptions,\n  CreateDataKeyResponse,\n  CreateObjectOptions,\n  DataKey,\n  DataKeyPair,\n  DecryptDataKeyOptions,\n  DecryptDataKeyResponse,\n  DeleteObjectOptions,\n  KeyContext,\n  ListObjectVersionsResponse,\n  ObjectDigest,\n  ObjectDigestResponse,\n  ObjectMetadata,\n  ObjectVersion,\n  ReadObjectMetadataResponse,\n  ReadObjectOptions,\n  ReadObjectResponse,\n  UpdateObjectOptions,\n  VaultObject,\n} from './interfaces';\nimport {\n  deserializeCreateDataKeyResponse,\n  deserializeDecryptDataKeyResponse,\n} from './serializers/vault-key.serializer';\nimport {\n  deserializeListObjects,\n  deserializeObject,\n  deserializeObjectMetadata,\n  desrializeListObjectVersions,\n  serializeCreateObjectEntity,\n  serializeUpdateObjectEntity,\n} from './serializers/vault-object.serializer';\n\ninterface Decoded {\n  iv: Uint8Array;\n  tag: Uint8Array;\n  keys: string;\n  ciphertext: Uint8Array;\n}\n\nexport class Vault {\n  private cryptoProvider: CryptoProvider;\n\n  constructor(private readonly workos: WorkOS) {\n    this.cryptoProvider = workos.getCryptoProvider();\n  }\n\n  private decode(payload: string): Decoded {\n    const inputData = base64ToUint8Array(payload);\n    // Use 12 bytes for IV (standard for AES-GCM)\n    const iv = new Uint8Array(inputData.subarray(0, 12));\n    const tag = new Uint8Array(inputData.subarray(12, 28));\n    const { value: keyLen, nextIndex } = decodeUInt32(inputData, 28);\n\n    // Use subarray instead of slice and convert directly to base64\n    const keysBuffer = inputData.subarray(nextIndex, nextIndex + keyLen);\n    const keys = uint8ArrayToBase64(keysBuffer);\n\n    const ciphertext = new Uint8Array(inputData.subarray(nextIndex + keyLen));\n\n    return {\n      iv,\n      tag,\n      keys,\n      ciphertext,\n    };\n  }\n\n  async createObject(options: CreateObjectOptions): Promise<ObjectMetadata> {\n    const { data } = await this.workos.post<ReadObjectMetadataResponse>(\n      `/vault/v1/kv`,\n      serializeCreateObjectEntity(options),\n    );\n    return deserializeObjectMetadata(data);\n  }\n\n  async listObjects(\n    options?: PaginationOptions | undefined,\n  ): Promise<List<ObjectDigest>> {\n    const url = new URL('/vault/v1/kv', this.workos.baseURL);\n    if (options?.after) {\n      url.searchParams.set('after', options.after);\n    }\n    if (options?.limit) {\n      url.searchParams.set('limit', options.limit.toString());\n    }\n\n    const { data } = await this.workos.get<ListResponse<ObjectDigestResponse>>(\n      url.toString(),\n    );\n    return deserializeListObjects(data);\n  }\n\n  async listObjectVersions(\n    options: ReadObjectOptions,\n  ): Promise<ObjectVersion[]> {\n    const { data } = await this.workos.get<ListObjectVersionsResponse>(\n      `/vault/v1/kv/${encodeURIComponent(options.id)}/versions`,\n    );\n    return desrializeListObjectVersions(data);\n  }\n\n  async readObject(options: ReadObjectOptions): Promise<VaultObject> {\n    const { data } = await this.workos.get<ReadObjectResponse>(\n      `/vault/v1/kv/${encodeURIComponent(options.id)}`,\n    );\n    return deserializeObject(data);\n  }\n\n  async describeObject(options: