@workos-inc/node 8.0.0-rc.2 → 8.0.0-rc.4

package/lib/vault/vault.cjs

@@ -0,0 +1,97 @@
+const require_common_utils_leb128 = require('../common/utils/leb128.cjs');
+const require_common_utils_base64 = require('../common/utils/base64.cjs');
+const require_vault_serializers_vault_key_serializer = require('./serializers/vault-key.serializer.cjs');
+const require_vault_serializers_vault_object_serializer = require('./serializers/vault-object.serializer.cjs');
+
+//#region src/vault/vault.ts
+var Vault = class {
+	cryptoProvider;
+	constructor(workos) {
+		this.workos = workos;
+		this.cryptoProvider = workos.getCryptoProvider();
+	}
+	decode(payload) {
+		const inputData = require_common_utils_base64.base64ToUint8Array(payload);
+		const iv = new Uint8Array(inputData.subarray(0, 12));
+		const tag = new Uint8Array(inputData.subarray(12, 28));
+		const { value: keyLen, nextIndex } = require_common_utils_leb128.decodeUInt32(inputData, 28);
+		return {
+			iv,
+			tag,
+			keys: require_common_utils_base64.uint8ArrayToBase64(inputData.subarray(nextIndex, nextIndex + keyLen)),
+			ciphertext: new Uint8Array(inputData.subarray(nextIndex + keyLen))
+		};
+	}
+	async createObject(options) {
+		const { data } = await this.workos.post(`/vault/v1/kv`, require_vault_serializers_vault_object_serializer.serializeCreateObjectEntity(options));
+		return require_vault_serializers_vault_object_serializer.deserializeObjectMetadata(data);
+	}
+	async listObjects(options) {
+		const url = new URL("/vault/v1/kv", this.workos.baseURL);
+		if (options?.after) url.searchParams.set("after", options.after);
+		if (options?.limit) url.searchParams.set("limit", options.limit.toString());
+		const { data } = await this.workos.get(url.toString());
+		return require_vault_serializers_vault_object_serializer.deserializeListObjects(data);
+	}
+	async listObjectVersions(options) {
+		const { data } = await this.workos.get(`/vault/v1/kv/${encodeURIComponent(options.id)}/versions`);
+		return require_vault_serializers_vault_object_serializer.desrializeListObjectVersions(data);
+	}
+	async readObject(options) {
+		const { data } = await this.workos.get(`/vault/v1/kv/${encodeURIComponent(options.id)}`);
+		return require_vault_serializers_vault_object_serializer.deserializeObject(data);
+	}
+	async describeObject(options) {
+		const { data } = await this.workos.get(`/vault/v1/kv/${encodeURIComponent(options.id)}/metadata`);
+		return require_vault_serializers_vault_object_serializer.deserializeObject(data);
+	}
+	async updateObject(options) {
+		const { data } = await this.workos.put(`/vault/v1/kv/${encodeURIComponent(options.id)}`, require_vault_serializers_vault_object_serializer.serializeUpdateObjectEntity(options));
+		return require_vault_serializers_vault_object_serializer.deserializeObject(data);
+	}
+	async deleteObject(options) {
+		return this.workos.delete(`/vault/v1/kv/${encodeURIComponent(options.id)}`);
+	}
+	async createDataKey(options) {
+		const { data } = await this.workos.post(`/vault/v1/keys/data-key`, options);
+		return require_vault_serializers_vault_key_serializer.deserializeCreateDataKeyResponse(data);
+	}
+	async decryptDataKey(options) {
+		const { data } = await this.workos.post(`/vault/v1/keys/decrypt`, options);
+		return require_vault_serializers_vault_key_serializer.deserializeDecryptDataKeyResponse(data);
+	}
+	async encrypt(data, context, associatedData) {
+		const keyPair = await this.createDataKey({ context });
+		const encoder = new TextEncoder();
+		const key = require_common_utils_base64.base64ToUint8Array(keyPair.dataKey.key);
+		const keyBlob = require_common_utils_base64.base64ToUint8Array(keyPair.encryptedKeys);
+		const prefixLenBuffer = require_common_utils_leb128.encodeUInt32(keyBlob.length);
+		const aadBuffer = associatedData ? encoder.encode(associatedData) : void 0;
+		const iv = this.cryptoProvider.randomBytes(12);
+		const { ciphertext, iv: resultIv, tag } = await this.cryptoProvider.encrypt(encoder.encode(data), key, iv, aadBuffer);
+		const resultArray = new Uint8Array(resultIv.length + tag.length + prefixLenBuffer.length + keyBlob.length + ciphertext.length);
+		let offset = 0;
+		resultArray.set(resultIv, offset);
+		offset += resultIv.length;
+		resultArray.set(tag, offset);
+		offset += tag.length;
+		resultArray.set(new Uint8Array(prefixLenBuffer), offset);
+		offset += prefixLenBuffer.length;
+		resultArray.set(keyBlob, offset);
+		offset += keyBlob.length;
+		resultArray.set(ciphertext, offset);
+		return require_common_utils_base64.uint8ArrayToBase64(resultArray);
+	}
+	async decrypt(encryptedData, associatedData) {
+		const decoded = this.decode(encryptedData);
+		const key = require_common_utils_base64.base64ToUint8Array((await this.decryptDataKey({ keys: decoded.keys })).key);
+		const encoder = new TextEncoder();
+		const aadBuffer = associatedData ? encoder.encode(associatedData) : void 0;
+		const decrypted = await this.cryptoProvider.decrypt(decoded.ciphertext, key, decoded.iv, decoded.tag, aadBuffer);
+		return new TextDecoder().decode(decrypted);
+	}
+};
+
+//#endregion
+exports.Vault = Vault;
+//# sourceMappingURL=vault.cjs.map

