@workos-inc/node 8.0.0-rc.9 → 8.1.0

package/lib/check-options.serializer-7EswFQ_P.cjs

@@ -0,0 +1,69 @@
+const require_interface_check = require('./interface-check-CTSXH7TS.cjs');
+
+//#region src/fga/serializers/check-options.serializer.ts
+const serializeCheckOptions = (options) => ({
+	op: options.op,
+	checks: options.checks.map(serializeCheckWarrantOptions),
+	debug: options.debug
+});
+const serializeCheckBatchOptions = (options) => ({
+	op: "batch",
+	checks: options.checks.map(serializeCheckWarrantOptions),
+	debug: options.debug
+});
+const serializeCheckWarrantOptions = (warrant) => {
+	return {
+		resource_type: require_interface_check.isResourceInterface(warrant.resource) ? warrant.resource.getResourceType() : warrant.resource.resourceType,
+		resource_id: require_interface_check.isResourceInterface(warrant.resource) ? warrant.resource.getResourceId() : warrant.resource.resourceId ? warrant.resource.resourceId : "",
+		relation: warrant.relation,
+		subject: require_interface_check.isSubject(warrant.subject) ? {
+			resource_type: warrant.subject.resourceType,
+			resource_id: warrant.subject.resourceId
+		} : {
+			resource_type: warrant.subject.getResourceType(),
+			resource_id: warrant.subject.getResourceId()
+		},
+		context: warrant.context ?? {}
+	};
+};
+const deserializeDecisionTreeNode = (response) => {
+	return {
+		check: {
+			resource: {
+				resourceType: response.check.resource_type,
+				resourceId: response.check.resource_id
+			},
+			relation: response.check.relation,
+			subject: {
+				resourceType: response.check.subject.resource_type,
+				resourceId: response.check.subject.resource_id
+			},
+			context: response.check.context
+		},
+		policy: response.policy,
+		decision: response.decision,
+		processingTime: response.processing_time,
+		children: response.children.map(deserializeDecisionTreeNode)
+	};
+};
+
+//#endregion
+Object.defineProperty(exports, 'deserializeDecisionTreeNode', {
+  enumerable: true,
+  get: function () {
+    return deserializeDecisionTreeNode;
+  }
+});
+Object.defineProperty(exports, 'serializeCheckBatchOptions', {
+  enumerable: true,
+  get: function () {
+    return serializeCheckBatchOptions;
+  }
+});
+Object.defineProperty(exports, 'serializeCheckOptions', {
+  enumerable: true,
+  get: function () {
+    return serializeCheckOptions;
+  }
+});
+//# sourceMappingURL=check-options.serializer-7EswFQ_P.cjs.map