ReadObjectOptions): Promise<VaultObject> {\n    const { data } = await this.workos.get<ReadObjectResponse>(\n      `/vault/v1/kv/${encodeURIComponent(options.id)}/metadata`,\n    );\n    return deserializeObject(data);\n  }\n\n  async updateObject(options: UpdateObjectOptions): Promise<VaultObject> {\n    const { data } = await this.workos.put<ReadObjectResponse>(\n      `/vault/v1/kv/${encodeURIComponent(options.id)}`,\n      serializeUpdateObjectEntity(options),\n    );\n    return deserializeObject(data);\n  }\n\n  async deleteObject(options: DeleteObjectOptions): Promise<void> {\n    return this.workos.delete(`/vault/v1/kv/${encodeURIComponent(options.id)}`);\n  }\n\n  async createDataKey(options: CreateDataKeyOptions): Promise<DataKeyPair> {\n    const { data } = await this.workos.post<CreateDataKeyResponse>(\n      `/vault/v1/keys/data-key`,\n      options,\n    );\n    return deserializeCreateDataKeyResponse(data);\n  }\n\n  async decryptDataKey(options: DecryptDataKeyOptions): Promise<DataKey> {\n    const { data } = await this.workos.post<DecryptDataKeyResponse>(\n      `/vault/v1/keys/decrypt`,\n      options,\n    );\n    return deserializeDecryptDataKeyResponse(data);\n  }\n\n  async encrypt(\n    data: string,\n    context: KeyContext,\n    associatedData?: string,\n  ): Promise<string> {\n    const keyPair = await this.createDataKey({\n      context,\n    });\n\n    // Convert base64 key to Uint8Array\n    const encoder = new TextEncoder();\n\n    // Use our cross-runtime base64 utility\n    const key = base64ToUint8Array(keyPair.dataKey.key);\n    const keyBlob = base64ToUint8Array(keyPair.encryptedKeys);\n\n    const prefixLenBuffer = encodeUInt32(keyBlob.length);\n    const aadBuffer = associatedData\n      ? encoder.encode(associatedData)\n      : undefined;\n\n    // Use a 12-byte IV for AES-GCM (industry standard)\n    const iv = this.cryptoProvider.randomBytes(12);\n\n    const {\n      ciphertext,\n      iv: resultIv,\n      tag,\n    } = await this.cryptoProvider.encrypt(\n      encoder.encode(data),\n      key,\n      iv,\n      aadBuffer,\n    );\n\n    // Concatenate all parts into a single array\n    const resultArray = new Uint8Array(\n      resultIv.length +\n        tag.length +\n        prefixLenBuffer.length +\n        keyBlob.length +\n        ciphertext.length,\n    );\n\n    let offset = 0;\n    resultArray.set(resultIv, offset);\n    offset += resultIv.length;\n\n    resultArray.set(tag, offset);\n    offset += tag.length;\n\n    resultArray.set(new Uint8Array(prefixLenBuffer), offset);\n    offset += prefixLenBuffer.length;\n\n    resultArray.set(keyBlob, offset);\n    offset += keyBlob.length;\n\n    resultArray.set(ciphertext, offset);\n\n    // Convert to base64 using our cross-runtime utility\n    return uint8ArrayToBase64(resultArray);\n  }\n\n  async decrypt(\n    encryptedData: string,\n    associatedData?: string,\n  ): Promise<string> {\n    const decoded = this.decode(encryptedData);\n    const dataKey = await this.decryptDataKey({ keys: decoded.keys });\n\n    // Convert base64 key to Uint8Array using our cross-runtime utility\n    const key = base64ToUint8Array(dataKey.key);\n\n    