package/lib/vault/vault.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"vault.cjs","names":["workos: WorkOS","base64ToUint8Array","decodeUInt32","uint8ArrayToBase64","serializeCreateObjectEntity","deserializeObjectMetadata","deserializeListObjects","desrializeListObjectVersions","deserializeObject","serializeUpdateObjectEntity","deserializeCreateDataKeyResponse","deserializeDecryptDataKeyResponse","encodeUInt32"],"sources":["../../src/vault/vault.ts"],"sourcesContent":["import { decodeUInt32, encodeUInt32 } from '../common/utils/leb128';\nimport { CryptoProvider } from '../common/crypto/crypto-provider';\nimport { List, ListResponse } from '../common/interfaces';\nimport { PaginationOptions } from '../index.worker';\nimport { base64ToUint8Array, uint8ArrayToBase64 } from '../common/utils/base64';\nimport type { WorkOS } from '../workos';\nimport {\n  CreateDataKeyOptions,\n  CreateDataKeyResponse,\n  CreateObjectOptions,\n  DataKey,\n  DataKeyPair,\n  DecryptDataKeyOptions,\n  DecryptDataKeyResponse,\n  DeleteObjectOptions,\n  KeyContext,\n  ListObjectVersionsResponse,\n  ObjectDigest,\n  ObjectDigestResponse,\n  ObjectMetadata,\n  ObjectVersion,\n  ReadObjectMetadataResponse,\n  ReadObjectOptions,\n  ReadObjectResponse,\n  UpdateObjectOptions,\n  VaultObject,\n} from './interfaces';\nimport {\n  deserializeCreateDataKeyResponse,\n  deserializeDecryptDataKeyResponse,\n} from './serializers/vault-key.serializer';\nimport {\n  deserializeListObjects,\n  deserializeObject,\n  deserializeObjectMetadata,\n  desrializeListObjectVersions,\n  serializeCreateObjectEntity,\n  serializeUpdateObjectEntity,\n} from './serializers/vault-object.serializer';\n\ninterface Decoded {\n  iv: Uint8Array;\n  tag: Uint8Array;\n  keys: string;\n  ciphertext: Uint8Array;\n}\n\nexport class Vault {\n  private cryptoProvider: CryptoProvider;\n\n  constructor(private readonly workos: WorkOS) {\n    this.cryptoProvider = workos.getCryptoProvider();\n  }\n\n  private decode(payload: string): Decoded {\n    const inputData = base64ToUint8Array(payload);\n    // Use 12 bytes for IV (standard for AES-GCM)\n    const iv = new Uint8Array(inputData.subarray(0, 12));\n    const tag = new Uint8Array(inputData.subarray(12, 28));\n    const { value: keyLen, nextIndex } = decodeUInt32(inputData, 28);\n\n    // Use subarray instead of slice and convert directly to base64\n    const keysBuffer = inputData.subarray(nextIndex, nextIndex + keyLen);\n    const keys = uint8ArrayToBase64(keysBuffer);\n\n    const ciphertext = new Uint8Array(inputData.subarray(nextIndex + keyLen));\n\n    return {\n      iv,\n      tag,\n      keys,\n      ciphertext,\n    };\n  }\n\n  async createObject(options: CreateObjectOptions): Promise<ObjectMetadata> {\n    const { data } = await this.workos.post<ReadObjectMetadataResponse>(\n      `/vault/v1/kv`,\n      serializeCreateObjectEntity(options),\n    );\n    return deserializeObjectMetadata(data);\n  }\n\n  async listObjects(\n    options?: PaginationOptions | undefined,\n  ): Promise<List<ObjectDigest>> {\n    const url = new URL('/vault/v1/kv', this.workos.baseURL);\n    if (options?.after) {\n      url.searchParams.set('after', options.after);\n    }\n    if (options?.limit) {\n      url.searchParams.set('limit', options.limit.toString());\n    }\n\n    const { data } = await this.workos.get<ListResponse<ObjectDigestResponse>>(\n      url.toString(),\n    );\n    return deserializeListObjects(data);\n  }\n\n  async listObjectVersions(\n    options: ReadObjectOptions,\n  ): Promise<ObjectVersion[]> {\n    const { data } = await this.workos.get<ListObjectVersionsResponse>(\n      `/vault/v1/kv/${encodeURIComponent(options.id)}/versions`,\n    );\n    return desrializeListObjectVersions(data);\n  }\n\n  async readObject(options: ReadObjectOptions): Promise<VaultObject> {\n    const { data } = await this.workos.get<ReadObjectResponse>(\n      `/vault/v1/kv/${encodeURIComponent(options.id)}`,\n    );\n    return deserializeObject(data);\n  }\n\n  async describeObject(options: ReadObjectOptions): Promise<VaultObject> {\n    const { data } = await this.workos.get<ReadObjectResponse>(\n      `/vault/v1/kv/${encodeURIComponent(options.id)}/metadata`,\n    );\n    return deserializeObject(data);\n  }\n\n  async updateObject(options: UpdateObjectOptions): Promise<VaultObject> {\n    const { data } = await this.workos.put<ReadObjectResponse>(\n      `/vault/v1/kv/${encodeURIComponent(options.id)}`,\n      serializeUpdateObjectEntity(options),\n    );\n    return deserializeObject(data);\n  }\n\n  async deleteObject(options: DeleteObjectOptions): Promise<void> {\n    return this.workos.delete(`/vault/v1/kv/${encodeURIComponent(options.id)}`);\n  }\n\n  async createDataKey(options: CreateDataKeyOptions): Promise<DataKeyPair> {\n    const { data } = await this.workos.post<CreateDataKeyResponse>(\n      `/vault/v1/keys/data-key`,\n      options,\n    );\n    return deserializeCreateDataKeyResponse(data);\n  }\n\n  async decryptDataKey(options: DecryptDataKeyOptions): Promise<DataKey> {\n    const { data } = await this.workos.post<DecryptDataKeyResponse>(\n      `/vault/v1/keys/decrypt`,\n      options,\n    );\n    return deserializeDecryptDataKeyResponse(data);\n  }\n\n  async encrypt(\n    data: string,\n    context: KeyContext,\n    associatedData?: string,\n  ): Promise<string> {\n    const keyPair = await this.createDataKey({\n      context,\n    });\n\n    // Convert base64 key to Uint8Array\n    const encoder = new TextEncoder();\n\n    // Use our cross-runtime base64 utility\n    const key = base64ToUint8Array(keyPair.dataKey.key);\n    const keyBlob = base64ToUint8Array(keyPair.encryptedKeys);\n\n    const prefixLenBuffer = encodeUInt32(keyBlob.length);\n    const aadBuffer = associatedData\n      ? encoder.encode(associatedData)\n      : undefined;\n\n    // Use a 12-byte IV for AES-GCM (industry standard)\n    const iv = this.cryptoProvider.randomBytes(12);\n\n    const {\n      ciphertext,\n      iv: resultIv,\n      tag,\n    } = await this.cryptoProvider.encrypt(\n      encoder.encode(data),\n      key,\n      iv,\n      aadBuffer,\n    );\n\n    // Concatenate all parts into a single array\n    const resultArray = new Uint8Array(\n      resultIv.length +\n        tag.length +\n        prefixLenBuffer.length +\n        keyBlob.length +\n        ciphertext.length,\n    );\n\n    let offset = 0;\n    resultArray.set(resultIv, offset);\n    offset += resultIv.length;\n\n    resultArray.set(tag, offset);\n    offset += tag.length;\n\n    resultArray.set(new Uint8Array(prefixLenBuffer), offset);\n    offset += prefixLenBuffer.length;\n\n    resultArray.set(keyBlob, offset);\n    offset += keyBlob.length;\n\n    resultArray.set(ciphertext, offset);\n\n    // Convert to base64 using our cross-runtime utility\n    return uint8ArrayToBase64(resultArray);\n  }\n\n  async decrypt(\n    encryptedData: string,\n    associatedData?: string,\n  ): Promise<string> {\n    const decoded = this.decode(encryptedData);\n    const dataKey = await this.decryptDataKey({ keys: decoded.keys });\n\n    // Convert base64 key to Uint8Array using our cross-runtime utility\n    const key = base64ToUint8Array(dataKey.key);\n\n    const encoder = new TextEncoder();\n    const aadBuffer = associatedData\n      ? encoder.encode(associatedData)\n      : undefined;\n\n    const decrypted = await this.cryptoProvider.decrypt(\n      decoded.ciphertext,\n      key,\n      decoded.iv,\n      decoded.tag,\n      aadBuffer,\n    );\n\n    return new TextDecoder().decode(decrypted);\n  }\n}\n"],"mappings":";;;;;;AA+CA,IAAa,QAAb,MAAmB;CACjB,AAAQ;CAER,YAAY,AAAiBA,QAAgB;EAAhB;AAC3B,OAAK,iBAAiB,OAAO,mBAAmB;;CAGlD,AAAQ,OAAO,SAA0B;EACvC,MAAM,YAAYC,+CAAmB,QAAQ;EAE7C,MAAM,KAAK,IAAI,WAAW,UAAU,SAAS,GAAG,GAAG,CAAC;EACpD,MAAM,MAAM,IAAI,WAAW,UAAU,SAAS,IAAI,GAAG,CAAC;EACtD,MAAM,EAAE,OAAO,QAAQ,cAAcC,yCAAa,WAAW,GAAG;AAQhE,SAAO;GACL;GACA;GACA,MAPWC,+CADM,UAAU,SAAS,WAAW,YAAY,OAAO,CACzB;GAQzC,YANiB,IAAI,WAAW,UAAU,SAAS,YAAY,OAAO,CAAC;GAOxE;;CAGH,MAAM,aAAa,SAAuD;EACxE,MAAM,EAAE,SAAS,MAAM,KAAK,OAAO,KACjC,gBACAC,8EAA4B,QAAQ,CACrC;AACD,SAAOC,4EAA0B,KAAK;;CAGxC,MAAM,YACJ,SAC6B;EAC7B,MAAM,MAAM,IAAI,IAAI,gBAAgB,KAAK,OAAO,QAAQ;AACxD,MAAI,SAAS,MACX,KAAI,aAAa,IAAI,SAAS,QAAQ,MAAM;AAE9C,MAAI,SAAS,MACX,KAAI,aAAa,IAAI,SAAS,QAAQ,MAAM,UAAU,CAAC;EAGzD,MAAM,EAAE,SAAS,MAAM,KAAK,OAAO,IACjC,IAAI,UAAU,CACf;AACD,SAAOC,yEAAuB,KAAK;;CAGrC,MAAM,mBACJ,SAC0B;EAC1B,MAAM,EAAE,SAAS,MAAM,KAAK,OAAO,IACjC,gBAAgB,mBAAmB,QAAQ,GAAG,CAAC,WAChD;AACD,SAAOC,+EAA6B,KAAK;;CAG3C,MAAM,WAAW,SAAkD;EACjE,MAAM,EAAE,SAAS,MAAM,KAAK,OAAO,IACjC,gBAAgB,mBAAmB,QAAQ,GAAG,GAC/C;AACD,SAAOC,oEAAkB,KAAK;;CAGhC,MAAM,eAAe,SAAkD;EACrE,MAAM,EAAE,SAAS,MAAM,KAAK,OAAO,IACjC,gBAAgB,mBAAmB,QAAQ,GAAG,CAAC,WAChD;AACD,SAAOA,oEAAkB,KAAK;;CAGhC,MAAM,aAAa,SAAoD;EACrE,MAAM,EAAE,SAAS,MAAM,KAAK,OAAO,IACjC,gBAAgB,mBAAmB,QAAQ,GAAG,IAC9CC,8EAA4B,QAAQ,CACrC;AACD,SAAOD,oEAAkB,KAAK;;CAGhC,MAAM,aAAa,SAA6C;AAC9D,SAAO,KAAK,OAAO,OAAO,gBAAgB,mBAAmB,QAAQ,GAAG,GAAG;;CAG7E,MAAM,cAAc,SAAqD;EACvE,MAAM,EAAE,SAAS,MAAM,KAAK,OAAO,KACjC,2BACA,QACD;AACD,SAAOE,gFAAiC,KAAK;;CAG/C,MAAM,eAAe,SAAkD;EACrE,MAAM,EAAE,SAAS,MAAM,KAAK,OAAO,KACjC,0BACA,QACD;AACD,SAAOC,iFAAkC,KAAK;;CAGhD,MAAM,QACJ,MACA,SACA,gBACiB;EACjB,MAAM,UAAU,MAAM,KAAK,cAAc,EACvC,SACD,CAAC;EAGF,MAAM,UAAU,IAAI,aAAa;EAGjC,MAAM,MAAMV,+CAAmB,QAAQ,QAAQ,IAAI;EACnD,MAAM,UAAUA,+CAAmB,QAAQ,cAAc;EAEzD,MAAM,kBAAkBW,yCAAa,QAAQ,OAAO;EACpD,MAAM,YAAY,iBACd,QAAQ,OAAO,eAAe,GAC9B;EAGJ,MAAM,KAAK,KAAK,eAAe,YAAY,GAAG;EAE9C,MAAM,EACJ,YACA,IAAI,UACJ,QACE,MAAM,KAAK,eAAe,QAC5B,QAAQ,OAAO,KAAK,EACpB,KACA,IACA,UACD;EAGD,MAAM,cAAc,IAAI,WACtB,SAAS,SACP,IAAI,SACJ,gBAAgB,SAChB,QAAQ,SACR,WAAW,OACd;EAED,IAAI,SAAS;AACb,cAAY,IAAI,UAAU,OAAO;AACjC,YAAU,SAAS;AAEnB,cAAY,IAAI,KAAK,OAAO;AAC5B,YAAU,IAAI;AAEd,cAAY,IAAI,IAAI,WAAW,gBAAgB,EAAE,OAAO;AACxD,YAAU,gBAAgB;AAE1B,cAAY,IAAI,SAAS,OAAO;AAChC,YAAU,QAAQ;AAElB,cAAY,IAAI,YAAY,OAAO;AAGnC,SAAOT,+CAAmB,YAAY;;CAGxC,MAAM,QACJ,eACA,gBACiB;EACjB,MAAM,UAAU,KAAK,OAAO,cAAc;EAI1C,MAAM,MAAMF,gDAHI,MAAM,KAAK,eAAe,EAAE,MAAM,QAAQ,MAAM,CAAC,EAG1B,IAAI;EAE3C,MAAM,UAAU,IAAI,aAAa;EACjC,MAAM,YAAY,iBACd,QAAQ,OAAO,eAAe,GAC9B;EAEJ,MAAM,YAAY,MAAM,KAAK,eAAe,QAC1C,QAAQ,YACR,KACA,QAAQ,IACR,QAAQ,KACR,UACD;AAED,SAAO,IAAI,aAAa,CAAC,OAAO,UAAU"}

