@workos-inc/node 8.0.0-rc.6 → 8.0.0-rc.8

package/lib/vault/vault.d.ts

@@ -21,6 +21,7 @@ declare class Vault {
   listObjects(options?: PaginationOptions | undefined): Promise<List<ObjectDigest>>;
   listObjectVersions(options: ReadObjectOptions): Promise<ObjectVersion[]>;
   readObject(options: ReadObjectOptions): Promise<VaultObject>;
+  readObjectByName(name: string): Promise<VaultObject>;
   describeObject(options: ReadObjectOptions): Promise<VaultObject>;
   updateObject(options: UpdateObjectOptions): Promise<VaultObject>;
   deleteObject(options: DeleteObjectOptions): Promise<void>;

package/lib/vault/vault.js

@@ -41,6 +41,10 @@ var Vault = class {
 		const { data } = await this.workos.get(`/vault/v1/kv/${encodeURIComponent(options.id)}`);
 		return deserializeObject(data);
 	}
+	async readObjectByName(name) {
+		const { data } = await this.workos.get(`/vault/v1/kv/name/${encodeURIComponent(name)}`);
+		return deserializeObject(data);
+	}
 	async describeObject(options) {
 		const { data } = await this.workos.get(`/vault/v1/kv/${encodeURIComponent(options.id)}/metadata`);
 		return deserializeObject(data);