package/lib/check-options.serializer-7EswFQ_P.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"check-options.serializer-7EswFQ_P.cjs","names":["isResourceInterface","isSubject"],"sources":["../src/fga/serializers/check-options.serializer.ts"],"sourcesContent":["import {\n  CheckBatchOptions,\n  CheckOptions,\n  CheckWarrantOptions,\n  DecisionTreeNode,\n  DecisionTreeNodeResponse,\n  SerializedCheckBatchOptions,\n  SerializedCheckOptions,\n  SerializedCheckWarrantOptions,\n} from '../interfaces';\nimport { isSubject, isResourceInterface } from '../utils/interface-check';\n\nexport const serializeCheckOptions = (\n  options: CheckOptions,\n): SerializedCheckOptions => ({\n  op: options.op,\n  checks: options.checks.map(serializeCheckWarrantOptions),\n  debug: options.debug,\n});\n\nexport const serializeCheckBatchOptions = (\n  options: CheckBatchOptions,\n): SerializedCheckBatchOptions => ({\n  op: 'batch',\n  checks: options.checks.map(serializeCheckWarrantOptions),\n  debug: options.debug,\n});\n\nconst serializeCheckWarrantOptions = (\n  warrant: CheckWarrantOptions,\n): SerializedCheckWarrantOptions => {\n  return {\n    resource_type: isResourceInterface(warrant.resource)\n      ? warrant.resource.getResourceType()\n      : warrant.resource.resourceType,\n    resource_id: isResourceInterface(warrant.resource)\n      ? warrant.resource.getResourceId()\n      : warrant.resource.resourceId\n        ? warrant.resource.resourceId\n        : '',\n    relation: warrant.relation,\n    subject: isSubject(warrant.subject)\n      ? {\n          resource_type: warrant.subject.resourceType,\n          resource_id: warrant.subject.resourceId,\n        }\n      : {\n          resource_type: warrant.subject.getResourceType(),\n          resource_id: warrant.subject.getResourceId(),\n        },\n    context: warrant.context ?? {},\n  };\n};\n\nexport const deserializeDecisionTreeNode = (\n  response: DecisionTreeNodeResponse,\n): DecisionTreeNode => {\n  return {\n    check: {\n      resource: {\n        resourceType: response.check.resource_type,\n        resourceId: response.check.resource_id,\n      },\n      relation: response.check.relation,\n      subject: {\n        resourceType: response.check.subject.resource_type,\n        resourceId: response.check.subject.resource_id,\n      },\n      context: response.check.context,\n    },\n    policy: response.policy,\n    decision: response.decision,\n    processingTime: response.processing_time,\n    children: response.children.map(deserializeDecisionTreeNode),\n  };\n};\n"],"mappings":";;;AAYA,MAAa,yBACX,aAC4B;CAC5B,IAAI,QAAQ;CACZ,QAAQ,QAAQ,OAAO,IAAI,6BAA6B;CACxD,OAAO,QAAQ;CAChB;AAED,MAAa,8BACX,aACiC;CACjC,IAAI;CACJ,QAAQ,QAAQ,OAAO,IAAI,6BAA6B;CACxD,OAAO,QAAQ;CAChB;AAED,MAAM,gCACJ,YACkC;AAClC,QAAO;EACL,eAAeA,4CAAoB,QAAQ,SAAS,GAChD,QAAQ,SAAS,iBAAiB,GAClC,QAAQ,SAAS;EACrB,aAAaA,4CAAoB,QAAQ,SAAS,GAC9C,QAAQ,SAAS,eAAe,GAChC,QAAQ,SAAS,aACf,QAAQ,SAAS,aACjB;EACN,UAAU,QAAQ;EAClB,SAASC,kCAAU,QAAQ,QAAQ,GAC/B;GACE,eAAe,QAAQ,QAAQ;GAC/B,aAAa,QAAQ,QAAQ;GAC9B,GACD;GACE,eAAe,QAAQ,QAAQ,iBAAiB;GAChD,aAAa,QAAQ,QAAQ,eAAe;GAC7C;EACL,SAAS,QAAQ,WAAW,EAAE;EAC/B;;AAGH,MAAa,+BACX,aACqB;AACrB,QAAO;EACL,OAAO;GACL,UAAU;IACR,cAAc,SAAS,MAAM;IAC7B,YAAY,SAAS,MAAM;IAC5B;GACD,UAAU,SAAS,MAAM;GACzB,SAAS;IACP,cAAc,SAAS,MAAM,QAAQ;IACrC,YAAY,SAAS,MAAM,QAAQ;IACpC;GACD,SAAS,SAAS,MAAM;GACzB;EACD,QAAQ,SAAS;EACjB,UAAU,SAAS;EACnB,gBAAgB,SAAS;EACzB,UAAU,SAAS,SAAS,IAAI,4BAA4B;EAC7D"}

package/lib/check-options.serializer-BPqbwhK1.d.cts

@@ -0,0 +1,9 @@
+import { d as DecisionTreeNodeResponse, f as SerializedCheckBatchOptions, n as CheckOptions, p as SerializedCheckOptions, t as CheckBatchOptions, u as DecisionTreeNode } from "./check.interface-CYFe8m8j.cjs";
+
+//#region src/fga/serializers/check-options.serializer.d.ts
+declare const serializeCheckOptions: (options: CheckOptions) => SerializedCheckOptions;
+declare const serializeCheckBatchOptions: (options: CheckBatchOptions) => SerializedCheckBatchOptions;
+declare const deserializeDecisionTreeNode: (response: DecisionTreeNodeResponse) => DecisionTreeNode;
+//#endregion
+export { serializeCheckBatchOptions as n, serializeCheckOptions as r, deserializeDecisionTreeNode as t };
+//# sourceMappingURL=check-options.serializer-BPqbwhK1.d.cts.map

package/lib/check.interface-B2pzNanW.cjs

@@ -0,0 +1,33 @@
+const require_check_options_serializer = require('./check-options.serializer-7EswFQ_P.cjs');
+
+//#region src/fga/interfaces/check.interface.ts
+const CHECK_RESULT_AUTHORIZED = "authorized";
+var CheckResult = class {
+	result;
+	isImplicit;
+	warrantToken;
+	debugInfo;
+	warnings;
+	constructor(json) {
+		this.result = json.result;
+		this.isImplicit = json.is_implicit;
+		this.warrantToken = json.warrant_token;
+		this.debugInfo = json.debug_info ? {
+			processingTime: json.debug_info.processing_time,
+			decisionTree: require_check_options_serializer.deserializeDecisionTreeNode(json.debug_info.decision_tree)
+		} : void 0;
+		this.warnings = json.warnings;
+	}
+	isAuthorized() {
+		return this.result === CHECK_RESULT_AUTHORIZED;
+	}
+};
+
+//#endregion
+Object.defineProperty(exports, 'CheckResult', {
+  enumerable: true,
+  get: function () {
+    return CheckResult;
+  }
+});
+//# sourceMappingURL=check.interface-B2pzNanW.cjs.map