package/lib/vault/vault.d.cts

@@ -0,0 +1,33 @@
+import { PaginationOptions } from "../common/interfaces/pagination-options.interface.cjs";
+import { List } from "../common/interfaces/list.interface.cjs";
+import { DataKey, DataKeyPair, KeyContext } from "./interfaces/key.interface.cjs";
+import { CreateDataKeyOptions } from "./interfaces/key/create-data-key.interface.cjs";
+import { DecryptDataKeyOptions } from "./interfaces/key/decrypt-data-key.interface.cjs";
+import { CreateObjectOptions } from "./interfaces/object/create-object.interface.cjs";
+import { DeleteObjectOptions } from "./interfaces/object/delete-object.interface.cjs";
+import { ObjectDigest, ObjectMetadata, ObjectVersion, VaultObject } from "./interfaces/object.interface.cjs";
+import { ReadObjectOptions } from "./interfaces/object/read-object.interface.cjs";
+import { UpdateObjectOptions } from "./interfaces/object/update-object.interface.cjs";
+import { WorkOS } from "../workos.cjs";
+
+//#region src/vault/vault.d.ts
+declare class Vault {
+  private readonly workos;
+  private cryptoProvider;
+  constructor(workos: WorkOS);
+  private decode;
+  createObject(options: CreateObjectOptions): Promise<ObjectMetadata>;
+  listObjects(options?: PaginationOptions | undefined): Promise<List<ObjectDigest>>;
+  listObjectVersions(options: ReadObjectOptions): Promise<ObjectVersion[]>;
+  readObject(options: ReadObjectOptions): Promise<VaultObject>;
+  describeObject(options: ReadObjectOptions): Promise<VaultObject>;
+  updateObject(options: UpdateObjectOptions): Promise<VaultObject>;
+  deleteObject(options: DeleteObjectOptions): Promise<void>;
+  createDataKey(options: CreateDataKeyOptions): Promise<DataKeyPair>;
+  decryptDataKey(options: DecryptDataKeyOptions): Promise<DataKey>;
+  encrypt(data: string, context: KeyContext, associatedData?: string): Promise<string>;
+  decrypt(encryptedData: string, associatedData?: string): Promise<string>;
+}
+//#endregion
+export { Vault };
+//# sourceMappingURL=vault.d.cts.map

package/lib/vault/vault.d.ts

@@ -0,0 +1,34 @@
+import { PaginationOptions } from "../common/interfaces/pagination-options.interface.js";
+import { List } from "../common/interfaces/list.interface.js";
+import "../index.worker.js";
+import { DataKey, DataKeyPair, KeyContext } from "./interfaces/key.interface.js";
+import { CreateDataKeyOptions } from "./interfaces/key/create-data-key.interface.js";
+import { DecryptDataKeyOptions } from "./interfaces/key/decrypt-data-key.interface.js";
+import { CreateObjectOptions } from "./interfaces/object/create-object.interface.js";
+import { DeleteObjectOptions } from "./interfaces/object/delete-object.interface.js";
+import { ObjectDigest, ObjectMetadata, ObjectVersion, VaultObject } from "./interfaces/object.interface.js";
+import { ReadObjectOptions } from "./interfaces/object/read-object.interface.js";
+import { UpdateObjectOptions } from "./interfaces/object/update-object.interface.js";
+import { WorkOS } from "../workos.js";
+
+//#region src/vault/vault.d.ts
+declare class Vault {
+  private readonly workos;
+  private cryptoProvider;
+  constructor(workos: WorkOS);
+  private decode;
+  createObject(options: CreateObjectOptions): Promise<ObjectMetadata>;
+  listObjects(options?: PaginationOptions | undefined): Promise<List<ObjectDigest>>;
+  listObjectVersions(options: ReadObjectOptions): Promise<ObjectVersion[]>;
+  readObject(options: ReadObjectOptions): Promise<VaultObject>;
+  describeObject(options: ReadObjectOptions): Promise<VaultObject>;
+  updateObject(options: UpdateObjectOptions): Promise<VaultObject>;
+  deleteObject(options: DeleteObjectOptions): Promise<void>;
+  createDataKey(options: CreateDataKeyOptions): Promise<DataKeyPair>;
+  decryptDataKey(options: DecryptDataKeyOptions): Promise<DataKey>;
+  encrypt(data: string, context: KeyContext, associatedData?: string): Promise<string>;
+  decrypt(encryptedData: string, associatedData?: string): Promise<string>;
+}
+//#endregion
+export { Vault };
+//# sourceMappingURL=vault.d.ts.map

