@workos-inc/node 8.0.0-rc.2 → 8.0.0-rc.4

package/lib/client/sso.d.ts

@@ -0,0 +1,21 @@
+import { SSOAuthorizationURLOptions as SSOAuthorizationURLOptions$1 } from "../sso/interfaces/authorization-url-options.interface.js";
+
+//#region src/client/sso.d.ts
+declare namespace sso_d_exports {
+  export { SSOAuthorizationURLOptions, getAuthorizationUrl };
+}
+type SSOAuthorizationURLOptions = SSOAuthorizationURLOptions$1 & {
+  baseURL?: string;
+};
+/**
+ * Generates the authorization URL for SSO authentication.
+ * Does not require an API key, suitable for OAuth client operations.
+ *
+ * @param options - SSO authorization URL options
+ * @returns The authorization URL as a string
+ * @throws Error if required arguments are missing
+ */
+declare function getAuthorizationUrl(options: SSOAuthorizationURLOptions): string;
+//#endregion
+export { SSOAuthorizationURLOptions, getAuthorizationUrl, sso_d_exports };
+//# sourceMappingURL=sso.d.ts.map

package/lib/client/sso.js

@@ -0,0 +1,34 @@
+import { __export } from "../_virtual/rolldown_runtime.js";
+import { toQueryString } from "../common/utils/query-string.js";
+
+//#region src/client/sso.ts
+var sso_exports = /* @__PURE__ */ __export({ getAuthorizationUrl: () => getAuthorizationUrl });
+/**
+* Generates the authorization URL for SSO authentication.
+* Does not require an API key, suitable for OAuth client operations.
+*
+* @param options - SSO authorization URL options
+* @returns The authorization URL as a string
+* @throws Error if required arguments are missing
+*/
+function getAuthorizationUrl(options) {
+	const { connection, clientId, domainHint, loginHint, organization, provider, providerQueryParams, providerScopes, redirectUri, state, baseURL = "https://api.workos.com" } = options;
+	if (!provider && !connection && !organization) throw new Error(`Incomplete arguments. Need to specify either a 'connection', 'organization', or 'provider'.`);
+	return `${baseURL}/sso/authorize?${toQueryString({
+		connection,
+		organization,
+		domain_hint: domainHint,
+		login_hint: loginHint,
+		provider,
+		provider_query_params: providerQueryParams,
+		provider_scopes: providerScopes,
+		client_id: clientId,
+		redirect_uri: redirectUri,
+		response_type: "code",
+		state
+	})}`;
+}
+
+//#endregion
+export { getAuthorizationUrl, sso_exports };
+//# sourceMappingURL=sso.js.map

package/lib/client/sso.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sso.js","names":[],"sources":["../../src/client/sso.ts"],"sourcesContent":["import { toQueryString } from '../common/utils/query-string';\nimport type { SSOAuthorizationURLOptions as BaseSSOAuthorizationURLOptions } from '../sso/interfaces';\n\n// Extend the base options to include baseURL for internal use\nexport type SSOAuthorizationURLOptions = BaseSSOAuthorizationURLOptions & {\n  baseURL?: string;\n};\n\n/**\n * Generates the authorization URL for SSO authentication.\n * Does not require an API key, suitable for OAuth client operations.\n *\n * @param options - SSO authorization URL options\n * @returns The authorization URL as a string\n * @throws Error if required arguments are missing\n */\nexport function getAuthorizationUrl(\n  options: SSOAuthorizationURLOptions,\n): string {\n  const {\n    connection,\n    clientId,\n    domainHint,\n    loginHint,\n    organization,\n    provider,\n    providerQueryParams,\n    providerScopes,\n    redirectUri,\n    state,\n    baseURL = 'https://api.workos.com',\n  } = options;\n\n  if (!provider && !connection && !organization) {\n    throw new Error(\n      `Incomplete arguments. Need to specify either a 'connection', 'organization', or 'provider'.`,\n    );\n  }\n\n  const query = toQueryString({\n    connection,\n    organization,\n    domain_hint: domainHint,\n    login_hint: loginHint,\n    provider,\n    provider_query_params: providerQueryParams,\n    provider_scopes: providerScopes,\n    client_id: clientId,\n    redirect_uri: redirectUri,\n    response_type: 'code',\n    state,\n  });\n\n  return `${baseURL}/sso/authorize?${query}`;\n}\n"],"mappings":";;;;;;;;;;;;;AAgBA,SAAgB,oBACd,SACQ;CACR,MAAM,EACJ,YACA,UACA,YACA,WACA,cACA,UACA,qBACA,gBACA,aACA,OACA,UAAU,6BACR;AAEJ,KAAI,CAAC,YAAY,CAAC,cAAc,CAAC,aAC/B,OAAM,IAAI,MACR,8FACD;AAiBH,QAAO,GAAG,QAAQ,iBAdJ,cAAc;EAC1B;EACA;EACA,aAAa;EACb,YAAY;EACZ;EACA,uBAAuB;EACvB,iBAAiB;EACjB,WAAW;EACX,cAAc;EACd,eAAe;EACf;EACD,CAAC"}

