@workos-inc/node 8.0.0-rc.6 → 8.0.0-rc.8

package/lib/user-management/user-management.js

@@ -1,9 +1,10 @@
-import { getAuthorizationUrl, getJwksUrl, getLogoutUrl } from "../client/user-management.js";
+import { AutoPaginatable } from "../common/utils/pagination.js";
 import { serializeAuthenticateWithCodeOptions } from "./serializers/authenticate-with-code-options.serializer.js";
 import { serializeAuthenticateWithCodeAndVerifierOptions } from "./serializers/authenticate-with-code-and-verifier-options.serializer.js";
 import { serializeAuthenticateWithMagicAuthOptions } from "./serializers/authenticate-with-magic-auth-options.serializer.js";
 import { serializeAuthenticateWithPasswordOptions } from "./serializers/authenticate-with-password-options.serializer.js";
 import { serializeAuthenticateWithRefreshTokenOptions } from "./serializers/authenticate-with-refresh-token.options.serializer.js";
+import { serializeAuthenticateWithRefreshTokenPublicClientOptions } from "./serializers/authenticate-with-refresh-token-public-client-options.serializer.js";
 import { serializeAuthenticateWithTotpOptions } from "./serializers/authenticate-with-totp-options.serializer.js";
 import { deserializeUser } from "./serializers/user.serializer.js";
 import { deserializeAuthenticationResponse } from "./serializers/authentication-response.serializer.js";
@@ -21,9 +22,9 @@ import { deserializeSession } from "./serializers/session.serializer.js";
 import { serializeCreateUserOptions } from "./serializers/create-user-options.serializer.js";
 import { serializeUpdateUserOptions } from "./serializers/update-user-options.serializer.js";
 import { deserializeOrganizationMembership } from "./serializers/organization-membership.serializer.js";
-import { AutoPaginatable } from "../common/utils/pagination.js";
 import { fetchAndDeserialize } from "../common/utils/fetch-and-deserialize.js";
 import { deserializeFeatureFlag } from "../feature-flags/serializers/feature-flag.serializer.js";
+import { toQueryString } from "../common/utils/query-string.js";
 import { deserializeChallenge } from "../mfa/serializers/challenge.serializer.js";
 import { sealData, unsealData } from "../common/crypto/seal.js";
 import { getEnv } from "../common/utils/env.js";
@@ -50,6 +51,15 @@ var UserManagement = class {
 		const { clientId } = workos.options;
 		this.clientId = clientId;
 	}
+	/**
+	* Resolve clientId from method options or fall back to constructor-provided value.
+	* @throws TypeError if clientId is not available from either source
+	*/
+	resolveClientId(clientId) {
+		const resolved = clientId ?? this.clientId;
+		if (!resolved) throw new TypeError("clientId is required. Provide it in method options or when initializing WorkOS.");
+		return resolved;
+	}
 	async getJWKS() {
 		const { createRemoteJWKSet } = await getJose();
 		if (!this.clientId) return;
@@ -83,9 +93,11 @@ var UserManagement = class {
 		return deserializeUser(data);
 	}
 	async authenticateWithMagicAuth(payload) {
-		const { session, ...remainingPayload } = payload;
+		const { session, clientId, ...remainingPayload } = payload;
+		const resolvedClientId = this.resolveClientId(clientId);
 		const { data } = await this.workos.post("/user_management/authenticate", serializeAuthenticateWithMagicAuthOptions({
 			...remainingPayload,
+			clientId: resolvedClientId,
 			clientSecret: this.workos.key
 		}));
 		return this.prepareAuthenticationResponse({
@@ -94,9 +106,11 @@ var UserManagement = class {
 		});
 	}
 	async authenticateWithPassword(payload) {
-		const { session, ...remainingPayload } = payload;
+		const { session, clientId, ...remainingPayload } = payload;
+		const resolvedClientId = this.resolveClientId(clientId);
 		const { data } = await this.workos.post("/user_management/authenticate", serializeAuthenticateWithPasswordOptions({
 			...remainingPayload,
+			clientId: resolvedClientId,
 			clientSecret: this.workos.key
 		}));
 		return this.prepareAuthenticationResponse({
@@ -104,40 +118,86 @@ var UserManagement = class {
 			session
 		});
 	}
+	/**
+	* Exchange an authorization code for tokens.
+	*
+	* Auto-detects public vs confidential client mode:
+	* - If codeVerifier is provided: Uses PKCE flow (public client)
+	* - If no codeVerifier: Uses client_secret from API key (confidential client)
+	* - If both: Uses both client_secret AND codeVerifier (confidential client with PKCE)
+	*
+	* Using PKCE with confidential clients is recommended by OAuth 2.1 for defense
+	* in depth and provides additional CSRF protection on the authorization flow.
+	*
+	* @throws Error if neither codeVerifier nor API key is available
+	*/
 	async authenticateWithCode(payload) {
-		const { session, ...remainingPayload } = payload;
+		const { session, clientId, codeVerifier, ...remainingPayload } = payload;
+		const resolvedClientId = this.resolveClientId(clientId);
+		if (codeVerifier !== void 0 && codeVerifier.trim() === "") throw new TypeError("codeVerifier cannot be an empty string. Generate a valid PKCE pair using workos.pkce.generate().");
+		const hasApiKey = !!this.workos.key;
+		if (!!!codeVerifier && !hasApiKey) throw new TypeError("authenticateWithCode requires either a codeVerifier (for public clients) or an API key configured on the WorkOS instance (for confidential clients).");
 		const { data } = await this.workos.post("/user_management/authenticate", serializeAuthenticateWithCodeOptions({
 			...remainingPayload,
-			clientSecret: this.workos.key
-		}));
+			clientId: resolvedClientId,
+			codeVerifier,
+			clientSecret: hasApiKey ? this.workos.key : void 0
+		}), { skipApiKeyCheck: !hasApiKey });
 		return this.prepareAuthenticationResponse({
 			authenticationResponse: deserializeAuthenticationResponse(data),
 			session
 		});
 	}
+	/**
+	* Exchange an authorization code for tokens using PKCE (public client flow).
+	* Use this instead of authenticateWithCode() when the client cannot securely
+	* store a client_secret (browser, mobile, CLI, desktop apps).
+	*
+	* @param payload.clientId - Your WorkOS client ID
+	* @param payload.code - The authorization code from the OAuth callback
+	* @param payload.codeVerifier - The PKCE code verifier used to generate the code challenge
+	*/
 	async authenticateWithCodeAndVerifier(payload) {
-		const { session, ...remainingPayload } = payload;
-		const { data } = await this.workos.post("/user_management/authenticate", serializeAuthenticateWithCodeAndVerifierOptions(remainingPayload));
+		const { session, clientId, ...remainingPayload } = payload;
+		const resolvedClientId = this.resolveClientId(clientId);
+		const { data } = await this.workos.post("/user_management/authenticate", serializeAuthenticateWithCodeAndVerifierOptions({
+			...remainingPayload,
+			clientId: resolvedClientId
+		}), { skipApiKeyCheck: true });
 		return this.prepareAuthenticationResponse({
 			authenticationResponse: deserializeAuthenticationResponse(data),
 			session
 		});
 	}
+	/**
+	* Refresh an access token using a refresh token.
+	* Automatically detects public client mode - if no API key is configured,
+	* omits client_secret from the request.
+	*/
 	async authenticateWithRefreshToken(payload) {
-		const { session, ...remainingPayload } = payload;
-		const { data } = await this.workos.post("/user_management/authenticate", serializeAuthenticateWithRefreshTokenOptions({
+		const { session, clientId, ...remainingPayload } = payload;
+		const resolvedClientId = this.resolveClientId(clientId);
+		const isPublicClient = !this.workos.key;
+		const body = isPublicClient ? serializeAuthenticateWithRefreshTokenPublicClientOptions({
+			...remainingPayload,
+			clientId: resolvedClientId
+		}) : serializeAuthenticateWithRefreshTokenOptions({
 			...remainingPayload,
+			clientId: resolvedClientId,
 			clientSecret: this.workos.key
-		}));
+		});
+		const { data } = await this.workos.post("/user_management/authenticate", body, { skipApiKeyCheck: isPublicClient });
 		return this.prepareAuthenticationResponse({
 			authenticationResponse: deserializeAuthenticationResponse(data),
 			session
 		});
 	}
 	async authenticateWithTotp(payload) {
-		const { session, ...remainingPayload } = payload;
+		const { session, clientId, ...remainingPayload } = payload;
+		const resolvedClientId = this.resolveClientId(clientId);
 		const { data } = await this.workos.post("/user_management/authenticate", serializeAuthenticateWithTotpOptions({
 			...remainingPayload,
+			clientId: resolvedClientId,
 			clientSecret: this.workos.key
 		}));
 		return this.prepareAuthenticationResponse({
@@ -146,9 +206,11 @@ var UserManagement = class {
 		});
 	}
 	async authenticateWithEmailVerification(payload) {
-		const { session, ...remainingPayload } = payload;
+		const { session, clientId, ...remainingPayload } = payload;
+		const resolvedClientId = this.resolveClientId(clientId);
 		const { data } = await this.workos.post("/user_management/authenticate", serializeAuthenticateWithEmailVerificationOptions({
 			...remainingPayload,
+			clientId: resolvedClientId,
 			clientSecret: this.workos.key
 		}));
 		return this.prepareAuthenticationResponse({
@@ -157,9 +219,11 @@ var UserManagement = class {
 		});
 	}
 	async authenticateWithOrganizationSelection(payload) {
-		const { session, ...remainingPayload } = payload;
+		const { session, clientId, ...remainingPayload } = payload;
+		const resolvedClientId = this.resolveClientId(clientId);
 		const { data } = await this.workos.post("/user_management/authenticate", serializeAuthenticateWithOrganizationSelectionOptions({
 			...remainingPayload,
+			clientId: resolvedClientId,
 			clientSecret: this.workos.key
 		}));
 		return this.prepareAuthenticationResponse({
@@ -207,17 +271,21 @@ var UserManagement = class {
 			await jwtVerify(accessToken, jwks);
 			return true;
 		} catch (e) {
-			return false;
+			if (e instanceof Error && "code" in e && typeof e.code === "string" && (e.code.startsWith("ERR_JWT_") || e.code.startsWith("ERR_JWS_"))) return false;
+			throw e;
 		}
 	}
 	async prepareAuthenticationResponse({ authenticationResponse, session }) {
-		if (session?.sealSession) return {
-			...authenticationResponse,
-			sealedSession: await this.sealSessionDataFromAuthenticationResponse({
-				authenticationResponse,
-				cookiePassword: session.cookiePassword
-			})
-		};
+		if (session?.sealSession) {
+			if (!this.workos.key) throw new Error("Session sealing requires server-side usage with an API key. Public clients should store tokens directly (e.g., secure storage on mobile, keychain on desktop).");
+			return {
+				...authenticationResponse,
+				sealedSession: await this.sealSessionDataFromAuthenticationResponse({
+					authenticationResponse,
+					cookiePassword: session.cookiePassword
+				})
+			};
+		}
 		return authenticationResponse;
 	}
 	async sealSessionDataFromAuthenticationResponse({ authenticationResponse, cookiePassword }) {
@@ -356,20 +424,107 @@ var UserManagement = class {
 	async revokeSession(payload) {
 		await this.workos.post("/user_management/sessions/revoke", serializeRevokeSessionOptions(payload));
 	}
+	/**
+	* Generate an OAuth 2.0 authorization URL.
+	*
+	* For public clients (browser, mobile, CLI), include PKCE parameters:
+	* - Generate PKCE using workos.pkce.generate()
+	* - Pass codeChallenge and codeChallengeMethod here
+	* - Store codeVerifier and pass to authenticateWithCode() later
+	*
+	* Or use getAuthorizationUrlWithPKCE() which handles PKCE automatically.
+	*/
 	getAuthorizationUrl(options) {
-		return getAuthorizationUrl({
-			...options,
-			baseURL: this.workos.baseURL
+		const { connectionId, codeChallenge, codeChallengeMethod, clientId, domainHint, loginHint, organizationId, provider, providerQueryParams, providerScopes, prompt, redirectUri, state, screenHint } = options;
+		const resolvedClientId = this.resolveClientId(clientId);
+		if (!provider && !connectionId && !organizationId) throw new TypeError(`Incomplete arguments. Need to specify either a 'connectionId', 'organizationId', or 'provider'.`);
+		if (provider !== "authkit" && screenHint) throw new TypeError(`'screenHint' is only supported for 'authkit' provider`);
+		const query = toQueryString({
+			connection_id: connectionId,
+			code_challenge: codeChallenge,
+			code_challenge_method: codeChallengeMethod,
+			organization_id: organizationId,
+			domain_hint: domainHint,
+			login_hint: loginHint,
+			provider,
+			provider_query_params: providerQueryParams,
+			provider_scopes: providerScopes,
+			prompt,
+			client_id: resolvedClientId,
+			redirect_uri: redirectUri,
+			response_type: "code",
+			state,
+			screen_hint: screenHint
 		});
+		return `${this.workos.baseURL}/user_management/authorize?${query}`;
 	}
-	getLogoutUrl(options) {
-		return getLogoutUrl({
-			...options,
-			baseURL: this.workos.baseURL
+	/**
+	* Generate an OAuth 2.0 authorization URL with automatic PKCE.
+	*
+	* This method generates PKCE parameters internally and returns them along with
+	* the authorization URL. Use this for public clients (CLI apps, Electron, mobile)
+	* that cannot securely store a client secret.
+	*
+	* @returns Object containing url, state, and codeVerifier
+	*
+	* @example
+	* ```typescript
+	* const { url, state, codeVerifier } = await workos.userManagement.getAuthorizationUrlWithPKCE({
+	*   provider: 'authkit',
+	*   clientId: 'client_123',
+	*   redirectUri: 'myapp://callback',
+	* });
+	*
+	* // Store state and codeVerifier securely, then redirect user to url
+	* // After callback, exchange the code:
+	* const response = await workos.userManagement.authenticateWithCode({
+	*   code: authorizationCode,
+	*   codeVerifier,
+	*   clientId: 'client_123',
+	* });
+	* ```
+	*/
+	async getAuthorizationUrlWithPKCE(options) {
+		const { clientId, connectionId, domainHint, loginHint, organizationId, provider, providerQueryParams, providerScopes, prompt, redirectUri, screenHint } = options;
+		const resolvedClientId = this.resolveClientId(clientId);
+		if (!provider && !connectionId && !organizationId) throw new TypeError(`Incomplete arguments. Need to specify either a 'connectionId', 'organizationId', or 'provider'.`);
+		if (provider !== "authkit" && screenHint) throw new TypeError(`'screenHint' is only supported for 'authkit' provider`);
+		const pkce = await this.workos.pkce.generate();
+		const state = this.workos.pkce.generateCodeVerifier(43);
+		const query = toQueryString({
+			connection_id: connectionId,
+			code_challenge: pkce.codeChallenge,
+			code_challenge_method: "S256",
+			organization_id: organizationId,
+			domain_hint: domainHint,
+			login_hint: loginHint,
+			provider,
+			provider_query_params: providerQueryParams,
+			provider_scopes: providerScopes,
+			prompt,
+			client_id: resolvedClientId,
+			redirect_uri: redirectUri,
+			response_type: "code",
+			state,
+			screen_hint: screenHint
 		});
+		return {
+			url: `${this.workos.baseURL}/user_management/authorize?${query}`,
+			state,
+			codeVerifier: pkce.codeVerifier
+		};
+	}
+	getLogoutUrl(options) {
+		const { sessionId, returnTo } = options;
+		if (!sessionId) throw new TypeError(`Incomplete arguments. Need to specify 'sessionId'.`);
+		const url = new URL("/user_management/sessions/logout", this.workos.baseURL);
+		url.searchParams.set("session_id", sessionId);
+		if (returnTo) url.searchParams.set("return_to", returnTo);
+		return url.toString();
 	}
 	getJwksUrl(clientId) {
-		return getJwksUrl(clientId, this.workos.baseURL);
+		if (!clientId) throw new TypeError("clientId must be a valid clientId");
+		return `${this.workos.baseURL}/sso/jwks/${clientId}`;
 	}
 };
 

package/lib/user-management/user-management.js.map

@@ -1 +1 @@