package/lib/vault/vault.js.map

@@ -1 +1 @@
-{"version":3,"file":"vault.js","names":["workos: WorkOS"],"sources":["../../src/vault/vault.ts"],"sourcesContent":["import { decodeUInt32, encodeUInt32 } from '../common/utils/leb128';\nimport { CryptoProvider } from '../common/crypto/crypto-provider';\nimport { List, ListResponse } from '../common/interfaces';\nimport { PaginationOptions } from '../index.worker';\nimport { base64ToUint8Array, uint8ArrayToBase64 } from '../common/utils/base64';\nimport type { WorkOS } from '../workos';\nimport {\n  CreateDataKeyOptions,\n  CreateDataKeyResponse,\n  CreateObjectOptions,\n  DataKey,\n  DataKeyPair,\n  DecryptDataKeyOptions,\n  DecryptDataKeyResponse,\n  DeleteObjectOptions,\n  KeyContext,\n  ListObjectVersionsResponse,\n  ObjectDigest,\n  ObjectDigestResponse,\n  ObjectMetadata,\n  ObjectVersion,\n  ReadObjectMetadataResponse,\n  ReadObjectOptions,\n  ReadObjectResponse,\n  UpdateObjectOptions,\n  VaultObject,\n} from './interfaces';\nimport {\n  deserializeCreateDataKeyResponse,\n  deserializeDecryptDataKeyResponse,\n} from './serializers/vault-key.serializer';\nimport {\n  deserializeListObjects,\n  deserializeObject,\n  deserializeObjectMetadata,\n  desrializeListObjectVersions,\n  serializeCreateObjectEntity,\n  serializeUpdateObjectEntity,\n} from './serializers/vault-object.serializer';\n\ninterface Decoded {\n  iv: Uint8Array;\n  tag: Uint8Array;\n  keys: string;\n  ciphertext: Uint8Array;\n}\n\nexport class Vault {\n  private cryptoProvider: CryptoProvider;\n\n  constructor(private readonly workos: WorkOS) {\n    this.cryptoProvider = workos.getCryptoProvider();\n  }\n\n  private decode(payload: string): Decoded {\n    const inputData = base64ToUint8Array(payload);\n    // Use 12 bytes for IV (standard for AES-GCM)\n    const iv = new Uint8Array(inputData.subarray(0, 12));\n    const tag = new Uint8Array(inputData.subarray(12, 28));\n    const { value: keyLen, nextIndex } = decodeUInt32(inputData, 28);\n\n    // Use subarray instead of slice and convert directly to base64\n    const keysBuffer = inputData.subarray(nextIndex, nextIndex + keyLen);\n    const keys = uint8ArrayToBase64(keysBuffer);\n\n    const ciphertext = new Uint8Array(inputData.subarray(nextIndex + keyLen));\n\n    return {\n      iv,\n      tag,\n      keys,\n      ciphertext,\n    };\n  }\n\n  async createObject(options: CreateObjectOptions): Promise<ObjectMetadata> {\n    const { data } = await this.workos.post<ReadObjectMetadataResponse>(\n      `/vault/v1/kv`,\n      serializeCreateObjectEntity(options),\n    );\n    return deserializeObjectMetadata(data);\n  }\n\n  async listObjects(\n    options?: PaginationOptions | undefined,\n  ): Promise<List<ObjectDigest>> {\n    const url = new URL('/vault/v1/kv', this.workos.baseURL);\n    if (options?.after) {\n      url.searchParams.set('after', options.after);\n    }\n    if (options?.limit) {\n      url.searchParams.set('limit', options.limit.toString());\n    }\n\n    const { data } = await this.workos.get<ListResponse<ObjectDigestResponse>>(\n      url.toString(),\n    );\n    return deserializeListObjects(data);\n  }\n\n  async listObjectVersions(\n    options: ReadObjectOptions,\n  ): Promise<ObjectVersion[]> {\n    const { data } = await this.workos.get<ListObjectVersionsResponse>(\n      `/vault/v1/kv/${encodeURIComponent(options.id)}/versions`,\n    );\n    return desrializeListObjectVersions(data);\n  }\n\n  async readObject(options: ReadObjectOptions): Promise<VaultObject> {\n    const { data } = await this.workos.get<ReadObjectResponse>(\n      `/vault/v1/kv/${encodeURIComponent(options.id)}`,\n    );\n    return deserializeObject(data);\n  }\n\n  async describeObject(options: ReadObjectOptions): Promise<VaultObject> {\n    const { data } = await this.workos.get<ReadObjectResponse>(\n      `/vault/v1/kv/${encodeURIComponent(options.id)}/metadata`,\n    );\n    return deserializeObject(data);\n  }\n\n  async updateObject(options: UpdateObjectOptions): Promise<VaultObject> {\n    const { data } = await this.workos.put<ReadObjectResponse>(\n      `/vault/v1/kv/${encodeURIComponent(options.id)}`,\n      serializeUpdateObjectEntity(options),\n    );\n    return deserializeObject(data);\n  }\n\n  async deleteObject(options: DeleteObjectOptions): Promise<void> {\n    return this.workos.delete(`/vault/v1/kv/${encodeURIComponent(options.id)}`);\n  }\n\n  async createDataKey(options: CreateDataKeyOptions): Promise<DataKeyPair> {\n    const { data } = await this.workos.post<CreateDataKeyResponse>(\n      `/vault/v1/keys/data-key`,\n      options,\n    );\n    return deserializeCreateDataKeyResponse(data);\n  }\n\n  async decryptDataKey(options: DecryptDataKeyOptions): Promise<DataKey> {\n    const { data } = await this.workos.post<DecryptDataKeyResponse>(\n      `/vault/v1/keys/decrypt`,\n      options,\n    );\n    return deserializeDecryptDataKeyResponse(data);\n  }\n\n  async encrypt(\n    data: string,\n    context: KeyContext,\n    associatedData?: string,\n  ): Promise<string> {\n    const keyPair = await this.createDataKey({\n      context,\n    });\n\n    // Convert base64 key to Uint8Array\n    const encoder = new TextEncoder();\n\n    // Use our cross-runtime base64 utility\n    const key = base64ToUint8Array(keyPair.dataKey.key);\n    const keyBlob = base64ToUint8Array(keyPair.encryptedKeys);\n\n    const prefixLenBuffer = encodeUInt32(keyBlob.length);\n    const aadBuffer = associatedData\n      ? encoder.encode(associatedData)\n      : undefined;\n\n    // Use a 12-byte IV for AES-GCM (industry standard)\n    const iv = this.cryptoProvider.randomBytes(12);\n\n    const {\n      ciphertext,\n      iv: resultIv,\n      tag,\n    } = await this.cryptoProvider.encrypt(\n      encoder.encode(data),\n      key,\n      iv,\n      aadBuffer,\n    );\n\n    // Concatenate all parts into a single array\n    const resultArray = new Uint8Array(\n      resultIv.length +\n        tag.length +\n        prefixLenBuffer.length +\n        keyBlob.length +\n        ciphertext.length,\n    );\n\n    let offset = 0;\n    resultArray.set(resultIv, offset);\n    offset += resultIv.length;\n\n    resultArray.set(tag, offset);\n    offset += tag.length;\n\n    resultArray.set(new Uint8Array(prefixLenBuffer), offset);\n    offset += prefixLenBuffer.length;\n\n    resultArray.set(keyBlob, offset);\n    offset += keyBlob.length;\n\n    resultArray.set(ciphertext, offset);\n\n    // Convert to base64 using our cross-runtime utility\n    return uint8ArrayToBase64(resultArray);\n  }\n\n  async decrypt(\n    encryptedData: string,\n    associatedData?: string,\n  ): Promise<string> {\n    const decoded = this.decode(encryptedData);\n    const dataKey = await this.decryptDataKey({ keys: decoded.keys });\n\n    // Convert base64 key to Uint8Array using our cross-runtime utility\n    const key = base64ToUint8Array(dataKey.key);\n\n    const encoder = new TextEncoder();\n    const aadBuffer = associatedData\n      ? encoder.encode(associatedData)\n      : undefined;\n\n    const decrypted = await this.cryptoProvider.decrypt(\n      decoded.ciphertext,\n      key,\n      decoded.iv,\n      decoded.tag,\n      aadBuffer,\n    );\n\n    return new TextDecoder().decode(decrypted);\n  }\n}\n"],"mappings":";;;;;;AA+CA,IAAa,QAAb,MAAmB;CACjB,AAAQ;CAER,YAAY,AAAiBA,QAAgB;EAAhB;AAC3B,OAAK,iBAAiB,OAAO,mBAAmB;;CAGlD,AAAQ,OAAO,SAA0B;EACvC,MAAM,YAAY,mBAAmB,QAAQ;EAE7C,MAAM,KAAK,IAAI,WAAW,UAAU,SAAS,GAAG,GAAG,CAAC;EACpD,MAAM,MAAM,IAAI,WAAW,UAAU,SAAS,IAAI,GAAG,CAAC;EACtD,MAAM,EAAE,OAAO,QAAQ,cAAc,aAAa,WAAW,GAAG;AAQhE,SAAO;GACL;GACA;GACA,MAPW,mBADM,UAAU,SAAS,WAAW,YAAY,OAAO,CACzB;GAQzC,YANiB,IAAI,WAAW,UAAU,SAAS,YAAY,OAAO,CAAC;GAOxE;;CAGH,MAAM,aAAa,SAAuD;EACxE,MAAM,EAAE,SAAS,MAAM,KAAK,OAAO,KACjC,gBACA,4BAA4B,QAAQ,CACrC;AACD,SAAO,0BAA0B,KAAK;;CAGxC,MAAM,YACJ,SAC6B;EAC7B,MAAM,MAAM,IAAI,IAAI,gBAAgB,KAAK,OAAO,QAAQ;AACxD,MAAI,SAAS,MACX,KAAI,aAAa,IAAI,SAAS,QAAQ,MAAM;AAE9C,MAAI,SAAS,MACX,KAAI,aAAa,IAAI,SAAS,QAAQ,MAAM,UAAU,CAAC;EAGzD,MAAM,EAAE,SAAS,MAAM,KAAK,OAAO,IACjC,IAAI,UAAU,CACf;AACD,SAAO,uBAAuB,KAAK;;CAGrC,MAAM,mBACJ,SAC0B;EAC1B,MAAM,EAAE,SAAS,MAAM,KAAK,OAAO,IACjC,gBAAgB,mBAAmB,QAAQ,GAAG,CAAC,WAChD;AACD,SAAO,6BAA6B,KAAK;;CAG3C,MAAM,WAAW,SAAkD;EACjE,MAAM,EAAE,SAAS,MAAM,KAAK,OAAO,IACjC,gBAAgB,mBAAmB,QAAQ,GAAG,GAC/C;AACD,SAAO,kBAAkB,KAAK;;CAGhC,MAAM,eAAe,SAAkD;EACrE,MAAM,EAAE,SAAS,MAAM,KAAK,OAAO,IACjC,gBAAgB,mBAAmB,QAAQ,GAAG,CAAC,WAChD;AACD,SAAO,kBAAkB,KAAK;;CAGhC,MAAM,aAAa,SAAoD;EACrE,MAAM,EAAE,SAAS,MAAM,KAAK,OAAO,IACjC,gBAAgB,mBAAmB,QAAQ,GAAG,IAC9C,4BAA4B,QAAQ,CACrC;AACD,SAAO,kBAAkB,KAAK;;CAGhC,MAAM,aAAa,SAA6C;AAC9D,SAAO,KAAK,OAAO,OAAO,gBAAgB,mBAAmB,QAAQ,GAAG,GAAG;;CAG7E,MAAM,cAAc,SAAqD;EACvE,MAAM,EAAE,SAAS,MAAM,KAAK,OAAO,KACjC,2BACA,QACD;AACD,SAAO,iCAAiC,KAAK;;CAG/C,MAAM,eAAe,SAAkD;EACrE,MAAM,EAAE,SAAS,MAAM,KAAK,OAAO,KACjC,0BACA,QACD;AACD,SAAO,kCAAkC,KAAK;;CAGhD,MAAM,QACJ,MACA,SACA,gBACiB;EACjB,MAAM,UAAU,MAAM,KAAK,cAAc,EACvC,SACD,CAAC;EAGF,MAAM,UAAU,IAAI,aAAa;EAGjC,MAAM,MAAM,mBAAmB,QAAQ,QAAQ,IAAI;EACnD,MAAM,UAAU,mBAAmB,QAAQ,cAAc;EAEzD,MAAM,kBAAkB,aAAa,QAAQ,OAAO;EACpD,MAAM,YAAY,iBACd,QAAQ,OAAO,eAAe,GAC9B;EAGJ,MAAM,KAAK,KAAK,eAAe,YAAY,GAAG;EAE9C,MAAM,EACJ,YACA,IAAI,UACJ,QACE,MAAM,KAAK,eAAe,QAC5B,QAAQ,OAAO,KAAK,EACpB,KACA,IACA,UACD;EAGD,MAAM,cAAc,IAAI,WACtB,SAAS,SACP,IAAI,SACJ,gBAAgB,SAChB,QAAQ,SACR,WAAW,OACd;EAED,IAAI,SAAS;AACb,cAAY,IAAI,UAAU,OAAO;AACjC,YAAU,SAAS;AAEnB,cAAY,IAAI,KAAK,OAAO;AAC5B,YAAU,IAAI;AAEd,cAAY,IAAI,IAAI,WAAW,gBAAgB,EAAE,OAAO;AACxD,YAAU,gBAAgB;AAE1B,cAAY,IAAI,SAAS,OAAO;AAChC,YAAU,QAAQ;AAElB,cAAY,IAAI,YAAY,OAAO;AAGnC,SAAO,mBAAmB,YAAY;;CAGxC,MAAM,QACJ,eACA,gBACiB;EACjB,MAAM,UAAU,KAAK,OAAO,cAAc;EAI1C,MAAM,MAAM,oBAHI,MAAM,KAAK,eAAe,EAAE,MAAM,QAAQ,MAAM,CAAC,EAG1B,IAAI;EAE3C,MAAM,UAAU,IAAI,aAAa;EACjC,MAAM,YAAY,iBACd,QAAQ,OAAO,eAAe,GAC9B;EAEJ,MAAM,YAAY,MAAM,KAAK,eAAe,QAC1C,QAAQ,YACR,KACA,QAAQ,IACR,QAAQ,KACR,UACD;AAED,SAAO,IAAI,aAAa,CAAC,OAAO,UAAU"}
+{"version":3,"file":"vault.js","names":["workos: WorkOS"],"sources":["../../src/vault/vault.ts"],"sourcesContent":["import { decodeUInt32, encodeUInt32 } from '../common/utils/leb128';\nimport { CryptoProvider } from '../common/crypto/crypto-provider';\nimport { List, ListResponse } from '../common/interfaces';\nimport { PaginationOptions } from '../index.worker';\nimport { base64ToUint8Array, uint8ArrayToBase64 } from '../common/utils/base64';\nimport type { WorkOS } from '../workos';\nimport {\n  CreateDataKeyOptions,\n  CreateDataKeyResponse,\n  CreateObjectOptions,\n  DataKey,\n  DataKeyPair,\n  DecryptDataKeyOptions,\n  DecryptDataKeyResponse,\n  DeleteObjectOptions,\n  KeyContext,\n  ListObjectVersionsResponse,\n  ObjectDigest,\n  ObjectDigestResponse,\n  ObjectMetadata,\n  ObjectVersion,\n  ReadObjectMetadataResponse,\n  ReadObjectOptions,\n  ReadObjectResponse,\n  UpdateObjectOptions,\n  VaultObject,\n} from './interfaces';\nimport {\n  deserializeCreateDataKeyResponse,\n  deserializeDecryptDataKeyResponse,\n} from './serializers/vault-key.serializer';\nimport {\n  deserializeListObjects,\n  deserializeObject,\n  deserializeObjectMetadata,\n  desrializeListObjectVersions,\n  serializeCreateObjectEntity,\n  serializeUpdateObjectEntity,\n} from './serializers/vault-object.serializer';\n\ninterface Decoded {\n  iv: Uint8Array;\n  tag: Uint8Array;\n  keys: string;\n  ciphertext: Uint8Array;\n}\n\nexport class Vault {\n  private cryptoProvider: CryptoProvider;\n\n  constructor(private readonly workos: WorkOS) {\n    this.cryptoProvider = workos.getCryptoProvider();\n  }\n\n  private decode(payload: string): Decoded {\n    const inputData = base64ToUint8Array(payload);\n    // Use 12 bytes for IV (standard for AES-GCM)\n    const iv = new Uint8Array(inputData.subarray(0, 12));\n    const tag = new Uint8Array(inputData.subarray(12, 28));\n    const { value: keyLen, nextIndex } = decodeUInt32(inputData, 28);\n\n    // Use subarray instead of slice and convert directly to base64\n    const keysBuffer = inputData.subarray(nextIndex, nextIndex + keyLen);\n    const keys = uint8ArrayToBase64(keysBuffer);\n\n    const ciphertext = new Uint8Array(inputData.subarray(nextIndex + keyLen));\n\n    return {\n      iv,\n      tag,\n      keys,\n      ciphertext,\n    };\n  }\n\n  async createObject(options: CreateObjectOptions): Promise<ObjectMetadata> {\n    const { data } = await this.workos.post<ReadObjectMetadataResponse>(\n      `/vault/v1/kv`,\n      serializeCreateObjectEntity(options),\n    );\n    return deserializeObjectMetadata(data);\n  }\n\n  async listObjects(\n    options?: PaginationOptions | undefined,\n  ): Promise<List<ObjectDigest>> {\n    const url = new URL('/vault/v1/kv', this.workos.baseURL);\n    if (options?.after) {\n      url.searchParams.set('after', options.after);\n    }\n    if (options?.limit) {\n      url.searchParams.set('limit', options.limit.toString());\n    }\n\n    const { data } = await this.workos.get<ListResponse<ObjectDigestResponse>>(\n      url.toString(),\n    );\n    return deserializeListObjects(data);\n  }\n\n  async listObjectVersions(\n    options: ReadObjectOptions,\n  ): Promise<ObjectVersion[]> {\n    const { data } = await this.workos.get<ListObjectVersionsResponse>(\n      `/vault/v1/kv/${encodeURIComponent(options.id)}/versions`,\n    );\n    return desrializeListObjectVersions(data);\n  }\n\n  async readObject(options: ReadObjectOptions): Promise<VaultObject> {\n    const { data } = await this.workos.get<ReadObjectResponse>(\n      `/vault/v1/kv/${encodeURIComponent(options.id)}`,\n    );\n    return deserializeObject(data);\n  }\n\n  async readObjectByName(name: string): Promise<VaultObject> {\n    const { data } = await this.workos.get<ReadObjectResponse>(\n      `/vault/v1/kv/name/${encodeURIComponent(name)}`,\n    );\n    return deserializeObject(data);\n  }\n\n  async describeObject(options: ReadObjectOptions): Promise<VaultObject> {\n    const { data } = await this.workos.get<ReadObjectResponse>(\n      `/vault/v1/kv/${encodeURIComponent(options.id)}/metadata`,\n    );\n    return deserializeObject(data);\n  }\n\n  async updateObject(options: UpdateObjectOptions): Promise<VaultObject> {\n    const { data } = await this.workos.put<ReadObjectResponse>(\n      `/vault/v1/kv/${encodeURIComponent(options.id)}`,\n      serializeUpdateObjectEntity(options),\n    );\n    return deserializeObject(data);\n  }\n\n  async deleteObject(options: DeleteObjectOptions): Promise<void> {\n    return this.workos.delete(`/vault/v1/kv/${encodeURIComponent(options.id)}`);\n  }\n\n  async createDataKey(options: CreateDataKeyOptions): Promise<DataKeyPair> {\n    const { data } = await this.workos.post<CreateDataKeyResponse>(\n      `/vault/v1/keys/data-key`,\n      options,\n    );\n    return deserializeCreateDataKeyResponse(data);\n  }\n\n  async decryptDataKey(options: DecryptDataKeyOptions): Promise<DataKey> {\n    const { data } = await this.workos.post<DecryptDataKeyResponse>(\n      `/vault/v1/keys/decrypt`,\n      options,\n    );\n    return deserializeDecryptDataKeyResponse(data);\n  }\n\n  async encrypt(\n    data: string,\n    context: KeyContext,\n    associatedData?: string,\n  ): Promise<string> {\n    const keyPair = await this.createDataKey({\n      context,\n    });\n\n    // Convert base64 key to Uint8Array\n    const encoder = new TextEncoder();\n\n    // Use our cross-runtime base64 utility\n    const key = base64ToUint8Array(keyPair.dataKey.key);\n    const keyBlob = base64ToUint8Array(keyPair.encryptedKeys);\n\n    const prefixLenBuffer = encodeUInt32(keyBlob.length);\n    const aadBuffer = associatedData\n      ? encoder.encode(associatedData)\n      : undefined;\n\n    // Use a 12-byte IV for AES-GCM (industry standard)\n    const iv = this.cryptoProvider.randomBytes(12);\n\n    const {\n      ciphertext,\n      iv: resultIv,\n      tag,\n    } = await this.cryptoProvider.encrypt(\n      encoder.encode(data),\n      key,\n      iv,\n      aadBuffer,\n    );\n\n    // Concatenate all parts into a single array\n    const resultArray = new Uint8Array(\n      resultIv.length +\n        tag.length +\n        prefixLenBuffer.length +\n        keyBlob.length +\n        ciphertext.length,\n    );\n\n    let offset = 0;\n    resultArray.set(resultIv, offset);\n    offset += resultIv.length;\n\n    resultArray.set(tag, offset);\n    offset += tag.length;\n\n    resultArray.set(new Uint8Array(prefixLenBuffer), offset);\n    offset += prefixLenBuffer.length;\n\n    resultArray.set(keyBlob, offset);\n    offset += keyBlob.length;\n\n    resultArray.set(ciphertext, offset);\n\n    // Convert to base64 using our cross-runtime utility\n    return uint8ArrayToBase64(resultArray);\n  }\n\n  async decrypt(\n    encryptedData: string,\n    associatedData?: string,\n  ): Promise<string> {\n    const decoded = this.decode(encryptedData);\n    const dataKey = await this.decryptDataKey({ keys: decoded.keys });\n\n    // Convert base64 key to Uint8Array using our cross-runtime utility\n    const key = base64ToUint8Array(dataKey.key);\n\n    const encoder = new TextEncoder();\n    const aadBuffer = associatedData\n      ? encoder.encode(associatedData)\n      : undefined;\n\n    const decrypted = await this.cryptoProvider.decrypt(\n      decoded.ciphertext,\n      key,\n      decoded.iv,\n      decoded.tag,\n      aadBuffer,\n    );\n\n    return new TextDecoder().decode(decrypted);\n  }\n}\n"],"mappings":";;;;;;AA+CA,IAAa,QAAb,MAAmB;CACjB,AAAQ;CAER,YAAY,AAAiBA,QAAgB;EAAhB;AAC3B,OAAK,iBAAiB,OAAO,mBAAmB;;CAGlD,AAAQ,OAAO,SAA0B;EACvC,MAAM,YAAY,mBAAmB,QAAQ;EAE7C,MAAM,KAAK,IAAI,WAAW,UAAU,SAAS,GAAG,GAAG,CAAC;EACpD,MAAM,MAAM,IAAI,WAAW,UAAU,SAAS,IAAI,GAAG,CAAC;EACtD,MAAM,EAAE,OAAO,QAAQ,cAAc,aAAa,WAAW,GAAG;AAQhE,SAAO;GACL;GACA;GACA,MAPW,mBADM,UAAU,SAAS,WAAW,YAAY,OAAO,CACzB;GAQzC,YANiB,IAAI,WAAW,UAAU,SAAS,YAAY,OAAO,CAAC;GAOxE;;CAGH,MAAM,aAAa,SAAuD;EACxE,MAAM,EAAE,SAAS,MAAM,KAAK,OAAO,KACjC,gBACA,4BAA4B,QAAQ,CACrC;AACD,SAAO,0BAA0B,KAAK;;CAGxC,MAAM,YACJ,SAC6B;EAC7B,MAAM,MAAM,IAAI,IAAI,gBAAgB,KAAK,OAAO,QAAQ;AACxD,MAAI,SAAS,MACX,KAAI,aAAa,IAAI,SAAS,QAAQ,MAAM;AAE9C,MAAI,SAAS,MACX,KAAI,aAAa,IAAI,SAAS,QAAQ,MAAM,UAAU,CAAC;EAGzD,MAAM,EAAE,SAAS,MAAM,KAAK,OAAO,IACjC,IAAI,UAAU,CACf;AACD,SAAO,uBAAuB,KAAK;;CAGrC,MAAM,mBACJ,SAC0B;EAC1B,MAAM,EAAE,SAAS,MAAM,KAAK,OAAO,IACjC,gBAAgB,mBAAmB,QAAQ,GAAG,CAAC,WAChD;AACD,SAAO,6BAA6B,KAAK;;CAG3C,MAAM,WAAW,SAAkD;EACjE,MAAM,EAAE,SAAS,MAAM,KAAK,OAAO,IACjC,gBAAgB,mBAAmB,QAAQ,GAAG,GAC/C;AACD,SAAO,kBAAkB,KAAK;;CAGhC,MAAM,iBAAiB,MAAoC;EACzD,MAAM,EAAE,SAAS,MAAM,KAAK,OAAO,IACjC,qBAAqB,mBAAmB,KAAK,GAC9C;AACD,SAAO,kBAAkB,KAAK;;CAGhC,MAAM,eAAe,SAAkD;EACrE,MAAM,EAAE,SAAS,MAAM,KAAK,OAAO,IACjC,gBAAgB,mBAAmB,QAAQ,GAAG,CAAC,WAChD;AACD,SAAO,kBAAkB,KAAK;;CAGhC,MAAM,aAAa,SAAoD;EACrE,MAAM,EAAE,SAAS,MAAM,KAAK,OAAO,IACjC,gBAAgB,mBAAmB,QAAQ,GAAG,IAC9C,4BAA4B,QAAQ,CACrC;AACD,SAAO,kBAAkB,KAAK;;CAGhC,MAAM,aAAa,SAA6C;AAC9D,SAAO,KAAK,OAAO,OAAO,gBAAgB,mBAAmB,QAAQ,GAAG,GAAG;;CAG7E,MAAM,cAAc,SAAqD;EACvE,MAAM,EAAE,SAAS,MAAM,KAAK,OAAO,KACjC,2BACA,QACD;AACD,SAAO,iCAAiC,KAAK;;CAG/C,MAAM,eAAe,SAAkD;EACrE,MAAM,EAAE,SAAS,MAAM,KAAK,OAAO,KACjC,0BACA,QACD;AACD,SAAO,kCAAkC,KAAK;;CAGhD,MAAM,QACJ,MACA,SACA,gBACiB;EACjB,MAAM,UAAU,MAAM,KAAK,cAAc,EACvC,SACD,CAAC;EAGF,MAAM,UAAU,IAAI,aAAa;EAGjC,MAAM,MAAM,mBAAmB,QAAQ,QAAQ,IAAI;EACnD,MAAM,UAAU,mBAAmB,QAAQ,cAAc;EAEzD,MAAM,kBAAkB,aAAa,QAAQ,OAAO;EACpD,MAAM,YAAY,iBACd,QAAQ,OAAO,eAAe,GAC9B;EAGJ,MAAM,KAAK,KAAK,eAAe,YAAY,GAAG;EAE9C,MAAM,EACJ,YACA,IAAI,UACJ,QACE,MAAM,KAAK,eAAe,QAC5B,QAAQ,OAAO,KAAK,EACpB,KACA,IACA,UACD;EAGD,MAAM,cAAc,IAAI,WACtB,SAAS,SACP,IAAI,SACJ,gBAAgB,SAChB,QAAQ,SACR,WAAW,OACd;EAED,IAAI,SAAS;AACb,cAAY,IAAI,UAAU,OAAO;AACjC,YAAU,SAAS;AAEnB,cAAY,IAAI,KAAK,OAAO;AAC5B,YAAU,IAAI;AAEd,cAAY,IAAI,IAAI,WAAW,gBAAgB,EAAE,OAAO;AACxD,YAAU,gBAAgB;AAE1B,cAAY,IAAI,SAAS,OAAO;AAChC,YAAU,QAAQ;AAElB,cAAY,IAAI,YAAY,OAAO;AAGnC,SAAO,mBAAmB,YAAY;;CAGxC,MAAM,QACJ,eACA,gBACiB;EACjB,MAAM,UAAU,KAAK,OAAO,cAAc;EAI1C,MAAM,MAAM,oBAHI,MAAM,KAAK,eAAe,EAAE,MAAM,QAAQ,MAAM,CAAC,EAG1B,IAAI;EAE3C,MAAM,UAAU,IAAI,aAAa;EACjC,MAAM,YAAY,iBACd,QAAQ,OAAO,eAAe,GAC9B;EAEJ,MAAM,YAAY,MAAM,KAAK,eAAe,QAC1C,QAAQ,YACR,KACA,QAAQ,IACR,QAAQ,KACR,UACD;AAED,SAAO,IAAI,aAAa,CAAC,OAAO,UAAU"}