package/lib/vault/vault.js

@@ -0,0 +1,97 @@
+import { decodeUInt32, encodeUInt32 } from "../common/utils/leb128.js";
+import { base64ToUint8Array, uint8ArrayToBase64 } from "../common/utils/base64.js";
+import { deserializeCreateDataKeyResponse, deserializeDecryptDataKeyResponse } from "./serializers/vault-key.serializer.js";
+import { deserializeListObjects, deserializeObject, deserializeObjectMetadata, desrializeListObjectVersions, serializeCreateObjectEntity, serializeUpdateObjectEntity } from "./serializers/vault-object.serializer.js";
+
+//#region src/vault/vault.ts
+var Vault = class {
+	cryptoProvider;
+	constructor(workos) {
+		this.workos = workos;
+		this.cryptoProvider = workos.getCryptoProvider();
+	}
+	decode(payload) {
+		const inputData = base64ToUint8Array(payload);
+		const iv = new Uint8Array(inputData.subarray(0, 12));
+		const tag = new Uint8Array(inputData.subarray(12, 28));
+		const { value: keyLen, nextIndex } = decodeUInt32(inputData, 28);
+		return {
+			iv,
+			tag,
+			keys: uint8ArrayToBase64(inputData.subarray(nextIndex, nextIndex + keyLen)),
+			ciphertext: new Uint8Array(inputData.subarray(nextIndex + keyLen))
+		};
+	}
+	async createObject(options) {
+		const { data } = await this.workos.post(`/vault/v1/kv`, serializeCreateObjectEntity(options));
+		return deserializeObjectMetadata(data);
+	}
+	async listObjects(options) {
+		const url = new URL("/vault/v1/kv", this.workos.baseURL);
+		if (options?.after) url.searchParams.set("after", options.after);
+		if (options?.limit) url.searchParams.set("limit", options.limit.toString());
+		const { data } = await this.workos.get(url.toString());
+		return deserializeListObjects(data);
+	}
+	async listObjectVersions(options) {
+		const { data } = await this.workos.get(`/vault/v1/kv/${encodeURIComponent(options.id)}/versions`);
+		return desrializeListObjectVersions(data);
+	}
+	async readObject(options) {
+		const { data } = await this.workos.get(`/vault/v1/kv/${encodeURIComponent(options.id)}`);
+		return deserializeObject(data);
+	}
+	async describeObject(options) {
+		const { data } = await this.workos.get(`/vault/v1/kv/${encodeURIComponent(options.id)}/metadata`);
+		return deserializeObject(data);
+	}
+	async updateObject(options) {
+		const { data } = await this.workos.put(`/vault/v1/kv/${encodeURIComponent(options.id)}`, serializeUpdateObjectEntity(options));
+		return deserializeObject(data);
+	}
+	async deleteObject(options) {
+		return this.workos.delete(`/vault/v1/kv/${encodeURIComponent(options.id)}`);
+	}
+	async createDataKey(options) {
+		const { data } = await this.workos.post(`/vault/v1/keys/data-key`, options);
+		return deserializeCreateDataKeyResponse(data);
+	}
+	async decryptDataKey(options) {
+		const { data } = await this.workos.post(`/vault/v1/keys/decrypt`, options);
+		return deserializeDecryptDataKeyResponse(data);
+	}
+	async encrypt(data, context, associatedData) {
+		const keyPair = await this.createDataKey({ context });
+		const encoder = new TextEncoder();
+		const key = base64ToUint8Array(keyPair.dataKey.key);
+		const keyBlob = base64ToUint8Array(keyPair.encryptedKeys);
+		const prefixLenBuffer = encodeUInt32(keyBlob.length);
+		const aadBuffer = associatedData ? encoder.encode(associatedData) : void 0;
+		const iv = this.cryptoProvider.randomBytes(12);
+		const { ciphertext, iv: resultIv, tag } = await this.cryptoProvider.encrypt(encoder.encode(data), key, iv, aadBuffer);
+		const resultArray = new Uint8Array(resultIv.length + tag.length + prefixLenBuffer.length + keyBlob.length + ciphertext.length);
+		let offset = 0;
+		resultArray.set(resultIv, offset);
+		offset += resultIv.length;
+		resultArray.set(tag, offset);
+		offset += tag.length;
+		resultArray.set(new Uint8Array(prefixLenBuffer), offset);
+		offset += prefixLenBuffer.length;
+		resultArray.set(keyBlob, offset);
+		offset += keyBlob.length;
+		resultArray.set(ciphertext, offset);
+		return uint8ArrayToBase64(resultArray);
+	}
+	async decrypt(encryptedData, associatedData) {
+		const decoded = this.decode(encryptedData);
+		const key = base64ToUint8Array((await this.decryptDataKey({ keys: decoded.keys })).key);
+		const encoder = new TextEncoder();
+		const aadBuffer = associatedData ? encoder.encode(associatedData) : void 0;
+		const decrypted = await this.cryptoProvider.decrypt(decoded.ciphertext, key, decoded.iv, decoded.tag, aadBuffer);
+		return new TextDecoder().decode(decrypted);
+	}
+};
+
+//#endregion
+export { Vault };
+//# sourceMappingURL=vault.js.map