-{"version":3,"file":"user-management.js","names":["workos: WorkOS","clientUserManagement.getAuthorizationUrl","clientUserManagement.getLogoutUrl","clientUserManagement.getJwksUrl"],"sources":["../../src/user-management/user-management.ts"],"sourcesContent":["import { sealData, unsealData } from '../common/crypto/seal';\nimport * as clientUserManagement from '../client/user-management';\nimport { PaginationOptions } from '../common/interfaces/pagination-options.interface';\nimport { fetchAndDeserialize } from '../common/utils/fetch-and-deserialize';\nimport { AutoPaginatable } from '../common/utils/pagination';\nimport { getEnv } from '../common/utils/env';\nimport { Challenge, ChallengeResponse } from '../mfa/interfaces';\nimport { deserializeChallenge } from '../mfa/serializers';\nimport {\n  FeatureFlag,\n  FeatureFlagResponse,\n} from '../feature-flags/interfaces/feature-flag.interface';\nimport { deserializeFeatureFlag } from '../feature-flags/serializers/feature-flag.serializer';\nimport { WorkOS } from '../workos';\nimport {\n  AuthenticateWithCodeAndVerifierOptions,\n  AuthenticateWithCodeOptions,\n  AuthenticateWithMagicAuthOptions,\n  AuthenticateWithPasswordOptions,\n  AuthenticateWithRefreshTokenOptions,\n  AuthenticateWithSessionOptions,\n  AuthenticateWithTotpOptions,\n  AuthenticationResponse,\n  AuthenticationResponseResponse,\n  CreateMagicAuthOptions,\n  CreatePasswordResetOptions,\n  CreateUserOptions,\n  EmailVerification,\n  EmailVerificationResponse,\n  EnrollAuthFactorOptions,\n  ListAuthFactorsOptions,\n  ListSessionsOptions,\n  ListUsersOptions,\n  ListUserFeatureFlagsOptions,\n  MagicAuth,\n  MagicAuthResponse,\n  PasswordReset,\n  PasswordResetResponse,\n  ResetPasswordOptions,\n  SendVerificationEmailOptions,\n  SerializedAuthenticateWithCodeAndVerifierOptions,\n  SerializedAuthenticateWithCodeOptions,\n  SerializedAuthenticateWithMagicAuthOptions,\n  SerializedAuthenticateWithPasswordOptions,\n  SerializedAuthenticateWithRefreshTokenOptions,\n  SerializedAuthenticateWithTotpOptions,\n  SerializedCreateMagicAuthOptions,\n  SerializedCreatePasswordResetOptions,\n  SerializedCreateUserOptions,\n  SerializedListSessionsOptions,\n  SerializedListUsersOptions,\n  SerializedResetPasswordOptions,\n  SerializedVerifyEmailOptions,\n  Session,\n  SessionResponse,\n  UpdateUserOptions,\n  User,\n  UserResponse,\n  VerifyEmailOptions,\n} from './interfaces';\nimport {\n  AuthenticateWithEmailVerificationOptions,\n  SerializedAuthenticateWithEmailVerificationOptions,\n} from './interfaces/authenticate-with-email-verification-options.interface';\nimport {\n  AuthenticateWithOrganizationSelectionOptions,\n  SerializedAuthenticateWithOrganizationSelectionOptions,\n} from './interfaces/authenticate-with-organization-selection.interface';\nimport {\n  AccessToken,\n  AuthenticateWithSessionCookieFailedResponse,\n  AuthenticateWithSessionCookieFailureReason,\n  AuthenticateWithSessionCookieOptions,\n  AuthenticateWithSessionCookieSuccessResponse,\n  SessionCookieData,\n} from './interfaces/authenticate-with-session-cookie.interface';\nimport { UserManagementAuthorizationURLOptions } from './interfaces/authorization-url-options.interface';\nimport {\n  CreateOrganizationMembershipOptions,\n  SerializedCreateOrganizationMembershipOptions,\n} from './interfaces/create-organization-membership-options.interface';\nimport {\n  Factor,\n  FactorResponse,\n  FactorWithSecrets,\n  FactorWithSecretsResponse,\n} from './interfaces/factor.interface';\nimport { Identity, IdentityResponse } from './interfaces/identity.interface';\nimport {\n  Invitation,\n  InvitationResponse,\n} from './interfaces/invitation.interface';\nimport {\n  ListInvitationsOptions,\n  SerializedListInvitationsOptions,\n} from './interfaces/list-invitations-options.interface';\nimport {\n  ListOrganizationMembershipsOptions,\n  SerializedListOrganizationMembershipsOptions,\n} from './interfaces/list-organization-memberships-options.interface';\nimport {\n  OrganizationMembership,\n  OrganizationMembershipResponse,\n} from './interfaces/organization-membership.interface';\nimport {\n  RevokeSessionOptions,\n  SerializedRevokeSessionOptions,\n  serializeRevokeSessionOptions,\n} from './interfaces/revoke-session-options.interface';\nimport {\n  SendInvitationOptions,\n  SerializedSendInvitationOptions,\n} from './interfaces/send-invitation-options.interface';\nimport { SessionHandlerOptions } from './interfaces/session-handler-options.interface';\nimport {\n  SerializedUpdateOrganizationMembershipOptions,\n  UpdateOrganizationMembershipOptions,\n} from './interfaces/update-organization-membership-options.interface';\nimport {\n  deserializeAuthenticationResponse,\n  deserializeEmailVerification,\n  deserializeFactorWithSecrets,\n  deserializeMagicAuth,\n  deserializePasswordReset,\n  deserializeSession,\n  deserializeUser,\n  serializeAuthenticateWithCodeAndVerifierOptions,\n  serializeAuthenticateWithCodeOptions,\n  serializeAuthenticateWithMagicAuthOptions,\n  serializeAuthenticateWithPasswordOptions,\n  serializeAuthenticateWithRefreshTokenOptions,\n  serializeAuthenticateWithTotpOptions,\n  serializeCreateMagicAuthOptions,\n  serializeCreatePasswordResetOptions,\n  serializeCreateUserOptions,\n  serializeEnrollAuthFactorOptions,\n  serializeListSessionsOptions,\n  serializeResetPasswordOptions,\n  serializeUpdateUserOptions,\n} from './serializers';\nimport { serializeAuthenticateWithEmailVerificationOptions } from './serializers/authenticate-with-email-verification.serializer';\nimport { serializeAuthenticateWithOrganizationSelectionOptions } from './serializers/authenticate-with-organization-selection-options.serializer';\nimport { serializeCreateOrganizationMembershipOptions } from './serializers/create-organization-membership-options.serializer';\nimport { deserializeFactor } from './serializers/factor.serializer';\nimport { deserializeIdentities } from './serializers/identity.serializer';\nimport { deserializeInvitation } from './serializers/invitation.serializer';\nimport { serializeListInvitationsOptions } from './serializers/list-invitations-options.serializer';\nimport { serializeListOrganizationMembershipsOptions } from './serializers/list-organization-memberships-options.serializer';\nimport { serializeListUsersOptions } from './serializers/list-users-options.serializer';\nimport { deserializeOrganizationMembership } from './serializers/organization-membership.serializer';\nimport { serializeSendInvitationOptions } from './serializers/send-invitation-options.serializer';\nimport { serializeUpdateOrganizationMembershipOptions } from './serializers/update-organization-membership-options.serializer';\nimport { CookieSession } from './session';\nimport { getJose } from '../utils/jose';\n\nexport class UserManagement {\n  private _jwks:\n    | ReturnType<typeof import('jose').createRemoteJWKSet>\n    | undefined;\n  public clientId: string | undefined;\n\n  constructor(private readonly workos: WorkOS) {\n    const { clientId } = workos.options;\n\n    this.clientId = clientId;\n  }\n\n  async getJWKS(): Promise<\n    ReturnType<typeof import('jose').createRemoteJWKSet> | undefined\n  > {\n    const { createRemoteJWKSet } = await getJose();\n    if (!this.clientId) {\n      return;\n    }\n\n    // Set the JWKS URL. This is used to verify if the JWT is still valid\n    this._jwks ??= createRemoteJWKSet(new URL(this.getJwksUrl(this.clientId)), {\n      cooldownDuration: 1000 * 60 * 5,\n    });\n\n    return this._jwks;\n  }\n\n  /**\n   * Loads a sealed session using the provided session data and cookie password.\n   *\n   * @param options - The options for loading the sealed session.\n   * @param options.sessionData - The sealed session data.\n   * @param options.cookiePassword - The password used to encrypt the session data.\n   * @returns The session class.\n   */\n  loadSealedSession(options: {\n    sessionData: string;\n    cookiePassword: string;\n  }): CookieSession {\n    return new CookieSession(this, options.sessionData, options.cookiePassword);\n  }\n\n  async getUser(userId: string): Promise<User> {\n    const { data } = await this.workos.get<UserResponse>(\n      `/user_management/users/${userId}`,\n    );\n\n    return deserializeUser(data);\n  }\n\n  async getUserByExternalId(externalId: string): Promise<User> {\n    const { data } = await this.workos.get<UserResponse>(\n      `/user_management/users/external_id/${externalId}`,\n    );\n\n    return deserializeUser(data);\n  }\n\n  async listUsers(\n    options?: ListUsersOptions,\n  ): Promise<AutoPaginatable<User, SerializedListUsersOptions>> {\n    return new AutoPaginatable(\n      await fetchAndDeserialize<UserResponse, User>(\n        this.workos,\n        '/user_management/users',\n        deserializeUser,\n        options ? serializeListUsersOptions(options) : undefined,\n      ),\n      (params) =>\n        fetchAndDeserialize<UserResponse, User>(\n          this.workos,\n          '/user_management/users',\n          deserializeUser,\n          params,\n        ),\n      options ? serializeListUsersOptions(options) : undefined,\n    );\n  }\n\n  async createUser(payload: CreateUserOptions): Promise<User> {\n    const { data } = await this.workos.post<\n      UserResponse,\n      SerializedCreateUserOptions\n    >('/user_management/users', serializeCreateUserOptions(payload));\n\n    return deserializeUser(data);\n  }\n\n  async authenticateWithMagicAuth(\n    payload: AuthenticateWithMagicAuthOptions,\n  ): Promise<AuthenticationResponse> {\n    const { session, ...remainingPayload } = payload;\n\n    const { data } = await this.workos.post<\n      AuthenticationResponseResponse,\n      SerializedAuthenticateWithMagicAuthOptions\n    >(\n      '/user_management/authenticate',\n      serializeAuthenticateWithMagicAuthOptions({\n        ...remainingPayload,\n        clientSecret: this.workos.key,\n      }),\n    );\n\n    return this.prepareAuthenticationResponse({\n      authenticationResponse: deserializeAuthenticationResponse(data),\n      session,\n    });\n  }\n\n  async authenticateWithPassword(\n    payload: AuthenticateWithPasswordOptions,\n  ): Promise<AuthenticationResponse> {\n    const { session, ...remainingPayload } = payload;\n\n    const { data } = await this.workos.post<\n      AuthenticationResponseResponse,\n      SerializedAuthenticateWithPasswordOptions\n    >(\n      '/user_management/authenticate',\n      serializeAuthenticateWithPasswordOptions({\n        ...remainingPayload,\n        clientSecret: this.workos.key,\n      }),\n    );\n\n    return this.prepareAuthenticationResponse({\n      authenticationResponse: deserializeAuthenticationResponse(data),\n      session,\n    });\n  }\n\n  async authenticateWithCode(\n    payload: AuthenticateWithCodeOptions,\n  ): Promise<AuthenticationResponse> {\n    const { session, ...remainingPayload } = payload;\n\n    const { data } = await this.workos.post<\n      AuthenticationResponseResponse,\n      SerializedAuthenticateWithCodeOptions\n    >(\n      '/user_management/authenticate',\n      serializeAuthenticateWithCodeOptions({\n        ...remainingPayload,\n        clientSecret: this.workos.key,\n      }),\n    );\n\n    return this.prepareAuthenticationResponse({\n      authenticationResponse: deserializeAuthenticationResponse(data),\n      session,\n    });\n  }\n\n  async authenticateWithCodeAndVerifier(\n    payload: AuthenticateWithCodeAndVerifierOptions,\n  ): Promise<AuthenticationResponse> {\n    const { session, ...remainingPayload } = payload;\n\n    const { data } = await this.workos.post<\n      AuthenticationResponseResponse,\n      SerializedAuthenticateWithCodeAndVerifierOptions\n    >(\n      '/user_management/authenticate',\n      serializeAuthenticateWithCodeAndVerifierOptions(remainingPayload),\n    );\n\n    return this.prepareAuthenticationResponse({\n      authenticationResponse: deserializeAuthenticationResponse(data),\n      session,\n    });\n  }\n\n  async authenticateWithRefreshToken(\n    payload: AuthenticateWithRefreshTokenOptions,\n  ): Promise<AuthenticationResponse> {\n    const { session, ...remainingPayload } = payload;\n\n    const { data } = await this.workos.post<\n      AuthenticationResponseResponse,\n      SerializedAuthenticateWithRefreshTokenOptions\n    >(\n      '/user_management/authenticate',\n      serializeAuthenticateWithRefreshTokenOptions({\n        ...remainingPayload,\n        clientSecret: this.workos.key,\n      }),\n    );\n\n    return this.prepareAuthenticationResponse({\n      authenticationResponse: deserializeAuthenticationResponse(data),\n      session,\n    });\n  }\n\n  async authenticateWithTotp(\n    payload: AuthenticateWithTotpOptions,\n  ): Promise<AuthenticationResponse> {\n    const { session, ...remainingPayload } = payload;\n\n    const { data } = await this.workos.post<\n      AuthenticationResponseResponse,\n      SerializedAuthenticateWithTotpOptions\n    >(\n      '/user_management/authenticate',\n      serializeAuthenticateWithTotpOptions({\n        ...remainingPayload,\n        clientSecret: this.workos.key,\n      }),\n    );\n\n    return this.prepareAuthenticationResponse({\n      authenticationResponse: deserializeAuthenticationResponse(data),\n      session,\n    });\n  }\n\n  async authenticateWithEmailVerification(\n    payload: AuthenticateWithEmailVerificationOptions,\n  ): Promise<AuthenticationResponse> {\n    const { session, ...remainingPayload } = payload;\n\n    const { data } = await this.workos.post<\n      AuthenticationResponseResponse,\n      SerializedAuthenticateWithEmailVerificationOptions\n    >(\n      '/user_management/authenticate',\n      serializeAuthenticateWithEmailVerificationOptions({\n        ...remainingPayload,\n        clientSecret: this.workos.key,\n      }),\n    );\n\n    return this.prepareAuthenticationResponse({\n      authenticationResponse: deserializeAuthenticationResponse(data),\n      session,\n    });\n  }\n\n  async authenticateWithOrganizationSelection(\n    payload: AuthenticateWithOrganizationSelectionOptions,\n  ): Promise<AuthenticationResponse> {\n    const { session, ...remainingPayload } = payload;\n\n    const { data } = await this.workos.post<\n      AuthenticationResponseResponse,\n      SerializedAuthenticateWithOrganizationSelectionOptions\n    >(\n      '/user_management/authenticate',\n      serializeAuthenticateWithOrganizationSelectionOptions({\n        ...remainingPayload,\n        clientSecret: this.workos.key,\n      }),\n    );\n\n    return this.prepareAuthenticationResponse({\n      authenticationResponse: deserializeAuthenticationResponse(data),\n      session,\n    });\n  }\n\n  async authenticateWithSessionCookie({\n    sessionData,\n    cookiePassword = getEnv('WORKOS_COOKIE_PASSWORD'),\n  }: AuthenticateWithSessionCookieOptions): Promise<\n    | AuthenticateWithSessionCookieSuccessResponse\n    | AuthenticateWithSessionCookieFailedResponse\n  > {\n    if (!cookiePassword) {\n      throw new Error('Cookie password is required');\n    }\n\n    const jwks = await this.getJWKS();\n\n    if (!jwks) {\n      throw new Error('Must provide clientId to initialize JWKS');\n    }\n\n    const { decodeJwt } = await getJose();\n\n    if (!sessionData) {\n      return {\n        authenticated: false,\n        reason:\n          AuthenticateWithSessionCookieFailureReason.NO_SESSION_COOKIE_PROVIDED,\n      };\n    }\n\n    const session = await unsealData<SessionCookieData>(sessionData, {\n      password: cookiePassword,\n    });\n\n    if (!session.accessToken) {\n      return {\n        authenticated: false,\n        reason:\n          AuthenticateWithSessionCookieFailureReason.INVALID_SESSION_COOKIE,\n      };\n    }\n\n    if (!