package/lib/webhooks/webhooks.cjs

@@ -1,5 +1,5 @@
-const require_common_crypto_signature_provider = require('../common/crypto/signature-provider.cjs');
 const require_common_serializers_event_serializer = require('../common/serializers/event.serializer.cjs');
+const require_common_crypto_signature_provider = require('../common/crypto/signature-provider.cjs');
 
 //#region src/webhooks/webhooks.ts
 var Webhooks = class {

package/lib/webhooks/webhooks.js

@@ -1,5 +1,5 @@
-import { SignatureProvider } from "../common/crypto/signature-provider.js";
 import { deserializeEvent } from "../common/serializers/event.serializer.js";
+import { SignatureProvider } from "../common/crypto/signature-provider.js";
 
 //#region src/webhooks/webhooks.ts
 var Webhooks = class {

package/lib/workos.cjs

@@ -1,17 +1,12 @@
-const require_common_crypto_subtle_crypto_provider = require('./common/crypto/subtle-crypto-provider.cjs');
-const require_common_net_http_client = require('./common/net/http-client.cjs');
-const require_common_exceptions_parse_error = require('./common/exceptions/parse-error.cjs');
-const require_common_net_fetch_client = require('./common/net/fetch-client.cjs');
+const require_common_exceptions_api_key_required_exception = require('./common/exceptions/api-key-required.exception.cjs');
 const require_common_exceptions_generic_server_exception = require('./common/exceptions/generic-server.exception.cjs');
 const require_common_exceptions_bad_request_exception = require('./common/exceptions/bad-request.exception.cjs');
-const require_common_exceptions_no_api_key_provided_exception = require('./common/exceptions/no-api-key-provided.exception.cjs');
 const require_common_exceptions_not_found_exception = require('./common/exceptions/not-found.exception.cjs');
 const require_common_exceptions_oauth_exception = require('./common/exceptions/oauth.exception.cjs');
 const require_common_exceptions_rate_limit_exceeded_exception = require('./common/exceptions/rate-limit-exceeded.exception.cjs');
 const require_common_exceptions_unauthorized_exception = require('./common/exceptions/unauthorized.exception.cjs');
 const require_common_exceptions_unprocessable_entity_exception = require('./common/exceptions/unprocessable-entity.exception.cjs');
-const require_actions_actions = require('./actions/actions.cjs');
-const require_webhooks_webhooks = require('./webhooks/webhooks.cjs');
+const require_pkce_pkce = require('./pkce/pkce.cjs');
 const require_api_keys_api_keys = require('./api-keys/api-keys.cjs');
 const require_directory_sync_directory_sync = require('./directory-sync/directory-sync.cjs');
 const require_events_events = require('./events/events.cjs');
@@ -21,18 +16,25 @@ const require_passwordless_passwordless = require('./passwordless/passwordless.c
 const require_pipes_pipes = require('./pipes/pipes.cjs');
 const require_portal_portal = require('./portal/portal.cjs');
 const require_sso_sso = require('./sso/sso.cjs');
+const require_webhooks_webhooks = require('./webhooks/webhooks.cjs');
 const require_mfa_mfa = require('./mfa/mfa.cjs');
 const require_audit_logs_audit_logs = require('./audit-logs/audit-logs.cjs');
 const require_common_utils_env = require('./common/utils/env.cjs');
 const require_user_management_user_management = require('./user-management/user-management.cjs');
 const require_fga_fga = require('./fga/fga.cjs');
+const require_feature_flags_feature_flags = require('./feature-flags/feature-flags.cjs');
+const require_common_net_http_client = require('./common/net/http-client.cjs');
+const require_common_crypto_subtle_crypto_provider = require('./common/crypto/subtle-crypto-provider.cjs');
+const require_common_exceptions_parse_error = require('./common/exceptions/parse-error.cjs');
+const require_common_net_fetch_client = require('./common/net/fetch-client.cjs');
 const require_widgets_widgets = require('./widgets/widgets.cjs');
+const require_actions_actions = require('./actions/actions.cjs');
 const require_vault_vault = require('./vault/vault.cjs');
 const require_common_exceptions_conflict_exception = require('./common/exceptions/conflict.exception.cjs');
 const require_common_utils_runtime_info = require('./common/utils/runtime-info.cjs');
 