package/lib/check.interface-B2pzNanW.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"check.interface-B2pzNanW.cjs","names":["deserializeDecisionTreeNode"],"sources":["../src/fga/interfaces/check.interface.ts"],"sourcesContent":["import { ResourceInterface, ResourceOptions } from './resource.interface';\nimport { PolicyContext, SerializedSubject, Subject } from './warrant.interface';\nimport { CheckOp } from './check-op.enum';\nimport { PostOptions } from '../../common/interfaces';\nimport { deserializeDecisionTreeNode } from '../serializers/check-options.serializer';\nimport { Warning } from './warning.interface';\n\nconst CHECK_RESULT_AUTHORIZED = 'authorized';\n\nexport interface CheckWarrantOptions {\n  resource: ResourceInterface | ResourceOptions;\n  relation: string;\n  subject: ResourceInterface | Subject;\n  context?: PolicyContext;\n}\n\nexport interface SerializedCheckWarrantOptions {\n  resource_type: string;\n  resource_id: string;\n  relation: string;\n  subject: SerializedSubject;\n  context: PolicyContext;\n}\n\nexport interface CheckOptions {\n  op?: CheckOp;\n  checks: CheckWarrantOptions[];\n  debug?: boolean;\n}\n\nexport interface CheckBatchOptions {\n  checks: CheckWarrantOptions[];\n  debug?: boolean;\n}\n\nexport interface SerializedCheckOptions {\n  op?: CheckOp;\n  checks: SerializedCheckWarrantOptions[];\n  debug?: boolean;\n}\n\nexport interface SerializedCheckBatchOptions {\n  op: 'batch';\n  checks: SerializedCheckWarrantOptions[];\n  debug?: boolean;\n}\n\nexport interface CheckResultResponse {\n  result: string;\n  is_implicit: boolean;\n  warrant_token: string;\n  debug_info?: DebugInfoResponse;\n  warnings?: Warning[];\n}\n\nexport interface DebugInfo {\n  processingTime: number;\n  decisionTree: DecisionTreeNode;\n}\n\nexport interface DecisionTreeNode {\n  check: CheckWarrantOptions;\n  policy?: string;\n  decision: string;\n  processingTime: number;\n  children: DecisionTreeNode[];\n}\n\nexport interface DebugInfoResponse {\n  processing_time: number;\n  decision_tree: DecisionTreeNodeResponse;\n}\n\nexport interface DecisionTreeNodeResponse {\n  check: SerializedCheckWarrantOptions;\n  policy?: string;\n  decision: string;\n  processing_time: number;\n  children: DecisionTreeNodeResponse[];\n}\n\nexport interface CheckResultInterface {\n  result: string;\n  isImplicit: boolean;\n  warrantToken: string;\n  debugInfo?: DebugInfo;\n  warnings?: Warning[];\n}\n\nexport class CheckResult implements CheckResultInterface {\n  public result: string;\n  public isImplicit: boolean;\n  public warrantToken: string;\n  public debugInfo?: DebugInfo;\n  public warnings?: Warning[];\n\n  constructor(json: CheckResultResponse) {\n    this.result = json.result;\n    this.isImplicit = json.is_implicit;\n    this.warrantToken = json.warrant_token;\n    this.debugInfo = json.debug_info\n      ? {\n          processingTime: json.debug_info.processing_time,\n          decisionTree: deserializeDecisionTreeNode(\n            json.debug_info.decision_tree,\n          ),\n        }\n      : undefined;\n    this.warnings = json.warnings;\n  }\n\n  isAuthorized(): boolean {\n    return this.result === CHECK_RESULT_AUTHORIZED;\n  }\n}\n\nexport type CheckRequestOptions = Pick<PostOptions, 'warrantToken'>;\n"],"mappings":";;;AAOA,MAAM,0BAA0B;AAkFhC,IAAa,cAAb,MAAyD;CACvD,AAAO;CACP,AAAO;CACP,AAAO;CACP,AAAO;CACP,AAAO;CAEP,YAAY,MAA2B;AACrC,OAAK,SAAS,KAAK;AACnB,OAAK,aAAa,KAAK;AACvB,OAAK,eAAe,KAAK;AACzB,OAAK,YAAY,KAAK,aAClB;GACE,gBAAgB,KAAK,WAAW;GAChC,cAAcA,6DACZ,KAAK,WAAW,cACjB;GACF,GACD;AACJ,OAAK,WAAW,KAAK;;CAGvB,eAAwB;AACtB,SAAO,KAAK,WAAW"}