(await this.isValidJwt(session.accessToken))) {\n      return {\n        authenticated: false,\n        reason: AuthenticateWithSessionCookieFailureReason.INVALID_JWT,\n      };\n    }\n\n    const {\n      sid: sessionId,\n      org_id: organizationId,\n      role,\n      roles,\n      permissions,\n      entitlements,\n      feature_flags: featureFlags,\n    } = decodeJwt<AccessToken>(session.accessToken);\n\n    return {\n      authenticated: true,\n      sessionId,\n      organizationId,\n      role,\n      roles,\n      user: session.user,\n      permissions,\n      entitlements,\n      featureFlags,\n      accessToken: session.accessToken,\n      authenticationMethod: session.authenticationMethod,\n    };\n  }\n\n  private async isValidJwt(accessToken: string): Promise<boolean> {\n    const jwks = await this.getJWKS();\n    const { jwtVerify } = await getJose();\n    if (!jwks) {\n      throw new Error('Must provide clientId to initialize JWKS');\n    }\n\n    try {\n      await jwtVerify(accessToken, jwks);\n      return true;\n    } catch (e) {\n      return false;\n    }\n  }\n\n  private async prepareAuthenticationResponse({\n    authenticationResponse,\n    session,\n  }: {\n    authenticationResponse: AuthenticationResponse;\n    session?: AuthenticateWithSessionOptions;\n  }): Promise<AuthenticationResponse> {\n    if (session?.sealSession) {\n      return {\n        ...authenticationResponse,\n        sealedSession: await this.sealSessionDataFromAuthenticationResponse({\n          authenticationResponse,\n          cookiePassword: session.cookiePassword,\n        }),\n      };\n    }\n\n    return authenticationResponse;\n  }\n\n  private async sealSessionDataFromAuthenticationResponse({\n    authenticationResponse,\n    cookiePassword,\n  }: {\n    authenticationResponse: AuthenticationResponse;\n    cookiePassword?: string;\n  }): Promise<string> {\n    if (!cookiePassword) {\n      throw new Error('Cookie password is required');\n    }\n\n    const { decodeJwt } = await getJose();\n\n    const { org_id: organizationIdFromAccessToken } = decodeJwt<AccessToken>(\n      authenticationResponse.accessToken,\n    );\n\n    const sessionData: SessionCookieData = {\n      organizationId: organizationIdFromAccessToken,\n      user: authenticationResponse.user,\n      accessToken: authenticationResponse.accessToken,\n      refreshToken: authenticationResponse.refreshToken,\n      authenticationMethod: authenticationResponse.authenticationMethod,\n      impersonator: authenticationResponse.impersonator,\n    };\n\n    return sealData(sessionData, {\n      password: cookiePassword,\n    });\n  }\n\n  async getSessionFromCookie({\n    sessionData,\n    cookiePassword = getEnv('WORKOS_COOKIE_PASSWORD'),\n  }: SessionHandlerOptions): Promise<SessionCookieData | undefined> {\n    if (!cookiePassword) {\n      throw new Error('Cookie password is required');\n    }\n\n    if (sessionData) {\n      return unsealData<SessionCookieData>(sessionData, {\n        password: cookiePassword,\n      });\n    }\n\n    return undefined;\n  }\n\n  async getEmailVerification(\n    emailVerificationId: string,\n  ): Promise<EmailVerification> {\n    const { data } = await this.workos.get<EmailVerificationResponse>(\n      `/user_management/email_verification/${emailVerificationId}`,\n    );\n\n    return deserializeEmailVerification(data);\n  }\n\n  async sendVerificationEmail({\n    userId,\n  }: SendVerificationEmailOptions): Promise<{ user: User }> {\n    const { data } = await this.workos.post<{ user: UserResponse }>(\n      `/user_management/users/${userId}/email_verification/send`,\n      {},\n    );\n\n    return { user: deserializeUser(data.user) };\n  }\n\n  async getMagicAuth(magicAuthId: string): Promise<MagicAuth> {\n    const { data } = await this.workos.get<MagicAuthResponse>(\n      `/user_management/magic_auth/${magicAuthId}`,\n    );\n\n    return deserializeMagicAuth(data);\n  }\n\n  async createMagicAuth(options: CreateMagicAuthOptions): Promise<MagicAuth> {\n    const { data } = await this.workos.post<\n      MagicAuthResponse,\n      SerializedCreateMagicAuthOptions\n    >(\n      '/user_management/magic_auth',\n      serializeCreateMagicAuthOptions({\n        ...options,\n      }),\n    );\n\n    return deserializeMagicAuth(data);\n  }\n\n  async verifyEmail({\n    code,\n    userId,\n  }: VerifyEmailOptions): Promise<{ user: User }> {\n    const { data } = await this.workos.post<\n      { user: UserResponse },\n      SerializedVerifyEmailOptions\n    >(`/user_management/users/${userId}/email_verification/confirm`, {\n      code,\n    });\n\n    return { user: deserializeUser(data.user) };\n  }\n\n  async getPasswordReset(passwordResetId: string): Promise<PasswordReset> {\n    const { data } = await this.workos.get<PasswordResetResponse>(\n      `/user_management/password_reset/${passwordResetId}`,\n    );\n\n    return deserializePasswordReset(data);\n  }\n\n  async createPasswordReset(\n    options: CreatePasswordResetOptions,\n  ): Promise<PasswordReset> {\n    const { data } = await this.workos.post<\n      PasswordResetResponse,\n      SerializedCreatePasswordResetOptions\n    >(\n      '/user_management/password_reset',\n      serializeCreatePasswordResetOptions({\n        ...options,\n      }),\n    );\n\n    return deserializePasswordReset(data);\n  }\n\n  async resetPassword(payload: ResetPasswordOptions): Promise<{ user: User }> {\n    const { data } = await this.workos.post<\n      { user: UserResponse },\n      SerializedResetPasswordOptions\n    >(\n      '/user_management/password_reset/confirm',\n      serializeResetPasswordOptions(payload),\n    );\n\n    return { user: deserializeUser(data.user) };\n  }\n\n  async updateUser(payload: UpdateUserOptions): Promise<User> {\n    const { data } = await this.workos.put<UserResponse>(\n      `/user_management/users/${payload.userId}`,\n      serializeUpdateUserOptions(payload),\n    );\n\n    return deserializeUser(data);\n  }\n\n  async enrollAuthFactor(payload: EnrollAuthFactorOptions): Promise<{\n    authenticationFactor: FactorWithSecrets;\n    authenticationChallenge: Challenge;\n  }> {\n    const { data } = await this.workos.post<{\n      authentication_factor: FactorWithSecretsResponse;\n      authentication_challenge: ChallengeResponse;\n    }>(\n      `/user_management/users/${payload.userId}/auth_factors`,\n      serializeEnrollAuthFactorOptions(payload),\n    );\n\n    return {\n      authenticationFactor: deserializeFactorWithSecrets(\n        data.authentication_factor,\n      ),\n      authenticationChallenge: deserializeChallenge(\n        data.authentication_challenge,\n      ),\n    };\n  }\n\n  async listAuthFactors(\n    options: ListAuthFactorsOptions,\n  ): Promise<AutoPaginatable<Factor, PaginationOptions>> {\n    const { userId, ...restOfOptions } = options;\n    return new AutoPaginatable(\n      await fetchAndDeserialize<FactorResponse, Factor>(\n        this.workos,\n        `/user_management/users/${userId}/auth_factors`,\n        deserializeFactor,\n        restOfOptions,\n      ),\n      (params) =>\n        fetchAndDeserialize<FactorResponse, Factor>(\n          this.workos,\n          `/user_management/users/${userId}/auth_factors`,\n          deserializeFactor,\n          params,\n        ),\n      restOfOptions,\n    );\n  }\n\n  async listUserFeatureFlags(\n    options: ListUserFeatureFlagsOptions,\n  ): Promise<AutoPaginatable<FeatureFlag>> {\n    const { userId, ...paginationOptions } = options;\n\n    return new AutoPaginatable(\n      await fetchAndDeserialize<FeatureFlagResponse, FeatureFlag>(\n        this.workos,\n        `/user_management/users/${userId}/feature-flags`,\n        deserializeFeatureFlag,\n        paginationOptions,\n      ),\n      (params) =>\n        fetchAndDeserialize<FeatureFlagResponse, FeatureFlag>(\n          this.workos,\n          `/user_management/users/${userId}/feature-flags`,\n          deserializeFeatureFlag,\n          params,\n        ),\n      paginationOptions,\n    );\n  }\n\n  async listSessions(\n    userId: string,\n    options?: ListSessionsOptions,\n  ): Promise<AutoPaginatable<Session, SerializedListSessionsOptions>> {\n    return new AutoPaginatable(\n      await fetchAndDeserialize<SessionResponse, Session>(\n        this.workos,\n        `/user_management/users/${userId}/sessions`,\n        deserializeSession,\n        options ? serializeListSessionsOptions(options) : undefined,\n      ),\n      (params) =>\n        fetchAndDeserialize<SessionResponse, Session>(\n          this.workos,\n          `/user_management/users/${userId}/sessions`,\n          deserializeSession,\n          params,\n        ),\n      options ? serializeListSessionsOptions(options) : undefined,\n    );\n  }\n\n  async deleteUser(userId: string) {\n    await this.workos.delete(`/user_management/users/${userId}`);\n  }\n\n  async getUserIdentities(userId: string): Promise<Identity[]> {\n    if (!userId) {\n      throw new TypeError(`Incomplete arguments. Need to specify 'userId'.`);\n    }\n\n    const { data } = await this.workos.get<IdentityResponse[]>(\n      `/user_management/users/${userId}/identities`,\n    );\n\n    return deserializeIdentities(data);\n  }\n\n  async getOrganizationMembership(\n    organizationMembershipId: string,\n  ): Promise<OrganizationMembership> {\n    const { data } = await this.workos.get<OrganizationMembershipResponse>(\n      `/user_management/organization_memberships/${organizationMembershipId}`,\n    );\n\n    return deserializeOrganizationMembership(data);\n  }\n\n  async listOrganizationMemberships(\n    options: ListOrganizationMembershipsOptions,\n  ): Promise<\n    AutoPaginatable<\n      OrganizationMembership,\n      SerializedListOrganizationMembershipsOptions\n    >\n  > {\n    const serializedOptions =\n      serializeListOrganizationMembershipsOptions(options);\n\n    return new AutoPaginatable(\n      await fetchAndDeserialize<\n        OrganizationMembershipResponse,\n        OrganizationMembership\n      >(\n        this.workos,\n        '/user_management/organization_memberships',\n        deserializeOrganizationMembership,\n        serializedOptions,\n      ),\n      (params) =>\n        fetchAndDeserialize<\n          OrganizationMembershipResponse,\n          OrganizationMembership\n        >(\n          this.workos,\n          '/user_management/organization_memberships',\n          deserializeOrganizationMembership,\n          params,\n        ),\n      serializedOptions,\n    );\n  }\n\n  async createOrganizationMembership(\n    options: CreateOrganizationMembershipOptions,\n  ): Promise<OrganizationMembership> {\n    const { data } = await this.workos.post<\n      OrganizationMembershipResponse,\n      SerializedCreateOrganizationMembershipOptions\n    >(\n      '/user_management/organization_memberships',\n      serializeCreateOrganizationMembershipOptions(options),\n    );\n\n    return deserializeOrganizationMembership(data);\n  }\n\n  async updateOrganizationMembership(\n    organizationMembershipId: string,\n    options: UpdateOrganizationMembershipOptions,\n  ): Promise<OrganizationMembership> {\n    const { data } = await this.workos.put<\n      OrganizationMembershipResponse,\n      SerializedUpdateOrganizationMembershipOptions\n    >(\n      `/user_management/organization_memberships/${organizationMembershipId}`,\n      serializeUpdateOrganizationMembershipOptions(options),\n    );\n\n    return deserializeOrganizationMembership(data);\n  }\n\n  async deleteOrganizationMembership(\n    organizationMembershipId: string,\n  ): Promise<void> {\n    await this.workos.delete(\n      `/user_management/organization_memberships/${organizationMembershipId}`,\n    );\n  }\n\n  async deactivateOrganizationMembership(\n    organizationMembershipId: string,\n  ): Promise<OrganizationMembership> {\n    const { data } = await this.workos.put<OrganizationMembershipResponse>(\n      `/user_management/organization_memberships/${organizationMembershipId}/deactivate`,\n      {},\n    );\n\n    return deserializeOrganizationMembership(data);\n  }\n\n  async reactivateOrganizationMembership(\n    organizationMembershipId: string,\n  ): Promise<OrganizationMembership> {\n    const { data } = await this.workos.put<OrganizationMembershipResponse>(\n      `/user_management/organization_memberships/${organizationMembershipId}/reactivate`,\n      {},\n    );\n\n    return deserializeOrganizationMembership(data);\n  }\n\n  async getInvitation(invitationId: string): Promise<Invitation> {\n    const { data } = await this.workos.get<InvitationResponse>(\n      `/user_management/invitations/${invitationId}`,\n    );\n\n    return deserializeInvitation(data);\n  }\n\n  async findInvitationByToken(invitationToken: string): Promise<Invitation> {\n    const { data } = await this.workos.get<InvitationResponse>(\n      `/user_management/invitations/by_token/${invitationToken}`,\n    );\n\n    return deserializeInvitation(data);\n  }\n\n  async listInvitations(\n    options: ListInvitationsOptions,\n  ): Promise<AutoPaginatable<Invitation, SerializedListInvitationsOptions>> {\n    return new AutoPaginatable(\n      await fetchAndDeserialize<InvitationResponse, Invitation>(\n        this.workos,\n        '/user_management/invitations',\n        deserializeInvitation,\n        options ? serializeListInvitationsOptions(options) : undefined,\n      ),\n      (params) =>\n        fetchAndDeserialize<InvitationResponse, Invitation>(\n          this.workos,\n          '/user_management/invitations',\n          deserializeInvitation,\n          params,\n        ),\n      options ? serializeListInvitationsOptions(options) : undefined,\n    );\n  }\n\n  async sendInvitation(payload: SendInvitationOptions): Promise<Invitation> {\n    const { data } = await this.workos.post<\n      InvitationResponse,\n      SerializedSendInvitationOptions\n    >(\n      '/user_management/invitations',\n      serializeSendInvitationOptions({\n        ...payload,\n      }),\n    );\n\n    return deserializeInvitation(data);\n  }\n\n  async acceptInvitation(invitationId: string): Promise<Invitation> {\n    const { data } = await this.workos.post<InvitationResponse, any>(\n      `/user_management/invitations/${invitationId}/accept`,\n      null,\n    );\n\n    return deserializeInvitation(data);\n  }\n\n  async revokeInvitation(invitationId: string): Promise<Invitation> {\n    const { data } = await this.workos.post<InvitationResponse, any>(\n      `/user_management/invitations/${invitationId}/revoke`,\n      null,\n    );\n\n    return deserializeInvitation(data);\n  }\n\n  async resendInvitation(invitationId: string): Promise<Invitation> {\n    const { data } = await this.workos.post<InvitationResponse, any>(\n      `/user_management/invitations/${invitationId}/resend`,\n      null,\n    );\n\n    return deserializeInvitation(data);\n  }\n\n  async revokeSession(payload: RevokeSessionOptions): Promise<void> {\n    await this.workos.post<void, SerializedRevokeSessionOptions>(\n      '/user_management/sessions/revoke',\n      serializeRevokeSessionOptions(payload),\n    );\n  }\n\n  getAuthorizationUrl(options: UserManagementAuthorizationURLOptions): string {\n    // Delegate to client implementation\n    return clientUserManagement.getAuthorizationUrl({\n      ...options,\n      baseURL: this.workos.baseURL,\n    });\n  }\n\n  getLogoutUrl(options: clientUserManagement.LogoutURLOptions): string {\n    // Delegate to client implementation\n    return clientUserManagement.getLogoutUrl({\n      ...options,\n      baseURL: this.workos.baseURL,\n    });\n  }\n\n  getJwksUrl(clientId: string): string {\n    // Delegate to client implementation\n    return