 //#region src/workos.ts
-const VERSION = "8.0.0-rc.6";
+const VERSION = "8.0.0-rc.8";
 const DEFAULT_HOSTNAME = "api.workos.com";
 const HEADER_AUTHORIZATION = "Authorization";
 const HEADER_IDEMPOTENCY_KEY = "Idempotency-Key";
@@ -41,43 +43,71 @@ var WorkOS = class {
 	baseURL;
 	client;
 	clientId;
+	key;
+	options;
+	pkce;
+	hasApiKey;
 	actions;
 	apiKeys = new require_api_keys_api_keys.ApiKeys(this);
 	auditLogs = new require_audit_logs_audit_logs.AuditLogs(this);
 	directorySync = new require_directory_sync_directory_sync.DirectorySync(this);
+	events = new require_events_events.Events(this);
+	featureFlags = new require_feature_flags_feature_flags.FeatureFlags(this);
+	fga = new require_fga_fga.FGA(this);
+	mfa = new require_mfa_mfa.Mfa(this);
 	organizations = new require_organizations_organizations.Organizations(this);
 	organizationDomains = new require_organization_domains_organization_domains.OrganizationDomains(this);
 	passwordless = new require_passwordless_passwordless.Passwordless(this);
 	pipes = new require_pipes_pipes.Pipes(this);
 	portal = new require_portal_portal.Portal(this);
 	sso = new require_sso_sso.SSO(this);
-	webhooks;
-	mfa = new require_mfa_mfa.Mfa(this);
-	events = new require_events_events.Events(this);
 	userManagement;
-	fga = new require_fga_fga.FGA(this);
-	widgets = new require_widgets_widgets.Widgets(this);
 	vault = new require_vault_vault.Vault(this);
-	constructor(key, options = {}) {
-		this.key = key;
-		this.options = options;
-		if (!key) {
-			this.key = require_common_utils_env.getEnv("WORKOS_API_KEY");
-			if (!this.key) throw new require_common_exceptions_no_api_key_provided_exception.NoApiKeyProvidedException();
+	webhooks;
+	widgets = new require_widgets_widgets.Widgets(this);
+	/**
+	* Create a new WorkOS client.
+	*
+	* @param keyOrOptions - API key string, or options object
+	* @param maybeOptions - Options when first argument is API key
+	*
+	* @example
+	* // Server-side with API key (string)
+	* const workos = new WorkOS('sk_...');
+	*
+	* @example
+	* // Server-side with API key (object)
+	* const workos = new WorkOS({ apiKey: 'sk_...', clientId: 'client_...' });
+	*
+	* @example
+	* // PKCE/public client (no API key)
+	* const workos = new WorkOS({ clientId: 'client_...' });
+	*/
+	constructor(keyOrOptions, maybeOptions) {
+		if (typeof keyOrOptions === "object") {
+			this.key = keyOrOptions.apiKey;
+			this.options = keyOrOptions;
+		} else {
+			this.key = keyOrOptions;
+			this.options = maybeOptions ?? {};
 		}
+		if (!this.key) this.key = require_common_utils_env.getEnv("WORKOS_API_KEY");
+		this.hasApiKey = !!this.key;
 		if (this.options.https === void 0) this.options.https = true;
 		this.clientId = this.options.clientId;
 		if (!this.clientId) this.clientId = require_common_utils_env.getEnv("WORKOS_CLIENT_ID");
+		if (!this.hasApiKey && !this.clientId) throw new Error("WorkOS requires either an API key or a clientId. For server-side: new WorkOS(\"sk_...\") or new WorkOS({ apiKey: \"sk_...\" }). For PKCE/public clients: new WorkOS({ clientId: \"client_...\" })");
 		const protocol = this.options.https ? "https" : "http";
 		const apiHostname = this.options.apiHostname || DEFAULT_HOSTNAME;
 		const port = this.options.port;
 		this.baseURL = `${protocol}://${apiHostname}`;
 		if (port) this.baseURL = this.baseURL + `:${port}`;
+		this.pkce = new require_pkce_pkce.PKCE();
 		this.webhooks = this.createWebhookClient();
 		this.actions = this.createActionsClient();
 		this.userManagement = new require_user_management_user_management.UserManagement(this);
-		const userAgent = this.createUserAgent(options);
-		this.client = this.createHttpClient(options, userAgent);
+		const userAgent = this.createUserAgent(this.options);
+		this.client = this.createHttpClient(this.options, userAgent);
 	}
 	createUserAgent(options) {
 		let userAgent = `workos-node/${VERSION}`;
@@ -99,20 +129,29 @@ var WorkOS = class {
 		return new require_common_crypto_subtle_crypto_provider.SubtleCryptoProvider();
 	}
 	createHttpClient(options, userAgent) {
+		const headers = { "User-Agent": userAgent };
+		const configHeaders = options.config?.headers;
+		if (configHeaders && typeof configHeaders === "object" && !Array.isArray(configHeaders) && !(configHeaders instanceof Headers)) Object.assign(headers, configHeaders);
+		if (this.key) headers["Authorization"] = `Bearer ${this.key}`;
 		return new require_common_net_fetch_client.FetchHttpClient(this.baseURL, {
 			...options.config,
 			timeout: options.timeout,
-			headers: {
-				...options.config?.headers,
-				Authorization: `Bearer ${this.key}`,
-				"User-Agent": userAgent
-			}
+			headers
 		});
 	}
 	get version() {
 		return VERSION;
 	}
+	/**
+	* Require API key for methods that need it.
+	* @param methodName - Name of the method requiring API key (for error message)
+	* @throws ApiKeyRequiredException if no API key was provided
+	*/
+	requireApiKey(methodName) {
+		if (!this.hasApiKey) throw new require_common_exceptions_api_key_required_exception.ApiKeyRequiredException(methodName);
+	}
 	async post(path, entity, options = {}) {
+		if (!options.skipApiKeyCheck) this.requireApiKey(path);
 		const requestHeaders = {};
 		if (options.idempotencyKey) requestHeaders[HEADER_IDEMPOTENCY_KEY] = options.idempotencyKey;
 		if (options.warrantToken) requestHeaders[HEADER_WARRANT_TOKEN] = options.warrantToken;
@@ -137,6 +176,7 @@ var WorkOS = class {
 		}
 	}
 	async get(path, options = {}) {
+		if (!options.skipApiKeyCheck) this.requireApiKey(path);
 		const requestHeaders = {};
 		if (options.accessToken) requestHeaders[HEADER_AUTHORIZATION] = `Bearer ${options.accessToken}`;
 		if (options.warrantToken) requestHeaders[HEADER_WARRANT_TOKEN] = options.warrantToken;
@@ -161,6 +201,7 @@ var WorkOS = class {
 		}
 	}
 	async put(path, entity, options = {}) {
+		if (!options.skipApiKeyCheck) this.requireApiKey(path);
 		const requestHeaders = {};
 		if (options.idempotencyKey) requestHeaders[HEADER_IDEMPOTENCY_KEY] = options.idempotencyKey;
 		let res;
@@ -184,6 +225,7 @@ var WorkOS = class {
 		}
 	}
 	async delete(path, query) {
+		this.requireApiKey(path);
 		try {
 			await this.client.delete(path, { params: query });
 		} catch (error) {