package/lib/check.interface-CYFe8m8j.d.cts

@@ -0,0 +1,88 @@
+import { t as PostOptions } from "./post-options.interface-DdsVDnGH.cjs";
+import { t as CheckOp } from "./check-op.enum-BwJZx-i9.cjs";
+import { c as ResourceInterface, l as ResourceOptions } from "./resource.interface-BHXuymiW.cjs";
+import { a as SerializedSubject, r as PolicyContext, s as Subject } from "./warrant.interface-D0zCmerc.cjs";
+import { r as Warning } from "./warning.interface-BVeaQsw5.cjs";
+
+//#region src/fga/interfaces/check.interface.d.ts
+interface CheckWarrantOptions {
+  resource: ResourceInterface | ResourceOptions;
+  relation: string;
+  subject: ResourceInterface | Subject;
+  context?: PolicyContext;
+}
+interface SerializedCheckWarrantOptions {
+  resource_type: string;
+  resource_id: string;
+  relation: string;
+  subject: SerializedSubject;
+  context: PolicyContext;
+}
+interface CheckOptions {
+  op?: CheckOp;
+  checks: CheckWarrantOptions[];
+  debug?: boolean;
+}
+interface CheckBatchOptions {
+  checks: CheckWarrantOptions[];
+  debug?: boolean;
+}
+interface SerializedCheckOptions {
+  op?: CheckOp;
+  checks: SerializedCheckWarrantOptions[];
+  debug?: boolean;
+}
+interface SerializedCheckBatchOptions {
+  op: 'batch';
+  checks: SerializedCheckWarrantOptions[];
+  debug?: boolean;
+}
+interface CheckResultResponse {
+  result: string;
+  is_implicit: boolean;
+  warrant_token: string;
+  debug_info?: DebugInfoResponse;
+  warnings?: Warning[];
+}
+interface DebugInfo {
+  processingTime: number;
+  decisionTree: DecisionTreeNode;
+}
+interface DecisionTreeNode {
+  check: CheckWarrantOptions;
+  policy?: string;
+  decision: string;
+  processingTime: number;
+  children: DecisionTreeNode[];
+}
+interface DebugInfoResponse {
+  processing_time: number;
+  decision_tree: DecisionTreeNodeResponse;
+}
+interface DecisionTreeNodeResponse {
+  check: SerializedCheckWarrantOptions;
+  policy?: string;
+  decision: string;
+  processing_time: number;
+  children: DecisionTreeNodeResponse[];
+}
+interface CheckResultInterface {
+  result: string;
+  isImplicit: boolean;
+  warrantToken: string;
+  debugInfo?: DebugInfo;
+  warnings?: Warning[];
+}
+declare class CheckResult implements CheckResultInterface {
+  result: string;
+  isImplicit: boolean;
+  warrantToken: string;
+  debugInfo?: DebugInfo;
+  warnings?: Warning[];
+  constructor(json: CheckResultResponse);
+  isAuthorized(): boolean;
+}
+type CheckRequestOptions = Pick<PostOptions, 'warrantToken'>;
+//#endregion
+export { CheckResultInterface as a, DebugInfo as c, DecisionTreeNodeResponse as d, SerializedCheckBatchOptions as f, CheckResult as i, DebugInfoResponse as l, SerializedCheckWarrantOptions as m, CheckOptions as n, CheckResultResponse as o, SerializedCheckOptions as p, CheckRequestOptions as r, CheckWarrantOptions as s, CheckBatchOptions as t, DecisionTreeNode as u };
+//# sourceMappingURL=check.interface-CYFe8m8j.d.cts.map

package/lib/common/crypto/crypto-provider.cjs

@@ -1,13 +1,3 @@
+const require_crypto_provider = require('../../crypto-provider-C895awiY.cjs');
 
-//#region src/common/crypto/crypto-provider.ts
-/**
-* Interface encapsulating the various crypto computations used by the library,
-* allowing pluggable underlying crypto implementations.
-*/
-var CryptoProvider = class {
-	encoder = new TextEncoder();
-};
-
-//#endregion
-exports.CryptoProvider = CryptoProvider;
-//# sourceMappingURL=crypto-provider.cjs.map
+exports.CryptoProvider = require_crypto_provider.CryptoProvider;