clientUserManagement.getJwksUrl(clientId, this.workos.baseURL);\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA2JA,IAAa,iBAAb,MAA4B;CAC1B,AAAQ;CAGR,AAAO;CAEP,YAAY,AAAiBA,QAAgB;EAAhB;EAC3B,MAAM,EAAE,aAAa,OAAO;AAE5B,OAAK,WAAW;;CAGlB,MAAM,UAEJ;EACA,MAAM,EAAE,uBAAuB,MAAM,SAAS;AAC9C,MAAI,CAAC,KAAK,SACR;AAIF,OAAK,UAAU,mBAAmB,IAAI,IAAI,KAAK,WAAW,KAAK,SAAS,CAAC,EAAE,EACzE,kBAAkB,MAAO,KAAK,GAC/B,CAAC;AAEF,SAAO,KAAK;;;;;;;;;;CAWd,kBAAkB,SAGA;AAChB,SAAO,IAAI,cAAc,MAAM,QAAQ,aAAa,QAAQ,eAAe;;CAG7E,MAAM,QAAQ,QAA+B;EAC3C,MAAM,EAAE,SAAS,MAAM,KAAK,OAAO,IACjC,0BAA0B,SAC3B;AAED,SAAO,gBAAgB,KAAK;;CAG9B,MAAM,oBAAoB,YAAmC;EAC3D,MAAM,EAAE,SAAS,MAAM,KAAK,OAAO,IACjC,sCAAsC,aACvC;AAED,SAAO,gBAAgB,KAAK;;CAG9B,MAAM,UACJ,SAC4D;AAC5D,SAAO,IAAI,gBACT,MAAM,oBACJ,KAAK,QACL,0BACA,iBACA,UAAU,0BAA0B,QAAQ,GAAG,OAChD,GACA,WACC,oBACE,KAAK,QACL,0BACA,iBACA,OACD,EACH,UAAU,0BAA0B,QAAQ,GAAG,OAChD;;CAGH,MAAM,WAAW,SAA2C;EAC1D,MAAM,EAAE,SAAS,MAAM,KAAK,OAAO,KAGjC,0BAA0B,2BAA2B,QAAQ,CAAC;AAEhE,SAAO,gBAAgB,KAAK;;CAG9B,MAAM,0BACJ,SACiC;EACjC,MAAM,EAAE,SAAS,GAAG,qBAAqB;EAEzC,MAAM,EAAE,SAAS,MAAM,KAAK,OAAO,KAIjC,iCACA,0CAA0C;GACxC,GAAG;GACH,cAAc,KAAK,OAAO;GAC3B,CAAC,CACH;AAED,SAAO,KAAK,8BAA8B;GACxC,wBAAwB,kCAAkC,KAAK;GAC/D;GACD,CAAC;;CAGJ,MAAM,yBACJ,SACiC;EACjC,MAAM,EAAE,SAAS,GAAG,qBAAqB;EAEzC,MAAM,EAAE,SAAS,MAAM,KAAK,OAAO,KAIjC,iCACA,yCAAyC;GACvC,GAAG;GACH,cAAc,KAAK,OAAO;GAC3B,CAAC,CACH;AAED,SAAO,KAAK,8BAA8B;GACxC,wBAAwB,kCAAkC,KAAK;GAC/D;GACD,CAAC;;CAGJ,MAAM,qBACJ,SACiC;EACjC,MAAM,EAAE,SAAS,GAAG,qBAAqB;EAEzC,MAAM,EAAE,SAAS,MAAM,KAAK,OAAO,KAIjC,iCACA,qCAAqC;GACnC,GAAG;GACH,cAAc,KAAK,OAAO;GAC3B,CAAC,CACH;AAED,SAAO,KAAK,8BAA8B;GACxC,wBAAwB,kCAAkC,KAAK;GAC/D;GACD,CAAC;;CAGJ,MAAM,gCACJ,SACiC;EACjC,MAAM,EAAE,SAAS,GAAG,qBAAqB;EAEzC,MAAM,EAAE,SAAS,MAAM,KAAK,OAAO,KAIjC,iCACA,gDAAgD,iBAAiB,CAClE;AAED,SAAO,KAAK,8BAA8B;GACxC,wBAAwB,kCAAkC,KAAK;GAC/D;GACD,CAAC;;CAGJ,MAAM,6BACJ,SACiC;EACjC,MAAM,EAAE,SAAS,GAAG,qBAAqB;EAEzC,MAAM,EAAE,SAAS,MAAM,KAAK,OAAO,KAIjC,iCACA,6CAA6C;GAC3C,GAAG;GACH,cAAc,KAAK,OAAO;GAC3B,CAAC,CACH;AAED,SAAO,KAAK,8BAA8B;GACxC,wBAAwB,kCAAkC,KAAK;GAC/D;GACD,CAAC;;CAGJ,MAAM,qBACJ,SACiC;EACjC,MAAM,EAAE,SAAS,GAAG,qBAAqB;EAEzC,MAAM,EAAE,SAAS,MAAM,KAAK,OAAO,KAIjC,iCACA,qCAAqC;GACnC,GAAG;GACH,cAAc,KAAK,OAAO;GAC3B,CAAC,CACH;AAED,SAAO,KAAK,8BAA8B;GACxC,wBAAwB,kCAAkC,KAAK;GAC/D;GACD,CAAC;;CAGJ,MAAM,kCACJ,SACiC;EACjC,MAAM,EAAE,SAAS,GAAG,qBAAqB;EAEzC,MAAM,EAAE,SAAS,MAAM,KAAK,OAAO,KAIjC,iCACA,kDAAkD;GAChD,GAAG;GACH,cAAc,KAAK,OAAO;GAC3B,CAAC,CACH;AAED,SAAO,KAAK,8BAA8B;GACxC,wBAAwB,kCAAkC,KAAK;GAC/D;GACD,CAAC;;CAGJ,MAAM,sCACJ,SACiC;EACjC,MAAM,EAAE,SAAS,GAAG,qBAAqB;EAEzC,MAAM,EAAE,SAAS,MAAM,KAAK,OAAO,KAIjC,iCACA,sDAAsD;GACpD,GAAG;GACH,cAAc,KAAK,OAAO;GAC3B,CAAC,CACH;AAED,SAAO,KAAK,8BAA8B;GACxC,wBAAwB,kCAAkC,KAAK;GAC/D;GACD,CAAC;;CAGJ,MAAM,8BAA8B,EAClC,aACA,iBAAiB,OAAO,yBAAyB,IAIjD;AACA,MAAI,CAAC,eACH,OAAM,IAAI,MAAM,8BAA8B;AAKhD,MAAI,CAFS,MAAM,KAAK,SAAS,CAG/B,OAAM,IAAI,MAAM,2CAA2C;EAG7D,MAAM,EAAE,cAAc,MAAM,SAAS;AAErC,MAAI,CAAC,YACH,QAAO;GACL,eAAe;GACf,QACE,2CAA2C;GAC9C;EAGH,MAAM,UAAU,MAAM,WAA8B,aAAa,EAC/D,UAAU,gBACX,CAAC;AAEF,MAAI,CAAC,QAAQ,YACX,QAAO;GACL,eAAe;GACf,QACE,2CAA2C;GAC9C;AAGH,MAAI,CAAE,MAAM,KAAK,WAAW,QAAQ,YAAY,CAC9C,QAAO;GACL,eAAe;GACf,QAAQ,2CAA2C;GACpD;EAGH,MAAM,EACJ,KAAK,WACL,QAAQ,gBACR,MACA,OACA,aACA,cACA,eAAe,iBACb,UAAuB,QAAQ,YAAY;AAE/C,SAAO;GACL,eAAe;GACf;GACA;GACA;GACA;GACA,MAAM,QAAQ;GACd;GACA;GACA;GACA,aAAa,QAAQ;GACrB,sBAAsB,QAAQ;GAC/B;;CAGH,MAAc,WAAW,aAAuC;EAC9D,MAAM,OAAO,MAAM,KAAK,SAAS;EACjC,MAAM,EAAE,cAAc,MAAM,SAAS;AACrC,MAAI,CAAC,KACH,OAAM,IAAI,MAAM,2CAA2C;AAG7D,MAAI;AACF,SAAM,UAAU,aAAa,KAAK;AAClC,UAAO;WACA,GAAG;AACV,UAAO;;;CAIX,MAAc,8BAA8B,EAC1C,wBACA,WAIkC;AAClC,MAAI,SAAS,YACX,QAAO;GACL,GAAG;GACH,eAAe,MAAM,KAAK,0CAA0C;IAClE;IACA,gBAAgB,QAAQ;IACzB,CAAC;GACH;AAGH,SAAO;;CAGT,MAAc,0CAA0C,EACtD,wBACA,kBAIkB;AAClB,MAAI,CAAC,eACH,OAAM,IAAI,MAAM,8BAA8B;EAGhD,MAAM,EAAE,cAAc,MAAM,SAAS;EAErC,MAAM,EAAE,QAAQ,kCAAkC,UAChD,uBAAuB,YACxB;AAWD,SAAO,SATgC;GACrC,gBAAgB;GAChB,MAAM,uBAAuB;GAC7B,aAAa,uBAAuB;GACpC,cAAc,uBAAuB;GACrC,sBAAsB,uBAAuB;GAC7C,cAAc,uBAAuB;GACtC,EAE4B,EAC3B,UAAU,gBACX,CAAC;;CAGJ,MAAM,qBAAqB,EACzB,aACA,iBAAiB,OAAO,yBAAyB,IACe;AAChE,MAAI,CAAC,eACH,OAAM,IAAI,MAAM,8BAA8B;AAGhD,MAAI,YACF,QAAO,WAA8B,aAAa,EAChD,UAAU,gBACX,CAAC;;CAMN,MAAM,qBACJ,qBAC4B;EAC5B,MAAM,EAAE,SAAS,MAAM,KAAK,OAAO,IACjC,uCAAuC,sBACxC;AAED,SAAO,6BAA6B,KAAK;;CAG3C,MAAM,sBAAsB,EAC1B,UACwD;EACxD,MAAM,EAAE,SAAS,MAAM,KAAK,OAAO,KACjC,0BAA0B,OAAO,2BACjC,EAAE,CACH;AAED,SAAO,EAAE,MAAM,gBAAgB,KAAK,KAAK,EAAE;;CAG7C,MAAM,aAAa,aAAyC;EAC1D,MAAM,EAAE,SAAS,MAAM,KAAK,OAAO,IACjC,+BAA+B,cAChC;AAED,SAAO,qBAAqB,KAAK;;CAGnC,MAAM,gBAAgB,SAAqD;EACzE,MAAM,EAAE,SAAS,MAAM,KAAK,OAAO,KAIjC,+BACA,gCAAgC,EAC9B,GAAG,SACJ,CAAC,CACH;AAED,SAAO,qBAAqB,KAAK;;CAGnC,MAAM,YAAY,EAChB,MACA,UAC8C;EAC9C,MAAM,EAAE,SAAS,MAAM,KAAK,OAAO,KAGjC,0BAA0B,OAAO,8BAA8B,EAC/D,MACD,CAAC;AAEF,SAAO,EAAE,MAAM,gBAAgB,KAAK,KAAK,EAAE;;CAG7C,MAAM,iBAAiB,iBAAiD;EACtE,MAAM,EAAE,SAAS,MAAM,KAAK,OAAO,IACjC,mCAAmC,kBACpC;AAED,SAAO,yBAAyB,KAAK;;CAGvC,MAAM,oBACJ,SACwB;EACxB,MAAM,EAAE,SAAS,MAAM,KAAK,OAAO,KAIjC,mCACA,oCAAoC,EAClC,GAAG,SACJ,CAAC,CACH;AAED,SAAO,yBAAyB,KAAK;;CAGvC,MAAM,cAAc,SAAwD;EAC1E,MAAM,EAAE,SAAS,MAAM,KAAK,OAAO,KAIjC,2CACA,8BAA8B,QAAQ,CACvC;AAED,SAAO,EAAE,MAAM,gBAAgB,KAAK,KAAK,EAAE;;CAG7C,MAAM,WAAW,SAA2C;EAC1D,MAAM,EAAE,SAAS,MAAM,KAAK,OAAO,IACjC,0BAA0B,QAAQ,UAClC,2BAA2B,QAAQ,CACpC;AAED,SAAO,gBAAgB,KAAK;;CAG9B,MAAM,iBAAiB,SAGpB;EACD,MAAM,EAAE,SAAS,MAAM,KAAK,OAAO,KAIjC,0BAA0B,QAAQ,OAAO,gBACzC,iCAAiC,QAAQ,CAC1C;AAED,SAAO;GACL,sBAAsB,6BACpB,KAAK,sBACN;GACD,yBAAyB,qBACvB,KAAK,yBACN;GACF;;CAGH,MAAM,gBACJ,SACqD;EACrD,MAAM,EAAE,QAAQ,GAAG,kBAAkB;AACrC,SAAO,IAAI,gBACT,MAAM,oBACJ,KAAK,QACL,0BAA0B,OAAO,gBACjC,mBACA,cACD,GACA,WACC,oBACE,KAAK,QACL,0BAA0B,OAAO,gBACjC,mBACA,OACD,EACH,cACD;;CAGH,MAAM,qBACJ,SACuC;EACvC,MAAM,EAAE,QAAQ,GAAG,sBAAsB;AAEzC,SAAO,IAAI,gBACT,MAAM,oBACJ,KAAK,QACL,0BAA0B,OAAO,iBACjC,wBACA,kBACD,GACA,WACC,oBACE,KAAK,QACL,0BAA0B,OAAO,iBACjC,wBACA,OACD,EACH,kBACD;;CAGH,MAAM,aACJ,QACA,SACkE;AAClE,SAAO,IAAI,gBACT,MAAM,oBACJ,KAAK,QACL,0BAA0B,OAAO,YACjC,oBACA,UAAU,6BAA6B,QAAQ,GAAG,OACnD,GACA,WACC,oBACE,KAAK,QACL,0BAA0B,OAAO,YACjC,oBACA,OACD,EACH,UAAU,6BAA6B,QAAQ,GAAG,OACnD;;CAGH,MAAM,WAAW,QAAgB;AAC/B,QAAM,KAAK,OAAO,OAAO,0BAA0B,SAAS;;CAG9D,MAAM,kBAAkB,QAAqC;AAC3D,MAAI,CAAC,OACH,OAAM,IAAI,UAAU,kDAAkD;EAGxE,MAAM,EAAE,SAAS,MAAM,KAAK,OAAO,IACjC,0BAA0B,OAAO,aAClC;AAED,SAAO,sBAAsB,KAAK;;CAGpC,MAAM,0BACJ,0BACiC;EACjC,MAAM,EAAE,SAAS,MAAM,KAAK,OAAO,IACjC,6CAA6C,2BAC9C;AAED,SAAO,kCAAkC,KAAK;;CAGhD,MAAM,4BACJ,SAMA;EACA,MAAM,oBACJ,4CAA4C,QAAQ;AAEtD,SAAO,IAAI,gBACT,MAAM,oBAIJ,KAAK,QACL,6CACA,mCACA,kBACD,GACA,WACC,oBAIE,KAAK,QACL,6CACA,mCACA,OACD,EACH,kBACD;;CAGH,MAAM,6BACJ,SACiC;EACjC,MAAM,EAAE,SAAS,MAAM,KAAK,OAAO,KAIjC,6CACA,6CAA6C,QAAQ,CACtD;AAED,SAAO,kCAAkC,KAAK;;CAGhD,MAAM,6BACJ,0BACA,SACiC;EACjC,MAAM,EAAE,SAAS,MAAM,KAAK,OAAO,IAIjC,6CAA6C,4BAC7C,6CAA6C,QAAQ,CACtD;AAED,SAAO,kCAAkC,KAAK;;CAGhD,MAAM,6BACJ,0BACe;AACf,QAAM,KAAK,OAAO,OAChB,6CAA6C,2BAC9C;;CAGH,MAAM,iCACJ,0BACiC;EACjC,MAAM,EAAE,SAAS,MAAM,KAAK,OAAO,IACjC,6CAA6C,yBAAyB,cACtE,EAAE,CACH;AAED,SAAO,kCAAkC,KAAK;;CAGhD,MAAM,iCACJ,0BACiC;EACjC,MAAM,EAAE,SAAS,MAAM,KAAK,OAAO,IACjC,6CAA6C,yBAAyB,cACtE,EAAE,CACH;AAED,SAAO,kCAAkC,KAAK;;CAGhD,MAAM,cAAc,cAA2C;EAC7D,MAAM,EAAE,SAAS,MAAM,KAAK,OAAO,IACjC,gCAAgC,eACjC;AAED,SAAO,sBAAsB,KAAK;;CAGpC,MAAM,sBAAsB,iBAA8C;EACxE,MAAM,EAAE,SAAS,MAAM,KAAK,OAAO,IACjC,yCAAyC,kBAC1C;AAED,SAAO,sBAAsB,KAAK;;CAGpC,MAAM,gBACJ,SACwE;AACxE,SAAO,IAAI,gBACT,MAAM,oBACJ,KAAK,QACL,gCACA,uBACA,UAAU,gCAAgC,QAAQ,GAAG,OACtD,GACA,WACC,oBACE,KAAK,QACL,gCACA,uBACA,OACD,EACH,UAAU,gCAAgC,QAAQ,GAAG,OACtD;;CAGH,MAAM,eAAe,SAAqD;EACxE,MAAM,EAAE,SAAS,MAAM,KAAK,OAAO,KAIjC,gCACA,+BAA+B,EAC7B,GAAG,SACJ,CAAC,CACH;AAED,SAAO,sBAAsB,KAAK;;CAGpC,MAAM,iBAAiB,cAA2C;EAChE,MAAM,EAAE,SAAS,MAAM,KAAK,OAAO,KACjC,gCAAgC,aAAa,UAC7C,KACD;AAED,SAAO,sBAAsB,KAAK;;CAGpC,MAAM,iBAAiB,cAA2C;EAChE,MAAM,EAAE,SAAS,MAAM,KAAK,OAAO,KACjC,gCAAgC,aAAa,UAC7C,KACD;AAED,SAAO,sBAAsB,KAAK;;CAGpC,MAAM,iBAAiB,cAA2C;EAChE,MAAM,EAAE,SAAS,MAAM,KAAK,OAAO,KACjC,gCAAgC,aAAa,UAC7C,KACD;AAED,SAAO,sBAAsB,KAAK;;CAGpC,MAAM,cAAc,SAA8C;AAChE,QAAM,KAAK,OAAO,KAChB,oCACA,8BAA8B,QAAQ,CACvC;;CAGH,oBAAoB,SAAwD;AAE1E,SAAOC,oBAAyC;GAC9C,GAAG;GACH,SAAS,KAAK,OAAO;GACtB,CAAC;;CAGJ,aAAa,SAAwD;AAEnE,SAAOC,aAAkC;GACvC,GAAG;GACH,SAAS,KAAK,OAAO;GACtB,CAAC;;CAGJ,WAAW,UAA0B;AAEnC,SAAOC,WAAgC,UAAU,KAAK,OAAO,QAAQ"}
+{"version":3,"file":"user-management.js","names":["workos: WorkOS"],"sources":["../../src/user-management/user-management.ts"],"sourcesContent":["import { sealData, unsealData } from '../common/crypto/seal';\nimport { PaginationOptions } from '../common/interfaces/pagination-options.interface';\nimport { fetchAndDeserialize } from '../common/utils/fetch-and-deserialize';\nimport { AutoPaginatable } from '../common/utils/pagination';\nimport { getEnv } from '../common/utils/env';\nimport { toQueryString } from '../common/utils/query-string';\nimport { Challenge, ChallengeResponse } from '../mfa/interfaces';\nimport { deserializeChallenge } from '../mfa/serializers';\nimport {\n  FeatureFlag,\n  FeatureFlagResponse,\n} from '../feature-flags/interfaces/feature-flag.interface';\nimport { deserializeFeatureFlag } from '../feature-flags/serializers';\nimport { WorkOS } from '../workos';\nimport {\n  AuthenticateWithCodeAndVerifierOptions,\n  AuthenticateWithCodeOptions,\n  AuthenticateWithMagicAuthOptions,\n  AuthenticateWithPasswordOptions,\n  AuthenticateWithRefreshTokenOptions,\n  AuthenticateWithSessionOptions,\n  AuthenticateWithTotpOptions,\n  AuthenticationResponse,\n  AuthenticationResponseResponse,\n  CreateMagicAuthOptions,\n  CreatePasswordResetOptions,\n  CreateUserOptions,\n  EmailVerification,\n  EmailVerificationResponse,\n  EnrollAuthFactorOptions,\n  ListAuthFactorsOptions,\n  ListSessionsOptions,\n  ListUsersOptions,\n  ListUserFeatureFlagsOptions,\n  LogoutURLOptions,\n  MagicAuth,\n  MagicAuthResponse,\n  PasswordReset,\n  PasswordResetResponse,\n  ResetPasswordOptions,\n  SendVerificationEmailOptions,\n  SerializedAuthenticateWithCodeAndVerifierOptions,\n  SerializedAuthenticateWithCodeOptions,\n  SerializedAuthenticateWithMagicAuthOptions,\n  SerializedAuthenticateWithPasswordOptions,\n  SerializedAuthenticateWithRefreshTokenOptions,\n  SerializedAuthenticateWithRefreshTokenPublicClientOptions,\n  SerializedAuthenticateWithTotpOptions,\n  SerializedCreateMagicAuthOptions,\n  SerializedCreatePasswordResetOptions,\n  SerializedCreateUserOptions,\n  SerializedListSessionsOptions,\n  SerializedListUsersOptions,\n  SerializedResetPasswordOptions,\n  SerializedVerifyEmailOptions,\n  Session,\n  SessionResponse,\n  UpdateUserOptions,\n  User,\n  UserResponse,\n  VerifyEmailOptions,\n} from './interfaces';\nimport {\n  AuthenticateWithEmailVerificationOptions,\n  SerializedAuthenticateWithEmailVerificationOptions,\n} from './interfaces/authenticate-with-email-verification-options.interface';\nimport {\n  AuthenticateWithOrganizationSelectionOptions,\n  SerializedAuthenticateWithOrganizationSelectionOptions,\n} from './interfaces/authenticate-with-organization-selection.interface';\nimport {\n  AccessToken,\n  AuthenticateWithSessionCookieFailedResponse,\n  AuthenticateWithSessionCookieFailureReason,\n  AuthenticateWithSessionCookieOptions,\n  AuthenticateWithSessionCookieSuccessResponse,\n  SessionCookieData,\n} from './interfaces/authenticate-with-session-cookie.interface';\nimport {\n  PKCEAuthorizationURLResult,\n  UserManagementAuthorizationURLOptions,\n} from './interfaces/authorization-url-options.interface';\nimport {\n  CreateOrganizationMembershipOptions,\n  SerializedCreateOrganizationMembershipOptions,\n} from './interfaces/create-organization-membership-options.interface';\nimport {\n  Factor,\n  FactorResponse,\n  FactorWithSecrets,\n  FactorWithSecretsResponse,\n} from './interfaces/factor.interface';\nimport { Identity, IdentityResponse } from './interfaces/identity.interface';\nimport {\n  Invitation,\n  InvitationResponse,\n} from './interfaces/invitation.interface';\nimport {\n  ListInvitationsOptions,\n  SerializedListInvitationsOptions,\n} from './interfaces/list-invitations-options.interface';\nimport {\n  ListOrganizationMembershipsOptions,\n  SerializedListOrganizationMembershipsOptions,\n} from './interfaces/list-organization-memberships-options.interface';\nimport {\n  OrganizationMembership,\n  OrganizationMembershipResponse,\n} from './interfaces/organization-membership.interface';\nimport {\n  RevokeSessionOptions,\n  SerializedRevokeSessionOptions,\n  serializeRevokeSessionOptions,\n} from './interfaces/revoke-session-options.interface';\nimport {\n  SendInvitationOptions,\n  SerializedSendInvitationOptions,\n} from './interfaces/send-invitation-options.interface';\nimport { SessionHandlerOptions } from './interfaces/session-handler-options.interface';\nimport {\n  SerializedUpdateOrganizationMembershipOptions,\n  UpdateOrganizationMembershipOptions,\n} from './interfaces/update-organization-membership-options.interface';\nimport {\n  deserializeAuthenticationResponse,\n  deserializeEmailVerification,\n  deserializeFactorWithSecrets,\n  deserializeMagicAuth,\n  deserializePasswordReset,\n  deserializeSession,\n  deserializeUser,\n  serializeAuthenticateWithCodeAndVerifierOptions,\n  serializeAuthenticateWithCodeOptions,\n  serializeAuthenticateWithMagicAuthOptions,\n  serializeAuthenticateWithPasswordOptions,\n  serializeAuthenticateWithRefreshTokenOptions,\n  serializeAuthenticateWithRefreshTokenPublicClientOptions,\n  serializeAuthenticateWithTotpOptions,\n  serializeCreateMagicAuthOptions,\n  serializeCreatePasswordResetOptions,\n  serializeCreateUserOptions,\n  serializeEnrollAuthFactorOptions,\n  serializeListSessionsOptions,\n  serializeResetPasswordOptions,\n  serializeUpdateUserOptions,\n} from './serializers';\nimport { serializeAuthenticateWithEmailVerificationOptions } from './serializers/authenticate-with-email-verification.serializer';\nimport { serializeAuthenticateWithOrganizationSelectionOptions } from './serializers/authenticate-with-organization-selection-options.serializer';\nimport { serializeCreateOrganizationMembershipOptions } from './serializers/create-organization-membership-options.serializer';\nimport { deserializeFactor } from './serializers/factor.serializer';\nimport { deserializeIdentities } from './serializers/identity.serializer';\nimport { deserializeInvitation } from './serializers/invitation.serializer';\nimport { serializeListInvitationsOptions } from './serializers/list-invitations-options.serializer';\nimport { serializeListOrganizationMembershipsOptions } from './serializers/list-organization-memberships-options.serializer';\nimport { serializeListUsersOptions } from './serializers/list-users-options.serializer';\nimport { deserializeOrganizationMembership } from './serializers/organization-membership.serializer';\nimport { serializeSendInvitationOptions } from './serializers/send-invitation-options.serializer';\nimport { serializeUpdateOrganizationMembershipOptions } from './serializers/update-organization-membership-options.serializer';\nimport { CookieSession } from './session';\nimport { getJose } from '../utils/jose';\n\nexport class UserManagement {\n  private _jwks:\n    | ReturnType<typeof import('jose').createRemoteJWKSet>\n    | undefined;\n  public clientId: string | undefined;\n\n  constructor(private readonly workos: WorkOS) {\n    const { clientId } = workos.options;\n\n    this.clientId = clientId;\n  }\n\n  /**\n   * Resolve clientId from method options or fall back to constructor-provided value.\n   * @throws TypeError if clientId is not available from either source\n   */\n  private resolveClientId(clientId?: string): string {\n    const resolved = clientId ?? this.clientId;\n    if (!resolved) {\n      throw new TypeError(\n        'clientId is required. Provide it in method options or when initializing WorkOS.',\n      );\n    }\n    return resolved;\n  }\n\n  async getJWKS(): Promise<\n    ReturnType<typeof import('jose').createRemoteJWKSet> | undefined\n  > {\n    const { createRemoteJWKSet } = await getJose();\n    if (!this.clientId) {\n      return;\n    }\n\n    // Set the JWKS URL. This is used to verify if the JWT is still valid\n    this._jwks ??= createRemoteJWKSet(new URL(this.getJwksUrl(this.clientId)), {\n      cooldownDuration: 1000 * 60 * 5,\n    });\n\n    return this._jwks;\n  }\n\n  /**\n   * Loads a sealed session using the provided session data and cookie password.\n   *\n   * @param options - The options for loading the sealed session.\n   * @param options.sessionData - The sealed session data.\n   * @param options.cookiePassword - The password used to encrypt the session data.\n   * @returns The session class.