package/lib/client/user-management.cjs

@@ -0,0 +1,80 @@
+const require_rolldown_runtime = require('../_virtual/rolldown_runtime.cjs');
+const require_common_utils_query_string = require('../common/utils/query-string.cjs');
+
+//#region src/client/user-management.ts
+var user_management_exports = /* @__PURE__ */ require_rolldown_runtime.__export({
+	getAuthorizationUrl: () => getAuthorizationUrl,
+	getJwksUrl: () => getJwksUrl,
+	getLogoutUrl: () => getLogoutUrl
+});
+/**
+* Generates the authorization URL for OAuth client authentication.
+* Suitable for PKCE flows and other OAuth client operations that don't require an API key.
+*
+* @param options - Authorization URL options
+* @returns The authorization URL as a string
+* @throws TypeError if required arguments are missing
+*/
+function getAuthorizationUrl(options) {
+	const { connectionId, codeChallenge, codeChallengeMethod, clientId, domainHint, loginHint, organizationId, provider, providerQueryParams, providerScopes, prompt, redirectUri, state, screenHint, baseURL = "https://api.workos.com" } = options;
+	if (!provider && !connectionId && !organizationId) throw new TypeError(`Incomplete arguments. Need to specify either a 'connectionId', 'organizationId', or 'provider'.`);
+	if (provider !== "authkit" && screenHint) throw new TypeError(`'screenHint' is only supported for 'authkit' provider`);
+	return `${baseURL}/user_management/authorize?${require_common_utils_query_string.toQueryString({
+		connection_id: connectionId,
+		code_challenge: codeChallenge,
+		code_challenge_method: codeChallengeMethod,
+		organization_id: organizationId,
+		domain_hint: domainHint,
+		login_hint: loginHint,
+		provider,
+		provider_query_params: providerQueryParams,
+		provider_scopes: providerScopes,
+		prompt,
+		client_id: clientId,
+		redirect_uri: redirectUri,
+		response_type: "code",
+		state,
+		screen_hint: screenHint
+	})}`;
+}
+/**
+* Generates the logout URL for ending a user session.
+* This method is safe to use in browser environments as it doesn't require an API key.
+*
+* @param options - Logout URL options
+* @returns The logout URL as a string
+* @throws TypeError if sessionId is not provided
+*/
+function getLogoutUrl(options) {
+	const { sessionId, returnTo, baseURL = "https://api.workos.com" } = options;
+	if (!sessionId) throw new TypeError(`Incomplete arguments. Need to specify 'sessionId'.`);
+	const url = new URL("/user_management/sessions/logout", baseURL);
+	url.searchParams.set("session_id", sessionId);
+	if (returnTo) url.searchParams.set("return_to", returnTo);
+	return url.toString();
+}
+/**
+* Gets the JWKS (JSON Web Key Set) URL for a given client ID.
+* Does not require an API key, returns the public JWKS endpoint.
+*
+* @param clientId - The WorkOS client ID
+* @param baseURL - Optional base URL for the API (defaults to https://api.workos.com)
+* @returns The JWKS URL as a string
+* @throws TypeError if clientId is not provided
+*/
+function getJwksUrl(clientId, baseURL = "https://api.workos.com") {
+	if (!clientId) throw new TypeError("clientId must be a valid clientId");
+	return `${baseURL}/sso/jwks/${clientId}`;
+}
+
+//#endregion
+exports.getAuthorizationUrl = getAuthorizationUrl;
+exports.getJwksUrl = getJwksUrl;
+exports.getLogoutUrl = getLogoutUrl;
+Object.defineProperty(exports, 'user_management_exports', {
+  enumerable: true,
+  get: function () {
+    return user_management_exports;
+  }
+});
+//# sourceMappingURL=user-management.cjs.map

package/lib/client/user-management.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"user-management.cjs","names":["toQueryString"],"sources":["../../src/client/user-management.ts"],"sourcesContent":["import { toQueryString } from '../common/utils/query-string';\n\n// Re-export necessary interfaces for client use\nexport interface AuthorizationURLOptions {\n  clientId: string;\n  codeChallenge?: string;\n  codeChallengeMethod?: 'S256';\n  connectionId?: string;\n  organizationId?: string;\n  domainHint?: string;\n  loginHint?: string;\n  provider?: string;\n  providerQueryParams?: Record<string, string | boolean | number>;\n  providerScopes?: string[];\n  prompt?: string;\n  redirectUri: string;\n  state?: string;\n  screenHint?: 'sign-up' | 'sign-in';\n}\n\nexport interface LogoutURLOptions {\n  sessionId: string;\n  returnTo?: string;\n}\n\n/**\n * Generates the authorization URL for OAuth client authentication.\n * Suitable for PKCE flows and other OAuth client operations that don't require an API key.\n *\n * @param options - Authorization URL options\n * @returns The authorization URL as a string\n * @throws TypeError if required arguments are missing\n */\nexport function getAuthorizationUrl(\n  options: AuthorizationURLOptions & { baseURL?: string },\n): string {\n  const {\n    connectionId,\n    codeChallenge,\n    codeChallengeMethod,\n    clientId,\n    domainHint,\n    loginHint,\n    organizationId,\n    provider,\n    providerQueryParams,\n    providerScopes,\n    prompt,\n    redirectUri,\n    state,\n    screenHint,\n    baseURL = 'https://api.workos.com',\n  } = options;\n\n  if (!provider && !connectionId && !organizationId) {\n    throw new TypeError(\n      `Incomplete arguments. Need to specify either a 'connectionId', 'organizationId', or 'provider'.`,\n    );\n  }\n\n  if (provider !== 'authkit' && screenHint) {\n    throw new TypeError(\n      `'screenHint' is only supported for 'authkit' provider`,\n    );\n  }\n\n  const query = toQueryString({\n    connection_id: connectionId,\n    code_challenge: codeChallenge,\n    code_challenge_method: codeChallengeMethod,\n    organization_id: organizationId,\n    domain_hint: domainHint,\n    login_hint: loginHint,\n    provider,\n    provider_query_params: providerQueryParams,\n    provider_scopes: providerScopes,\n    prompt,\n    client_id: clientId,\n    redirect_uri: redirectUri,\n    response_type: 'code',\n    state,\n    screen_hint: screenHint,\n  });\n\n  return `${baseURL}/user_management/authorize?${query}`;\n}\n\n/**\n * Generates the logout URL for ending a user session.\n * This method is safe to use in browser environments as it doesn't require an API key.\n *\n * @param options - Logout URL options\n * @returns The logout URL as a string\n * @throws TypeError if sessionId is not provided\n */\nexport function getLogoutUrl(\n  options: LogoutURLOptions & { baseURL?: string },\n): string {\n  const { sessionId, returnTo, baseURL = 'https://api.workos.com' } = options;\n\n  if (!sessionId) {\n    throw new TypeError(`Incomplete arguments. Need to specify 'sessionId'.`);\n  }\n\n  const url = new URL('/user_management/sessions/logout', baseURL);\n\n  url.searchParams.set('session_id', sessionId);\n  if (returnTo) {\n    url.searchParams.set('return_to', returnTo);\n  }\n\n  return url.toString();\n}\n\n/**\n * Gets the JWKS (JSON Web Key Set) URL for a given client ID.\n * Does not require an API key, returns the public JWKS endpoint.\n *\n * @param clientId - The WorkOS client ID\n * @param baseURL - Optional base URL for the API (defaults to https://api.workos.com)\n * @returns The JWKS URL as a string\n * @throws TypeError if clientId is not provided\n */\nexport function getJwksUrl(\n  clientId: string,\n  baseURL = 'https://api.workos.com',\n): string {\n  if (!clientId) {\n    throw new TypeError('clientId must be a valid clientId');\n  }\n\n  return `${baseURL}/sso/jwks/${clientId}`;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;AAiCA,SAAgB,oBACd,SACQ;CACR,MAAM,EACJ,cACA,eACA,qBACA,UACA,YACA,WACA,gBACA,UACA,qBACA,gBACA,QACA,aACA,OACA,YACA,UAAU,6BACR;AAEJ,KAAI,CAAC,YAAY,CAAC,gBAAgB,CAAC,eACjC,OAAM,IAAI,UACR,kGACD;AAGH,KAAI,aAAa,aAAa,WAC5B,OAAM,IAAI,UACR,wDACD;AAqBH,QAAO,GAAG,QAAQ,6BAlBJA,gDAAc;EAC1B,eAAe;EACf,gBAAgB;EAChB,uBAAuB;EACvB,iBAAiB;EACjB,aAAa;EACb,YAAY;EACZ;EACA,uBAAuB;EACvB,iBAAiB;EACjB;EACA,WAAW;EACX,cAAc;EACd,eAAe;EACf;EACA,aAAa;EACd,CAAC;;;;;;;;;;AAaJ,SAAgB,aACd,SACQ;CACR,MAAM,EAAE,WAAW,UAAU,UAAU,6BAA6B;AAEpE,KAAI,CAAC,UACH,OAAM,IAAI,UAAU,qDAAqD;CAG3E,MAAM,MAAM,IAAI,IAAI,oCAAoC,QAAQ;AAEhE,KAAI,aAAa,IAAI,cAAc,UAAU;AAC7C,KAAI,SACF,KAAI,aAAa,IAAI,aAAa,SAAS;AAG7C,QAAO,IAAI,UAAU;;;;;;;;;;;AAYvB,SAAgB,WACd,UACA,UAAU,0BACF;AACR,KAAI,CAAC,SACH,OAAM,IAAI,UAAU,oCAAoC;AAG1D,QAAO,GAAG,QAAQ,YAAY"}