package/lib/common/crypto/crypto-provider.d.cts

@@ -1,75 +1,2 @@
-//#region src/common/crypto/crypto-provider.d.ts
-/**
- * Interface encapsulating the various crypto computations used by the library,
- * allowing pluggable underlying crypto implementations.
- */
-declare abstract class CryptoProvider {
-  encoder: TextEncoder;
-  /**
-   * Computes a SHA-256 HMAC given a secret and a payload (encoded in UTF-8).
-   * The output HMAC should be encoded in hexadecimal.
-   *
-   * Sample values for implementations:
-   * - computeHMACSignature('', 'test_secret') => 'f7f9bd47fb987337b5796fdc1fdb9ba221d0d5396814bfcaf9521f43fd8927fd'
-   * - computeHMACSignature('\ud83d\ude00', 'test_secret') => '837da296d05c4fe31f61d5d7ead035099d9585a5bcde87de952012a78f0b0c43
-   */
-  abstract computeHMACSignature(payload: string, secret: string): string;
-  /**
-   * Asynchronous version of `computeHMACSignature`. Some implementations may
-   * only allow support async signature computation.
-   *
-   * Computes a SHA-256 HMAC given a secret and a payload (encoded in UTF-8).
-   * The output HMAC should be encoded in hexadecimal.
-   *
-   * Sample values for implementations:
-   * - computeHMACSignature('', 'test_secret') => 'f7f9bd47fb987337b5796fdc1fdb9ba221d0d5396814bfcaf9521f43fd8927fd'
-   * - computeHMACSignature('\ud83d\ude00', 'test_secret') => '837da296d05c4fe31f61d5d7ead035099d9585a5bcde87de952012a78f0b0c43
-   */
-  abstract computeHMACSignatureAsync(payload: string, secret: string): Promise<string>;
-  /**
-   * Cryptographically determine whether two signatures are equal
-   */
-  abstract secureCompare(stringA: string, stringB: string): Promise<boolean>;
-  /**
-   * Encrypts data using AES-256-GCM algorithm.
-   *
-   * @param plaintext The data to encrypt
-   * @param key The encryption key (should be 32 bytes for AES-256)
-   * @param iv Optional initialization vector (if not provided, a random one will be generated)
-   * @param aad Optional additional authenticated data
-   * @returns Object containing the encrypted ciphertext, the IV used, and the authentication tag
-   */
-  abstract encrypt(plaintext: Uint8Array, key: Uint8Array, iv?: Uint8Array, aad?: Uint8Array): Promise<{
-    ciphertext: Uint8Array;
-    iv: Uint8Array;
-    tag: Uint8Array;
-  }>;
-  /**
-   * Decrypts data that was encrypted using AES-256-GCM algorithm.
-   *
-   * @param ciphertext The encrypted data
-   * @param key The decryption key (must be the same key used for encryption)
-   * @param iv The initialization vector used during encryption
-   * @param tag The authentication tag produced during encryption
-   * @param aad Optional additional authenticated data (must match what was used during encryption)
-   * @returns The decrypted data
-   * @throws Will throw an error if authentication fails or the data has been tampered with
-   */
-  abstract decrypt(ciphertext: Uint8Array, key: Uint8Array, iv: Uint8Array, tag: Uint8Array, aad?: Uint8Array): Promise<Uint8Array>;
-  /**
-   * Generates cryptographically secure random bytes.
-   *
-   * @param length The number of random bytes to generate
-   * @returns A Uint8Array containing the random bytes
-   */
-  abstract randomBytes(length: number): Uint8Array;
-  /**
-   * Generates a random UUID v4 string.
-   *
-   * @returns A UUID v4 string in the format xxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxx
-   */
-  abstract randomUUID(): string;
-}
-//#endregion
-export { CryptoProvider };
-//# sourceMappingURL=crypto-provider.d.cts.map
+import { t as CryptoProvider } from "../../crypto-provider-CIbAgUc-.cjs";
+export { CryptoProvider };

package/lib/common/crypto/seal.cjs

@@ -1,44 +1,4 @@
-const require_index = require('../../node_modules/iron-webcrypto/index.cjs');
+const require_seal = require('../../seal-Dl5Et6Vv.cjs');
 
-//#region src/common/crypto/seal.ts
-const VERSION_DELIMITER = "~";
-const CURRENT_MAJOR_VERSION = 2;
-function parseSeal(seal$1) {
-	const [sealWithoutVersion = "", tokenVersionAsString] = seal$1.split(VERSION_DELIMITER);
-	return {
-		sealWithoutVersion,
-		tokenVersion: tokenVersionAsString == null ? null : parseInt(tokenVersionAsString, 10)
-	};
-}
-async function sealData(data, { password }) {
-	return `${await require_index.seal(data, {
-		id: "1",
-		secret: password
-	}, {
-		...require_index.defaults,
-		ttl: 0,
-		encode: JSON.stringify
-	})}${VERSION_DELIMITER}${CURRENT_MAJOR_VERSION}`;
-}
-async function unsealData(encryptedData, { password }) {
-	const { sealWithoutVersion, tokenVersion } = parseSeal(encryptedData);
-	const passwordMap = { 1: password };
-	let data;
-	try {
-		data = await require_index.unseal(sealWithoutVersion, passwordMap, {
-			...require_index.defaults,
-			ttl: 0
-		}) ?? {};
-	} catch (error) {
-		if (error instanceof Error && /^(Expired seal|Bad hmac value|Cannot find password|Incorrect number of sealed components|Wrong mac prefix)/.test(error.message)) return {};
-		throw error;
-	}
-	if (tokenVersion === 2) return data;
-	else if (tokenVersion !== null) return data.persistent ?? data;
-	return data;
-}
-
-//#endregion
-exports.sealData = sealData;
-exports.unsealData = unsealData;
-//# sourceMappingURL=seal.cjs.map
+exports.sealData = require_seal.sealData;
+exports.unsealData = require_seal.unsealData;