package/lib/vault/vault.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"vault.js","names":["workos: WorkOS"],"sources":["../../src/vault/vault.ts"],"sourcesContent":["import { decodeUInt32, encodeUInt32 } from '../common/utils/leb128';\nimport { CryptoProvider } from '../common/crypto/crypto-provider';\nimport { List, ListResponse } from '../common/interfaces';\nimport { PaginationOptions } from '../index.worker';\nimport { base64ToUint8Array, uint8ArrayToBase64 } from '../common/utils/base64';\nimport type { WorkOS } from '../workos';\nimport {\n  CreateDataKeyOptions,\n  CreateDataKeyResponse,\n  CreateObjectOptions,\n  DataKey,\n  DataKeyPair,\n  DecryptDataKeyOptions,\n  DecryptDataKeyResponse,\n  DeleteObjectOptions,\n  KeyContext,\n  ListObjectVersionsResponse,\n  ObjectDigest,\n  ObjectDigestResponse,\n  ObjectMetadata,\n  ObjectVersion,\n  ReadObjectMetadataResponse,\n  ReadObjectOptions,\n  ReadObjectResponse,\n  UpdateObjectOptions,\n  VaultObject,\n} from './interfaces';\nimport {\n  deserializeCreateDataKeyResponse,\n  deserializeDecryptDataKeyResponse,\n} from './serializers/vault-key.serializer';\nimport {\n  deserializeListObjects,\n  deserializeObject,\n  deserializeObjectMetadata,\n  desrializeListObjectVersions,\n  serializeCreateObjectEntity,\n  serializeUpdateObjectEntity,\n} from './serializers/vault-object.serializer';\n\ninterface Decoded {\n  iv: Uint8Array;\n  tag: Uint8Array;\n  keys: string;\n  ciphertext: Uint8Array;\n}\n\nexport class Vault {\n  private cryptoProvider: CryptoProvider;\n\n  constructor(private readonly workos: WorkOS) {\n    this.cryptoProvider = workos.getCryptoProvider();\n  }\n\n  private decode(payload: string): Decoded {\n    const inputData = base64ToUint8Array(payload);\n    // Use 12 bytes for IV (standard for AES-GCM)\n    const iv = new Uint8Array(inputData.subarray(0, 12));\n    const tag = new Uint8Array(inputData.subarray(12, 28));\n    const { value: keyLen, nextIndex } = decodeUInt32(inputData, 28);\n\n    // Use subarray instead of slice and convert directly to base64\n    const keysBuffer = inputData.subarray(nextIndex, nextIndex + keyLen);\n    const keys = uint8ArrayToBase64(keysBuffer);\n\n    const ciphertext = new Uint8Array(inputData.subarray(nextIndex + keyLen));\n\n    return {\n      iv,\n      tag,\n      keys,\n      ciphertext,\n    };\n  }\n\n  async createObject(options: CreateObjectOptions): Promise<ObjectMetadata> {\n    const { data } = await this.workos.post<ReadObjectMetadataResponse>(\n      `/vault/v1/kv`,\n      serializeCreateObjectEntity(options),\n    );\n    return deserializeObjectMetadata(data);\n  }\n\n  async listObjects(\n    options?: PaginationOptions | undefined,\n  ): Promise<List<ObjectDigest>> {\n    const url = new URL('/vault/v1/kv', this.workos.baseURL);\n    if (options?.after) {\n      url.searchParams.set('after', options.after);\n    }\n    if (options?.limit) {\n      url.searchParams.set('limit', options.limit.toString());\n    }\n\n    const { data } = await this.workos.get<ListResponse<ObjectDigestResponse>>(\n      url.toString(),\n    );\n    return deserializeListObjects(data);\n  }\n\n  async listObjectVersions(\n    options: ReadObjectOptions,\n  ): Promise<ObjectVersion[]> {\n    const { data } = await this.workos.get<ListObjectVersionsResponse>(\n      `/vault/v1/kv/${encodeURIComponent(options.id)}/versions`,\n    );\n    return desrializeListObjectVersions(data);\n  }\n\n  async readObject(options: ReadObjectOptions): Promise<VaultObject> {\n    const { data } = await this.workos.get<ReadObjectResponse>(\n      `/vault/v1/kv/${encodeURIComponent(options.id)}`,\n    );\n    return deserializeObject(data);\n  }\n\n  async describeObject(options: ReadObjectOptions): Promise<VaultObject> {\n    const { data } = await this.workos.get<ReadObjectResponse>(\n      `/vault/v1/kv/${encodeURIComponent(options.id)}/metadata`,\n    );\n    return deserializeObject(data);\n  }\n\n  async updateObject(options: UpdateObjectOptions): Promise<VaultObject> {\n    const { data } = await this.workos.put<ReadObjectResponse>(\n      `/vault/v1/kv/${encodeURIComponent(options.id)}`,\n      serializeUpdateObjectEntity(options),\n    );\n    return deserializeObject(data);\n  }\n\n  async deleteObject(options: DeleteObjectOptions): Promise<void> {\n    return this.workos.delete(`/vault/v1/kv/${encodeURIComponent(options.id)}`);\n  }\n\n  async createDataKey(options: CreateDataKeyOptions): Promise<DataKeyPair> {\n    const { data } = await this.workos.post<CreateDataKeyResponse>(\n      `/vault/v1/keys/data-key`,\n      options,\n    );\n    return deserializeCreateDataKeyResponse(data);\n  }\n\n  async decryptDataKey(options: DecryptDataKeyOptions): Promise<DataKey> {\n    const { data } = await this.workos.post<DecryptDataKeyResponse>(\n      `/vault/v1/keys/decrypt`,\n      options,\n    );\n    return deserializeDecryptDataKeyResponse(data);\n  }\n\n  async encrypt(\n    data: string,\n    context: KeyContext,\n    associatedData?: string,\n  ): Promise<string> {\n    const keyPair = await this.createDataKey({\n      context,\n    });\n\n    // Convert base64 key to Uint8Array\n    const encoder = new TextEncoder();\n\n    // Use our cross-runtime base64 utility\n    const key = base64ToUint8Array(keyPair.dataKey.key);\n    const keyBlob = base64ToUint8Array(keyPair.encryptedKeys);\n\n    const prefixLenBuffer = encodeUInt32(keyBlob.length);\n    const aadBuffer = associatedData\n      ? encoder.encode(associatedData)\n      : undefined;\n\n    // Use a 12-byte IV for AES-GCM (industry standard)\n    const iv = this.cryptoProvider.randomBytes(12);\n\n    const {\n      ciphertext,\n      iv: resultIv,\n      tag,\n    } = await this.cryptoProvider.encrypt(\n      encoder.encode(data),\n      key,\n      iv,\n      aadBuffer,\n    );\n\n    // Concatenate all parts into a single array\n    const resultArray = new Uint8Array(\n      resultIv.length +\n        tag.length +\n        prefixLenBuffer.length +\n        keyBlob.length +\n        ciphertext.length,\n    );\n\n    let offset = 0;\n    resultArray.set(resultIv, offset);\n    offset += resultIv.length;\n\n    resultArray.set(tag, offset);\n    offset += tag.length;\n\n    resultArray.set(new Uint8Array(prefixLenBuffer), offset);\n    offset += prefixLenBuffer.length;\n\n    resultArray.set(keyBlob, offset);\n    offset += keyBlob.length;\n\n    resultArray.set(ciphertext, offset);\n\n    // Convert to base64 using our cross-runtime utility\n    return uint8ArrayToBase64(resultArray);\n  }\n\n  async decrypt(\n    encryptedData: string,\n    associatedData?: string,\n  ): Promise<string> {\n    const decoded = this.decode(encryptedData);\n    const dataKey = await this.decryptDataKey({ keys: decoded.keys });\n\n    // Convert base64 key to Uint8Array using our cross-runtime utility\n    const key = base64ToUint8Array(dataKey.key);\n\n    const encoder = new TextEncoder();\n    const aadBuffer = associatedData\n      ? encoder.encode(associatedData)\n      : undefined;\n\n    const decrypted = await this.cryptoProvider.decrypt(\n      decoded.ciphertext,\n      key,\n      decoded.iv,\n      decoded.tag,\n      aadBuffer,\n    );\n\n    return new TextDecoder().decode(decrypted);\n  }\n}\n"],"mappings":";;;;;;AA+CA,IAAa,QAAb,MAAmB;CACjB,AAAQ;CAER,YAAY,AAAiBA,QAAgB;EAAhB;AAC3B,OAAK,iBAAiB,OAAO,mBAAmB;;CAGlD,AAAQ,OAAO,SAA0B;EACvC,MAAM,YAAY,mBAAmB,QAAQ;EAE7C,MAAM,KAAK,IAAI,WAAW,UAAU,SAAS,GAAG,GAAG,CAAC;EACpD,MAAM,MAAM,IAAI,WAAW,UAAU,SAAS,IAAI,GAAG,CAAC;EACtD,MAAM,EAAE,OAAO,QAAQ,cAAc,aAAa,WAAW,GAAG;AAQhE,SAAO;GACL;GACA;GACA,MAPW,mBADM,UAAU,SAAS,WAAW,YAAY,OAAO,CACzB;GAQzC,YANiB,IAAI,WAAW,UAAU,SAAS,YAAY,OAAO,CAAC;GAOxE;;CAGH,MAAM,aAAa,SAAuD;EACxE,MAAM,EAAE,SAAS,MAAM,KAAK,OAAO,KACjC,gBACA,4BAA4B,QAAQ,CACrC;AACD,SAAO,0BAA0B,KAAK;;CAGxC,MAAM,YACJ,SAC6B;EAC7B,MAAM,MAAM,IAAI,IAAI,gBAAgB,KAAK,OAAO,QAAQ;AACxD,MAAI,SAAS,MACX,KAAI,aAAa,IAAI,SAAS,QAAQ,MAAM;AAE9C,MAAI,SAAS,MACX,KAAI,aAAa,IAAI,SAAS,QAAQ,MAAM,UAAU,CAAC;EAGzD,MAAM,EAAE,SAAS,MAAM,KAAK,OAAO,IACjC,IAAI,UAAU,CACf;AACD,SAAO,uBAAuB,KAAK;;CAGrC,MAAM,mBACJ,SAC0B;EAC1B,MAAM,EAAE,SAAS,MAAM,KAAK,OAAO,IACjC,gBAAgB,mBAAmB,QAAQ,GAAG,CAAC,WAChD;AACD,SAAO,6BAA6B,KAAK;;CAG3C,MAAM,WAAW,SAAkD;EACjE,MAAM,EAAE,SAAS,MAAM,KAAK,OAAO,IACjC,gBAAgB,mBAAmB,QAAQ,GAAG,GAC/C;AACD,SAAO,kBAAkB,KAAK;;CAGhC,MAAM,eAAe,SAAkD;EACrE,MAAM,EAAE,SAAS,MAAM,KAAK,OAAO,IACjC,gBAAgB,mBAAmB,QAAQ,GAAG,CAAC,WAChD;AACD,SAAO,kBAAkB,KAAK;;CAGhC,MAAM,aAAa,SAAoD;EACrE,MAAM,EAAE,SAAS,MAAM,KAAK,OAAO,IACjC,gBAAgB,mBAAmB,QAAQ,GAAG,IAC9C,4BAA4B,QAAQ,CACrC;AACD,SAAO,kBAAkB,KAAK;;CAGhC,MAAM,aAAa,SAA6C;AAC9D,SAAO,KAAK,OAAO,OAAO,gBAAgB,mBAAmB,QAAQ,GAAG,GAAG;;CAG7E,MAAM,cAAc,SAAqD;EACvE,MAAM,EAAE,SAAS,MAAM,KAAK,OAAO,KACjC,2BACA,QACD;AACD,SAAO,iCAAiC,KAAK;;CAG/C,MAAM,eAAe,SAAkD;EACrE,MAAM,EAAE,SAAS,MAAM,KAAK,OAAO,KACjC,0BACA,QACD;AACD,SAAO,kCAAkC,KAAK;;CAGhD,MAAM,QACJ,MACA,SACA,gBACiB;EACjB,MAAM,UAAU,MAAM,KAAK,cAAc,EACvC,SACD,CAAC;EAGF,MAAM,UAAU,IAAI,aAAa;EAGjC,MAAM,MAAM,mBAAmB,QAAQ,QAAQ,IAAI;EACnD,MAAM,UAAU,mBAAmB,QAAQ,cAAc;EAEzD,MAAM,kBAAkB,aAAa,QAAQ,OAAO;EACpD,MAAM,YAAY,iBACd,QAAQ,OAAO,eAAe,GAC9B;EAGJ,MAAM,KAAK,KAAK,eAAe,YAAY,GAAG;EAE9C,MAAM,EACJ,YACA,IAAI,UACJ,QACE,MAAM,KAAK,eAAe,QAC5B,QAAQ,OAAO,KAAK,EACpB,KACA,IACA,UACD;EAGD,MAAM,cAAc,IAAI,WACtB,SAAS,SACP,IAAI,SACJ,gBAAgB,SAChB,QAAQ,SACR,WAAW,OACd;EAED,IAAI,SAAS;AACb,cAAY,IAAI,UAAU,OAAO;AACjC,YAAU,SAAS;AAEnB,cAAY,IAAI,KAAK,OAAO;AAC5B,YAAU,IAAI;AAEd,cAAY,IAAI,IAAI,WAAW,gBAAgB,EAAE,OAAO;AACxD,YAAU,gBAAgB;AAE1B,cAAY,IAAI,SAAS,OAAO;AAChC,YAAU,QAAQ;AAElB,cAAY,IAAI,YAAY,OAAO;AAGnC,SAAO,mBAAmB,YAAY;;CAGxC,MAAM,QACJ,eACA,gBACiB;EACjB,MAAM,UAAU,KAAK,OAAO,cAAc;EAI1C,MAAM,MAAM,oBAHI,MAAM,KAAK,eAAe,EAAE,MAAM,QAAQ,MAAM,CAAC,EAG1B,IAAI;EAE3C,MAAM,UAAU,IAAI,aAAa;EACjC,MAAM,YAAY,iBACd,QAAQ,OAAO,eAAe,GAC9B;EAEJ,MAAM,YAAY,MAAM,KAAK,eAAe,QAC1C,QAAQ,YACR,KACA,QAAQ,IACR,QAAQ,KACR,UACD;AAED,SAAO,IAAI,aAAa,CAAC,OAAO,UAAU"}