package/lib/client/user-management.d.cts

@@ -0,0 +1,58 @@
+declare namespace user_management_d_exports {
+  export { AuthorizationURLOptions, LogoutURLOptions, getAuthorizationUrl, getJwksUrl, getLogoutUrl };
+}
+interface AuthorizationURLOptions {
+  clientId: string;
+  codeChallenge?: string;
+  codeChallengeMethod?: 'S256';
+  connectionId?: string;
+  organizationId?: string;
+  domainHint?: string;
+  loginHint?: string;
+  provider?: string;
+  providerQueryParams?: Record<string, string | boolean | number>;
+  providerScopes?: string[];
+  prompt?: string;
+  redirectUri: string;
+  state?: string;
+  screenHint?: 'sign-up' | 'sign-in';
+}
+interface LogoutURLOptions {
+  sessionId: string;
+  returnTo?: string;
+}
+/**
+ * Generates the authorization URL for OAuth client authentication.
+ * Suitable for PKCE flows and other OAuth client operations that don't require an API key.
+ *
+ * @param options - Authorization URL options
+ * @returns The authorization URL as a string
+ * @throws TypeError if required arguments are missing
+ */
+declare function getAuthorizationUrl(options: AuthorizationURLOptions & {
+  baseURL?: string;
+}): string;
+/**
+ * Generates the logout URL for ending a user session.
+ * This method is safe to use in browser environments as it doesn't require an API key.
+ *
+ * @param options - Logout URL options
+ * @returns The logout URL as a string
+ * @throws TypeError if sessionId is not provided
+ */
+declare function getLogoutUrl(options: LogoutURLOptions & {
+  baseURL?: string;
+}): string;
+/**
+ * Gets the JWKS (JSON Web Key Set) URL for a given client ID.
+ * Does not require an API key, returns the public JWKS endpoint.
+ *
+ * @param clientId - The WorkOS client ID
+ * @param baseURL - Optional base URL for the API (defaults to https://api.workos.com)
+ * @returns The JWKS URL as a string
+ * @throws TypeError if clientId is not provided
+ */
+declare function getJwksUrl(clientId: string, baseURL?: string): string;
+//#endregion
+export { AuthorizationURLOptions, LogoutURLOptions, getAuthorizationUrl, getJwksUrl, getLogoutUrl, user_management_d_exports };
+//# sourceMappingURL=user-management.d.cts.map

package/lib/client/user-management.d.ts

@@ -0,0 +1,58 @@
+declare namespace user_management_d_exports {
+  export { AuthorizationURLOptions, LogoutURLOptions, getAuthorizationUrl, getJwksUrl, getLogoutUrl };
+}
+interface AuthorizationURLOptions {
+  clientId: string;
+  codeChallenge?: string;
+  codeChallengeMethod?: 'S256';
+  connectionId?: string;
+  organizationId?: string;
+  domainHint?: string;
+  loginHint?: string;
+  provider?: string;
+  providerQueryParams?: Record<string, string | boolean | number>;
+  providerScopes?: string[];
+  prompt?: string;
+  redirectUri: string;
+  state?: string;
+  screenHint?: 'sign-up' | 'sign-in';
+}
+interface LogoutURLOptions {
+  sessionId: string;
+  returnTo?: string;
+}
+/**
+ * Generates the authorization URL for OAuth client authentication.
+ * Suitable for PKCE flows and other OAuth client operations that don't require an API key.
+ *
+ * @param options - Authorization URL options
+ * @returns The authorization URL as a string
+ * @throws TypeError if required arguments are missing
+ */
+declare function getAuthorizationUrl(options: AuthorizationURLOptions & {
+  baseURL?: string;
+}): string;
+/**
+ * Generates the logout URL for ending a user session.
+ * This method is safe to use in browser environments as it doesn't require an API key.
+ *
+ * @param options - Logout URL options
+ * @returns The logout URL as a string
+ * @throws TypeError if sessionId is not provided
+ */
+declare function getLogoutUrl(options: LogoutURLOptions & {
+  baseURL?: string;
+}): string;
+/**
+ * Gets the JWKS (JSON Web Key Set) URL for a given client ID.
+ * Does not require an API key, returns the public JWKS endpoint.
+ *
+ * @param clientId - The WorkOS client ID
+ * @param baseURL - Optional base URL for the API (defaults to https://api.workos.com)
+ * @returns The JWKS URL as a string
+ * @throws TypeError if clientId is not provided
+ */
+declare function getJwksUrl(clientId: string, baseURL?: string): string;
+//#endregion
+export { AuthorizationURLOptions, LogoutURLOptions, getAuthorizationUrl, getJwksUrl, getLogoutUrl, user_management_d_exports };
+//# sourceMappingURL=user-management.d.ts.map