\n   */\n  loadSealedSession(options: {\n    sessionData: string;\n    cookiePassword: string;\n  }): CookieSession {\n    return new CookieSession(this, options.sessionData, options.cookiePassword);\n  }\n\n  async getUser(userId: string): Promise<User> {\n    const { data } = await this.workos.get<UserResponse>(\n      `/user_management/users/${userId}`,\n    );\n\n    return deserializeUser(data);\n  }\n\n  async getUserByExternalId(externalId: string): Promise<User> {\n    const { data } = await this.workos.get<UserResponse>(\n      `/user_management/users/external_id/${externalId}`,\n    );\n\n    return deserializeUser(data);\n  }\n\n  async listUsers(\n    options?: ListUsersOptions,\n  ): Promise<AutoPaginatable<User, SerializedListUsersOptions>> {\n    return new AutoPaginatable(\n      await fetchAndDeserialize<UserResponse, User>(\n        this.workos,\n        '/user_management/users',\n        deserializeUser,\n        options ? serializeListUsersOptions(options) : undefined,\n      ),\n      (params) =>\n        fetchAndDeserialize<UserResponse, User>(\n          this.workos,\n          '/user_management/users',\n          deserializeUser,\n          params,\n        ),\n      options ? serializeListUsersOptions(options) : undefined,\n    );\n  }\n\n  async createUser(payload: CreateUserOptions): Promise<User> {\n    const { data } = await this.workos.post<\n      UserResponse,\n      SerializedCreateUserOptions\n    >('/user_management/users', serializeCreateUserOptions(payload));\n\n    return deserializeUser(data);\n  }\n\n  async authenticateWithMagicAuth(\n    payload: AuthenticateWithMagicAuthOptions,\n  ): Promise<AuthenticationResponse> {\n    const { session, clientId, ...remainingPayload } = payload;\n    const resolvedClientId = this.resolveClientId(clientId);\n\n    const { data } = await this.workos.post<\n      AuthenticationResponseResponse,\n      SerializedAuthenticateWithMagicAuthOptions\n    >(\n      '/user_management/authenticate',\n      serializeAuthenticateWithMagicAuthOptions({\n        ...remainingPayload,\n        clientId: resolvedClientId,\n        clientSecret: this.workos.key,\n      }),\n    );\n\n    return this.prepareAuthenticationResponse({\n      authenticationResponse: deserializeAuthenticationResponse(data),\n      session,\n    });\n  }\n\n  async authenticateWithPassword(\n    payload: AuthenticateWithPasswordOptions,\n  ): Promise<AuthenticationResponse> {\n    const { session, clientId, ...remainingPayload } = payload;\n    const resolvedClientId = this.resolveClientId(clientId);\n\n    const { data } = await this.workos.post<\n      AuthenticationResponseResponse,\n      SerializedAuthenticateWithPasswordOptions\n    >(\n      '/user_management/authenticate',\n      serializeAuthenticateWithPasswordOptions({\n        ...remainingPayload,\n        clientId: resolvedClientId,\n        clientSecret: this.workos.key,\n      }),\n    );\n\n    return this.prepareAuthenticationResponse({\n      authenticationResponse: deserializeAuthenticationResponse(data),\n      session,\n    });\n  }\n\n  /**\n   * Exchange an authorization code for tokens.\n   *\n   * Auto-detects public vs confidential client mode:\n   * - If codeVerifier is provided: Uses PKCE flow (public client)\n   * - If no codeVerifier: Uses client_secret from API key (confidential client)\n   * - If both: Uses both client_secret AND codeVerifier (confidential client with PKCE)\n   *\n   * Using PKCE with confidential clients is recommended by OAuth 2.1 for defense\n   * in depth and provides additional CSRF protection on the authorization flow.\n   *\n   * @throws Error if neither codeVerifier nor API key is available\n   */\n  async authenticateWithCode(\n    payload: AuthenticateWithCodeOptions,\n  ): Promise<AuthenticationResponse> {\n    const { session, clientId, codeVerifier, ...remainingPayload } = payload;\n    const resolvedClientId = this.resolveClientId(clientId);\n\n    // Validate codeVerifier is not an empty string (common mistake)\n    if (codeVerifier !== undefined && codeVerifier.trim() === '') {\n      throw new TypeError(\n        'codeVerifier cannot be an empty string. ' +\n          'Generate a valid PKCE pair using workos.pkce.generate().',\n      );\n    }\n\n    const hasApiKey = !!this.workos.key;\n    const hasPKCE = !!codeVerifier;\n\n    if (!hasPKCE && !hasApiKey) {\n      throw new TypeError(\n        'authenticateWithCode requires either a codeVerifier (for public clients) ' +\n          'or an API key configured on the WorkOS instance (for confidential clients).',\n      );\n    }\n\n    const { data } = await this.workos.post<\n      AuthenticationResponseResponse,\n      SerializedAuthenticateWithCodeOptions\n    >(\n      '/user_management/authenticate',\n      serializeAuthenticateWithCodeOptions({\n        ...remainingPayload,\n        clientId: resolvedClientId,\n        codeVerifier,\n        clientSecret: hasApiKey ? this.workos.key : undefined,\n      }),\n      { skipApiKeyCheck: !hasApiKey },\n    );\n\n    return this.prepareAuthenticationResponse({\n      authenticationResponse: deserializeAuthenticationResponse(data),\n      session,\n    });\n  }\n\n  /**\n   * Exchange an authorization code for tokens using PKCE (public client flow).\n   * Use this instead of authenticateWithCode() when the client cannot securely\n   * store a client_secret (browser, mobile, CLI, desktop apps).\n   *\n   * @param payload.clientId - Your WorkOS client ID\n   * @param payload.code - The authorization code from the OAuth callback\n   * @param payload.codeVerifier - The PKCE code verifier used to generate the code challenge\n   */\n  async authenticateWithCodeAndVerifier(\n    payload: AuthenticateWithCodeAndVerifierOptions,\n  ): Promise<AuthenticationResponse> {\n    const { session, clientId, ...remainingPayload } = payload;\n    const resolvedClientId = this.resolveClientId(clientId);\n\n    const { data } = await this.workos.post<\n      AuthenticationResponseResponse,\n      SerializedAuthenticateWithCodeAndVerifierOptions\n    >(\n      '/user_management/authenticate',\n      serializeAuthenticateWithCodeAndVerifierOptions({\n        ...remainingPayload,\n        clientId: resolvedClientId,\n      }),\n      { skipApiKeyCheck: true },\n    );\n\n    return this.prepareAuthenticationResponse({\n      authenticationResponse: deserializeAuthenticationResponse(data),\n      session,\n    });\n  }\n\n  /**\n   * Refresh an access token using a refresh token.\n   * Automatically detects public client mode - if no API key is configured,\n   * omits client_secret from the request.\n   */\n  async authenticateWithRefreshToken(\n    payload: AuthenticateWithRefreshTokenOptions,\n  ): Promise<AuthenticationResponse> {\n    const { session, clientId, ...remainingPayload } = payload;\n    const resolvedClientId = this.resolveClientId(clientId);\n    const isPublicClient = !this.workos.key;\n\n    const body = isPublicClient\n      ? serializeAuthenticateWithRefreshTokenPublicClientOptions({\n          ...remainingPayload,\n          clientId: resolvedClientId,\n        })\n      : serializeAuthenticateWithRefreshTokenOptions({\n          ...remainingPayload,\n          clientId: resolvedClientId,\n          clientSecret: this.workos.key,\n        });\n\n    const { data } = await this.workos.post<\n      AuthenticationResponseResponse,\n      | SerializedAuthenticateWithRefreshTokenOptions\n      | SerializedAuthenticateWithRefreshTokenPublicClientOptions\n    >('/user_management/authenticate', body, {\n      skipApiKeyCheck: isPublicClient,\n    });\n\n    return this.prepareAuthenticationResponse({\n      authenticationResponse: deserializeAuthenticationResponse(data),\n      session,\n    });\n  }\n\n  async authenticateWithTotp(\n    payload: AuthenticateWithTotpOptions,\n  ): Promise<AuthenticationResponse> {\n    const { session, clientId, ...remainingPayload } = payload;\n    const resolvedClientId = this.resolveClientId(clientId);\n\n    const { data } = await this.workos.post<\n      AuthenticationResponseResponse,\n      SerializedAuthenticateWithTotpOptions\n    >(\n      '/user_management/authenticate',\n      serializeAuthenticateWithTotpOptions({\n        ...remainingPayload,\n        clientId: resolvedClientId,\n        clientSecret: this.workos.key,\n      }),\n    );\n\n    return this.prepareAuthenticationResponse({\n      authenticationResponse: deserializeAuthenticationResponse(data),\n      session,\n    });\n  }\n\n  async authenticateWithEmailVerification(\n    payload: AuthenticateWithEmailVerificationOptions,\n  ): Promise<AuthenticationResponse> {\n    const { session, clientId, ...remainingPayload } = payload;\n    const resolvedClientId = this.resolveClientId(clientId);\n\n    const { data } = await this.workos.post<\n      AuthenticationResponseResponse,\n      SerializedAuthenticateWithEmailVerificationOptions\n    >(\n      '/user_management/authenticate',\n      serializeAuthenticateWithEmailVerificationOptions({\n        ...remainingPayload,\n        clientId: resolvedClientId,\n        clientSecret: this.workos.key,\n      }),\n    );\n\n    return this.prepareAuthenticationResponse({\n      authenticationResponse: deserializeAuthenticationResponse(data),\n      session,\n    });\n  }\n\n  async authenticateWithOrganizationSelection(\n    payload: AuthenticateWithOrganizationSelectionOptions,\n  ): Promise<AuthenticationResponse> {\n    const { session, clientId, ...remainingPayload } = payload;\n    const resolvedClientId = this.resolveClientId(clientId);\n\n    const { data } = await this.workos.post<\n      AuthenticationResponseResponse,\n      SerializedAuthenticateWithOrganizationSelectionOptions\n    >(\n      '/user_management/authenticate',\n      serializeAuthenticateWithOrganizationSelectionOptions({\n        ...remainingPayload,\n        clientId: resolvedClientId,\n        clientSecret: this.workos.key,\n      }),\n    );\n\n    return this.prepareAuthenticationResponse({\n      authenticationResponse: deserializeAuthenticationResponse(data),\n      session,\n    });\n  }\n\n  async authenticateWithSessionCookie({\n    sessionData,\n    cookiePassword = getEnv('WORKOS_COOKIE_PASSWORD'),\n  }: AuthenticateWithSessionCookieOptions): Promise<\n    | AuthenticateWithSessionCookieSuccessResponse\n    | AuthenticateWithSessionCookieFailedResponse\n  > {\n    if (!cookiePassword) {\n      throw new Error('Cookie password is required');\n    }\n\n    const jwks = await this.getJWKS();\n\n    if (!jwks) {\n      throw new Error('Must provide clientId to initialize JWKS');\n    }\n\n    const { decodeJwt } = await getJose();\n\n    if (!sessionData) {\n      return {\n        authenticated: false,\n        reason:\n          AuthenticateWithSessionCookieFailureReason.NO_SESSION_COOKIE_PROVIDED,\n      };\n    }\n\n    const session = await unsealData<SessionCookieData>(sessionData, {\n      password: cookiePassword,\n    });\n\n    if (!session.accessToken) {\n      return {\n        authenticated: false,\n        reason:\n          AuthenticateWithSessionCookieFailureReason.INVALID_SESSION_COOKIE,\n      };\n    }\n\n    if (!(await this.isValidJwt(session.accessToken))) {\n      return {\n        authenticated: false,\n        reason: AuthenticateWithSessionCookieFailureReason.INVALID_JWT,\n      };\n    }\n\n    const {\n      sid: sessionId,\n      org_id: organizationId,\n      role,\n      roles,\n      permissions,\n      entitlements,\n      feature_flags: featureFlags,\n    } = decodeJwt<AccessToken>(session.accessToken);\n\n    return {\n      authenticated: true,\n      sessionId,\n      organizationId,\n      role,\n      roles,\n      user: session.user,\n      permissions,\n      entitlements,\n      featureFlags,\n      accessToken: session.accessToken,\n      authenticationMethod: session.authenticationMethod,\n    };\n  }\n\n  private async isValidJwt(accessToken: string): Promise<boolean> {\n    const jwks = await this.getJWKS();\n    const { jwtVerify } = await getJose();\n    if (!jwks) {\n      throw new Error('Must provide clientId to initialize JWKS');\n    }\n\n    try {\n      await jwtVerify(accessToken, jwks);\n      return true;\n    } catch (e) {\n      // Only treat as invalid JWT if it's an actual JWT/JWS error from jose\n      // Network errors, crypto failures, etc. should propagate\n      if (\n        e instanceof Error &&\n        'code' in e &&\n        typeof e.code === 'string' &&\n        (e.code.startsWith('ERR_JWT_') || e.code.startsWith('ERR_JWS_'))\n      ) {\n        return false;\n      }\n      throw e;\n    }\n  }\n\n  private async prepareAuthenticationResponse({\n    authenticationResponse,\n    session,\n  }: {\n    authenticationResponse: AuthenticationResponse;\n    session?: AuthenticateWithSessionOptions;\n  }): Promise<AuthenticationResponse> {\n    if (session?.sealSession) {\n      if (!this.workos.key) {\n        throw new Error(\n          'Session sealing requires server-side usage with an API key. ' +\n            'Public clients should store tokens directly ' +\n            '(e.g., secure storage on mobile, keychain on desktop).',\n        );\n      }\n\n      return {\n        ...authenticationResponse,\n        sealedSession: await this.sealSessionDataFromAuthenticationResponse({\n          authenticationResponse,\n          cookiePassword: session.cookiePassword,\n        }),\n      };\n    }\n\n    return authenticationResponse;\n  }\n\n  private async sealSessionDataFromAuthenticationResponse({\n    authenticationResponse,\n    cookiePassword,\n  }: {\n    authenticationResponse: AuthenticationResponse;\n    cookiePassword?: string;\n  }): Promise<string> {\n    if (!cookiePassword) {\n      throw new Error('Cookie password is required');\n    }\n\n    const { decodeJwt } = await getJose();\n\n    const { org_id: organizationIdFromAccessToken } = decodeJwt<AccessToken>(\n      authenticationResponse.accessToken,\n    );\n\n    const sessionData: SessionCookieData = {\n      organizationId: organizationIdFromAccessToken,\n      user: authenticationResponse.user,\n      accessToken: authenticationResponse.accessToken,\n      refreshToken: authenticationResponse.refreshToken,\n      authenticationMethod: authenticationResponse.authenticationMethod,\n      impersonator: authenticationResponse.impersonator,\n    };\n\n    return sealData(sessionData, {\n      password: cookiePassword,\n    });\n  }\n\n  async getSessionFromCookie({\n    sessionData,\n    cookiePassword = getEnv('WORKOS_COOKIE_PASSWORD'),\n  }: SessionHandlerOptions): Promise<SessionCookieData | undefined> {\n    if (!cookiePassword) {\n      throw new Error('Cookie password is required');\n    }\n\n    if (sessionData) {\n      return unsealData<SessionCookieData>(sessionData, {\n        password: cookiePassword,\n      });\n    }\n\n    return undefined;\n  }\n\n  async getEmailVerification(\n    emailVerificationId: string,\n  ): Promise<EmailVerification> {\n    const { data } = await this.workos.get<EmailVerificationResponse>(\n      `/user_management/email_verification/${emailVerificationId}`,\n    );\n\n    return deserializeEmailVerification(data);\n  }\n\n  async sendVerificationEmail({\n    userId,\n  }: SendVerificationEmailOptions): Promise<{ user: User }> {\n    const { data } = await this.workos.post<{ user: UserResponse }>(\n      `/user_management/users/${userId}/email_verification/send`,\n      {},\n    );\n\n    return { user: deserializeUser(data.user) };\n  }\n\n  async getMagicAuth(magicAuthId: string): Promise<MagicAuth> {\n    const { data } = await this.workos.get<MagicAuthResponse>(\n      `/user_management/magic_auth/${magicAuthId}`,\n    );\n\n    return deserializeMagicAuth(data);\n  }\n\n  async createMagicAuth(options: CreateMagicAuthOptions): Promise<MagicAuth> {\n    const { data } = await this.workos.post<\n      MagicAuthResponse,\n      SerializedCreateMagicAuthOptions\n    >(\n      '/user_management/magic_auth',\n      serializeCreateMagicAuthOptions({\n        ...options,\n      }),\n    );\n\n    return deserializeMagicAuth(data);\n  }\n\n  async verifyEmail({\n    code,\n    userId,\n  }: VerifyEmailOptions): Promise<{ user: User }> {\n    const { data } = await this.workos.post<\n      { user: UserResponse },\n      SerializedVerifyEmailOptions\n    >(`/user_management/users/${userId}/email_verification/confirm`, {\n      code,\n    });\n\n    return { user: deserializeUser(data.user) };\n  }\n\n  async getPasswordReset(passwordResetId: string): Promise<PasswordReset> {\n    const { data } = await this.workos.get<PasswordResetResponse>(\n      `/user_management/password_reset/${passwordResetId}`,\n    );\n\n    return deserializePasswordReset(data);\n  }\n\n  async createPasswordReset(\n    options: CreatePasswordResetOptions,\n  ): Promise<PasswordReset> {\n    const { data } = await this.workos.post<\n      PasswordResetResponse,\n      SerializedCreatePasswordResetOptions\n    >(\n      '/user_management/password_reset',\n      serializeCreatePasswordResetOptions({\n        ...options,\n      }),\n    );\n\n    return deserializePasswordReset(data);\n  }\n\n  async resetPassword(payload: ResetPasswordOptions): Promise<{ user: User }> {\n    const { data } = await this.workos.post<\n      { user: UserResponse },\n      SerializedResetPasswordOptions\n    >(\n      '/user_management/password_reset/confirm',\n      serializeResetPasswordOptions(payload),\n    );\n\n    return { user: deserializeUser(data.user) };\n  }\n\n  async updateUser(payload: UpdateUserOptions): Promise<User> {\n    const { data } = await this.workos.put<UserResponse>(\n      `/user_management/users/${payload.userId}`,\n      serializeUpdateUserOptions(payload),\n    );\n\n    return deserializeUser(data);\n  }\n\n  async enrollAuthFactor(payload: EnrollAuthFactorOptions): Promise<{\n    authenticationFactor: FactorWithSecrets;\n    authenticationChallenge: Challenge;\n  }> {\n    const { data } = await this.workos.post<{\n      authentication_factor: FactorWithSecretsResponse;\n      authentication_challenge: ChallengeResponse;\n    }>(\n      `/user_management/users/${payload.userId}/auth_factors`,\n      serializeEnrollAuthFactorOptions(payload),\n    );\n\n    return {\n      authenticationFactor: deserializeFactorWithSecrets(\n        data.authentication_factor,\n      ),\n      authenticationChallenge: deserializeChallenge(\n        data.authentication_challenge,\n      ),\n    };\n  }\n\n  async listAuthFactors(\n    options: ListAuthFactorsOptions,\n  ): Promise<AutoPaginatable<Factor, PaginationOptions>> {\n    const { userId, ...restOfOptions } = options;\n    return new AutoPaginatable(\n      await fetchAndDeserialize<FactorResponse, Factor>(\n        this.workos,\n        `/user_management/users/${userId}/auth_factors`,\n        deserializeFactor,\n        restOfOptions,\n      ),\n      (params) =>\n        fetchAndDeserialize<FactorResponse, Factor>(\n          this.workos,\n          `/user_management/users/${userId}/auth_factors`,\n          deserializeFactor,\n          params,\n        ),\n      restOfOptions,\n    );\n  }\n\n  async listUserFeatureFlags(\n    options: ListUserFeatureFlagsOptions,\n  ): Promise<AutoPaginatable<FeatureFlag>> {\n    const { userId, ...paginationOptions } = options;\n\n    return new AutoPaginatable(\n      await fetchAndDeserialize<FeatureFlagResponse, FeatureFlag>(\n        this.workos,\n        `/user_management/users/${userId}/feature-flags`,\n        deserializeFeatureFlag,\n        paginationOptions,\n      ),\n      (params) =>\n        fetchAndDeserialize<FeatureFlagResponse, FeatureFlag>(\n          this.workos,\n          `/user_management/users/${userId}/feature-flags`,\n          deserializeFeatureFlag,\n          params,\n        ),\n      paginationOptions,\n    );\n  }\n\n  async listSessions(\n    userId: string,\n    options?: ListSessionsOptions,\n  ): Promise<AutoPaginatable<Session, SerializedListSessionsOptions>> {\n    return new AutoPaginatable(\n      await fetchAndDeserialize<SessionResponse, Session>(\n        this.workos,\n        `/user_management/users/${userId}/sessions`,\n        deserializeSession,\n        options ? serializeListSessionsOptions(options) : undefined,\n      ),\n      (params) =>\n        fetchAndDeserialize<SessionResponse, Session>(\n          this.workos,\n          `/user_management/users/${userId}/sessions`,\n          deserializeSession,\n          params,\n        ),\n      options ? serializeListSessionsOptions(options) : undefined,\n    );\n  }\n\n  async deleteUser(userId: string) {\n    await this.workos.delete(`/user_management/users/${userId}`);\n  }\n\n  async getUserIdentities(userId: string): Promise<Identity[]> {\n    if (!userId) {\n      throw new TypeError(`Incomplete arguments. Need to specify 'userId'.`);\n    }\n\n    const { data } = await this.workos.get<IdentityResponse[]>(\n      `/user_management/users/${userId}/identities`,\n    );\n\n    return deserializeIdentities(data);\n  }\n\n  async getOrganizationMembership(\n    organizationMembershipId: string,\n  ): Promise<OrganizationMembership> {\n    const { data } = await this.workos.get<OrganizationMembershipResponse>(\n      `/user_management/organization_memberships/${organizationMembershipId}`,\n    );\n\n    return deserializeOrganizationMembership(data);\n  }\n\n  async listOrganizationMemberships(\n    options: ListOrganizationMembershipsOptions,\n  ): Promise<\n    AutoPaginatable<\n      OrganizationMembership,\n      SerializedListOrganizationMembershipsOptions\n    >\n  > {\n    const serializedOptions =\n      serializeListOrganizationMembershipsOptions(options);\n\n    return new AutoPaginatable(\n      await fetchAndDeserialize<\n        OrganizationMembershipResponse,\n        OrganizationMembership\n      >(\n        this.workos,\n        '/user_management/organization_memberships',\n        deserializeOrganizationMembership,\n        serializedOptions,\n      ),\n      (params) =>\n        fetchAndDeserialize<\n          OrganizationMembershipResponse,\n          OrganizationMembership\n        >(\n          this.workos,\n          '/user_management/organization_memberships',\n          deserializeOrganizationMembership,\n          params,\n        ),\n      serializedOptions,\n    );\n  }\n\n  async createOrganizationMembership(\n    options: CreateOrganizationMembershipOptions,\n  ): Promise<OrganizationMembership> {\n    const { data } = await this.workos.post<\n      OrganizationMembershipResponse,\n      SerializedCreateOrganizationMembershipOptions\n    >(\n      '/user_management/organization_memberships',\n      serializeCreateOrganizationMembershipOptions(options),\n    );\n\n    return deserializeOrganizationMembership(data);\n  }\n\n  async updateOrganizationMembership(\n    organizationMembershipId: string,\n    options: UpdateOrganizationMembershipOptions,\n  ): Promise<OrganizationMembership> {\n    const { data } = await this.workos.put<\n      OrganizationMembershipResponse,\n      SerializedUpdateOrganizationMembershipOptions\n    >(\n      `/user_management/organization_memberships/${organizationMembershipId}`,\n      serializeUpdateOrganizationMembershipOptions(options),\n    );\n\n    return deserializeOrganizationMembership(data);\n  }\n\n  async deleteOrganizationMembership(\n    organizationMembershipId: string,\n  ): Promise<void> {\n    await this.workos.delete(\n      `/user_management/organization_memberships/${organizationMembershipId}`,\n    );\n  }\n\n  async deactivateOrganizationMembership(\n    organizationMembershipId: string,\n  ): Promise<OrganizationMembership> {\n    const { data } = await this.workos.put<OrganizationMembershipResponse>(\n      `/user_management/organization_memberships/${organizationMembershipId}/deactivate`,\n      {},\n    );\n\n    return deserializeOrganizationMembership(data);\n  }\n\n  async reactivateOrganizationMembership(\n    organizationMembershipId: string,\n  ): Promise<OrganizationMembership> {\n    const { data } = await this.workos.put<OrganizationMembershipResponse>(\n      `/user_management/organization_memberships/${organizationMembershipId}/reactivate`,\n      {},\n    );\n\n    return deserializeOrganizationMembership(data);\n  }\n\n  async getInvitation(invitationId: string): Promise<Invitation> {\n    const { data } = await this.workos.get<InvitationResponse>(\n      `/user_management/invitations/${invitationId}`,\n    );\n\n    return deserializeInvitation(data);\n  }\n\n  async findInvitationByToken(invitationToken: string): Promise<Invitation> {\n    const { data } = await this.workos.get<InvitationResponse>(\n      `/user_management/invitations/by_token/${invitationToken}`,\n    );\n\n    return deserializeInvitation(data);\n  }\n\n  async listInvitations(\n    options: ListInvitationsOptions,\n  ): Promise<AutoPaginatable<Invitation, SerializedListInvitationsOptions>> {\n    return new AutoPaginatable(\n      await fetchAndDeserialize<InvitationResponse, Invitation>(\n        this.workos,\n        '/user_management/invitations',\n        deserializeInvitation,\n        options ? serializeListInvitationsOptions(options) : undefined,\n      ),\n      (params) =>\n        fetchAndDeserialize<InvitationResponse, Invitation>(\n          this.workos,\n          '/user_management/invitations',\n          deserializeInvitation,\n          params,\n        ),\n      options ? serializeListInvitationsOptions(options) : undefined,\n    );\n  }\n\n  async sendInvitation(payload: SendInvitationOptions): Promise<Invitation> {\n    const { data } = await this.workos.post<\n      InvitationResponse,\n      SerializedSendInvitationOptions\n    >(\n      '/user_management/invitations',\n      serializeSendInvitationOptions({\n        ...payload,\n      }),\n    );\n\n    return deserializeInvitation(data);\n  }\n\n  async acceptInvitation(invitationId: string): Promise<Invitation> {\n    const { data } = await this.workos.post<InvitationResponse, any>(\n      `/user_management/invitations/${invitationId}/accept`,\n      null,\n    );\n\n    return deserializeInvitation(data);\n  }\n\n  async revokeInvitation(invitationId: string): Promise<Invitation> {\n    const { data } = await this.workos.post<InvitationResponse, any>(\n      `/user_management/invitations/${invitationId}/revoke`,\n      null,\n    );\n\n    return deserializeInvitation(data);\n  }\n\n  async resendInvitation(invitationId: string): Promise<Invitation> {\n    const { data } = await this.workos.post<InvitationResponse, any>(\n      `/user_management/invitations/${invitationId}/resend`,\n      null,\n    );\n\n    return deserializeInvitation(data);\n  }\n\n  async revokeSession(payload: RevokeSessionOptions): Promise<void> {\n    await this.workos.post<void, SerializedRevokeSessionOptions>(\n      '/user_management/sessions/revoke',\n      serializeRevokeSessionOptions(payload),\n    );\n  }\n\n  /**\n   * Generate an OAuth 2.0 authorization URL.\n   *\n   * For public clients (browser, mobile, CLI), include PKCE parameters:\n   * - Generate PKCE using workos.pkce.generate()\n   * - Pass codeChallenge and codeChallengeMethod here\n   * - Store codeVerifier and pass to authenticateWithCode() later\n   *\n   * Or use getAuthorizationUrlWithPKCE() which handles PKCE automatically.\n   */\n  getAuthorizationUrl(options: UserManagementAuthorizationURLOptions): string {\n    const {\n      connectionId,\n      codeChallenge,\n      codeChallengeMethod,\n      clientId,\n      domainHint,\n      loginHint,\n      organizationId,\n      provider,\n      providerQueryParams,\n      providerScopes,\n      prompt,\n      redirectUri,\n      state,\n      screenHint,\n    } = options;\n    const resolvedClientId = this.resolveClientId(clientId);\n\n    if (!provider && !connectionId && !organizationId) {\n      throw new TypeError(\n        `Incomplete arguments. Need to specify either a 'connectionId', 'organizationId', or 'provider'.`,\n      );\n    }\n\n    if (provider !== 'authkit' && screenHint) {\n      throw new TypeError(\n        `'screenHint' is only supported for 'authkit' provider`,\n      );\n    }\n\n    const query = toQueryString({\n      connection_id: connectionId,\n      code_challenge: codeChallenge,\n      code_challenge_method: codeChallengeMethod,\n      organization_id: organizationId,\n      domain_hint: domainHint,\n      login_hint: loginHint,\n      provider,\n      provider_query_params: providerQueryParams,\n      provider_scopes: providerScopes,\n      prompt,\n      client_id: resolvedClientId,\n      redirect_uri: redirectUri,\n      response_type: 'code',\n      state,\n      screen_hint: screenHint,\n    });\n\n    return `${this.workos.baseURL}/user_management/authorize?${query}`;\n  }\n\n  /**\n   * Generate an OAuth 2.0 authorization URL with automatic PKCE.\n   *\n   * This method generates PKCE parameters internally and returns them along with\n   * the authorization URL. Use this for public clients (CLI apps, Electron, mobile)\n   * that cannot securely store a client secret.\n   *\n   * @returns Object containing url, state, and codeVerifier\n   *\n   * @example\n   * ```typescript\n   * const { url, state, codeVerifier } = await workos.userManagement.getAuthorizationUrlWithPKCE({\n   *   provider: 'authkit',\n   *   clientId: 'client_123',\n   *   redirectUri: 'myapp://callback',\n   * });\n   *\n   * // Store state and codeVerifier securely, then redirect user to url\n   * // After callback, exchange the code:\n   * const response = await workos.userManagement.authenticateWithCode({\n   *   code: authorizationCode,\n   *   codeVerifier,\n   *   clientId: 'client_123',\n   * });\n   * ```\n   */\n  async getAuthorizationUrlWithPKCE(\n    options: Omit<\n      UserManagementAuthorizationURLOptions,\n      'codeChallenge' | 'codeChallengeMethod' | 'state'\n    >,\n  ): Promise<PKCEAuthorizationURLResult> {\n    const {\n      clientId,\n      connectionId,\n      domainHint,\n      loginHint,\n      organizationId,\n      provider,\n      providerQueryParams,\n      providerScopes,\n      prompt,\n      redirectUri,\n      screenHint,\n    } = options;\n    const resolvedClientId = this.resolveClientId(clientId);\n\n    if (!provider && !connectionId && !organizationId) {\n      throw new TypeError(\n        `Incomplete arguments. Need to specify either a 'connectionId', 'organizationId', or 'provider'.`,\n      );\n    }\n\n    if (provider !== 'authkit' && screenHint) {\n      throw new TypeError(\n        `'screenHint' is only supported for 'authkit' provider`,\n      );\n    }\n\n    // Generate PKCE parameters\n    const pkce = await this.workos.pkce.generate();\n\n    // Generate secure random state\n    const state = this.workos.pkce.generateCodeVerifier(43);\n\n    const query = toQueryString({\n      connection_id: connectionId,\n      code_challenge: pkce.codeChallenge,\n      code_challenge_method: 'S256',\n      organization_id: organizationId,\n      domain_hint: domainHint,\n      login_hint: loginHint,\n      provider,\n      provider_query_params: providerQueryParams,\n      provider_scopes: providerScopes,\n      prompt,\n      client_id: resolvedClientId,\n      redirect_uri: redirectUri,\n      response_type: 'code',\n      state,\n      screen_hint: screenHint,\n    });\n\n    const url = `${this.workos.baseURL}/user_management/authorize?${query}`;\n\n    return { url, state, codeVerifier: pkce.codeVerifier };\n  }\n\n  getLogoutUrl(options: LogoutURLOptions): string {\n    const { sessionId, returnTo } = options;\n\n    if (!sessionId) {\n      throw new TypeError(`Incomplete arguments. Need to specify 'sessionId'.