package/lib/common/crypto/seal.js

@@ -1,4 +1,4 @@
-import { defaults, seal, unseal } from "../../node_modules/iron-webcrypto/index.js";
+import { defaults, seal, unseal } from "iron-webcrypto";
 
 //#region src/common/crypto/seal.ts
 const VERSION_DELIMITER = "~";

package/lib/common/crypto/signature-provider.cjs

@@ -1,33 +1,3 @@
-const require_common_exceptions_signature_verification_exception = require('../exceptions/signature-verification.exception.cjs');
+const require_signature_provider = require('../../signature-provider-Dx4cy5vI.cjs');
 
-//#region src/common/crypto/signature-provider.ts
-var SignatureProvider = class {
-	cryptoProvider;
-	constructor(cryptoProvider) {
-		this.cryptoProvider = cryptoProvider;
-	}
-	async verifyHeader({ payload, sigHeader, secret, tolerance = 18e4 }) {
-		const [timestamp, signatureHash] = this.getTimestampAndSignatureHash(sigHeader);
-		if (!signatureHash || Object.keys(signatureHash).length === 0) throw new require_common_exceptions_signature_verification_exception.SignatureVerificationException("No signature hash found with expected scheme v1");
-		if (parseInt(timestamp, 10) < Date.now() - tolerance) throw new require_common_exceptions_signature_verification_exception.SignatureVerificationException("Timestamp outside the tolerance zone");
-		const expectedSig = await this.computeSignature(timestamp, payload, secret);
-		if (await this.cryptoProvider.secureCompare(expectedSig, signatureHash) === false) throw new require_common_exceptions_signature_verification_exception.SignatureVerificationException("Signature hash does not match the expected signature hash for payload");
-		return true;
-	}
-	getTimestampAndSignatureHash(sigHeader) {
-		const [t, v1] = sigHeader.split(",");
-		if (typeof t === "undefined" || typeof v1 === "undefined") throw new require_common_exceptions_signature_verification_exception.SignatureVerificationException("Signature or timestamp missing");
-		const { 1: timestamp } = t.split("=");
-		const { 1: signatureHash } = v1.split("=");
-		return [timestamp, signatureHash];
-	}
-	async computeSignature(timestamp, payload, secret) {
-		payload = JSON.stringify(payload);
-		const signedPayload = `${timestamp}.${payload}`;
-		return await this.cryptoProvider.computeHMACSignatureAsync(signedPayload, secret);
-	}
-};
-
-//#endregion
-exports.SignatureProvider = SignatureProvider;
-//# sourceMappingURL=signature-provider.cjs.map
+exports.SignatureProvider = require_signature_provider.SignatureProvider;

package/lib/common/crypto/signature-provider.d.cts

@@ -1,4 +1,4 @@
-import { CryptoProvider } from "./crypto-provider.cjs";
+import { t as CryptoProvider } from "../../crypto-provider-CIbAgUc-.cjs";
 
 //#region src/common/crypto/signature-provider.d.ts
 declare class SignatureProvider {

package/lib/common/crypto/subtle-crypto-provider.cjs

@@ -1,94 +1,3 @@
-const require_common_crypto_crypto_provider = require('./crypto-provider.cjs');
+const require_subtle_crypto_provider = require('../../subtle-crypto-provider-z15sJdtL.cjs');
 