package/lib/client/user-management.js

@@ -0,0 +1,72 @@
+import { __export } from "../_virtual/rolldown_runtime.js";
+import { toQueryString } from "../common/utils/query-string.js";
+
+//#region src/client/user-management.ts
+var user_management_exports = /* @__PURE__ */ __export({
+	getAuthorizationUrl: () => getAuthorizationUrl,
+	getJwksUrl: () => getJwksUrl,
+	getLogoutUrl: () => getLogoutUrl
+});
+/**
+* Generates the authorization URL for OAuth client authentication.
+* Suitable for PKCE flows and other OAuth client operations that don't require an API key.
+*
+* @param options - Authorization URL options
+* @returns The authorization URL as a string
+* @throws TypeError if required arguments are missing
+*/
+function getAuthorizationUrl(options) {
+	const { connectionId, codeChallenge, codeChallengeMethod, clientId, domainHint, loginHint, organizationId, provider, providerQueryParams, providerScopes, prompt, redirectUri, state, screenHint, baseURL = "https://api.workos.com" } = options;
+	if (!provider && !connectionId && !organizationId) throw new TypeError(`Incomplete arguments. Need to specify either a 'connectionId', 'organizationId', or 'provider'.`);
+	if (provider !== "authkit" && screenHint) throw new TypeError(`'screenHint' is only supported for 'authkit' provider`);
+	return `${baseURL}/user_management/authorize?${toQueryString({
+		connection_id: connectionId,
+		code_challenge: codeChallenge,
+		code_challenge_method: codeChallengeMethod,
+		organization_id: organizationId,
+		domain_hint: domainHint,
+		login_hint: loginHint,
+		provider,
+		provider_query_params: providerQueryParams,
+		provider_scopes: providerScopes,
+		prompt,
+		client_id: clientId,
+		redirect_uri: redirectUri,
+		response_type: "code",
+		state,
+		screen_hint: screenHint
+	})}`;
+}
+/**
+* Generates the logout URL for ending a user session.
+* This method is safe to use in browser environments as it doesn't require an API key.
+*
+* @param options - Logout URL options
+* @returns The logout URL as a string
+* @throws TypeError if sessionId is not provided
+*/
+function getLogoutUrl(options) {
+	const { sessionId, returnTo, baseURL = "https://api.workos.com" } = options;
+	if (!sessionId) throw new TypeError(`Incomplete arguments. Need to specify 'sessionId'.`);
+	const url = new URL("/user_management/sessions/logout", baseURL);
+	url.searchParams.set("session_id", sessionId);
+	if (returnTo) url.searchParams.set("return_to", returnTo);
+	return url.toString();
+}
+/**
+* Gets the JWKS (JSON Web Key Set) URL for a given client ID.
+* Does not require an API key, returns the public JWKS endpoint.
+*
+* @param clientId - The WorkOS client ID
+* @param baseURL - Optional base URL for the API (defaults to https://api.workos.com)
+* @returns The JWKS URL as a string
+* @throws TypeError if clientId is not provided
+*/
+function getJwksUrl(clientId, baseURL = "https://api.workos.com") {
+	if (!clientId) throw new TypeError("clientId must be a valid clientId");
+	return `${baseURL}/sso/jwks/${clientId}`;
+}
+
+//#endregion
+export { getAuthorizationUrl, getJwksUrl, getLogoutUrl, user_management_exports };
+//# sourceMappingURL=user-management.js.map

package/lib/client/user-management.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"user-management.js","names":[],"sources":["../../src/client/user-management.ts"],"sourcesContent":["import { toQueryString } from '../common/utils/query-string';\n\n// Re-export necessary interfaces for client use\nexport interface AuthorizationURLOptions {\n  clientId: string;\n  codeChallenge?: string;\n  codeChallengeMethod?: 'S256';\n  connectionId?: string;\n  organizationId?: string;\n  domainHint?: string;\n  loginHint?: string;\n  provider?: string;\n  providerQueryParams?: Record<string, string | boolean | number>;\n  providerScopes?: string[];\n  prompt?: string;\n  redirectUri: string;\n  state?: string;\n  screenHint?: 'sign-up' | 'sign-in';\n}\n\nexport interface LogoutURLOptions {\n  sessionId: string;\n  returnTo?: string;\n}\n\n/**\n * Generates the authorization URL for OAuth client authentication.\n * Suitable for PKCE flows and other OAuth client operations that don't require an API key.\n *\n * @param options - Authorization URL options\n * @returns The authorization URL as a string\n * @throws TypeError if required arguments are missing\n */\nexport function getAuthorizationUrl(\n  options: AuthorizationURLOptions & { baseURL?: string },\n): string {\n  const {\n    connectionId,\n    codeChallenge,\n    codeChallengeMethod,\n    clientId,\n    domainHint,\n    loginHint,\n    organizationId,\n    provider,\n    providerQueryParams,\n    providerScopes,\n    prompt,\n    redirectUri,\n    state,\n    screenHint,\n    baseURL = 'https://api.workos.com',\n  } = options;\n\n  if (!provider && !connectionId && !organizationId) {\n    throw new TypeError(\n      `Incomplete arguments. Need to specify either a 'connectionId', 'organizationId', or 'provider'.`,\n    );\n  }\n\n  if (provider !== 'authkit' && screenHint) {\n    throw new TypeError(\n      `'screenHint' is only supported for 'authkit' provider`,\n    );\n  }\n\n  const query = toQueryString({\n    connection_id: connectionId,\n    code_challenge: codeChallenge,\n    code_challenge_method: codeChallengeMethod,\n    organization_id: organizationId,\n    domain_hint: domainHint,\n    login_hint: loginHint,\n    provider,\n    provider_query_params: providerQueryParams,\n    provider_scopes: providerScopes,\n    prompt,\n    client_id: clientId,\n    redirect_uri: redirectUri,\n    response_type: 'code',\n    state,\n    screen_hint: screenHint,\n  });\n\n  return `${baseURL}/user_management/authorize?${query}`;\n}\n\n/**\n * Generates the logout URL for ending a user session.\n * This method is safe to use in browser environments as it doesn't require an API key.\n *\n * @param options - Logout URL options\n * @returns The logout URL as a string\n * @throws TypeError if sessionId is not provided\n */\nexport function getLogoutUrl(\n  options: LogoutURLOptions & { baseURL?: string },\n): string {\n  const { sessionId, returnTo, baseURL = 'https://api.workos.com' } = options;\n\n  if (!sessionId) {\n    throw new TypeError(`Incomplete arguments. Need to specify 'sessionId'.`);\n  }\n\n  const url = new URL('/user_management/sessions/logout', baseURL);\n\n  url.searchParams.set('session_id', sessionId);\n  if (returnTo) {\n    url.searchParams.set('return_to', returnTo);\n  }\n\n  return url.toString();\n}\n\n/**\n * Gets the JWKS (JSON Web Key Set) URL for a given client ID.\n * Does not require an API key, returns the public JWKS endpoint.\n *\n * @param clientId - The WorkOS client ID\n * @param baseURL - Optional base URL for the API (defaults to https://api.workos.com)\n * @returns The JWKS URL as a string\n * @throws TypeError if clientId is not provided\n */\nexport function getJwksUrl(\n  clientId: string,\n  baseURL = 'https://api.workos.com',\n): string {\n  if (!clientId) {\n    throw new TypeError('clientId must be a valid clientId');\n  }\n\n  return `${baseURL}/sso/jwks/${clientId}`;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;AAiCA,SAAgB,oBACd,SACQ;CACR,MAAM,EACJ,cACA,eACA,qBACA,UACA,YACA,WACA,gBACA,UACA,qBACA,gBACA,QACA,aACA,OACA,YACA,UAAU,6BACR;AAEJ,KAAI,CAAC,YAAY,CAAC,gBAAgB,CAAC,eACjC,OAAM,IAAI,UACR,kGACD;AAGH,KAAI,aAAa,aAAa,WAC5B,OAAM,IAAI,UACR,wDACD;AAqBH,QAAO,GAAG,QAAQ,6BAlBJ,cAAc;EAC1B,eAAe;EACf,gBAAgB;EAChB,uBAAuB;EACvB,iBAAiB;EACjB,aAAa;EACb,YAAY;EACZ;EACA,uBAAuB;EACvB,iBAAiB;EACjB;EACA,WAAW;EACX,cAAc;EACd,eAAe;EACf;EACA,aAAa;EACd,CAAC;;;;;;;;;;AAaJ,SAAgB,aACd,SACQ;CACR,MAAM,EAAE,WAAW,UAAU,UAAU,6BAA6B;AAEpE,KAAI,CAAC,UACH,OAAM,IAAI,UAAU,qDAAqD;CAG3E,MAAM,MAAM,IAAI,IAAI,oCAAoC,QAAQ;AAEhE,KAAI,aAAa,IAAI,cAAc,UAAU;AAC7C,KAAI,SACF,KAAI,aAAa,IAAI,aAAa,SAAS;AAG7C,QAAO,IAAI,UAAU;;;;;;;;;;;AAYvB,SAAgB,WACd,UACA,UAAU,0BACF;AACR,KAAI,CAAC,SACH,OAAM,IAAI,UAAU,oCAAoC;AAG1D,QAAO,GAAG,QAAQ,YAAY"}