package/lib/webhooks/webhooks.cjs

@@ -0,0 +1,33 @@
+const require_common_crypto_signature_provider = require('../common/crypto/signature-provider.cjs');
+const require_common_serializers_event_serializer = require('../common/serializers/event.serializer.cjs');
+
+//#region src/webhooks/webhooks.ts
+var Webhooks = class {
+	signatureProvider;
+	constructor(cryptoProvider) {
+		this.signatureProvider = new require_common_crypto_signature_provider.SignatureProvider(cryptoProvider);
+	}
+	get verifyHeader() {
+		return this.signatureProvider.verifyHeader.bind(this.signatureProvider);
+	}
+	get computeSignature() {
+		return this.signatureProvider.computeSignature.bind(this.signatureProvider);
+	}
+	get getTimestampAndSignatureHash() {
+		return this.signatureProvider.getTimestampAndSignatureHash.bind(this.signatureProvider);
+	}
+	async constructEvent({ payload, sigHeader, secret, tolerance = 18e4 }) {
+		const options = {
+			payload,
+			sigHeader,
+			secret,
+			tolerance
+		};
+		await this.verifyHeader(options);
+		return require_common_serializers_event_serializer.deserializeEvent(payload);
+	}
+};
+
+//#endregion
+exports.Webhooks = Webhooks;
+//# sourceMappingURL=webhooks.cjs.map

package/lib/webhooks/webhooks.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhooks.cjs","names":["SignatureProvider","deserializeEvent"],"sources":["../../src/webhooks/webhooks.ts"],"sourcesContent":["import { deserializeEvent } from '../common/serializers';\nimport { Event, EventResponse } from '../common/interfaces';\nimport { SignatureProvider } from '../common/crypto/signature-provider';\nimport { CryptoProvider } from '../common/crypto/crypto-provider';\n\nexport class Webhooks {\n  private signatureProvider: SignatureProvider;\n\n  constructor(cryptoProvider: CryptoProvider) {\n    this.signatureProvider = new SignatureProvider(cryptoProvider);\n  }\n\n  get verifyHeader() {\n    return this.signatureProvider.verifyHeader.bind(this.signatureProvider);\n  }\n\n  get computeSignature() {\n    return this.signatureProvider.computeSignature.bind(this.signatureProvider);\n  }\n\n  get getTimestampAndSignatureHash() {\n    return this.signatureProvider.getTimestampAndSignatureHash.bind(\n      this.signatureProvider,\n    );\n  }\n\n  async constructEvent({\n    payload,\n    sigHeader,\n    secret,\n    tolerance = 180000,\n  }: {\n    payload: Record<string, unknown>;\n    sigHeader: string;\n    secret: string;\n    tolerance?: number;\n  }): Promise<Event> {\n    const options = { payload, sigHeader, secret, tolerance };\n    await this.verifyHeader(options);\n\n    const webhookPayload = payload as unknown as EventResponse;\n\n    return deserializeEvent(webhookPayload);\n  }\n}\n"],"mappings":";;;;AAKA,IAAa,WAAb,MAAsB;CACpB,AAAQ;CAER,YAAY,gBAAgC;AAC1C,OAAK,oBAAoB,IAAIA,2DAAkB,eAAe;;CAGhE,IAAI,eAAe;AACjB,SAAO,KAAK,kBAAkB,aAAa,KAAK,KAAK,kBAAkB;;CAGzE,IAAI,mBAAmB;AACrB,SAAO,KAAK,kBAAkB,iBAAiB,KAAK,KAAK,kBAAkB;;CAG7E,IAAI,+BAA+B;AACjC,SAAO,KAAK,kBAAkB,6BAA6B,KACzD,KAAK,kBACN;;CAGH,MAAM,eAAe,EACnB,SACA,WACA,QACA,YAAY,QAMK;EACjB,MAAM,UAAU;GAAE;GAAS;GAAW;GAAQ;GAAW;AACzD,QAAM,KAAK,aAAa,QAAQ;AAIhC,SAAOC,6DAFgB,QAEgB"}

package/lib/webhooks/webhooks.d.cts

@@ -0,0 +1,35 @@
+import { CryptoProvider } from "../common/crypto/crypto-provider.cjs";
+import { Event } from "../common/interfaces/event.interface.cjs";
+
+//#region src/webhooks/webhooks.d.ts
+declare class Webhooks {
+  private signatureProvider;
+  constructor(cryptoProvider: CryptoProvider);
+  get verifyHeader(): ({
+    payload,
+    sigHeader,
+    secret,
+    tolerance
+  }: {
+    payload: any;
+    sigHeader: string;
+    secret: string;
+    tolerance?: number;
+  }) => Promise<boolean>;
+  get computeSignature(): (timestamp: any, payload: any, secret: string) => Promise<string>;
+  get getTimestampAndSignatureHash(): (sigHeader: string) => [string, string];
+  constructEvent({
+    payload,
+    sigHeader,
+    secret,
+    tolerance
+  }: {
+    payload: Record<string, unknown>;
+    sigHeader: string;
+    secret: string;
+    tolerance?: number;
+  }): Promise<Event>;
+}
+//#endregion
+export { Webhooks };
+//# sourceMappingURL=webhooks.d.cts.map