const encoder = new TextEncoder();\n    const aadBuffer = associatedData\n      ? encoder.encode(associatedData)\n      : undefined;\n\n    const decrypted = await this.cryptoProvider.decrypt(\n      decoded.ciphertext,\n      key,\n      decoded.iv,\n      decoded.tag,\n      aadBuffer,\n    );\n\n    return new TextDecoder().decode(decrypted);\n  }\n}\n"],"mappings":";;AAAA,SAAS,cAAc,oBAAoB;AAI3C,SAAS,oBAAoB,0BAA0B;AAuBvD;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AASA,MAAM,MAAM;AAAA,EAGjB,YAA6B,QAAgB;AAAhB;AAC3B,SAAK,iBAAiB,OAAO,kBAAkB;AAAA,EACjD;AAAA,EApDF,OA+CmB;AAAA;AAAA;AAAA,EACT;AAAA,EAMA,OAAO,SAA0B;AACvC,UAAM,YAAY,mBAAmB,OAAO;AAE5C,UAAM,KAAK,IAAI,WAAW,UAAU,SAAS,GAAG,EAAE,CAAC;AACnD,UAAM,MAAM,IAAI,WAAW,UAAU,SAAS,IAAI,EAAE,CAAC;AACrD,UAAM,EAAE,OAAO,QAAQ,UAAU,IAAI,aAAa,WAAW,EAAE;AAG/D,UAAM,aAAa,UAAU,SAAS,WAAW,YAAY,MAAM;AACnE,UAAM,OAAO,mBAAmB,UAAU;AAE1C,UAAM,aAAa,IAAI,WAAW,UAAU,SAAS,YAAY,MAAM,CAAC;AAExE,WAAO;AAAA,MACL;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,aAAa,SAAuD;AACxE,UAAM,EAAE,KAAK,IAAI,MAAM,KAAK,OAAO;AAAA,MACjC;AAAA,MACA,4BAA4B,OAAO;AAAA,IACrC;AACA,WAAO,0BAA0B,IAAI;AAAA,EACvC;AAAA,EAEA,MAAM,YACJ,SAC6B;AAC7B,UAAM,MAAM,IAAI,IAAI,gBAAgB,KAAK,OAAO,OAAO;AACvD,QAAI,SAAS,OAAO;AAClB,UAAI,aAAa,IAAI,SAAS,QAAQ,KAAK;AAAA,IAC7C;AACA,QAAI,SAAS,OAAO;AAClB,UAAI,aAAa,IAAI,SAAS,QAAQ,MAAM,SAAS,CAAC;AAAA,IACxD;AAEA,UAAM,EAAE,KAAK,IAAI,MAAM,KAAK,OAAO;AAAA,MACjC,IAAI,SAAS;AAAA,IACf;AACA,WAAO,uBAAuB,IAAI;AAAA,EACpC;AAAA,EAEA,MAAM,mBACJ,SAC0B;AAC1B,UAAM,EAAE,KAAK,IAAI,MAAM,KAAK,OAAO;AAAA,MACjC,gBAAgB,mBAAmB,QAAQ,EAAE,CAAC;AAAA,IAChD;AACA,WAAO,6BAA6B,IAAI;AAAA,EAC1C;AAAA,EAEA,MAAM,WAAW,SAAkD;AACjE,UAAM,EAAE,KAAK,IAAI,MAAM,KAAK,OAAO;AAAA,MACjC,gBAAgB,mBAAmB,QAAQ,EAAE,CAAC;AAAA,IAChD;AACA,WAAO,kBAAkB,IAAI;AAAA,EAC/B;AAAA,EAEA,MAAM,eAAe,SAAkD;AACrE,UAAM,EAAE,KAAK,IAAI,MAAM,KAAK,OAAO;AAAA,MACjC,gBAAgB,mBAAmB,QAAQ,EAAE,CAAC;AAAA,IAChD;AACA,WAAO,kBAAkB,IAAI;AAAA,EAC/B;AAAA,EAEA,MAAM,aAAa,SAAoD;AACrE,UAAM,EAAE,KAAK,IAAI,MAAM,KAAK,OAAO;AAAA,MACjC,gBAAgB,mBAAmB,QAAQ,EAAE,CAAC;AAAA,MAC9C,4BAA4B,OAAO;AAAA,IACrC;AACA,WAAO,kBAAkB,IAAI;AAAA,EAC/B;AAAA,EAEA,MAAM,aAAa,SAA6C;AAC9D,WAAO,KAAK,OAAO,OAAO,gBAAgB,mBAAmB,QAAQ,EAAE,CAAC,EAAE;AAAA,EAC5E;AAAA,EAEA,MAAM,cAAc,SAAqD;AACvE,UAAM,EAAE,KAAK,IAAI,MAAM,KAAK,OAAO;AAAA,MACjC;AAAA,MACA;AAAA,IACF;AACA,WAAO,iCAAiC,IAAI;AAAA,EAC9C;AAAA,EAEA,MAAM,eAAe,SAAkD;AACrE,UAAM,EAAE,KAAK,IAAI,MAAM,KAAK,OAAO;AAAA,MACjC;AAAA,MACA;AAAA,IACF;AACA,WAAO,kCAAkC,IAAI;AAAA,EAC/C;AAAA,EAEA,MAAM,QACJ,MACA,SACA,gBACiB;AACjB,UAAM,UAAU,MAAM,KAAK,cAAc;AAAA,MACvC;AAAA,IACF,CAAC;AAGD,UAAM,UAAU,IAAI,YAAY;AAGhC,UAAM,MAAM,mBAAmB,QAAQ,QAAQ,GAAG;AAClD,UAAM,UAAU,mBAAmB,QAAQ,aAAa;AAExD,UAAM,kBAAkB,aAAa,QAAQ,MAAM;AACnD,UAAM,YAAY,iBACd,QAAQ,OAAO,cAAc,IAC7B;AAGJ,UAAM,KAAK,KAAK,eAAe,YAAY,EAAE;AAE7C,UAAM;AAAA,MACJ;AAAA,MACA,IAAI;AAAA,MACJ;AAAA,IACF,IAAI,MAAM,KAAK,eAAe;AAAA,MAC5B,QAAQ,OAAO,IAAI;AAAA,MACnB;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAGA,UAAM,cAAc,IAAI;AAAA,MACtB,SAAS,SACP,IAAI,SACJ,gBAAgB,SAChB,QAAQ,SACR,WAAW;AAAA,IACf;AAEA,QAAI,SAAS;AACb,gBAAY,IAAI,UAAU,MAAM;AAChC,cAAU,SAAS;AAEnB,gBAAY,IAAI,KAAK,MAAM;AAC3B,cAAU,IAAI;AAEd,gBAAY,IAAI,IAAI,WAAW,eAAe,GAAG,MAAM;AACvD,cAAU,gBAAgB;AAE1B,gBAAY,IAAI,SAAS,MAAM;AAC/B,cAAU,QAAQ;AAElB,gBAAY,IAAI,YAAY,MAAM;AAGlC,WAAO,mBAAmB,WAAW;AAAA,EACvC;AAAA,EAEA,MAAM,QACJ,eACA,gBACiB;AACjB,UAAM,UAAU,KAAK,OAAO,aAAa;AACzC,UAAM,UAAU,MAAM,KAAK,eAAe,EAAE,MAAM,QAAQ,KAAK,CAAC;AAGhE,UAAM,MAAM,mBAAmB,QAAQ,GAAG;AAE1C,UAAM,UAAU,IAAI,YAAY;AAChC,UAAM,YAAY,iBACd,QAAQ,OAAO,cAAc,IAC7B;AAEJ,UAAM,YAAY,MAAM,KAAK,eAAe;AAAA,MAC1C,QAAQ;AAAA,MACR;AAAA,MACA,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR;AAAA,IACF;AAEA,WAAO,IAAI,YAAY,EAAE,OAAO,SAAS;AAAA,EAC3C;AACF;","names":[]}

package/lib/esm/widgets/interfaces/get-token.d.ts

@@ -1,4 +1,4 @@
-type WidgetScope = 'widgets:users-table:manage' | 'widgets:sso:manage' | 'widgets:domain-verification:manage';
+type WidgetScope = 'widgets:users-table:manage' | 'widgets:sso:manage' | 'widgets:domain-verification:manage' | 'widgets:api-keys:manage';
 interface GetTokenOptions {
     organizationId: string;
     userId?: string;

package/lib/esm/widgets/interfaces/get-token.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../src/widgets/interfaces/get-token.ts"],"sourcesContent":["export type WidgetScope =\n  | 'widgets:users-table:manage'\n  | 'widgets:sso:manage'\n  | 'widgets:domain-verification:manage';\n\nexport interface GetTokenOptions {\n  organizationId: string;\n  userId?: string;\n  scopes?: WidgetScope[];\n}\n\nexport interface SerializedGetTokenOptions {\n  organization_id: string;\n  user_id?: string;\n  scopes?: WidgetScope[];\n}\n\nexport const serializeGetTokenOptions = (\n  options: GetTokenOptions,\n): SerializedGetTokenOptions => ({\n  organization_id: options.organizationId,\n  user_id: options.userId,\n  scopes: options.scopes,\n});\n\nexport interface GetTokenResponse {\n  token: string;\n}\n\nexport interface GetTokenResponseResponse {\n  token: string;\n}\n\nexport const deserializeGetTokenResponse = (\n  data: GetTokenResponseResponse,\n): GetTokenResponse => ({\n  token: data.token,\n});\n"],"mappings":";;AAiBO,MAAM,2BAA2B,wBACtC,aAC+B;AAAA,EAC/B,iBAAiB,QAAQ;AAAA,EACzB,SAAS,QAAQ;AAAA,EACjB,QAAQ,QAAQ;AAClB,IANwC;AAgBjC,MAAM,8BAA8B,wBACzC,UACsB;AAAA,EACtB,OAAO,KAAK;AACd,IAJ2C;","names":[]}
+{"version":3,"sources":["../../../../src/widgets/interfaces/get-token.ts"],"sourcesContent":["export type WidgetScope =\n  | 'widgets:users-table:manage'\n  | 'widgets:sso:manage'\n  | 'widgets:domain-verification:manage'\n  | 'widgets:api-keys:manage';\nexport interface GetTokenOptions {\n  organizationId: string;\n  userId?: string;\n  scopes?: WidgetScope[];\n}\n\nexport interface SerializedGetTokenOptions {\n  organization_id: string;\n  user_id?: string;\n  scopes?: WidgetScope[];\n}\n\nexport const serializeGetTokenOptions = (\n  options: GetTokenOptions,\n): SerializedGetTokenOptions => ({\n  organization_id: options.organizationId,\n  user_id: options.userId,\n  scopes: options.scopes,\n});\n\nexport interface GetTokenResponse {\n  token: string;\n}\n\nexport interface GetTokenResponseResponse {\n  token: string;\n}\n\nexport const deserializeGetTokenResponse = (\n  data: GetTokenResponseResponse,\n): GetTokenResponse => ({\n  token: data.token,\n});\n"],"mappings":";;AAiBO,MAAM,2BAA2B,wBACtC,aAC+B;AAAA,EAC/B,iBAAiB,QAAQ;AAAA,EACzB,SAAS,QAAQ;AAAA,EACjB,QAAQ,QAAQ;AAClB,IANwC;AAgBjC,MAAM,8BAA8B,wBACzC,UACsB;AAAA,EACtB,OAAO,KAAK;AACd,IAJ2C;","names":[]}