package/lib/common/crypto/crypto-provider.cjs

@@ -0,0 +1,13 @@
+
+//#region src/common/crypto/crypto-provider.ts
+/**
+* Interface encapsulating the various crypto computations used by the library,
+* allowing pluggable underlying crypto implementations.
+*/
+var CryptoProvider = class {
+	encoder = new TextEncoder();
+};
+
+//#endregion
+exports.CryptoProvider = CryptoProvider;
+//# sourceMappingURL=crypto-provider.cjs.map

package/lib/common/crypto/crypto-provider.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto-provider.cjs","names":[],"sources":["../../../src/common/crypto/crypto-provider.ts"],"sourcesContent":["/**\n * Interface encapsulating the various crypto computations used by the library,\n * allowing pluggable underlying crypto implementations.\n */\nexport abstract class CryptoProvider {\n  encoder = new TextEncoder();\n\n  /**\n   * Computes a SHA-256 HMAC given a secret and a payload (encoded in UTF-8).\n   * The output HMAC should be encoded in hexadecimal.\n   *\n   * Sample values for implementations:\n   * - computeHMACSignature('', 'test_secret') => 'f7f9bd47fb987337b5796fdc1fdb9ba221d0d5396814bfcaf9521f43fd8927fd'\n   * - computeHMACSignature('\\ud83d\\ude00', 'test_secret') => '837da296d05c4fe31f61d5d7ead035099d9585a5bcde87de952012a78f0b0c43\n   */\n  abstract computeHMACSignature(payload: string, secret: string): string;\n\n  /**\n   * Asynchronous version of `computeHMACSignature`. Some implementations may\n   * only allow support async signature computation.\n   *\n   * Computes a SHA-256 HMAC given a secret and a payload (encoded in UTF-8).\n   * The output HMAC should be encoded in hexadecimal.\n   *\n   * Sample values for implementations:\n   * - computeHMACSignature('', 'test_secret') => 'f7f9bd47fb987337b5796fdc1fdb9ba221d0d5396814bfcaf9521f43fd8927fd'\n   * - computeHMACSignature('\\ud83d\\ude00', 'test_secret') => '837da296d05c4fe31f61d5d7ead035099d9585a5bcde87de952012a78f0b0c43\n   */\n  abstract computeHMACSignatureAsync(\n    payload: string,\n    secret: string,\n  ): Promise<string>;\n\n  /**\n   * Cryptographically determine whether two signatures are equal\n   */\n  abstract secureCompare(stringA: string, stringB: string): Promise<boolean>;\n\n  /**\n   * Encrypts data using AES-256-GCM algorithm.\n   *\n   * @param plaintext The data to encrypt\n   * @param key The encryption key (should be 32 bytes for AES-256)\n   * @param iv Optional initialization vector (if not provided, a random one will be generated)\n   * @param aad Optional additional authenticated data\n   * @returns Object containing the encrypted ciphertext, the IV used, and the authentication tag\n   */\n  abstract encrypt(\n    plaintext: Uint8Array,\n    key: Uint8Array,\n    iv?: Uint8Array,\n    aad?: Uint8Array,\n  ): Promise<{\n    ciphertext: Uint8Array;\n    iv: Uint8Array;\n    tag: Uint8Array;\n  }>;\n\n  /**\n   * Decrypts data that was encrypted using AES-256-GCM algorithm.\n   *\n   * @param ciphertext The encrypted data\n   * @param key The decryption key (must be the same key used for encryption)\n   * @param iv The initialization vector used during encryption\n   * @param tag The authentication tag produced during encryption\n   * @param aad Optional additional authenticated data (must match what was used during encryption)\n   * @returns The decrypted data\n   * @throws Will throw an error if authentication fails or the data has been tampered with\n   */\n  abstract decrypt(\n    ciphertext: Uint8Array,\n    key: Uint8Array,\n    iv: Uint8Array,\n    tag: Uint8Array,\n    aad?: Uint8Array,\n  ): Promise<Uint8Array>;\n\n  /**\n   * Generates cryptographically secure random bytes.\n   *\n   * @param length The number of random bytes to generate\n   * @returns A Uint8Array containing the random bytes\n   */\n  abstract randomBytes(length: number): Uint8Array;\n\n  /**\n   * Generates a random UUID v4 string.\n   *\n   * @returns A UUID v4 string in the format xxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxx\n   */\n  abstract randomUUID(): string;\n}\n"],"mappings":";;;;;;AAIA,IAAsB,iBAAtB,MAAqC;CACnC,UAAU,IAAI,aAAa"}