package/lib/webhooks/webhooks.d.ts

@@ -0,0 +1,35 @@
+import { CryptoProvider } from "../common/crypto/crypto-provider.js";
+import { Event } from "../common/interfaces/event.interface.js";
+
+//#region src/webhooks/webhooks.d.ts
+declare class Webhooks {
+  private signatureProvider;
+  constructor(cryptoProvider: CryptoProvider);
+  get verifyHeader(): ({
+    payload,
+    sigHeader,
+    secret,
+    tolerance
+  }: {
+    payload: any;
+    sigHeader: string;
+    secret: string;
+    tolerance?: number;
+  }) => Promise<boolean>;
+  get computeSignature(): (timestamp: any, payload: any, secret: string) => Promise<string>;
+  get getTimestampAndSignatureHash(): (sigHeader: string) => [string, string];
+  constructEvent({
+    payload,
+    sigHeader,
+    secret,
+    tolerance
+  }: {
+    payload: Record<string, unknown>;
+    sigHeader: string;
+    secret: string;
+    tolerance?: number;
+  }): Promise<Event>;
+}
+//#endregion
+export { Webhooks };
+//# sourceMappingURL=webhooks.d.ts.map

package/lib/webhooks/webhooks.js

@@ -0,0 +1,33 @@
+import { SignatureProvider } from "../common/crypto/signature-provider.js";
+import { deserializeEvent } from "../common/serializers/event.serializer.js";
+
+//#region src/webhooks/webhooks.ts
+var Webhooks = class {
+	signatureProvider;
+	constructor(cryptoProvider) {
+		this.signatureProvider = new SignatureProvider(cryptoProvider);
+	}
+	get verifyHeader() {
+		return this.signatureProvider.verifyHeader.bind(this.signatureProvider);
+	}
+	get computeSignature() {
+		return this.signatureProvider.computeSignature.bind(this.signatureProvider);
+	}
+	get getTimestampAndSignatureHash() {
+		return this.signatureProvider.getTimestampAndSignatureHash.bind(this.signatureProvider);
+	}
+	async constructEvent({ payload, sigHeader, secret, tolerance = 18e4 }) {
+		const options = {
+			payload,
+			sigHeader,
+			secret,
+			tolerance
+		};
+		await this.verifyHeader(options);
+		return deserializeEvent(payload);
+	}
+};
+
+//#endregion
+export { Webhooks };
+//# sourceMappingURL=webhooks.js.map

package/lib/webhooks/webhooks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhooks.js","names":[],"sources":["../../src/webhooks/webhooks.ts"],"sourcesContent":["import { deserializeEvent } from '../common/serializers';\nimport { Event, EventResponse } from '../common/interfaces';\nimport { SignatureProvider } from '../common/crypto/signature-provider';\nimport { CryptoProvider } from '../common/crypto/crypto-provider';\n\nexport class Webhooks {\n  private signatureProvider: SignatureProvider;\n\n  constructor(cryptoProvider: CryptoProvider) {\n    this.signatureProvider = new SignatureProvider(cryptoProvider);\n  }\n\n  get verifyHeader() {\n    return this.signatureProvider.verifyHeader.bind(this.signatureProvider);\n  }\n\n  get computeSignature() {\n    return this.signatureProvider.computeSignature.bind(this.signatureProvider);\n  }\n\n  get getTimestampAndSignatureHash() {\n    return this.signatureProvider.getTimestampAndSignatureHash.bind(\n      this.signatureProvider,\n    );\n  }\n\n  async constructEvent({\n    payload,\n    sigHeader,\n    secret,\n    tolerance = 180000,\n  }: {\n    payload: Record<string, unknown>;\n    sigHeader: string;\n    secret: string;\n    tolerance?: number;\n  }): Promise<Event> {\n    const options = { payload, sigHeader, secret, tolerance };\n    await this.verifyHeader(options);\n\n    const webhookPayload = payload as unknown as EventResponse;\n\n    return deserializeEvent(webhookPayload);\n  }\n}\n"],"mappings":";;;;AAKA,IAAa,WAAb,MAAsB;CACpB,AAAQ;CAER,YAAY,gBAAgC;AAC1C,OAAK,oBAAoB,IAAI,kBAAkB,eAAe;;CAGhE,IAAI,eAAe;AACjB,SAAO,KAAK,kBAAkB,aAAa,KAAK,KAAK,kBAAkB;;CAGzE,IAAI,mBAAmB;AACrB,SAAO,KAAK,kBAAkB,iBAAiB,KAAK,KAAK,kBAAkB;;CAG7E,IAAI,+BAA+B;AACjC,SAAO,KAAK,kBAAkB,6BAA6B,KACzD,KAAK,kBACN;;CAGH,MAAM,eAAe,EACnB,SACA,WACA,QACA,YAAY,QAMK;EACjB,MAAM,UAAU;GAAE;GAAS;GAAW;GAAQ;GAAW;AACzD,QAAM,KAAK,aAAa,QAAQ;AAIhC,SAAO,iBAFgB,QAEgB"}

package/lib/widgets/interfaces/get-token.cjs

@@ -0,0 +1,13 @@
+
+//#region src/widgets/interfaces/get-token.ts
+const serializeGetTokenOptions = (options) => ({
+	organization_id: options.organizationId,
+	user_id: options.userId,
+	scopes: options.scopes
+});
+const deserializeGetTokenResponse = (data) => ({ token: data.token });
+
+//#endregion
+exports.deserializeGetTokenResponse = deserializeGetTokenResponse;
+exports.serializeGetTokenOptions = serializeGetTokenOptions;
+//# sourceMappingURL=get-token.cjs.map

package/lib/widgets/interfaces/get-token.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"get-token.cjs","names":[],"sources":["../../../src/widgets/interfaces/get-token.ts"],"sourcesContent":["export type WidgetScope =\n  | 'widgets:users-table:manage'\n  | 'widgets:sso:manage'\n  | 'widgets:domain-verification:manage'\n  | 'widgets:api-keys:manage';\nexport interface GetTokenOptions {\n  organizationId: string;\n  userId?: string;\n  scopes?: WidgetScope[];\n}\n\nexport interface SerializedGetTokenOptions {\n  organization_id: string;\n  user_id?: string;\n  scopes?: WidgetScope[];\n}\n\nexport const serializeGetTokenOptions = (\n  options: GetTokenOptions,\n): SerializedGetTokenOptions => ({\n  organization_id: options.organizationId,\n  user_id: options.userId,\n  scopes: options.scopes,\n});\n\nexport interface GetTokenResponse {\n  token: string;\n}\n\nexport interface GetTokenResponseResponse {\n  token: string;\n}\n\nexport const deserializeGetTokenResponse = (\n  data: GetTokenResponseResponse,\n): GetTokenResponse => ({\n  token: data.token,\n});\n"],"mappings":";;AAiBA,MAAa,4BACX,aAC+B;CAC/B,iBAAiB,QAAQ;CACzB,SAAS,QAAQ;CACjB,QAAQ,QAAQ;CACjB;AAUD,MAAa,+BACX,UACsB,EACtB,OAAO,KAAK,OACb"}

package/lib/widgets/interfaces/get-token.d.cts

@@ -0,0 +1,23 @@
+//#region src/widgets/interfaces/get-token.d.ts
+type WidgetScope = 'widgets:users-table:manage' | 'widgets:sso:manage' | 'widgets:domain-verification:manage' | 'widgets:api-keys:manage';
+interface GetTokenOptions {
+  organizationId: string;
+  userId?: string;
+  scopes?: WidgetScope[];
+}
+interface SerializedGetTokenOptions {
+  organization_id: string;
+  user_id?: string;
+  scopes?: WidgetScope[];
+}
+declare const serializeGetTokenOptions: (options: GetTokenOptions) => SerializedGetTokenOptions;
+interface GetTokenResponse {
+  token: string;
+}
+interface GetTokenResponseResponse {
+  token: string;
+}
+declare const deserializeGetTokenResponse: (data: GetTokenResponseResponse) => GetTokenResponse;
+//#endregion
+export { GetTokenOptions, GetTokenResponse, GetTokenResponseResponse, SerializedGetTokenOptions, WidgetScope, deserializeGetTokenResponse, serializeGetTokenOptions };
+//# sourceMappingURL=get-token.d.cts.map