package/lib/esm/widgets/widgets.d.ts

@@ -1,16 +1,22 @@
-export { c as Widgets } from '../workos-e5MfmByv.js';
+export { d as Widgets } from '../workos-DLj13cxf.js';
 import './interfaces/get-token.js';
 import '../common/interfaces/get-options.interface.js';
 import '../common/interfaces/post-options.interface.js';
 import '../common/interfaces/put-options.interface.js';
 import '../common/interfaces/workos-options.interface.js';
 import '../common/interfaces/app-info.interface.js';
-import '../events/interfaces/list-events-options.interface.js';
-import '../common/interfaces/event.interface.js';
+import '../common/utils/pagination.js';
+import '../common/interfaces/pagination-options.interface.js';
+import '../common/interfaces/list.interface.js';
 import '../directory-sync/interfaces/directory.interface.js';
 import '../directory-sync/interfaces/directory-group.interface.js';
+import '../directory-sync/interfaces/list-directories-options.interface.js';
+import '../directory-sync/interfaces/list-groups-options.interface.js';
+import '../directory-sync/interfaces/list-directory-users-options.interface.js';
 import '../directory-sync/interfaces/directory-user.interface.js';
 import '../roles/interfaces/role.interface.js';
+import '../events/interfaces/list-events-options.interface.js';
+import '../common/interfaces/event.interface.js';
 import '../organizations/interfaces/organization.interface.js';
 import '../organization-domains/interfaces/organization-domain.interface.js';
 import '../sso/interfaces/connection.interface.js';
@@ -25,9 +31,6 @@ import '../user-management/interfaces/magic-auth.interface.js';
 import '../user-management/interfaces/password-reset.interface.js';
 import '../user-management/interfaces/session.interface.js';
 import '../user-management/interfaces/impersonator.interface.js';
-import '../common/interfaces/list.interface.js';
-import '../common/utils/pagination.js';
-import '../common/interfaces/pagination-options.interface.js';
 import '../organizations/interfaces/create-organization-options.interface.js';
 import '../organizations/interfaces/domain-data.interface.js';
 import '../organizations/interfaces/list-organization-feature-flags-options.interface.js';
@@ -123,6 +126,5 @@ import '../vault/interfaces/object/delete-object.interface.js';
 import '../vault/interfaces/object/read-object.interface.js';
 import '../vault/interfaces/object.interface.js';
 import '../vault/interfaces/object/update-object.interface.js';
-import '../directory-sync/interfaces/list-directories-options.interface.js';
-import '../directory-sync/interfaces/list-groups-options.interface.js';
-import '../directory-sync/interfaces/list-directory-users-options.interface.js';
+import '../api-keys/interfaces/validate-api-key.interface.js';
+import '../api-keys/interfaces/api-key.interface.js';

package/lib/esm/{workos-e5MfmByv.d.ts → workos-DLj13cxf.d.ts}

@@ -2,10 +2,16 @@ import { GetOptions } from './common/interfaces/get-options.interface.js';
 import { PostOptions } from './common/interfaces/post-options.interface.js';