package/lib/common/crypto/crypto-provider.d.cts

@@ -0,0 +1,75 @@
+//#region src/common/crypto/crypto-provider.d.ts
+/**
+ * Interface encapsulating the various crypto computations used by the library,
+ * allowing pluggable underlying crypto implementations.
+ */
+declare abstract class CryptoProvider {
+  encoder: TextEncoder;
+  /**
+   * Computes a SHA-256 HMAC given a secret and a payload (encoded in UTF-8).
+   * The output HMAC should be encoded in hexadecimal.
+   *
+   * Sample values for implementations:
+   * - computeHMACSignature('', 'test_secret') => 'f7f9bd47fb987337b5796fdc1fdb9ba221d0d5396814bfcaf9521f43fd8927fd'
+   * - computeHMACSignature('\ud83d\ude00', 'test_secret') => '837da296d05c4fe31f61d5d7ead035099d9585a5bcde87de952012a78f0b0c43
+   */
+  abstract computeHMACSignature(payload: string, secret: string): string;
+  /**
+   * Asynchronous version of `computeHMACSignature`. Some implementations may
+   * only allow support async signature computation.
+   *
+   * Computes a SHA-256 HMAC given a secret and a payload (encoded in UTF-8).
+   * The output HMAC should be encoded in hexadecimal.
+   *
+   * Sample values for implementations:
+   * - computeHMACSignature('', 'test_secret') => 'f7f9bd47fb987337b5796fdc1fdb9ba221d0d5396814bfcaf9521f43fd8927fd'
+   * - computeHMACSignature('\ud83d\ude00', 'test_secret') => '837da296d05c4fe31f61d5d7ead035099d9585a5bcde87de952012a78f0b0c43
+   */
+  abstract computeHMACSignatureAsync(payload: string, secret: string): Promise<string>;
+  /**
+   * Cryptographically determine whether two signatures are equal
+   */
+  abstract secureCompare(stringA: string, stringB: string): Promise<boolean>;
+  /**
+   * Encrypts data using AES-256-GCM algorithm.
+   *
+   * @param plaintext The data to encrypt
+   * @param key The encryption key (should be 32 bytes for AES-256)
+   * @param iv Optional initialization vector (if not provided, a random one will be generated)
+   * @param aad Optional additional authenticated data
+   * @returns Object containing the encrypted ciphertext, the IV used, and the authentication tag
+   */
+  abstract encrypt(plaintext: Uint8Array, key: Uint8Array, iv?: Uint8Array, aad?: Uint8Array): Promise<{
+    ciphertext: Uint8Array;
+    iv: Uint8Array;
+    tag: Uint8Array;
+  }>;
+  /**
+   * Decrypts data that was encrypted using AES-256-GCM algorithm.
+   *
+   * @param ciphertext The encrypted data
+   * @param key The decryption key (must be the same key used for encryption)
+   * @param iv The initialization vector used during encryption
+   * @param tag The authentication tag produced during encryption
+   * @param aad Optional additional authenticated data (must match what was used during encryption)
+   * @returns The decrypted data
+   * @throws Will throw an error if authentication fails or the data has been tampered with
+   */
+  abstract decrypt(ciphertext: Uint8Array, key: Uint8Array, iv: Uint8Array, tag: Uint8Array, aad?: Uint8Array): Promise<Uint8Array>;
+  /**
+   * Generates cryptographically secure random bytes.
+   *
+   * @param length The number of random bytes to generate
+   * @returns A Uint8Array containing the random bytes
+   */
+  abstract randomBytes(length: number): Uint8Array;
+  /**
+   * Generates a random UUID v4 string.
+   *
+   * @returns A UUID v4 string in the format xxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxx
+   */
+  abstract randomUUID(): string;
+}
+//#endregion
+export { CryptoProvider };
+//# sourceMappingURL=crypto-provider.d.cts.map

package/lib/common/crypto/crypto-provider.d.ts

@@ -0,0 +1,75 @@
+//#region src/common/crypto/crypto-provider.d.ts
+/**
+ * Interface encapsulating the various crypto computations used by the library,
+ * allowing pluggable underlying crypto implementations.
+ */
+declare abstract class CryptoProvider {
+  encoder: TextEncoder;
+  /**
+   * Computes a SHA-256 HMAC given a secret and a payload (encoded in UTF-8).
+   * The output HMAC should be encoded in hexadecimal.
+   *
+   * Sample values for implementations:
+   * - computeHMACSignature('', 'test_secret') => 'f7f9bd47fb987337b5796fdc1fdb9ba221d0d5396814bfcaf9521f43fd8927fd'
+   * - computeHMACSignature('\ud83d\ude00', 'test_secret') => '837da296d05c4fe31f61d5d7ead035099d9585a5bcde87de952012a78f0b0c43
+   */
+  abstract computeHMACSignature(payload: string, secret: string): string;
+  /**
+   * Asynchronous version of `computeHMACSignature`. Some implementations may
+   * only allow support async signature computation.
+   *
+   * Computes a SHA-256 HMAC given a secret and a payload (encoded in UTF-8).
+   * The output HMAC should be encoded in hexadecimal.
+   *
+   * Sample values for implementations:
+   * - computeHMACSignature('', 'test_secret') => 'f7f9bd47fb987337b5796fdc1fdb9ba221d0d5396814bfcaf9521f43fd8927fd'
+   * - computeHMACSignature('\ud83d\ude00', 'test_secret') => '837da296d05c4fe31f61d5d7ead035099d9585a5bcde87de952012a78f0b0c43
+   */
+  abstract computeHMACSignatureAsync(payload: string, secret: string): Promise<string>;
+  /**
+   * Cryptographically determine whether two signatures are equal
+   */
+  abstract secureCompare(stringA: string, stringB: string): Promise<boolean>;
+  /**
+   * Encrypts data using AES-256-GCM algorithm.
+   *
+   * @param plaintext The data to encrypt
+   * @param key The encryption key (should be 32 bytes for AES-256)
+   * @param iv Optional initialization vector (if not provided, a random one will be generated)
+   * @param aad Optional additional authenticated data
+   * @returns Object containing the encrypted ciphertext, the IV used, and the authentication tag
+   */
+  abstract encrypt(plaintext: Uint8Array, key: Uint8Array, iv?: Uint8Array, aad?: Uint8Array): Promise<{
+    ciphertext: Uint8Array;
+    iv: Uint8Array;
+    tag: Uint8Array;
+  }>;
+  /**
+   * Decrypts data that was encrypted using AES-256-GCM algorithm.
+   *
+   * @param ciphertext The encrypted data
+   * @param key The decryption key (must be the same key used for encryption)
+   * @param iv The initialization vector used during encryption
+   * @param tag The authentication tag produced during encryption
+   * @param aad Optional additional authenticated data (must match what was used during encryption)
+   * @returns The decrypted data
+   * @throws Will throw an error if authentication fails or the data has been tampered with
+   */
+  abstract decrypt(ciphertext: Uint8Array, key: Uint8Array, iv: Uint8Array, tag: Uint8Array, aad?: Uint8Array): Promise<Uint8Array>;
+  /**
+   * Generates cryptographically secure random bytes.
+   *
+   * @param length The number of random bytes to generate
+   * @returns A Uint8Array containing the random bytes
+   */
+  abstract randomBytes(length: number): Uint8Array;
+  /**
+   * Generates a random UUID v4 string.
+   *
+   * @returns A UUID v4 string in the format xxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxx
+   */
+  abstract randomUUID(): string;
+}
+//#endregion
+export { CryptoProvider };
+//# sourceMappingURL=crypto-provider.d.ts.map