package/lib/workos.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"workos.cjs","names":["ApiKeys","AuditLogs","DirectorySync","Organizations","OrganizationDomains","Passwordless","Pipes","Portal","SSO","Mfa","Events","FGA","Widgets","Vault","key?: string","options: WorkOSOptions","getEnv","NoApiKeyProvidedException","protocol: string","apiHostname: string","port: number | undefined","UserManagement","userAgent: string","getRuntimeInfo","Webhooks","Actions","SubtleCryptoProvider","FetchHttpClient","requestHeaders: Record<string, string>","res: HttpClientResponseInterface","ParseError","HttpClientError","UnauthorizedException","ConflictException","UnprocessableEntityException","NotFoundException","RateLimitExceededException","error","OauthException","BadRequestException","GenericServerException"],"sources":["../src/workos.ts"],"sourcesContent":["import {\n  GenericServerException,\n  NoApiKeyProvidedException,\n  NotFoundException,\n  UnauthorizedException,\n  UnprocessableEntityException,\n  OauthException,\n  RateLimitExceededException,\n} from './common/exceptions';\nimport {\n  GetOptions,\n  HttpClientResponseInterface,\n  PostOptions,\n  PutOptions,\n  WorkOSOptions,\n  WorkOSResponseError,\n} from './common/interfaces';\nimport { ApiKeys } from './api-keys/api-keys';\nimport { DirectorySync } from './directory-sync/directory-sync';\nimport { Events } from './events/events';\nimport { Organizations } from './organizations/organizations';\nimport { OrganizationDomains } from './organization-domains/organization-domains';\nimport { Passwordless } from './passwordless/passwordless';\nimport { Pipes } from './pipes/pipes';\nimport { Portal } from './portal/portal';\nimport { SSO } from './sso/sso';\nimport { Webhooks } from './webhooks/webhooks';\nimport { Mfa } from './mfa/mfa';\nimport { AuditLogs } from './audit-logs/audit-logs';\nimport { UserManagement } from './user-management/user-management';\nimport { FGA } from './fga/fga';\nimport { BadRequestException } from './common/exceptions/bad-request.exception';\n\nimport { HttpClient, HttpClientError } from './common/net/http-client';\nimport { SubtleCryptoProvider } from './common/crypto/subtle-crypto-provider';\nimport { FetchHttpClient } from './common/net/fetch-client';\nimport { Widgets } from './widgets/widgets';\nimport { Actions } from './actions/actions';\nimport { Vault } from './vault/vault';\nimport { ConflictException } from './common/exceptions/conflict.exception';\nimport { CryptoProvider } from './common/crypto/crypto-provider';\nimport { ParseError } from './common/exceptions/parse-error';\nimport { getEnv } from './common/utils/env';\nimport { getRuntimeInfo } from './common/utils/runtime-info';\n\nconst VERSION = '8.0.0-rc.6';\n\nconst DEFAULT_HOSTNAME = 'api.workos.com';\n\nconst HEADER_AUTHORIZATION = 'Authorization';\nconst HEADER_IDEMPOTENCY_KEY = 'Idempotency-Key';\nconst HEADER_WARRANT_TOKEN = 'Warrant-Token';\n\nexport class WorkOS {\n  readonly baseURL: string;\n  readonly client: HttpClient;\n  readonly clientId?: string;\n\n  readonly actions: Actions;\n  readonly apiKeys = new ApiKeys(this);\n  readonly auditLogs = new AuditLogs(this);\n  readonly directorySync = new DirectorySync(this);\n  readonly organizations = new Organizations(this);\n  readonly organizationDomains = new OrganizationDomains(this);\n  readonly passwordless = new Passwordless(this);\n  readonly pipes = new Pipes(this);\n  readonly portal = new Portal(this);\n  readonly sso = new SSO(this);\n  readonly webhooks: Webhooks;\n  readonly mfa = new Mfa(this);\n  readonly events = new Events(this);\n  readonly userManagement: UserManagement;\n  readonly fga = new FGA(this);\n  readonly widgets = new Widgets(this);\n  readonly vault = new Vault(this);\n\n  constructor(\n    readonly key?: string,\n    readonly options: WorkOSOptions = {},\n  ) {\n    if (!key) {\n      this.key = getEnv('WORKOS_API_KEY');\n\n      if (!this.key) {\n        throw new NoApiKeyProvidedException();\n      }\n    }\n\n    if (this.options.https === undefined) {\n      this.options.https = true;\n    }\n\n    this.clientId = this.options.clientId;\n    if (!this.clientId) {\n      this.clientId = getEnv('WORKOS_CLIENT_ID');\n    }\n\n    const protocol: string = this.options.https ? 'https' : 'http';\n    const apiHostname: string = this.options.apiHostname || DEFAULT_HOSTNAME;\n    const port: number | undefined = this.options.port;\n    this.baseURL = `${protocol}://${apiHostname}`;\n\n    if (port) {\n      this.baseURL = this.baseURL + `:${port}`;\n    }\n\n    this.webhooks = this.createWebhookClient();\n    this.actions = this.createActionsClient();\n\n    // Must initialize UserManagement after baseURL is configured\n    this.userManagement = new UserManagement(this);\n\n    const userAgent = this.createUserAgent(options);\n\n    this.client = this.createHttpClient(options, userAgent);\n  }\n\n  private createUserAgent(options: WorkOSOptions): string {\n    let userAgent: string = `workos-node/${VERSION}`;\n\n    const { name: runtimeName, version: runtimeVersion } = getRuntimeInfo();\n    userAgent += ` (${runtimeName}${runtimeVersion ? `/${runtimeVersion}` : ''})`;\n\n    if (options.appInfo) {\n      const { name, version } = options.appInfo;\n      userAgent += ` ${name}: ${version}`;\n    }\n\n    return userAgent;\n  }\n\n  createWebhookClient() {\n    return new Webhooks(this.getCryptoProvider());\n  }\n\n  createActionsClient() {\n    return new Actions(this.getCryptoProvider());\n  }\n\n  getCryptoProvider(): CryptoProvider {\n    return new SubtleCryptoProvider();\n  }\n\n  createHttpClient(options: WorkOSOptions, userAgent: string) {\n    return new FetchHttpClient(this.baseURL, {\n      ...options.config,\n      timeout: options.timeout,\n      headers: {\n        ...options.config?.headers,\n        Authorization: `Bearer ${this.key}`,\n        'User-Agent': userAgent,\n      },\n    }) as HttpClient;\n  }\n\n  get version() {\n    return VERSION;\n  }\n\n  async post<Result = any, Entity = any>(\n    path: string,\n    entity: Entity,\n    options: PostOptions = {},\n  ): Promise<{ data: Result }> {\n    const requestHeaders: Record<string, string> = {};\n\n    if (options.idempotencyKey) {\n      requestHeaders[HEADER_IDEMPOTENCY_KEY] = options.idempotencyKey;\n    }\n\n    if (options.warrantToken) {\n      requestHeaders[HEADER_WARRANT_TOKEN] = options.warrantToken;\n    }\n\n    let res: HttpClientResponseInterface;\n\n    try {\n      res = await this.client.post<Entity>(path, entity, {\n        params: options.query,\n        headers: requestHeaders,\n      });\n    } catch (error) {\n      this.handleHttpError({ path, error });\n      throw error;\n    }\n\n    try {\n      return { data: await res.toJSON() };\n    } catch (error) {\n      await this.handleParseError(error, res);\n      throw error;\n    }\n  }\n\n  async get<Result = any>(\n    path: string,\n    options: GetOptions = {},\n  ): Promise<{ data: Result }> {\n    const requestHeaders: Record<string, string> = {};\n\n    if (options.accessToken) {\n      requestHeaders[HEADER_AUTHORIZATION] = `Bearer ${options.accessToken}`;\n    }\n\n    if (options.warrantToken) {\n      requestHeaders[HEADER_WARRANT_TOKEN] = options.warrantToken;\n    }\n\n    let res: HttpClientResponseInterface;\n    try {\n      res = await this.client.get(path, {\n        params: options.query,\n        headers: requestHeaders,\n      });\n    } catch (error) {\n      this.handleHttpError({ path, error });\n\n      throw error;\n    }\n\n    try {\n      return { data: await res.toJSON() };\n    } catch (error) {\n      await this.handleParseError(error, res);\n      throw error;\n    }\n  }\n\n  async put<Result = any, Entity = any>(\n    path: string,\n    entity: Entity,\n    options: PutOptions = {},\n  ): Promise<{ data: Result }> {\n    const requestHeaders: Record<string, string> = {};\n\n    if (options.idempotencyKey) {\n      requestHeaders[HEADER_IDEMPOTENCY_KEY] = options.idempotencyKey;\n    }\n\n    let res: HttpClientResponseInterface;\n\n    try {\n      res = await this.client.put<Entity>(path, entity, {\n        params: options.query,\n        headers: requestHeaders,\n      });\n    } catch (error) {\n      this.handleHttpError({ path, error });\n\n      throw error;\n    }\n\n    try {\n      return { data: await res.toJSON() };\n    } catch (error) {\n      await this.handleParseError(error, res);\n      throw error;\n    }\n  }\n\n  async delete(path: string, query?: any): Promise<void> {\n    try {\n      await this.client.delete(path, {\n        params: query,\n      });\n    } catch (error) {\n      this.handleHttpError({ path, error });\n\n      throw error;\n    }\n  }\n\n  emitWarning(warning: string) {\n    // tslint:disable-next-line:no-console\n    console.warn(`WorkOS: ${warning}`);\n  }\n\n  private async handleParseError(\n    error: unknown,\n    res: HttpClientResponseInterface,\n  ) {\n    if (error instanceof SyntaxError) {\n      const rawResponse = res.getRawResponse() as Response;\n      const requestID = rawResponse.headers.get('X-Request-ID') ?? '';\n      const rawStatus = rawResponse.status;\n      const rawBody = await rawResponse.text();\n      throw new ParseError({\n        message: error.message,\n        rawBody,\n        rawStatus,\n        requestID,\n      });\n    }\n  }\n\n  private handleHttpError({ path, error }: { path: string; error: unknown }) {\n    if (!(error instanceof HttpClientError)) {\n      throw new Error(`Unexpected error: ${error}`, { cause: error });\n    }\n\n    const { response } = error as HttpClientError<WorkOSResponseError>;\n\n    if (response) {\n      const { status, data, headers } = response;\n\n      const requestID = headers['X-Request-ID'] ?? '';\n      const {\n        code,\n        error_description: errorDescription,\n        error,\n        errors,\n        message,\n      } = data;\n\n      switch (status) {\n        case 401: {\n          throw new UnauthorizedException(requestID);\n        }\n        case 409: {\n          throw new ConflictException({ requestID, message, error });\n        }\n        case 422: {\n          throw new UnprocessableEntityException({\n            code,\n            errors,\n            message,\n            requestID,\n          });\n        }\n        case 404: {\n          throw new NotFoundException({\n            code,\n            message,\n            path,\n            requestID,\n          });\n        }\n        case 429: {\n          const retryAfter = headers.get('Retry-After');\n\n          throw new RateLimitExceededException(\n            data.message,\n            requestID,\n            retryAfter ? Number(retryAfter) : null,\n          );\n        }\n        default: {\n          if (error || errorDescription) {\n            throw new OauthException(\n              status,\n              requestID,\n              error,\n              errorDescription,\n              data,\n            );\n          } else if (code && errors) {\n            // Note: ideally this should be mapped directly with a `400` status code.\n            // However, this would break existing logic for the `OauthException` exception.