package/lib/widgets/interfaces/get-token.d.ts

@@ -0,0 +1,23 @@
+//#region src/widgets/interfaces/get-token.d.ts
+type WidgetScope = 'widgets:users-table:manage' | 'widgets:sso:manage' | 'widgets:domain-verification:manage' | 'widgets:api-keys:manage';
+interface GetTokenOptions {
+  organizationId: string;
+  userId?: string;
+  scopes?: WidgetScope[];
+}
+interface SerializedGetTokenOptions {
+  organization_id: string;
+  user_id?: string;
+  scopes?: WidgetScope[];
+}
+declare const serializeGetTokenOptions: (options: GetTokenOptions) => SerializedGetTokenOptions;
+interface GetTokenResponse {
+  token: string;
+}
+interface GetTokenResponseResponse {
+  token: string;
+}
+declare const deserializeGetTokenResponse: (data: GetTokenResponseResponse) => GetTokenResponse;
+//#endregion
+export { GetTokenOptions, GetTokenResponse, GetTokenResponseResponse, SerializedGetTokenOptions, WidgetScope, deserializeGetTokenResponse, serializeGetTokenOptions };
+//# sourceMappingURL=get-token.d.ts.map

package/lib/widgets/interfaces/get-token.js

@@ -0,0 +1,11 @@
+//#region src/widgets/interfaces/get-token.ts
+const serializeGetTokenOptions = (options) => ({
+	organization_id: options.organizationId,
+	user_id: options.userId,
+	scopes: options.scopes
+});
+const deserializeGetTokenResponse = (data) => ({ token: data.token });
+
+//#endregion
+export { deserializeGetTokenResponse, serializeGetTokenOptions };
+//# sourceMappingURL=get-token.js.map

package/lib/widgets/interfaces/get-token.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"get-token.js","names":[],"sources":["../../../src/widgets/interfaces/get-token.ts"],"sourcesContent":["export type WidgetScope =\n  | 'widgets:users-table:manage'\n  | 'widgets:sso:manage'\n  | 'widgets:domain-verification:manage'\n  | 'widgets:api-keys:manage';\nexport interface GetTokenOptions {\n  organizationId: string;\n  userId?: string;\n  scopes?: WidgetScope[];\n}\n\nexport interface SerializedGetTokenOptions {\n  organization_id: string;\n  user_id?: string;\n  scopes?: WidgetScope[];\n}\n\nexport const serializeGetTokenOptions = (\n  options: GetTokenOptions,\n): SerializedGetTokenOptions => ({\n  organization_id: options.organizationId,\n  user_id: options.userId,\n  scopes: options.scopes,\n});\n\nexport interface GetTokenResponse {\n  token: string;\n}\n\nexport interface GetTokenResponseResponse {\n  token: string;\n}\n\nexport const deserializeGetTokenResponse = (\n  data: GetTokenResponseResponse,\n): GetTokenResponse => ({\n  token: data.token,\n});\n"],"mappings":";AAiBA,MAAa,4BACX,aAC+B;CAC/B,iBAAiB,QAAQ;CACzB,SAAS,QAAQ;CACjB,QAAQ,QAAQ;CACjB;AAUD,MAAa,+BACX,UACsB,EACtB,OAAO,KAAK,OACb"}

package/lib/widgets/widgets.cjs

@@ -0,0 +1,16 @@
+const require_widgets_interfaces_get_token = require('./interfaces/get-token.cjs');
+
+//#region src/widgets/widgets.ts
+var Widgets = class {
+	constructor(workos) {
+		this.workos = workos;
+	}
+	async getToken(payload) {
+		const { data } = await this.workos.post("/widgets/token", require_widgets_interfaces_get_token.serializeGetTokenOptions(payload));
+		return require_widgets_interfaces_get_token.deserializeGetTokenResponse(data).token;
+	}
+};
+
+//#endregion
+exports.Widgets = Widgets;
+//# sourceMappingURL=widgets.cjs.map

package/lib/widgets/widgets.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"widgets.cjs","names":["workos: WorkOS","serializeGetTokenOptions","deserializeGetTokenResponse"],"sources":["../../src/widgets/widgets.ts"],"sourcesContent":["import { WorkOS } from '../workos';\nimport {\n  deserializeGetTokenResponse,\n  GetTokenOptions,\n  GetTokenResponseResponse,\n  SerializedGetTokenOptions,\n  serializeGetTokenOptions,\n} from './interfaces/get-token';\n\nexport class Widgets {\n  constructor(private readonly workos: WorkOS) {}\n\n  async getToken(payload: GetTokenOptions): Promise<string> {\n    const { data } = await this.workos.post<\n      GetTokenResponseResponse,\n      SerializedGetTokenOptions\n    >('/widgets/token', serializeGetTokenOptions(payload));\n\n    return deserializeGetTokenResponse(data).token;\n  }\n}\n"],"mappings":";;;AASA,IAAa,UAAb,MAAqB;CACnB,YAAY,AAAiBA,QAAgB;EAAhB;;CAE7B,MAAM,SAAS,SAA2C;EACxD,MAAM,EAAE,SAAS,MAAM,KAAK,OAAO,KAGjC,kBAAkBC,8DAAyB,QAAQ,CAAC;AAEtD,SAAOC,iEAA4B,KAAK,CAAC"}

package/lib/widgets/widgets.d.cts

@@ -0,0 +1,12 @@
+import { GetTokenOptions } from "./interfaces/get-token.cjs";
+import { WorkOS } from "../workos.cjs";
+
+//#region src/widgets/widgets.d.ts
+declare class Widgets {
+  private readonly workos;
+  constructor(workos: WorkOS);
+  getToken(payload: GetTokenOptions): Promise<string>;
+}
+//#endregion
+export { Widgets };
+//# sourceMappingURL=widgets.d.cts.map

package/lib/widgets/widgets.d.ts

@@ -0,0 +1,12 @@
+import { GetTokenOptions } from "./interfaces/get-token.js";
+import { WorkOS } from "../workos.js";
+
+//#region src/widgets/widgets.d.ts
+declare class Widgets {
+  private readonly workos;
+  constructor(workos: WorkOS);
+  getToken(payload: GetTokenOptions): Promise<string>;
+}
+//#endregion
+export { Widgets };
+//# sourceMappingURL=widgets.d.ts.map

package/lib/widgets/widgets.js

@@ -0,0 +1,16 @@
+import { deserializeGetTokenResponse, serializeGetTokenOptions } from "./interfaces/get-token.js";
+
+//#region src/widgets/widgets.ts
+var Widgets = class {
+	constructor(workos) {
+		this.workos = workos;
+	}
+	async getToken(payload) {
+		const { data } = await this.workos.post("/widgets/token", serializeGetTokenOptions(payload));
+		return deserializeGetTokenResponse(data).token;
+	}
+};
+
+//#endregion
+export { Widgets };
+//# sourceMappingURL=widgets.js.map

package/lib/widgets/widgets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"widgets.js","names":["workos: WorkOS"],"sources":["../../src/widgets/widgets.ts"],"sourcesContent":["import { WorkOS } from '../workos';\nimport {\n  deserializeGetTokenResponse,\n  GetTokenOptions,\n  GetTokenResponseResponse,\n  SerializedGetTokenOptions,\n  serializeGetTokenOptions,\n} from './interfaces/get-token';\n\nexport class Widgets {\n  constructor(private readonly workos: WorkOS) {}\n\n  async getToken(payload: GetTokenOptions): Promise<string> {\n    const { data } = await this.workos.post<\n      GetTokenResponseResponse,\n      SerializedGetTokenOptions\n    >('/widgets/token', serializeGetTokenOptions(payload));\n\n    return deserializeGetTokenResponse(data).token;\n  }\n}\n"],"mappings":";;;AASA,IAAa,UAAb,MAAqB;CACnB,YAAY,AAAiBA,QAAgB;EAAhB;;CAE7B,MAAM,SAAS,SAA2C;EACxD,MAAM,EAAE,SAAS,MAAM,KAAK,OAAO,KAGjC,kBAAkB,yBAAyB,QAAQ,CAAC;AAEtD,SAAO,4BAA4B,KAAK,CAAC"}