package/lib/common/crypto/crypto-provider.js

@@ -0,0 +1,12 @@
+//#region src/common/crypto/crypto-provider.ts
+/**
+* Interface encapsulating the various crypto computations used by the library,
+* allowing pluggable underlying crypto implementations.
+*/
+var CryptoProvider = class {
+	encoder = new TextEncoder();
+};
+
+//#endregion
+export { CryptoProvider };
+//# sourceMappingURL=crypto-provider.js.map

package/lib/common/crypto/crypto-provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto-provider.js","names":[],"sources":["../../../src/common/crypto/crypto-provider.ts"],"sourcesContent":["/**\n * Interface encapsulating the various crypto computations used by the library,\n * allowing pluggable underlying crypto implementations.\n */\nexport abstract class CryptoProvider {\n  encoder = new TextEncoder();\n\n  /**\n   * Computes a SHA-256 HMAC given a secret and a payload (encoded in UTF-8).\n   * The output HMAC should be encoded in hexadecimal.\n   *\n   * Sample values for implementations:\n   * - computeHMACSignature('', 'test_secret') => 'f7f9bd47fb987337b5796fdc1fdb9ba221d0d5396814bfcaf9521f43fd8927fd'\n   * - computeHMACSignature('\\ud83d\\ude00', 'test_secret') => '837da296d05c4fe31f61d5d7ead035099d9585a5bcde87de952012a78f0b0c43\n   */\n  abstract computeHMACSignature(payload: string, secret: string): string;\n\n  /**\n   * Asynchronous version of `computeHMACSignature`. Some implementations may\n   * only allow support async signature computation.\n   *\n   * Computes a SHA-256 HMAC given a secret and a payload (encoded in UTF-8).\n   * The output HMAC should be encoded in hexadecimal.\n   *\n   * Sample values for implementations:\n   * - computeHMACSignature('', 'test_secret') => 'f7f9bd47fb987337b5796fdc1fdb9ba221d0d5396814bfcaf9521f43fd8927fd'\n   * - computeHMACSignature('\\ud83d\\ude00', 'test_secret') => '837da296d05c4fe31f61d5d7ead035099d9585a5bcde87de952012a78f0b0c43\n   */\n  abstract computeHMACSignatureAsync(\n    payload: string,\n    secret: string,\n  ): Promise<string>;\n\n  /**\n   * Cryptographically determine whether two signatures are equal\n   */\n  abstract secureCompare(stringA: string, stringB: string): Promise<boolean>;\n\n  /**\n   * Encrypts data using AES-256-GCM algorithm.\n   *\n   * @param plaintext The data to encrypt\n   * @param key The encryption key (should be 32 bytes for AES-256)\n   * @param iv Optional initialization vector (if not provided, a random one will be generated)\n   * @param aad Optional additional authenticated data\n   * @returns Object containing the encrypted ciphertext, the IV used, and the authentication tag\n   */\n  abstract encrypt(\n    plaintext: Uint8Array,\n    key: Uint8Array,\n    iv?: Uint8Array,\n    aad?: Uint8Array,\n  ): Promise<{\n    ciphertext: Uint8Array;\n    iv: Uint8Array;\n    tag: Uint8Array;\n  }>;\n\n  /**\n   * Decrypts data that was encrypted using AES-256-GCM algorithm.\n   *\n   * @param ciphertext The encrypted data\n   * @param key The decryption key (must be the same key used for encryption)\n   * @param iv The initialization vector used during encryption\n   * @param tag The authentication tag produced during encryption\n   * @param aad Optional additional authenticated data (must match what was used during encryption)\n   * @returns The decrypted data\n   * @throws Will throw an error if authentication fails or the data has been tampered with\n   */\n  abstract decrypt(\n    ciphertext: Uint8Array,\n    key: Uint8Array,\n    iv: Uint8Array,\n    tag: Uint8Array,\n    aad?: Uint8Array,\n  ): Promise<Uint8Array>;\n\n  /**\n   * Generates cryptographically secure random bytes.\n   *\n   * @param length The number of random bytes to generate\n   * @returns A Uint8Array containing the random bytes\n   */\n  abstract randomBytes(length: number): Uint8Array;\n\n  /**\n   * Generates a random UUID v4 string.\n   *\n   * @returns A UUID v4 string in the format xxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxx\n   */\n  abstract randomUUID(): string;\n}\n"],"mappings":";;;;;AAIA,IAAsB,iBAAtB,MAAqC;CACnC,UAAU,IAAI,aAAa"}

package/lib/common/crypto/signature-provider.cjs

@@ -0,0 +1,33 @@
+const require_common_exceptions_signature_verification_exception = require('../exceptions/signature-verification.exception.cjs');
+
+//#region src/common/crypto/signature-provider.ts
+var SignatureProvider = class {
+	cryptoProvider;
+	constructor(cryptoProvider) {
+		this.cryptoProvider = cryptoProvider;
+	}
+	async verifyHeader({ payload, sigHeader, secret, tolerance = 18e4 }) {
+		const [timestamp, signatureHash] = this.getTimestampAndSignatureHash(sigHeader);
+		if (!signatureHash || Object.keys(signatureHash).length === 0) throw new require_common_exceptions_signature_verification_exception.SignatureVerificationException("No signature hash found with expected scheme v1");
+		if (parseInt(timestamp, 10) < Date.now() - tolerance) throw new require_common_exceptions_signature_verification_exception.SignatureVerificationException("Timestamp outside the tolerance zone");
+		const expectedSig = await this.computeSignature(timestamp, payload, secret);
+		if (await this.cryptoProvider.secureCompare(expectedSig, signatureHash) === false) throw new require_common_exceptions_signature_verification_exception.SignatureVerificationException("Signature hash does not match the expected signature hash for payload");
+		return true;
+	}
+	getTimestampAndSignatureHash(sigHeader) {
+		const [t, v1] = sigHeader.split(",");
+		if (typeof t === "undefined" || typeof v1 === "undefined") throw new require_common_exceptions_signature_verification_exception.SignatureVerificationException("Signature or timestamp missing");
+		const { 1: timestamp } = t.split("=");
+		const { 1: signatureHash } = v1.split("=");
+		return [timestamp, signatureHash];
+	}
+	async computeSignature(timestamp, payload, secret) {
+		payload = JSON.stringify(payload);
+		const signedPayload = `${timestamp}.${payload}`;
+		return await this.cryptoProvider.computeHMACSignatureAsync(signedPayload, secret);
+	}
+};
+
+//#endregion
+exports.SignatureProvider = SignatureProvider;
+//# sourceMappingURL=signature-provider.cjs.map