 import { PutOptions } from './common/interfaces/put-options.interface.js';
 import { WorkOSOptions } from './common/interfaces/workos-options.interface.js';
+import { AutoPaginatable } from './common/utils/pagination.js';
+import { Directory } from './directory-sync/interfaces/directory.interface.js';
+import { DirectoryGroup } from './directory-sync/interfaces/directory-group.interface.js';
+import { ListDirectoriesOptions, SerializedListDirectoriesOptions } from './directory-sync/interfaces/list-directories-options.interface.js';
+import { ListDirectoryGroupsOptions } from './directory-sync/interfaces/list-groups-options.interface.js';
+import { ListDirectoryUsersOptions } from './directory-sync/interfaces/list-directory-users-options.interface.js';
+import { DefaultCustomAttributes, DirectoryUserWithGroups } from './directory-sync/interfaces/directory-user.interface.js';
 import { ListEventOptions } from './events/interfaces/list-events-options.interface.js';
 import { Event } from './common/interfaces/event.interface.js';
 import { List } from './common/interfaces/list.interface.js';
-import { AutoPaginatable } from './common/utils/pagination.js';
 import { CreateOrganizationOptions, CreateOrganizationRequestOptions } from './organizations/interfaces/create-organization-options.interface.js';
 import { ListOrganizationFeatureFlagsOptions } from './organizations/interfaces/list-organization-feature-flags-options.interface.js';
 import { ListOrganizationsOptions } from './organizations/interfaces/list-organizations-options.interface.js';
@@ -39,7 +45,7 @@ import { AuditLogExportOptions } from './audit-logs/interfaces/audit-log-export-
 import { AuditLogExport } from './audit-logs/interfaces/audit-log-export.interface.js';
 import { CreateAuditLogEventOptions, CreateAuditLogEventRequestOptions } from './audit-logs/interfaces/create-audit-log-event-options.interface.js';
 import { CreateAuditLogSchemaOptions, CreateAuditLogSchemaRequestOptions, AuditLogSchema } from './audit-logs/interfaces/create-audit-log-schema-options.interface.js';
-import { createRemoteJWKSet } from 'jose';
+import * as jose from 'jose';
 import { L as LogoutURLOptions } from './user-management-qKHMGyQi.js';
 import { PaginationOptions } from './common/interfaces/pagination-options.interface.js';
 import { AuthenticateWithCodeOptions } from './user-management/interfaces/authenticate-with-code-options.interface.js';
@@ -100,12 +106,13 @@ import { ReadObjectOptions } from './vault/interfaces/object/read-object.interfa
 import { UpdateObjectOptions } from './vault/interfaces/object/update-object.interface.js';
 import { ObjectMetadata, ObjectDigest, ObjectVersion, VaultObject } from './vault/interfaces/object.interface.js';
 import { CryptoProvider } from './common/crypto/crypto-provider.js';
-import { Directory } from './directory-sync/interfaces/directory.interface.js';
-import { DirectoryGroup } from './directory-sync/interfaces/directory-group.interface.js';
-import { ListDirectoriesOptions, SerializedListDirectoriesOptions } from './directory-sync/interfaces/list-directories-options.interface.js';