-//#region src/common/crypto/subtle-crypto-provider.ts
-/**
-* `CryptoProvider which uses the SubtleCrypto interface of the Web Crypto API.
-*
-* This only supports asynchronous operations.
-*/
-var SubtleCryptoProvider = class extends require_common_crypto_crypto_provider.CryptoProvider {
-	subtleCrypto;
-	constructor(subtleCrypto) {
-		super();
-		this.subtleCrypto = subtleCrypto || crypto.subtle;
-	}
-	computeHMACSignature(_payload, _secret) {
-		throw new Error("SubleCryptoProvider cannot be used in a synchronous context.");
-	}
-	/** @override */
-	async computeHMACSignatureAsync(payload, secret) {
-		const encoder = new TextEncoder();
-		const key = await this.subtleCrypto.importKey("raw", encoder.encode(secret), {
-			name: "HMAC",
-			hash: { name: "SHA-256" }
-		}, false, ["sign"]);
-		const signatureBuffer = await this.subtleCrypto.sign("hmac", key, encoder.encode(payload));
-		const signatureBytes = new Uint8Array(signatureBuffer);
-		const signatureHexCodes = new Array(signatureBytes.length);
-		for (let i = 0; i < signatureBytes.length; i++) signatureHexCodes[i] = byteHexMapping[signatureBytes[i]];
-		return signatureHexCodes.join("");
-	}
-	/** @override */
-	async secureCompare(stringA, stringB) {
-		const bufferA = this.encoder.encode(stringA);
-		const bufferB = this.encoder.encode(stringB);
-		if (bufferA.length !== bufferB.length) return false;
-		const algorithm = {
-			name: "HMAC",
-			hash: "SHA-256"
-		};
-		const key = await crypto.subtle.generateKey(algorithm, false, ["sign", "verify"]);
-		const hmac = await crypto.subtle.sign(algorithm, key, bufferA);
-		return await crypto.subtle.verify(algorithm, key, hmac, bufferB);
-	}
-	async encrypt(plaintext, key, iv, aad) {
-		const actualIv = iv || crypto.getRandomValues(new Uint8Array(32));
-		const cryptoKey = await this.subtleCrypto.importKey("raw", key, { name: "AES-GCM" }, false, ["encrypt"]);
-		const encryptParams = {
-			name: "AES-GCM",
-			iv: actualIv
-		};
-		if (aad) encryptParams.additionalData = aad;
-		const encryptedData = await this.subtleCrypto.encrypt(encryptParams, cryptoKey, plaintext);
-		const encryptedBytes = new Uint8Array(encryptedData);
-		const tagStart = encryptedBytes.length - 16;
-		const tag = encryptedBytes.slice(tagStart);
-		return {
-			ciphertext: encryptedBytes.slice(0, tagStart),
-			iv: actualIv,
-			tag
-		};
-	}
-	async decrypt(ciphertext, key, iv, tag, aad) {
-		const combinedData = new Uint8Array(ciphertext.length + tag.length);
-		combinedData.set(ciphertext, 0);
-		combinedData.set(tag, ciphertext.length);
-		const cryptoKey = await this.subtleCrypto.importKey("raw", key, { name: "AES-GCM" }, false, ["decrypt"]);
-		const decryptParams = {
-			name: "AES-GCM",
-			iv
-		};
-		if (aad) decryptParams.additionalData = aad;
-		const decryptedData = await this.subtleCrypto.decrypt(decryptParams, cryptoKey, combinedData);
-		return new Uint8Array(decryptedData);
-	}
-	randomBytes(length) {
-		const bytes = new Uint8Array(length);
-		crypto.getRandomValues(bytes);
-		return bytes;
-	}
-	randomUUID() {
-		if (typeof crypto !== "undefined" && typeof crypto.randomUUID === "function") return crypto.randomUUID();
-		const bytes = this.randomBytes(16);
-		bytes[6] = bytes[6] & 15 | 64;
-		bytes[8] = bytes[8] & 63 | 128;
-		const hex = Array.from(bytes, (b) => byteHexMapping[b]).join("");
-		return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20)}`;
-	}
-};
-const byteHexMapping = new Array(256);
-for (let i = 0; i < byteHexMapping.length; i++) byteHexMapping[i] = i.toString(16).padStart(2, "0");
-
-//#endregion
-exports.SubtleCryptoProvider = SubtleCryptoProvider;
-//# sourceMappingURL=subtle-crypto-provider.cjs.map
+exports.SubtleCryptoProvider = require_subtle_crypto_provider.SubtleCryptoProvider;

package/lib/common/crypto/subtle-crypto-provider.d.cts

@@ -1,4 +1,4 @@
-import { CryptoProvider } from "./crypto-provider.cjs";
+import { t as CryptoProvider } from "../../crypto-provider-CIbAgUc-.cjs";
 
 //#region src/common/crypto/subtle-crypto-provider.d.ts
 

package/lib/common/exceptions/api-key-required.exception.cjs

@@ -1,15 +1,3 @@
+const require_api_key_required_exception = require('../../api-key-required.exception-hy_QT4YB.cjs');
 