package/lib/common/crypto/signature-provider.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"signature-provider.cjs","names":["SignatureVerificationException"],"sources":["../../../src/common/crypto/signature-provider.ts"],"sourcesContent":["import { SignatureVerificationException } from '../exceptions';\nimport { CryptoProvider } from './crypto-provider';\n\nexport class SignatureProvider {\n  private cryptoProvider: CryptoProvider;\n\n  constructor(cryptoProvider: CryptoProvider) {\n    this.cryptoProvider = cryptoProvider;\n  }\n\n  async verifyHeader({\n    payload,\n    sigHeader,\n    secret,\n    tolerance = 180000,\n  }: {\n    payload: any;\n    sigHeader: string;\n    secret: string;\n    tolerance?: number;\n  }): Promise<boolean> {\n    const [timestamp, signatureHash] =\n      this.getTimestampAndSignatureHash(sigHeader);\n\n    if (!signatureHash || Object.keys(signatureHash).length === 0) {\n      throw new SignatureVerificationException(\n        'No signature hash found with expected scheme v1',\n      );\n    }\n\n    if (parseInt(timestamp, 10) < Date.now() - tolerance) {\n      throw new SignatureVerificationException(\n        'Timestamp outside the tolerance zone',\n      );\n    }\n\n    const expectedSig = await this.computeSignature(timestamp, payload, secret);\n    if (\n      (await this.cryptoProvider.secureCompare(expectedSig, signatureHash)) ===\n      false\n    ) {\n      throw new SignatureVerificationException(\n        'Signature hash does not match the expected signature hash for payload',\n      );\n    }\n    return true;\n  }\n\n  getTimestampAndSignatureHash(sigHeader: string): [string, string] {\n    const signature = sigHeader;\n    const [t, v1] = signature.split(',');\n    if (typeof t === 'undefined' || typeof v1 === 'undefined') {\n      throw new SignatureVerificationException(\n        'Signature or timestamp missing',\n      );\n    }\n    const { 1: timestamp } = t.split('=');\n    const { 1: signatureHash } = v1.split('=');\n\n    return [timestamp, signatureHash];\n  }\n\n  async computeSignature(\n    timestamp: any,\n    payload: any,\n    secret: string,\n  ): Promise<string> {\n    payload = JSON.stringify(payload);\n    const signedPayload = `${timestamp}.${payload}`;\n\n    return await this.cryptoProvider.computeHMACSignatureAsync(\n      signedPayload,\n      secret,\n    );\n  }\n}\n"],"mappings":";;;AAGA,IAAa,oBAAb,MAA+B;CAC7B,AAAQ;CAER,YAAY,gBAAgC;AAC1C,OAAK,iBAAiB;;CAGxB,MAAM,aAAa,EACjB,SACA,WACA,QACA,YAAY,QAMO;EACnB,MAAM,CAAC,WAAW,iBAChB,KAAK,6BAA6B,UAAU;AAE9C,MAAI,CAAC,iBAAiB,OAAO,KAAK,cAAc,CAAC,WAAW,EAC1D,OAAM,IAAIA,0FACR,kDACD;AAGH,MAAI,SAAS,WAAW,GAAG,GAAG,KAAK,KAAK,GAAG,UACzC,OAAM,IAAIA,0FACR,uCACD;EAGH,MAAM,cAAc,MAAM,KAAK,iBAAiB,WAAW,SAAS,OAAO;AAC3E,MACG,MAAM,KAAK,eAAe,cAAc,aAAa,cAAc,KACpE,MAEA,OAAM,IAAIA,0FACR,wEACD;AAEH,SAAO;;CAGT,6BAA6B,WAAqC;EAEhE,MAAM,CAAC,GAAG,MADQ,UACQ,MAAM,IAAI;AACpC,MAAI,OAAO,MAAM,eAAe,OAAO,OAAO,YAC5C,OAAM,IAAIA,0FACR,iCACD;EAEH,MAAM,EAAE,GAAG,cAAc,EAAE,MAAM,IAAI;EACrC,MAAM,EAAE,GAAG,kBAAkB,GAAG,MAAM,IAAI;AAE1C,SAAO,CAAC,WAAW,cAAc;;CAGnC,MAAM,iBACJ,WACA,SACA,QACiB;AACjB,YAAU,KAAK,UAAU,QAAQ;EACjC,MAAM,gBAAgB,GAAG,UAAU,GAAG;AAEtC,SAAO,MAAM,KAAK,eAAe,0BAC/B,eACA,OACD"}

package/lib/common/crypto/signature-provider.d.cts

@@ -0,0 +1,23 @@
+import { CryptoProvider } from "./crypto-provider.cjs";
+
+//#region src/common/crypto/signature-provider.d.ts
+declare class SignatureProvider {
+  private cryptoProvider;
+  constructor(cryptoProvider: CryptoProvider);
+  verifyHeader({
+    payload,
+    sigHeader,
+    secret,
+    tolerance
+  }: {
+    payload: any;
+    sigHeader: string;
+    secret: string;
+    tolerance?: number;
+  }): Promise<boolean>;
+  getTimestampAndSignatureHash(sigHeader: string): [string, string];
+  computeSignature(timestamp: any, payload: any, secret: string): Promise<string>;
+}
+//#endregion
+export { SignatureProvider };
+//# sourceMappingURL=signature-provider.d.cts.map

package/lib/common/crypto/signature-provider.d.ts

@@ -0,0 +1,23 @@
+import { CryptoProvider } from "./crypto-provider.js";
+
+//#region src/common/crypto/signature-provider.d.ts
+declare class SignatureProvider {
+  private cryptoProvider;
+  constructor(cryptoProvider: CryptoProvider);
+  verifyHeader({
+    payload,
+    sigHeader,
+    secret,
+    tolerance
+  }: {
+    payload: any;
+    sigHeader: string;
+    secret: string;
+    tolerance?: number;
+  }): Promise<boolean>;
+  getTimestampAndSignatureHash(sigHeader: string): [string, string];
+  computeSignature(timestamp: any, payload: any, secret: string): Promise<string>;
+}
+//#endregion
+export { SignatureProvider };
+//# sourceMappingURL=signature-provider.d.ts.map