\n            throw new BadRequestException({\n              code,\n              errors,\n              message,\n              requestID,\n            });\n          } else {\n            throw new GenericServerException(\n              status,\n              data.message,\n              data,\n              requestID,\n            );\n          }\n        }\n      }\n    }\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA6CA,MAAM,UAAU;AAEhB,MAAM,mBAAmB;AAEzB,MAAM,uBAAuB;AAC7B,MAAM,yBAAyB;AAC/B,MAAM,uBAAuB;AAE7B,IAAa,SAAb,MAAoB;CAClB,AAAS;CACT,AAAS;CACT,AAAS;CAET,AAAS;CACT,AAAS,UAAU,IAAIA,kCAAQ,KAAK;CACpC,AAAS,YAAY,IAAIC,wCAAU,KAAK;CACxC,AAAS,gBAAgB,IAAIC,oDAAc,KAAK;CAChD,AAAS,gBAAgB,IAAIC,kDAAc,KAAK;CAChD,AAAS,sBAAsB,IAAIC,sEAAoB,KAAK;CAC5D,AAAS,eAAe,IAAIC,+CAAa,KAAK;CAC9C,AAAS,QAAQ,IAAIC,0BAAM,KAAK;CAChC,AAAS,SAAS,IAAIC,6BAAO,KAAK;CAClC,AAAS,MAAM,IAAIC,oBAAI,KAAK;CAC5B,AAAS;CACT,AAAS,MAAM,IAAIC,oBAAI,KAAK;CAC5B,AAAS,SAAS,IAAIC,6BAAO,KAAK;CAClC,AAAS;CACT,AAAS,MAAM,IAAIC,oBAAI,KAAK;CAC5B,AAAS,UAAU,IAAIC,gCAAQ,KAAK;CACpC,AAAS,QAAQ,IAAIC,0BAAM,KAAK;CAEhC,YACE,AAASC,KACT,AAASC,UAAyB,EAAE,EACpC;EAFS;EACA;AAET,MAAI,CAAC,KAAK;AACR,QAAK,MAAMC,gCAAO,iBAAiB;AAEnC,OAAI,CAAC,KAAK,IACR,OAAM,IAAIC,mFAA2B;;AAIzC,MAAI,KAAK,QAAQ,UAAU,OACzB,MAAK,QAAQ,QAAQ;AAGvB,OAAK,WAAW,KAAK,QAAQ;AAC7B,MAAI,CAAC,KAAK,SACR,MAAK,WAAWD,gCAAO,mBAAmB;EAG5C,MAAME,WAAmB,KAAK,QAAQ,QAAQ,UAAU;EACxD,MAAMC,cAAsB,KAAK,QAAQ,eAAe;EACxD,MAAMC,OAA2B,KAAK,QAAQ;AAC9C,OAAK,UAAU,GAAG,SAAS,KAAK;AAEhC,MAAI,KACF,MAAK,UAAU,KAAK,UAAU,IAAI;AAGpC,OAAK,WAAW,KAAK,qBAAqB;AAC1C,OAAK,UAAU,KAAK,qBAAqB;AAGzC,OAAK,iBAAiB,IAAIC,uDAAe,KAAK;EAE9C,MAAM,YAAY,KAAK,gBAAgB,QAAQ;AAE/C,OAAK,SAAS,KAAK,iBAAiB,SAAS,UAAU;;CAGzD,AAAQ,gBAAgB,SAAgC;EACtD,IAAIC,YAAoB,eAAe;EAEvC,MAAM,EAAE,MAAM,aAAa,SAAS,mBAAmBC,kDAAgB;AACvE,eAAa,KAAK,cAAc,iBAAiB,IAAI,mBAAmB,GAAG;AAE3E,MAAI,QAAQ,SAAS;GACnB,MAAM,EAAE,MAAM,YAAY,QAAQ;AAClC,gBAAa,IAAI,KAAK,IAAI;;AAG5B,SAAO;;CAGT,sBAAsB;AACpB,SAAO,IAAIC,mCAAS,KAAK,mBAAmB,CAAC;;CAG/C,sBAAsB;AACpB,SAAO,IAAIC,gCAAQ,KAAK,mBAAmB,CAAC;;CAG9C,oBAAoC;AAClC,SAAO,IAAIC,mEAAsB;;CAGnC,iBAAiB,SAAwB,WAAmB;AAC1D,SAAO,IAAIC,gDAAgB,KAAK,SAAS;GACvC,GAAG,QAAQ;GACX,SAAS,QAAQ;GACjB,SAAS;IACP,GAAG,QAAQ,QAAQ;IACnB,eAAe,UAAU,KAAK;IAC9B,cAAc;IACf;GACF,CAAC;;CAGJ,IAAI,UAAU;AACZ,SAAO;;CAGT,MAAM,KACJ,MACA,QACA,UAAuB,EAAE,EACE;EAC3B,MAAMC,iBAAyC,EAAE;AAEjD,MAAI,QAAQ,eACV,gBAAe,0BAA0B,QAAQ;AAGnD,MAAI,QAAQ,aACV,gBAAe,wBAAwB,QAAQ;EAGjD,IAAIC;AAEJ,MAAI;AACF,SAAM,MAAM,KAAK,OAAO,KAAa,MAAM,QAAQ;IACjD,QAAQ,QAAQ;IAChB,SAAS;IACV,CAAC;WACK,OAAO;AACd,QAAK,gBAAgB;IAAE;IAAM;IAAO,CAAC;AACrC,SAAM;;AAGR,MAAI;AACF,UAAO,EAAE,MAAM,MAAM,IAAI,QAAQ,EAAE;WAC5B,OAAO;AACd,SAAM,KAAK,iBAAiB,OAAO,IAAI;AACvC,SAAM;;;CAIV,MAAM,IACJ,MACA,UAAsB,EAAE,EACG;EAC3B,MAAMD,iBAAyC,EAAE;AAEjD,MAAI,QAAQ,YACV,gBAAe,wBAAwB,UAAU,QAAQ;AAG3D,MAAI,QAAQ,aACV,gBAAe,wBAAwB,QAAQ;EAGjD,IAAIC;AACJ,MAAI;AACF,SAAM,MAAM,KAAK,OAAO,IAAI,MAAM;IAChC,QAAQ,QAAQ;IAChB,SAAS;IACV,CAAC;WACK,OAAO;AACd,QAAK,gBAAgB;IAAE;IAAM;IAAO,CAAC;AAErC,SAAM;;AAGR,MAAI;AACF,UAAO,EAAE,MAAM,MAAM,IAAI,QAAQ,EAAE;WAC5B,OAAO;AACd,SAAM,KAAK,iBAAiB,OAAO,IAAI;AACvC,SAAM;;;CAIV,MAAM,IACJ,MACA,QACA,UAAsB,EAAE,EACG;EAC3B,MAAMD,iBAAyC,EAAE;AAEjD,MAAI,QAAQ,eACV,gBAAe,0BAA0B,QAAQ;EAGnD,IAAIC;AAEJ,MAAI;AACF,SAAM,MAAM,KAAK,OAAO,IAAY,MAAM,QAAQ;IAChD,QAAQ,QAAQ;IAChB,SAAS;IACV,CAAC;WACK,OAAO;AACd,QAAK,gBAAgB;IAAE;IAAM;IAAO,CAAC;AAErC,SAAM;;AAGR,MAAI;AACF,UAAO,EAAE,MAAM,MAAM,IAAI,QAAQ,EAAE;WAC5B,OAAO;AACd,SAAM,KAAK,iBAAiB,OAAO,IAAI;AACvC,SAAM;;;CAIV,MAAM,OAAO,MAAc,OAA4B;AACrD,MAAI;AACF,SAAM,KAAK,OAAO,OAAO,MAAM,EAC7B,QAAQ,OACT,CAAC;WACK,OAAO;AACd,QAAK,gBAAgB;IAAE;IAAM;IAAO,CAAC;AAErC,SAAM;;;CAIV,YAAY,SAAiB;AAE3B,UAAQ,KAAK,WAAW,UAAU;;CAGpC,MAAc,iBACZ,OACA,KACA;AACA,MAAI,iBAAiB,aAAa;GAChC,MAAM,cAAc,IAAI,gBAAgB;GACxC,MAAM,YAAY,YAAY,QAAQ,IAAI,eAAe,IAAI;GAC7D,MAAM,YAAY,YAAY;GAC9B,MAAM,UAAU,MAAM,YAAY,MAAM;AACxC,SAAM,IAAIC,iDAAW;IACnB,SAAS,MAAM;IACf;IACA;IACA;IACD,CAAC;;;CAIN,AAAQ,gBAAgB,EAAE,MAAM,SAA2C;AACzE,MAAI,EAAE,iBAAiBC,gDACrB,OAAM,IAAI,MAAM,qBAAqB,SAAS,EAAE,OAAO,OAAO,CAAC;EAGjE,MAAM,EAAE,aAAa;AAErB,MAAI,UAAU;GACZ,MAAM,EAAE,QAAQ,MAAM,YAAY;GAElC,MAAM,YAAY,QAAQ,mBAAmB;GAC7C,MAAM,EACJ,MACA,mBAAmB,kBACnB,gBACA,QACA,YACE;AAEJ,WAAQ,QAAR;IACE,KAAK,IACH,OAAM,IAAIC,uEAAsB,UAAU;IAE5C,KAAK,IACH,OAAM,IAAIC,+DAAkB;KAAE;KAAW;KAAS;KAAO,CAAC;IAE5D,KAAK,IACH,OAAM,IAAIC,sFAA6B;KACrC;KACA;KACA;KACA;KACD,CAAC;IAEJ,KAAK,IACH,OAAM,IAAIC,gEAAkB;KAC1B;KACA;KACA;KACA;KACD,CAAC;IAEJ,KAAK,KAAK;KACR,MAAM,aAAa,QAAQ,IAAI,cAAc;AAE7C,WAAM,IAAIC,mFACR,KAAK,SACL,WACA,aAAa,OAAO,WAAW,GAAG,KACnC;;IAEH,QACE,KAAIC,WAAS,iBACX,OAAM,IAAIC,yDACR,QACA,WACAD,SACA,kBACA,KACD;aACQ,QAAQ,OAGjB,OAAM,IAAIE,oEAAoB;KAC5B;KACA;KACA;KACA;KACD,CAAC;QAEF,OAAM,IAAIC,0EACR,QACA,KAAK,SACL,MACA,UACD"}
+{"version":3,"file":"workos.cjs","names":["ApiKeys","AuditLogs","DirectorySync","Events","FeatureFlags","FGA","Mfa","Organizations","OrganizationDomains","Passwordless","Pipes","Portal","SSO","Vault","Widgets","getEnv","protocol: string","apiHostname: string","port: number | undefined","PKCE","UserManagement","userAgent: string","getRuntimeInfo","Webhooks","Actions","SubtleCryptoProvider","headers: Record<string, string>","FetchHttpClient","ApiKeyRequiredException","requestHeaders: Record<string, string>","res: HttpClientResponseInterface","ParseError","HttpClientError","UnauthorizedException","ConflictException","UnprocessableEntityException","NotFoundException","RateLimitExceededException","error","OauthException","BadRequestException","GenericServerException"],"sources":["../src/workos.ts"],"sourcesContent":["import {\n  ApiKeyRequiredException,\n  GenericServerException,\n  NotFoundException,\n  UnauthorizedException,\n  UnprocessableEntityException,\n  OauthException,\n  RateLimitExceededException,\n} from './common/exceptions';\nimport { PKCE } from './pkce/pkce';\nimport {\n  GetOptions,\n  HttpClientResponseInterface,\n  PostOptions,\n  PutOptions,\n  WorkOSOptions,\n  WorkOSResponseError,\n} from './common/interfaces';\nimport { ApiKeys } from './api-keys/api-keys';\nimport { DirectorySync } from './directory-sync/directory-sync';\nimport { Events } from './events/events';\nimport { Organizations } from './organizations/organizations';\nimport { OrganizationDomains } from './organization-domains/organization-domains';\nimport { Passwordless } from './passwordless/passwordless';\nimport { Pipes } from './pipes/pipes';\nimport { Portal } from './portal/portal';\nimport { SSO } from './sso/sso';\nimport { Webhooks } from './webhooks/webhooks';\nimport { Mfa } from './mfa/mfa';\nimport { AuditLogs } from './audit-logs/audit-logs';\nimport { UserManagement } from './user-management/user-management';\nimport { FGA } from './fga/fga';\nimport { BadRequestException } from './common/exceptions/bad-request.exception';\nimport { FeatureFlags } from './feature-flags/feature-flags';\n\nimport { HttpClient, HttpClientError } from './common/net/http-client';\nimport { SubtleCryptoProvider } from './common/crypto/subtle-crypto-provider';\nimport { FetchHttpClient } from './common/net/fetch-client';\nimport { Widgets } from './widgets/widgets';\nimport { Actions } from './actions/actions';\nimport { Vault } from './vault/vault';\nimport { ConflictException } from './common/exceptions/conflict.exception';\nimport { CryptoProvider } from './common/crypto/crypto-provider';\nimport { ParseError } from './common/exceptions/parse-error';\nimport { getEnv } from './common/utils/env';\nimport { getRuntimeInfo } from './common/utils/runtime-info';\n\nconst VERSION = '8.0.0-rc.8';\n\nconst DEFAULT_HOSTNAME = 'api.workos.com';\n\nconst HEADER_AUTHORIZATION = 'Authorization';\nconst HEADER_IDEMPOTENCY_KEY = 'Idempotency-Key';\nconst HEADER_WARRANT_TOKEN = 'Warrant-Token';\n\nexport class WorkOS {\n  readonly baseURL: string;\n  readonly client: HttpClient;\n  readonly clientId?: string;\n  readonly key?: string;\n  readonly options: WorkOSOptions;\n  readonly pkce: PKCE;\n\n  private readonly hasApiKey: boolean;\n\n  readonly actions: Actions;\n  readonly apiKeys = new ApiKeys(this);\n  readonly auditLogs = new AuditLogs(this);\n  readonly directorySync = new DirectorySync(this);\n  readonly events = new Events(this);\n  readonly featureFlags = new FeatureFlags(this);\n  readonly fga = new FGA(this);\n  readonly mfa = new Mfa(this);\n  readonly organizations = new Organizations(this);\n  readonly organizationDomains = new OrganizationDomains(this);\n  readonly passwordless = new Passwordless(this);\n  readonly pipes = new Pipes(this);\n  readonly portal = new Portal(this);\n  readonly sso = new SSO(this);\n  readonly userManagement: UserManagement;\n  readonly vault = new Vault(this);\n  readonly webhooks: Webhooks;\n  readonly widgets = new Widgets(this);\n\n  /**\n   * Create a new WorkOS client.\n   *\n   * @param keyOrOptions - API key string, or options object\n   * @param maybeOptions - Options when first argument is API key\n   *\n   * @example\n   * // Server-side with API key (string)\n   * const workos = new WorkOS('sk_...');\n   *\n   * @example\n   * // Server-side with API key (object)\n   * const workos = new WorkOS({ apiKey: 'sk_...', clientId: 'client_...' });\n   *\n   * @example\n   * // PKCE/public client (no API key)\n   * const workos = new WorkOS({ clientId: 'client_...' });\n   */\n  constructor(\n    keyOrOptions?: string | WorkOSOptions,\n    maybeOptions?: WorkOSOptions,\n  ) {\n    if (typeof keyOrOptions === 'object') {\n      this.key = keyOrOptions.apiKey;\n      this.options = keyOrOptions;\n    } else {\n      this.key = keyOrOptions;\n      this.options = maybeOptions ?? {};\n    }\n\n    if (!this.key) {\n      this.key = getEnv('WORKOS_API_KEY');\n    }\n\n    this.hasApiKey = !!this.key;\n\n    if (this.options.https === undefined) {\n      this.options.https = true;\n    }\n\n    this.clientId = this.options.clientId;\n    if (!this.clientId) {\n      this.clientId = getEnv('WORKOS_CLIENT_ID');\n    }\n\n    if (!this.hasApiKey && !this.clientId) {\n      throw new Error(\n        'WorkOS requires either an API key or a clientId. ' +\n          'For server-side: new WorkOS(\"sk_...\") or new WorkOS({ apiKey: \"sk_...\" }). ' +\n          'For PKCE/public clients: new WorkOS({ clientId: \"client_...\" })',\n      );\n    }\n\n    const protocol: string = this.options.https ? 'https' : 'http';\n    const apiHostname: string = this.options.apiHostname || DEFAULT_HOSTNAME;\n    const port: number | undefined = this.options.port;\n    this.baseURL = `${protocol}://${apiHostname}`;\n\n    if (port) {\n      this.baseURL = this.baseURL + `:${port}`;\n    }\n\n    this.pkce = new PKCE();\n\n    this.webhooks = this.createWebhookClient();\n    this.actions = this.createActionsClient();\n\n    // Must initialize UserManagement after baseURL is configured\n    this.userManagement = new UserManagement(this);\n\n    const userAgent = this.createUserAgent(this.options);\n\n    this.client = this.createHttpClient(this.options, userAgent);\n  }\n\n  private createUserAgent(options: WorkOSOptions): string {\n    let userAgent: string = `workos-node/${VERSION}`;\n\n    const { name: runtimeName, version: runtimeVersion } = getRuntimeInfo();\n    userAgent += ` (${runtimeName}${runtimeVersion ? `/${runtimeVersion}` : ''})`;\n\n    if (options.appInfo) {\n      const { name, version } = options.appInfo;\n      userAgent += ` ${name}: ${version}`;\n    }\n\n    return userAgent;\n  }\n\n  createWebhookClient() {\n    return new Webhooks(this.getCryptoProvider());\n  }\n\n  createActionsClient() {\n    return new Actions(this.getCryptoProvider());\n  }\n\n  getCryptoProvider(): CryptoProvider {\n    return new SubtleCryptoProvider();\n  }\n\n  createHttpClient(options: WorkOSOptions, userAgent: string) {\n    const headers: Record<string, string> = {\n      'User-Agent': userAgent,\n    };\n\n    const configHeaders = options.config?.headers;\n    if (\n      configHeaders &&\n      typeof configHeaders === 'object' &&\n      !Array.isArray(configHeaders) &&\n      !