-import { ListDirectoryGroupsOptions } from './directory-sync/interfaces/list-groups-options.interface.js';
-import { ListDirectoryUsersOptions } from './directory-sync/interfaces/list-directory-users-options.interface.js';
-import { DefaultCustomAttributes, DirectoryUserWithGroups } from './directory-sync/interfaces/directory-user.interface.js';
+import { ValidateApiKeyOptions, ValidateApiKeyResponse } from './api-keys/interfaces/validate-api-key.interface.js';
+
+declare class ApiKeys {
+    private readonly workos;
+    constructor(workos: WorkOS);
+    validateApiKey(payload: ValidateApiKeyOptions): Promise<ValidateApiKeyResponse>;
+}
 
 declare class DirectorySync {
     private readonly workos;
@@ -202,7 +209,6 @@ type RefreshOptions = {
     organizationId?: string;
 };
 declare class CookieSession {
-    private jwks;
     private userManagement;
     private cookiePassword;
     private sessionData;
@@ -238,7 +244,7 @@ declare class UserManagement {
     private _jwks;
     clientId: string | undefined;
     constructor(workos: WorkOS);
-    get jwks(): ReturnType<typeof createRemoteJWKSet> | undefined;
+    getJWKS(): Promise<ReturnType<typeof jose.createRemoteJWKSet> | undefined>;
     /**
      * Loads a sealed session using the provided session data and cookie password.
      *
@@ -359,6 +365,7 @@ declare class WorkOS {
     readonly client: HttpClient;
     readonly clientId?: string;
     readonly actions: Actions;
+    readonly apiKeys: ApiKeys;
     readonly auditLogs: AuditLogs;
     readonly directorySync: DirectorySync;
     readonly organizations: Organizations;
@@ -395,4 +402,4 @@ declare class WorkOS {
     private handleHttpError;
 }
 
-export { AuditLogs as A, CookieSession as C, DirectorySync as D, Events as E, FGA as F, Mfa as M, Organizations as O, Passwordless as P, SSO as S, UserManagement as U, Vault as V, WorkOS as W, OrganizationDomains as a, Portal as b, Widgets as c };
+export { ApiKeys as A, CookieSession as C, DirectorySync as D, Events as E, FGA as F, Mfa as M, Organizations as O, Passwordless as P, SSO as S, UserManagement as U, Vault as V, WorkOS as W, OrganizationDomains as a, Portal as b, AuditLogs as c, Widgets as d };

package/lib/esm/workos.d.ts

@@ -2,18 +2,24 @@ import './common/interfaces/get-options.interface.js';
 import './common/interfaces/post-options.interface.js';
 import './common/interfaces/put-options.interface.js';
 import './common/interfaces/workos-options.interface.js';
-export { W as WorkOS } from './workos-e5MfmByv.js';
+export { W as WorkOS } from './workos-DLj13cxf.js';
 import './webhooks/webhooks.js';
 import './common/net/http-client.js';
 import './actions/actions.js';
 import './common/crypto/crypto-provider.js';
 import './common/interfaces/app-info.interface.js';
-import './events/interfaces/list-events-options.interface.js';
-import './common/interfaces/event.interface.js';
+import './common/utils/pagination.js';
+import './common/interfaces/pagination-options.interface.js';
+import './common/interfaces/list.interface.js';
 import './directory-sync/interfaces/directory.interface.js';
 import './directory-sync/interfaces/directory-group.interface.js';