-//#region src/common/exceptions/api-key-required.exception.ts
-var ApiKeyRequiredException = class extends Error {
-	status = 403;
-	name = "ApiKeyRequiredException";
-	path;
-	constructor(path) {
-		super(`API key required for "${path}". For server-side apps, initialize with: new WorkOS("sk_..."). For browser/mobile/CLI apps, use authenticateWithCodeAndVerifier() and authenticateWithRefreshToken() which work without an API key.`);
-		this.path = path;
-	}
-};
-
-//#endregion
-exports.ApiKeyRequiredException = ApiKeyRequiredException;
-//# sourceMappingURL=api-key-required.exception.cjs.map
+exports.ApiKeyRequiredException = require_api_key_required_exception.ApiKeyRequiredException;

package/lib/common/exceptions/api-key-required.exception.d.cts

@@ -1,10 +1,2 @@
-//#region src/common/exceptions/api-key-required.exception.d.ts
-declare class ApiKeyRequiredException extends Error {
-  readonly status = 403;
-  readonly name = "ApiKeyRequiredException";
-  readonly path: string;
-  constructor(path: string);
-}
-//#endregion
-export { ApiKeyRequiredException };
-//# sourceMappingURL=api-key-required.exception.d.cts.map
+import { t as ApiKeyRequiredException } from "../../api-key-required.exception-B3Qy27bt.cjs";
+export { ApiKeyRequiredException };

package/lib/common/exceptions/bad-request.exception.cjs

@@ -1,21 +1,3 @@
+const require_bad_request_exception = require('../../bad-request.exception-BmjHrQEZ.cjs');
 
-//#region src/common/exceptions/bad-request.exception.ts
-var BadRequestException = class extends Error {
-	status = 400;
-	name = "BadRequestException";
-	message = "Bad request";
-	code;
-	errors;
-	requestID;
-	constructor({ code, errors, message, requestID }) {
-		super();
-		this.requestID = requestID;
-		if (message) this.message = message;
-		if (code) this.code = code;
-		if (errors) this.errors = errors;
-	}
-};
-
-//#endregion
-exports.BadRequestException = BadRequestException;
-//# sourceMappingURL=bad-request.exception.cjs.map
+exports.BadRequestException = require_bad_request_exception.BadRequestException;

package/lib/common/exceptions/bad-request.exception.d.cts

@@ -1,25 +1,2 @@
-import { RequestException } from "../interfaces/request-exception.interface.cjs";
-
-//#region src/common/exceptions/bad-request.exception.d.ts
-declare class BadRequestException extends Error implements RequestException {
-  readonly status = 400;
-  readonly name = "BadRequestException";
-  readonly message: string;
-  readonly code?: string;
-  readonly errors?: unknown[];
-  readonly requestID: string;
-  constructor({
-    code,
-    errors,
-    message,
-    requestID
-  }: {
-    code?: string;
-    errors?: unknown[];
-    message?: string;
-    requestID: string;
-  });
-}
-//#endregion
-export { BadRequestException };
-//# sourceMappingURL=bad-request.exception.d.cts.map
+import { t as BadRequestException } from "../../bad-request.exception-KjLJBnk8.cjs";
+export { BadRequestException };

package/lib/common/exceptions/conflict.exception.cjs

@@ -1,18 +1,3 @@
+const require_conflict_exception = require('../../conflict.exception-CN3a7Qrw.cjs');
 
-//#region src/common/exceptions/conflict.exception.ts
-var ConflictException = class extends Error {
-	status = 409;
-	name = "ConflictException";
-	requestID;
-	constructor({ error, message, requestID }) {
-		super();
-		this.requestID = requestID;
-		if (message) this.message = message;
-		else if (error) this.message = `Error: ${error}`;
-		else this.message = `An conflict has occurred on the server.`;
-	}
-};
-
-//#endregion
-exports.ConflictException = ConflictException;
-//# sourceMappingURL=conflict.exception.cjs.map
+exports.ConflictException = require_conflict_exception.ConflictException;

package/lib/common/exceptions/conflict.exception.d.cts

@@ -1,4 +1,4 @@
-import { RequestException } from "../interfaces/request-exception.interface.cjs";
+import { t as RequestException } from "../../request-exception.interface-ncoDfVCo.cjs";
 
 //#region src/common/exceptions/conflict.exception.d.ts
 declare class ConflictException extends Error implements RequestException {

package/lib/common/exceptions/generic-server.exception.cjs

@@ -1,17 +1,3 @@
+const require_generic_server_exception = require('../../generic-server.exception-CQ1bI6ng.cjs');
 
-//#region src/common/exceptions/generic-server.exception.ts
-var GenericServerException = class extends Error {
-	name = "GenericServerException";
-	message = "The request could not be completed.";
-	constructor(status, message, rawData, requestID) {
-		super();
-		this.status = status;
-		this.rawData = rawData;
-		this.requestID = requestID;
-		if (message) this.message = message;
-	}
-};
-
-//#endregion
-exports.GenericServerException = GenericServerException;
-//# sourceMappingURL=generic-server.exception.cjs.map
+exports.GenericServerException = require_generic_server_exception.GenericServerException;