`);\n    }\n\n    const url = new URL(\n      '/user_management/sessions/logout',\n      this.workos.baseURL,\n    );\n\n    url.searchParams.set('session_id', sessionId);\n    if (returnTo) {\n      url.searchParams.set('return_to', returnTo);\n    }\n\n    return url.toString();\n  }\n\n  getJwksUrl(clientId: string): string {\n    if (!clientId) {\n      throw new TypeError('clientId must be a valid clientId');\n    }\n\n    return `${this.workos.baseURL}/sso/jwks/${clientId}`;\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAiKA,IAAa,iBAAb,MAA4B;CAC1B,AAAQ;CAGR,AAAO;CAEP,YAAY,AAAiBA,QAAgB;EAAhB;EAC3B,MAAM,EAAE,aAAa,OAAO;AAE5B,OAAK,WAAW;;;;;;CAOlB,AAAQ,gBAAgB,UAA2B;EACjD,MAAM,WAAW,YAAY,KAAK;AAClC,MAAI,CAAC,SACH,OAAM,IAAI,UACR,kFACD;AAEH,SAAO;;CAGT,MAAM,UAEJ;EACA,MAAM,EAAE,uBAAuB,MAAM,SAAS;AAC9C,MAAI,CAAC,KAAK,SACR;AAIF,OAAK,UAAU,mBAAmB,IAAI,IAAI,KAAK,WAAW,KAAK,SAAS,CAAC,EAAE,EACzE,kBAAkB,MAAO,KAAK,GAC/B,CAAC;AAEF,SAAO,KAAK;;;;;;;;;;CAWd,kBAAkB,SAGA;AAChB,SAAO,IAAI,cAAc,MAAM,QAAQ,aAAa,QAAQ,eAAe;;CAG7E,MAAM,QAAQ,QAA+B;EAC3C,MAAM,EAAE,SAAS,MAAM,KAAK,OAAO,IACjC,0BAA0B,SAC3B;AAED,SAAO,gBAAgB,KAAK;;CAG9B,MAAM,oBAAoB,YAAmC;EAC3D,MAAM,EAAE,SAAS,MAAM,KAAK,OAAO,IACjC,sCAAsC,aACvC;AAED,SAAO,gBAAgB,KAAK;;CAG9B,MAAM,UACJ,SAC4D;AAC5D,SAAO,IAAI,gBACT,MAAM,oBACJ,KAAK,QACL,0BACA,iBACA,UAAU,0BAA0B,QAAQ,GAAG,OAChD,GACA,WACC,oBACE,KAAK,QACL,0BACA,iBACA,OACD,EACH,UAAU,0BAA0B,QAAQ,GAAG,OAChD;;CAGH,MAAM,WAAW,SAA2C;EAC1D,MAAM,EAAE,SAAS,MAAM,KAAK,OAAO,KAGjC,0BAA0B,2BAA2B,QAAQ,CAAC;AAEhE,SAAO,gBAAgB,KAAK;;CAG9B,MAAM,0BACJ,SACiC;EACjC,MAAM,EAAE,SAAS,UAAU,GAAG,qBAAqB;EACnD,MAAM,mBAAmB,KAAK,gBAAgB,SAAS;EAEvD,MAAM,EAAE,SAAS,MAAM,KAAK,OAAO,KAIjC,iCACA,0CAA0C;GACxC,GAAG;GACH,UAAU;GACV,cAAc,KAAK,OAAO;GAC3B,CAAC,CACH;AAED,SAAO,KAAK,8BAA8B;GACxC,wBAAwB,kCAAkC,KAAK;GAC/D;GACD,CAAC;;CAGJ,MAAM,yBACJ,SACiC;EACjC,MAAM,EAAE,SAAS,UAAU,GAAG,qBAAqB;EACnD,MAAM,mBAAmB,KAAK,gBAAgB,SAAS;EAEvD,MAAM,EAAE,SAAS,MAAM,KAAK,OAAO,KAIjC,iCACA,yCAAyC;GACvC,GAAG;GACH,UAAU;GACV,cAAc,KAAK,OAAO;GAC3B,CAAC,CACH;AAED,SAAO,KAAK,8BAA8B;GACxC,wBAAwB,kCAAkC,KAAK;GAC/D;GACD,CAAC;;;;;;;;;;;;;;;CAgBJ,MAAM,qBACJ,SACiC;EACjC,MAAM,EAAE,SAAS,UAAU,cAAc,GAAG,qBAAqB;EACjE,MAAM,mBAAmB,KAAK,gBAAgB,SAAS;AAGvD,MAAI,iBAAiB,UAAa,aAAa,MAAM,KAAK,GACxD,OAAM,IAAI,UACR,mGAED;EAGH,MAAM,YAAY,CAAC,CAAC,KAAK,OAAO;AAGhC,MAAI,CAFY,CAAC,CAAC,gBAEF,CAAC,UACf,OAAM,IAAI,UACR,uJAED;EAGH,MAAM,EAAE,SAAS,MAAM,KAAK,OAAO,KAIjC,iCACA,qCAAqC;GACnC,GAAG;GACH,UAAU;GACV;GACA,cAAc,YAAY,KAAK,OAAO,MAAM;GAC7C,CAAC,EACF,EAAE,iBAAiB,CAAC,WAAW,CAChC;AAED,SAAO,KAAK,8BAA8B;GACxC,wBAAwB,kCAAkC,KAAK;GAC/D;GACD,CAAC;;;;;;;;;;;CAYJ,MAAM,gCACJ,SACiC;EACjC,MAAM,EAAE,SAAS,UAAU,GAAG,qBAAqB;EACnD,MAAM,mBAAmB,KAAK,gBAAgB,SAAS;EAEvD,MAAM,EAAE,SAAS,MAAM,KAAK,OAAO,KAIjC,iCACA,gDAAgD;GAC9C,GAAG;GACH,UAAU;GACX,CAAC,EACF,EAAE,iBAAiB,MAAM,CAC1B;AAED,SAAO,KAAK,8BAA8B;GACxC,wBAAwB,kCAAkC,KAAK;GAC/D;GACD,CAAC;;;;;;;CAQJ,MAAM,6BACJ,SACiC;EACjC,MAAM,EAAE,SAAS,UAAU,GAAG,qBAAqB;EACnD,MAAM,mBAAmB,KAAK,gBAAgB,SAAS;EACvD,MAAM,iBAAiB,CAAC,KAAK,OAAO;EAEpC,MAAM,OAAO,iBACT,yDAAyD;GACvD,GAAG;GACH,UAAU;GACX,CAAC,GACF,6CAA6C;GAC3C,GAAG;GACH,UAAU;GACV,cAAc,KAAK,OAAO;GAC3B,CAAC;EAEN,MAAM,EAAE,SAAS,MAAM,KAAK,OAAO,KAIjC,iCAAiC,MAAM,EACvC,iBAAiB,gBAClB,CAAC;AAEF,SAAO,KAAK,8BAA8B;GACxC,wBAAwB,kCAAkC,KAAK;GAC/D;GACD,CAAC;;CAGJ,MAAM,qBACJ,SACiC;EACjC,MAAM,EAAE,SAAS,UAAU,GAAG,qBAAqB;EACnD,MAAM,mBAAmB,KAAK,gBAAgB,SAAS;EAEvD,MAAM,EAAE,SAAS,MAAM,KAAK,OAAO,KAIjC,iCACA,qCAAqC;GACnC,GAAG;GACH,UAAU;GACV,cAAc,KAAK,OAAO;GAC3B,CAAC,CACH;AAED,SAAO,KAAK,8BAA8B;GACxC,wBAAwB,kCAAkC,KAAK;GAC/D;GACD,CAAC;;CAGJ,MAAM,kCACJ,SACiC;EACjC,MAAM,EAAE,SAAS,UAAU,GAAG,qBAAqB;EACnD,MAAM,mBAAmB,KAAK,gBAAgB,SAAS;EAEvD,MAAM,EAAE,SAAS,MAAM,KAAK,OAAO,KAIjC,iCACA,kDAAkD;GAChD,GAAG;GACH,UAAU;GACV,cAAc,KAAK,OAAO;GAC3B,CAAC,CACH;AAED,SAAO,KAAK,8BAA8B;GACxC,wBAAwB,kCAAkC,KAAK;GAC/D;GACD,CAAC;;CAGJ,MAAM,sCACJ,SACiC;EACjC,MAAM,EAAE,SAAS,UAAU,GAAG,qBAAqB;EACnD,MAAM,mBAAmB,KAAK,gBAAgB,SAAS;EAEvD,MAAM,EAAE,SAAS,MAAM,KAAK,OAAO,KAIjC,iCACA,sDAAsD;GACpD,GAAG;GACH,UAAU;GACV,cAAc,KAAK,OAAO;GAC3B,CAAC,CACH;AAED,SAAO,KAAK,8BAA8B;GACxC,wBAAwB,kCAAkC,KAAK;GAC/D;GACD,CAAC;;CAGJ,MAAM,8BAA8B,EAClC,aACA,iBAAiB,OAAO,yBAAyB,IAIjD;AACA,MAAI,CAAC,eACH,OAAM,IAAI,MAAM,8BAA8B;AAKhD,MAAI,CAFS,MAAM,KAAK,SAAS,CAG/B,OAAM,IAAI,MAAM,2CAA2C;EAG7D,MAAM,EAAE,cAAc,MAAM,SAAS;AAErC,MAAI,CAAC,YACH,QAAO;GACL,eAAe;GACf,QACE,2CAA2C;GAC9C;EAGH,MAAM,UAAU,MAAM,WAA8B,aAAa,EAC/D,UAAU,gBACX,CAAC;AAEF,MAAI,CAAC,QAAQ,YACX,QAAO;GACL,eAAe;GACf,QACE,2CAA2C;GAC9C;AAGH,MAAI,CAAE,MAAM,KAAK,WAAW,QAAQ,YAAY,CAC9C,QAAO;GACL,eAAe;GACf,QAAQ,2CAA2C;GACpD;EAGH,MAAM,EACJ,KAAK,WACL,QAAQ,gBACR,MACA,OACA,aACA,cACA,eAAe,iBACb,UAAuB,QAAQ,YAAY;AAE/C,SAAO;GACL,eAAe;GACf;GACA;GACA;GACA;GACA,MAAM,QAAQ;GACd;GACA;GACA;GACA,aAAa,QAAQ;GACrB,sBAAsB,QAAQ;GAC/B;;CAGH,MAAc,WAAW,aAAuC;EAC9D,MAAM,OAAO,MAAM,KAAK,SAAS;EACjC,MAAM,EAAE,cAAc,MAAM,SAAS;AACrC,MAAI,CAAC,KACH,OAAM,IAAI,MAAM,2CAA2C;AAG7D,MAAI;AACF,SAAM,UAAU,aAAa,KAAK;AAClC,UAAO;WACA,GAAG;AAGV,OACE,aAAa,SACb,UAAU,KACV,OAAO,EAAE,SAAS,aACjB,EAAE,KAAK,WAAW,WAAW,IAAI,EAAE,KAAK,WAAW,WAAW,EAE/D,QAAO;AAET,SAAM;;;CAIV,MAAc,8BAA8B,EAC1C,wBACA,WAIkC;AAClC,MAAI,SAAS,aAAa;AACxB,OAAI,CAAC,KAAK,OAAO,IACf,OAAM,IAAI,MACR,iKAGD;AAGH,UAAO;IACL,GAAG;IACH,eAAe,MAAM,KAAK,0CAA0C;KAClE;KACA,gBAAgB,QAAQ;KACzB,CAAC;IACH;;AAGH,SAAO;;CAGT,MAAc,0CAA0C,EACtD,wBACA,kBAIkB;AAClB,MAAI,CAAC,eACH,OAAM,IAAI,MAAM,8BAA8B;EAGhD,MAAM,EAAE,cAAc,MAAM,SAAS;EAErC,MAAM,EAAE,QAAQ,kCAAkC,UAChD,uBAAuB,YACxB;AAWD,SAAO,SATgC;GACrC,gBAAgB;GAChB,MAAM,uBAAuB;GAC7B,aAAa,uBAAuB;GACpC,cAAc,uBAAuB;GACrC,sBAAsB,uBAAuB;GAC7C,cAAc,uBAAuB;GACtC,EAE4B,EAC3B,UAAU,gBACX,CAAC;;CAGJ,MAAM,qBAAqB,EACzB,aACA,iBAAiB,OAAO,yBAAyB,IACe;AAChE,MAAI,CAAC,eACH,OAAM,IAAI,MAAM,8BAA8B;AAGhD,MAAI,YACF,QAAO,WAA8B,aAAa,EAChD,UAAU,gBACX,CAAC;;CAMN,MAAM,qBACJ,qBAC4B;EAC5B,MAAM,EAAE,SAAS,MAAM,KAAK,OAAO,IACjC,uCAAuC,sBACxC;AAED,SAAO,6BAA6B,KAAK;;CAG3C,MAAM,sBAAsB,EAC1B,UACwD;EACxD,MAAM,EAAE,SAAS,MAAM,KAAK,OAAO,KACjC,0BAA0B,OAAO,2BACjC,EAAE,CACH;AAED,SAAO,EAAE,MAAM,gBAAgB,KAAK,KAAK,EAAE;;CAG7C,MAAM,aAAa,aAAyC;EAC1D,MAAM,EAAE,SAAS,MAAM,KAAK,OAAO,IACjC,+BAA+B,cAChC;AAED,SAAO,qBAAqB,KAAK;;CAGnC,MAAM,gBAAgB,SAAqD;EACzE,MAAM,EAAE,SAAS,MAAM,KAAK,OAAO,KAIjC,+BACA,gCAAgC,EAC9B,GAAG,SACJ,CAAC,CACH;AAED,SAAO,qBAAqB,KAAK;;CAGnC,MAAM,YAAY,EAChB,MACA,UAC8C;EAC9C,MAAM,EAAE,SAAS,MAAM,KAAK,OAAO,KAGjC,0BAA0B,OAAO,8BAA8B,EAC/D,MACD,CAAC;AAEF,SAAO,EAAE,MAAM,gBAAgB,KAAK,KAAK,EAAE;;CAG7C,MAAM,iBAAiB,iBAAiD;EACtE,MAAM,EAAE,SAAS,MAAM,KAAK,OAAO,IACjC,mCAAmC,kBACpC;AAED,SAAO,yBAAyB,KAAK;;CAGvC,MAAM,oBACJ,SACwB;EACxB,MAAM,EAAE,SAAS,MAAM,KAAK,OAAO,KAIjC,mCACA,oCAAoC,EAClC,GAAG,SACJ,CAAC,CACH;AAED,SAAO,yBAAyB,KAAK;;CAGvC,MAAM,cAAc,SAAwD;EAC1E,MAAM,EAAE,SAAS,MAAM,KAAK,OAAO,KAIjC,2CACA,8BAA8B,QAAQ,CACvC;AAED,SAAO,EAAE,MAAM,gBAAgB,KAAK,KAAK,EAAE;;CAG7C,MAAM,WAAW,SAA2C;EAC1D,MAAM,EAAE,SAAS,MAAM,KAAK,OAAO,IACjC,0BAA0B,QAAQ,UAClC,2BAA2B,QAAQ,CACpC;AAED,SAAO,gBAAgB,KAAK;;CAG9B,MAAM,iBAAiB,SAGpB;EACD,MAAM,EAAE,SAAS,MAAM,KAAK,OAAO,KAIjC,0BAA0B,QAAQ,OAAO,gBACzC,iCAAiC,QAAQ,CAC1C;AAED,SAAO;GACL,sBAAsB,6BACpB,KAAK,sBACN;GACD,yBAAyB,qBACvB,KAAK,yBACN;GACF;;CAGH,MAAM,gBACJ,SACqD;EACrD,MAAM,EAAE,QAAQ,GAAG,kBAAkB;AACrC,SAAO,IAAI,gBACT,MAAM,oBACJ,KAAK,QACL,0BAA0B,OAAO,gBACjC,mBACA,cACD,GACA,WACC,oBACE,KAAK,QACL,0BAA0B,OAAO,gBACjC,mBACA,OACD,EACH,cACD;;CAGH,MAAM,qBACJ,SACuC;EACvC,MAAM,EAAE,QAAQ,GAAG,sBAAsB;AAEzC,SAAO,IAAI,gBACT,MAAM,oBACJ,KAAK,QACL,0BAA0B,OAAO,iBACjC,wBACA,kBACD,GACA,WACC,oBACE,KAAK,QACL,0BAA0B,OAAO,iBACjC,wBACA,OACD,EACH,kBACD;;CAGH,MAAM,aACJ,QACA,SACkE;AAClE,SAAO,IAAI,gBACT,MAAM,oBACJ,KAAK,QACL,0BAA0B,OAAO,YACjC,oBACA,UAAU,6BAA6B,QAAQ,GAAG,OACnD,GACA,WACC,oBACE,KAAK,QACL,0BAA0B,OAAO,YACjC,oBACA,OACD,EACH,UAAU,6BAA6B,QAAQ,GAAG,OACnD;;CAGH,MAAM,WAAW,QAAgB;AAC/B,QAAM,KAAK,OAAO,OAAO,0BAA0B,SAAS;;CAG9D,MAAM,kBAAkB,QAAqC;AAC3D,MAAI,CAAC,OACH,OAAM,IAAI,UAAU,kDAAkD;EAGxE,MAAM,EAAE,SAAS,MAAM,KAAK,OAAO,IACjC,0BAA0B,OAAO,aAClC;AAED,SAAO,sBAAsB,KAAK;;CAGpC,MAAM,0BACJ,0BACiC;EACjC,MAAM,EAAE,SAAS,MAAM,KAAK,OAAO,IACjC,6CAA6C,2BAC9C;AAED,SAAO,kCAAkC,KAAK;;CAGhD,MAAM,4BACJ,SAMA;EACA,MAAM,oBACJ,4CAA4C,QAAQ;AAEtD,SAAO,IAAI,gBACT,MAAM,oBAIJ,KAAK,QACL,6CACA,mCACA,kBACD,GACA,WACC,oBAIE,KAAK,QACL,6CACA,mCACA,OACD,EACH,kBACD;;CAGH,MAAM,6BACJ,SACiC;EACjC,MAAM,EAAE,SAAS,MAAM,KAAK,OAAO,KAIjC,6CACA,6CAA6C,QAAQ,CACtD;AAED,SAAO,kCAAkC,KAAK;;CAGhD,MAAM,6BACJ,0BACA,SACiC;EACjC,MAAM,EAAE,SAAS,MAAM,KAAK,OAAO,IAIjC,6CAA6C,4BAC7C,6CAA6C,QAAQ,CACtD;AAED,SAAO,kCAAkC,KAAK;;CAGhD,MAAM,6BACJ,0BACe;AACf,QAAM,KAAK,OAAO,OAChB,6CAA6C,2BAC9C;;CAGH,MAAM,iCACJ,0BACiC;EACjC,MAAM,EAAE,SAAS,MAAM,KAAK,OAAO,IACjC,6CAA6C,yBAAyB,cACtE,EAAE,CACH;AAED,SAAO,kCAAkC,KAAK;;CAGhD,MAAM,iCACJ,0BACiC;EACjC,MAAM,EAAE,SAAS,MAAM,KAAK,OAAO,IACjC,6CAA6C,yBAAyB,cACtE,EAAE,CACH;AAED,SAAO,kCAAkC,KAAK;;CAGhD,MAAM,cAAc,cAA2C;EAC7D,MAAM,EAAE,SAAS,MAAM,KAAK,OAAO,IACjC,gCAAgC,eACjC;AAED,SAAO,sBAAsB,KAAK;;CAGpC,MAAM,sBAAsB,iBAA8C;EACxE,MAAM,EAAE,SAAS,MAAM,KAAK,OAAO,IACjC,yCAAyC,kBAC1C;AAED,SAAO,sBAAsB,KAAK;;CAGpC,MAAM,gBACJ,SACwE;AACxE,SAAO,IAAI,gBACT,MAAM,oBACJ,KAAK,QACL,gCACA,uBACA,UAAU,gCAAgC,QAAQ,GAAG,OACtD,GACA,WACC,oBACE,KAAK,QACL,gCACA,uBACA,OACD,EACH,UAAU,gCAAgC,QAAQ,GAAG,OACtD;;CAGH,MAAM,eAAe,SAAqD;EACxE,MAAM,EAAE,SAAS,MAAM,KAAK,OAAO,KAIjC,gCACA,+BAA+B,EAC7B,GAAG,SACJ,CAAC,CACH;AAED,SAAO,sBAAsB,KAAK;;CAGpC,MAAM,iBAAiB,cAA2C;EAChE,MAAM,EAAE,SAAS,MAAM,KAAK,OAAO,KACjC,gCAAgC,aAAa,UAC7C,KACD;AAED,SAAO,sBAAsB,KAAK;;CAGpC,MAAM,iBAAiB,cAA2C;EAChE,MAAM,EAAE,SAAS,MAAM,KAAK,OAAO,KACjC,gCAAgC,aAAa,UAC7C,KACD;AAED,SAAO,sBAAsB,KAAK;;CAGpC,MAAM,iBAAiB,cAA2C;EAChE,MAAM,EAAE,SAAS,MAAM,KAAK,OAAO,KACjC,gCAAgC,aAAa,UAC7C,KACD;AAED,SAAO,sBAAsB,KAAK;;CAGpC,MAAM,cAAc,SAA8C;AAChE,QAAM,KAAK,OAAO,KAChB,oCACA,8BAA8B,QAAQ,CACvC;;;;;;;;;;;;CAaH,oBAAoB,SAAwD;EAC1E,MAAM,EACJ,cACA,eACA,qBACA,UACA,YACA,WACA,gBACA,UACA,qBACA,gBACA,QACA,aACA,OACA,eACE;EACJ,MAAM,mBAAmB,KAAK,gBAAgB,SAAS;AAEvD,MAAI,CAAC,YAAY,CAAC,gBAAgB,CAAC,eACjC,OAAM,IAAI,UACR,kGACD;AAGH,MAAI,aAAa,aAAa,WAC5B,OAAM,IAAI,UACR,wDACD;EAGH,MAAM,QAAQ,cAAc;GAC1B,eAAe;GACf,gBAAgB;GAChB,uBAAuB;GACvB,iBAAiB;GACjB,aAAa;GACb,YAAY;GACZ;GACA,uBAAuB;GACvB,iBAAiB;GACjB;GACA,WAAW;GACX,cAAc;GACd,eAAe;GACf;GACA,aAAa;GACd,CAAC;AAEF,SAAO,GAAG,KAAK,OAAO,QAAQ,6BAA6B;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA6B7D,MAAM,4BACJ,SAIqC;EACrC,MAAM,EACJ,UACA,cACA,YACA,WACA,gBACA,UACA,qBACA,gBACA,QACA,aACA,eACE;EACJ,MAAM,mBAAmB,KAAK,gBAAgB,SAAS;AAEvD,MAAI,CAAC,YAAY,CAAC,gBAAgB,CAAC,eACjC,OAAM,IAAI,UACR,kGACD;AAGH,MAAI,aAAa,aAAa,WAC5B,OAAM,IAAI,UACR,wDACD;EAIH,MAAM,OAAO,MAAM,KAAK,OAAO,KAAK,UAAU;EAG9C,MAAM,QAAQ,KAAK,OAAO,KAAK,qBAAqB,GAAG;EAEvD,MAAM,QAAQ,cAAc;GAC1B,eAAe;GACf,gBAAgB,KAAK;GACrB,uBAAuB;GACvB,iBAAiB;GACjB,aAAa;GACb,YAAY;GACZ;GACA,uBAAuB;GACvB,iBAAiB;GACjB;GACA,WAAW;GACX,cAAc;GACd,eAAe;GACf;GACA,aAAa;GACd,CAAC;AAIF,SAAO;GAAE,KAFG,GAAG,KAAK,OAAO,QAAQ,6BAA6B;GAElD;GAAO,cAAc,KAAK;GAAc;;CAGxD,aAAa,SAAmC;EAC9C,MAAM,EAAE,WAAW,aAAa;AAEhC,MAAI,CAAC,UACH,OAAM,IAAI,UAAU,qDAAqD;EAG3E,MAAM,MAAM,IAAI,IACd,oCACA,KAAK,OAAO,QACb;AAED,MAAI,aAAa,IAAI,cAAc,UAAU;AAC7C,MAAI,SACF,KAAI,aAAa,IAAI,aAAa,SAAS;AAG7C,SAAO,IAAI,UAAU;;CAGvB,WAAW,UAA0B;AACnC,MAAI,CAAC,SACH,OAAM,IAAI,UAAU,oCAAoC;AAG1D,SAAO,GAAG,KAAK,OAAO,QAAQ,YAAY"}

package/lib/vault/vault.cjs

@@ -41,6 +41,10 @@ var Vault = class {
 		const { data } = await this.workos.get(`/vault/v1/kv/${encodeURIComponent(options.id)}`);
 		return require_vault_serializers_vault_object_serializer.deserializeObject(data);
 	}
+	async readObjectByName(name) {
+		const { data } = await this.workos.get(`/vault/v1/kv/name/${encodeURIComponent(name)}`);
+		return require_vault_serializers_vault_object_serializer.deserializeObject(data);
+	}
 	async describeObject(options) {
 		const { data } = await this.workos.get(`/vault/v1/kv/${encodeURIComponent(options.id)}/metadata`);
 		return require_vault_serializers_vault_object_serializer.deserializeObject(data);

package/lib/vault/vault.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"vault.cjs","names":["workos: WorkOS","base64ToUint8Array","decodeUInt32","uint8ArrayToBase64","serializeCreateObjectEntity","deserializeObjectMetadata","deserializeListObjects","desrializeListObjectVersions","deserializeObject","serializeUpdateObjectEntity","deserializeCreateDataKeyResponse","deserializeDecryptDataKeyResponse","encodeUInt32"],"sources":["../../src/vault/vault.ts"],"sourcesContent":["import { decodeUInt32, encodeUInt32 } from '../common/utils/leb128';\nimport { CryptoProvider } from '../common/crypto/crypto-provider';\nimport { List, ListResponse } from '../common/interfaces';\nimport { PaginationOptions } from '../index.worker';\nimport { base64ToUint8Array, uint8ArrayToBase64 } from '../common/utils/base64';\nimport type { WorkOS } from '../workos';\nimport {\n  CreateDataKeyOptions,\n  CreateDataKeyResponse,\n  CreateObjectOptions,\n  DataKey,\n  DataKeyPair,\n  DecryptDataKeyOptions,\n  DecryptDataKeyResponse,\n  DeleteObjectOptions,\n  KeyContext,\n  ListObjectVersionsResponse,\n  ObjectDigest,\n  ObjectDigestResponse,\n  ObjectMetadata,\n  ObjectVersion,\n  ReadObjectMetadataResponse,\n  ReadObjectOptions,\n  ReadObjectResponse,\n  UpdateObjectOptions,\n  VaultObject,\n} from './interfaces';\nimport {\n  deserializeCreateDataKeyResponse,\n  deserializeDecryptDataKeyResponse,\n} from './serializers/vault-key.serializer';\nimport {\n  deserializeListObjects,\n  deserializeObject,\n  deserializeObjectMetadata,\n  desrializeListObjectVersions,\n  serializeCreateObjectEntity,\n  serializeUpdateObjectEntity,\n} from './serializers/vault-object.serializer';\n\ninterface Decoded {\n  iv: Uint8Array;\n  tag: Uint8Array;\n  keys: string;\n  ciphertext: Uint8Array;\n}\n\nexport class Vault {\n  private cryptoProvider: CryptoProvider;\n\n  constructor(private readonly workos: WorkOS) {\n    this.cryptoProvider = workos.getCryptoProvider();\n  }\n\n  private decode(payload: string): Decoded {\n    const inputData = base64ToUint8Array(payload);\n    // Use 12 bytes for IV (standard for AES-GCM)\n    const iv = new Uint8Array(inputData.subarray(0, 12));\n    const tag = new Uint8Array(inputData.subarray(12, 28));\n    const { value: keyLen, nextIndex } = decodeUInt32(inputData, 28);\n\n    // Use subarray instead of slice and convert directly to base64\n    const keysBuffer = inputData.subarray(nextIndex, nextIndex + keyLen);\n    const keys = uint8ArrayToBase64(keysBuffer);\n\n    const ciphertext = new Uint8Array(inputData.subarray(nextIndex + keyLen));\n\n    return {\n      iv,\n      tag,\n      keys,\n      ciphertext,\n    };\n  }\n\n  async createObject(options: CreateObjectOptions): Promise<ObjectMetadata> {\n    const { data } = await this.workos.post<ReadObjectMetadataResponse>(\n      `/vault/v1/kv`,\n      serializeCreateObjectEntity(options),\n    );\n    return deserializeObjectMetadata(data);\n  }\n\n  async listObjects(\n    options?: PaginationOptions | undefined,\n  ): Promise<List<ObjectDigest>> {\n    const url = new URL('/vault/v1/kv', this.workos.baseURL);\n    if (options?.after) {\n      url.searchParams.set('after', options.after);\n    }\n    if (options?.limit) {\n      url.searchParams.set('limit', options.limit.toString());\n    }\n\n    const { data } = await this.workos.get<ListResponse<ObjectDigestResponse>>(\n      url.toString(),\n    );\n    return deserializeListObjects(data);\n  }\n\n  async listObjectVersions(\n    options: ReadObjectOptions,\n  ): Promise<ObjectVersion[]> {\n    const { data } = await this.workos.get<ListObjectVersionsResponse>(\n      `/vault/v1/kv/${encodeURIComponent(options.id)}/versions`,\n    );\n    return desrializeListObjectVersions(data);\n  }\n\n  async readObject(options: ReadObjectOptions): Promise<VaultObject> {\n    const { data } = await this.workos.get<ReadObjectResponse>(\n      `/vault/v1/kv/${encodeURIComponent(options.id)}`,\n    );\n    return deserializeObject(data);\n  }\n\n  async describeObject(options: ReadObjectOptions): Promise<VaultObject> {\n    const { data } = await this.workos.get<ReadObjectResponse>(\n      `/vault/v1/kv/${encodeURIComponent(options.id)}/metadata`,\n    );\n    return deserializeObject(data);\n  }\n\n  async updateObject(options: UpdateObjectOptions): Promise<VaultObject> {\n    const { data } = await this.workos.put<ReadObjectResponse>(\n      `/vault/v1/kv/${encodeURIComponent(options.id)}`,\n      serializeUpdateObjectEntity(options),\n    );\n    return deserializeObject(data);\n  }\n\n  async deleteObject(options: DeleteObjectOptions): Promise<void> {\n    return this.workos.delete(`/vault/v1/kv/${encodeURIComponent(options.id)}`);\n  }\n\n  async createDataKey(options: CreateDataKeyOptions): Promise<DataKeyPair> {\n    const { data } = await this.workos.post<CreateDataKeyResponse>(\n      `/vault/v1/keys/data-key`,\n      options,\n    );\n    return deserializeCreateDataKeyResponse(data);\n  }\n\n  async decryptDataKey(options: DecryptDataKeyOptions): Promise<DataKey> {\n    const { data } = await this.workos.post<DecryptDataKeyResponse>(\n      `/vault/v1/keys/decrypt`,\n      options,\n    );\n    