+import './directory-sync/interfaces/list-directories-options.interface.js';
+import './directory-sync/interfaces/list-groups-options.interface.js';
+import './directory-sync/interfaces/list-directory-users-options.interface.js';
 import './directory-sync/interfaces/directory-user.interface.js';
 import './roles/interfaces/role.interface.js';
+import './events/interfaces/list-events-options.interface.js';
+import './common/interfaces/event.interface.js';
 import './organizations/interfaces/organization.interface.js';
 import './organization-domains/interfaces/organization-domain.interface.js';
 import './sso/interfaces/connection.interface.js';
@@ -28,9 +34,6 @@ import './user-management/interfaces/magic-auth.interface.js';
 import './user-management/interfaces/password-reset.interface.js';
 import './user-management/interfaces/session.interface.js';
 import './user-management/interfaces/impersonator.interface.js';
-import './common/interfaces/list.interface.js';
-import './common/utils/pagination.js';
-import './common/interfaces/pagination-options.interface.js';
 import './organizations/interfaces/create-organization-options.interface.js';
 import './organizations/interfaces/domain-data.interface.js';
 import './organizations/interfaces/list-organization-feature-flags-options.interface.js';
@@ -120,9 +123,8 @@ import './vault/interfaces/object/delete-object.interface.js';
 import './vault/interfaces/object/read-object.interface.js';
 import './vault/interfaces/object.interface.js';
 import './vault/interfaces/object/update-object.interface.js';
-import './directory-sync/interfaces/list-directories-options.interface.js';
-import './directory-sync/interfaces/list-groups-options.interface.js';
-import './directory-sync/interfaces/list-directory-users-options.interface.js';
+import './api-keys/interfaces/validate-api-key.interface.js';
+import './api-keys/interfaces/api-key.interface.js';
 import './common/interfaces/http-client.interface.js';
 import './actions/interfaces/action.interface.js';
 import './actions/interfaces/response-payload.interface.js';

package/lib/esm/workos.js

@@ -9,6 +9,7 @@ import {
   OauthException,
   RateLimitExceededException
 } from "./common/exceptions/index.js";
+import { ApiKeys } from "./api-keys/api-keys.js";
 import { DirectorySync } from "./directory-sync/directory-sync.js";
 import { Events } from "./events/events.js";
 import { Organizations } from "./organizations/organizations.js";
@@ -32,7 +33,7 @@ import { ConflictException } from "./common/exceptions/conflict.exception.js";
 import { ParseError } from "./common/exceptions/parse-error.js";
 import { getEnv } from "./common/utils/env.js";
 import { getRuntimeInfo } from "./common/utils/runtime-info.js";
-const VERSION = "8.0.0-beta.4";
+const VERSION = "8.0.0-rc.3";
 const DEFAULT_HOSTNAME = "api.workos.com";
 const HEADER_AUTHORIZATION = "Authorization";
 const HEADER_IDEMPOTENCY_KEY = "Idempotency-Key";
@@ -74,6 +75,7 @@ class WorkOS {
   client;
   clientId;
   actions;
+  apiKeys = new ApiKeys(this);
   auditLogs = new AuditLogs(this);
   directorySync = new DirectorySync(this);
   organizations = new Organizations(this);