(configHeaders instanceof Headers)\n    ) {\n      Object.assign(headers, configHeaders);\n    }\n\n    if (this.key) {\n      headers['Authorization'] = `Bearer ${this.key}`;\n    }\n\n    return new FetchHttpClient(this.baseURL, {\n      ...options.config,\n      timeout: options.timeout,\n      headers,\n    }) as HttpClient;\n  }\n\n  get version() {\n    return VERSION;\n  }\n\n  /**\n   * Require API key for methods that need it.\n   * @param methodName - Name of the method requiring API key (for error message)\n   * @throws ApiKeyRequiredException if no API key was provided\n   */\n  requireApiKey(methodName: string): void {\n    if (!this.hasApiKey) {\n      throw new ApiKeyRequiredException(methodName);\n    }\n  }\n\n  async post<Result = any, Entity = any>(\n    path: string,\n    entity: Entity,\n    options: PostOptions = {},\n  ): Promise<{ data: Result }> {\n    if (!options.skipApiKeyCheck) {\n      this.requireApiKey(path);\n    }\n\n    const requestHeaders: Record<string, string> = {};\n\n    if (options.idempotencyKey) {\n      requestHeaders[HEADER_IDEMPOTENCY_KEY] = options.idempotencyKey;\n    }\n\n    if (options.warrantToken) {\n      requestHeaders[HEADER_WARRANT_TOKEN] = options.warrantToken;\n    }\n\n    let res: HttpClientResponseInterface;\n\n    try {\n      res = await this.client.post<Entity>(path, entity, {\n        params: options.query,\n        headers: requestHeaders,\n      });\n    } catch (error) {\n      this.handleHttpError({ path, error });\n      throw error;\n    }\n\n    try {\n      return { data: await res.toJSON() };\n    } catch (error) {\n      await this.handleParseError(error, res);\n      throw error;\n    }\n  }\n\n  async get<Result = any>(\n    path: string,\n    options: GetOptions = {},\n  ): Promise<{ data: Result }> {\n    if (!options.skipApiKeyCheck) {\n      this.requireApiKey(path);\n    }\n\n    const requestHeaders: Record<string, string> = {};\n\n    if (options.accessToken) {\n      requestHeaders[HEADER_AUTHORIZATION] = `Bearer ${options.accessToken}`;\n    }\n\n    if (options.warrantToken) {\n      requestHeaders[HEADER_WARRANT_TOKEN] = options.warrantToken;\n    }\n\n    let res: HttpClientResponseInterface;\n    try {\n      res = await this.client.get(path, {\n        params: options.query,\n        headers: requestHeaders,\n      });\n    } catch (error) {\n      this.handleHttpError({ path, error });\n\n      throw error;\n    }\n\n    try {\n      return { data: await res.toJSON() };\n    } catch (error) {\n      await this.handleParseError(error, res);\n      throw error;\n    }\n  }\n\n  async put<Result = any, Entity = any>(\n    path: string,\n    entity: Entity,\n    options: PutOptions = {},\n  ): Promise<{ data: Result }> {\n    if (!options.skipApiKeyCheck) {\n      this.requireApiKey(path);\n    }\n\n    const requestHeaders: Record<string, string> = {};\n\n    if (options.idempotencyKey) {\n      requestHeaders[HEADER_IDEMPOTENCY_KEY] = options.idempotencyKey;\n    }\n\n    let res: HttpClientResponseInterface;\n\n    try {\n      res = await this.client.put<Entity>(path, entity, {\n        params: options.query,\n        headers: requestHeaders,\n      });\n    } catch (error) {\n      this.handleHttpError({ path, error });\n\n      throw error;\n    }\n\n    try {\n      return { data: await res.toJSON() };\n    } catch (error) {\n      await this.handleParseError(error, res);\n      throw error;\n    }\n  }\n\n  async delete(path: string, query?: any): Promise<void> {\n    this.requireApiKey(path);\n\n    try {\n      await this.client.delete(path, {\n        params: query,\n      });\n    } catch (error) {\n      this.handleHttpError({ path, error });\n\n      throw error;\n    }\n  }\n\n  emitWarning(warning: string) {\n    // tslint:disable-next-line:no-console\n    console.warn(`WorkOS: ${warning}`);\n  }\n\n  private async handleParseError(\n    error: unknown,\n    res: HttpClientResponseInterface,\n  ) {\n    if (error instanceof SyntaxError) {\n      const rawResponse = res.getRawResponse() as Response;\n      const requestID = rawResponse.headers.get('X-Request-ID') ?? '';\n      const rawStatus = rawResponse.status;\n      const rawBody = await rawResponse.text();\n      throw new ParseError({\n        message: error.message,\n        rawBody,\n        rawStatus,\n        requestID,\n      });\n    }\n  }\n\n  private handleHttpError({ path, error }: { path: string; error: unknown }) {\n    if (!(error instanceof HttpClientError)) {\n      throw new Error(`Unexpected error: ${error}`, { cause: error });\n    }\n\n    const { response } = error as HttpClientError<WorkOSResponseError>;\n\n    if (response) {\n      const { status, data, headers } = response;\n\n      const requestID = headers['X-Request-ID'] ?? '';\n      const {\n        code,\n        error_description: errorDescription,\n        error,\n        errors,\n        message,\n      } = data;\n\n      switch (status) {\n        case 401: {\n          throw new UnauthorizedException(requestID);\n        }\n        case 409: {\n          throw new ConflictException({ requestID, message, error });\n        }\n        case 422: {\n          throw new UnprocessableEntityException({\n            code,\n            errors,\n            message,\n            requestID,\n          });\n        }\n        case 404: {\n          throw new NotFoundException({\n            code,\n            message,\n            path,\n            requestID,\n          });\n        }\n        case 429: {\n          const retryAfter = headers.get('Retry-After');\n\n          throw new RateLimitExceededException(\n            data.message,\n            requestID,\n            retryAfter ? Number(retryAfter) : null,\n          );\n        }\n        default: {\n          if (error || errorDescription) {\n            throw new OauthException(\n              status,\n              requestID,\n              error,\n              errorDescription,\n              data,\n            );\n          } else if (code && errors) {\n            // Note: ideally this should be mapped directly with a `400` status code.\n            // However, this would break existing logic for the `OauthException` exception.\n            throw new BadRequestException({\n              code,\n              errors,\n              message,\n              requestID,\n            });\n          } else {\n            throw new GenericServerException(\n              status,\n              data.message,\n              data,\n              requestID,\n            );\n          }\n        }\n      }\n    }\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA+CA,MAAM,UAAU;AAEhB,MAAM,mBAAmB;AAEzB,MAAM,uBAAuB;AAC7B,MAAM,yBAAyB;AAC/B,MAAM,uBAAuB;AAE7B,IAAa,SAAb,MAAoB;CAClB,AAAS;CACT,AAAS;CACT,AAAS;CACT,AAAS;CACT,AAAS;CACT,AAAS;CAET,AAAiB;CAEjB,AAAS;CACT,AAAS,UAAU,IAAIA,kCAAQ,KAAK;CACpC,AAAS,YAAY,IAAIC,wCAAU,KAAK;CACxC,AAAS,gBAAgB,IAAIC,oDAAc,KAAK;CAChD,AAAS,SAAS,IAAIC,6BAAO,KAAK;CAClC,AAAS,eAAe,IAAIC,iDAAa,KAAK;CAC9C,AAAS,MAAM,IAAIC,oBAAI,KAAK;CAC5B,AAAS,MAAM,IAAIC,oBAAI,KAAK;CAC5B,AAAS,gBAAgB,IAAIC,kDAAc,KAAK;CAChD,AAAS,sBAAsB,IAAIC,sEAAoB,KAAK;CAC5D,AAAS,eAAe,IAAIC,+CAAa,KAAK;CAC9C,AAAS,QAAQ,IAAIC,0BAAM,KAAK;CAChC,AAAS,SAAS,IAAIC,6BAAO,KAAK;CAClC,AAAS,MAAM,IAAIC,oBAAI,KAAK;CAC5B,AAAS;CACT,AAAS,QAAQ,IAAIC,0BAAM,KAAK;CAChC,AAAS;CACT,AAAS,UAAU,IAAIC,gCAAQ,KAAK;;;;;;;;;;;;;;;;;;;CAoBpC,YACE,cACA,cACA;AACA,MAAI,OAAO,iBAAiB,UAAU;AACpC,QAAK,MAAM,aAAa;AACxB,QAAK,UAAU;SACV;AACL,QAAK,MAAM;AACX,QAAK,UAAU,gBAAgB,EAAE;;AAGnC,MAAI,CAAC,KAAK,IACR,MAAK,MAAMC,gCAAO,iBAAiB;AAGrC,OAAK,YAAY,CAAC,CAAC,KAAK;AAExB,MAAI,KAAK,QAAQ,UAAU,OACzB,MAAK,QAAQ,QAAQ;AAGvB,OAAK,WAAW,KAAK,QAAQ;AAC7B,MAAI,CAAC,KAAK,SACR,MAAK,WAAWA,gCAAO,mBAAmB;AAG5C,MAAI,CAAC,KAAK,aAAa,CAAC,KAAK,SAC3B,OAAM,IAAI,MACR,oMAGD;EAGH,MAAMC,WAAmB,KAAK,QAAQ,QAAQ,UAAU;EACxD,MAAMC,cAAsB,KAAK,QAAQ,eAAe;EACxD,MAAMC,OAA2B,KAAK,QAAQ;AAC9C,OAAK,UAAU,GAAG,SAAS,KAAK;AAEhC,MAAI,KACF,MAAK,UAAU,KAAK,UAAU,IAAI;AAGpC,OAAK,OAAO,IAAIC,wBAAM;AAEtB,OAAK,WAAW,KAAK,qBAAqB;AAC1C,OAAK,UAAU,KAAK,qBAAqB;AAGzC,OAAK,iBAAiB,IAAIC,uDAAe,KAAK;EAE9C,MAAM,YAAY,KAAK,gBAAgB,KAAK,QAAQ;AAEpD,OAAK,SAAS,KAAK,iBAAiB,KAAK,SAAS,UAAU;;CAG9D,AAAQ,gBAAgB,SAAgC;EACtD,IAAIC,YAAoB,eAAe;EAEvC,MAAM,EAAE,MAAM,aAAa,SAAS,mBAAmBC,kDAAgB;AACvE,eAAa,KAAK,cAAc,iBAAiB,IAAI,mBAAmB,GAAG;AAE3E,MAAI,QAAQ,SAAS;GACnB,MAAM,EAAE,MAAM,YAAY,QAAQ;AAClC,gBAAa,IAAI,KAAK,IAAI;;AAG5B,SAAO;;CAGT,sBAAsB;AACpB,SAAO,IAAIC,mCAAS,KAAK,mBAAmB,CAAC;;CAG/C,sBAAsB;AACpB,SAAO,IAAIC,gCAAQ,KAAK,mBAAmB,CAAC;;CAG9C,oBAAoC;AAClC,SAAO,IAAIC,mEAAsB;;CAGnC,iBAAiB,SAAwB,WAAmB;EAC1D,MAAMC,UAAkC,EACtC,cAAc,WACf;EAED,MAAM,gBAAgB,QAAQ,QAAQ;AACtC,MACE,iBACA,OAAO,kBAAkB,YACzB,CAAC,MAAM,QAAQ,cAAc,IAC7B,EAAE,yBAAyB,SAE3B,QAAO,OAAO,SAAS,cAAc;AAGvC,MAAI,KAAK,IACP,SAAQ,mBAAmB,UAAU,KAAK;AAG5C,SAAO,IAAIC,gDAAgB,KAAK,SAAS;GACvC,GAAG,QAAQ;GACX,SAAS,QAAQ;GACjB;GACD,CAAC;;CAGJ,IAAI,UAAU;AACZ,SAAO;;;;;;;CAQT,cAAc,YAA0B;AACtC,MAAI,CAAC,KAAK,UACR,OAAM,IAAIC,6EAAwB,WAAW;;CAIjD,MAAM,KACJ,MACA,QACA,UAAuB,EAAE,EACE;AAC3B,MAAI,CAAC,QAAQ,gBACX,MAAK,cAAc,KAAK;EAG1B,MAAMC,iBAAyC,EAAE;AAEjD,MAAI,QAAQ,eACV,gBAAe,0BAA0B,QAAQ;AAGnD,MAAI,QAAQ,aACV,gBAAe,wBAAwB,QAAQ;EAGjD,IAAIC;AAEJ,MAAI;AACF,SAAM,MAAM,KAAK,OAAO,KAAa,MAAM,QAAQ;IACjD,QAAQ,QAAQ;IAChB,SAAS;IACV,CAAC;WACK,OAAO;AACd,QAAK,gBAAgB;IAAE;IAAM;IAAO,CAAC;AACrC,SAAM;;AAGR,MAAI;AACF,UAAO,EAAE,MAAM,MAAM,IAAI,QAAQ,EAAE;WAC5B,OAAO;AACd,SAAM,KAAK,iBAAiB,OAAO,IAAI;AACvC,SAAM;;;CAIV,MAAM,IACJ,MACA,UAAsB,EAAE,EACG;AAC3B,MAAI,CAAC,QAAQ,gBACX,MAAK,cAAc,KAAK;EAG1B,MAAMD,iBAAyC,EAAE;AAEjD,MAAI,QAAQ,YACV,gBAAe,wBAAwB,UAAU,QAAQ;AAG3D,MAAI,QAAQ,aACV,gBAAe,wBAAwB,QAAQ;EAGjD,IAAIC;AACJ,MAAI;AACF,SAAM,MAAM,KAAK,OAAO,IAAI,MAAM;IAChC,QAAQ,QAAQ;IAChB,SAAS;IACV,CAAC;WACK,OAAO;AACd,QAAK,gBAAgB;IAAE;IAAM;IAAO,CAAC;AAErC,SAAM;;AAGR,MAAI;AACF,UAAO,EAAE,MAAM,MAAM,IAAI,QAAQ,EAAE;WAC5B,OAAO;AACd,SAAM,KAAK,iBAAiB,OAAO,IAAI;AACvC,SAAM;;;CAIV,MAAM,IACJ,MACA,QACA,UAAsB,EAAE,EACG;AAC3B,MAAI,CAAC,QAAQ,gBACX,MAAK,cAAc,KAAK;EAG1B,MAAMD,iBAAyC,EAAE;AAEjD,MAAI,QAAQ,eACV,gBAAe,0BAA0B,QAAQ;EAGnD,IAAIC;AAEJ,MAAI;AACF,SAAM,MAAM,KAAK,OAAO,IAAY,MAAM,QAAQ;IAChD,QAAQ,QAAQ;IAChB,SAAS;IACV,CAAC;WACK,OAAO;AACd,QAAK,gBAAgB;IAAE;IAAM;IAAO,CAAC;AAErC,SAAM;;AAGR,MAAI;AACF,UAAO,EAAE,MAAM,MAAM,IAAI,QAAQ,EAAE;WAC5B,OAAO;AACd,SAAM,KAAK,iBAAiB,OAAO,IAAI;AACvC,SAAM;;;CAIV,MAAM,OAAO,MAAc,OAA4B;AACrD,OAAK,cAAc,KAAK;AAExB,MAAI;AACF,SAAM,KAAK,OAAO,OAAO,MAAM,EAC7B,QAAQ,OACT,CAAC;WACK,OAAO;AACd,QAAK,gBAAgB;IAAE;IAAM;IAAO,CAAC;AAErC,SAAM;;;CAIV,YAAY,SAAiB;AAE3B,UAAQ,KAAK,WAAW,UAAU;;CAGpC,MAAc,iBACZ,OACA,KACA;AACA,MAAI,iBAAiB,aAAa;GAChC,MAAM,cAAc,IAAI,gBAAgB;GACxC,MAAM,YAAY,YAAY,QAAQ,IAAI,eAAe,IAAI;GAC7D,MAAM,YAAY,YAAY;GAC9B,MAAM,UAAU,MAAM,YAAY,MAAM;AACxC,SAAM,IAAIC,iDAAW;IACnB,SAAS,MAAM;IACf;IACA;IACA;IACD,CAAC;;;CAIN,AAAQ,gBAAgB,EAAE,MAAM,SAA2C;AACzE,MAAI,EAAE,iBAAiBC,gDACrB,OAAM,IAAI,MAAM,qBAAqB,SAAS,EAAE,OAAO,OAAO,CAAC;EAGjE,MAAM,EAAE,aAAa;AAErB,MAAI,UAAU;GACZ,MAAM,EAAE,QAAQ,MAAM,YAAY;GAElC,MAAM,YAAY,QAAQ,mBAAmB;GAC7C,MAAM,EACJ,MACA,mBAAmB,kBACnB,gBACA,QACA,YACE;AAEJ,WAAQ,QAAR;IACE,KAAK,IACH,OAAM,IAAIC,uEAAsB,UAAU;IAE5C,KAAK,IACH,OAAM,IAAIC,+DAAkB;KAAE;KAAW;KAAS;KAAO,CAAC;IAE5D,KAAK,IACH,OAAM,IAAIC,sFAA6B;KACrC;KACA;KACA;KACA;KACD,CAAC;IAEJ,KAAK,IACH,OAAM,IAAIC,gEAAkB;KAC1B;KACA;KACA;KACA;KACD,CAAC;IAEJ,KAAK,KAAK;KACR,MAAM,aAAa,QAAQ,IAAI,cAAc;AAE7C,WAAM,IAAIC,mFACR,KAAK,SACL,WACA,aAAa,OAAO,WAAW,GAAG,KACnC;;IAEH,QACE,KAAIC,WAAS,iBACX,OAAM,IAAIC,yDACR,QACA,WACAD,SACA,kBACA,KACD;aACQ,QAAQ,OAGjB,OAAM,IAAIE,oEAAoB;KAC5B;KACA;KACA;KACA;KACD,CAAC;QAEF,OAAM,IAAIC,0EACR,QACA,KAAK,SACL,MACA,UACD"}