return deserializeDecryptDataKeyResponse(data);\n  }\n\n  async encrypt(\n    data: string,\n    context: KeyContext,\n    associatedData?: string,\n  ): Promise<string> {\n    const keyPair = await this.createDataKey({\n      context,\n    });\n\n    // Convert base64 key to Uint8Array\n    const encoder = new TextEncoder();\n\n    // Use our cross-runtime base64 utility\n    const key = base64ToUint8Array(keyPair.dataKey.key);\n    const keyBlob = base64ToUint8Array(keyPair.encryptedKeys);\n\n    const prefixLenBuffer = encodeUInt32(keyBlob.length);\n    const aadBuffer = associatedData\n      ? encoder.encode(associatedData)\n      : undefined;\n\n    // Use a 12-byte IV for AES-GCM (industry standard)\n    const iv = this.cryptoProvider.randomBytes(12);\n\n    const {\n      ciphertext,\n      iv: resultIv,\n      tag,\n    } = await this.cryptoProvider.encrypt(\n      encoder.encode(data),\n      key,\n      iv,\n      aadBuffer,\n    );\n\n    // Concatenate all parts into a single array\n    const resultArray = new Uint8Array(\n      resultIv.length +\n        tag.length +\n        prefixLenBuffer.length +\n        keyBlob.length +\n        ciphertext.length,\n    );\n\n    let offset = 0;\n    resultArray.set(resultIv, offset);\n    offset += resultIv.length;\n\n    resultArray.set(tag, offset);\n    offset += tag.length;\n\n    resultArray.set(new Uint8Array(prefixLenBuffer), offset);\n    offset += prefixLenBuffer.length;\n\n    resultArray.set(keyBlob, offset);\n    offset += keyBlob.length;\n\n    resultArray.set(ciphertext, offset);\n\n    // Convert to base64 using our cross-runtime utility\n    return uint8ArrayToBase64(resultArray);\n  }\n\n  async decrypt(\n    encryptedData: string,\n    associatedData?: string,\n  ): Promise<string> {\n    const decoded = this.decode(encryptedData);\n    const dataKey = await this.decryptDataKey({ keys: decoded.keys });\n\n    // Convert base64 key to Uint8Array using our cross-runtime utility\n    const key = base64ToUint8Array(dataKey.key);\n\n    const encoder = new TextEncoder();\n    const aadBuffer = associatedData\n      ? encoder.encode(associatedData)\n      : undefined;\n\n    const decrypted = await this.cryptoProvider.decrypt(\n      decoded.ciphertext,\n      key,\n      decoded.iv,\n      decoded.tag,\n      aadBuffer,\n    );\n\n    return new TextDecoder().decode(decrypted);\n  }\n}\n"],"mappings":";;;;;;AA+CA,IAAa,QAAb,MAAmB;CACjB,AAAQ;CAER,YAAY,AAAiBA,QAAgB;EAAhB;AAC3B,OAAK,iBAAiB,OAAO,mBAAmB;;CAGlD,AAAQ,OAAO,SAA0B;EACvC,MAAM,YAAYC,+CAAmB,QAAQ;EAE7C,MAAM,KAAK,IAAI,WAAW,UAAU,SAAS,GAAG,GAAG,CAAC;EACpD,MAAM,MAAM,IAAI,WAAW,UAAU,SAAS,IAAI,GAAG,CAAC;EACtD,MAAM,EAAE,OAAO,QAAQ,cAAcC,yCAAa,WAAW,GAAG;AAQhE,SAAO;GACL;GACA;GACA,MAPWC,+CADM,UAAU,SAAS,WAAW,YAAY,OAAO,CACzB;GAQzC,YANiB,IAAI,WAAW,UAAU,SAAS,YAAY,OAAO,CAAC;GAOxE;;CAGH,MAAM,aAAa,SAAuD;EACxE,MAAM,EAAE,SAAS,MAAM,KAAK,OAAO,KACjC,gBACAC,8EAA4B,QAAQ,CACrC;AACD,SAAOC,4EAA0B,KAAK;;CAGxC,MAAM,YACJ,SAC6B;EAC7B,MAAM,MAAM,IAAI,IAAI,gBAAgB,KAAK,OAAO,QAAQ;AACxD,MAAI,SAAS,MACX,KAAI,aAAa,IAAI,SAAS,QAAQ,MAAM;AAE9C,MAAI,SAAS,MACX,KAAI,aAAa,IAAI,SAAS,QAAQ,MAAM,UAAU,CAAC;EAGzD,MAAM,EAAE,SAAS,MAAM,KAAK,OAAO,IACjC,IAAI,UAAU,CACf;AACD,SAAOC,yEAAuB,KAAK;;CAGrC,MAAM,mBACJ,SAC0B;EAC1B,MAAM,EAAE,SAAS,MAAM,KAAK,OAAO,IACjC,gBAAgB,mBAAmB,QAAQ,GAAG,CAAC,WAChD;AACD,SAAOC,+EAA6B,KAAK;;CAG3C,MAAM,WAAW,SAAkD;EACjE,MAAM,EAAE,SAAS,MAAM,KAAK,OAAO,IACjC,gBAAgB,mBAAmB,QAAQ,GAAG,GAC/C;AACD,SAAOC,oEAAkB,KAAK;;CAGhC,MAAM,eAAe,SAAkD;EACrE,MAAM,EAAE,SAAS,MAAM,KAAK,OAAO,IACjC,gBAAgB,mBAAmB,QAAQ,GAAG,CAAC,WAChD;AACD,SAAOA,oEAAkB,KAAK;;CAGhC,MAAM,aAAa,SAAoD;EACrE,MAAM,EAAE,SAAS,MAAM,KAAK,OAAO,IACjC,gBAAgB,mBAAmB,QAAQ,GAAG,IAC9CC,8EAA4B,QAAQ,CACrC;AACD,SAAOD,oEAAkB,KAAK;;CAGhC,MAAM,aAAa,SAA6C;AAC9D,SAAO,KAAK,OAAO,OAAO,gBAAgB,mBAAmB,QAAQ,GAAG,GAAG;;CAG7E,MAAM,cAAc,SAAqD;EACvE,MAAM,EAAE,SAAS,MAAM,KAAK,OAAO,KACjC,2BACA,QACD;AACD,SAAOE,gFAAiC,KAAK;;CAG/C,MAAM,eAAe,SAAkD;EACrE,MAAM,EAAE,SAAS,MAAM,KAAK,OAAO,KACjC,0BACA,QACD;AACD,SAAOC,iFAAkC,KAAK;;CAGhD,MAAM,QACJ,MACA,SACA,gBACiB;EACjB,MAAM,UAAU,MAAM,KAAK,cAAc,EACvC,SACD,CAAC;EAGF,MAAM,UAAU,IAAI,aAAa;EAGjC,MAAM,MAAMV,+CAAmB,QAAQ,QAAQ,IAAI;EACnD,MAAM,UAAUA,+CAAmB,QAAQ,cAAc;EAEzD,MAAM,kBAAkBW,yCAAa,QAAQ,OAAO;EACpD,MAAM,YAAY,iBACd,QAAQ,OAAO,eAAe,GAC9B;EAGJ,MAAM,KAAK,KAAK,eAAe,YAAY,GAAG;EAE9C,MAAM,EACJ,YACA,IAAI,UACJ,QACE,MAAM,KAAK,eAAe,QAC5B,QAAQ,OAAO,KAAK,EACpB,KACA,IACA,UACD;EAGD,MAAM,cAAc,IAAI,WACtB,SAAS,SACP,IAAI,SACJ,gBAAgB,SAChB,QAAQ,SACR,WAAW,OACd;EAED,IAAI,SAAS;AACb,cAAY,IAAI,UAAU,OAAO;AACjC,YAAU,SAAS;AAEnB,cAAY,IAAI,KAAK,OAAO;AAC5B,YAAU,IAAI;AAEd,cAAY,IAAI,IAAI,WAAW,gBAAgB,EAAE,OAAO;AACxD,YAAU,gBAAgB;AAE1B,cAAY,IAAI,SAAS,OAAO;AAChC,YAAU,QAAQ;AAElB,cAAY,IAAI,YAAY,OAAO;AAGnC,SAAOT,+CAAmB,YAAY;;CAGxC,MAAM,QACJ,eACA,gBACiB;EACjB,MAAM,UAAU,KAAK,OAAO,cAAc;EAI1C,MAAM,MAAMF,gDAHI,MAAM,KAAK,eAAe,EAAE,MAAM,QAAQ,MAAM,CAAC,EAG1B,IAAI;EAE3C,MAAM,UAAU,IAAI,aAAa;EACjC,MAAM,YAAY,iBACd,QAAQ,OAAO,eAAe,GAC9B;EAEJ,MAAM,YAAY,MAAM,KAAK,eAAe,QAC1C,QAAQ,YACR,KACA,QAAQ,IACR,QAAQ,KACR,UACD;AAED,SAAO,IAAI,aAAa,CAAC,OAAO,UAAU"}
+{"version":3,"file":"vault.cjs","names":["workos: WorkOS","base64ToUint8Array","decodeUInt32","uint8ArrayToBase64","serializeCreateObjectEntity","deserializeObjectMetadata","deserializeListObjects","desrializeListObjectVersions","deserializeObject","serializeUpdateObjectEntity","deserializeCreateDataKeyResponse","deserializeDecryptDataKeyResponse","encodeUInt32"],"sources":["../../src/vault/vault.ts"],"sourcesContent":["import { decodeUInt32, encodeUInt32 } from '../common/utils/leb128';\nimport { CryptoProvider } from '../common/crypto/crypto-provider';\nimport { List, ListResponse } from '../common/interfaces';\nimport { PaginationOptions } from '../index.worker';\nimport { base64ToUint8Array, uint8ArrayToBase64 } from '../common/utils/base64';\nimport type { WorkOS } from '../workos';\nimport {\n  CreateDataKeyOptions,\n  CreateDataKeyResponse,\n  CreateObjectOptions,\n  DataKey,\n  DataKeyPair,\n  DecryptDataKeyOptions,\n  DecryptDataKeyResponse,\n  DeleteObjectOptions,\n  KeyContext,\n  ListObjectVersionsResponse,\n  ObjectDigest,\n  ObjectDigestResponse,\n  ObjectMetadata,\n  ObjectVersion,\n  ReadObjectMetadataResponse,\n  ReadObjectOptions,\n  ReadObjectResponse,\n  UpdateObjectOptions,\n  VaultObject,\n} from './interfaces';\nimport {\n  deserializeCreateDataKeyResponse,\n  deserializeDecryptDataKeyResponse,\n} from './serializers/vault-key.serializer';\nimport {\n  deserializeListObjects,\n  deserializeObject,\n  deserializeObjectMetadata,\n  desrializeListObjectVersions,\n  serializeCreateObjectEntity,\n  serializeUpdateObjectEntity,\n} from './serializers/vault-object.serializer';\n\ninterface Decoded {\n  iv: Uint8Array;\n  tag: Uint8Array;\n  keys: string;\n  ciphertext: Uint8Array;\n}\n\nexport class Vault {\n  private cryptoProvider: CryptoProvider;\n\n  constructor(private readonly workos: WorkOS) {\n    this.cryptoProvider = workos.getCryptoProvider();\n  }\n\n  private decode(payload: string): Decoded {\n    const inputData = base64ToUint8Array(payload);\n    // Use 12 bytes for IV (standard for AES-GCM)\n    const iv = new Uint8Array(inputData.subarray(0, 12));\n    const tag = new Uint8Array(inputData.subarray(12, 28));\n    const { value: keyLen, nextIndex } = decodeUInt32(inputData, 28);\n\n    // Use subarray instead of slice and convert directly to base64\n    const keysBuffer = inputData.subarray(nextIndex, nextIndex + keyLen);\n    const keys = uint8ArrayToBase64(keysBuffer);\n\n    const ciphertext = new Uint8Array(inputData.subarray(nextIndex + keyLen));\n\n    return {\n      iv,\n      tag,\n      keys,\n      ciphertext,\n    };\n  }\n\n  async createObject(options: CreateObjectOptions): Promise<ObjectMetadata> {\n    const { data } = await this.workos.post<ReadObjectMetadataResponse>(\n      `/vault/v1/kv`,\n      serializeCreateObjectEntity(options),\n    );\n    return deserializeObjectMetadata(data);\n  }\n\n  async listObjects(\n    options?: PaginationOptions | undefined,\n  ): Promise<List<ObjectDigest>> {\n    const url = new URL('/vault/v1/kv', this.workos.baseURL);\n    if (options?.after) {\n      url.searchParams.set('after', options.after);\n    }\n    if (options?.limit) {\n      url.searchParams.set('limit', options.limit.toString());\n    }\n\n    const { data } = await this.workos.get<ListResponse<ObjectDigestResponse>>(\n      url.toString(),\n    );\n    return deserializeListObjects(data);\n  }\n\n  async listObjectVersions(\n    options: ReadObjectOptions,\n  ): Promise<ObjectVersion[]> {\n    const { data } = await this.workos.get<ListObjectVersionsResponse>(\n      `/vault/v1/kv/${encodeURIComponent(options.id)}/versions`,\n    );\n    return desrializeListObjectVersions(data);\n  }\n\n  async readObject(options: ReadObjectOptions): Promise<VaultObject> {\n    const { data } = await this.workos.get<ReadObjectResponse>(\n      `/vault/v1/kv/${encodeURIComponent(options.id)}`,\n    );\n    return deserializeObject(data);\n  }\n\n  async readObjectByName(name: string): Promise<VaultObject> {\n    const { data } = await this.workos.get<ReadObjectResponse>(\n      `/vault/v1/kv/name/${encodeURIComponent(name)}`,\n    );\n    return deserializeObject(data);\n  }\n\n  async describeObject(options: ReadObjectOptions): Promise<VaultObject> {\n    const { data } = await this.workos.get<ReadObjectResponse>(\n      `/vault/v1/kv/${encodeURIComponent(options.id)}/metadata`,\n    );\n    return deserializeObject(data);\n  }\n\n  async updateObject(options: UpdateObjectOptions): Promise<VaultObject> {\n    const { data } = await this.workos.put<ReadObjectResponse>(\n      `/vault/v1/kv/${encodeURIComponent(options.id)}`,\n      serializeUpdateObjectEntity(options),\n    );\n    return deserializeObject(data);\n  }\n\n  async deleteObject(options: DeleteObjectOptions): Promise<void> {\n    return this.workos.delete(`/vault/v1/kv/${encodeURIComponent(options.id)}`);\n  }\n\n  async createDataKey(options: CreateDataKeyOptions): Promise<DataKeyPair> {\n    const { data } = await this.workos.post<CreateDataKeyResponse>(\n      `/vault/v1/keys/data-key`,\n      options,\n    );\n    return deserializeCreateDataKeyResponse(data);\n  }\n\n  async decryptDataKey(options: DecryptDataKeyOptions): Promise<DataKey> {\n    const { data } = await this.workos.post<DecryptDataKeyResponse>(\n      `/vault/v1/keys/decrypt`,\n      options,\n    );\n    return deserializeDecryptDataKeyResponse(data);\n  }\n\n  async encrypt(\n    data: string,\n    context: KeyContext,\n    associatedData?: string,\n  ): Promise<string> {\n    const keyPair = await this.createDataKey({\n      context,\n    });\n\n    // Convert base64 key to Uint8Array\n    const encoder = new TextEncoder();\n\n    // Use our cross-runtime base64 utility\n    const key = base64ToUint8Array(keyPair.dataKey.key);\n    const keyBlob = base64ToUint8Array(keyPair.encryptedKeys);\n\n    const prefixLenBuffer = encodeUInt32(keyBlob.length);\n    const aadBuffer = associatedData\n      ? encoder.encode(associatedData)\n      : undefined;\n\n    // Use a 12-byte IV for AES-GCM (industry standard)\n    const iv = this.cryptoProvider.randomBytes(12);\n\n    const {\n      ciphertext,\n      iv: resultIv,\n      tag,\n    } = await this.cryptoProvider.encrypt(\n      encoder.encode(data),\n      key,\n      iv,\n      aadBuffer,\n    );\n\n    // Concatenate all parts into a single array\n    const resultArray = new Uint8Array(\n      resultIv.length +\n        tag.length +\n        prefixLenBuffer.length +\n        keyBlob.length +\n        ciphertext.length,\n    );\n\n    let offset = 0;\n    resultArray.set(resultIv, offset);\n    offset += resultIv.length;\n\n    resultArray.set(tag, offset);\n    offset += tag.length;\n\n    resultArray.set(new Uint8Array(prefixLenBuffer), offset);\n    offset += prefixLenBuffer.length;\n\n    resultArray.set(keyBlob, offset);\n    offset += keyBlob.length;\n\n    resultArray.set(ciphertext, offset);\n\n    // Convert to base64 using our cross-runtime utility\n    return uint8ArrayToBase64(resultArray);\n  }\n\n  async decrypt(\n    encryptedData: string,\n    associatedData?: string,\n  ): Promise<string> {\n    const decoded = this.decode(encryptedData);\n    const dataKey = await this.decryptDataKey({ keys: decoded.keys });\n\n    // Convert base64 key to Uint8Array using our cross-runtime utility\n    const key = base64ToUint8Array(dataKey.key);\n\n    const encoder = new TextEncoder();\n    const aadBuffer = associatedData\n      ? encoder.encode(associatedData)\n      : undefined;\n\n    const decrypted = await this.cryptoProvider.decrypt(\n      decoded.ciphertext,\n      key,\n      decoded.iv,\n      decoded.tag,\n      aadBuffer,\n    );\n\n    return new TextDecoder().decode(decrypted);\n  }\n}\n"],"mappings":";;;;;;AA+CA,IAAa,QAAb,MAAmB;CACjB,AAAQ;CAER,YAAY,AAAiBA,QAAgB;EAAhB;AAC3B,OAAK,iBAAiB,OAAO,mBAAmB;;CAGlD,AAAQ,OAAO,SAA0B;EACvC,MAAM,YAAYC,+CAAmB,QAAQ;EAE7C,MAAM,KAAK,IAAI,WAAW,UAAU,SAAS,GAAG,GAAG,CAAC;EACpD,MAAM,MAAM,IAAI,WAAW,UAAU,SAAS,IAAI,GAAG,CAAC;EACtD,MAAM,EAAE,OAAO,QAAQ,cAAcC,yCAAa,WAAW,GAAG;AAQhE,SAAO;GACL;GACA;GACA,MAPWC,+CADM,UAAU,SAAS,WAAW,YAAY,OAAO,CACzB;GAQzC,YANiB,IAAI,WAAW,UAAU,SAAS,YAAY,OAAO,CAAC;GAOxE;;CAGH,MAAM,aAAa,SAAuD;EACxE,MAAM,EAAE,SAAS,MAAM,KAAK,OAAO,KACjC,gBACAC,8EAA4B,QAAQ,CACrC;AACD,SAAOC,4EAA0B,KAAK;;CAGxC,MAAM,YACJ,SAC6B;EAC7B,MAAM,MAAM,IAAI,IAAI,gBAAgB,KAAK,OAAO,QAAQ;AACxD,MAAI,SAAS,MACX,KAAI,aAAa,IAAI,SAAS,QAAQ,MAAM;AAE9C,MAAI,SAAS,MACX,KAAI,aAAa,IAAI,SAAS,QAAQ,MAAM,UAAU,CAAC;EAGzD,MAAM,EAAE,SAAS,MAAM,KAAK,OAAO,IACjC,IAAI,UAAU,CACf;AACD,SAAOC,yEAAuB,KAAK;;CAGrC,MAAM,mBACJ,SAC0B;EAC1B,MAAM,EAAE,SAAS,MAAM,KAAK,OAAO,IACjC,gBAAgB,mBAAmB,QAAQ,GAAG,CAAC,WAChD;AACD,SAAOC,+EAA6B,KAAK;;CAG3C,MAAM,WAAW,SAAkD;EACjE,MAAM,EAAE,SAAS,MAAM,KAAK,OAAO,IACjC,gBAAgB,mBAAmB,QAAQ,GAAG,GAC/C;AACD,SAAOC,oEAAkB,KAAK;;CAGhC,MAAM,iBAAiB,MAAoC;EACzD,MAAM,EAAE,SAAS,MAAM,KAAK,OAAO,IACjC,qBAAqB,mBAAmB,KAAK,GAC9C;AACD,SAAOA,oEAAkB,KAAK;;CAGhC,MAAM,eAAe,SAAkD;EACrE,MAAM,EAAE,SAAS,MAAM,KAAK,OAAO,IACjC,gBAAgB,mBAAmB,QAAQ,GAAG,CAAC,WAChD;AACD,SAAOA,oEAAkB,KAAK;;CAGhC,MAAM,aAAa,SAAoD;EACrE,MAAM,EAAE,SAAS,MAAM,KAAK,OAAO,IACjC,gBAAgB,mBAAmB,QAAQ,GAAG,IAC9CC,8EAA4B,QAAQ,CACrC;AACD,SAAOD,oEAAkB,KAAK;;CAGhC,MAAM,aAAa,SAA6C;AAC9D,SAAO,KAAK,OAAO,OAAO,gBAAgB,mBAAmB,QAAQ,GAAG,GAAG;;CAG7E,MAAM,cAAc,SAAqD;EACvE,MAAM,EAAE,SAAS,MAAM,KAAK,OAAO,KACjC,2BACA,QACD;AACD,SAAOE,gFAAiC,KAAK;;CAG/C,MAAM,eAAe,SAAkD;EACrE,MAAM,EAAE,SAAS,MAAM,KAAK,OAAO,KACjC,0BACA,QACD;AACD,SAAOC,iFAAkC,KAAK;;CAGhD,MAAM,QACJ,MACA,SACA,gBACiB;EACjB,MAAM,UAAU,MAAM,KAAK,cAAc,EACvC,SACD,CAAC;EAGF,MAAM,UAAU,IAAI,aAAa;EAGjC,MAAM,MAAMV,+CAAmB,QAAQ,QAAQ,IAAI;EACnD,MAAM,UAAUA,+CAAmB,QAAQ,cAAc;EAEzD,MAAM,kBAAkBW,yCAAa,QAAQ,OAAO;EACpD,MAAM,YAAY,iBACd,QAAQ,OAAO,eAAe,GAC9B;EAGJ,MAAM,KAAK,KAAK,eAAe,YAAY,GAAG;EAE9C,MAAM,EACJ,YACA,IAAI,UACJ,QACE,MAAM,KAAK,eAAe,QAC5B,QAAQ,OAAO,KAAK,EACpB,KACA,IACA,UACD;EAGD,MAAM,cAAc,IAAI,WACtB,SAAS,SACP,IAAI,SACJ,gBAAgB,SAChB,QAAQ,SACR,WAAW,OACd;EAED,IAAI,SAAS;AACb,cAAY,IAAI,UAAU,OAAO;AACjC,YAAU,SAAS;AAEnB,cAAY,IAAI,KAAK,OAAO;AAC5B,YAAU,IAAI;AAEd,cAAY,IAAI,IAAI,WAAW,gBAAgB,EAAE,OAAO;AACxD,YAAU,gBAAgB;AAE1B,cAAY,IAAI,SAAS,OAAO;AAChC,YAAU,QAAQ;AAElB,cAAY,IAAI,YAAY,OAAO;AAGnC,SAAOT,+CAAmB,YAAY;;CAGxC,MAAM,QACJ,eACA,gBACiB;EACjB,MAAM,UAAU,KAAK,OAAO,cAAc;EAI1C,MAAM,MAAMF,gDAHI,MAAM,KAAK,eAAe,EAAE,MAAM,QAAQ,MAAM,CAAC,EAG1B,IAAI;EAE3C,MAAM,UAAU,IAAI,aAAa;EACjC,MAAM,YAAY,iBACd,QAAQ,OAAO,eAAe,GAC9B;EAEJ,MAAM,YAAY,MAAM,KAAK,eAAe,QAC1C,QAAQ,YACR,KACA,QAAQ,IACR,QAAQ,KACR,UACD;AAED,SAAO,IAAI,aAAa,CAAC,OAAO,UAAU"}

package/lib/vault/vault.d.cts

@@ -20,6 +20,7 @@ declare class Vault {
   listObjects(options?: PaginationOptions | undefined): Promise<List<ObjectDigest>>;
   listObjectVersions(options: ReadObjectOptions): Promise<ObjectVersion[]>;
   readObject(options: ReadObjectOptions): Promise<VaultObject>;
+  readObjectByName(name: string): Promise<VaultObject>;
   describeObject(options: ReadObjectOptions): Promise<VaultObject>;
   updateObject(options: UpdateObjectOptions): Promise<VaultObject>;
   deleteObject(options: DeleteObjectOptions): Promise<void>;