package/lib/workos.d.cts

@@ -4,6 +4,7 @@ import { PostOptions } from "./common/interfaces/post-options.interface.cjs";
 import { PutOptions } from "./common/interfaces/put-options.interface.cjs";
 import { WorkOSOptions } from "./common/interfaces/workos-options.interface.cjs";
 import { Actions } from "./actions/actions.cjs";
+import { PKCE } from "./pkce/pkce.cjs";
 import { DirectorySync } from "./directory-sync/directory-sync.cjs";
 import { Events } from "./events/events.cjs";
 import { Organizations } from "./organizations/organizations.cjs";
@@ -17,6 +18,7 @@ import { Mfa } from "./mfa/mfa.cjs";
 import { AuditLogs } from "./audit-logs/audit-logs.cjs";
 import { UserManagement } from "./user-management/user-management.cjs";
 import { FGA } from "./fga/fga.cjs";
+import { FeatureFlags } from "./feature-flags/feature-flags.cjs";
 import { HttpClient } from "./common/net/http-client.cjs";
 import { Widgets } from "./widgets/widgets.cjs";
 import { Vault } from "./vault/vault.cjs";
@@ -24,35 +26,62 @@ import { ApiKeys } from "./api-keys/api-keys.cjs";
 
 //#region src/workos.d.ts
 declare class WorkOS {
-  readonly key?: string | undefined;
-  readonly options: WorkOSOptions;
   readonly baseURL: string;
   readonly client: HttpClient;
   readonly clientId?: string;
+  readonly key?: string;
+  readonly options: WorkOSOptions;
+  readonly pkce: PKCE;
+  private readonly hasApiKey;
   readonly actions: Actions;
   readonly apiKeys: ApiKeys;
   readonly auditLogs: AuditLogs;
   readonly directorySync: DirectorySync;
+  readonly events: Events;
+  readonly featureFlags: FeatureFlags;
+  readonly fga: FGA;
+  readonly mfa: Mfa;
   readonly organizations: Organizations;
   readonly organizationDomains: OrganizationDomains;
   readonly passwordless: Passwordless;
   readonly pipes: Pipes;
   readonly portal: Portal;
   readonly sso: SSO;
-  readonly webhooks: Webhooks;
-  readonly mfa: Mfa;
-  readonly events: Events;
   readonly userManagement: UserManagement;
-  readonly fga: FGA;
-  readonly widgets: Widgets;
   readonly vault: Vault;
-  constructor(key?: string | undefined, options?: WorkOSOptions);
+  readonly webhooks: Webhooks;
+  readonly widgets: Widgets;
+  /**
+   * Create a new WorkOS client.
+   *
+   * @param keyOrOptions - API key string, or options object
+   * @param maybeOptions - Options when first argument is API key
+   *
+   * @example
+   * // Server-side with API key (string)
+   * const workos = new WorkOS('sk_...');
+   *
+   * @example
+   * // Server-side with API key (object)
+   * const workos = new WorkOS({ apiKey: 'sk_...', clientId: 'client_...' });
+   *
+   * @example
+   * // PKCE/public client (no API key)
+   * const workos = new WorkOS({ clientId: 'client_...' });
+   */
+  constructor(keyOrOptions?: string | WorkOSOptions, maybeOptions?: WorkOSOptions);
   private createUserAgent;
   createWebhookClient(): Webhooks;
   createActionsClient(): Actions;
   getCryptoProvider(): CryptoProvider;
   createHttpClient(options: WorkOSOptions, userAgent: string): HttpClient;
   get version(): string;
+  /**
+   * Require API key for methods that need it.
+   * @param methodName - Name of the method requiring API key (for error message)
+   * @throws ApiKeyRequiredException if no API key was provided
+   */
+  requireApiKey(methodName: string): void;
   post<Result = any, Entity = any>(path: string, entity: Entity, options?: PostOptions): Promise<{
     data: Result;
   }>;

package/lib/workos.d.ts

@@ -4,6 +4,7 @@ import { PostOptions } from "./common/interfaces/post-options.interface.js";
 import { PutOptions } from "./common/interfaces/put-options.interface.js";
 import { WorkOSOptions } from "./common/interfaces/workos-options.interface.js";
 import { Actions } from "./actions/actions.js";
+import { PKCE } from "./pkce/pkce.js";
 import { DirectorySync } from "./directory-sync/directory-sync.js";
 import { Events } from "./events/events.js";
 import { Organizations } from "./organizations/organizations.js";
@@ -17,6 +18,7 @@ import { Mfa } from "./mfa/mfa.js";
 import { AuditLogs } from "./audit-logs/audit-logs.js";
 import { UserManagement } from "./user-management/user-management.js";
 import { FGA } from "./fga/fga.js";
+import { FeatureFlags } from "./feature-flags/feature-flags.js";
 import { HttpClient } from "./common/net/http-client.js";
 import { Widgets } from "./widgets/widgets.js";
 import { Vault } from "./vault/vault.js";
@@ -24,35 +26,62 @@ import { ApiKeys } from "./api-keys/api-keys.js";
 
 //#region src/workos.d.ts
 declare class WorkOS {
-  readonly key?: string | undefined;
-  readonly options: WorkOSOptions;
   readonly baseURL: string;
   readonly client: HttpClient;
   readonly clientId?: string;
+  readonly key?: string;
+  readonly options: WorkOSOptions;
+  readonly pkce: PKCE;
+  private readonly hasApiKey;
   readonly actions: Actions;
   readonly apiKeys: ApiKeys;
   readonly auditLogs: AuditLogs;
   readonly directorySync: DirectorySync;
+  readonly events: Events;
+  readonly featureFlags: FeatureFlags;
+  readonly fga: FGA;
+  readonly mfa: Mfa;
   readonly organizations: Organizations;
   readonly organizationDomains: OrganizationDomains;
   readonly passwordless: Passwordless;
   readonly pipes: Pipes;
   readonly portal: Portal;
   readonly sso: SSO;
-  readonly webhooks: Webhooks;
-  readonly mfa: Mfa;
-  readonly events: Events;
   readonly userManagement: UserManagement;
-  readonly fga: FGA;
-  readonly widgets: Widgets;
   readonly vault: Vault;
-  constructor(key?: string | undefined, options?: WorkOSOptions);
+  readonly webhooks: Webhooks;
+  readonly widgets: Widgets;
+  /**
+   * Create a new WorkOS client.
+   *
+   * @param keyOrOptions - API key string, or options object
+   * @param maybeOptions - Options when first argument is API key
+   *
+   * @example
+   * // Server-side with API key (string)
+   * const workos = new WorkOS('sk_...');
+   *
+   * @example
+   * // Server-side with API key (object)
+   * const workos = new WorkOS({ apiKey: 'sk_...', clientId: 'client_...' });
+   *
+   * @example
+   * // PKCE/public client (no API key)
+   * const workos = new WorkOS({ clientId: 'client_...' });
+   */
+  constructor(keyOrOptions?: string | WorkOSOptions, maybeOptions?: WorkOSOptions);
   private createUserAgent;
   createWebhookClient(): Webhooks;
   createActionsClient(): Actions;
   getCryptoProvider(): CryptoProvider;
   createHttpClient(options: WorkOSOptions, userAgent: string): HttpClient;
   get version(): string;
+  /**
+   * Require API key for methods that need it.
+   * @param methodName - Name of the method requiring API key (for error message)
+   * @throws ApiKeyRequiredException if no API key was provided
+   */
+  requireApiKey(methodName: string): void;
   post<Result = any, Entity = any>(path: string, entity: Entity, options?: PostOptions): Promise<{
     data: Result;
   }>;